Fake tech support scam : Google Chrome users be Alert

2/07/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPK5yrlhrNtgZPH-2SLXsbmGRikYga3Ma-Vp-meI3KY4A6cKTjHRJyn8B_zqmm205p3AGd90adFUgmIvko5A6JCf0jorRybnoH_RAU-eGcim0OESAQpWkIkKifMBISAvITYQZDaGO8KgUO/s1600/Tech-Support-Scams-Targeting-Mac-Owners.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="445" data-original-width="811" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPK5yrlhrNtgZPH-2SLXsbmGRikYga3Ma-Vp-meI3KY4A6cKTjHRJyn8B_zqmm205p3AGd90adFUgmIvko5A6JCf0jorRybnoH_RAU-eGcim0OESAQpWkIkKifMBISAvITYQZDaGO8KgUO/s640/Tech-Support-Scams-Targeting-Mac-Owners.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Fake tech support scam : Google Chrome users be Alert</td></tr>
</tbody></table>
Tech support scams are increasingly hitting Windows users on the Google Chrome browser—even when it's been updated to the latest version.<br />
<ul style="text-align: left;">
<li>Tech support scams may use an API to freeze a user's browser, prompting them to call a fake support line and share their credit card information. </li>
<li>Fake Google Chrome browser alerts asking users to contact false tech support lines have increased over the last quarter for Windows users, according to Malwarebytes.</li>
</ul>
Fake browser alerts pushing these tech support scams have increased in the last quarter, according to Malwarebytes. Most of these attack campaigns come from <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malicious </a>advertising and compromised websites, with criminals looking to scare users into calling the number—sometimes by completely locking their browser.<br />
<br />
These scams take the form of browser alerts asking users to contact fake tech support lines in attempts to gain their credit card information. And the attacks on <a href="http://www.hackerschronicle.com/search/label/Google%20Chrome" target="_blank">Google Chrome</a> are far from the first to hit the web: In January 2017, when you Googled "<b>Facebook customer support</b>," .In February 2017, a top <a href="http://www.hackerschronicle.com/search/label/Google" target="_blank">Google </a>search result that appeared to be an ad for Amazon.com was actually a malicious link .<br />
<br />
The US Federal Trade Commission recently launched an effort to put a stop to these scams, but they will likely remain pervasive, This means businesses must be especially vigilant in training employees to recognize scams, phishing attacks, and other cybersecurity issues.<br />
<br />
Since these attacks do not seem to be slowing down, it's important for businesses to train their end users to recognize them. The best way to handle such an <a href="http://www.hackerschronicle.com/search/label/Cyber%20Attack" target="_blank">attack </a>is to avoid panicking and close the browser using the Task Manager. The pop-ups themselves are usually harmless, so long as the user doesn't call the number provided.<br />
<br />
Professionals, whether working at home or in the office, should always go through their IT or security department to handle security issues. All users should be aware that it is highly unlikely that tech vendors will proactively reach out to users offering support.</div>

Fake tech support scam : Google Chrome users be Alert Tech support scams are increasingly hitting Windows users on the Google Chrome br...

Is IBM Cloud Blumix insecure ?

