Pakistan orders anti-Islam video block on YouTube

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><span style="color: red; font-size: large;">Pakistan orders anti-Islam video block on YouTube</span><br /><br /><div class="wp-caption aligncenter" id="attachment_2959956" style="background-color: white; border: 0px; clear: both; color: #373737; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 12px; line-height: 19px; margin: 0px auto; max-width: 670px; outline: 0px; padding: 0px; vertical-align: baseline; width: 680px;"><img alt="Pta, youtube, anti islam, Pakistan youtube, anti-Islam film, us diplomatic missions, us diplomats, us embassies, libya, Egypt, yemen, Afghanistan, Pakistan Telecommunication Authority, anti-Islamic video, Innocence of Muslims, Christopher Stevens, 9/11, pastor terry jones, anti-US protests, quran burning, new york, Koran burning, ground zero, Benghazi, cairo, sanaa" class="size-full wp-image-2959956" height="334" src="http://dawncompk.files.wordpress.com/2012/09/pta-670.jpg?w=670&h=350" style="margin-bottom: -7px;" title="pta-670" width="640" /><br /><div class="wp-caption-text" style="background-attachment: scroll; background-color: #ebebeb; background-image: none; background-position: 0px 0px; background-repeat: repeat repeat; border: 0px; color: #666666; font-family: arial; font-style: inherit; line-height: 16px; margin-bottom: 10px; min-height: 20px; outline: 0px; padding: 6px 10px; vertical-align: baseline;">“Pakistan Telecommunication Authority (PTA) has proactively blocked and vigorously preventing all access to anti-Islamic video placed on worldwide web via YouTube with the name of ‘Innocence of Muslims’,” it said in a statement. – File photo.</div></div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;"><div style="text-align: left;"><strong style="border: 0px; color: #025387; font-size: 16px; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">ISLAMABAD: Pakistan on Thursday blocked access to an anti-Islam film as security measures beefed up around US diplomatic missions, following attacks on American consulates and embassies in Libya, Egypt and Yemen.</strong></div></div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">The Afghan government earlier ordered an indefinite ban on the entire YouTube video sharing site to prevent access to the film made in the United States, which Kabul said was offensive to Muslims.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">“Pakistan Telecommunication Authority (PTA) has proactively blocked and is vigorously preventing all access to the anti-Islamic video placed on the worldwide web via YouTube with the name of ‘Innocence of Muslims’,” it said in a statement.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">It said “the authority is in close liaison with all the service providers for immediate blocking of the provocative video”, adding that “proactive monitoring and blocking is being done, round the clock”.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">The PTA, which is the main regulatory authority, is mandated to block blasphemous and pornographic websites.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">“Websites which contain offensive, objectionable and obnoxious material are blocked on the direction of the government as per mandated protocols,” said the statement.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">A spokesman for the Internet Service Providers Association of Pakistan, Wahaj us Siraj, told AFP that the ISPs have blocked all the URLs with the film.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">“We have fully implemented orders of the PTA and will make sure that the film is not accessible to anyone in Pakistan,” Siraj added.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">Pakistan’s government said the “abominable” production was designed to stoke inter-faith hatred around the anniversary of the September 11, 2001 attacks, while Afghan authorities condemned the film as “inhuman and insulting”.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">“We have beefed up the security for the possible threats to the US embassy,” Khurram Rasheed, a senior Pakistani police official responsible for diplomats’ security in Islamabad, told AFP earlier Thursday.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">“We expect some protests against the embassy tomorrow and we are preparing to handle that,” he said.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">Riots this week erupted over the film in Libya, where a mob stormed the US consulate in the eastern city of Benghazi on Tuesday, killing US ambassador Christopher Stevens and several other staff members.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">There were also anti-US protests in Egypt’s capital Cairo and on Thursday a crowd stormed the American embassy complex in the Yemeni capital Sanaa before being driven out by police.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">The low-budget movie, entitled “Innocence of Muslims”, portrays followers of the faith as immoral and gratuitously violent.</div><div style="background-color: white; border: 0px; color: #666666; font-family: Arial; font-size: 14px; line-height: 22px; margin-bottom: 14px; outline: 0px; padding: 0px; vertical-align: baseline;">The film has been promoted by controversial US pastor Terry Jones, who has drawn protests for previously burning the Quran and vehemently opposing the construction of a mosque near Ground Zero in New York.</div></div><a class="twitter-follow-button" data-show-count="false" href="https://twitter.com/thehackersmedia">Follow @HackersMedia</a><script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script></div>

Pakistan orders anti-Islam video block on YouTube

Pakistan orders anti-Islam video block on YouTube “Pakistan Telecommunication Authority (PTA) has proactively blocked and vigorously prevent...

Read more »

YouTube Blocks Video Inciting Violence in Mid-East

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 class="title" style="background-color: white; border: 0px; font-family: arial, sans-serif; font-size: 36px; font: inherit; letter-spacing: -0.05em; line-height: 40px; margin: 12px 0px; padding: 0px; vertical-align: baseline;">YouTube Blocks Video Inciting Violence in Mid-East</h1><div><h2 class="subtitle" style="background-color: white; border: 0px; color: #999999; font-family: arial, sans-serif; font-size: 18px; font-weight: normal; font: inherit; line-height: 22px; margin: 0px; padding: 0px; vertical-align: baseline;">YouTube has elected to leave the video on its website, saying it doesn't violate its policies, but has blocked access to it in Egypt and Libya</h2></div><div><br /></div><div><div class="imageCaptureLarge" style="background-color: white; border: 0px; font-family: arial, sans-serif; font-size: 12px; font: inherit; height: 368px; line-height: 12px; margin: 0px; overflow: hidden; padding: 0px; vertical-align: baseline; width: 654px;"><a href="http://media.nbcbayarea.com/images/654*368/libya-add-P7.jpg" id="lb_leadimage" style="border: 0px; color: #26518e; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><img alt="YouTube Blocks Video Inciting Violence in Mid-East" height="368" src="http://media.nbcbayarea.com/images/654*368/libya-add-P7.jpg" style="border: 0px; font: inherit; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;" width="654" /></a></div><div align="right" class="imageCredit" style="background-color: white; border: 0px; color: #c3c3c3; font-family: arial; font-size: 10px; font: inherit; line-height: 16px; margin-bottom: 8px; margin-top: 2px; padding: 0px; vertical-align: baseline;">AFP/Getty Images</div><div class="imageCaption" style="background-color: white; border: 0px; color: #999999; font-family: arial; font-size: 12px; font: inherit; line-height: 16px; margin-bottom: 17px; padding: 0px; vertical-align: baseline;">Egyptian protesters tear down the US flag and wave various black Islamic flags at the US embassy in Cairo on September 11, 2012 during a demonstration against a film deemed offensive to Islam. Thousands of angry Egyptian demonstrators protested against the film made by an Israeli-American who describes Islam as a "cancer" as an armed mob attacked the US mission in the Libyan city of Benghazi killing an official. AFP PHOTO/STR (Photo credit should read -/AFP/GettyImages)</div><div class="imageCaption" style="background-color: white; border: 0px; color: #999999; font-family: arial; font-size: 12px; font: inherit; line-height: 16px; margin-bottom: 17px; padding: 0px; vertical-align: baseline;"><br /></div><div class="imageCaption" style="background-color: white; border: 0px; color: #999999; font-family: arial; font-size: 12px; font: inherit; line-height: 16px; margin-bottom: 17px; padding: 0px; vertical-align: baseline;"></div><div id="paragraph1" style="border: 0px; color: #333333; font-family: arial, sans-serif; font-size: 15px; font: inherit; line-height: 22px; margin-bottom: 15px; padding: 0px; vertical-align: baseline;">YouTube has blocked a video attacking Islam's prophet Muhammad in Egypt and Libya, where angry protests were sparked by outrage at the video.<br />       Ultraconservative Muslims enflamed by the video stormed the U.S. embassy in Cairo on Tuesday and replaced an American flag with an Islamic banner. Later Tuesday evening, protesters in Libya burned down the U.S. consulate in the Libyan city of Benghazi, killing the U.S. ambassador to Libya and three members of his staff.</div><div id="paragraph2" style="border: 0px; color: #333333; font-family: arial, sans-serif; font-size: 15px; font: inherit; line-height: 22px; margin-bottom: 15px; margin-top: 15px; padding: 0px; vertical-align: baseline;">       The 14-minute video is a trailer to an amateurish, low-budget movie titled "Innocence of Muslims,'' which depicts Muhammad as a feckless philanderer who approved of child sexual abuse. Muslims find it offensive to depict Muhammad in any manner, let alone insult the prophet.        YouTube has elected to leave the video on its website, saying it doesn't violate its policies, but has blocked access to it in Egypt and Libya. The Google-Inc. video site took the unusual step Wednesday of publicly commenting on the video, a practice it typically eschews.<br />       "We work hard to create a community everyone can enjoy and which also enables people to express different opinions,'' YouTube said in a statement. "This can be a challenge because what's OK in one country can be offensive elsewhere. This video which is widely available on the web is clearly within our guidelines and so will stay on YouTube. However, given the very difficult situation in Libya and Egypt we have temporarily restricted access in both countries. Our hearts are with the families of the people murdered in yesterday's attack in Libya.''<br />       The video was uploaded on July 2 by a YouTube user going by the name Sam Bacile. After sitting dormant and largely unwatched for two months, it was dubbed into Arabic and excerpts gained airplay on TV networks in Egypt, enraging ultraconservative viewers.<br />       President Barack Obama on Wednesday condemned the attack in Benghazi and ordered increased security to protect American diplomatic personnel around the world. He pledged to ``bring justice to the killers who attacked our people.''<br />       "We reject all efforts to denigrate the religious beliefs of others,'' said Obama. ``But there is absolutely no justification for this type of senseless violence, none.'' </div></div></div>

YouTube Blocks Video Inciting Violence in Mid-East

YouTube Blocks Video Inciting Violence in Mid-East YouTube has elected to leave the video on its website, saying it doesn't violate its ...

