Anonymous Hacked English Defence League

NAMES and personal details of English Defence League members have been leaked online by a group of hackers. Information on the far-right hate mob, including names, addresses and phone numbers, has been published by the computer group Anonymous.
Anonymous has warned it will carry out more cyber attacks on the anti-Islam group and said the EDL "should have expected us".
In a video posted on YouTube the group says the EDL has used Drummer Lee Rigby's death as an “another excuse to further spread your campaign of hate, bigotry, and misinformation.”
Drummer Rigby was hacked to death near Woolwich barracks in south east London last Wednesday.
A list of what were said to be mobile phone numbers for senior named EDL figures appeared online along with addresses of what were said to be donors to the group.
The video was posted under the title ’A Message from Anonymous UK to the English Defence League’.
“Under the guise of national pride you have instigated crimes against the innocent and incited the subjugation of Muslims,” the message continues.
“We will not allow your injustices, your lies, and your stupidity, to further radicalize our youth into fearing and despising their fellow man.”
The menacing warning concludes: “In this operation, we will begin the systematic and comprehensive decimation of your cult.
“We will further expose your falsities and your attempts to censor, to your members, to the British public, and to the world as a whole.
“You will fall, we can say this with complete confidence.”
About 1,000 protesters joined an EDL march to Downing Street on Monday, chanting “Muslim killers off our streets” and “There’s only one Lee Rigby” in tribute to the soldier killed in Woolwich last week.
Four men have since been charged with various offences.
A massive police presence kept them apart from a smaller group of anti-fascist activists, with officers making 13 arrests in total.

U.S. Secret Weapons Designs Stolen by Chinese cyberspies

Chinese cyber spies have stolen some of America's most sensitive weapons designs a dangerous development that could endanger soldiers in a conflict with China, The Washington Post reports.
Many of the larger contractors have put up effective security, so the hackers have gone after subcontractors instead.
“In many cases, they don’t know they’ve been hacked until the FBI comes knocking on their door,” a senior military official told the Post. “This is billions of dollars of combat advantage for China. They’ve just saved themselves 25 years of research and development. It’s nuts.”
The cybertheft gives China an edge that it could exploit during a conflict, it accelerates China's military technology while saving it billions of dollars in research costs and the American designs can be used to benefit China's own defense industry.
The report's public version says that such cyber-attacks could cause "severe consequences for U.S. forces engaged in combat," including cutting communications links that could make weapons fail to operate correctly. Planes, satellites and drones might crash, the report said.
"If they got into the combat systems, it enables them to understand it to be able to jam it or otherwise disable it," said Winslow T. Wheeler, director of the Straus Military Reform Project at the Project on Government Oversight. "If they’ve got into the basic algorithms for the missile and how they behave, somebody better get out a clean piece of paper and start to design all over again."

PayPal Site Vulnerable to XSS Attack

A 17 year old German schoolboy posted information over the weekend regarding an apparent cross site scripting (XSS) vulnerability in the popular money transfer site PayPal. The problem lies in the site’s search function and at least in the German version of the website can be triggered by using a string of Javascript alert code.
Robert Kugler, the security researcher behind the bug posted details about the vulnerability on the Full Disclosure mailing list Friday. Now Kugler is finding his name in the headlines after PayPal allegedly informed him he was too young to qualify for an award.
“Unfortunately PayPal disqualified me from receiving any bounty payment because of being 17 years old…” Kugler, who turns 18 next March, wrote on Seclists.
Kugler wrote in the post that he’s interested in securing computer systems and in the past has dug up bugs for Microsoft – his name is listed in the security researcher acknowledgments last month – and found flaws in Mozilla’s Firefox browser on two separate occasions.
PayPal started its bug bounty program last June, following in the footsteps of companies like Mozilla and Facebook who over the last few years have set up systems to responsibly disclose bugs. While Kugler’s bug does appear to be in scope with its program as it is new and is on the valid PayPal web site, PayPal fails to mention an age requirement for security researchers in its terms and conditions.
While it isn’t clear if PayPal is planning to fix Kugler’s vulnerability right away – emails to the company were not immediately returned on Tuesday – it fixed a similar XSS flaw last fall that allowed the execution of client-side script and browser cookie hijacking.

