Archive | August, 2011

Hackers Get Hold Of Wildcard Google SSL Certificate – Could Hijack Gmail Accounts

Cybertroopers storming your ship?


One of the big discussions points this week is about a wildcard cert for Google that has leaked out from a Dutch company called DigiNotar. The certificate is good for all Google domains – it’s a *.google.com cert.

This is bad news and apparently has been in the wild for a while, some people are linking to deaths in Iran as the cert could be used to hijack Gmail accounts using a MITM attack.

If you want to check out the cert directly, you can do so here:

Gmail.com SSL MITM ATTACK BY Iranian Government – 27/8/2011

The story seems to originate here where a user in Iran noticed a MITM was being perpetrated on him – probably by his own ISP or government.

Is This MITM Attack to Gmail’s SSL ?

Hackers have obtained a digital certificate good for any Google website from a Dutch certificate provider, a security researcher said today. Criminals could use the certificate to conduct “man-in-the-middle” attacks targeting users of Gmail, Google’s search engine or any other service operated by the Mountain View, Calif. company.

“This is a wildcard for any of the Google domains,” said Roel Schouwenberg, senior malware researcher with Kaspersky Lab, in an email interview Monday.

“[Attackers] could poison DNS, present their site with the fake cert and bingo, they have the user’s credentials,” said Andrew Storms, director of security operations at nCircle Security.

Man-in-the-middle attacks could also be launched via spam messages with links leading to a site posing as, say, the real Gmail. If recipients surfed to that link, their account login username and password could be hijacked. Details of the certificate were posted on Pastebin.com last Saturday. Pastebin.com is a public site where developers — including hackers — often post source code samples.

According to Schouwenberg, the SSL (secure socket layer) certificate is valid, and was issued by DigiNotar, a Dutch certificate authority, or CA. DigiNotar was acquired earlier this year by Chicago-based Vasco, which bills itself on its site as “a world leader in strong authentication.”

Vasco did not reply to a request for comment.

The cert is valid, which is scary. One thing which is currently unknown is how the cert got out there, if it was a hack or a leak or someone from the outside got access to the DigiNotar CA.

If you want more technical details on how to verify the cert, you can check this out:

Internet death sentence for DigiNotar’s Root CA!


Security researcher and Tor developer Jacob Applebaum confirmed that the certificate was valid in an email answer to Computerworld questions, as did noted SSL researcher Moxie Marlinspike on Twitter. “Yep, just verified the signature, that pastebin *.google.com certificate is real,” said Marlinspike .

Because the certificate is valid, a browser would not display a warning message if its user went to a website signed with the certificate.

It’s unclear whether the certificate was obtained because of a lack of oversight by DigiNotar or through a breach of the company’s certificate issuing website.

Schouwenberg urged the company to provide more information as soon as possible.

“Given their ties to the government and financial sectors it’s extremely important we find out the scope of the breach as quickly as possible,” Schouwenberg said. The situation was reminiscent of a breach last March, when a hacker obtained certificates for some of the Web’s biggest sites, including Google and Gmail, Microsoft, Skype and Yahoo.

Then, Comodo said that nine certificates had been fraudulently issued after attackers used an account assigned to a company partner in southern Europe.

Initially, Comodo argued that Iran’s government may have been involved in the theft. Days later, however, a solo Iranian hacker claimed responsibility for stealing the SSL certificates.

Today, Kaspersky’s Schouwenberg said “nation-state involvement is the most plausible explanation” for the acquisition of the DigiNotar-issued certificate.

Google have also mentioned in on their security blog here:

Today we received reports of attempted SSL man-in-the-middle (MITM) attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The attacker used a fraudulent SSL certificate issued by DigiNotar, a root certificate authority that should not issue certificates for Google (and has since revoked it).

An update on attempted man-in-the-middle attacks

There was also quick action taken by both Mozilla and Microsoft.

It’s been pretty quiet really to say this is really a major issue, I hope more details come out about how this occurred. If you are using Firefox there are instructions on how to delete/distrust the DigiNotar CA here.

Source: Network World


Posted in: Exploits/Vulnerabilities, Legal Issues, Privacy

Tags: , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Legal Issues, Privacy | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,312 views
- AJAX: Is your application secure enough? - 120,023 views
- eEye Launches 0-Day Exploit Tracker - 85,478 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


WebSurgery – Web Application Security Testing Suite

Cybertroopers storming your ship?