Read more »

YouTube blocks anti-Islam video in India

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="background-color: white; color: #393939; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 28px; line-height: 30px;">YouTube blocks anti-Islam video in India</span><br /><img src="https://lh4.googleusercontent.com/-4QDxins1Vgw/AAAAAAAAAAI/AAAAAAAAGYw/sM3FJY9Asl4/s250-c-k/photo.jpg" /> <br /><span style="background-color: white;"></span><br />NEW DELHI: Video-sharing website YouTube has blocked access in India to an anti-Islam film that surfaced in the United States and has since sparked deadly protests in the Muslim world, Google said on Friday.<br />US-based search engine Google, which owns YouTube, did not say whether it acted on its own or was asked to remove the content by the Indian government.<br /><br />"We do, at times, block content in response to a court order or other valid legal process. We have blocked access to the YouTube page in the Indian domain," a Google executive, who asked not to be named, told AFP.<br /><br />YouTube had earlier this week offered to "temporarily" restrict access to the film in Libya and Egypt, the hotbed of protests, because of the "very difficult situation" in both the countries.<br /><br />Pakistan and Afghanistan have already blocked access to the movie, which was condemned as "inhuman" and "provocative".<br /><br />Indonesia, where most of the 240 million population practise a moderate form of Islam, has also demanded that YouTube remove the film from its website.<br /><br />Protesters have targeted US embassies for the film, which portrays followers of the Islamic faith as immoral and gratuitously violent.<br /><br />Four people died in the Yemeni capital Sanaa on Thursday as violence flared outside US embassies over the low-budget film.<br /><br />The deaths followed the killing of US diplomat and three colleagues in Syria Tuesday, after a mob stormed the consulate in Benghazi.<br /><br />India is home to a Muslim population estimated at about 150 million, according to census<br /></div>

YouTube blocks anti-Islam video in India

YouTube blocks anti-Islam video in India NEW DELHI: Video-sharing website YouTube has blocked access in India to an anti-Islam film that su...

Read more »

‘Innocence Of Muslims’ Movie Causes YouTube Ban In Afghanistan, Islamic Republic Tries To Prevent People From Watching Muhammad Film

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: Arial, Helvetica, sans-serif; font-size: 26px; font-weight: bold; line-height: 26px;">‘Innocence Of Muslims’ Movie Causes YouTube Ban In Afghanistan, Islamic Republic Tries To Prevent People From Watching Muhammad Film</span> <br /><span style="font-family: Arial, Helvetica, sans-serif; font-size: 26px; font-weight: bold; line-height: 26px;"><br /></span> <img src="http://group5tud.files.wordpress.com/2010/08/022-youtube-music.png" /> <br /><span style="font-family: Arial, Helvetica, sans-serif; font-size: 26px; font-weight: bold; line-height: 26px;"><br /></span> <br /><div class="content1 KonaBody" style="border: 0px none; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; list-style: none; margin: 0px; outline: none 0px; padding: 0px;"><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">The Islamic Republic of <span class="tpk" style="border: 0px none; list-style: none; margin: 0px; outline: none 0px; padding: 0px;">Afghanistan</span> officially banned the video-sharing website YouTube on Wednesday in an attempt to prevent Afghans from watching the controversial "Innocence of Muslims." </div></div><div class="content2 KonaBody" style="border: 0px none; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; list-style: none; margin: 0px; outline: none 0px; padding: 0px;"><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">"We have been told to shut down YouTube to the Afghan public until the video is taken down," Aimal Marjan, general director of Information Technology at the ministry, told Reuters.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">The film, now known as the "Muhammad film," reportedly instigated planned protests outside the U.S. Consulate in Benghazi, <span class="tpk" style="border: 0px none; list-style: none; margin: 0px; outline: none 0px; padding: 0px;">Libya</span>.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">John Christopher Stevens, the U.S. ambassador to <span class="tpk" style="border: 0px none; list-style: none; margin: 0px; outline: none 0px; padding: 0px;">Libya</span>, and three embassy staff were killed as they rushed away from a consulate building in Benghazi, stormed by al Qaeda-linked gunmen. Protesters also attacked the U.S. embassy in Cairo.</div></div><div class="content3" style="border: 0px none; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; list-style: none; margin: 0px; outline: none 0px; padding: 0px;"><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">While some media outlets speculated that the film sparked the powerful protests, <a href="http://www.cnn.com/2012/09/12/world/africa/libya-us-ambassador-killed/index.html?hpt=us_c2" rel="nofollow" style="border: 0px none; color: #0051a1; list-style: none; margin: 0px; outline: none 0px; padding: 0px;" target="_blank">CNN</a> reported that the deadly assault in Benghazi on the U.S. Consulate was planned by the attackers who used the protests as a diversion.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">According to <a href="http://www.cnn.com/2012/09/12/world/africa/libya-us-ambassador-killed/index.html?hpt=us_c2" rel="nofollow" style="border: 0px none; color: #0051a1; list-style: none; margin: 0px; outline: none 0px; padding: 0px;" target="_blank">CNN</a>, the sources could not say whether the attackers instigated the protest or merely took advantage of it.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">The consulate in Libya was one of several American diplomatic missions in the Middle East to fall victim to protests Tuesday following the release of a YouTube video that mocked Islam and depicted the Muslim Prophet Muhammad as a child molester, a womanizer and a ruthless killer.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">Citing a U.S. official familiar with the attack on the consulate in Libya, CNN reported that a grenade set the building ablaze, leaving the Americans facing both a fire inside and attackers outside.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">U.S. Ambassador Stevens and the three other Americans who died were separated from the rest of the staff while trying to escape to the roof of the building and succumbed to smoke inhalation, the senior official told CNN.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">The official added that there were several "valiant but unsuccessful" attempts to get back into the building and rescue them.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">U.S. officials announced on Wednesday that around 50 U.S. Marines from a rapid reaction force were headed to Libya in an effort to restore security to the consulate.</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">In Washington, President <span class="tpk" style="border: 0px none; list-style: none; margin: 0px; outline: none 0px; padding: 0px;">Barack Obama</span> said the violence was completely unwarranted and vowed that "justice will be done."</div><div style="border: 0px none; font-size: 1.2em; line-height: 1.5em; list-style: none; margin-bottom: 1em; outline: none 0px; padding: 0px;">"Since our founding, the United States has been a nation that respects all faiths. We reject all efforts to denigrate the religious beliefs of others," he said. "But there is absolutely no justification for this type of senseless violence -- none."</div></div></div>

‘Innocence Of Muslims’ Movie Causes YouTube Ban In Afghanistan, Islamic Republic Tries To Prevent People From Watching Muhammad Film

‘Innocence Of Muslims’ Movie Causes YouTube Ban In Afghanistan, Islamic Republic Tries To Prevent People From Watching Muhammad Film The...

Read more »