8/03/2017 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0-WaNEDO6AXAm3Ym8BB067AYfipaSRdX1H7ejEHJK_o0nLbpSeekz1IHr6IcY1ai2IaVWUIMpZRgP0SFPiXjwghWRdhIY4ELsRDE2PqtHA9QuTA-axzW-pkS_nAyYeQbzjRNPuqKg4uk/s1600/ibm+insecure.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="399" data-original-width="1103" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0-WaNEDO6AXAm3Ym8BB067AYfipaSRdX1H7ejEHJK_o0nLbpSeekz1IHr6IcY1ai2IaVWUIMpZRgP0SFPiXjwghWRdhIY4ELsRDE2PqtHA9QuTA-axzW-pkS_nAyYeQbzjRNPuqKg4uk/s640/ibm+insecure.jpg" width="640" /></a></div>
<br />
An e-mail has gone out from IBM about its Bluemix cloud: after next Tuesday, the SoftLayer APIs will no longer accept connections encrypted with the ancient TLS 1.0.</div>
<div>
It's not <i>quite</i> a surprise that the 1990s-era protocol was still accepted: a great many services are still midway through their deprecation plans.</div>
<div>
To give just one example, Salesforce <a href="https://help.salesforce.com/articleView?id=TLS-1-0-Disablement-Critical-Update-Console-CRUC-Setting&type=1" rel="nofollow" target="_blank">began</a> its phase-out of TLS 1.0 in production instances on July 22, 2017.</div>
<div>
And the PCI Council, which had originally wanted TLS 1.0 gone last year, had to extend its deprecation date to 30 June 2018 (and it's still <a href="https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls" rel="nofollow" target="_blank">blogging </a>early warnings for members, in case they're still failing to catch up).</div>
<div>
In the Bluemix e-mail, IBM notes: “There should be no impact to customers using a modern web client. This notification is intended to be informative only.</div>
<div>
The two services affected by the depreciation are api.softlayer.com and api.service.softlayer.com – so there's another community that's got to pay attention, namely developers who wrote to the APIs and used TLS 1.0 to secure their API access.</div>
<div>
TLS 1.0 has long been known as insecure, as far back as 2011 when it was bitten by the BEAST exploit. ®</div>
</div>

Encryption Hacking News IBM Is IBM Cloud Blumix insecure ?

An e-mail has gone out from IBM about its Bluemix cloud: after next Tuesday, the SoftLayer APIs will no longer accept connections encry...

Now Your Eyes Can Zoom With Telescopic Contact Lenses

6/30/2016 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWReQlyYDnHjT-v7lO7-9ryZivDnUg5wPt6M3J1GTvr66pqffSxKyqZ0-i2bOIlKgRL0jpOjNvODSgBrTHgO5G0mB6XkRXoTjR_mpkDDOU8xllnKlxguDWnCpxx8X70GG45hU3xk9vysY/s1600/Now-Your-Eyes-Can-Zoom-Eith-Telescopic-Contact-Lenses.jpg" imageanchor="1"><img border="0" height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWReQlyYDnHjT-v7lO7-9ryZivDnUg5wPt6M3J1GTvr66pqffSxKyqZ0-i2bOIlKgRL0jpOjNvODSgBrTHgO5G0mB6XkRXoTjR_mpkDDOU8xllnKlxguDWnCpxx8X70GG45hU3xk9vysY/s640/Now-Your-Eyes-Can-Zoom-Eith-Telescopic-Contact-Lenses.jpg" width="640" /></a></div>
<br />
Contacts have some clear advantages over eyeglasses, from being impossible to knock off by a hit or fall, to being essentially invisible unlike the edges of the eyeglass lenses. Now, they have just gained a huge new asset.<br />
<br />
We have all seen science fiction films about enhancements to our physiology, and fantasy ones where characters could see in the far distance.<br />
<br />
Now we can finally claim that we have the means to give everyone and their grandmother telescopic vision. Researchers at the Swiss Federal Institute of Technology have introduced contact lenses with zoom support.<br />
The zooming contact lenses<br />
<br />
The brainchild of researcher <span class="highlight pop">Eric Tremblay</span>, the contacts were revealed at the American Association for the Advancement of Science annual meeting in California.<br />
<br />
They are still a prototype, but they can be very useful to counteract age-related mascular degeneration (AMD for short). Age-related muscular degeneration being the main cause behind loss of sight in adults over the age of fifty.<br />
<br />
The lenses have built-in telescopes that can zoom in at 3X. The lenses themselves are rigid, but they are also larger than the normal ones, covering not just the cornea but the sclera as well (the white of the eyes).<br />
<br />
1.5 mm thick, the lenses have a ring of tiny aluminum mirrors inside, to bounce light around and magnify the view 2.8 times, increasing the perceived size of objects.<br />
<br />
You can switch between normal and zoomed view by winking the right eye, thus interrupting the light being reflexed from the contact to the glasses.<br />
<br />
And thus we reach the main drawback: the contacts don't work alone, but in tandem with <a href="http://www.hackerschronicle.com/search/label/Gadgets">smart glasses</a> which can distinguish between blinks and winks.<br />
<br />
When winking, the light being reflected from the contacts to the glasses is interrupted, activating a polarized filter in the glasses which guides light towards the telescopic part. Winking the left eye resets things to normal view.<br />
Practical applications<br />
<br />
The zooming contact lenses might not be superman-level telescopic vision, especially since they'd work while the Clark Kent persona is active, but they are still a significant achievement. Human tests haven't been carried out yet, however, and the amount of time the contacts can be worn is restricted, for health reasons.<br />
<br />
Source: Softpedia<br />
<br /></div>

