Hacking.BaBa

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates</h1><div><br /><img alt="Microsoft releases two security bulletins for September 2012" src="http://i1-news.softpedia-static.com/images/news2/XSS-Vulnerabilities-Addressed-by-Microsoft-s-September-2012-Updates-2.png?1347441537" /> <br /><br /></div><div><div>Microsoft has issued two security bulletins as part of its September 2012 Patch Tuesday release. One noteworthy fact is that the company hasn’t made available so few bulletins since May 2011.</div><div><br /></div><div>The first bulletin – rated as Important - addresses a cross-site scripting (XSS) security hole present in Visual Studio Team Foundation Server.</div><div><br /></div><div><br /></div><div> Another Important XSS flaw has been identified in Microsoft System Center Configuration Manager, affecting Microsoft Systems Management Server 2003 Service Pack 3 and Microsoft System Center Configuration Manager 2007 Service Pack 2.</div><div><br /></div><div>Trend Micro researchers highlight the fact that such vulnerabilities have been utilized successfully on numerous occasions, several such attacks being recorded in 2011.</div><div><br /></div><div>As always, Microsoft customers are advised to apply the updates as soon as possible to ensure that they’re systems are protected. Fortunately for users, the bulletins don’t require that they restart their computers. </div><div><br /></div><div>Attacks that leverage these vulnerabilities haven’t been recorded so far, but that doesn’t mean they will not be launched in the future, which is why its highly recommended that the updates are applied.</div><div><br /></div><div>The Redmond company also took this opportunity to remind everyone of the fact that the October updates would come with a major security improvement. The use of RSA keys with a length less than 1024 bits will be restricted.</div><div><br /></div><div>“For those who find they are using certificates with RSA key lengths of less than 1024 bits, those certificates will be required to be reissued with at least a 1024-bit key length. (1024 should, by the way, be considered a minimum length; the most up-to-date security practices recommend 2048 bits or even better),” Angela Gunn of Trustworthy Computing explained.</div><div><br /></div><div>Here’s this month’s video in which Yunsun Wee provides further details regarding the two bulletins and the improvements made with the upcoming update:</div></div><div><br /><br /></div><div></div></div><br /></div>

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates Microsoft has issued two security bulletins as part of its September 20...

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches

<div dir="ltr" style="text-align: left;" trbidi="on"><table border="0" cellpadding="0" cellspacing="0" style="color: #9e9e9e; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; text-align: start; width: 725px;"><tbody><tr><td class="contentheadings" valign="top"><h1 id="htitle" style="color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches</h1><div><br /></div><div><img src="http://i1-news.softpedia-static.com/images/news2/August-2012-VIPRE-Report-Scams-Mobile-Malware-and-Privacy-Breaches-2.png?1347439404" /> </div><div style="color: #5e5e5e;"><br /></div><div><div><span style="color: #5e5e5e; font-size: x-small;">GFI Software has released its VIPRE Report for August 2012 and the numbers show that in the past month cybercriminals have been busy launching email scams, malicious mobile applications, and phishing campaigns.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">One of the biggest spam campaigns recorded in August revolved around Nationwide. Several variants of the bogus emails have been spotted, all of them attempting to lure internauts to websites where they were requested to hand over their account details.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;"> Experts also noticed a lot of scam websites that relied on UK's Directgov logo in order to convince Internet users to sign up for all sorts of premium services.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">Last, but certainly not least, mobile malware and shady app markets have left their print on the last month of summer. </span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">And speaking of mobile malware, GFI researchers have analyzed the apps released by the Mitt Romney and Barack Obama presidential campaigns. They have discovered a number of privacy issues that most likely weren’t taken into consideration by most users when they installed the applications.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">For instance, the Romney app not only collects information from the mobile device, but it also asks customers to sign in through their Facebook account. This allows it to post messages on the social media network on their behalf.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“The past month’s examples show that the world of smartphone applications has firmly become a battleground for scammers and malware writers, keen to take advantage of unsuspecting users,” Christopher Boyd, senior threat researcher at GFI Software, explained.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“Avoiding mobile malware often requires the same preventative tactics associated with traditional malware such as verifying the legitimacy of any unsolicited emails or hyperlinks before installing an unknown application or submitting personal information,” Boyd added.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“However, as we saw this month, the increased activity aimed at mobile devices doesn’t mean traditional attacks, such as desktop malware and email scams, have become any less of a threat.”</span></div><div><span style="color: #5e5e5e; font-size: x-small;"> Add me on Google+</span></div></div><div style="color: #5e5e5e;"><br /></div></td></tr></tbody></table></div>

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches GFI Software has released its VIPRE Report for August 2012 and the num...

SMS-Sender Trojans Served by Shady Google Play Replica Site

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">SMS-Sender Trojans Served by Shady Google Play Replica Site</h1><div><img alt="Shady Android app market" height="311" src="http://i1-news.softpedia-static.com/images/news-700/SMS-Sender-Trojans-Served-by-Shady-Google-Play-Replica-Site.png?1347437964" width="640" /> </div><div><div>Although the Olympics and the Paralympics have come to an end, researchers say that cybercriminals are still relying on them to spread their malicious elements. A site that attempts to replicate Google Play – iplay-andro7d.net - has been found to serve all sorts of shady apps that hide an SMS Trojan.</div><div><br /></div><div>The applications hosted on the site – Skype, Firefox, Facebook, Instagram and others – hide a nasty Trojan (Trojan.AndroidOS.Generic.A) that sends out SMS messages to premium rate numbers, inflating the bills of unsuspecting Android users, GFI researchers note.</div><div><br /></div><div>Apparently, the malicious app market - proudly displaying the Olympics logo - only serves the Trojan-infested software to internauts who access it from an Android device, a trick successfully utilized in the past.</div><div><br /></div><div>Again, we will take this opportunity to advise users to refrain from downloading applications from untrusted alternative Android markets. Also, beware of Olympics scams as it seems they’re still doing the rounds.</div></div></div>

SMS-Sender Trojans Served by Shady Google Play Replica Site

SMS-Sender Trojans Served by Shady Google Play Replica Site Although the Olympics and the Paralympics have come to an end, researchers say ...

Consumer cybercrime cost India $8 billion in last 12 months: Norton

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: Georgia, 'Times New Roman', Times, serif; font-size: 30px;">Consumer cybercrime cost India $8 billion in last 12 months: Norton</span> <br /><span style="font-family: Georgia, 'Times New Roman', Times, serif; font-size: 30px;"><br /></span> <br /><div class="newslist_img" style="color: #4e4e4e; float: left; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 10px; margin-right: 10px; margin-top: 10px;"><img alt="more-hacking.jpg" class="imgbdr" id="HeadContent_FullstoryCtrl_mainstoryimage" src="http://cdn.ndtv.com/tech/images/gadgets/more-hacking.jpg" style="background-color: white; border: 1px solid rgb(225, 225, 225); padding: 4px;" /></div><div style="color: #4e4e4e; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px;"></div><div id="HeadContent_FullstoryCtrl_fulldetails" style="color: #4e4e4e; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px;">Software security services provider Norton today said consumer cybercrime has cost the country a whopping USD 8 billion or around Rs 42,000 crore in the past 12 months, impacting 42 million people.Releasing the findings of its annual cybercrime report, it is estimated that over 42 million people fell victim to cybercrime in the past 12 months in the country, incurring around USD8 billion in direct financial losses. In terms o cost, this is a full 18 percent increase.<br />Against this, the global loss has been pegged at USD110 billion.<br />The study further notes that as many as 66 percent of online adults have been a victim of cybercrime in their lifetime in the country. During the past 12 months, as many as 56 percent of online adults here have experienced cybercrime- that is over 1,15,000 victims per day, 80 victims per minute and over one every second.<br />According to the report, the average direct financial cost per victim is USD192, which is up 18 percent over 2011 when it was USD163.<br />One key finding this year is that both the cost per victim as well as social and mobile incidents are on the rise due to cybercrime.<br />The study is based on the findings of self-reported experiences of over 13,000 adults across 24 countries, Norton by Symantec said in a statement.<br />Globally, every second, 18 adults fall a victim of cybercrime, resulting in over 1.5 million cybercrime victims each day. With losses totaling an average of USD197 per victim across the world in direct financial costs, in the past 12 months, an estimated 556 million experienced cybercrime, represents 46 percent of online adults in the past 12 months, says the report. Last year the percentage was 45 percent.<br />The survey has found an increase in new forms of cybercrime compared to last year, such as those found on social networks or mobile devices, indicating that cybercriminals are starting to focus their efforts on these increasingly popular platforms.<br />One in three online adults (32 percent) has been a victim of either social or mobile cybercrime during the past 12 months, and 51 percent of social network users have been victims of social cybercrime in the country.<br />As many as 22 percent of social network users reported someone have hacked into their profile and pretended to be them, while 15 percent users said they have fallen victim to a scam or fake link on their social network platform.<br />"Cybercriminals are changing their tactics to target fast growing mobile platforms and social networks where consumers are less aware of security risks," says Norton by Symantec Asia director and internet safety advocate Effendy Ibrahim said.</div></div>