The 10 Most Infamous Student Hackers of All Time

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: Arial; font-size: 14px; line-height: 21px;">Hacking has always been inherently a young person’s game. The first usage of the word “hacker” was to describe pranksters </span><a href="http://www.historyofinformation.com/expanded.php?id=1229" style="border: 0px; color: #0088cc; font-family: Arial; font-size: 14px; line-height: 21px; margin: 0px; padding: 0px; vertical-align: baseline;">meddling with the phones</a><span style="font-family: Arial; font-size: 14px; line-height: 21px;"> at MIT. Many hackers have cited boredom, a desire for change, or the thrill of going somewhere one is not supposed to go as their motivation for hacking, all of which could apply to scores of common activities on college campuses. While today’s hacking scene is dominated by large hacking groups like Anonymous and Masters of Deception, many of the greatest hacks ever have been pulled off by college, high school, and even middle school kids who rose to infamy armed only with a computer and the willingness to cross the bounds of legality.</span><br /><div style="border: 0px; font-family: Arial; font-size: 14px; line-height: 21px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIvlgrf0zfzx4TZzOK_zFe7_Yq_xkHT96zJRV06JX1xUTl3VMc7WtyFZJ3eReHSUbi575oSRw5LnZ2ORmx9Q1e_qyIs8BPKPPgQ7D5U3K5X0lN749EmG7wSjDsAo9PFy3xaHoit2ftjxrp/s1600/student-hacker.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="277" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIvlgrf0zfzx4TZzOK_zFe7_Yq_xkHT96zJRV06JX1xUTl3VMc7WtyFZJ3eReHSUbi575oSRw5LnZ2ORmx9Q1e_qyIs8BPKPPgQ7D5U3K5X0lN749EmG7wSjDsAo9PFy3xaHoit2ftjxrp/s400/student-hacker.jpg" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div></div><ol style="border: 0px; font-family: Arial; font-size: 14px; line-height: 21px; margin: 0px 0px 1em 2em; outline: 0px; padding: 0px; vertical-align: baseline;"><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://lastwatchdog.com/microsoft-pays-250000-bounty-capture-creator-netskysasser/" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Sven Jaschan</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">In the <a href="http://www.sophos.com/en-us/press-office/press-releases/2005/07/va_sasserfree.aspx" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">words of one tech expert</a>, “His name will always be associated with some of the biggest viruses in the history of the Internet.” The viruses: the Sasser and NetSky worms that infected millions of computers and have caused millions of dollars of damage since their release in 2004. The man behind the viruses proved to be not even a man at all, legally. Seventeen-year-old hacker Sven Jaschan, a student at a computer science school in Germany, claimed to have created the viruses to become a hero by developing a program that would eradicate the rampaging Mydoom and Bagle bugs. Instead he found himself the subject of <a href="http://lastwatchdog.com/microsoft-pays-250000-bounty-capture-creator-netskysasser/" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">a $250,000 bounty</a>courtesy of Microsoft, for which some of his classmates turned him in.</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.wired.com/threatlevel/2009/07/hacker/" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Jonathan James</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">In 2000, at the age of 16, James, or “C0mrade” as he was known in the hacker community, infamously became the first juvenile federally sentenced for hacking. The targets of his notorious hack jobs were a wing of the U.S. Department of Defense called the Defense Threat Reduction Agency, NASA, and the Marshall Space Flight Center in Huntsville, Ala. (By hacking the latter James gained the ability to control the A/C in the International Space Station.) All of these were pulled off “for fun” while James was still a student at Palmetto Senior High in Miami. Unfortunately, the fun ran out when James was tied into a massive <a href="http://www.browardpalmbeach.com/2010-05-20/news/four-kids-from-south-florida-led-the-world-s-biggest-online-identity-heist/" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">identity theft investigation</a>. Though insisting he was innocent, James took his own life, saying he had “no faith in the justice system.”</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://mafiaboybook.com/michael-calce/" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Michael Calce</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">Yahoo. CNN. Ebay. Amazon. Dell.com. One by one in a matter of days, these huge websites crashed at the hands of 15-year-old Canadian high school student Michael Calce, aka “MafiaBoy.” Armed with a denial-of-service program he called “Rivolta” that overloaded servers he targeted, the young hacker wreaked $7.5 million in damages, <a href="http://www.wired.com/politics/law/news/2001/06/44673" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">according to court filings</a>. Calce was caught when he fell victim to a common ailment of teenage boys: bragging. The cops were turned on to him when he began boasting in chat rooms about being responsible for the attacks. On Sept. 12, 2001, MafiaBoy was sentenced to a group facility for eight months on 56 counts of cybercrime.</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.telegraph.co.uk/technology/6670127/Top-10-most-famous-hackers.html" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Kevin Mitnick</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">Before performing hacks that prompted the U.S. Department of Justice to declare him “the most wanted computer criminal in United States history,” Kevin Mitnick had already made a name for himself as a hacker in his school days, first at Monroe High School in LA and later at USC. On a dare, Mitnick connived an opening into the computer system of Digital Equipment Corporation, which some fellow hackers then used to <a href="http://passwordresearch.com/stories/story47.html" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">steal proprietary source code</a> from the company before ratting on him. While still on probation for that crime, Mitnick broke into the premises of Pacific Bell and had to go on the run from police in the aftermath, during which time he hacked dozens of systems, including those of IBM, Nokia, Motorola, and Fujitsu.</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.rawhack.com/famous.hackers/tim.berners.lee.htm" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Tim Berners-Lee</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">“Scandalous” is a synonym for “infamous,” and for this legendary computer scientist, knight of the British Empire, and inventor of the World Wide Web to have been a hacker in his school days is certainly a juicy factoid. During his time at Oxford in the mid-’70s, Sir Tim was banned from using university computers after he and a friend were caught hacking their way into restricted digital areas. Luckily by that time he already knew how to <a href="http://designmuseum.org/design/tim-berners-lee" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">make his own computer</a> out of a soldering iron, an old TV, and some spare parts. And also luckily for him, he will always be <a href="http://www.huffingtonpost.com/2012/07/28/tim-berners-lee-lee-london-2012-olympics-opening-ceremony_n_1714256.html" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">revered</a> as the father of the Internet.</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.atarimagazines.com/creative/v10n1/266_Telecommunications_talk.php" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Neal Patrick and the 414s</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">In the early ’80s, hacking was still a relatively foreign concept to most Americans. Few recognized the enormous power hackers could hijack with a few strokes on a keyboard, which explains why a young group of hackers known as the 414s (after a Milwaukee area code) were virtual celebrities after they hacked into the famous Los Alamos National Laboratory, the Memorial Sloan-Kettering Cancer Center, and elsewhere. While today hacking a lab where classified nuclear research is conducted could earn you a one-way ticket to Guantanamo, the 17-year-old ringleader and high school student Neal Patrick was on <a href="http://www.ugo.com/the-goods/the-414s" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">the cover of <em style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Newsweek</em></a>. The group members got light sentences but prompted Congress to take a stronger role in cybercrime.</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.findingdulcinea.com/news/on-this-day/July-August-08/On-this-Day--Robert-Morris-Becomes-First-Hacker-Prosecuted-For-Spreading-Virus.html" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Robert T. Morris</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">The first ever Internet worm, the Morris Worm derived its name from Cornell grad student Robert Tappan Morris. In 1988, Morris released the worm through MIT’s system to cover his tracks, which would seem to contradict his claims that he meant no harm with it. But that’s exactly what resulted: the worm spread out of control, infecting more than 6,000 computers connected to the ARPANET, the academic forerunner to the World Wide Web. The damages reached as high as an estimated $10 million, and Morris earned the ignominious distinction of being the first person prosecuted under the Computer Fraud and Abuse Act. Morris got community service but was apparently not considered too infamous to be offered his current job as a professor at MIT.</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.newyorker.com/reporting/2012/05/07/120507fa_fact_kushner" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">George Hotz</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">To some, George Hotz (aka “geohot,” aka “million75,” aka “mil”) is a public menace, a threat to electronic businesses everywhere. To many, Hotz is a hero. The high-schooler shot to fame/infamy in 2007 at the tender age of 17 by giving the world its first hacked, or “jailbroken” iPhone. He traded it for a new sports car and three new iPhones, and the video of the hacking received millions of hits. Apple has had to grudgingly come to terms with jailbreaking, seeing as the <a href="http://www.wired.com/threatlevel/2010/07/feds-ok-iphone-jailbreaking/" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">courts have declared it legal</a>, but Sony Corp. is definitely not OK with such tampering. When Hotz hacked his PlayStation 3 and published the how-to on the web, the company launched a vicious lawsuit against him. In turn, the hacker group Anonymous launched an attack on Sony, stealing millions of users’ personal info.</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.independent.ie/national-news/trinity-student-fbi-claim-is-top-hacker-is-released-by-gardai-3041639.html" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Donncha O’Cearbhaill</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">According to the FBI, this 19-year-old freshman at Trinity College Dublin is one of the top five most wanted hackers in the world. Well, he was; now that he’s been arrested he’s not really “wanted” anymore. The Feds contend the young man is a VIP member of the Anonymous and LulzSec hacking groups that have already been mentioned and whose targets have included the FBI, the U.S. Senate, and Sony (in the Hotz backlash). It seems “Palladium” (O’Cearbhaill) took the liberty of listening in on a conference call between the FBI and several international police forces who were discussing their investigations of the hacking groups. He could be sentenced to up to 15 years in prison if convicted for that hack alone.</div></li><li style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.forbes.com/sites/andygreenberg/2011/08/01/meet-comex-the-iphone-uber-hacker-who-keeps-outsmarting-apple/" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">Nicholas Allegra</a>:</strong><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">Just as George Hotz moved on from the Apple hacking game, Brown University student Nicholas Allegra is also hanging up his jersey. “Comex,” as he is known to millions of rooted iPhone fans, created the simple-to-use Apple iOS jailbreaking program <a href="http://www.jailbreakme.com/" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">JailbreakMe</a> in 2007 and has since released two newer versions of it. However, Comex seems to have gone over to the dark side,<a href="http://news.softpedia.com/news/Apple-Hires-Jailbreak-Artist-Comex-218837.shtml" style="border: 0px; color: #0088cc; margin: 0px; padding: 0px; vertical-align: baseline;">accepting an internship</a> with the very company whose products he became famous exploiting. Still, Allegra’s hacking skills are so advanced (one author puts him five years ahead of the authors of the infamous Stuxnet worm that corrupted Iran’s nuclear facilities) and so many people availed themselves of his talents, he will forever live in hacking infamy.</div><div style="border: 0px; margin: 1em auto; outline: 0px; padding: 0px; vertical-align: baseline;">Source: <a href="http://www.onlinedegrees.org/the-10-most-infamous-student-hackers-of-all-time/" target="_blank">Link</a></div></li></ol></div><a class="twitter-follow-button" data-show-count="false" href="https://twitter.com/thehackersmedia">Follow @thehackersmedia</a><script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script></div>

The 10 Most Infamous Student Hackers of All Time

Hacking has always been inherently a young person’s game. The first usage of the word “hacker” was to describe pranksters  meddling with the...

