Hollowood Hacker to be sentenced

<div dir="ltr" style="text-align: left;" trbidi="on"><br />The Jacksonville man who hacked into the emails of Hollywood celebrities could face up to six years in prison for his crimes and pay more thousands of dollars to his victims.<br /><br />The victims who were hacked include Scarlett Johanson and Christina Aguilera, just to name a few.<br /><br />His nickname has become The Hollywood Hacker. 35-year-old Christopher Chaney admitted to being sorry for hacking into the online accounts of stars like Christina Aguilera and Scarlett Johanson.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK0xhSm8cKCRKHeUJ5Jv2sdHCScIL1Rqk3sg_0RcHKoKXCc-iU97UXiaL1GGX3EcnzIttnjLVFsR4TEXyGIyQVyclHS-Yn4Oxfud8rEU213RDKgRKWovKmyu9vgNI7siMH7y0FNOruylz5/s1600/Hollywood-Hacker.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="225" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK0xhSm8cKCRKHeUJ5Jv2sdHCScIL1Rqk3sg_0RcHKoKXCc-iU97UXiaL1GGX3EcnzIttnjLVFsR4TEXyGIyQVyclHS-Yn4Oxfud8rEU213RDKgRKWovKmyu9vgNI7siMH7y0FNOruylz5/s400/Hollywood-Hacker.jpg" width="400" /></a></div><br /><br />But despite the fact that Chaney has shown remorse for his online crimes, the Jacksonville man may have to pay $150,000 in fines and spend 71 months behind bars.<br /><br />In court Chaney was asked, “What do you want to tell your family. Do you really think that’s right?” After this question, Chaney apologized.<br /><br />“It’s not that we’re retreating from this. but we can’t wholly embrace it either, because the case is becoming more convoluted and more convoluted,” Chaney’s lawyer Mark Chestnutt said.<br /><br />Chaney’s lawyers said it was an adrenaline rush that fueled his online criminal behavior. He even sent nude photos of the stars to celebrity websites and other hackers.<br /><br />Prosecutors want Chaney to compensate his victims.<br /><br />They said Scarlett Johanson is owed more than $66,000, Christina Aguilera $7,500, Renee Olstead $76,000 and an undisclosed amount to Mila Kunis.<br /><br />In addition to the hollywood starlets, a search warrant of Chaney’s hard drive revealed that it was used to conduct Internet searches for an underage Connecticut woman. She complained to police that Chaney had been chatting with her online since she was 13. She alleged the hacker stole private transmissions as well, but his lawyer claims the opposite.<br /><br />“He says man, I”ve never heard of her,” Chestnutt said. “Listen, this guy’s never been on a plane! Never been to Connecticut. Never met this young lady. Hedoesn’t know her, doesn’t recall talking with her on the Internet.”<br /><br />Chaney is scheduled to be sentenced Monday morning in Los Angeles federal court on his guilty plea to nine felony counts of hacking into the email accounts of several actresses. Prosecutors have recommended 6 years in prison.<br /></div>

Hollowood Hacker to be sentenced

The Jacksonville man who hacked into the emails of Hollywood celebrities could face up to six years in prison for his crimes and pay more thousands of dollars to his victims.The victims who were hacke…

Read more »

Hacker Will Expose Potential Security Flaw In Four Million Hotel Room Keycard Locks

