Russian Defence Hacked, 500+MB Data Leaked

3/06/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOflRQn5hAdjYc6YeeCb31T1Apix8GJ46RKRFwXVksjDRg_09tVZB-_GeDWpeEf0Lm3MLZ2gKrDPRpx3lM8-WTX2ivOW3gkME_440Dap1bgzrgZku_aZ2qFAcgZ-Yg_Sl6fCqAUve5MMrA/s1600/russian-defence-hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Russian Defence Export Hacked" border="0" height="71" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOflRQn5hAdjYc6YeeCb31T1Apix8GJ46RKRFwXVksjDRg_09tVZB-_GeDWpeEf0Lm3MLZ2gKrDPRpx3lM8-WTX2ivOW3gkME_440Dap1bgzrgZku_aZ2qFAcgZ-Yg_Sl6fCqAUve5MMrA/s1600/russian-defence-hacked.png" title="Russian Defence Hacked" width="400" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
Today Russian hacktivist <a href="https://twitter.com/Rucyborg" target="_blank">Rucyborg</a> has announced a big leak of files from Russian Defence Export ROSOBORONEXPORT (<a href="http://www.roe.ru/" target="_blank">http://www.roe.ru/</a>).<br />
The leak was announced just a short time ago from twitter and has been posted to <a href="https://www.cyberguerrilla.org/blog/?p=17581" target="_blank">cyberguerrilla</a>. The leaked files are just the first part of a few to come from the Russian government.<br />
The attacks have been carried out due to the recent drama Putin is causing and the Russian hackers have stated they do not want any war all they want to do is expose Putin and his government for what they are.<br />
they have also stated that leaks from <a href="https://en.wikipedia.org/wiki/Sukhoi" target="_blank">Sukhoi</a>, <a href="https://en.wikipedia.org/wiki/Oboronprom" target="_blank">Oboronprom</a>, <a href="http://eng.gazflot.ru/" target="_blank">Gazflot</a>, <a href="http://eng.gazflot.ru/" target="_blank">Rusal</a> and others.<br />
The leaked data has been uploaded to <a href="http://bayfiles.net/file/18nWT/NHiWky/rusarms.rar" target="_blank">bayfiles</a> as a 488MB rar file and a <a href="http://bayfiles.net/file/18nWT/NHiWky/rusarms.rar">preview</a> of the leaked documents has also been provided.<br />
<div>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3UbsoF_nnfmXkzISesJ79ayr6pS_VH2xdqCHbcjEOwc8lPmcfjpnlIgzH_U0elX5qMbLf-Tu79cfJNUo8t56Xzttmvj7R7A0neJuC0fC4O5hKOTMEPPKWpiGrDLGvJ4BAkjlS0MtZnn9n/s1600/roe-mil-leak-1.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3UbsoF_nnfmXkzISesJ79ayr6pS_VH2xdqCHbcjEOwc8lPmcfjpnlIgzH_U0elX5qMbLf-Tu79cfJNUo8t56Xzttmvj7R7A0neJuC0fC4O5hKOTMEPPKWpiGrDLGvJ4BAkjlS0MtZnn9n/s1600/roe-mil-leak-1.jpg" width="229" /></a></div>
<div>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlsxdtUDPj1N_YfEjD0-uc9AMnKJSbP6cTEdpL8JuH7wD6rhZ0ye0ZbivUIzFApi0EhGXUignB15GRWt1fbWVfA5wHQa-dmoN_qHhDEONx1wKjg5HYfCiFZOV3PBRgEnuiWJnkyErZQ_kl/s1600/roe-mil-leak-3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="242" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlsxdtUDPj1N_YfEjD0-uc9AMnKJSbP6cTEdpL8JuH7wD6rhZ0ye0ZbivUIzFApi0EhGXUignB15GRWt1fbWVfA5wHQa-dmoN_qHhDEONx1wKjg5HYfCiFZOV3PBRgEnuiWJnkyErZQ_kl/s1600/roe-mil-leak-3.jpg" width="320" /></a></div>
<br /><br /><br /><br /></div>

Today Russian hacktivist Rucyborg has announced a big leak of files from Russian Defence Export ROSOBORONEXPORT ( http://www.roe.ru/ )...