Read more »

Researchers Demonstrate CRIME Attack Against TLS Protocol [Video]

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 16px;">Researchers Demonstrate CRIME Attack Against TLS Protocol [Video]</span><br /><div><br /></div><div><iframe allowfullscreen="allowfullscreen" frameborder="0" height="720" src="http://www.youtube.com/embed/gGPhHYyg9r4" width="960"></iframe><br /></div><div><strong style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;"><br /></strong> <strong style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Juliano Rizzo and Thai Duong – the security researcher who became famous after demonstrating the SSL attack known as the <a href="http://news.softpedia.com/news/SSL-Encryption-Turns-Out-to-Be-Highly-Vulnerable-222599.shtml" style="color: #0058bb; text-decoration: none;" target="_blank">BEAST</a> – have come up with an attack against the TLS protocol.</strong><br /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">To prove their findings, they’ve released a video proof-of-concept which shows that an attacker can gain access to protected user cookies and hijack sessions.</span><br /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /> <span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">According to the researchers, the new attack is similar to the BEAST, but they didn’t pinpoint the TLS feature responsible for the information leak, ThreatPost </span><a href="https://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512" rel="nofollow" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank">notes</a><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">.</span><br /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /> <span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Apparently, all TLS versions are susceptible to these attacks which work on both Firefox and Chrome.</span><br /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /> <span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">The experts reveal that users can protect themselves against such attacks by permanently keeping their browsers updated and by disabling compression on servers.</span><br /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /> <span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">The details of the CRIME attack will be presented by the researchers at the upcoming </span><a href="http://ekoparty.org/" rel="nofollow" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank">ekoparty</a><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;"> security conference in Buenos Aires, Argentina.</span> </div><div><br /></div><div>Source: <a href="http://news.softpedia.com/news/Researchers-Demonstrate-CRIME-Attack-Against-TLS-Protocol-Video-291922.shtml">View</a><br /><br /><img src="http://www.tls-online.com/images/Tls-logo.GIF" /> </div></div>

Researchers Demonstrate CRIME Attack Against TLS Protocol [Video]

Researchers Demonstrate CRIME Attack Against TLS Protocol [Video] Juliano Rizzo and Thai Duong – the security researcher who became famous ...

Read more »

Hijacked Pinterest Accounts Promote Work-at-Home Jobs on Facebook and Twitter

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">Hijacked Pinterest Accounts Promote Work-at-Home Jobs on Facebook and Twitter</h1><div><br /></div><div><img alt="Work-at-home jobs advertised on Pinterest" src="http://i1-news.softpedia-static.com/images/news2/Hijacked-Pinterest-Accounts-Promote-Work-at-Home-Jobs-on-Facebook-and-Twitter-2.jpg?1347523260" /> </div><div><br /></div><div><strong style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Spammers are using compromised Pinterest accounts to advertise shady work-at-home job offers. For users who have linked their Pinterest profiles to Facebook and Twitter it’s even worse, since the spammy messages are pushed onto these websites as well.</strong><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">The growing popularity of the relatively new social media platform Pinterest is beginning to attract more and more cybercriminals. The company has started </span><a href="http://news.softpedia.com/news/Pinterest-Starts-Locking-Accounts-of-Hacked-Users-282342.shtml" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank"><strong>warning users</strong></a><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;"> a few weeks ago to be on the lookout for any suspicious elements (malware, phishing scams, and malicious browser plugins) which could allow crooks to take over their accounts.</span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br /><div align="center" class="article_ad" style="background-color: white; color: #222222; float: right; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; margin: 10px 0px 10px 15px; padding: 0px;"><ins style="border: none; display: inline-table; height: 250px; margin: 0px; padding: 0px; position: relative; visibility: visible; width: 300px;"></ins></div><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">However, it seems that many users still fall for the traps set by the spammers. According to </span><a href="http://nakedsecurity.sophos.com/2012/09/12/omg-this-is-so-cool-pinterest-hack-feeds-spam-to-twitter-and-facebook/?utm_source=feedburner&utm_medium=feed&utm_content=Google+Reader&utm_campaign=Feed:+nakedsecurity+(Naked+Security+-+Sophos)" rel="nofollow" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank">Sophos experts</a><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">, in the past few days a number of shady work-at-home jobs have been advertised. </span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">In situations where the Pinterest account is linked to Twitter and Facebook, the spam appears as messages such as “Omg this is so cool! Can’t wait for more!” or “Omg this is so exciting! Too excited for next ones!”</span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Bitdefender’s HotForSecurity </span><a href="http://www.hotforsecurity.com/blog/hacked-pinterest-accounts-push-spam-to-facebook-and-twitter-3469.html" rel="nofollow" style="background-color: white; color: #0058bb; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify; text-decoration: none;" target="_blank">reports</a><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;"> that the attackers haven’t changed the passwords of the compromised accounts. They simply utilized them to promote their shady offers.</span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Experts report that for some Twitter customers the situation is so frustrating that they have even decided to close their Pinterest accounts in order to stop the spam from flowing in.</span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">Pinterest is working hard on removing the shady pins, but it appears that they’re having difficulties in properly cleaning up the platform. Unfortunately, this incident once again highlights the necessity for a proper anti-spam mechanism that could combat this phenomenon.</span><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><br style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;" /><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;">For now, Pinterest keeps advising the victims of such attacks to immediately change their passwords. They also recommend users to be cautious when installing third-party apps and web browser extensions since in many cases they’re the ones responsible for allowing hackers to hijack accounts.</span> </div><div><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;"><br /></span></div><div><span style="background-color: white; color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 14px; text-align: justify;"><br /></span></div><div style="text-align: justify;"><span style="color: #222222; font-family: Verdana, Arial, Helvetica, sans-serif;"><span style="font-size: 11px; line-height: 14px;">Source: </span></span><a href="http://news.softpedia.com/news/Hijacked-Pinterest-Accounts-Promote-Work-at-Home-Jobs-on-Facebook-and-Twitter-291906.shtml" style="text-align: left;">View</a></div></div>

Hijacked Pinterest Accounts Promote Work-at-Home Jobs on Facebook and Twitter

Hijacked Pinterest Accounts Promote Work-at-Home Jobs on Facebook and Twitter Spammers are using compromised Pinterest accounts to advertis...

Read more »

Visa to Introduce Point-to-Point Encryption Service to Payment Terminals

<div dir="ltr" style="text-align: left;" trbidi="on"><table border="0" cellpadding="0" cellspacing="0" style="color: #9e9e9e; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; text-align: start; width: 725px;"><tbody><tr><td class="contentheadings" valign="top"><h1 id="htitle" style="color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">Visa to Introduce Point-to-Point Encryption Service to Payment Terminals</h1><div style="color: #5e5e5e;"><br /></div><div style="color: #5e5e5e;"><img alt="Visa to introduce new encryption service by 2013" height="145" src="http://i1-news.softpedia-static.com/images/news2/Visa-to-Introduce-Point-to-Point-Encryption-Service-to-Payment-Terminals-2.jpg?1347524048" width="400" /> </div><div style="color: #5e5e5e;"><br /></div><div><div><span style="color: #5e5e5e;">At the end of August, Visa revealed its plans to introduce a new point-to-point encryption ((P2PE) service called Visa Merchant Data Secure. The service – which will be made available at the beginning of 2013 – will aim at securing payment terminals and other critical systems across the industry. </span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;">The P2PE technology will allow merchants to protect sensitive cardholder information by encrypting data within the payment processing environment. The encryption keys will be guarded by Visa, the gateway, or the company that acquires the service.</span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;"> "Merchants large and small have expressed an interest in encryption as a way to protect cardholder data in their payment systems and simplify their security protocols," Ellen Richey, chief enterprise risk officer at Visa, explained when the service was announced.</span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;">"Since encrypted data can't be used to commit fraud, Visa's point-to-point encryption solution can significantly reduce the risk and impact of data compromises."</span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;">According to Eduardo Perez of the Visa Risk Group, the new service is not required yet, but it is “one of the tenets of the PCI Data Security Standard.” </span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;">In a recent interview, Perez revealed that the main goal was to continue to encourage organizations to adopt the more secure EMV (Europay, MasterCard, Visa) standard and rely more on dynamic authentications. </span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;">The new encryption solution might represent the answer to the issues highlighted a few days ago by University of Cambridge researchers. They discovered the fact that the unpredictable number (UN) used by EMV cards to authenticate themselves was somewhat predictable.</span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;">They found a pattern in the way many ATMs and point-of-sales (POS) devices generated the “random” part of the UN. Because manufacturers of these devices are taking shortcuts, EMV card holders might become exposed.</span></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;">Their theory might explain some of the phantom withdrawals that some cardholders have reported.</span></div></div><div><span style="color: #5e5e5e;"><br /></span></div><div><span style="color: #5e5e5e;">Source: </span><a href="http://news.softpedia.com/news/Visa-to-Introduce-Point-to-Point-Encryption-Service-to-Payment-Terminals-291895.shtml">View</a></div></td></tr></tbody></table></div>

Visa to Introduce Point-to-Point Encryption Service to Payment Terminals

Visa to Introduce Point-to-Point Encryption Service to Payment Terminals At the end of August, Visa revealed its plans to introduce a new p...