Consumer cybercrime cost India $8 billion in last 12 months: Norton

Consumer cybercrime cost India $8 billion in last 12 months: Norton Software security services provider Norton today said consumer cybercr...

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h2 style="color: #4c586c; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 32px; font-weight: lighter; margin: 0px;">DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More</h2><div><br /></div><div><img src="http://ctovision.com/wp-content/uploads/DHS.png" /> </div><div><br /></div><div><div style="background-color: white; color: #4c4d4f; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 13px; line-height: 19px; padding: 0px 0px 8px;">Here is today’s federal cybersecurity and information technology news:</div><ul style="background-color: white; color: #4c4d4f; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 13px; line-height: 19px;"><li>As many security experts suspected, the Apple device ID’s that Anonymous claimed came from a Federal Bureau of Investigation agent’s hacked laptop actually came from the hack of an application development company. More <a href="http://www.wired.com/threatlevel/2012/09/udid-leak-traced-to-blue-toad/" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>A new survey finds that although much of federal information technology has not yet moved to the cloud, agencies seem to be gaining confidence in moving more critical systems to the cloud. More <a href="http://www.fiercegovernmentit.com/story/survey-cloud-migration-slow-possibly-more-confident/2012-09-10" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>The Executive Office of the President is seeking a unified system for managing thousands of internship applications. More <a href="http://www.nextgov.com/cio-briefing/2012/09/white-house-seeks-unified-system-manage-interns/57989/?oref=ng-channelriver" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>Secretary of the Department of Homeland Security Janet Napolitano called for guidelines to facilitate public-private cybersecurity information sharing at a recent conference. More <a href="http://searchsecurity.techtarget.com/news/2240162981/Napolitano-calls-for-cybersecurity-intelligence-information-sharing" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>In an attempt to bolster their cybersecurity workforce, the Department of Homeland Security is encouraging qualified hackers to apply even if they don’t have a college degree or don’t intend to stay at the position indefinitely. More <a href="http://blogs.csoonline.com/security-leadership/2355/cso-security-standard-dhs-wants-you-little-while-least" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li></ul></div></div>

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More Here is today’s federal cybersecurity and information technolo...