WebSurgery is a suite of tools for security testing of web applications. It was designed for security auditors to help them with the web application planning and exploitation. Currently, it uses an efficient, fast and stable Web Crawler, File/Dir Brute forcer, Fuzzer for advanced exploitation of known and unusual vulnerabilities such as SQL Injection, Cross site scripting (XSS), Brute force for login forms, identification of firewall-filtered rules, DOS Attacks and WEB Proxy to analyze, intercept and manipulate the traffic between your browser and the target web application.

WEB Crawler

WEB Crawler was designed to be fast, accurate, stable, completely parametrable and the use of advanced techniques to extract links from Javascript and HTML Tags. It works with parametrable timing settings (Timeout, Threading, Max Data Size, Retries) and a number of rules parameters to prevent infinitive loops and pointless scanning (Case Sensitive, Dir Depth, Process Above/Below, Submit Forms, Fetch Indexes/Sitemaps, Max Requests per File/Script Parameters). It is also possible to apply custom headers (user agent, cookies etc) and Include/Exclude Filters. WEB Crawler come with an embedded File/Dir Brute Forcer which helps to directly brute force for files/dirs in the directories found from crawling.

WEB Bruteforcer

WEB Bruteforcer is a brute forcer for files and directories within the web application which helps to identify the hidden structure. It is also multi-threaded and completely parametrable for timing settings (Timeout, Threading, Max Data Size, Retries) and rules (Headers, Base Dir, Brute force Dirs/Files, Recursive, File’s Extension, Send GET/HEAD, Follow Redirects, Process Cookies and List generator configuration).
By default, it will brute force from root / base dir recursively for both files and directories. It sends both HEAD and GET requests when it needs it (HEAD to identify if the file/dir exists and then GET to retrieve the full response).


WEB Fuzzer

WEB Fuzzer is a more advanced tool to create a number of requests based on one initial request. Fuzzer has no limits and can be used to exploit known vulnerabilities such (blind) SQL Inections and more unsual ways such identifing improper input handling, firewall/filtering rules, DOS Attacks.

WEB Editor

A simple WEB Editor to send individual requests. It also contains a HEX Editor for more advanced requests.

WEB Proxy

WEB Proxy is a proxy server running locally and will allow you to analyze, intercept and manipulate HTTP/HTTPS requests coming from your browser or other application which support proxies.

You can download WebSurgery here:

Setup – setup.msi
Portable – websurgery.zip

Or read more here.


Posted in: Hacking Tools, Web Hacking

Tags: , , , , , , , , , ,

Posted in: Hacking Tools, Web Hacking | Add a Comment
Recent in Hacking Tools:
- The Backdoor Factory (BDF) – Patch Binaries With Shellcode
- Gdog – Python Windows Backdoor With Gmail Command & Control
- SPF (SpeedPhish Framework) – E-mail Phishing Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,972,741 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,398,749 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 675,626 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Stealing ATM Pin Numbers Using Thermal Imaging Cameras

Cybertroopers storming your ship?


Now this is a really neat bit of hardware hacking, it’s been a while since we’ve reported on any kind of ATM Skimming or ATM Hacking stories.

You may remember back in November 2010 – European Banks Seeing New Wave Of ATM Skimming or way back in 2008 when Pro ATM Hacker ‘Chao’ Gives Out ATM Hacking Tips.

The latest is this neat hack that came out of a method outlined by Michal Zalewski back in 2005:

Cracking safes with thermal imaging

Security researchers have found that thermal cameras can be combined with computer algorithms to automate the process of stealing payment card data processed by automatic teller machines.

At the Usenix Security Symposium in San Francisco last week, the researchers said the technique has advantages over more common ATM skimming methods that use traditional cameras to capture the PINs people enter during transactions. That’s because customers often obscure a camera’s view with their bodies, either inadvertently or on purpose. What’s more, it can take a considerable amount of time for crooks to view the captured footage and log the code entered during each session.

Thermal imaging can vastly improve the process by recovering the code for some time after each PIN is entered. Their output can also be processed by an algorithm that automates the process of translating it into the secret code.

The hack works extremely efficiently on ATMs using plastic keypads, it will not work on metal keypads and this method works up to 60 seconds after you’ve used the ATM.

I’m not sure about you guys but all the ATMs I’ve seen here are using metal keypads, so it wouldn’t work too well over here.

Either way it’s a fairly cool hack and I’m glad to see, so far there’s no proof of thieves using it in the wild.