Gadgets Technology Wearable Technology Now Your Eyes Can Zoom With Telescopic Contact Lenses

Contacts have some clear advantages over eyeglasses, from being impossible to knock off by a hit or fall, to being essentially invisible...

Millions of health records, LEAKED

6/28/2016 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLH8RYn6seWRyOte7fXtY8K8pjplZLMBjUEMPHB27KS7ls5QCC0Jzb4NaBoSVfAeVodHSfn6y1kG2j7nR7RRpn2sZjb8EzvXwRmyGD8_cjfYBPqzkZW9R-KydPBqbJf4fnVfjjecvLBeE/s1600/health-records-dat-breach.jpeg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" height="347" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLH8RYn6seWRyOte7fXtY8K8pjplZLMBjUEMPHB27KS7ls5QCC0Jzb4NaBoSVfAeVodHSfn6y1kG2j7nR7RRpn2sZjb8EzvXwRmyGD8_cjfYBPqzkZW9R-KydPBqbJf4fnVfjjecvLBeE/s640/health-records-dat-breach.jpeg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">The dark web seller has four batches of data, going for close to $1 million in bitcoin.</td></tr>
</tbody></table>
<br />
<br />
A hacker is advertising hundreds of thousands of alleged records from healthcare organizations on a dark web marketplace, including social security and insurance policy numbers.<br />
<br />
The seller, who goes by the name "<b>thedarkoverlord</b>" began listing the data over the weekend, but could not be immediately contacted on Monday.<br />
<br />
The largest batch of data, which the seller claims to contain a little over 9.2 million health insurance records from US patients, is on sale for 750 bitcoins. At Monday's rate, that's about $486,000. The data includes names, addresses, emails, phone numbers, dates of birth and social security numbers.<br />
<br />
We couldn't verify the authenticity of the data contained in the seller's ad. The seller did not have any points to their name, unlike other known hackers, indicating that they are new to the site. News site Motherboard contacted some users who confirmed that their data was in a sample that was received.<br />
<br />
The hacker said the data was stolen by exploiting an disclosed <a href="http://www.hackerschronicle.com/search/label/Vulnerability">zero-day</a> flaw in the remote desktop protocol (RDP), which can allow a user to remotely view another user's desktop.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAzvREp49HEWjUdGfKDRKILcDL3aKCdXrntu5j7Zj_tffLXRtaw2y4jD6yxyIY_qnd2kHKGqnh-AC6kr-Be9wbNxDLrME6ORJLvwJXFE3vqfwsjj8o8DFpFht59UIk7vnmOdpv2P0CGXw/s1600/health-recods-data-leak.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="467" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAzvREp49HEWjUdGfKDRKILcDL3aKCdXrntu5j7Zj_tffLXRtaw2y4jD6yxyIY_qnd2kHKGqnh-AC6kr-Be9wbNxDLrME6ORJLvwJXFE3vqfwsjj8o8DFpFht59UIk7vnmOdpv2P0CGXw/s640/health-recods-data-leak.png" width="640" /></a></div>
<br />
<br />
It's not all that surprising, given that earlier this year a hacker exposed thousands of insecure desktops that anyone can remotely view, thanks to poorly-configured remote desktop software. In one case, we were able to see a computer used in a pediatrician's office, which contained personal details on hundreds of patients.<br />
<br />
Another batch of data includes 207,000 records from an unnamed healthcare organization in the US midwest region, on sale for 170 bitcoins (about $110,100 at the time of writing).<br />
<br />
The seller also claims to have close to 397,000 records from members in Atlanta, Georgia -- most of which are from Blue Cross Blue Shield and United Healthcare, which is being sold for 300 bitcoin (or about $194,000).<br />
<br />
Another smaller batch contains records on 47,800 members from Farmington, Missouri, which is on sale for 60 bitcoins (or about $39,000).<br />
<br />
The hacker said in one listing that the data was stored on an "accessible internal network" and stored in plaintext -- which if true would be in violation of federal healthcare privacy rules. Another database was allegedly stolen from a Microsoft Access database.<br />
<br />
It's not clear where the data came from, but healthcare providers and hospitals have been increasingly targeted for customer and patient data in recent months. Anthem was notably hit last year, in which hackers took off with over 80 million records.<br />
<br />
According to recent data, the healthcare industry tallies up as the highest cost of a<a href="http://www.hackerschronicle.com/search/label/Data%20Leak"> data breach</a> per record.<br />
  </div>