Cosmo the God Hacker

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><img height="227" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw1.jpg" width="400" /> </div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><br /></div><div style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><span style="color: #333333;">Cosmo is huge — 6 foot 7 and 220 pounds the last time he was weighed, at a detention facility in Long Beach, California on June 26. And yet he’s getting bigger, because Cosmo — also known as </span><a href="http://twitter.com/cosmothegod" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Cosmo the God</a><span style="color: #333333;">, the social-engineering mastermind who weaseled his way past </span><nobr style="color: #333333; margin: 0px; padding: 0px;">security systems</nobr><span style="color: #333333;"> at</span><span style="color: red;"> Amazon, Apple, AT&T, PayPal, AOL, Netflix, Network Solutions, and Microsoft — is just 15 years old.</span></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">He turns 16 next March, and he may very well do so inside a prison cell.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was arrested along with dozens of others <a href="http://www.fbi.gov/newyork/press-releases/2012/manhattan-u.s.-attorney-and-fbi-assistant-director-in-charge-announce-24-arrests-in-eight-countries-as-part-of-international-cyber-crime-takedown" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">in a recent multi-state FBI sting</a> targeting credit <nobr style="margin: 0px; padding: 0px;"><a class="FAtxtL" href="http://www.wired.com/gadgetlab/2012/09/cosmo-the-god-who-fell-to-earth/all/#" id="FALINK_3_0_2" style="background-color: transparent !important; border-bottom-color: rgb(28, 125, 255) !important; border-bottom-style: solid !important; border-bottom-width: 1px !important; color: rgb(28, 125, 255) !important; display: inline !important; margin: 0px; outline: none; padding-bottom: 1px !important; padding-left: 0px; padding-right: 0px; padding-top: 0px;">card</a></nobr>fraud. It is the day before his court date, but he doesn’t know which task force is investigating him or the name of his public defender. He doesn’t even know what he’s been charged with. It’s tough to narrow it down; he freely admits to participation in a wide array of crimes.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">With his group, UGNazi (short for “underground nazi” and pronounced “you-gee” not “uhg”), Cosmo took part in some of the most notorious hacks of the year. Throughout the winter and spring, they DDoS’ed all manner of government and financial sites, including NASDAQ, ca.gov, and CIA.gov, which they <a href="http://www.telegraph.co.uk/technology/news/9222447/Hackers-claim-credit-for-CIA-website-going-offline.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">took down for a matter of hours in April</a>. They bypassed Google two step, hijacked 4chan’s DNS and redirected it to their own Twitter feed, and repeatedly <a href="http://www.leakedin.com/2012/04/17/page/2/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">posted Mayor Michael Bloomberg’s address and Social Security number online</a>. After breaking into one billing agency using social-engineering techniques this past May, they proceeded to dump <a href="http://www.forbes.com/sites/andygreenberg/2012/05/22/hackers-impersonate-web-billing-firms-staff-to-spill-500000-users-passwords-and-credit-cards/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">some 500,000 credit card numbers online</a>. Cosmo was the social engineer for the crew, a specialist in talking his way past security barriers. His arsenal of tricks held clever-yet-idiot-proof ways of getting into accounts on Amazon, Apple, AOL, PayPal, Best Buy, Buy.com, Live.com (think: Hotmail, Outlook, Xbox) and more. He can hijack phone numbers from AT&T, Sprint, T-Mobile and your local telco.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“UGNazi was a big deal,” Mikko Hypponen, the chief security researcher at F-Secure, told Wired via email. “The Cloudflare hack was a big deal. They could have done much more with that technique.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">So, yes, he is Cosmo the God. But before he was Cosmo, he was Derek*. And while Cosmo may be a god, Derek is just a kid. A high school dropout. A liar, fraud, vandal and thief. But ultimately a kid, without much adult supervision or guidance.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">I met Cosmo by accident and opportunity, after hackers used social-engineering techniques <a href="http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">to circumvent Apple’s and Amazon’s security mechanisms and break into my accounts</a>. They wrought enormous damage, wiping my computer, phone and tablet, deleting my Google account, and hijacking my Twitter account.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">After it happened I fell into their world and began communicating regularly with the very hacker who jacked me, a kid named <a href="http://www.twitter.com/phobiathegod" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Phobia</a>. He introduced me to Cosmo, who wanted to tell me about all manner of other account vulnerabilities. And last month, I flew down to Long Beach to talk to him face to face.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">*<em style="margin: 0px; padding: 0px;">Editor’s note: Because he is a minor, Wired is not disclosing Cosmo’s real name</em>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div class="wp-caption alignnone" id="attachment_115561" style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px 0px 5px; width: 670px;"><a href="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw3.jpg" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="size-large wp-image-115561" data-lazy-loaded="true" height="440" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw3-660x440.jpg" style="border: none; display: inline; margin: 0px; padding: 0px;" title="hackerbw3" width="660" /></a><br /><div class="wp-caption-text" style="background-color: black; color: #dddddd; font-size: 12px; line-height: 15px; margin-right: 10px; margin-top: -5px; padding: 10px;">The suburban Southern California neighborhood that Cosmo calls home. <em style="margin: 0px; padding: 0px;">Photo: Sandra Garcia/Wired</em></div></div><br style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px;" /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Becoming Cosmo</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo squirms in his chair as we sit in his grandmother’s living room. Her small <nobr style="margin: 0px; padding: 0px;"><a class="FAtxtL" href="http://www.wired.com/gadgetlab/2012/09/cosmo-the-god-who-fell-to-earth/all/#" id="FALINK_1_0_0" style="background-color: transparent !important; border-bottom-color: rgb(28, 125, 255) !important; border-bottom-style: solid !important; border-bottom-width: 1px !important; color: rgb(28, 125, 255) !important; display: inline !important; margin: 0px; outline: none; padding-bottom: 1px !important; padding-left: 0px; padding-right: 0px; padding-top: 0px;">apartment</a></nobr>, with dark brown carpeting, is directly downstairs from his own. The front door is open to let the breeze blow. It’s hot, even sitting next to a fan. There is a picture of Jesus on a table. Cosmo’s family has lived in Long Beach for four generations; in fact, his great grandfather poured the foundation on the very property where we now sit.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo lives upstairs with his mother, who he says typically works six days a week as an insurance claims adjuster. She gets home late in the evening. He doesn’t speak to his father. They live just south of State Route One in Long Beach. When I look up their address on <a href="https://www.crimereports.com/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">CrimeReports</a>, it is right on the border of a zone where crime is extremely frequent and violent. But Derek doesn’t get involved with any of that, says his grandmother.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Derek is always, always home. He don’t go anywhere,” says his grandmother. “He’s a good kid. He’s a very good kid.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">That may be, but it turns out this wasn’t his first tangle with the law. He describes previous run-ins as he sits cramped, legs and head akimbo, in the passenger seat of my rental car, while we drive around looking for a quiet place to talk. The year before, he’d been arrested after getting caught smoking pot in a bathroom at school. I ask if that was the only other time. He says it was. Then he pauses.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Oh! And I also got, I guess you could say arrested, in October 2011. <a href="http://belmontshore.patch.com/articles/wilson-high-bomb-scare-evacuates-most-of-4300-students" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Someone called in a bomb threat to my school</a>. They did it every day of the school week, and on the fifth day they said my name. The fifth day they called in and said I had a gun. It was other hackers.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo’s name and address — his documents, or “dox” as hackers know them — have long been published online. And it’s meant he’s been a target for both vengeance and lulz — just, you know, because he’s Cosmo the God and one of the more notorious social engineers around.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Someone also swatted my house,” he tells me, smiling. “It happens a lot to me. Well, the SWAT team was only once at my house, but lots of time with the local police department.” Swatting is a vicious prank where a hacker uses an internet call system to report a hostage situation, which scrambles local law enforcement to the victim’s doorstep.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Through AOL, you can use <a href="http://relayservices.att.com/content/2/im_relay_3.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">AT&T Relay</a> to call the SWAT. It’s for handicapped people. You have to sign up, but it’s easy to sign up. You just instant message the username AT&T Relay and then 911. They ask what’s your location, the emergency. That’s what they did to me. That’s what they did to my school too, because there’s less ways of getting caught.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo shrugs at this, like it’s all perfectly normal stuff for a teenage boy. And the thing is, in 2012, it is perfectly normal for a bored teenage boy on the edge of delinquency. Instead of egging cars and swinging bats at mailboxes, he’s breaking into e-mail accounts.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo got into hacking via online gaming. He grew up on Xbox, and played others online competitively. One day, he was knocked offline mid-match, forfeiting the game. He discovered that this was done via a simple trick, where one gamer turns a script on his opponent’s IP address. He began using this same tactic himself. It was easy and required nothing more than off-the-shelf programs, like <a href="http://www.youtube.com/watch?v=e19D9E3e0b0" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Cain and Able</a>. It was a veil lifted.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Xbox gamers know each other by their gamertags. And among young gamers it’s a lot cooler to have a simple gamertag like “Fred” than, say, “Fred1988Ohio.” Before Microsoft beefed up its security, getting a password-reset form on Windows Live (and thus hijacking a gamer tag) required only the name on the account and the last four digits and expiration date of the credit card on file. Derek discovered that the person who owned the “Cosmo” gamer tag also had a Netflix account. And that’s how he became Cosmo.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I called Netflix and it was so easy,” he chuckles. “They said, ‘What’s your name?’ and I said, ‘Todd [Redacted],’ gave them his e-mail, and they said, ‘Alright your password is 12345,’ and I was signed in. I saw the last four digits of his credit card. That’s when I filled out the Windows Live password-reset form, which just required the first name and last name of the credit card holder, the last four digits, and the expiration date.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This method still works. When Wired called Netflix, all we had to provide was the name and e-mail address on the account, and we were given the same password reset.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo says he did not know with certainty Netflix had the information he wanted prior to the call. But his success was an ah-ha moment.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I figured that if Netflix could score, so could any big provider. Back then, Amazon was easier. And then it got a little bit more security. They made it where you needed the last four of the credit card to reset [a password]. That’s when I figured out you just have to go to fakenamegenerator.com to get a credit card number. So, I would just add the card, hang up, call back, give them the last four and they’d reset it.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This Amazon method, the same one other hackers used to break into my accounts, was one of Cosmo’s innovations. (Although other hackers also claim to have discovered it independently.) I ask him how he figured out he could pull it off, because it’s as clever as it is devious. He shrugs. “It just came to me.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div class="wp-caption alignnone" id="attachment_115668" style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px 0px 5px; width: 670px;"><a href="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw4.jpg" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="size-large wp-image-115668" data-lazy-loaded="true" height="440" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw4-660x440.jpg" style="border: none; display: inline; margin: 0px; padding: 0px;" title="hackerbw4" width="660" /></a><br /><div class="wp-caption-text" style="background-color: black; color: #dddddd; font-size: 12px; line-height: 15px; margin-right: 10px; margin-top: -5px; padding: 10px;"><em style="margin: 0px; padding: 0px;">Photo: Sandra Garcia/Wired</em></div></div><br style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px;" /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Enter UGNazi</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was soon finding all manner of sources for getting information: Hulu, Buy.com, BestBuy, PayPal, Apple and AOL all offered avenues into others’ accounts, where he could peep in at credit card numbers, addresses and emails.  He learned new social-engineering techniques online and likewise passed along what he knew to others. There is a constant information trade back and forth online. IRC and AIM are the user manuals to every back-end customer service system in corporate America.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Meanwhile, he had more time than ever to devote to his particular brand of hacking, also known as socialing. After the bomb threats, he was asked to leave Woodrow Wilson High School in October. He started taking classes at an adult continuing education program where he could complete his degree. But he found it boring. And he had to walk there and back, three miles each way. So in December, he quit.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This meant he was now home all the time, bored. The next month, an online friend of his approached him about joining a new hacking team. The friend was Josh the God, and he was putting together a hacktivist group called UGNazi, with the intention of using their combined skills to protest SOPA and CISPA. Far from being intimidated by the proposed anti-piracy legislation, they were motivated by it. They wanted to attack it and those who supported it. Cosmo’s job was to socially engineer companies that could provide data about their targets.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">One of their initial targets was UFC.com–the website of the Ultimate Fighting Championship–in retaliation for its support of SOPA. (They did the same to Coach.com.) Once Cosmo gathered the necessary background information on UFC’s president, Dana White, they were able to get into the company’s account with Network Solutions. Via Network Solutions, they redirected the DNS to one they controlled. Bang.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">SOPA, of course, died. But UGNazi lived on. They took down the websites for the states of California and Washington and the cities of New York and Washington D.C. They took out Papa John’s website after it<a href="https://twitter.com/UG/status/204715194801328129" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">failed to deliver a pizza in a timely manner</a>. They hacked into MyBB.com, the back-end that many websites use to power forums, and then hijacked its domain. They were pure mayhem.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“UGNazi was also remarkable in how they apparently had no limits on who to attack–the U.S. government, CIA, Wounded Warrior etc.” says Hypponen, “and no apparent [sense of] self preservation, which led to their demise. In this regard, UG and Lulzsec were similar.