Read more »

BlackHole Exploit Kit 2.0 Made Available, Price Remains the Same

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">BlackHole Exploit Kit 2.0 Made Available, Price Remains the Same</h1><div><br /></div><div><img alt="BlackHole exploit kit 2.0 released" height="267" src="http://i1-news.softpedia-static.com/images/news2/BlackHole-Exploit-Kit-2-0-Made-Available-Price-Remains-Same-2.jpg?1347519896" width="400" /> </div><div><br /></div><div><div>The infamous BlackHole exploit kit has been upgraded to the 2.0 version. Its developers have noticed that security solutions have no problem in identifying the old variant as being malware, so they claim to have rewritten it from scratch.</div><div><br /></div><div>As expected, <a href="http://malware.dontneedcoffee.com/2012/09/blackhole2.0.html">BlackHole 2.0 </a>comes with several improvements. First of all, they added a protection mechanism that prevents security firms from accessing the exploits, and in order to achieve this, dynamic URLs – which are valid for only a few seconds - are generated.</div><div><br /></div><div><br /></div><div> The new variant doesn’t rely on plugindetect to determine the Java version that’s installed, thus speeding up the malware download process. Old exploits that were causing browsers to crash and “scary visual effects” have been removed. </div><div><br /></div><div>Furthermore, because the link to the malicious payload was easily identified by security software, BlackHole 2.0 comes with a feature that allows the customer to choose the link. The creators of the exploit kit claim that this way none of the commercial antivirus solutions is able to detect it.</div><div><br /></div><div>Dynamic URLs are utilized everywhere, permanent variable names – which were easily detectable - not being used anymore.</div><div><br /></div><div>A number of 16 improvements have also been made to the BlackHole’s administrator panel: it’s faster, statistics are easier to view, and mobile phones and Windows 8 have been added to allow customers to see precisely what types of devices are infected.</div><div><br /></div><div>Finally, a number of “private tricks” have been implemented, which the author prefers to keep a secret because he fears that competitors and antivirus companies are “sneaking around.”</div><div><br /></div><div>As far as the pricing goes, the developers are renting it to anyone for the amount of $500 (400 EUR) per month on their own servers. If the customer has his own server, the license is much cheaper: $700 (560 EUR) for three months, $1,000 (800 EUR) for six months, and $1,500 (1,200 EUR) for a whole year.</div><div><br /></div><div>The cybercriminals even offer support on weekdays between 9AM and 7PM.</div></div><div><br /></div><div>Source: <a href="http://news.softpedia.com/news/BlackHole-Exploit-Kit-2-0-Made-Available-Price-Remains-Same-291881.shtml">Click To View Source</a></div></div>

BlackHole Exploit Kit 2.0 Made Available, Price Remains the Same

BlackHole Exploit Kit 2.0 Made Available, Price Remains the Same The infamous BlackHole exploit kit has been upgraded to the 2.0 version. I...

Read more »

Avira, Mcdonalds, Hyundai And Microsoft Sites Hacked by Hmei7

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on">World 3rd most Dangerous hacker of the World in now a day "<span style="color: red;">Hmei7</span>" <span style="color: grey; font-family: Courier New; font-size: small;">indonesian<b> </b></span>hacker Hacked official sites of Avira, Mcdonalds, Hyundai And Microsoft. This kind of attack show the level of knowledge of those Black hats who remain under cover but still they are lot more power full the world Security Experts.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiz-GvDkAB4H3juS_c6UiHtw2UNOeWSOUVXR9m0O3H8a1B1a3hYY-k6y1cUbrN_lMZ0rfm-mToRsHuZWxXJYCe2S8gP2ZOOYH_3ciaVj4bmPSZ93l3qzcYit60AIaGgH4Rs793QSS2tDF88/s1600/microsoft+hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="157" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiz-GvDkAB4H3juS_c6UiHtw2UNOeWSOUVXR9m0O3H8a1B1a3hYY-k6y1cUbrN_lMZ0rfm-mToRsHuZWxXJYCe2S8gP2ZOOYH_3ciaVj4bmPSZ93l3qzcYit60AIaGgH4Rs793QSS2tDF88/s320/microsoft+hacked.png" width="320" /></a></div><br /><b>- Avira</b><br /><a href="http://avira.si/">http://avira.si/</a><br /><a href="http://www.zone-h.org/mirror/id/18292028">http://www.zone-h.org/mirror/id/18292028</a><br /><br /><b> - Mcdonalds</b><br /><a href="http://mcdonalds.md/">http://mcdonalds.md/</a><br /><a href="http://www.zone-h.org/mirror/id/18277764">http://www.zone-h.org/mirror/id/18277764</a><br /><br /><b>- Hyundai</b><br /><a href="http://hyundai.ps/interior.php">http://hyundai.ps/interior.php</a><br /><a href="http://www.zone-h.org/mirror/id/18286094">http://www.zone-h.org/mirror/id/18286094</a><br /><br /><b>- Microsoft</b><br /><a href="http://microsoft.com.mk/biznispaketi/x.htm">http://microsoft.com.mk/biznispaketi/x.htm</a><br /><a href="http://www.zone-h.org/mirror/id/18285958">http://www.zone-h.org/mirror/id/18285958</a><br /><br /></div><a class="twitter-follow-button" data-show-count="false" href="https://twitter.com/thehackersmedia">Follow @thehackersmedia</a><script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script></div>

Avira, Mcdonalds, Hyundai And Microsoft Sites Hacked by Hmei7

World 3rd most Dangerous hacker of the World in now a day " Hmei7 "  indonesian   hacker Hacked official sites of Avira, Mcdonalds...

Read more »

Domino's Pizza says website hacked

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 style="background-color: white; border: 0px; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 26px; font-weight: normal; line-height: 30px; margin: 0px 0px 7px; outline: 0px; padding: 0px;">Domino's Pizza says website hacked</h1><div><h2 style="background-color: white; border: 0px; color: #666666; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 16px; font-weight: normal; line-height: 20px; margin: 0px 0px 10px; outline: 0px; padding: 0px;">Indian Domino's franchisee says that customer information was not leaked</h2></div><div><img height="400" src="http://news.hitb.org/sites/default/files/styles/article_large/public/field/image/500px-Dominos_pizza_logo.svg_.png" width="400" /> </div><div><br /></div><div><div>IDG News Service - The website of Domino's Pizza India was hacked, but customers' information was not compromised, the local franchisee Jubilant FoodWorks said on Wednesday.</div><div><br /></div><div>Personal information including names, phone numbers, email addresses, passwords and city details from 37,000 accounts was leaked from Domino's website to some blogs and websites by by a little-known Turkish hacker group, according to various reports earlier this week. It isn't clear why the group had targeted Domino's website.</div><div><br /></div><div>The hack reflects India's continuing problems with online security. In July, 2021 Indian websites were defaced, according to the government's Indian Computer Emergency Response Team (CERT-In). An earlier government estimate stated that a total of 112 government websites in India were hacked from December to February.</div><div><br /></div><div>Confirming that there was a security breach, Jubilant FoodWorks said it was limited to the "Wow Club" page on the brand website, and the hackers were able to steal some data which was non-commercial in nature. "They had posted the data on few blog sites which we have got blocked now," it added.</div><div><br /></div><div>The Wow Club gives members access to deals and offers at Domino's. Jubilant, which runs the website as Domino's franchisee for India, Nepal, Sri Lanka and Bangladesh, has said in its privacy statement that it requests personal information under certain circumstances, including when members want to order online or register with the Wow Club.</div><div><br /></div><div>Jubilant said its online pizza ordering site is fully secure, and there had not been any data leakage there. "This is a very unfortunate event which has happened despite the security ecosystem that we have created around our online assets," it said in a statement. The company said it had improved its security, monitoring and audits to avoid any such incident in future.</div><div><br /></div><div>Indian government websites have been frequently hacked, usually by groups that claim to be based in Pakistan. India and Pakistan have a longstanding border dispute. More recently a fledgling branch of Anonymous in the country has attacked Indian government and politicians' websites in protest against alleged Internet censorship in the country, by both hacking and denial-of-service attacks.</div><div><br /></div><div>Private companies have also been hacked, including Microsoft India's online store. The site was attacked in February by Chinese hackers who said they wanted the company's attention, but Microsoft later cautioned that the hackers may have also compromised customers' financial information. The website was hosted by a third-party service provider.</div></div></div>

Domino's Pizza says website hacked

Domino's Pizza says website hacked Indian Domino's franchisee says that customer information was not leaked IDG News Service - The ...

Read more »

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates</h1><div><br /><img alt="Microsoft releases two security bulletins for September 2012" src="http://i1-news.softpedia-static.com/images/news2/XSS-Vulnerabilities-Addressed-by-Microsoft-s-September-2012-Updates-2.png?1347441537" /> <br /><br /></div><div><div>Microsoft has issued two security bulletins as part of its September 2012 Patch Tuesday release. One noteworthy fact is that the company hasn’t made available so few bulletins since May 2011.</div><div><br /></div><div>The first bulletin – rated as Important - addresses a cross-site scripting (XSS) security hole present in Visual Studio Team Foundation Server.</div><div><br /></div><div><br /></div><div> Another Important XSS flaw has been identified in Microsoft System Center Configuration Manager, affecting Microsoft Systems Management Server 2003 Service Pack 3 and Microsoft System Center Configuration Manager 2007 Service Pack 2.</div><div><br /></div><div>Trend Micro researchers highlight the fact that such vulnerabilities have been utilized successfully on numerous occasions, several such attacks being recorded in 2011.</div><div><br /></div><div>As always, Microsoft customers are advised to apply the updates as soon as possible to ensure that they’re systems are protected. Fortunately for users, the bulletins don’t require that they restart their computers. </div><div><br /></div><div>Attacks that leverage these vulnerabilities haven’t been recorded so far, but that doesn’t mean they will not be launched in the future, which is why its highly recommended that the updates are applied.</div><div><br /></div><div>The Redmond company also took this opportunity to remind everyone of the fact that the October updates would come with a major security improvement. The use of RSA keys with a length less than 1024 bits will be restricted.</div><div><br /></div><div>“For those who find they are using certificates with RSA key lengths of less than 1024 bits, those certificates will be required to be reissued with at least a 1024-bit key length. (1024 should, by the way, be considered a minimum length; the most up-to-date security practices recommend 2048 bits or even better),” Angela Gunn of Trustworthy Computing explained.</div><div><br /></div><div>Here’s this month’s video in which Yunsun Wee provides further details regarding the two bulletins and the improvements made with the upcoming update:</div></div><div><br /><br /></div><div></div></div><br /></div>

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates Microsoft has issued two security bulletins as part of its September 20...