Darknet Data Leak Hacking News Identity Theft News Millions of health records, LEAKED

The dark web seller has four batches of data, going for close to $1 million in bitcoin. A hacker is advertising hundreds of thousands...

RCE, Information Disclosure and XSS Flaws Found in PayPal

4/15/2014 cyb3r.gladiat0r 4

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuIwDgMNaan2uhQRa6VZRiUWTr7JTxgzIBKLz-HDBPC4RznLPMoODa6G5BeZfIo1MifcSy-nP72XWL_DHOY8DwNS8DiHOsRrkhGL1_ilr16MwDXTioCptQS659nbw7bwNvhKfBPK8iKaA/s1600/RCE-Information-Disclosure-and-XSS-Flaws-Found-in-PayPal-Partner-Program-Video.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="RCE, Information Disclosure and XSS Flaws Found in PayPal " border="0" height="218" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuIwDgMNaan2uhQRa6VZRiUWTr7JTxgzIBKLz-HDBPC4RznLPMoODa6G5BeZfIo1MifcSy-nP72XWL_DHOY8DwNS8DiHOsRrkhGL1_ilr16MwDXTioCptQS659nbw7bwNvhKfBPK8iKaA/s1600/RCE-Information-Disclosure-and-XSS-Flaws-Found-in-PayPal-Partner-Program-Video.jpg" title="RCE, Information Disclosure and XSS Flaws Found in PayPal " width="400" /></a></div>
<br />
A security expert has managed to identify three <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerabilities</a> on <a href="http://paypal-marketing.com/">paypal-marketing.com</a>, the website used by the payment processor for the <a href="http://www.hackerschronicle.com/search/label/PayPal">PayPal</a> Partner Program.<br />
<br />
Behrouz Sadeghipour has found and reported a <a href="http://www.hackerschronicle.com/search/label/XSS">cross-site scripting (XSS)</a> issue, a <a href="http://www.hackerschronicle.com/search/label/Remote%20Code%20Execution">remote code execution</a> flaw and an <a href="http://www.hackerschronicle.com/search/label/Information%20Disclosure">information disclosure vulnerability</a>.<br />
<br />
Initially, the researcher found the XSS flaw, which he reported to PayPal’s security team on March 19. The XSS was addressed on April 9.<br />
<br />
One day after the XSS was fixed, Sadeghipour identified an information disclosure issue, which he later leveraged for remote code execution. The expert said he was looking for an SQL Injection bug, but he found an RCE instead.<br />
<br />
To demonstrate the existence of the RCE to PayPal, he sent the company’s security team three links showing that he could retrieve the Process ID (PID), the script owner’s Group ID (GID) and the script owner’s User ID (UID) by replacing a parameter in the request with <a href="http://www.hackerschronicle.com/search/label/PHP">PHP</a> commands.<br />
<br />
By April 11, PayPal had addressed the vulnerability. The company has promised to reward the researcher in the next payment cycle.<br />
<br />
Sadeghipour highlights that the RCE he has found is a remote code execution, not a remote command execution bug. This vulnerability allows an attacker to run PHP functions. The flaw produces the same sort of results, but by leveraging PHP.<br />
<br />
Check out the proof-of-concept video for the PayPal Partner Program vulnerabilities. Additional technical details are available on <a href="http://nahamsec.com/2014/04/paypal-marketing-remote-code-execution/">Behrouz Sadeghipour's blog</a>.<br />
<iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/BB3rSd_muBc" width="560"></iframe><br />
Source: <a href="http://softpedia.com/">Softpedia</a></div>