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The group’s <a href="http://www.net-security.org/secworld.php?id=13032" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">last big takedown was 4Chan</a>. “Josh thought everyone on 4chan was a child molester,” Cosmo explained. But there was more than likely another motivation as well: Lulz. Not to mention huge traffic. If they could redirect 4chan to their own Twitter feed, even for a minute, they would achieve instant notoriety.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Their avenue to jack 4chan was a web services company called CloudFlare that was providing 4chan’s DNS services. (Ironically, UGNazi.com was also a CloudFlare customer.)</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The original idea was to take CloudFlare via Network Solutions, something UGNazi done many times before with other companies. They had gotten CloudFlare CEO Matthew Prince’s dox and had all the information they typically needed to hijack a NetSol account. But they hit a snag: Prince had a two-step security mechanism on his account. They needed a device-specific PIN code that they couldn’t get. But they had been able to ascertain that Prince’s phone number was on AT&T, which meant they had another avenue of attack: his Google email, <a href="http://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">which used that AT&T number as an account recovery option</a>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Security is only as strong as its weakest link. And in this case, the weak link was AT&T. If UG Nazi could get to Prince’s phone, which was his backup mechanism, they could get to his Google account. And to get to his phone, they just needed his Social Security number. That sounds like it’s a tough thing to get. It’s not.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Social Security numbers are freely bought and sold online, not on hidden Tor sites or via some dark back alley, but on the open Web in broad daylight. The cost to buy a Social Security number and date of birth on one Russian site Cosmo referred us to, for example, is $3.80, payable via an alternative currency favored by carders called <a href="http://www.libertyreserve.com/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Liberty Reserve</a>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Once they had Prince’s Social Security number, it was time to manipulate AT&T’s customer service.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“First we called AT&T to forward [Prince’s] cell phone number to Google Voice. We did that, and the lady said ‘alright what’s your name?’ And Josh said ‘Matthew Prince.’ And the lady said, ‘what’s the last four digits of your SSN?’ And Josh gave the full SSN anyway. And she was like ‘alright what’s the phone number you want to forward it to?’</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“He gave her the Google Voice number, and it was forwarded.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo initially said UGNazi used text message forwarding, which both Google and Prince say is not the case. Furthermore, while Wired was able to set up a forwarding number in the manner Cosmo described, we were not able to forward text messages to Google Voice from AT&T. Voice yes, text no. It’s the one glaring inconsistency in everything Cosmo reported. When I asked him about it again, via AIM, he replied “maybe it’s just voice for them then.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As Prince described the attack to Wired, his personal Gmail address was the backup address for his corporate Google Apps email. Although he had two step on the corporate account, he did not have it on the personal one. Furthermore, his phone number was the account-recovery option on that personal address. So UGNazi sent an account recovery request to his phone, which was forwarded to their number, and then used it to take over his personal Gmail.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Once they were in that, they used it to get into my corporate email by doing an account recovery, which was sent to my personal email,” says Prince. “Even though I had two-factor authentication on, for this one account-recovery procedure, Google didn’t verify any out-of-band system. They just sent the email to my personal Gmail and then, once they were in that, they were able to get into my personal email.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Google says this type of attack is no longer possible. A Google spokesperson gave Wired a statement noting “We fixed a flaw that existed in the account recovery process for Google Apps for Business customers under very specific conditions. If an administrator account that was configured to send password reset instructions to a registered secondary email address was successfully recovered, 2-step verification would have been disabled in the process. This could have led to abuse if their secondary email account was compromised through some other means. We swiftly resolved the issue to prevent further abuse.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Ultimately, the end result was that UG Nazi was able to bypass the Google two factor and gain access to Prince’s CloudFlare’s email and then admin tools. They were then able to redirect 4Chan’s DNS to point to their own Twitter account. The hack lasted mere minutes, but given 4chan’s traffic volume, it was enough. It was extremely high profile, and UG Nazi was now basically the most notorious hacking crew of 2012.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">People Are The Key to Every Lock</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As he did with Prince and CloudFlare, Cosmo accomplished many of his feats by going after individuals associated with organizations UG Nazi was targeting. He would gather little bits of information here and there, collecting dox data from various online services, like addresses and credit card numbers, until he had what he needed to launch an attack. Often, he did that by calling a company’s tech support system and pretending to be a worker in another department. Sometimes he was able to pull that off by learning intimate details of a company’s back-end systems.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I had a friend who installed a remote access tool on a Netflix computer. When [the Netflix employee] was AFK–not at the computer–he could use that computer. From there he took a bunch of screenshots, and saw the [support] <a href="http://techblog.netflix.com/2012/06/asgard-web-based-cloud-management-and.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">tool was called Obiwan</a>.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo couldn’t actually use Obiwan himself because he didn’t have a Netflix IP address. But that didn’t matter. He just needed to know what the back end looked like.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You have to impersonate a Netflix agent. So you call up and say ‘Hey, my name is Derek. I’m from Netflix Canada and I’m having a technical difficulty with Obiwan. Can you look something up for me?’ Then you say the email, the name, the billing, and then you ask for the last four. Then you just call back and reset their password.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">And that’s the secret. When Cosmo calls a company pretending to be an employee, he doesn’t wait for them to ask for details. He tells them all the person’s data he has up front. If he knows three pieces of a puzzle and just needs the fourth, he gives them those first without waiting to be asked for them. That way he demonstrates a knowledge of the system, disarming the person on the other end of the line and making them less likely to question his authenticity.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo sometimes even provides details that he knows tech support doesn’t need. For example, if a tech support requires only the zip code on file, he’ll provide the full address anyway. It makes him appear more knowledgeable and less likely to be questioned. That’s classic social engineering.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You can pretty much do it at any company–impersonate an agent,” he shrugs and smiles. “Most people will fall for it unless they’ve been trained not to. But most companies aren’t doing that.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Some of his techniques are incredibly complicated and involve multiple levels of social engineering, like the method he developed for getting into PayPal.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The inside of a PayPal account is a trove of information for social engineers. Once logged in, you can see the last four digits of someone’s credit cards and bank accounts, and their current billing address. That information can, in turn, be used to obtain password resets on all sorts of other sites. More nefariously, once inside someone’s PayPal account, you can flat out rob them.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo explained exactly how it is done.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You have to add a bank account. You can make a virtual bank account on eTrade.com with info from FakeNameGenerator.com.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired verified that it’s possible to create online bank accounts with automatically generated information–although we were also required to enter a driver’s license number, which we got via a second site, using the information from FakeNameGenerator.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You call PayPal, and you have to have the last four of a payment method. You can get that from Amazon or you can impersonate a PayPal agent. They access your account from the last four. You tell them you want to add a phone number, and you add a Google Voice number. And then you say, I also want to add a new bank account I just got. And they add that for you.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Then you hang up, go to PayPal.com, and go to Reset My PayPal Account. It says send to a phone number and shows the last digits. You pick your Google Voice number, and then it [calls] your phone. You enter that, and you go to a new page of verification that says please enter your full bank account with routing number. You just add the bank account number you made with E-Trade. And once you click next, it prompts you to create a new password.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired was able to replicate this method and receive PayPal password resets. After we disclosed the issue to PayPal, the company closed this security hole. PayPal’s director of communications, Anuj Nayar, told Wired this was a temporary issue caused by product testing that was accidentally left open and had now been closed.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired’s subsequent tests found this to be the case, although we could still add a phone number to an account, PayPal would no longer send a password reset to it until it had been verified by logging in.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Busted</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was still sleeping when the police arrived at his apartment. Officers and a detective with the Long Beach Police Department searched his home and seized three of his netbooks and his iPod Touch. They put him in handcuffs and refused to let him change clothes out of the shorts and t-shirt he’d been sleeping in the night before. Then they took him to the Los Padrinos Juvenile Hall, where he spent the next two days.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">They raided his grandmother’s home, too.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I was in the bathroom and I heard some guys talking,” she says. “When I opened up the bathroom door there was this cop standing right at the door. He stood right inside this door and it startled me. He took me by my arm and told me to come in and sit down. I sat down and the three cops were standing over there and they just stood there. I was startled and some cops walked by with Derek, and he was handcuffed.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo suspects the raid was tied to UGNazi’s participation in the <a href="http://www.forbes.com/sites/andygreenberg/2012/05/22/hackers-impersonate-web-billing-firms-staff-to-spill-500000-users-passwords-and-credit-cards/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">WHMCS credit card dump</a>, when they dropped a half million credit card numbers on the open Web, and not the CloudFlare hack that ultimately landed UGNazi on the FBI’s hit list. Still, he expressed remorse for what had gone down with Prince and for people who were still having accounts compromised via methods he pioneered.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I called Matthew Prince the night before [the hack],” Cosmo told me. “I was going to tell him about it. I called through AT&T relay and he hung up on me. I was just going to let him know, ‘Your site’s about to get hacked.’ Josh was going to do it anyway, but…”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Did Cosmo really try to warn Prince? Prince confirms that he did get several calls via an AT&T relay the night before. And while a warning may seem far fetched, it would not be completely out of character.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><a href="http://www.wired.com/gadgetlab/?attachment_id=114934" rel="attachment wp-att-114934" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="alignleft size-medium wp-image-114934" data-lazy-loaded="true" height="300" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/Screen-Shot-2012-09-04-at-3.52.38-PM-119x300.png" style="border: none; display: block; float: left; margin: 0px; padding: 5px 20px 5px 0px;" title="Cosmo and Mikko" width="119" /></a>For example, I was hacked long after Cosmo was arrested and had lost his ability to do any more damage. Yet he managed to learn about how it was done and attempted to relay that information to me via Mikko Hypponen, whom we both follow on Twitter. It was too late, but, still, he made the effort.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">And then there’s the question of why he’s speaking to me at all. Why he’s essentially incriminating himself before he goes to trial. He ultimately reached me via Phobia, the guy who hacked me. Phobia said Cosmo wanted to tell me about a specific AOL account hack that they wanted closed. From my first interaction with Cosmo, weeks ago, through today, he has maintained this was his motivation for talking.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The method Cosmo described for taking an AOL account away from its owner is distressingly simple. Worse, multiple hackers described the AOL exploit as ancient and well known. In short, it takes nothing more than someone’s name and address to take over their AOL email.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">To get a password reset on a free AOL email or chat account, all one needs to give the over-the-phone tech-support worker is the first and last name and zip code on the account. For a paid account, AOL asks for either the address or the last four digits of the credit card on file.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo tells me this casually, while drinking water from a plastic bottle. I stare at him.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Yeah…. that’s all you need to do.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired was able to confirm this and received password resets on both paid and free accounts, despite being being unable to answer account security questions. In some cases, we even deliberately provided incorrect answers. After we informed AOL, it quickly halted issuing password resets over the phone.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“We looked into the matter and found that there was, in fact, a gap in our phone support processes,” AOL’s Senior Vice President for Mail and Mobile David Tempkin informed Wired via email. “We addressed the problem immediately, and as of today, AOL users are better protected — it’s no longer possible to hack into an account via a phone-based password reset.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As a direct result of Cosmo coming forward, PayPal and Aol changed their account security procedures. For me, this only adds to his enigma.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">I wonder how much of everything else Cosmo has told me is true. The only thing I am certain of is that online security is an illusion. But I think he is being honest now. I think he’s genuinely remorseful and just wants all these gaping account holes, many of which he found or helped publicize, closed at last before anyone else has their identity stolen, or the SWAT team sent to their door. That’s what I believe, at least.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">But then, he’s a very, very good liar.</div></div><a class="twitter-follow-button" data-show-count="false" href="https://twitter.com/thehackersmedia">Follow @thehackersmedia</a><script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script></div>