Bitcoin Bank Hacked, Theft of $6,20,000

3/04/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqrBYVYzRsfVnaUNr447VTqFtwzKDZUNcHJocKWkQNtZ8KpPCHCykPNCC3c7qhrtW8-6iSe2wkHrqQlrUmXalRzjg02z5mPShMs1qQUbx3BBnMJTaUE_JmKor5wZMN-9_bo7jtvuaQohGm/s1600/bitcoin-hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bitcoin Bank Hacked, Theft of $6,20,000" border="0" height="225" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqrBYVYzRsfVnaUNr447VTqFtwzKDZUNcHJocKWkQNtZ8KpPCHCykPNCC3c7qhrtW8-6iSe2wkHrqQlrUmXalRzjg02z5mPShMs1qQUbx3BBnMJTaUE_JmKor5wZMN-9_bo7jtvuaQohGm/s1600/bitcoin-hacked.png" title="Bitcoin Bank Hacked, Theft of $6,20,000" width="400" /></a></div>
<br />
Flexcoin, famous for making <a href="http://www.hackerschronicle.com/search/label/Bitcoin" target="_blank">bitcoin</a> banking as easy as regular banking, is no more. The company shut its doors on Tuesday morning after hackers stole 896 bitcoins (nearly $620,000) from its vault on Sunday. And the most unsettling thing? That wasn't even the only bitcoin heist last weekend.<br />
To <a href="https://en.bitcoin.it/wiki/Flexcoin" target="_blank">Flexcoin's</a> credit, it wasn't completely cleaned out by hackers. Hackers did clean out Flexcoin's hot wallet, but an undisclosed number of bitcoins in cold storage were untouched. "Cold storage" simply means that the bitcoins were kept in computers <a href="https://en.bitcoin.it/wiki/Cold_storage" target="_blank">not connected to the internet</a>, an extra level of security for which customers pay an extra 0.5 percent. Flexcoin will give those bitcoins back to customers. Those whose bitcoins were stolen are, well, they're shit out of luck because bitcoins aren't insured like good ol' greenbacks are in most banks.<br />
If this sounds like a familiar story, that's because it is. On Tuesday, another bitcoin firm called <a href="https://bitcointalk.org/index.php?topic=499580" target="_blank">Polonix</a> also admitted that hackers broke in and stole 12.5 percent of its reserves, though it plans on replenishing the lost 'coin itself. And who could forget the infamous implosion of Mt.Gox, the Japan-based bitcoin exchange that filed for bankruptcy last week and announced that $424 million worth of cryptocurrency was lost and gone forever. Those just a couple of the major heists and boondoggles on a growing list of heists and boondoggles.<br />
But what do you expect. The burgeoning bitcoin industry is famously unstable and <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerable</a>. Sure, it's an exciting idea for the sake of liberty and anarchy and whatever! It's just not the safest way to store your money right now, is all.</div>

Bitcoin Cyber Crime Hacking News News Russian Hackers Source Code Bitcoin Bank Hacked, Theft of $6,20,000

Flexcoin, famous for making bitcoin banking as easy as regular banking, is no more. The company shut its doors on Tuesday morning after...