RCE, Information Disclosure and XSS Flaws Found in PayPal

Hacking News Information Disclosure News PayPal Remote Code Execution Vulnerability XSS RCE, Information Disclosure and XSS Flaws Found in PayPal

A security expert has managed to identify three vulnerabilities on paypal-marketing.com , the website used by the payment processor for...

How to patch your server against The Heartbleed Bug

4/09/2014 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<h3>
 <div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhF8F3vAwnst4IayJY5zYLxQJ_-NQBqWbNlmhPEVZiV0HJTJ7pQWu9FwtvAUEJYWLEIgX9_d9Bem64Sv5Fo31Sy3Gcm3fcavtdzOuyp0vG39gFf-122r39HWCB-2l_fR_VVjbFKISUwlYCg/s1600/How+to+patch+your+server+against+The+Heartbleed+Bug.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="How to patch your server against The Heartbleed Bug" border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhF8F3vAwnst4IayJY5zYLxQJ_-NQBqWbNlmhPEVZiV0HJTJ7pQWu9FwtvAUEJYWLEIgX9_d9Bem64Sv5Fo31Sy3Gcm3fcavtdzOuyp0vG39gFf-122r39HWCB-2l_fR_VVjbFKISUwlYCg/s1600/How+to+patch+your+server+against+The+Heartbleed+Bug.jpg" title="How to patch your server against The Heartbleed Bug" width="318" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
</h3>
<h3>
What is the Heartbleed Bug?</h3>
<br />
The Heartbleed Bug is a serious <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerability</a> in the popular <a href="http://www.hackerschronicle.com/search/label/OpenSSL">OpenSSL</a> cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).<br />
The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users. <br />
<br />
<h3>
Before you start</h3>
Check if your OpenSSL version is vulnerable to the <a href="http://www.hackerschronicle.com/search/label/Exploit">exploit</a>. You can check it by typing in your terminal: <span class="highlight pulse">openssl version</span><br />
The result should look something like this:<br />
<div class="command wobble-horizontal">
# openssl version<br />
OpenSSL 1.0.1g 7 Apr 2014  </div>
<br />
<br />
Since we at <a href="http://www.hackerschronicle.com/">Hackers Chronicle</a> already patched our systems at the time of writing this guide, your result will probably be different.<br />
<h3>
What versions are vulnerable?</h3>
Status of different versions:<br />
<ul>
<li>OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable</li>
<li>OpenSSL 1.0.1g is NOT vulnerable</li>
<li>OpenSSL 1.0.0 branch is NOT vulnerable</li>
<li><a href="http://www.hackerschronicle.com/search/label/OpenSSL">OpenSSL</a> 0.9.8 branch is NOT vulnerable</li>
</ul>
<br />
Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.<br />
<br />
Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:<br />
<ul>
<li>Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4</li>
<li><a href="http://www.hackerschronicle.com/search/label/Ubuntu">Ubuntu</a> 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11</li>
<li><a href="http://www.hackerschronicle.com/search/label/CentOS">CentOS</a> 6.5, OpenSSL 1.0.1e-15</li>
<li>Fedora 18, OpenSSL 1.0.1e-4</li>
<li>OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)</li>
<li>FreeBSD 8.4 (OpenSSL 1.0.1e) and 9.1 (OpenSSL 1.0.1c)</li>
<li>NetBSD 5.0.2 (OpenSSL 1.0.1e)</li>
<li>OpenSUSE 12.2 (OpenSSL 1.0.1c)</li>
</ul>
Operating system distribution with versions that are not vulnerable:<br />
<ul>
<li>Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14</li>