Cosmo the God Hacker

Cosmo is huge — 6 foot 7 and 220 pounds the last time he was weighed, at a detention facility in Long Beach, California on June 26. And yet...

Florida firm was Hacked, exposing Apple ID numbers

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 style="background-color: white; border: 0px; color: #242424; font-family: Droid-Serif, georgia, serif; font-size: 23px; font-weight: normal; line-height: 25px; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Florida firm was hacked, exposing Apple ID numbers</h1><div><br /></div><div><img alt="   " src="http://assets.bizjournals.com/dallas/news/apple%20carousel.jpg?v=1" /> </div><div><br /></div>BlueToad, an Orlando digital publishing company, has said that it is the source of the 1 million Apple IDs that were stolen last week, according to the Los Angeles Times.<br />AntiSec, a hacker group associated with Anonymous, posted the IDs online.<br />The group said it had hacked the IDs from an FBI officials’ laptop. The FBI denied this and BlueToad took responsibility on Sept.10 after its CEO, Paul DeHart, saw that the posted IDs closely matched his company’s data.<br />BlueToad, which develops apps for magazine, newspaper and book publishers, went to the FBI and to Apple (Nasdaq: AAPL) as soon as it discovered the match.<br />AntiSec had stated that 12 million IDs had been stolen and that it had also taken corresponding email addresses, phone numbers and other information. DeHart said this is not true and that “we don’t have any reason to believe they have any other information from our users.”<br /></div>

Florida firm was Hacked, exposing Apple ID numbers

Florida firm was hacked, exposing Apple ID numbers BlueToad, an Orlando digital publishing company, has said that it is the source of the 1...