Vulnerability in Android Jelly Bean and Kitkat

3/04/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgB64JLSeKK-sFwz5fG7fHovaSqZY48Pba15HVzbNxSVHCFJ7Q0VhN45sZIUks8aXkdDj31eaKvDVwZSzcAKnxR1hpHGzGiF9LNVVutYHrGx6PcYzWFdBTULGYn8pWzh73_9anxFQ9xZa-z/s1600/android-kitkat-vulnerability.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Vulnerability in Android Jelly Bean and Kitkat" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgB64JLSeKK-sFwz5fG7fHovaSqZY48Pba15HVzbNxSVHCFJ7Q0VhN45sZIUks8aXkdDj31eaKvDVwZSzcAKnxR1hpHGzGiF9LNVVutYHrGx6PcYzWFdBTULGYn8pWzh73_9anxFQ9xZa-z/s1600/android-kitkat-vulnerability.png" title="Vulnerability in Android Jelly Bean and Kitkat" width="320" /></a></div>
<br />
The researchers at <a href="http://en.wikipedia.org/wiki/Indian_Computer_Emergency_Response_Team" target="_blank">CERT-IN</a>, the Indian governments agency that monitors cyber threats, issued the advisory about the <a href="http://en.wikipedia.org/wiki/Vpn" target="_blank">VPN</a> flaw a few days ago.<br />
A critical flaw has been detected in the virtual private network offered by <a href="http://www.hackerschronicle.com/search/label/Android">Android</a> operating systems in the Indian cyberspace leading to hijack of personal data of users.<br />
Internet security sleuths have alerted consumers of this web-based service to guard against the spread of this <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">virus</a> which affects computer systems and mobile phones using the Android system.<br />
The suspicious activity has been noticed in two Android versions: 4.3 known as '<a href="http://en.wikipedia.org/wiki/Android_Jelly_Bean#Android_4.1_Jelly_Bean_.28API_level_16.29" target="_blank">Jelly Bean</a>' and the latest version 4.4 called '<a href="http://en.wikipedia.org/wiki/Android_Jelly_Bean#Android_4.4_KitKat_.28API_level_19.29" target="_blank">KitKat</a>'.<br />
"A critical flaw has been reported in Android's (<a href="http://www.hackerschronicle.com/search/label/VPN" target="_blank">virtual private network</a>) VPN implementation, affecting Android version 4.3 and 4.4 which could allow an attacker to bypass active VPN configuration to redirect secure VPN communications to a third party server or disclose or hijack unencrypted communications", said CERT-In in a latest advisory to users of this network.<br />
VPN technology is used to create an encrypted tunnel into a private network over public Internet. Organisations and group of people use such connections to enable employees or acquaintances to securely connect to enterprise networks from remote locations through multiple kinds of devices like laptops, desktops, mobiles and tablets.<br />
The agency said the current malicious application is capable of diverting the VPN traffic "to a different network address" and successful exploitation of this issue "could allow attackers to capture entire communication originating from affected device".<br />
"It is noted that not all applications are encrypting their network communication. Still there is a possibility that attacker could possibly capture sensitive information from the affected device in plain text like email addresses, IMEI number, SMSes, installed applications", the advisory said.<br />
Cyber experts said that this anomaly could only lead to capture and viewing the data which is in plain text and Android applications directly connecting to the server using SSL will not be affected. Websites which use 'https' in their URL will also be safe. The cyber agency has also suggested some counter measures to beat this threat.<br />
"Apply appropriate updates from original equipment manufacturer, do not download and install application from untrusted sources, maintain updated mobile security solution or <a href="http://www.hackerschronicle.com/search/label/Mobile">mobile</a> <a href="http://www.hackerschronicle.com/search/label/Anti%20Virus" target="_blank">anti-virus</a> solutions on the device, exercise caution while visiting trusted or untrusted URLs and do not click on the URLs received via SMS or email unexpectedly from trusted or received from untrusted users", are some of the combat techniques which have been suggested by the agency.</div>

Android Malwares Mobile VPN Vulnerability Vulnerability in Android Jelly Bean and Kitkat

The researchers at CERT-IN , the Indian governments agency that monitors cyber threats, issued the advisory about the VPN flaw a few da...

