Hacking.BaBa

Critical buffer overflow vulnerability in Photoshop CS6

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-size: large;"><b>Critical buffer overflow vulnerability in Photoshop CS6</b></span><br /><br /><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgn_AbgfAyVvG0pNUpK74PGuyB8-tbeTH8k87x05YE_psRkvlLeZjSc9FRyytKKxm2pYth6lEawsRn5T1NlgVyGhxmcjANcMihgUJA_nHUVCqImz4Eq3U32m5KMkvXF5b4wao2t3iWBRgY/s1600/Critical+buffer+overflow+vulnerability+in+Photoshop+CS6.jpg" /> <br /><br /><br /><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin: 0px; padding: 0px; text-align: justify;">Adobe has released an update for Photoshop CS6 that closes a critical heap-based buffer overflow vulnerability (<b style="margin: 0px; padding: 0px;">CVE-2012-4170</b>) in its popular graphics editing program. Both the Mac and Windows versions of Photoshop CS6 (aka Photoshop 13.0) contain a critical vulnerability that could allow an attacker to take control of affected systems.</div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin: 0px; padding: 0px; text-align: justify;">Furthermore, company officials say Adobe is unaware of any attacks against this vulnerability.That said, the Photoshop 13.0.1 update contains 75 other bug fixes, including 31 for problems known to cause crashes, 18 pertaining to 3D features, and 15 for drawing and graphics features.</div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin: 0px; padding: 0px; text-align: justify;"><br /></div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin: 0px; padding: 0px; text-align: justify;"><div style="margin: 0px; padding: 0px;">Adobe said that users and administrators can <a href="http://blogs.adobe.com/photoshopdotcom/2012/08/photoshop-cs6-13-0-1-update-now-available.html" rel="follow" style="color: #034e9d; margin: 0px; outline: none; padding: 0px; text-decoration: none;">download</a> and <nobr style="margin: 0px; padding: 0px;"><a class="FAtxtL" href="http://thehackernews.com/2012/09/critical-buffer-overflow-vulnerability.html#" id="FALINK_3_0_2" style="background-color: transparent !important; border-bottom-color: rgb(28, 125, 255) !important; border-bottom-style: solid !important; border-bottom-width: 1px !important; color: rgb(28, 125, 255) !important; display: inline !important; margin: 0px; outline: none; padding-bottom: 1px !important; padding-left: 0px; padding-right: 0px; padding-top: 0px;">install</a></nobr> the patch by lunching the "update" tool within the Photoshop help menu.The company credited a pair of Secunia researchers in discovering and reporting the flaw directly.</div><div style="margin: 0px; padding: 0px;"><br style="margin: 0px; padding: 0px;" /></div><div style="margin: 0px; padding: 0px;">According to a <a href="https://secunia.com/advisories/49141/" rel="follow" style="color: #034e9d; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Secunia advisory</a>, the problem is caused by a boundary error in the "Standard MultiPlugin.8BF" module when processing certain PNG image files. Both Windows and Mac OS X versions of Photoshop CS6 (13.0) are affected and upgrading to the new 13.0.1 release fixes the problem.</div></div></div>

Critical buffer overflow vulnerability in Photoshop CS6

Critical buffer overflow vulnerability in Photoshop CS6 Adobe has released an update for Photoshop CS6 that closes a critical heap-based bu...