<div dir="ltr" style="text-align: left;" trbidi="on">The next time you stay in a hotel room, run your fingers under the keycard lock outside your door. If you find a DC power port there, take note: With a fe<span class="text_exposed_show">w hacker tricks and a handful of cheap hardware, that tiny round hole might offer access to your room just as completely as your keycard.</span><br /><span class="text_exposed_show"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1Fp39Y-k2ZBVCzBM4sfmqDqNGWzNrPykR49fzHMcK3T0LAAM-c7W5jHk6sI2zkEQ6RGIWx7uWGDqC0B7VMSDVdo6L3217Lj3LwUqAFcHMWVrRt4AozaPDNLkxcXmlCiamyUAH42I827iB/s1600/Security+Flaw+In+Four+Million+Hotel+Room+Keycard+Locks.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="277" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1Fp39Y-k2ZBVCzBM4sfmqDqNGWzNrPykR49fzHMcK3T0LAAM-c7W5jHk6sI2zkEQ6RGIWx7uWGDqC0B7VMSDVdo6L3217Lj3LwUqAFcHMWVrRt4AozaPDNLkxcXmlCiamyUAH42I827iB/s400/Security+Flaw+In+Four+Million+Hotel+Room+Keycard+Locks.jpg" width="400" /></a></div><span class="text_exposed_show"><br /> At the Black Hat security conference Tuesday evening, a Mozilla software developer and 24-year old security researcher named Cody Brocious plans to present a pair of vulnerabilities he’s discovered in hotel room locks from the manufacturer Onity, whose devices are installed on the doors of between four and five million hotel rooms around the world according to the company’s figures. Using an open-source hardware gadget Brocious built for less than $50, he can insert a plug into that DC port and sometimes, albeit unreliably, open the lock in a matter of seconds. “I plug it in, power it up, and the lock opens,” he says simply.<br /> <br /> In fact, Brocious’s break-in trick isn’t quite so straightforward. Testing a standard Onity lock he ordered online, he’s able to easily bypass the card reader and trigger the opening mechanism every time. But on three Onity locks installed on real hotel doors he and I tested at well-known independent and franchise hotels in New York, results were much more mixed: Only one of the three opened, and even that one only worked on the second try, with Brocious taking a break to tweak his software between tests.<br /> <br /> Even with an unreliable method, however, Brocious’s work–and his ability to open one out of the three doors we tested without a key–suggests real flaws in Onity’s security architecture. And Brocious says he plans to release all his research in a paper as well as source code through his website following his talk, potentially enabling others to perfect his methods.<br /> <br /> Brocious’s exploit works by spoofing a portable programming device that hotel staff use to control a facility’s locks and set which master keys open which doors. The portable programmer, which plugs into the DC port under the locks, can also open any door, even providing power through that port to trigger the mechanism of a door lock in which the battery has run out.<br /> <br /> The system’s vulnerability arises, Brocious says, from the fact that every lock’s memory is entirely exposed to whatever device attempts to read it through that port. Though each lock has a cryptographic key that’s required to trigger its “open” mechanism, that string of data is also stored in the lock’s memory, like a spare key hidden under the welcome mat. So it can be immediately accessed by Brocious’s own spoofed portable device and used to open the door a fraction of a second later.<br /> <br /> Brocious believes that the unreliability of his method stems from timing issues in how his hacked-together unlocking device communicates with Onity’s locks. He doesn’t plan to complete the development and debugging of the technique himself, due to what he says are time constraints and concerns about what a universally effective exploit would mean for the security of millions of hotel guests. But he believes that with more experimentation and tweaking, someone could easily access a significant fraction of hotel rooms around the country without leaving a trace.<br /> <br /> In fact, Brocious isn’t the only one who knows his tricks. His former employer, a startup that sought to reverse engineer Onity’s hotel front desk system and offer a cheaper and more interoperable product, sold the intellectual property behind Brocious’s hack to the locksmith training company the Locksmith Institute (LSI) for $20,000 last year. LSI students, who often include law enforcement, may already have the ability to open Onity doors at will.<br /> <br /> “With how stupidly simple this is, it wouldn’t surprise me if a thousand other people have found this same vulnerability and sold it to other governments,” says Brocious. “An intern at the NSA could find this in five minutes.”<br /> <br /> The ability to access the devices’ memory is just one of the two vulnerabilities Brocious says he found in Onity’s locks. He says the company also uses a weak encryption scheme that allows him to derive the “site code”–a unique numerical key for every facility–from two cards encoded one after another for the same room. By reading the encrypted data off of two cards and testing thousands of potential site codes against both cards until the decoded data displays a predictable interval between the two, he can find the site code and use it to create more card keys with a magnetizing device. But given that he can only create more cards for the same room as the two keys he’s been issued, that security flaw represents a fairly low risk compared with the ability to open any door arbitrarily.<br /> <br /> Brocious says he stumbled upon the the flaws in Onity’s locks while working as the chief technology officer for a startup called Unified Platform Management Corporation, which sought to compete with bigger players in the hotel lock industry by creating a universal front end system for hotels that used common lock technologies. Brocious was hired to reverse engineer hotel locks, and Onity was his first target. The discovery of Onity’s security vulnerabilities was entirely unintentional, he says.<br /> <br /> UPM failed to find customers or investment and soon folded. With the exception of the sale of his exploit methods to LSI–the biggest sale the startup ever achieved–Brocious kept quiet about his discovery, until now.<br /> <br /> “This wasn’t the way we wanted to disrupt the business, exactly,” says Brian Thomason, one of UPM’s founders. “But hey, stuff happens, right?”<br /> <br /> In a move that may dismay security practitioners, Brocious never contacted Onity or its parent company United Technologies Corporation to tell the firm about its security flaws, and doesn’t plan to ahead of his talk. But he says that’s because there’s little the company could do: the locks can’t be simply upgraded with new firmware to fix the problem. New circuitboards will have to be installed in every affected lock, a logistical nightmare if millions of locks prove to be vulnerable. “I didn’t want to delay putting this out there any further than I had to. I see no path to mitigate this from Onity’s side,” he says. “The best way to help hotels at this point is educate them about this, not to go through Onity and delay getting the information out longer than I had to.”<br /> <br /> When I contacted Onity and provided a detailed description of Brocious’s work, the company responded with this statement: “We have not seen Mr. Brocious’ presentation and cannot comment on the content. Onity places the highest priority on the safety and security provided by its products and works every day to develop and supply the latest security technologies to the marketplace.”<br /> <br /> And if Onity’s locks are in fact as insecure and unsecurable as Brocious says, how does he suggest hotels and their guests protect themselves? “Hotels need to come up with a plan to move to more secure locks,” he says.</span></div>

