Archive | 2012

Basic Fuzzing Framework (BFF) From CERT – Linux & Mac OSX Fuzzer Tool

Outsmart Malicious Hackers


The CERT Basic Fuzzing Framework (BFF) is a software testing tool that finds defects in applications that run on the Linux and Mac OS X platforms. BFF performs mutational fuzzing on software that consumes file input. (Mutational fuzzing is the act of taking well-formed input data and corrupting it in various ways, looking for cases that cause crashes.) The BFF automatically collects test cases that cause software to crash in unique ways, as well as debugging information associated with the crashes. The goal of BFF is to minimize the effort required for software vendors and security researchers to efficiently discover and analyze security vulnerabilities found via fuzzing.

Traditionally fuzzing has been very effective at finding security vulnerabilities, but because of its inherently stochastic nature results can be highly dependent on the initial configuration of the fuzzing system. BFF applies machine learning and evolutionary computing techniques to minimize the amount of manual configuration required to initiate and complete an effective fuzzing campaign. BFF adjusts its configuration parameters based on what it finds (or does not find) over the course of a fuzzing campaign. By doing so it can dramatically increase both the efficacy and efficiency of the campaign. As a result, expert knowledge is not required to configure an effective fuzz campaign, and novices and experts alike can start finding and analyzing vulnerabilities very quickly.


Features

  • Minimal initial configuration is required to start a fuzzing campaign
  • Minimal supervision of the fuzzing campaign is required, as BFF can automatically recover from many common problems that can interrupt fuzzing campaigns
  • Uniqueness determination through intelligent backtrace analysis
  • Automated test case minimization reduces the effort required to analyze results by distilling the test case to the minimal changes to the input data required to induce a specific crash
  • Online machine learning applied to fuzzing parameter and input file selection to improve the efficacy of the campaign
  • Distributed fuzzing support
  • Crash severity / exploitability triage

At the CERT/CC, they have already used the BFF infrastructure to find a number of critical vulnerabilities in products such as Adobe Reader and Flash Player; Foxit Reader; Apple QuickTime, Preview, and Mac OS X; Xpdf; Poppler; FFmpeg; JasPer; Wireshark; VMware VMnc video codec; the Indeo video codec; and many others.

You can download BFF here:

http://www.cert.org/download/bff/

Or read more here.

Learn about Hacking Tools



Posted in: Hacking Tools, Secure Coding

Topic: Hacking Tools, Secure Coding

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.


Russian Cyber-Crime Market Doubled In 2011

Outsmart Malicious Hackers


It’s been quite a while since we’ve posted any news about Russia, so here’s an article which in some ways is quite scary.

The global cybercrime market is being dominated by Russian-speaking nations and their activity doubled in 2011. It’s certainly a disproportionate amount of crime when you look at their population size.

Cybercrime is a HUGE business, especially when it comes to malware and trojans targeting banking details and the follow on phishing scams.

Russian-speaking criminals grabbed more than a third of the entire global cybercrime market in 2011 as a growth in online fraud activity turned the country into a major digital crime superpower, a new report has suggested.

Russian cybercriminals earned $4.5 billion in 2011

The State and Trends of the Russian Digital Crime market 2011 from Russian security research company Group-IB estimates (using public and partner data) that the global cybercrime market reached around $12.5 billion (APS7.74 billion) in size during the year, with Russians and Russian speakers (including those outside the country) accounting for $4.5 billion of that total.

At the same time, using its own internally-collected analysis, the Russia-only cybercrime market doubled to $2.3 billion compared to 2010, a disproportionate level of activity considering the country’s modest 143 million population.

The top Russian cybercrime activity was online fraud, equivalent to almost a billion dollars in revenue, just ahead of spam on $830 million, internal market services on $230 million and DDoS on with $130 million.

As well as startling growth, the Russian cybercrime scene also saw consolidation into larger, more organised groups increasingly controlled by conventional crime mafias. There was also evidence of co-operation between these groups, and the growth of an important internal ‘crime-to-crime’ (C2C) market to support its activities.