ADS-B Is Insecure and Easily Spoofed, Say Hackers

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 class="node-title" style="border: 0px; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 1.5em; font-weight: inherit; line-height: 1.063em; margin: -10px 0px 18px 10px; outline: 0px; padding: 0px; vertical-align: baseline; width: 660px;">ADS-B Is Insecure and Easily Spoofed, Say Hackers</h1><div><div><img height="148" src="http://www.airservicesaustralia.com/wp-content/uploads/ADS-B_ticker.jpg" width="400" /> </div><div><br /></div><div>The ADS-B system that is the cornerstone of the FAA’s NextGen ATC modernization plan is at risk of serious security breaches, according to Brad Haines, a hacker and network security consultant who is worried about ADS-B vulnerabilities. Haines first outlined his concerns during a presentation he gave at the Def Con 20 hacker conference in Las Vegas in July. Automatic Dependent Surveillance-Broadcast (ADS-B) is on track to replace radar with a system that broadcasts GPS-based position data to controllers and other ADS-B-equipped aircraft as part of the NextGen system. Yet according to Haines–aka RenderMan–ADS-B signals are unauthenticated and unencrypted, and “spoofing” or inserting a fake aircraft into the ADS-B system is easy.</div><div> </div><div>Haines and another hacker named Nick Foster demonstrated this by spoofing a fake aircraft into the simulated busy airspace over San Francisco, using the open source Flight Gear flight simulator program. Spoofing a target into the real ADS-B system would be a simple matter of transmitting the signal on the ADS-B frequencies (978 and 1090 MHz).</div><div><br /></div><div>The FAA told AIN that the ADS-B system is secure. “We have ways of validating the data that shows up on a controller’s screen so that spoofed targets are filtered out,” an FAA spokeswoman said. “An FAA ADS-B security action plan identified and mitigated risks and monitors the progress of corrective action. These risks are security sensitive and are not publicly available. The air traffic system is based on redundancies to ensure safe operations. The FAA plans to maintain about half of the current network of secondary radars as a backup to ADS-B in the unlikely event it is needed.”</div><div><br /></div><div>According to Haines, the FAA’s method for filtering spoofed targets relies on multilateration, which is a technique for identifying a target using ground stations that detect transmissions from the target (usually transponder signals). But such filtering, he pointed out, would remove spoofed targets only from the FAA’s TIS-B feed, which sends ADS-B data to aircraft from ADS-B ground stations. “The spoofing threat can be mitigated with multilateration,” Haines noted. “However, an airplane receiving ADS-B [air-to-air] data has no way to do that.” In other words, an ADS-B in receiver on an aircraft will have no way of telling whether the ADS-B signal that it is receiving is from another aircraft or from a spoofed target transmitted on the ADS-B frequencies.</div><div><br /></div><div>Longstanding Concerns about ADS-B Security</div><div><br /></div><div>Concerns about ADS-B security aren’t new. In a 2009 graduate research project at the Air Force Institute of Technology at Wright-Patterson Air Force Base in Dayton, Ohio, Air Force Major Donald McCallie identified ADS-B vulnerabilities. “As early as 2006, concerns were raised about the ability of hackers to introduce as many as 50 false targets onto controllers’ radar screens. With open broadcast and no encryption there is no confidentiality; a lack of any authentication provides no integrity; and the ability to jam signals brings into question availability. The ADS-B infrastructure requires that all surveillance be open, and therefore non-secure, communications. As ADS-B is implemented, the potential exists for an attacker to exploit the inherent vulnerabilities of such an open system,” according to the paper.</div><div><br /></div><div>McCallie’s paper outlines six key ways that attackers could harm the ADS-B system, ranging from relatively easy disruptions using jamming equipment to more difficult target ghost inject (spoofing) to flood denial, which means disrupting the ADS-B frequencies. While McCallie characterizes airborne target spoofing as a medium-high difficulty operation, he wrote, “Because there is no data correlation like that which may occur in a ground station, it may be somewhat easier to inject a ghost target into an aircraft; although, physical access may offset that advantage.”</div><div><br /></div><div>Looking even farther back, a paper dated Sept. 18, 2001, and written by the FAA’s Ron Jones raised the issue of ADS-B security in relation to the 9/11 terrorist attacks that had taken place a week earlier. Jones raised two issues: “Probably the most fundamental security issue with ADS-B is the core idea of broadcasting the identity and precise location of each aircraft. This would open the door for a terrorist to attack specific aircraft or aircraft of a specific airline or corporation. While some people have suggested some form of encryption might be applied, I do not see any way in which this could be effective without fully undermining the basic ADS-B concept and associated benefits.” The second issue foreshadowed the current concern with fake targets. “As already briefly noted in DO-242 [RTCA standards] some applications may require independent validation of the ADS-B information. This has two aspects. One is simply to detect failures that result in errors in the reported aircraft location. The second is to detect spoofing and this is the aspect where the security concerns are raised.”</div><div><br /></div><div>Haines is pleased that his bringing up the issue of ADS-B security has ignited some discussion of the subject, although he told AIN that no authorities have contacted him seeking advice on the system’s vulnerabilities. He also worries that other countries implementing ADS-B are not addressing these security issues. If it were up to him, he said, he would focus on “training, policies and procedures. [And] understanding the risks and that one needs to ask questions like ‘what happens if this thing that is supposed not to fail fails.’ Ifa way for multilateration to be spoofed is found, what then? If our [fake target] attack is actually possible, how does that undermine the reliability?How quickly can the industry adapt? I would also build in more capacity for outside testing. The tools and techniques to screw with this stuff are at a maturity level that make it accessible to most people.Are the FAA et al thinking they have covered every possibility? Just remember how many ‘secure’ systems were compromised by teenagers in their parents’ basements.”</div></div></div>

ADS-B Is Insecure and Easily Spoofed, Say Hackers

ADS-B Is Insecure and Easily Spoofed, Say Hackers The ADS-B system that is the cornerstone of the FAA’s NextGen ATC modernization plan is a...