Read more »

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches

<div dir="ltr" style="text-align: left;" trbidi="on"><table border="0" cellpadding="0" cellspacing="0" style="color: #9e9e9e; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; text-align: start; width: 725px;"><tbody><tr><td class="contentheadings" valign="top"><h1 id="htitle" style="color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches</h1><div><br /></div><div><img src="http://i1-news.softpedia-static.com/images/news2/August-2012-VIPRE-Report-Scams-Mobile-Malware-and-Privacy-Breaches-2.png?1347439404" /> </div><div style="color: #5e5e5e;"><br /></div><div><div><span style="color: #5e5e5e; font-size: x-small;">GFI Software has released its VIPRE Report for August 2012 and the numbers show that in the past month cybercriminals have been busy launching email scams, malicious mobile applications, and phishing campaigns.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">One of the biggest spam campaigns recorded in August revolved around Nationwide. Several variants of the bogus emails have been spotted, all of them attempting to lure internauts to websites where they were requested to hand over their account details.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;"> Experts also noticed a lot of scam websites that relied on UK's Directgov logo in order to convince Internet users to sign up for all sorts of premium services.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">Last, but certainly not least, mobile malware and shady app markets have left their print on the last month of summer. </span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">And speaking of mobile malware, GFI researchers have analyzed the apps released by the Mitt Romney and Barack Obama presidential campaigns. They have discovered a number of privacy issues that most likely weren’t taken into consideration by most users when they installed the applications.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">For instance, the Romney app not only collects information from the mobile device, but it also asks customers to sign in through their Facebook account. This allows it to post messages on the social media network on their behalf.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“The past month’s examples show that the world of smartphone applications has firmly become a battleground for scammers and malware writers, keen to take advantage of unsuspecting users,” Christopher Boyd, senior threat researcher at GFI Software, explained.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“Avoiding mobile malware often requires the same preventative tactics associated with traditional malware such as verifying the legitimacy of any unsolicited emails or hyperlinks before installing an unknown application or submitting personal information,” Boyd added.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“However, as we saw this month, the increased activity aimed at mobile devices doesn’t mean traditional attacks, such as desktop malware and email scams, have become any less of a threat.”</span></div><div><span style="color: #5e5e5e; font-size: x-small;"> Add me on Google+</span></div></div><div style="color: #5e5e5e;"><br /></div></td></tr></tbody></table></div>

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches GFI Software has released its VIPRE Report for August 2012 and the num...

Read more »

SMS-Sender Trojans Served by Shady Google Play Replica Site

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">SMS-Sender Trojans Served by Shady Google Play Replica Site</h1><div><img alt="Shady Android app market" height="311" src="http://i1-news.softpedia-static.com/images/news-700/SMS-Sender-Trojans-Served-by-Shady-Google-Play-Replica-Site.png?1347437964" width="640" /> </div><div><div>Although the Olympics and the Paralympics have come to an end, researchers say that cybercriminals are still relying on them to spread their malicious elements. A site that attempts to replicate Google Play – iplay-andro7d.net - has been found to serve all sorts of shady apps that hide an SMS Trojan.</div><div><br /></div><div>The applications hosted on the site – Skype, Firefox, Facebook, Instagram and others – hide a nasty Trojan (Trojan.AndroidOS.Generic.A) that sends out SMS messages to premium rate numbers, inflating the bills of unsuspecting Android users, GFI researchers note.</div><div><br /></div><div>Apparently, the malicious app market - proudly displaying the Olympics logo - only serves the Trojan-infested software to internauts who access it from an Android device, a trick successfully utilized in the past.</div><div><br /></div><div>Again, we will take this opportunity to advise users to refrain from downloading applications from untrusted alternative Android markets. Also, beware of Olympics scams as it seems they’re still doing the rounds.</div></div></div>

SMS-Sender Trojans Served by Shady Google Play Replica Site

SMS-Sender Trojans Served by Shady Google Play Replica Site Although the Olympics and the Paralympics have come to an end, researchers say ...

Read more »

Consumer cybercrime cost India $8 billion in last 12 months: Norton

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: Georgia, 'Times New Roman', Times, serif; font-size: 30px;">Consumer cybercrime cost India $8 billion in last 12 months: Norton</span> <br /><span style="font-family: Georgia, 'Times New Roman', Times, serif; font-size: 30px;"><br /></span> <br /><div class="newslist_img" style="color: #4e4e4e; float: left; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 10px; margin-right: 10px; margin-top: 10px;"><img alt="more-hacking.jpg" class="imgbdr" id="HeadContent_FullstoryCtrl_mainstoryimage" src="http://cdn.ndtv.com/tech/images/gadgets/more-hacking.jpg" style="background-color: white; border: 1px solid rgb(225, 225, 225); padding: 4px;" /></div><div style="color: #4e4e4e; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px;"></div><div id="HeadContent_FullstoryCtrl_fulldetails" style="color: #4e4e4e; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px;">Software security services provider Norton today said consumer cybercrime has cost the country a whopping USD 8 billion or around Rs 42,000 crore in the past 12 months, impacting 42 million people.Releasing the findings of its annual cybercrime report, it is estimated that over 42 million people fell victim to cybercrime in the past 12 months in the country, incurring around USD8 billion in direct financial losses. In terms o cost, this is a full 18 percent increase.<br />Against this, the global loss has been pegged at USD110 billion.<br />The study further notes that as many as 66 percent of online adults have been a victim of cybercrime in their lifetime in the country. During the past 12 months, as many as 56 percent of online adults here have experienced cybercrime- that is over 1,15,000 victims per day, 80 victims per minute and over one every second.<br />According to the report, the average direct financial cost per victim is USD192, which is up 18 percent over 2011 when it was USD163.<br />One key finding this year is that both the cost per victim as well as social and mobile incidents are on the rise due to cybercrime.<br />The study is based on the findings of self-reported experiences of over 13,000 adults across 24 countries, Norton by Symantec said in a statement.<br />Globally, every second, 18 adults fall a victim of cybercrime, resulting in over 1.5 million cybercrime victims each day. With losses totaling an average of USD197 per victim across the world in direct financial costs, in the past 12 months, an estimated 556 million experienced cybercrime, represents 46 percent of online adults in the past 12 months, says the report. Last year the percentage was 45 percent.<br />The survey has found an increase in new forms of cybercrime compared to last year, such as those found on social networks or mobile devices, indicating that cybercriminals are starting to focus their efforts on these increasingly popular platforms.<br />One in three online adults (32 percent) has been a victim of either social or mobile cybercrime during the past 12 months, and 51 percent of social network users have been victims of social cybercrime in the country.<br />As many as 22 percent of social network users reported someone have hacked into their profile and pretended to be them, while 15 percent users said they have fallen victim to a scam or fake link on their social network platform.<br />"Cybercriminals are changing their tactics to target fast growing mobile platforms and social networks where consumers are less aware of security risks," says Norton by Symantec Asia director and internet safety advocate Effendy Ibrahim said.</div></div>

Consumer cybercrime cost India $8 billion in last 12 months: Norton

Consumer cybercrime cost India $8 billion in last 12 months: Norton Software security services provider Norton today said consumer cybercr...

Read more »

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h2 style="color: #4c586c; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 32px; font-weight: lighter; margin: 0px;">DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More</h2><div><br /></div><div><img src="http://ctovision.com/wp-content/uploads/DHS.png" /> </div><div><br /></div><div><div style="background-color: white; color: #4c4d4f; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 13px; line-height: 19px; padding: 0px 0px 8px;">Here is today’s federal cybersecurity and information technology news:</div><ul style="background-color: white; color: #4c4d4f; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 13px; line-height: 19px;"><li>As many security experts suspected, the Apple device ID’s that Anonymous claimed came from a Federal Bureau of Investigation agent’s hacked laptop actually came from the hack of an application development company. More <a href="http://www.wired.com/threatlevel/2012/09/udid-leak-traced-to-blue-toad/" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>A new survey finds that although much of federal information technology has not yet moved to the cloud, agencies seem to be gaining confidence in moving more critical systems to the cloud. More <a href="http://www.fiercegovernmentit.com/story/survey-cloud-migration-slow-possibly-more-confident/2012-09-10" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>The Executive Office of the President is seeking a unified system for managing thousands of internship applications. More <a href="http://www.nextgov.com/cio-briefing/2012/09/white-house-seeks-unified-system-manage-interns/57989/?oref=ng-channelriver" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>Secretary of the Department of Homeland Security Janet Napolitano called for guidelines to facilitate public-private cybersecurity information sharing at a recent conference. More <a href="http://searchsecurity.techtarget.com/news/2240162981/Napolitano-calls-for-cybersecurity-intelligence-information-sharing" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>In an attempt to bolster their cybersecurity workforce, the Department of Homeland Security is encouraging qualified hackers to apply even if they don’t have a college degree or don’t intend to stay at the position indefinitely. More <a href="http://blogs.csoonline.com/security-leadership/2355/cso-security-standard-dhs-wants-you-little-while-least" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li></ul></div></div>

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More Here is today’s federal cybersecurity and information technolo...