$12.5 Billion dollars is a LOT of zeros, that was the estimate of the money lost in 2011 to cybercrime. That’s almost $2 per person for the ENTIRE population of the World, that’s what I would colloquially call a shitload of cash.

It doesn’t stop there too, it amazes me that DDoS attacks are a multi-million dollar business! In Russia alone, according to this report anyway, these crims earnt $130 million USD carrying out DDoS attacks!


Coming from a Russian-based group of researchers, the report makes fascinating reading. There is a wealth of anecdotal evidence from crime busts and malware trends that Russia is a key hub for crybercrime but hard numbers are seldom put on its inner workings or business model.

An obvious question is why Russia has become such an important country for cybercrime. Beyond the traditional explanation of the large number of relatively poorly-paid programmers in the country, Group-IB also underlines the importance of policing and local laws.

The researchers note the case of Yevgeniy Anikin and Viktor Pleschuk, who were part of the gang that stole $10 million from the Royal bank of Scotland’s WorldPay ATM system in 2008 And yet received suspended sentences from Russian courts.

“Thus, because of imperfections in Russian laws and the lack of severe penalties, stable law enforcement practice, and regular training regarding counter cybercrime measures, cybercriminals are disproportionately [not held] liable for the crimes they commit,” note the researchers.

“The cybercrime market originating from Russia costs the global economy billions of dollars every year,” said Group-IB’s CEO, Ilya Sachkov.

The lax laws when it comes to cybercrime in Russia aren’t going to help the situation, but sadly – I’m not sure if they will even care.

If you want to read the original report you can do so here:

State and Trends of the Russian Digital Crime market 2011 [PDF]

Source: Network World

Learn about Malware



Posted in: Malware, Phishing, Spammers & Scammers

Topic: Malware, Phishing, Spammers & Scammers

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.


creepy – A Geolocation Information Aggregator AKA OSINT Tool

Outsmart Malicious Hackers


creepy is an application that allows you to gather geolocation related information about users from social networking platforms and image hosting services. The information is presented in a map inside the application where all the retrieved data is shown accompanied with relevant information (i.e. what was posted from that specific location) to provide context to the presentation.

Creepy

Features

  • Automatic caching of retrieved information in order to reduce API calls and the possibility of hiting limit rates.
  • GUI with navigateable map for better overview of the accumulated information
  • 4 Maps providers (including Google Maps) to use.
  • Open locations in Google Maps in your browser
  • Export retrieved locations list as kmz (for Google Earth) or csv files.
  • Handling twitter authentication in an easy way using oAuth. User credentials are not shared with the application.
  • User/target search for twitter and flickr.

Map Providers

  • Google Maps
  • Virtual Maps
  • Open Street Maps

Information Retrieval Using

  • Twitter’s tweet location
  • Coordinates when tweet was posted from mobile device
  • Place (geographical name) derived from users ip when posting on twitter’s web interface. Place gets translated into coordinates using geonames.com
  • Bounding Box derived from users ip when posting on twitter’s web interface.The less accurate source , a corner of the bounding box is selected randomly.
  • Geolocation information accessible through image hosting services API
  • EXIF tags from the photos posted.

Social Networking Platforms Supported

  • Twitter
  • Foursquare (only checkins that are posted to twitter)
  • Gowalla (only checkins that are posted to twitter)

Image Hosting Services Supported

  • flickr – information retrieved from API
  • twitpic.com – information retrieved from API and photo exif tags
  • yfrog.com – information retrieved from photo exif tags
  • img.ly – information retrieved from photo exif tags
  • plixi.com – information retrieved from photo exif tags
  • twitrpix.com – information retrieved from photo exif tags
  • foleext.com – information retrieved from photo exif tags
  • shozu.com – information retrieved from photo exif tags
  • pickhur.com – information retrieved from photo exif tags
  • moby.to – information retrieved from API and photo exif tags
  • twitsnaps.com – information retrieved from photo exif tags
  • twitgoo.com – information retrieved from photo exif tags

You can download creepy here:

CreepySetup_0.1.94.exe

Or read more here.

Learn about Privacy



Posted in: Privacy, Web Hacking

Topic: Privacy, Web Hacking

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.