<li>SUSE Linux Enterprise Server</li>
</ul>
<h3>
Ubuntu</h3>
open your terminal and type in the following:<br />
<span class="command wobble-horizontal">#sudo apt-get update<br />
#sudo apt-get install -y libssl1.0.0 openssl<br />
#openssl version -a <br />
//confirm the "built on" date is >= 2014-04-07<br />
sudo lsof -n | grep ssl | grep DEL <br />
//restart all listed services. Repeat this until no results are returned</span><br />
<br />
<h3>
<a href="http://www.hackerschronicle.com/search/label/Debian">Debian</a></h3>
Open terminal and copy or type the following:<br />
<span class="command wobble-horizontal">#wget http://security.debian.org/pool/updates/main/o/openssl/libssl1.0.0-dbg_1.0.1e-2+deb7u5_amd64.deb<br />
#wget http://security.debian.org/pool/updates/main/o/openssl/openssl_1.0.1e-2+deb7u5_amd64.deb<br />
#wget http://security.debian.org/pool/updates/main/o/openssl/libssl1.0.0_1.0.1e-2+deb7u5_amd64.deb<br />
#wget http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_1.0.1e-2+deb7u5_amd64.deb<br />
<br />
#dpkg -i openssl_1.0.1e-2+deb7u5_amd64.deb<br />
#dpkg -i libssl1.0.0_1.0.1e-2+deb7u5_amd64.deb<br />
#dpkg -i libssl1.0.0-dbg_1.0.1e-2+deb7u5_amd64.deb<br />
#dpkg -i libssl-dev_1.0.1e-2+deb7u5_amd64.deb<br />
<br />
#/etc/init.d/apache2 restart<br />
#/etc/init.d/ssh restart</span><br />
<br />
<h3>
CentOS</h3>
Open terminal and copy or type the following:<br />
<span class="command wobble-horizontal">#yum clean all && yum update "openssl*"</span><br />
<br />
Take note and ensure that it’s specifically <span class="system push highlight">openssl-1.0.1e-16.el6_5.7 (or later)</span> being installed. As this update has just been released, your yum mirror may not have this package yet. If your yum mirror/repository does not yet have this update, you can download and install the RPMs manually from another CentOS yum repository.<br />
<br />
After updating the packages, run the following command to see what processes still have the old, deleted OpenSSL libraries open:<br />
<span class="command wobble-horizontal">#lsof -n | grep ssl | grep DEL</span><br />
<br />
You must restart each process that still has the old libraries open.<br />
<br />
Examples of processes that may still have the old libraries open:<br />
<ul>
<li>mysql</li>
<li>postfix</li>
<li>webmin</li>
<li>openvpn</li>
<li>osad</li>
<li>nrpe</li>
</ul>
<h3>
<a href="http://www.hackerschronicle.com/search/label/Red%20Hat">Fedora/Red Hat</a></h3>
Open terminal and copy or type the following:<br />
<span class="command wobble-horizontal">$ yum update openssl</span><br />
<br />
Restart services that rely on OpenSSL<br />
<span class="command wobble-horizontal">$ lsof | grep libssl | awk '{print $1}' | sort | uniq</span><br />
<br />
<h3>
Test your website against Heartbleed Bug</h3>
<a href="http://possible.lv/tools/hb">Heartbleed Test - provided by possible.lv</a><br />
<a href="http://filippo.io/Heartbleed/">Heartbleed Test - provided by filippo.io </a><br />
<br />
Source: <a href="http://scanarch.com/" target="_blank">Scan Arch</a> </div>

How to patch your server against The Heartbleed Bug

Bug Centos CVE-2014-0160 Debian Heartbleed Bug Linux Tutorials OS Patch Red Hat Ubuntu Vulnerability How to patch your server against The Heartbleed Bug

What is the Heartbleed Bug? The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software librar...