GoDaddy hacked by Anonymous? Not likely

<div dir="ltr" style="text-align: left;" trbidi="on">GoDaddy hacked by Anonymous? Not likely<br /><br /><img src="http://www2.macleans.ca/wp-content/uploads/2012/09/GoDaddy-tp.jpg" /> <br /><br /><br />Yesterday the massive Internet registrar/lowbrow advertiser GoDaddy went down, taking millions of web sites offline with it. Breaking news reports attributed the trouble to a hack by Anonymous. Later, these items were corrected to say that the hack was not the work of Anonymous as a whole, but that Twitter user @AnonymousOwn3r was claiming responsibility. Mashable called @AnonymousOwn3r ”the security leader of Anonymous,” which must be true because @AnonymousOwn3r calls themself “the security leader of Anonymous” on his or her Twitter profile (and an “official member” to boot).  CNN went with the more measured description of @AnonymousOwn3r as “a person affiliated with Anonymous.”<br /><br />All of this is very silly. Anonymous isn’t an organized group of any kind and has no office or officer to make anything official. It has no leaders of security or of anything else, but I guess it does have affiliates. You become one by being anonymous on the Internet. Are you logged in to Macleans.ca right now as you read this? If not, you are a person affiliated with Anonymous.<br /><br />Whoever @AnonymousOwn3r is, they’ve gained notoriety and thousands of new followers in the last 24 hours and are likely having a laugh at the media right now. It might be a big laugh, because @AnonymousOwn3r might have had nothing to do with GoDaddy’s troubles.<br /><br />GoDaddy is claiming today that they were not, in fact, hacked at all. CEO Scott Wagner said in a statment today that the outage had nothing to do with a hack or with a denial of service attack, Anonymous’ brute force method of pushing sites offline. Instead, it was “due to a series of internal network events that corrupted router data tables” (which is totally what I thought it was from the start).<br /><br />Could Wagner’s statement be face-saving bluster? Possibly, but if so, he would be playing a very risky game. Hackers are usually all too happy to provide technical proof of their deeds, and if necessary, demonstrate their “ownage” of a site by smacking it offline again. @AnonymousOwn3r is assuring doubters that he or she is the real deal and linking to GitHub text purportedly documenting GoDaddy’s vulnerabilities.<br /><br />As security experts analyze this, we’ll find out who is lying: CEO Scott Wagner or @AnonymousOwn3r.<br /><br />My best guess? GoDaddy went dark due to some internal technical glitch, some random indvidual took credit, the media ran with it, and “lulz” ensued.<br /></div>

GoDaddy hacked by Anonymous? Not likely

GoDaddy hacked by Anonymous? Not likely Yesterday the massive Internet registrar/lowbrow advertiser GoDaddy went down, taking millions of w...

Trend Micro Adds Social Networking Protection to Titanium 2013

<div dir="ltr" style="text-align: left;" trbidi="on"><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">Trend Micro Adds Social Networking Protection to Titanium 2013</h1><div><br /></div><div><img alt="Entry-level security now includes WiFi protection and anti-spam" height="137" src="http://i1-news.softpedia-static.com/images/news2/Trend-Micro-Adds-Social-Networking-Protection-to-Titanium-2013-2.png?1347369413" width="400" /> </div><div><br /></div><div><strong style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Trend Micro released the new line of Titanium products for 2013. The focus in this release is on user’s social online activity.</strong><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">As such, the company integrated a security component for social networks that works across multiple online services: Facebook, Twitter, Google+, LinkedIn, MySpace and Pinterest. This allows the user to share information with their friends whenever Trend Micro identifies a malicious link.</span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Entry-level security has been turned up a notch as Trend Micro expands the list of features for Titanium Antivirus + by adding protection on WiFi hotspots, spam blocking capabilities and search result scanning.</span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">The more expensive solutions integrate parental controls, PC optimization (</span><a href="http://www.softpedia.com/get/Antivirus/Trend-Micro-PCcillin-Internet-Security.shtml" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank"><strong>Titanium Internet Security</strong></a><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">), DirectPass password manager, </span><a href="http://www.softpedia.com/get/Internet/File-Sharing/Trend-Micro-SafeSync.shtml" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank"><strong>SafeSync</strong></a><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;"> cloud storage with 5GB free and protection across multiple devices, mobile included (</span><a href="http://www.softpedia.com/get/Security/Security-Related/Trend-Micro-Titanium-Maximum-Security.shtml" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank"><strong>Titanium Maximum</strong></a><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">). Premium edition includes five licenses and a total of 25GB of SafeSync storage.</span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Full compatibility with Windows 8 is also among the highlights.</span> </div><br /></div>

Trend Micro Adds Social Networking Protection to Titanium 2013

Trend Micro Adds Social Networking Protection to Titanium 2013 Trend Micro released the new line of Titanium products for 2013. The focus i...

Jewish Agency Website Hacked

<div dir="ltr" style="text-align: left;" trbidi="on"><b><span style="font-size: large;">Jewish Agency Website Hacked</span></b><br /><b><span style="font-size: large;"><br /></span></b> <img src="http://www.jafi.org.il/NR/rdonlyres/CCF171B2-6FAA-47C1-A41D-AAC4DD06999F/0/topLogoNewBranding_375_91.jpg" /> <br /><b><span style="font-size: large;"><br /></span></b> <span style="background-color: white; font-family: Arial; font-size: 14px;">JERUSALEM -- The Jewish Agency's website was attacked by unknown hackers.</span><br /><br style="background-color: white; font-family: Arial; font-size: 14px;" /> <span style="background-color: white; font-family: Arial; font-size: 14px;">The wave of attacks began Septembers 7 and continued through the weekend, the organization said in a statement released Tuesday.</span><br /><br style="background-color: white; font-family: Arial; font-size: 14px;" /> <span style="background-color: white; font-family: Arial; font-size: 14px;">The attacks, which made the web site temporarily unavailable for short times, came from across the globe, including Russia, Hungary, Saudi Arabia, Brazil and Austria, according to the Jewish Agency.</span><br /><br style="background-color: white; font-family: Arial; font-size: 14px;" /> <span style="background-color: white; font-family: Arial; font-size: 14px;">After concern that data stored on the site could be affected, the Chief Information Officer of the Jewish Agency, Dov Yahav, on September 8 decided to shut down the web site to external users.</span><br /><br style="background-color: white; font-family: Arial; font-size: 14px;" /> <span style="background-color: white; font-family: Arial; font-size: 14px;">After upgrading the site’s security capabilities, it returned to normal operation on Sunday.</span> </div>

Jewish Agency Website Hacked

Jewish Agency Website Hacked JERUSALEM -- The Jewish Agency's website was attacked by unknown hackers. The wave of attacks began Sep...

Pirate Bay Founder Held In New Hacking Probe

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-size: large;"><b>Pirate Bay Founder Held In New Hacking Probe</b></span><br /><br /><img alt="Pirate Bay founder held in new hacking probe" src="http://www.thelocal.se/articleImages/43158.jpg" /> <br /><br />Pirate Bay founder Gottfrid Svartholm Warg, who faces a year-long prison sentence for promoting copyright infringement, was detained on new computer hacking suspicions when he landed in Sweden on Tuesday morning.<br />Cambodia deports Pirate Bay founder to Sweden (11 Sep 12)<br />Cambodia to deport Pirate Bay co-founder (4 Sep 12)<br />Pirate Bay founder arrested in Cambodia (1 Sep 12)<br /><br /><br />According to a statement issued on Tuesday by the Swedish Prosecution Authority (Åklagarmyndigheten), Warg is suspected of having hacked into the Swedish Tax Agency (Skatteverket) as well as Swedish IT firm Logica, which supplies services to the agency.<br /><br />"During a preliminary investigation concerning computer hacking at the company Logica and the Swedish Tax Agency during the spring, suspicions were directed at one person, Gottfrid Svartholm Warg," the Prosecution Authority wrote.<br /><br />The agency added, however, that Warg's August 30th arrest in Cambodia and subsequent deportation from the country on Monday were due to an arrest warrant issued for him in relation to his conviction in the Pirate Bay trial.<br /><br />Shortly after Warg's arrest, reports emerged that he was wanted in an investigation into a hacker attack against Logica and the tax agency.<br /><br />According to a September 6th report in the Dagens Nyheter (DN) newspaper, the attacks gave the hackers access to a sizeable amount of protected personal information.<br /><br />The attack is believed to have started in 2010 and continued until April of this year.<br /><br />Warg, and his fellow co-founders Fredrik Neij and Peter Sunde, as well as financier Carl Lundström, were all convicted in 2009 of facilitating copyright infringement and ordered to pay 46 million kronor ($6.9 million) in damages to the music and movie industry.<br /><br />While Neij, Sunde, and Lundström all had their 12-month sentences reduced to between four and 10 months on appeal in late 2010, Warg did not attend his appeal hearing and his one-year sentence was upheld.<br /><br />Prosecutors now have until Friday to issue a remand order for Warg related to the new computer hacking suspicions.</div>

Pirate Bay Founder Held In New Hacking Probe

Pirate Bay Founder Held In New Hacking Probe Pirate Bay founder Gottfrid Svartholm Warg, who faces a year-long prison sentence for promotin...