The African Cyber Gold Mine: your Western data

Going on a holiday is dangerous when it comes to security. You leave your well known environment and you leave towards an environment that is not secured as the way you expect it should be. Last week I have been in Africa and I have witnessed the African Cyber Gold Mine.

African Cyber Gold Mine

Face it - in Africa the technology has to make some big jumps until it comes to the "secure" level of Western countries but still the Western people travel to Africa and they make use of the Public Wifi hotspots, public computers in various internet cafe's. They have a lot of money and they love to keep a close watch on it.
Hackers know this - they are after your credentials in the African continent.

Don't hack the bank - hack the hotel

Why would an hacker try to hack an Western bank if it could simply attack an African hotel that has stored all your personal information in clear text? That is the African Cyber Gold Mine. It does not matter if you are the President or some guy that is just going on a holiday. We all come in the same database.

No statistics in Africa

If you start searching for cybercrime statistics in Africa you will get almost no information. But we do know that the most spam is being send from the same continent.

Have you been in Africa?

Have you ever been in Africa? Did you use public wifi? or did you take security measures?

Source:Cyberwarzone

WiFi and Hackers in KLM airplanes

Today The Netherlands announced that the Airplanes of KLM will be equipted with WiFi-accespoints in the airplane itself. This will allow the passengers to use internet while being in the air. This is great news - but it is awesome news for hackers.

Clients in the air

The clients that are being used in airplanes are most of the times simple smartphone devices that have little to no security options enabled.
These devices are an possible target for hackers in the air.

Man in the middle attack 

A man in the middle attack is easily done when it comes to smartphones. Smartphones don't have a function to check if the access point has changed or that someone is reading the internet traffic.

Disable your electronic devices

It is standard routine in The Netherlands - when you are in the airplane and your still on the ground you are obligated to turn of your smart phone as it could affect the airplane instruments.
This seems to be solved as KLM is introducing WiFi-access points.

Connection

The clients will connect to the access point - the access point gets the connection from Satellites. The clients will be paying 20 euros to get an ticket to connect to the WiFi access point.

Cyberinfocts Ethical Hackers Forum -- June 2013

Event Details

Cyber Information Communication Technology Services organized the Cyberinfocts Ethical Hacker & Security Community to highlight its three-fold mission on Security awareness, research and continuing education for IT professionals. The forum promotes collaborative research by welcoming IT professionals , as well as members of the public, to be part of the forum. We are especially interested in coming together to tackle challenges faced by IT professional in their different fields.

Cyberinfocts Ethical Hacker & Security Forum  is a forum to host and foster quality dialogue on subjects of relevance to the Information Systems and Security. It is intended for the benefit of the IT Professionals and of all whose subject interests or fields of research and study intersect with IT Security.

We setup this forum so you can chat and meet other IT Professionals who have similar interests in Information Security. Our forums are for discussing everything on Information Technology to IT security and exposing hacking attacks. We know that not everyone has just one challenge, so our forum of many different experts allows you to chat about your challenges and getting solutions to them all in one place!

Topics:   
IP surveillance Camera
Batch & Virus Programming
Window Password Hacking
Computer Forensics and Investigations
Question and Answer

Date: 8th June 2013
Time:10:00 am Prompt
Venue: Perfect Touch Consulting Limited
1 A, Basheer Augustos Street, Eric Emmanuel Bus Stop off Bode Thomas Street Surulere Lagos
Fees: 500
For further details contact: 07037288651

To reserve your sit please visit:   http://cyberinfocts-june-forum.eventbrite.com

Mobile malware attacks will spread through sensors in handsets

A group of university researchers have uncovered a new generation of malware attacks that target mobile hardware.

A study conducted at the University of Alabama Birmingham found that malware samples can be tuned to spread through sensor components in mobile handsets, resulting in fast-spreading infections that can be difficult to detect by conventional means.

According to the researchers, the theoretical new attacks would prey on sensor hardware such as optics, microphones or magnetic field sensors. The malware would then in theory be able to infect other devices in the area through sensor communications.

“These communication channels can be used to quickly reach out to a large number of infected devices, while offering a high degree of undetectability,” the researchers explained.

“In particular, unlike traditional network-based communication, the proposed sensing-enabled channels cannot be detected by monitoring the cellular or wireless communication networks.”

In addition to being difficult to detect, researchers believe that the malware could be used to create local botnets, chaining together multiple devices in a single area such as a sports arena and then using the infected machines to perform distributed-denial-of-service (DDoS) operations.