Anonymous Take Down Official F1 Site As Bahrain Protest

Outsmart Malicious Hackers


It seems like the latest target for Anonymous is the F1 due to the race that took place in Bahrain and the human rights issues in the country.

They DDoSed the official F1 site (formula1.com), which was up and down on Saturday and defaced another related site (f1-racers.net) which also contains some details from ticket sales.

I’m not entirely sure if it’s really Anonymous behind this or another fragment as the Blogspot has been killed and the AnonOps Twitter account hasn’t been updated since March 22nd.

Hackers claiming to be from Anonymous have taken down the official Formula One website as protests grow over this weekend’s controversial Grand Prix in the Kingdom of Bahrain.

“The F1 Grand Prix in Bahrain should be strongly opposed. The Al Khalifa regime stands to profit heavily off the race and has promised to use live ammunition against protestors in preparation,” the group said in a statement.

“They have already begun issuing collective punishment to entire villages for protests and have promised further retribution ‘to keep order’ for the F1 events in Bahrain. The Formula 1 racing authority was well-aware of the Human Rights situation in Bahrain and still chose to contribute to the regime’s oppression of civilians and will be punished.”

The statement also called for the release of Abdulhadi Alkhawaja, a prominent local human rights activist who was arrested at his home in April 2011 and sentenced to life in prison two months later on charges of aiding terrorist organizations. Amnesty International has declared him a ‘prisoner of conscience’ and he is now in the 70th day of a hunger strike.

So far the race looks like it will be going ahead anyway, although some members of the Force India team have left the country following an incident earlier in the week where they were caught in a riot and tear gassed. The country’s Crown Prince said to cancel the race now would “empower extremists,” Reuters reports.

The F1 in Bahrain went ahead without incident, the race track was heavily guarded by police with dogs etc. Bernie Ecclestone has also stated that he sees no reason to drop Bahrain from future F1 schedules, despite the controversy it provoked.

It’ll be interesting to see if the F1 now becomes a mainstay target for the Anonymous movement and their offshoots – F1 could suffer some serious damage from this.

The race was cancelled last year due to protests.


Bahrain was the first Middle Eastern state to hold a Formula One race in 2004 and the ruling family has a significant stake in the McLaren racing team. The 2011 race was cancelled after protests erupted across the country.

The protests began on Valentine’s Day last year, as part of the wave of uprisings across the Arab world. While uprisings in Tunisia, Egypt and Libya were successful (with some help from NATO in the last case,) the Bahraini uprising, which saw over 100,000 people take to the streets, was quickly crushed when the royal family asked the Saudi Arabian army to intervene. The US Navy 5th Fleet, which is based in Bahrain, did not take part.

After the initial uprising the former Metropolitan Police assistant commissioner John Yates, who resigned after being heavily criticized for his conduct of an investigation into the News of The World hacking scandal, was hired by the Bahraini royal family to investigate human rights abuses that may or may not have taken place.

Yates reportedly wrote to FIA president Jean Todt earlier this month, telling him that the protests were not as serious as the media was reporting and said he felt safer in Bahrain than he did in some parts of London.

“These are criminal acts being perpetrated against an unarmed police force who, in the face of such attacks, are acting with remarkable restraint,” he wrote. “They are not representative of the vast majority of delightful, law-abiding citizens that represent the real Bahrain that I see every day.”

The whole Anonymous thing has been pretty quiet lately, the last major target I recall was OccupyWallStreet, the Vatican and a few others. The last time we reported on Anonymous was about – Former LulzSec Leader Sabu Flips Sides & Informs For The FBI.

I guess the movement might have gotten too much press and there have been a LOT of arrests so it’s probably fragmented and gone a lot more underground – communicating offline and over more secure channels.

Source: The Register

Learn about Exploits/Vulnerabilities



Posted in: Exploits/Vulnerabilities, Web Hacking

Topic: Exploits/Vulnerabilities, Web Hacking

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.


NfSpy – ID-spoofing NFS Client Tool – Mount NFS Shares Without Account

Outsmart Malicious Hackers


We wrote about this tool originally last year – NfSpy – ID-spoofing NFS Client – Falsify NFS Credentials – and a new version just came out!