Read more »

Cosmo the God Hacker

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><img height="227" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw1.jpg" width="400" /> </div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><br /></div><div style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><span style="color: #333333;">Cosmo is huge — 6 foot 7 and 220 pounds the last time he was weighed, at a detention facility in Long Beach, California on June 26. And yet he’s getting bigger, because Cosmo — also known as </span><a href="http://twitter.com/cosmothegod" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Cosmo the God</a><span style="color: #333333;">, the social-engineering mastermind who weaseled his way past </span><nobr style="color: #333333; margin: 0px; padding: 0px;">security systems</nobr><span style="color: #333333;"> at</span><span style="color: red;"> Amazon, Apple, AT&T, PayPal, AOL, Netflix, Network Solutions, and Microsoft — is just 15 years old.</span></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">He turns 16 next March, and he may very well do so inside a prison cell.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was arrested along with dozens of others <a href="http://www.fbi.gov/newyork/press-releases/2012/manhattan-u.s.-attorney-and-fbi-assistant-director-in-charge-announce-24-arrests-in-eight-countries-as-part-of-international-cyber-crime-takedown" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">in a recent multi-state FBI sting</a> targeting credit <nobr style="margin: 0px; padding: 0px;"><a class="FAtxtL" href="http://www.wired.com/gadgetlab/2012/09/cosmo-the-god-who-fell-to-earth/all/#" id="FALINK_3_0_2" style="background-color: transparent !important; border-bottom-color: rgb(28, 125, 255) !important; border-bottom-style: solid !important; border-bottom-width: 1px !important; color: rgb(28, 125, 255) !important; display: inline !important; margin: 0px; outline: none; padding-bottom: 1px !important; padding-left: 0px; padding-right: 0px; padding-top: 0px;">card</a></nobr>fraud. It is the day before his court date, but he doesn’t know which task force is investigating him or the name of his public defender. He doesn’t even know what he’s been charged with. It’s tough to narrow it down; he freely admits to participation in a wide array of crimes.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">With his group, UGNazi (short for “underground nazi” and pronounced “you-gee” not “uhg”), Cosmo took part in some of the most notorious hacks of the year. Throughout the winter and spring, they DDoS’ed all manner of government and financial sites, including NASDAQ, ca.gov, and CIA.gov, which they <a href="http://www.telegraph.co.uk/technology/news/9222447/Hackers-claim-credit-for-CIA-website-going-offline.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">took down for a matter of hours in April</a>. They bypassed Google two step, hijacked 4chan’s DNS and redirected it to their own Twitter feed, and repeatedly <a href="http://www.leakedin.com/2012/04/17/page/2/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">posted Mayor Michael Bloomberg’s address and Social Security number online</a>. After breaking into one billing agency using social-engineering techniques this past May, they proceeded to dump <a href="http://www.forbes.com/sites/andygreenberg/2012/05/22/hackers-impersonate-web-billing-firms-staff-to-spill-500000-users-passwords-and-credit-cards/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">some 500,000 credit card numbers online</a>. Cosmo was the social engineer for the crew, a specialist in talking his way past security barriers. His arsenal of tricks held clever-yet-idiot-proof ways of getting into accounts on Amazon, Apple, AOL, PayPal, Best Buy, Buy.com, Live.com (think: Hotmail, Outlook, Xbox) and more. He can hijack phone numbers from AT&T, Sprint, T-Mobile and your local telco.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“UGNazi was a big deal,” Mikko Hypponen, the chief security researcher at F-Secure, told Wired via email. “The Cloudflare hack was a big deal. They could have done much more with that technique.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">So, yes, he is Cosmo the God. But before he was Cosmo, he was Derek*. And while Cosmo may be a god, Derek is just a kid. A high school dropout. A liar, fraud, vandal and thief. But ultimately a kid, without much adult supervision or guidance.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">I met Cosmo by accident and opportunity, after hackers used social-engineering techniques <a href="http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">to circumvent Apple’s and Amazon’s security mechanisms and break into my accounts</a>. They wrought enormous damage, wiping my computer, phone and tablet, deleting my Google account, and hijacking my Twitter account.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">After it happened I fell into their world and began communicating regularly with the very hacker who jacked me, a kid named <a href="http://www.twitter.com/phobiathegod" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Phobia</a>. He introduced me to Cosmo, who wanted to tell me about all manner of other account vulnerabilities. And last month, I flew down to Long Beach to talk to him face to face.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">*<em style="margin: 0px; padding: 0px;">Editor’s note: Because he is a minor, Wired is not disclosing Cosmo’s real name</em>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div class="wp-caption alignnone" id="attachment_115561" style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px 0px 5px; width: 670px;"><a href="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw3.jpg" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="size-large wp-image-115561" data-lazy-loaded="true" height="440" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw3-660x440.jpg" style="border: none; display: inline; margin: 0px; padding: 0px;" title="hackerbw3" width="660" /></a><br /><div class="wp-caption-text" style="background-color: black; color: #dddddd; font-size: 12px; line-height: 15px; margin-right: 10px; margin-top: -5px; padding: 10px;">The suburban Southern California neighborhood that Cosmo calls home. <em style="margin: 0px; padding: 0px;">Photo: Sandra Garcia/Wired</em></div></div><br style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px;" /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Becoming Cosmo</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo squirms in his chair as we sit in his grandmother’s living room. Her small <nobr style="margin: 0px; padding: 0px;"><a class="FAtxtL" href="http://www.wired.com/gadgetlab/2012/09/cosmo-the-god-who-fell-to-earth/all/#" id="FALINK_1_0_0" style="background-color: transparent !important; border-bottom-color: rgb(28, 125, 255) !important; border-bottom-style: solid !important; border-bottom-width: 1px !important; color: rgb(28, 125, 255) !important; display: inline !important; margin: 0px; outline: none; padding-bottom: 1px !important; padding-left: 0px; padding-right: 0px; padding-top: 0px;">apartment</a></nobr>, with dark brown carpeting, is directly downstairs from his own. The front door is open to let the breeze blow. It’s hot, even sitting next to a fan. There is a picture of Jesus on a table. Cosmo’s family has lived in Long Beach for four generations; in fact, his great grandfather poured the foundation on the very property where we now sit.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo lives upstairs with his mother, who he says typically works six days a week as an insurance claims adjuster. She gets home late in the evening. He doesn’t speak to his father. They live just south of State Route One in Long Beach. When I look up their address on <a href="https://www.crimereports.com/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">CrimeReports</a>, it is right on the border of a zone where crime is extremely frequent and violent. But Derek doesn’t get involved with any of that, says his grandmother.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Derek is always, always home. He don’t go anywhere,” says his grandmother. “He’s a good kid. He’s a very good kid.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">That may be, but it turns out this wasn’t his first tangle with the law. He describes previous run-ins as he sits cramped, legs and head akimbo, in the passenger seat of my rental car, while we drive around looking for a quiet place to talk. The year before, he’d been arrested after getting caught smoking pot in a bathroom at school. I ask if that was the only other time. He says it was. Then he pauses.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Oh! And I also got, I guess you could say arrested, in October 2011. <a href="http://belmontshore.patch.com/articles/wilson-high-bomb-scare-evacuates-most-of-4300-students" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Someone called in a bomb threat to my school</a>. They did it every day of the school week, and on the fifth day they said my name. The fifth day they called in and said I had a gun. It was other hackers.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo’s name and address — his documents, or “dox” as hackers know them — have long been published online. And it’s meant he’s been a target for both vengeance and lulz — just, you know, because he’s Cosmo the God and one of the more notorious social engineers around.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Someone also swatted my house,” he tells me, smiling. “It happens a lot to me. Well, the SWAT team was only once at my house, but lots of time with the local police department.” Swatting is a vicious prank where a hacker uses an internet call system to report a hostage situation, which scrambles local law enforcement to the victim’s doorstep.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Through AOL, you can use <a href="http://relayservices.att.com/content/2/im_relay_3.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">AT&T Relay</a> to call the SWAT. It’s for handicapped people. You have to sign up, but it’s easy to sign up. You just instant message the username AT&T Relay and then 911. They ask what’s your location, the emergency. That’s what they did to me. That’s what they did to my school too, because there’s less ways of getting caught.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo shrugs at this, like it’s all perfectly normal stuff for a teenage boy. And the thing is, in 2012, it is perfectly normal for a bored teenage boy on the edge of delinquency. Instead of egging cars and swinging bats at mailboxes, he’s breaking into e-mail accounts.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo got into hacking via online gaming. He grew up on Xbox, and played others online competitively. One day, he was knocked offline mid-match, forfeiting the game. He discovered that this was done via a simple trick, where one gamer turns a script on his opponent’s IP address. He began using this same tactic himself. It was easy and required nothing more than off-the-shelf programs, like <a href="http://www.youtube.com/watch?v=e19D9E3e0b0" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Cain and Able</a>. It was a veil lifted.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Xbox gamers know each other by their gamertags. And among young gamers it’s a lot cooler to have a simple gamertag like “Fred” than, say, “Fred1988Ohio.” Before Microsoft beefed up its security, getting a password-reset form on Windows Live (and thus hijacking a gamer tag) required only the name on the account and the last four digits and expiration date of the credit card on file. Derek discovered that the person who owned the “Cosmo” gamer tag also had a Netflix account. And that’s how he became Cosmo.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I called Netflix and it was so easy,” he chuckles. “They said, ‘What’s your name?’ and I said, ‘Todd [Redacted],’ gave them his e-mail, and they said, ‘Alright your password is 12345,’ and I was signed in. I saw the last four digits of his credit card. That’s when I filled out the Windows Live password-reset form, which just required the first name and last name of the credit card holder, the last four digits, and the expiration date.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This method still works. When Wired called Netflix, all we had to provide was the name and e-mail address on the account, and we were given the same password reset.