The findings expand on 2005 research from Michal Zalewski, who is now a member of Google’s security team. The Usenix presenters tested the technique laid out by Zalewski on 21 subjects who used 27 randomly selected PINs and found the rate of success varied depending on variables including the types of keypads and the subjects’ body temperature.

“In summary, while we document that post-hoc thermal imaging attacks are feasible and automatable, we also find that the window of vulnerability is far more modest than some feared and that there are simple counter-measures (i.e., deploying keypads with high thermal conductivity) that can shrink this vulnerability further still,” the researchers wrote.

I wonder if we’ll see a spate of real life attacks based around this technique now the paper has been published publicly.

You can grab the paper discussing the technique here: Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks [PDF].

Source: The Register


Posted in: Hardware Hacking, Privacy

Tags: , , , , , , , , , , ,

Posted in: Hardware Hacking, Privacy | Add a Comment
Recent in Hardware Hacking:
- Kid Gets Arrested For Building A Clock – World Goes NUTS
- The Jeep HACK – What You Need To Know
- Rowhammer – DDR3 Exploit – What You Need To Know

Related Posts:

Most Read in Hardware Hacking:
- Elevator/Lift Hacking !!!!! - 78,844 views
- Military Communications Hacking – Script Kiddy Style - 49,775 views
- Hackers Crack London Tube Oyster Card - 44,674 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Arachni v0.3 Released – Web Application Security Scanner Framework

Cybertroopers storming your ship?


It’s been a while since we last mentioned Arachni, it was back in February – Arachni v0.2.2.1 – Web Application Security Scanner Framework.

For those who are not aware, Arachni is a fully automated system which tries to enforce the fire and forget principle. As soon as a scan is started it will not bother you for anything nor require further user interaction. Upon completion, the scan results will be saved in a file which you can later convert to several different formats (HTML, Plain Text, XML, etc.)

The project was initially started as an educational exercise though it has since evolved into a powerful and modular framework allowing for fast, accurate and flexible security/vulnerability assessments..

More than that, Arachni is highly extend-able allowing for anyone to improve upon it by adding custom components and tailoring most aspects to meet most needs.

The author notified us of a major new release (v0.3) which has some great new features, a few of those being:


  • A new custom-written, lightweight Spider
  • Add-on support for the WebUI
    • Scan scheduler
    • AutoDeploy — Convert any SSH enabled Linux box into a Dispatcher
  • Improved accuracy of differential analysis audits
  • Improved accuracy of timing attack audits
  • Highly optimized timing attacks

If you are interested in the WebUI aspect you can check out some screenshots here, the more comprehensive ChangeLog is also available here.

For those of you into benchmarking and testing you might be interested to know that during a recent test Arachni was the only (from a long list of commercial and F/OSS systems) that hit 100% on both XSS and SQLi tests in the WAVSEP benchmark:

Commercial Web Application Scanner Benchmark

The author is doing a great job with this tool and rapidly closing the gap between free security scanners and the very expensive commercial options. If you do have any feedback on Arachni v0.3 drop a comment here or hit up the Arachni Google Group.

You can download Arachni v0.3 here:

arachni-v0.3-cde.tar.gz

Or read more here.


Posted in: Hacking Tools, Web Hacking

Tags: , , , , , , , , , , ,

Posted in: Hacking Tools, Web Hacking | Add a Comment
Recent in Hacking Tools:
- The Backdoor Factory (BDF) – Patch Binaries With Shellcode
- Gdog – Python Windows Backdoor With Gmail Command & Control
- SPF (SpeedPhish Framework) – E-mail Phishing Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,972,741 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,398,749 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 675,626 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Recent in Forensics:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- FastIR Collector – Windows Incident Response Tool
- Rekall – Memory Forensic Framework

Related Posts:

Most Read in Forensics:
- NetworkMiner – Passive Sniffer & Packet Analysis Tool for Windows - 66,363 views
- raw2vmdk – Mount Raw Hard Disk (dd) Images As VMDK Virtual Disks - 34,075 views
- OpenDLP – Free & Open-Source Data Loss Prevention (DLP) Tool - 28,146 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Mediggo – Tool To Detect Weak Or Insecure Cryptosystems Using Generic Cryptanalysis Techniques

Don't let your data go over to the Dark Side!


Mediggo is an opensource cryptanalysis library. This library implements generic cryptanalysis techniques to detect weak or insecure cryptosystems or learn and practice with cryptanalysis.