NfSpy has just been updated to support NFSv3, a more efficient and widespread protocol than the previous NFSv2. NfSpy is a FUSE filesystem written in Python that automatically changes UID and GID to give you full access to any file on an NFS share. Use it to mount an NFS export and act as the owner of every file and directory.

NFS before version 4 is reliant upon host trust relationships for authentication. The NFS server trusts any client machines to authenticate users and assign the same user IDs (UIDS) that the shared filesystem uses. This works in NIS, NIS+, and LDAP domains, for instance, but only if you know the client machine is not compromised, or faking its identity. This is because the only authentication in the NFS protocol is the passing of the UID and GID (group ID). There are a few things that can be done to enhance the security of NFS, but many of them are incomplete solutions, and even with all three listed here, it could still be possible to circumvent the security measures.

Features

  • Use filehandles from packet captures instead of asking mountd.
  • Hide from sysadmins by immediately “unmounting” while retaining access
  • Specify port/protocol for NFS or Mountd if you don’t have access to the portmapper

You can download NfSpy here:

NfSpy.zip

Or read more here.

Learn about Hacking Tools



Posted in: Hacking Tools, Linux Hacking, Networking Hacking

Topic: Hacking Tools, Linux Hacking, Networking Hacking

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.


Android Trojan Targets Japanese Market – Steals Personal Data

Keep on Guard!


Early last year we wrote about China Facing Problems With Android Handsets & Pre-installed Trojans, then later last year there was a possibility Cybercrooks May Be Able To Force Mobile Phones To Send Premium-Rate SMS Messages.

The latest news about Android malware is malicious apps that are in the official Google marketplace (called Play) – they are masquerading as apps to deliver trailers for various content – but in fact steals your data in the background.

Security experts are warning of yet more malicious applications found on Google’s official online apps market Play, this time designed to steal personal data in the background while promising to show trailers for Japanese anime, video games and porn.

McAfee malware researcher Carlos Castillo explained in a blog post that the new Android Trojan had been discovered in 15 applications on Google Play so far and downloaded by at least 70,000 users.

The malware, specifically designed to target Japanese users, is hidden in apps which show internet-based video trailers.

On installation, the malicious apps request the user grants them permission to read contact data and read phone state and identity which.

If granted by the user, this will enable them to pilfer Android ID, phone number and the victim’s entire contacts list including names, email addresses and phone numbers.

It will then attempt to send the data in clear text to a remote server and, if successful, will request a video from that same server to display, said Castillo.

I think most of us are pretty safe from this set of nasties though as it targets the Japanese market specifically. It is a general problem with Android apps though, most of them ask for far more permissions than they actually need to function (lazy devs perhaps?) so Android users are very used to granting all kinds of permissions to fairly simple apps.

Thankfully McAfee mobile security app does detect these as a threat (although how many people really have AV software on their phones?!).


“Due the privacy risk that these applications represent to Android customers, all of them have been removed from the market,” he cautioned.

“McAfee Mobile Security detects these threats as Android/DougaLeaker.A. Users should verify in the Google Play market prior installation that the application does not request permission to perform actions not related to its purpose.”

Google’s relatively open Android ecosystem has led to a huge surge in malware hidden in legitimate looking applications.

Apart from data-sucking Trojans, cyber criminals have looked to distribute apps containing premium dialler malware, SMS fraud Trojans and malware designed to turn a user’s handset into a bot.

Worryingly, two-thirds of Android anti-malware scanners are not up to the task, according to recent research from AV-Test.

The firm said that there are more than 11,000 strains of malware in the wild targeted at the platform – a figure growing at some pace.

Google does seem to be fairly on top of removing these apps from the marketplace as soon as they are reported and verified as malware. I’d have though they should integrate some kind of malware scan (including heuristic scanning for dodgy calls) to Google Play when someone adds a new app.

As always just be careful what you’re downloading and what you are giving permissions to. If you are paranoid, hook your phone up to your desktop and proxy all the traffic through there and get sniffing.

Source: The Register

Learn about Malware



Posted in: Malware, Privacy, Spammers & Scammers

Topic: Malware, Privacy, Spammers & Scammers

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.