Taiwan To Step Up Cyber War Capabilities To Counter Chinese Hackers

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 style="background-color: white; color: #1f4f82; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 30px; font-weight: 400; margin: 0px; padding: 0px 0px 10px;">Taiwan to step up cyberwar capabilities to counter Chinese hackers</h1><div><br /></div><div><div style="background-color: white; color: #505050; font-family: Arial, Helvetica, sans-serif; font-size: 16px; padding: 0px;"><b>Taiwan plans to beef up its cyberwar capabilities to counter a perceived threat from Chinese hackers targeting government and security websites.</b></div><div id="article_text" style="background-color: white; color: #505050; font-family: Arial, Helvetica, sans-serif; font-size: 16px;"><div style="padding: 0px; text-align: justify;"><br /></div><div style="padding: 0px; text-align: justify;"><img alt="cyber" src="http://english.samaylive.com/pics/article/virus265_1325528488.jpg" /><br /> </div><div style="padding: 0px; text-align: justify;"><br /></div><div style="padding: 0px; text-align: justify;">Taiwan will expand its cyberwar units next year while scaling back military spending due to budget constraints, the Taipei-based Liberty Times reported, citing a 2013 budget plan submitted by the National Security Bureau to parliament for approval.</div><div style="padding: 0px; text-align: justify;">In the six months to June, hackers launched more than one million attacks on the bureau's website, making it one of the most heavily targeted government sites, the paper said.</div><div style="padding: 0px; text-align: justify;">"All the attacks were detected and blocked, and no hackers have ever broken into the bureau's official website,"the paper said, without specifying the number of attacks from China.</div><div style="padding: 0px; text-align: justify;"><br /></div><div style="padding: 0px; text-align: justify;">But in a report also sent to parliament for reference on Beijing's continued military buildup, the bureau highlighted the perceived cyberwar threat from China, the paper said.</div><div style="padding: 0px; text-align: justify;">"China's cyberwar capabilities were organised by the military and government units, using Internet viruses to attack Taiwan's government, economic and military websites,"it cited the military report as saying.</div><div style="padding: 0px; text-align: justify;"><br /></div><div style="padding: 0px; text-align: justify;">Taiwanese government websites have frequently come under cyber attack from China, usually during disputes between the two sides.</div><div style="padding: 0px; text-align: justify;">Ties have improved markedly since Ma Ying-jeou of the China-friendly Kuomintang party came to power in 2008 on a platform of ramping up trade and tourism links with the mainland. Ma was reelected in January for a second and the last four-year term.<br />   </div><div style="padding: 0px; text-align: justify;">China still considers Taiwan part of its territory awaiting reunification, by force if necessary, even though  the island has ruled itself for more than 60 years after their split in 1949 at the end of a civil war.</div></div></div></div>

Taiwan To Step Up Cyber War Capabilities To Counter Chinese Hackers

Taiwan to step up cyberwar capabilities to counter Chinese hackers Taiwan plans to beef up its cyberwar capabilities to counter a perceived ...

MWSS Website Hacked

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h2 style="background-color: white; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 40px !important; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">MWSS website hacked</h2><div><br /></div><div><img alt="Screen cap taken 2:02 pm, September 2, 2012." height="201" src="http://static.rappler.com/images/MWSS%20Hacked%20September%202%202012.jpg" width="400" /> </div><div><br /></div><div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">MANILA, Philippines - Several hacker groups on Sunday, September 2, 2012, hacked the official website of the Metropolitan Waterworks and Sewage System (MWSS).</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">The groups identified themselves as Anonymous #OccupyPhilippines, Anonymous Butuan, PrivateX, #pR.is0n3r. Lo0p th3 Lo0p, l4stl00k, Anonymous Manila, and All Pinoy Hackers.</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">As of 2:57 pm on Sunday, the MWSS website contained a spinning logo of "Anonymous Philippines," with a link below that instructs visitors to "click for the reason."</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;"><span class="easy_img_caption" style="background-color: #f2f2f2; border: 0px; display: inline-block; font-family: inherit; font-style: inherit; line-height: 0.5; margin: 0px; outline: 0px; padding: 0px; text-align: center; vertical-align: top; width: 420px;"><img alt="A video message from "AnonymousButuan." Screen cap taken 2:02pm, September 2, 2012." border="0" height="213" src="http://static.rappler.com/images/MWSS%20Hacked%20September%202%202012-2.jpg" style="border: none; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;" title="A video message from "AnonymousButuan." Screen cap taken 2:02pm, September 2, 2012." width="420" /><span class="easy_img_caption_inner" style="border: 0px; color: black; display: inline-block; font-family: inherit; font-size: 8pt; line-height: normal; margin: 0px; outline: 0px; padding: 4px 8px; vertical-align: baseline;">A video message from "AnonymousButuan." Screen cap taken 2:02pm, September 2, 2012.</span></span></div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">The link leads to a YouTube video posted by user "AnonymousButuan" on August 31, 2012.</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">In the video, the group accused the MWSS, Maynilad Water Services Inc., and Manila Water Co. of cheating customers into paying for two cancelled projects. The group did not specific the projects that they were referring to. The group also alleged that the MWSS has been giving "excessive benefits" to its board members.</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">"We are fighting for the truth and free speech. People should not fear the government. The government should fear their people," the video said.</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">"We are anonymous, we are legion, we do not forgive, we do not forget, United as one, divided by none, the corrupt fear us, the honest support us, the heroic joins us, Metropolitan Waterworks and Sewerage System, it's too late to expect us!"</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Changes in the MWSS</strong></div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">The MWSS has been on the spotlight recently, after they eliminated the illegal allowances of its employees.</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">Back in August, it was revealed that the company's drivers had been receiving up to P97,000 a month mainly in the form of bonuses.</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">"Illegal" bonuses included a birthday and State of the Nation Address bonus.</div><div style="background-color: white; border: 0px; color: rgb(72, 86, 91) !important; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px; margin-bottom: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">In an interview on Rappler's #TalkThursday, MWSS Chairman Ramon Alkipala dismissed accusations that the allowances of the agency's board members were "excessive." According to him, it is only a smear campaign in reaction to the reforms instituted by the board, including the slashing of employee benefits.</div></div></div>