Cisco offers $300k for security solutions

3/04/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhashm6UT7AhyoNKmAs8M88GEusoYGA41n4_tQ_Z5XtJIcSX8qJCHp8jyUYXKcGsFyJ7YOT-EnaMXcd6sGZ_GHk2Ht-GW61_SYb8anWDElQT_P2jVI_XAWW7qjDsNBXt1fEEfsCiOcSpbkp/s1600/Cisco.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Cisco offers $300k for IoT security solutions" border="0" height="248" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhashm6UT7AhyoNKmAs8M88GEusoYGA41n4_tQ_Z5XtJIcSX8qJCHp8jyUYXKcGsFyJ7YOT-EnaMXcd6sGZ_GHk2Ht-GW61_SYb8anWDElQT_P2jVI_XAWW7qjDsNBXt1fEEfsCiOcSpbkp/s1600/Cisco.jpg" title="Cisco offers $300k for IoT security solutions" width="400" /></a></div>
<br />
Cisco has launched a new competition and is calling on "visionaries, innovators, and implementers" to propose practical solutions for issues affecting security of the Internet of Things.<br />
"We’re connecting more of our world every day through smart, IP-enabled devices ranging from home appliances, healthcare devices, and industrial equipment. These new connected devices are offering new ways to share information and are changing the way we live," says Christopher Young, senior VP for the security group at <a href="http://www.hackerschronicle.com/search/label/Cisco">Cisco</a>.<br />
"Yet, as our connected lives grow and become richer, the need for a new security model becomes even more critical. It requires that we work together as a community to find innovative solutions to make sure that the IoT securely fulfills its potential and preserves the convenience that it represents."<br />
Young announced the Challenge last week in his keynote address at the <a href="http://www.net-security.org/event/rsaconference2014" target="_blank">RSA Conference</a>, and has offered more details in a <a href="http://blogs.cisco.com/security/join-the-challenge-secure-the-internet-of-things/" target="_blank">blog post</a>. <br />
<a href="http://www.ninesights.com/community/cisco" target="_blank">The Internet of Things Security Grand Challenge</a> has a prize pot of $300,000 - a maximum of 6 winners will receive awards from $50,000 to $75,000. Also good to know that all participants will have an opportunity for additional collaboration with Cisco beyond the challenge.<br />
The proposals' feasibility, scalability, performance, and ease of use will be assessed by an evaluation panel consisting of five Cisco engineers and scientists, including Dave Evans, the company's Chief Futurist.<br />
The deadline for submissions is June 17, 2014, and the winners will announced and their solutions showcased at the Internet of Things World Forum this fall.
</div>

Cisco News RSA Conference 2014 security spending Cisco offers $300k for security solutions

Cisco has launched a new competition and is calling on "visionaries, innovators, and implementers" to propose practical soluti...

Tor develops its own anonymous Messenger

3/02/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJzH6v0uRoXN15MFZggZepo4zm0mGk5KG2yYIm9aTnP-lqdVTdn1IeqQ1fZsKJmMhCI1QaUcm8uN7BdJRqZKzobT5SY2tsYHlErxF3srXaNBWJkJSrYUoVqSwh7nXPJ8lO4azOoLx6L9Do/s1600/TOR-Messenger.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="The Instantbird IM tool will be the basis of the Tor Project's new anonymizing IM client." border="0" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJzH6v0uRoXN15MFZggZepo4zm0mGk5KG2yYIm9aTnP-lqdVTdn1IeqQ1fZsKJmMhCI1QaUcm8uN7BdJRqZKzobT5SY2tsYHlErxF3srXaNBWJkJSrYUoVqSwh7nXPJ8lO4azOoLx6L9Do/s1600/TOR-Messenger.jpg" title="Service will force instant message traffic over Tor's network to evade surveillance." width="640" /></a></div>
<br />
The Tor Foundation is moving forward with a plan to provide its own instant messaging service. Called the Tor Instant Messaging Bundle, the tool will allow people to communicate in real time while preserving anonymity by using chat servers concealed within Tor’s hidden network.<br />
In planning since last July—as news of the National Security Agency’s broad surveillance of instant messaging traffic emerged—the Tor Instant Messaging Bundle (TIMB) should be available in experimental builds by the end of March, based on a <a href="https://trac.torproject.org/projects/tor/wiki/org/meetings/2014WinterDevMeeting/notes/RoadmapTIMB" target="_blank">roadmap</a> published in conjunction with the <a href="https://trac.torproject.org/projects/tor/wiki/org/meetings/2014WinterDevMeeting" target="_blank">Tor Project’s Winter Dev meeting in Iceland</a>.<br />
TIMB will connect to instant messaging servers configured as Tor “hidden services” as well as to commercial IM services on the open Internet.<br />
The effort, which is funded by an <a href="https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorO" target="_blank">anonymous donor organization</a>, was originally called <a href="https://trac.torproject.org/projects/tor/wiki/org/sponsors/Otter/Attentive/Plan" target="_blank">Attentive Otter</a>. To ensure the anonymity of the user, TIMB will force all instant messaging traffic through the Tor network, regardless of whether it’s aimed at a server on the Tor network or not. TIMB will be based on <a href="http://www.instantbird.org/" target="_blank">Instantbird</a>, an open source instant messaging tool which is itself based on <a href="http://www.hackerschronicle.com/search/label/Mozilla" target="_blank">Mozilla’s</a> <a href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/XULRunner" target="_blank">XULrunner</a> cross-platform runtime environment.<br />
Instantbird was chosen after the TIMB team decided against using Pidgin or <a href="https://developer.pidgin.im/wiki/WhatIsLibpurple" target="_blank">libpurple</a>, the GPL open-source instant messaging library used by Pidgin and Adium, mostly because of the amount of effort that would have been required to audit and maintain the library, and also because of <a href="https://lists.torproject.org/pipermail/tor-dev/2013-October/005544.html" target="_blank">some concerns about how seriously Pidgin’s developers took security concerns</a>. The TIMB project will remove libpurple from Instantbird, a task that the Mozilla and Instantbird team were already working toward as they move the software to a pure JavaScript implementation.<br />
The first experimental release of TIMB won’t include “<a href="https://otr.cypherpunks.ca/" target="_blank">off the record” (OTR) capability</a>. OTR mode encrypts traffic further and uses an exchange of digital signatures to verify the identity of each party. But the signatures can’t be checked by anyone outside the instant messaging session and can’t be used to prove identity outside the session. The Tor team is hoping to develop OTR components for Instantbird and get them merged into future versions of the main Instantbird code line.</div>