Hacker Will Expose Potential Security Flaw In Four Million Hotel Room Keycard Locks

The next time you stay in a hotel room, run your fingers under the keycard lock outside your door. If you find a DC power port there, take note: With a few hacker tricks and a handful of cheap hard…

Read more »

Eight Million Email Addresses And Passwords Leaked From Gaming Site Gamigo

<div dir="ltr" style="text-align: left;" trbidi="on">Call it a slow leak. Four months after the gaming site Gamigo warned users about a hacker intrusion that accessed some portions of its <span class="text_exposed_show">users’ credentials, more than 8 million usernames, emails and and encrypted passwords from the site have been published on the Web, according to the data breach alert service PwnedList. The half-gigabyte collection of stolen user data was posted to the password-cracking forum Inside Pro earlier this month, where it remained online until late last week.</span><br /><span class="text_exposed_show">   </span><br /><span class="text_exposed_show">                              <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpnG1KQrdoijl5dXOjzOl5mHUjU6g1zi1-DlWafmDGwPoe0m3pvY2ANpNqgHUu1RZfpl9h8rYJASP5v9WVFBdNsf3uLvDiNVhkY-E7jE0SakxpYdzQPnLZFjNKU5Gl7fvMSbO7s_Watpc6/s1600/Gamigo+hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpnG1KQrdoijl5dXOjzOl5mHUjU6g1zi1-DlWafmDGwPoe0m3pvY2ANpNqgHUu1RZfpl9h8rYJASP5v9WVFBdNsf3uLvDiNVhkY-E7jE0SakxpYdzQPnLZFjNKU5Gl7fvMSbO7s_Watpc6/s400/Gamigo+hacked.png" width="400" /></a><br /> <br /> PwnedList founder Steve Thomas downloaded the file prior to its removal from the Web and has shared it with me, and I can confirm that it appears to be an enormous list of user emails with passwords obscured by cryptographic hashes.<br /> <br /> “It’s the largest leak I’ve ever actually seen,” says Thomas, whose startup seeks to track data breaches and alert users when their information is published. “When this breach originally happened, the data wasn’t released, so it wasn’t a big concern. Now eight million email addresses and passwords have been online, live data for any hacker to see.”<br /> <br /> Gamigo users can check on PwnedList’s site whether their email address is included in the leak.<br /> <br /> Though the passwords weren’t posted in a readable form initially, they may still be compromised. Within a half hour, another user in the Inside Pro forum thread responded to the post of the file with a message reading “found 94%,” implying that the passwords may have been easily derived from their hashed form.<br /> <br /> Gamigo, a free gaming site owned by German publishing firm Axel Springer AG, forced all users to change their passwords after it announced it had been hacked in March of this year, so the exposed passwords likely won’t give anyone access to user accounts on Gamigo.com itself. But given that users very often re-use passwords between sites, the breached passwords could offer access to more sensitive accounts on email or banking sites. Anyone who has had an account with Gamigo prior to its March breach should be sure to change their passwords on any accounts where they used the same credentials as on Gamigo.com.<br /> <br /> According to PwnedList’s analysis, the spilled data includes 3 million American accounts including Hotmail, Gmail, and Yahoo! mail addresses, 2.4 million German accounts, and 1.3 million French accounts. The company found dozens of email addresses from corporations including IBM, Allianz, Siemens, Deutsche Bank, and ExxonMobil.<br /> <br /> Though the user who posted the file to Inside Pro counted 11 million hashed passwords, PwnedList’s Thomas says he found only 8,244,o00 unique email addresses in the file. More than five thousand of the email addresses included the word “gamigo,” a sign that they were created specifically to register for Gamigo and strong evidence that the stolen database was in fact taken from Gamigo’s servers.</span><br /><span class="text_exposed_show"> <br /> In early March, Gamigo warned users that its “database was subject to an attack in the last few days,” and that “the intruder(s) managed to acquire (alias) user names and encrypted gamigo user passwords.” A few hundred of those credentials were posted in Gamigo forums.<br /> <br /> “We cannot rule out that the intruder(s) is/are still in possession of additional personal data, although to date we have received no report of any fraudulent use,” read the message. “To prevent any unauthorized access to your account, we have reset all passwords for the gamigo Account System and for all gamigo games!”<br /> <br /> I’ve contacted Gamigo for comment, and will add any update from the company when I hear back.<br /> <br /> PwnedList’s Steve Thomas says he believes Gamigo hasn’t acted irresponsibly in responding to the breach, despite not warning users to change any passwords they reused across other accounts. But he emphasizes that users who do reuse passwords should act now to change them immediately. “Now that these full details are out there, we can expect more attempts for accounts to be taken over or used maliciously,” he says.</span></div>