This library is open source (LGPL licence) and written in C programming language. Samples and test cases are provided with each techniques:

  • the solution is not always given to make people practice
  • the solution can always be obtained by contacting the development team

Current Features

  • Detection and cryptanalysis of weakly implemented or trapped systems

Future Features

  • Automatic detection of statistical biases in cryptographic algorithms.
  • Specific cryptanalysis tools.

You can download Mediggo here:

megiddo-0.4.0.tar.gz

Or read more here.


Posted in: Cryptography, Hacking Tools

Tags: , , , , , , , ,

Posted in: Cryptography, Hacking Tools | Add a Comment
Recent in Cryptography:
- DROWN Attack on TLS – Everything You Need To Know
- Dell Backdoor Root Cert – What You Need To Know
- ISIS Running 24-Hour Terrorist Crypto Help-desk

Related Posts:

Most Read in Cryptography:
- The World’s Fastest MD5 Cracker – BarsWF - 47,649 views
- Hackers Crack London Tube Oyster Card - 44,674 views
- WPA2 Vulnerability Discovered – “Hole 196” – A Flaw In GTK (Group Temporal Key) - 32,906 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Android Phones (Possibly) Hacked At Defcon On CDMA & 4G (HSPA)

Don't let your data go over to the Dark Side!


It seems like some major ownage was layed down at Defcon, I was very interested by the thread coderman posted in Full Disclosure earlier:

DEF CON 19 – hackers get hacked!

Especially when some people did chime in with supporting opinions and agreeing that it does seem like they got hacked. Basically someone setup some bogus CDMA/4G cell towers (probably with OpenBTS) and hacked a bunch of Android phones (that’s what is being claimed anyway).

And just to clarify – there’s no REAL 4G or LTE hacking involved – in the US they call HSPA 4G.

Claims that both CDMA and 4G networks were compromised at the recent Defcon security event in Las Vegas have raised little surprise, but the vulnerability of handsets is hotly debated.

The claim was made by coderman, a stalwart of security conferences, who reports that he witnessed an advanced man-in-the-middle attack operating on both CDMA and UMTS networks and masterminded by an amalgam of Anon and Lulz. This attack was apparently able to identify connected devices and run through known exploits before falling back to ask the user’s permission to install.

The symptoms of infection include “3G/4G* signal anomalies”, “Android [device] at full charged plugged in, but dropping to <50% charge once unplugged", "Android services that immediately respawn when killed" and "a hard freeze, and then take[ing] a long time to reboot". Android users might recognise that as SNAFU, but according to coderman it indicates the user has fallen prey to hackers from the usually-desperate groups Anon and Lulz. Other attendees are less certain, with many asking for more evidence (we did too, with equal lack of success). While it's hard to see if the attack happened as described much of it is plausible and follows a steady erosion of the security around cellular networks, which have stood the test of time well but are now recognised as weakening. Critically the 2G networks do not authenticate both ways – the handset authenticates to the network, but not the other way round – so it's relatively easy for an attacker to set up a femtocell and intercept communications. Handsets will also drop the encryption level on request by the network, which is required for use in countries where strong encryption is still verboten but provides an opportunity for the attacker to simply switch off the encryption.

Now there’s a lot of claims flying around here including the hacks, how advanced they are and who they were perpetrated by (Anonymous and LulzSec?).

Yes, cell network hacking has moved forward a lot in the last couple of years and the processing power of the average laptop is more than enough to own most cellular networks – but did this really happen? Right now no-one know, and really who is going to come forwards with evidence?

“Hi, I’m a l33t hacker and my phone got raped at Defcon 19” – yah sorry but that’s not going to happen.


Handsets are supposed to display such a change of status to the user, but they don’t.

Faking a call is still very hard, the secret shared between the SIM and the network authentication centre remains secure and hard to crack as ever, but once the encryption is off then data can be intercepted and false updates can be pushed out to smartphones.

In most cases such updates will require user permission to install, and will need to be signed or present additional dialogs, but users will generally agree to anything they’re presented with. The Defcon attendees might be more cautious, but the technique should be expected elsewhere.

Certainly there are numerous reports of strange cell sites popping up during the conference.

Our man on the ground, Dan Goodin, didn’t see any himself, but as handsets automatically connect to the nearest base station with the right operator code there’s no obvious notification and little to stop calls and data being intercepted.