SQL Injection vulnerability in Yahoo

4/08/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTL6tV9kV7M1jnMiGsqJkN05t-AAte545WWB5lT0nMMl0ySjeeSv-ygAOYGGJvzdimuyEVq_HIt9dcbu4rZcVtV_Z2PbTp21u8eEUudbExSQnpDf5ZFe1jmLYBwiCnMTZz5yrKpNpBlAZ5/s1600/Expert-Finds-8-Files-Vulnerable-to-SQL-Injection-in-Yahoo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Expert Finds 8 Files Vulnerable to SQL Injection in Yahoo HK Promotions Pages" border="0" height="351" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTL6tV9kV7M1jnMiGsqJkN05t-AAte545WWB5lT0nMMl0ySjeeSv-ygAOYGGJvzdimuyEVq_HIt9dcbu4rZcVtV_Z2PbTp21u8eEUudbExSQnpDf5ZFe1jmLYBwiCnMTZz5yrKpNpBlAZ5/s1600/Expert-Finds-8-Files-Vulnerable-to-SQL-Injection-in-Yahoo.png" title="Expert Finds 8 Files Vulnerable to SQL Injection in Yahoo HK Promotions Pages" width="640" /></a></div>
<br />
Security researcher <strong>Behrouz Sadeghipour</strong> has identified several <a href="http://www.hackerschronicle.com/search/label/SQL%20Injection">SQL Injection</a> <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerabilities</a> in a Hong Kong subdomain of <a href="http://www.hackerschronicle.com/search/label/Yahoo">Yahoo</a>. He reported his findings to the company and all the security holes have been fixed.<br />
<br />
According to the expert, the flaws have been found in various files on the Hong Kong promotions subdomain (<a href="http://hk.promotions.yahoo.com/">hk.promotions.yahoo.com</a>). <br />
<br />
He decided to analyze this subdomain because it contains a lot of Flash files and PHP scripts that could be vulnerable, and it doesn’t appear that the pages have been created by Yahoo’s core developers. <br />
<br />
Furthermore, since the pages are in Chinese, it’s likely that they’re ignored by many auditors.<br />
<br />
The expert has managed to identify a total of eight vulnerable files. Following his analysis of the Yahoo HK promotions subdomain, Sadeghipour sent 5 reports to the company. <br />
<br />
The list of pages on which he found SQL Injection vulnerabilities includes the Emotive2012 page, the <a href="http://www.hackerschronicle.com/search/label/Nikon">Nikon</a> Photo Itinerary page, and the Education page. By leveraging these bugs, the researcher managed to gain access to names, email addresses and other information.<br />
<br />
Yahoo addressed the issues within a month after being reported. The expert has told me that the company has removed the vulnerable files. <br />
<br />
As some of our readers might know, this isn’t the first time <strong>Sadeghipour</strong> finds serious vulnerabilities in Yahoo’s Hong Kong subdomains. Last month, he identified a <a href="http://www.hackerschronicle.com/2014/03/remote-code-execution-in-yahoo.html">remote code execution flaw</a>.<br />
<br />
At the time, he found an administrator panel for the hk.yahoo.net subdomain that could be accessed with <span class="highlight pop">admin/admin</span> credentials. <br />
<br />
For additional details on the SQL Injection vulnerabilities found in Yahoo, check out <a href="http://nahamsec.com/2014/04/yahoo-sql-injection/">Behrouz Sadeghipour‘s blog</a>. You can also check out the proof-of-concept videos he made for a couple of the flaws:<br />
<iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/8MuWtVqj4iU" width="560"></iframe><br />
<br />
<iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/8HN-91UxUh8" width="560"></iframe><br /></div>

Hacking News News SQL Injection Vulnerability Yahoo SQL Injection vulnerability in Yahoo

Security researcher Behrouz Sadeghipour has identified several SQL Injection vulnerabilities in a Hong Kong subdomain of Yahoo . He...