Hackers Stole Apple Data From US Company, Not FBI

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px; line-height: 17px;">Hackers Stole Apple Data From US Company, Not FBI</span></span><br /><span style="font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px; line-height: 17px;"><br /></span></span> <img alt="Hacked ... Apple product identification data was posted online." src="http://images.watoday.com.au/2012/09/11/3624968/art-353-apple2-300x0.jpg" /> <br /><span style="font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px; line-height: 17px;"><br /></span></span> <br /><div class="first" id="yui_3_5_1_23_1347315673844_256" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">A US company says that its files - not an FBI agent's laptop - were hacked by a renegade group that released Apple product identification data it claimed to have obtained through a breach of the law enforcement agency.</div><div id="yui_3_5_1_23_1347315673844_265" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">"We want to apologise, announce what happened and set the record straight," said Paul DeHart, chief executive of software company BlueToad.</div><div id="yui_3_5_1_23_1347315673844_268" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">FBI spokesman Paul Bresson confirmed that "it certainly does appear that BlueToad was where the information was actually compromised."</div><div id="yui_3_5_1_23_1347315673844_396" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">BlueToad hosts more than 5,000 worldwide publications including consumer magazines and business documents, and creates apps for its clients. DeHart said the company experiences about 1,000 unsuccessful break-in attempts a day.</div><div id="yui_3_5_1_23_1347315673844_396" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;"><br /></div><div id="yui_3_5_1_23_1347315673844_398" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">DeHart said his company realised it had been hacked soon after the group "AntiSec," an affiliate of Anonymous, posted a file on the internet with the identification numbers for what it claimed were 12 million Apple devices on September 3.</div><div style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">Anonymous is one of several loosely affiliated hacking groups that take credit for breaking into government security agencies and major corporations worldwide.</div><div style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">"A third party reached out to us who was examining the list that was on the internet and said, 'Hey, we see some connections to you guys,'" DeHart said.</div><div style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">He said his company is cooperating fully with the FBI. For security reasons, he declined to provide details of how they confirmed the data file came from his company.</div><div style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">"We haven't tied it to a person at least as of yet ... but we were able to figure out essentially what happened, tied to a lot of things and we've passed that information on (to the FBI)," DeHart said.</div><div style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">He said fewer than two million device IDs were obtained by the hackers rather than the 12 million the group claimed. He said his company, which does not collect private information such as Social Security numbers or credit card information, plugged the hole in its security system and has hired a national security firm to perform a complete security analysis.</div><div style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">"The attack that we got was pretty sophisticated, pretty determined," he said.</div><div id="yui_3_5_1_23_1347315673844_270" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">DeHart said his company hosts time-embargoed and time-sensitive content that could make it a target of hackers. He also speculated that whoever posted the data on the internet might have been acting out of a grudge against a hosted publisher, or might be trying to establish their bona fides among the well-known hacking groups.</div><div id="yui_3_5_1_23_1347315673844_410" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">The Apple ID numbers, called unique device identifiers or UDIDs, are a sequence of letters and numbers assigned to Apple products, such as iPhones or iPads. Many web-based mobile applications and gaming networks use UDIDs to identify users.</div><div id="yui_3_5_1_23_1347315673844_408" style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; padding: 0px; vertical-align: baseline;">Marc Maiffret, chief technology officer of security firm BeyondTrust, said the data dump itself, while serious, would not prove to be very damaging to consumer privacy, and would not allow hackers to break into peoples' iPhones.</div><span style="border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; margin: 0px; padding: 0px; vertical-align: baseline;"><br /></span><br /></div>

Hackers Stole Apple Data From US Company, Not FBI

Hackers Stole Apple Data From US Company, Not FBI A US company says that its files - not an FBI agent's laptop - were hacked by a ren...

Domino's India Web Site Hacked | Customer Data Leaked

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><br /><div style="background-color: white; border: 0px; font: inherit; margin-bottom: 15px; padding: 0px; vertical-align: baseline;"><span style="color: #252525; font-family: Verdana, Arial, sans-serif;"><span style="line-height: 18px;">Domino's India Web Site Hacked | Customer Data Leaked</span></span></div><div style="background-color: white; border: 0px; color: #252525; font-family: Verdana, Arial, sans-serif; font: inherit; line-height: 18px; margin-bottom: 15px; padding: 0px; vertical-align: baseline;"><img src="http://edgeseven.com.au/wp-content/uploads/Dominos-logo.jpeg" /> </div><div style="background-color: white; border: 0px; color: #252525; font-family: Verdana, Arial, sans-serif; font: inherit; line-height: 18px; margin-bottom: 15px; padding: 0px; vertical-align: baseline;">The Indian Web site of pizza retailer Domino was hacked by a Turkish group, which leaked information from about 37,000 accounts online. The data included names, phone numbers, email addresses, and passwords.</div><div style="background-color: white; border: 0px; color: #252525; font-family: Verdana, Arial, sans-serif; font: inherit; line-height: 18px; margin-bottom: 15px; padding: 0px; vertical-align: baseline;">In a <a href="http://business-standard.com/india/news/dominos-india-website-hacked-customer-info-leaked/486057/" style="border: 0px; color: #005399; cursor: pointer; font-size: 12px; font: inherit; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_self">report</a> Tuesday by the <em style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Business Standard</em>, the culprits behind the breach called themselves the <span style="border: 0px; font-size: 12px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Turkish Ajan Hacker Group</span>.<br /><br />The hack was done via SQL injection method and remote file inclusion, <span style="border: 0px; font-size: 12px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">one of the most common methods for stealing private data from web databases, according to the</span> news agency. The news daily explained that t<span style="border: 0px; font-size: 12px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">hrough this, the site's database is tricked into revealing data that should be hidden by ‘injecting’ certain commands.</span></div><div style="background-color: white; border: 0px; color: #252525; font-family: Verdana, Arial, sans-serif; font: inherit; line-height: 18px; margin-bottom: 15px; padding: 0px; vertical-align: baseline;">The news follows a recent spate of hacking of company Web sites in India. In May, electricity company AP Power Generation had its site hacked by hacktivist group Anonymous. In March, the government revealed that 112 of its sites had been breached in the first three months of the year.</div><br /></div>

Domino's India Web Site Hacked | Customer Data Leaked

Domino's India Web Site Hacked | Customer Data Leaked The Indian Web site of pizza retailer Domino was hacked by a Turkish group, which...

Hack lets Google Nexus 7 capture 720p video

Your Google Nexus 7 tablet may not have a rear-facing camera, but with a little technical know-how it appears you can get the slate's 1....

How To Hack WPA2 Wireless Access Points

Many of you have probably seen plenty of tutorials on how to crack WEP encryption. We even did a video back in the old Bauer-Power podcast o...

Former Hacker Reveals How Business Owners Should Protect Their Web Sites

Mitnick was wanted for computer hacking — he bypassed security systems in organizations such as Motorola, Sun Microsystems, Pacific Bell and...