3G networks, including HSPA, are a lot more secure and authenticate in both directions. That makes interception harder, but not impossible. Interception is then dependent on the encryption being used; A5/3 is mandated in Europe and really hard to break, but not widely used. The USA still seems to be using A5/2, at best, for some reason.

So interception of cellular data is eminently plausible, and faking updates is also plausible, but when it comes to inserting malicious code into handsets one is just as dependent on the mobile OS as if one were connecting over a Wi-Fi connection.

The whole thing is plausible? Yah definitely, but Defcon attendees are not your average drones (I hope) – and have at least some security smarts.

The delivery mechanism for this attack is the same old story, pushing out malicious updates and hoping the user installs them. For an average joe – yes this will work, for anyone who works in infosec? I find that unlikely.

I really hope more research is done on these attacks and we get to see some evidence of what really went down.

Source: The Register


Posted in: Exploits/Vulnerabilities, Privacy

Tags: , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Privacy | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,312 views
- AJAX: Is your application secure enough? - 120,023 views
- eEye Launches 0-Day Exploit Tracker - 85,478 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Agnitio v2.0 Released – Code Security Review Tool

Cybertroopers storming your ship?


It’s been a while since we’ve mentioned Agnitio, it was earlier this year in March: Agnitio v1.2 – Manual Security Code Review Tool.

The author notified me of a new version that was recently released with quite a few additions. For those not familiar with it, Agnitio is a tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.

Changes in V2.0

The major changes in v2.0 is the addition of a code analysis module which comes with Android and iOS rules, an editor for the checklist questions and the ability to create/edit/remove code analysis rules.

  • Fixed verify report button bug. It used to make the app crash if the report path field was empty because it didn’t check if it was empty before trying to use the field value.
  • Delete profile functionality added on the “view profiles” tab. Some users requested this functionality.
  • Removed hard coded filesystem paths and database names/locations from the code and make them configuration items.
  • Data editor for both principles and checklist guidance sections. This allows users to customise the guidance using their own languages, guidance text etc.
  • Increase the max size value of the text boxes on the principles guidance tab to allow more information to be entered by users.
  • More accurate error on the profile creation tab – specify exactly what fields have been missed rather than listing all.
  • Added “About” form with info, license, credits etc
  • Regular expressions expanded to include a wider range of characters including non English characters.
  • Turn the “other” language box red if the user clicks save with the other check box ticked but not language entered on the create and view profile tabs.
  • Metrics tab now “returns” if only one app is available rather than trying to load all graphs and throwing a separate error for each one.

The author is always interested in feedback and has integrated a lot of it into v2.0 of Agnitio, if you want to give some suggestions/bug reports or whatever after using the tool you can do so via the Security Ninja blog here, or on Twitter @securityninja.

You can download Agnitio v2.0 here:

Agnitio v2.zip

Or read more here.


Posted in: Countermeasures, Programming, Security Software

Tags: , , , , , , , , ,

Posted in: Countermeasures, Programming, Security Software | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,023 views
- Password Hasher Firefox Extension - 117,718 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,707 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


More Cyberterrorism – Taiwan Political Party Accuses China of Hacking

Don't let your data go over to the Dark Side!


Well there hasn’t been a whole lot of news the last couple of days apart from the London riots – which don’t have much of a technical spin. The only technical part is that the looters/rioters etc seem to be organizing themselves using BBM (BlackBerry Messenger) and Twitter.

The former being rather smart as it’s encrypted and sent via a 3rd party network – so it’s not open to wiretapping. It’s unlikely the tracksuit wearing chavs & hoodies know that, but still – it’s keeping them safe. Posting videos/pictures of themselves on public Twitter and Facebook accounts is not so smart though and will surely lead to some arrests.

Anyway that’s not the topic here, the topic here is another politically motivated hacking attack – what we would commonly call cyberterrorism.

A Taiwanese political party suspects the Chinese government is behind a hacking attack that stole information about the party’s election activities.

Taiwan’s Democratic Progressive Party (DPP) said on Tuesday that some of the attacks had been traced to China’s Xinhua News Agency, a state-run press group. The attack operated as a phishing campaign, in which DPP staffers were sent e-mails by hackers who attempted to impersonate other party employees. The staffers were then told to open the e-mail attachments, which secretly contained viruses to monitor the computers, a DPP spokeswoman said.

The DPP alleges the attacks were routed from the Xinhua News Agency through Malaysia and Australia. The attacks were also traced to IP addresses from the Chinese mainland. The Xinhua News Agency was contacted for response, but has yet to an issue a comment.