Anonymous Mozilla News Tor Tor Instant Messager Tor develops its own anonymous Messenger

The Tor Foundation is moving forward with a plan to provide its own instant messaging service. Called the Tor Instant Messaging Bundle, ...

Cross-Site Request Forgery(CSRF) Vulnerability in HP Service Manager

2/26/2014 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi95cNED1sSP_JKoftxfkj3UFWlO-Cx3ZuqmFFSzczDImVpij9pBh6opd4ZHStF1joHDuiQKa32dyXmUrABdEatbMYD0sAy0KB_TikKCbdZ7edATNhww8oqB6DAxfIQ2lHShhWF2BDUSi4/s1600/hp+csrf.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Cross-Site Request Forgery(CSRF)  in HP (Hewlett-Packard)" border="0" height="190" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi95cNED1sSP_JKoftxfkj3UFWlO-Cx3ZuqmFFSzczDImVpij9pBh6opd4ZHStF1joHDuiQKa32dyXmUrABdEatbMYD0sAy0KB_TikKCbdZ7edATNhww8oqB6DAxfIQ2lHShhWF2BDUSi4/s1600/hp+csrf.jpg" title="Cross-Site Request Forgery(CSRF)  in HP (Hewlett-Packard)" width="400" /></a></div>
<br />
Potential security vulnerabilities have been identified with <a href="http://www.hp.com/" rel="nofollow" target="_blank">HP</a> Service Manager. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (<a href="http://www.hackerschronicle.com/search/label/XSS" target="_blank">XSS</a>), Cross-Site Request Forgery (<a href="http://www.hackerschronicle.com/search/label/CSRF" target="_blank">CSRF</a>), Denial of Service (<a href="http://www.hackerschronicle.com/search/label/DoS" target="_blank">DoS</a>), execution of arbitrary code, unauthorized access, disclosure of Information, and authentication issues.<br />
<br />
<h3>
Effected Software Versions</h3>
HP Service Manager<br />
<ul>
<li>v9.30</li>
<li>v9.31</li>
<li>v9.32</li>
<li>v9.33</li>
</ul>
<h3>
Solution</h3>
HP has made the following software updates available to resolve the vulnerabilities.<br />
<ul>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00507" target="_blank">AIX Server 9.33.0035</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00508">HP Itanium Server 9.33.0035</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00509">Linux Server 9.33.0035</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00510">Solaris Server 9.33.0035</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00511" target="_blank">Windows Server 9.33.0035</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00512" target="_blank">Web Tier 9.33.0035</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00513" target="_blank">Windows Client 9.33.0035</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00514" target="_blank">Windows Client Configuration 9.33.0035</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00515" target="_blank">Mobility 9.33.0006</a></li>
<li><a href="http://support.openview.hp.com/selfsolve/document/LID/HPSM_00516" target="_blank">Applications 9.33.0035</a></li>
</ul>
<h3>
Technical Details</h3>
<ul>
<li><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1493" target="_blank">CVE-2013-1493</a> - Oracle Java JRE 1.7 Remote Execution of Arbitrary Code and Denial of Service (DoS)</li>
<li><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2067" target="_blank">CVE-2013-2067</a> - Apache Tomcat Authentication Issues</li>
<li><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6202" target="_blank">CVE-2013-6202</a> - Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Remote Execution of Arbitrary Code, Unauthorized Access, Disclosure of Information</li>
</ul>
Source: <a href="http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c04117626&ac.admitted=1393402317326.876444892.492883150" target="_blank">HP</a></div>