The researchers also noted that the infected handsets would be particularly prone to targeted attacks and advanced-persistent-threat (APT) operations.

“The malware on the phone can be triggered when the infected phone is inside a driving car; the malware may then interact with the car’s internal network and cause some serious problems. Similarly, malware may get triggered inside a home or company and may then interfere with the home’s wireless security system, perhaps dismantle it.”

The study is not the first to suggest that sensor hardware can be a possible infection vector. In 2012 researcher Charlie Miller found that NFC hardware could be exploited to completely compromise a targeted device

Microsoft brings anti-botnet fight to the cloud with Azure level-up

Microsoft is moving to better defend businesses against cybercrime, loading its anti-botnet security intelligence systems into Windows Azure, therby offering firms real-time information on the threats facing them.
The move was announced on Tuesday and is the latest stage of Microsoft's Active Response for Security (MARS) programme. The move will offer businesses direct real-time access to threat intelligence data from Microsoft and other Computer Emergency Response Teams (CERT), which was previously distributed via email.
TJ Campana, Microsoft's director of security for its Digital Crimes Unit, wrote: "By tapping into Microsoft's vast cloud resources, we are now able to share information on known botnet malware infections with ISPs and CERTs in near real-time. The new Windows Azure-based Cyber Threat Intelligence Program (C-TIP) will allow these organisations to have better situational awareness of cyber threats, and more quickly and efficiently notify people of potential security issues with their computers."
Campana said the upgrade is an essential step in Microsoft's ongoing battle against criminal operated zombie botnets, which it claims have become more tenacious in recent years.
"Cybercrime is a global phenomenon and malicious software poses grave risks to computer owners, businesses and users of the internet in general. Among the risks are bank fraud, identity theft, critical infrastructure and denial of service attacks, intellectual property theft and much more," he wrote.
"Every day our system receives hundreds of millions of attempted check-ins from computers infected with malware such as Conficker, Waledac, Rustock, Kelihos, Zeus, Nitol and Bamital."
This upgrade to Azure is the latest stage in Microsoft's ongoing battle against botnets. To date Microsoft has participated in several high-profile operations. These have included a take-down of Kelihos botnet in 2011 and the Bamital sting in February. Campana said that while the Azure upgrade won't result in any more direct takedowns, it will further squeeze cyber criminals' wallets, hampering their ability to expand their operations.
"While our clean-up efforts to date have been quite successful, this expedited form of information-sharing should dramatically increase our ability to clean computers and help us keep up with the fast-paced and ever-changing cybercrime landscape," he wrote.
"It also gives us another advantage: cyber criminals rely on infected computers to exponentially leverage their ability to commit their crimes, but if we're able to take those resources away from them, they'll have to spend time and money trying to find new victims, thereby making these criminal enterprises less lucrative and appealing in the first place."

US charges Liberty Reserve in $6bn money laundering scheme

The US government is charging a popular online currency exchange with what it claims is the largest money laundering scheme in history.

Attorneys with the US Southern New York have charged the operators of Liberty Reserve with trafficking in some $6bn worth of funds for activities including child pornography, cybercrime services and financial fraud.

Designed as a secure an anonymous payment service, Liberty Reserve allowed users to transmit funds internationally without the need for monetary exchange markets or other financial institutions. According to attorneys, however, the company existed almost entirely to facilitate underground transactions for criminal activity.

“As alleged, the only liberty that Liberty Reserve gave many of its users was the freedom to commit crimes – the coin of its realm was anonymity, and it became a popular hub for fraudsters, hackers, and traffickers,” said US Attorney Preet Bharara.

“The global enforcement action we announce today is an important step towards reining in the ‘Wild West’ of illicit Internet banking.”

The US court said that it has indicted five people who are believed to be behind Liberty Reserve, including individuals based in the US and Spain. Two more individuals, last seen in Costa Rica, are also being sought as suspects in the case.

This is not the first time Liberty Exchange has been singled out as a facilitator of underground transactions. Earlier this month the firm was one of several Bitcoin operations singled out by security researchers as money laundering fronts for malware sales.

Hack the hacker: US Congress urged to legalize cyber-attacks to fight cybercrimes

US Congress should legalize attacking hacker’s computers with malware, physically destroy networks and take photos of data thieves and copyright violators with their own cameras in order to punish IP thieves, the IP Commission recommends.