IT security experts have said the attacks were part of a state-sponsored hacking attempt, according to the DPP. “Already many countries and security groups have said the attacks from China’s cyber army are well organized and that a state actor guides and supports them,” the DPP said in statement issued on the party’s website.

As we all know, Taiwan and China are not really the best of friends with China claiming Taiwan to be part of it and Taiwan not quite agreeing. In China they fully act like Taiwan is just another state/province in China.

This time it seems to be a state run Chinese news agency (Xinhua) attacking Taiwan’s Democratic Progressive Party (commonly know as DPP).

These are of course at this time just claims, and it’ll probably stay that way as there’s no conclusive proof in these kind of situations.


China is already in the spotlight for cyber attacks after security vendor McAfee reported a massive cyber attack that stole sensitive information from 72 companies and organizations. Although McAfee did not name the group behind the hacking attempts, security experts have pointed fingers at China because of the organizations targeted. China, however, has repeatedly denied it sponsors any kind of hacking.

A DPP spokeswoman said the phishing attacks have been an ongoing problem, but that it appears more of the recent hacking attempts have been coming from China.

Taiwan and China separated in 1949 after a civil war. While China’s ruling communist party seeks for reunification with the island, the DPP supports Taiwan becoming its own nation, putting the two at odds with one another.

The DPP said on Tuesday it also traced hacking attempts to Taiwan’s own Research, Development and Evaluation Commission and called for the commission to investigate. The commission could not be reached for immediate comment.

China have been in the spotlight fairly recently with some very widespread phishing attacks including – Targeted Phishing Attacks Carried Out On Gmail – Likely From China.

It seems like these kinds of games will be going on forever including hacktivism, cyberterrorism, defacement in the name of certain causes and all kinds of other naughty business.

With so much information on computers now it’s no surprise, I’d like to see these kind of organisations having better infosec policies though including awareness training for all staff with access to e-mail accounts and computers.

Source: Network World


Posted in: General News

Tags: , , , , , ,

Posted in: General News | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,375 views
- eEye Launches 0-Day Exploit Tracker - 85,478 views
- Seattle Computer Security Expert Turns Tables On The Police - 43,698 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Websecurify – Integrated Web Security Testing Environment

Cybertroopers storming your ship?


Websecurify is an integrated web security testing environment, which can be used to identify web vulnerabilities by using advanced browser automation, discovery and fuzzing technologies. The platform is designed to perform automated as well as manual vulnerability tests and it is constantly improved and fine-tuned by a team of world class web application security penetration testers and the feedback from an active open source community.

The penetration testing platform is the only one of its kind. Websecurify is in effect built on the top of a browser and can understand all modern web technologies including upcoming web standards and current technologies such as HTML5.

Main Features

  • Available for all major platforms (Windows, Mac OS, Linux)
  • Simple to use user interface
  • Builtin internationalization support
  • Easily extensible with the help of add-ons and plugins
  • Exportable and customisable reports with any level of detail
  • Moduler and reusable design
  • Powerful manual testing tools and helper facilities
  • Team sharing support
  • Powerful analytical and scanning technology
  • Built-in service and support integration
  • Scriptable support for JavaScript and Python
  • Extensible via many languages including JavaScript, Python, C, C++ and Java

Websecurify uses several key technologies combined together to achieve the best possible result when performing automatic and manual tests. At the core of the platform sits a Web Browser. This allows Websecurify to gain a fine-grained control over the targeted web application and as such detect vulnerabilities that are difficult to find with other tools.

The carefully engineered user interface is simple to use but powerful. All tools and platform features are integrated with each other. This allows smooth transition from one type of task to another and it also makes it easier to work with the complex flow of data, gathered during the penetration test.

You can download Websecurify here:

Windows: Websecurify%200.8.exe
Mac: Websecurify%200.8.dmg
Linux: Websecurify%200.8.tgz

Or you can read more here.


Posted in: Hacking Tools, Web Hacking

Tags: , , , , , , , , , ,

Posted in: Hacking Tools, Web Hacking | Add a Comment
Recent in Hacking Tools:
- The Backdoor Factory (BDF) – Patch Binaries With Shellcode
- Gdog – Python Windows Backdoor With Gmail Command & Control
- SPF (SpeedPhish Framework) – E-mail Phishing Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,972,741 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,398,749 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 675,626 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95