CSRF HP Vulnerability Cross-Site Request Forgery(CSRF) Vulnerability in HP Service Manager

Potential security vulnerabilities have been identified with HP Service Manager. The vulnerabilities could be remotely exploited result...

Install & Configure HAProxy on CentOS for Load Balancing

2/26/2014 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-FGNaqO7JgyS87FGY56QxtTA8qdmKBwQSWxPMrPCdX6vxOB-BXyHJAzspbQa4_ib24af1BxbdJY7NKrJ43WK6p5TDFPRTcG8XzmcwQofSSs95dokh9FtpbUKIukxzlt_Dxi0ae3cnGrA/s1600/installing-haproxy-on-centos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Installing HAProxy on CentOS for Load Balancing" border="0" height="256" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-FGNaqO7JgyS87FGY56QxtTA8qdmKBwQSWxPMrPCdX6vxOB-BXyHJAzspbQa4_ib24af1BxbdJY7NKrJ43WK6p5TDFPRTcG8XzmcwQofSSs95dokh9FtpbUKIukxzlt_Dxi0ae3cnGrA/s1600/installing-haproxy-on-centos.png" title="Installing HAProxy on CentOS for Load Balancing" width="320" /></a></div>
<br />
HAproxy is open source proxy that can be used to enable <a href="http://en.wikipedia.org/wiki/High_availability">high availability</a> and <a href="http://en.wikipedia.org/wiki/Load_balancing_(computing)">load balancing</a> for web applications. It was designed especially for high load projects so it is very fast and predictable, HAProxy is based on single-process model.<br />
<br />
<div style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA5j4GnrTrI8gUBenIJIvo5wtPO1FwxsLGHQo-XFNyKTk41I7c3BuMI3Sq7_begyT0pIfOTO9rqsVU77YMOZDepziJvEN34rvTERZJhas11TTLWzXlFCwsGOok5EnvjbJpMoIBohezUmM/s1600/HAProxy-logo.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img alt="Installing HAProxy on CentOS for Load Balancing" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA5j4GnrTrI8gUBenIJIvo5wtPO1FwxsLGHQo-XFNyKTk41I7c3BuMI3Sq7_begyT0pIfOTO9rqsVU77YMOZDepziJvEN34rvTERZJhas11TTLWzXlFCwsGOok5EnvjbJpMoIBohezUmM/s1600/HAProxy-logo.png" title="Installing HAProxy on CentOS for Load Balancing" /></a></div>
In this post I’ll describe sample setup of HAProxy: users’ requests are load balanced between two web servers <strong>Web1</strong> and <strong>Web2</strong>, if one of them goes down then all the request are processed by alive server, once dead servers recovers load balancing enables again. See topology to the right.<br />
<h3>
Installation</h3>
<br />
HAProxy is included into repositories for major Linux distributions, so if you’re using <a href="http://www.hackerschronicle.com/search/label/Centos">Centos</a>, <a href="http://www.hackerschronicle.com/search/label/Redhat">Redhat</a> or <a href="http://www.hackerschronicle.com/search/label/Fedora">Fedora</a> type the following command:<br />
<br />
<div class="command wobble-horizontal">
#yum install haproxy</div>
<br />
<br />
If you’re Ubuntu, Debian or Linux Mint user use this one instead:<br />
<br />
<div class="command wobble-horizontal">
#apt-get install haproxy</div>
<h3>
Configuration</h3>
<br />
As soon as HAProxy is installed it’s time to edit its configuration file, usually it’s placed in <span class="highlight system pop">/etc/haproxy/haproxy.cfg</span>.<br />
Official documentation for HAProxy 1.4 (stable) is <a href="http://haproxy.1wt.eu/download/1.4/doc/configuration.txt">here</a>.<br />
<br />