Eight Million Email Addresses And Passwords Leaked From Gaming Site Gamigo

Call it a slow leak. Four months after the gaming site Gamigo warned users about a hacker intrusion that accessed some portions of its users’ credentials, more than 8 million usernames, emails and a…

Read more »

40+ Pakistani sites Hacked and Defaced by "venki"

<div dir="ltr" style="text-align: left;" trbidi="on"><br />40+ Pakistani sites Hacked and defaced by "<span style="color: red;">venki</span>" form "<span style="background-color: white;"><span style="color: red;">Indian Cyber Pirates</span>". There is no specific reason mention in hacked site but this is clearly told Pakistani admin that how much they need to work on security. This kind of attack become a regular on Pakistani cyber space and need lot of work to patch them.</span><br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3ZNjyGwcQWYSHVktgwlqUN__GnhvhcYpF7SnMn3hCJBiP1Hu0peGO2x9Pi1FLNARCSNpfv0uW7ypaGEyO2j_7xrQIVBr6X0pq8g-kWQF2aQVScWwtq4CcQuNjWadT-UCWE5-hbxz9bSLP/s1600/40%252B+Pakistani+sites+Hacked+and+Defaced+by+venki.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="211" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3ZNjyGwcQWYSHVktgwlqUN__GnhvhcYpF7SnMn3hCJBiP1Hu0peGO2x9Pi1FLNARCSNpfv0uW7ypaGEyO2j_7xrQIVBr6X0pq8g-kWQF2aQVScWwtq4CcQuNjWadT-UCWE5-hbxz9bSLP/s400/40%252B+Pakistani+sites+Hacked+and+Defaced+by+venki.png" width="400" /></a></div><br /><b>Deface page info:</b><br /><b><br /></b><br />"Hacked bY venki<br /><br />Hey Lmao Admin Shocked 4 HaCked!!!!<br />U Have Bad Security lolx u Realy Need to Patch Your ASs Cya Again<br /><br />INDIAN CYBER PIRATES<br /><br />We Are : | Pr3d4t0r 34gl3 Haxor | D34DM4N | ICP MEMBERS | "<br /><br /><b>Hacked Site List and Mirrors:</b><br /><a href="http://www.paste.to/NzUxOTEy" target="_blank">Pastbin</a><br /></div>

40+ Pakistani sites Hacked and Defaced by "venki"

40+ Pakistani sites Hacked and defaced by "venki" form "Indian Cyber Pirates". There is no specific reason mention in hacked site but this is clearly told Pakistani admin that how much they need to wo…

Read more »