The commissioners - former US government officials and military men - say that the “scale of international theft of American intellectual property (IP) is unprecedented”. However, the US government response has been “utterly inadequate to deal with the problem.”

"Almost all the advantages are on the side of the hacker; the current situation is not sustainable," the commissions's report says.

“New options need to be considered,” the authors call, then adding that current laws are limited and “have not kept pace with the technology of hacking.”

Thus, the commission suggests allowing active network retrieving stolen information, “altering it within the intruder’s networks, or even destroying the information within an unauthorized network."

For example, locking down the computer of unauthorized users and forcing them to come out to police could be one of the options.

“The file could be rendered inaccessible and the unauthorized user’s computer could be locked down, with instructions on how to contact law enforcement to get the password needed to unlock the account,” the commission recommended.

In other words, authors suggest legalizing ransomware - an extortion tool used by organized criminals, when malware that blocks access to the computer system it infects, and demands a ransom paid to the creator to remove the restriction.

Such measures, the commissioners stressed, do not violate existing laws, but still might help to prevent attacks and even provide both time and evidence for law enforcement to investigate the cyber-crime.

As additional measures, the report recommends “physically disabling or destroying the hacker’s own computer or network,” implanting malware in the hacker’s network or photographing the hacker using his own system’s camera.

“The legal underpinnings of such actions taken at network speed within the networks of hackers, even when undertaken by governments, have not yet been developed,” the authors say.

So, if counterattacks against hackers were legal, companies could use a variety of techniques and cause severe damage to the capability of IP pirates.

"These attacks would raise the cost to IP thieves of their actions, potentially deterring them from undertaking these activities in the first place," the report concludes.

However, if counterattacks were legalized, this would not be just about companies and hacker. Some pirated movies or songs on private computers, could be deemed an IP theft and allow rights holders to do horrible things to suspected systems.

ASIO at no risk from hack attack

THE building details of ASIO's new headquarters in Canberra, allegedly hacked by Chinese cyber spies, were stolen three years ago and no longer pose any threat to the agency's operations.

As China strongly denied allegations it mounted a cyber attack to steal the plans for ASIO's Canberra headquarters, sources familiar with the breach moved to play down its significance.

The Australian has been told the breach occurred in 2010, or possibly 2009. Although construction of the headquarters on Canberra's Constitution Avenue started in 2008, the discovery of the breach meant ASIO had the opportunity to alter the designs of the building to reduce the risk of espionage.

It is understood the layout of the $630 million building was accessed through a contractor working on the building, which is yet to be completed.

The breach shocked those familiar with the intensive security arrangements surrounding the construction of the building.
Digital Pass $1 for first 28 Days

One cyber security expert, who asked not to be named, said anything to do with the building's plans would have been "air-gapped", or stored on a system or computer not connected to the internet. The same restrictions would apply to contractors working on the site.

However, a second insider said it was presumptive to assume the data had been stolen through a cyber attack, saying it might have been obtained from a source such as a memory stick.

Although embarrassing for ASIO, sources with knowledge of the incident said its significance had been overplayed.

One said ASIO had since taken steps to counter the breach, but would give no details as to what those steps were.

A second questioned what the Chinese could realistically do with schematics, given the building itself would be one of the most secure in Australia.

A spokesman for ASIO declined to comment on any aspect of the claims first raised by the ABC's Four Corners program on Monday. A spokesman for the Chinese embassy in Canberra told The Australian the claims were baseless and some of them made with ulterior motives.

Julia Gillard told parliament the report on the Chinese cyber attack was inaccurate but she would not say what was wrong with it. "As the Attorney-General has stated, neither he nor the director-general of ASIO intend to comment further on these inaccurate reports," the Prime Minister told parliament.

Opposition legal affairs spokesman George Brandis said he had asked for an ASIO briefing on the allegations.

The Chinese embassy spokesman said that like other countries, China was facing a serious threat of cyber attacks and it was one of the world's main victims of hacking.

"China attaches importance to network security issues, and resolutely opposes all forms of hacker attacks," the spokesman said.

He said Chinese law prohibited hacker attacks and other acts of sabotage against internet security.

The last time something similar happened the boot was on the other foot, with Australian agencies accused in 1995 of bugging the new Chinese embassy in Canberra.