Here is configuration file to implement setup shown at the diagram and described above:<br />
<div class="content shadow-radial">
global<br />
user daemon<br />
group daemon<br />
daemon<br />
log 127.0.0.1 daemon<br />
<br />
listen http<br />
bind 1.2.3.4:80<br />
mode http<br />
option tcplog<br />
<br />
log global<br />
option dontlognull<br />
<br />
balance roundrobin<br />
clitimeout 60000<br />
srvtimeout 60000<br />
contimeout 5000<br />
retries 3<br />
server web1 web1.hackerschronicle.com:80 check<br />
server web2 web2.hackerschronicle.com:80 check<br />
cookie web1 insert nocache<br />
cookie web2 insert nocache</div>
<br />
<br />
Let’s stop on most important parts of this configuration file. Section <strong>global</strong> specifies user and group which will be used to run haproxy process (<strong>daemon</strong> in our example). Line <strong>daemon</strong> tells HAProxy to run in background, <strong>log 127.0.0.1 daemon</strong> specifies syslog facility for sending logs from HAProxy.<br />
<br />
Section <strong>listen http</strong> contains line <strong>bind 1.2.3.4:80</strong> that specifies IP address and port that will be used to accept users’ requests (they will be load balanced between Web1 and Web2). Line <strong>mode http</strong> means that HAProxy will filter all requests different from HTTP and will do load balancing over HTTP protocol.<br />
<br />
Line <strong>balance roundrobin</strong> specifies load balancing algorithm according to which each web server (Web1 and Web2) will be used in turns according to their weights. In our example weights for both servers are the same so load balancing is fair.<br />
<br />
Lines <strong>server web1</strong> … and <strong>server web2</strong> … specify web servers for load balancing and failover, in our case they are load balanced according to round robin algorithm and have the same priority/weight.<br />
<br />
The last two lines in configuration files are optional, they makes it possible to preserve cookies, it means for example that if you logged in to web application hosted at Web1 and then HAProxy forwarded your next request to Web2 you will still have logged in session opened as cookies with session id from Web1 will be sent to you from Web2 as well.</div>
<h3>
Start HAProxy Service</h3>
<div class="command wobble-horizontal">
# service haproxy start<br />
# chkconfig haproxy on</div>
<br />
<br />
<strong>Congratulation’s!</strong> you have successfully configured HAProxy load balancer. Read next article to <a href="http://www.hackerschronicle.com/search/label/HAProxy">enable haproxy stats</a> and <a href="http://www.hackerschronicle.com/search/label/HAProxy">setup ACL in HAProxy</a>.</div>

Centos HAProxy Linux Tutorials Load Balancing Tutorials Install & Configure HAProxy on CentOS for Load Balancing

HAproxy is open source proxy that can be used to enable high availability and load balancing for web applications. It was designed es...

Russian Defence Hacked, 500+MB Data Leaked

Bitcoin Bank Hacked, Theft of $6,20,000

Vulnerability in Android Jelly Bean and Kitkat

Cisco offers $300k for security solutions

Tor develops its own anonymous Messenger

Cross-Site Request Forgery(CSRF) Vulnerability in HP Service Manager

Install & Configure HAProxy on CentOS for Load Balancing

Popular

Comments

Archive