GoDaddy goes down, Anonymous claims responsibility

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: center;"><span style="font-size: x-large;"><b>GoDaddy goes down, Anonymous claims responsibility</b></span></div><img src="http://i.i.com.com/cnwk.1d/i/tim/2012/09/10/go-daddy-status-640x480_edited-1_620x350.jpg" /> <br /><br /><span style="background-color: #fefefe; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px;">CBS News) GoDaddy, the domain registrar and Web hosting company, is down, perhaps taking millions of websites down as a result.</span><br /><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"></div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">"Status Alert: Hey, all. We're aware of the trouble people are having with our site. We're working on it," <a href="https://twitter.com/GoDaddy/status/245213898683318272" style="border: 0px; color: #024382; cursor: pointer; font-family: inherit; font-style: inherit; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">@GoDaddy </a>tweeted Monday.</div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">A quick call to the company's customer service line resulted in this voice message:</div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">"If you are having a problem with your email, we are aware of the problem."</div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">GoDaddy email addresses are down, as well. The blog suggests customers concerned with that their site has been affected can check online status at <a href="http://www.downforeveryoneorjustme.com/" style="border: 0px; color: #024382; cursor: pointer; font-family: inherit; font-style: inherit; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">Down For Everyone Or Just Me</a>.</div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">Twitter accounts claiming to be associated with the hacking group Anonymous claimed responsibility for the attack.</div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">"Basically, every GoDaddy site on the planet just crashed," <a href="https://twitter.com/TibitXimer/status/245218086582628352" style="border: 0px; color: #024382; cursor: pointer; font-family: inherit; font-style: inherit; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">@TibitXimer </a>tweeted.</div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">"#TangoDown - godaddy.com," <a href="https://twitter.com/AnonOpsLegion/status/245218636187443200" style="border: 0px; color: #024382; cursor: pointer; font-family: inherit; font-style: inherit; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">@AnonOpsLegion </a>tweeted Monday, claiming that the Twitter account @AnonymousOwn3r was responsible for the breach. "TangoDown" is the term that Anonymous generally uses to signify that a website is down. </div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">"By using / supporting Godaddy, you are supporting censorship of the Internet," @AnonOpsLegion tweeted again later. </div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">GoDaddy was the target of protests after it was discovered that the company supported unpopular bills the Stop Online Piracy Act (SOPA) and Protect IP Act (PIPA).</div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">GoDaddy did not immediately respond to CBS News' request for comment.</div><div style="background-color: #fefefe; border: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"></div><br class="Apple-interchange-newline" /></div>

GoDaddy goes down, Anonymous claims responsibility

GoDaddy goes down, Anonymous claims responsibility CBS News) GoDaddy, the domain registrar and Web hosting company, is down, perhaps taking...

Ankit Fadia Hacked by Ganster

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: center;"><span style="font-size: large;"><b>Ankit Fadia Hacked by Ganster</b></span></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivdLaGmfTROGNmgYHvobl6LtMjoIzTPxIacCL_rCyWmb1SWBnqHkTOqFOB3yPPuBrRkD-wvjJmOgEcYmcRkVUbXI5FlF7VmlNd-6DOzku5qcnQUaVk-oQhie5q6qrR4ItmA14FxeqBwS0/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="170" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivdLaGmfTROGNmgYHvobl6LtMjoIzTPxIacCL_rCyWmb1SWBnqHkTOqFOB3yPPuBrRkD-wvjJmOgEcYmcRkVUbXI5FlF7VmlNd-6DOzku5qcnQUaVk-oQhie5q6qrR4ItmA14FxeqBwS0/s320/Untitled.png" width="320" /></a></div><br />The Offical Website of Ankit Fadia from India has been Hacked by Ganster. The hacker had left a message on the deface page saying the below:<br /><br /><br /><div style="text-align: center;">[Hacked by Ganster (Hacker)] </div><div style="text-align: center;"><br /></div><div style="text-align: center;">Fadia, ur a kid </div><div style="text-align: center;"><br /></div><div style="text-align: center;">Need Help Contact me Ku*.**m@gmail.com (https://www.facebook.com/Gangsterkul)</div><div style="text-align: center;"><br /></div><div style="text-align: center;">DO : Dance baby Dance kul make you Dance !!|</div><div style="text-align: center;"><br /></div><div style="text-align: center;">Security breached :D</div><div style="text-align: center;"><br /></div><div style="text-align: center;">Ganster Loging out. </div><div><br /></div><div>Site: <a href="http://www.ankitfadia.in/">http://www.ankitfadia.in/</a></div><div>Mirror: <a href="http://mirror-ma.com/mirror/id/70394/">http://mirror-ma.com/mirror/id/70394/</a></div></div>

Ankit Fadia Hacked by Ganster

Ankit Fadia Hacked by Ganster The Offical Website of Ankit Fadia from India has been Hacked by Ganster. The hacker had left a message on the...

VB Decompiler Pro 8.3

Description VB Decompiler Pro 8.3: VB Decompiler is decompiler for programs (EXE, DLL or OCX) written in Visual Basic 5.0 and 6.0 and disass...

Proxifier v3.15 Fullversion

Description Proxifier v3.15: Proxifier is a program that allows network applications that do not support working through proxy servers to op...

Al Jazeera Says News Service Hacked Again

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="background-color: white; font-size: 15px;"><span style="color: #333333; font-family: Georgia, Times New Roman, Times, serif;">Al Jazeera Says News Service Hacked Again</span></span><br /><span style="background-color: white; font-size: 15px;"><span style="color: #333333; font-family: Georgia, Times New Roman, Times, serif;"><br /></span></span> <img height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiHTdAmcT-DOAFFkW4zk5h5w_m4b4uLhwJq6NGNk_ZmFez6YOe9KrJlmZyfsQ2a9dnmGcYmERx2IVhtnmgajF_DWwt5bE7roBlEBuBkbMENUeUhGAYIsN_7zwFb0Ygszsb3UdZJEUV4yE/s400/Al+Jazeera+SMS+service+Hacked.jpg" width="400" /> <br /><span style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;"><br /></span> <span style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;">Qatar-based Al Jazeera news network’s mobile service was hacked on Sunday, four days after a number of its Internet websites came under cyber attack, it reported on its website Al jazeera.net.</span><br /><div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;"></div><div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;">‘The story claiming that the Prime Minister (Sheikh Hamad bin Jassem) has been the target of an assassination attempt in the royal palace is completely false and was a result of hacking of the service,’ the channel said in breaking news.</div><div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;">The main Arab satellite news channel said the claim was among three false texts sent via its mobile service ‘which has been hacked.’</div><div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;">Social networks, including Twitter, quoted Al Jazeera’s mobile service on Sunday as saying that Shaikh Hamad was targeted in an attack on the palace in Doha and that the wife of the emir, Sheikha Moza bint Nasser, was lightly wounded.</div><div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;">On Wednesday, the network said that a number of its websites had been hacked, and Internet users reported that pro-Syrian regime slogans were posted on the broadcaster’s pages.</div><div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;">Internet reports had said that the websites of the Qatar-owned network appeared with a Syrian flag along with the word ‘Hack’ and a message saying the piracy was in ‘response to the hostile position of the channel towards Syria, its people and government.’</div><div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;">The message also cited Al Jazeera’s ‘spread of false news.’</div><div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 15px;">Qatar has repeatedly voiced support for the Syrian opposition against President Bashar Al Assad’s regime and has openly called for arming rebels there, drawing strong criticism from Damascus which accuses Al Jazeera of pro-rebel bias.</div></div>

Al Jazeera Says News Service Hacked Again

Al Jazeera Says News Service Hacked Again Qatar-based Al Jazeera news network’s mobile service was hacked on Sunday, four days after a nu...