MWSS Website Hacked

MWSS website hacked MANILA, Philippines - Several hacker groups on Sunday, September 2, 2012, hacked the official website of the Metropolit...

Rita Ora's Twitter Page Hacked‎

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="background-color: white; border: 0px; color: #444444; font-family: Arial, Helvetica, sans-serif; font-size: 10px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><h1 style="background-color: transparent; background-position: initial initial; background-repeat: initial initial; border: 0px; font-size: 3.1em; font-weight: normal; line-height: 1em; margin: 10px 0px 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Rita Ora’s twitter page hacked</h1></div><div class="leadContainer" style="background-color: white; border: 0px; color: #444444; font-family: Arial, Helvetica, sans-serif; font-size: 10px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><div class="synopsis" style="background-color: transparent; border: 0px; font-size: 1.3em; line-height: 1.3em; margin-top: 15px; outline: 0px; padding: 0px; vertical-align: baseline;">British pop star posted that she has a crush on One Direction singer Harry Styles</div><div class="synopsis" style="background-color: transparent; border: 0px; font-size: 1.3em; line-height: 1.3em; margin-top: 15px; outline: 0px; padding: 0px; vertical-align: baseline;"><img src="http://www.4tnz.com/files/rita-ora-how-we-do-e1334614864336.jpg" /> </div><div class="synopsis" style="background-color: transparent; border: 0px; font-size: 1.3em; line-height: 1.3em; margin-top: 15px; outline: 0px; padding: 0px; vertical-align: baseline;"></div><div class="articleBody" style="border: 0px; font-size: 10px; line-height: normal; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><div style="background-color: transparent; border: 0px; font-size: 1.3em; line-height: 1.4em; margin-top: 10px; outline: 0px; padding: 0px; vertical-align: baseline;">British pop star Rita Ora has apologised to fans after a prankster hacked her Twitter account and posted that she has a crush on One Direction singer Harry Styles.</div></div><div class="articleBody" style="border: 0px; font-size: 10px; line-height: normal; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><div style="background-color: transparent; border: 0px; font-size: 1.3em; line-height: 1.4em; margin-top: 10px; outline: 0px; padding: 0px; vertical-align: baseline;">The 21-year-old got to know about the news on Saturday when she discovered a tweet on her page: “I wanna be with Harry Styles.”</div></div><div class="articleBody" style="border: 0px; font-size: 10px; line-height: normal; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><div style="background-color: transparent; border: 0px; font-size: 1.3em; line-height: 1.4em; margin-top: 10px; outline: 0px; padding: 0px; vertical-align: baseline;">She quickly deleted the message and told her 1.1 million followers she had contacted bosses at the social networking site about temporarily closing her account while resolving the problem, reports contactmusic.com.</div></div><div class="articleBody" style="border: 0px; font-size: 10px; line-height: normal; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><div style="background-color: transparent; border: 0px; font-size: 1.3em; line-height: 1.4em; margin-top: 10px; outline: 0px; padding: 0px; vertical-align: baseline;">“My Twitter has been hacked! Trying to get it frozen for a bit! Sorry guys,” she said.</div></div></div></div>

Rita Ora's Twitter Page Hacked‎

Rita Ora’s twitter page hacked British pop star posted that she has a crush on One Direction singer Harry Styles British pop star Rita Ora ...