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo says he did not know with certainty Netflix had the information he wanted prior to the call. But his success was an ah-ha moment.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I figured that if Netflix could score, so could any big provider. Back then, Amazon was easier. And then it got a little bit more security. They made it where you needed the last four of the credit card to reset [a password]. That’s when I figured out you just have to go to fakenamegenerator.com to get a credit card number. So, I would just add the card, hang up, call back, give them the last four and they’d reset it.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This Amazon method, the same one other hackers used to break into my accounts, was one of Cosmo’s innovations. (Although other hackers also claim to have discovered it independently.) I ask him how he figured out he could pull it off, because it’s as clever as it is devious. He shrugs. “It just came to me.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div class="wp-caption alignnone" id="attachment_115668" style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px 0px 5px; width: 670px;"><a href="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw4.jpg" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="size-large wp-image-115668" data-lazy-loaded="true" height="440" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw4-660x440.jpg" style="border: none; display: inline; margin: 0px; padding: 0px;" title="hackerbw4" width="660" /></a><br /><div class="wp-caption-text" style="background-color: black; color: #dddddd; font-size: 12px; line-height: 15px; margin-right: 10px; margin-top: -5px; padding: 10px;"><em style="margin: 0px; padding: 0px;">Photo: Sandra Garcia/Wired</em></div></div><br style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px;" /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Enter UGNazi</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was soon finding all manner of sources for getting information: Hulu, Buy.com, BestBuy, PayPal, Apple and AOL all offered avenues into others’ accounts, where he could peep in at credit card numbers, addresses and emails.  He learned new social-engineering techniques online and likewise passed along what he knew to others. There is a constant information trade back and forth online. IRC and AIM are the user manuals to every back-end customer service system in corporate America.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Meanwhile, he had more time than ever to devote to his particular brand of hacking, also known as socialing. After the bomb threats, he was asked to leave Woodrow Wilson High School in October. He started taking classes at an adult continuing education program where he could complete his degree. But he found it boring. And he had to walk there and back, three miles each way. So in December, he quit.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This meant he was now home all the time, bored. The next month, an online friend of his approached him about joining a new hacking team. The friend was Josh the God, and he was putting together a hacktivist group called UGNazi, with the intention of using their combined skills to protest SOPA and CISPA. Far from being intimidated by the proposed anti-piracy legislation, they were motivated by it. They wanted to attack it and those who supported it. Cosmo’s job was to socially engineer companies that could provide data about their targets.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">One of their initial targets was UFC.com–the website of the Ultimate Fighting Championship–in retaliation for its support of SOPA. (They did the same to Coach.com.) Once Cosmo gathered the necessary background information on UFC’s president, Dana White, they were able to get into the company’s account with Network Solutions. Via Network Solutions, they redirected the DNS to one they controlled. Bang.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">SOPA, of course, died. But UGNazi lived on. They took down the websites for the states of California and Washington and the cities of New York and Washington D.C. They took out Papa John’s website after it<a href="https://twitter.com/UG/status/204715194801328129" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">failed to deliver a pizza in a timely manner</a>. They hacked into MyBB.com, the back-end that many websites use to power forums, and then hijacked its domain. They were pure mayhem.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“UGNazi was also remarkable in how they apparently had no limits on who to attack–the U.S. government, CIA, Wounded Warrior etc.” says Hypponen, “and no apparent [sense of] self preservation, which led to their demise. In this regard, UG and Lulzsec were similar.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The group’s <a href="http://www.net-security.org/secworld.php?id=13032" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">last big takedown was 4Chan</a>. “Josh thought everyone on 4chan was a child molester,” Cosmo explained. But there was more than likely another motivation as well: Lulz. Not to mention huge traffic. If they could redirect 4chan to their own Twitter feed, even for a minute, they would achieve instant notoriety.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Their avenue to jack 4chan was a web services company called CloudFlare that was providing 4chan’s DNS services. (Ironically, UGNazi.com was also a CloudFlare customer.)</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The original idea was to take CloudFlare via Network Solutions, something UGNazi done many times before with other companies. They had gotten CloudFlare CEO Matthew Prince’s dox and had all the information they typically needed to hijack a NetSol account. But they hit a snag: Prince had a two-step security mechanism on his account. They needed a device-specific PIN code that they couldn’t get. But they had been able to ascertain that Prince’s phone number was on AT&T, which meant they had another avenue of attack: his Google email, <a href="http://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">which used that AT&T number as an account recovery option</a>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Security is only as strong as its weakest link. And in this case, the weak link was AT&T. If UG Nazi could get to Prince’s phone, which was his backup mechanism, they could get to his Google account. And to get to his phone, they just needed his Social Security number. That sounds like it’s a tough thing to get. It’s not.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Social Security numbers are freely bought and sold online, not on hidden Tor sites or via some dark back alley, but on the open Web in broad daylight. The cost to buy a Social Security number and date of birth on one Russian site Cosmo referred us to, for example, is $3.80, payable via an alternative currency favored by carders called <a href="http://www.libertyreserve.com/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Liberty Reserve</a>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Once they had Prince’s Social Security number, it was time to manipulate AT&T’s customer service.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“First we called AT&T to forward [Prince’s] cell phone number to Google Voice. We did that, and the lady said ‘alright what’s your name?’ And Josh said ‘Matthew Prince.’ And the lady said, ‘what’s the last four digits of your SSN?’ And Josh gave the full SSN anyway. And she was like ‘alright what’s the phone number you want to forward it to?’</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“He gave her the Google Voice number, and it was forwarded.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo initially said UGNazi used text message forwarding, which both Google and Prince say is not the case. Furthermore, while Wired was able to set up a forwarding number in the manner Cosmo described, we were not able to forward text messages to Google Voice from AT&T. Voice yes, text no. It’s the one glaring inconsistency in everything Cosmo reported. When I asked him about it again, via AIM, he replied “maybe it’s just voice for them then.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As Prince described the attack to Wired, his personal Gmail address was the backup address for his corporate Google Apps email. Although he had two step on the corporate account, he did not have it on the personal one. Furthermore, his phone number was the account-recovery option on that personal address. So UGNazi sent an account recovery request to his phone, which was forwarded to their number, and then used it to take over his personal Gmail.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Once they were in that, they used it to get into my corporate email by doing an account recovery, which was sent to my personal email,” says Prince. “Even though I had two-factor authentication on, for this one account-recovery procedure, Google didn’t verify any out-of-band system. They just sent the email to my personal Gmail and then, once they were in that, they were able to get into my personal email.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Google says this type of attack is no longer possible. A Google spokesperson gave Wired a statement noting “We fixed a flaw that existed in the account recovery process for Google Apps for Business customers under very specific conditions. If an administrator account that was configured to send password reset instructions to a registered secondary email address was successfully recovered, 2-step verification would have been disabled in the process. This could have led to abuse if their secondary email account was compromised through some other means. We swiftly resolved the issue to prevent further abuse.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Ultimately, the end result was that UG Nazi was able to bypass the Google two factor and gain access to Prince’s CloudFlare’s email and then admin tools. They were then able to redirect 4Chan’s DNS to point to their own Twitter account. The hack lasted mere minutes, but given 4chan’s traffic volume, it was enough. It was extremely high profile, and UG Nazi was now basically the most notorious hacking crew of 2012.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">People Are The Key to Every Lock</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As he did with Prince and CloudFlare, Cosmo accomplished many of his feats by going after individuals associated with organizations UG Nazi was targeting. He would gather little bits of information here and there, collecting dox data from various online services, like addresses and credit card numbers, until he had what he needed to launch an attack. Often, he did that by calling a company’s tech support system and pretending to be a worker in another department. Sometimes he was able to pull that off by learning intimate details of a company’s back-end systems.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I had a friend who installed a remote access tool on a Netflix computer. When [the Netflix employee] was AFK–not at the computer–he could use that computer. From there he took a bunch of screenshots, and saw the [support] <a href="http://techblog.netflix.com/2012/06/asgard-web-based-cloud-management-and.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">tool was called Obiwan</a>.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo couldn’t actually use Obiwan himself because he didn’t have a Netflix IP address. But that didn’t matter. He just needed to know what the back end looked like.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You have to impersonate a Netflix agent. So you call up and say ‘Hey, my name is Derek. I’m from Netflix Canada and I’m having a technical difficulty with Obiwan. Can you look something up for me?’ Then you say the email, the name, the billing, and then you ask for the last four. Then you just call back and reset their password.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">And that’s the secret. When Cosmo calls a company pretending to be an employee, he doesn’t wait for them to ask for details. He tells them all the person’s data he has up front. If he knows three pieces of a puzzle and just needs the fourth, he gives them those first without waiting to be asked for them. That way he demonstrates a knowledge of the system, disarming the person on the other end of the line and making them less likely to question his authenticity.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo sometimes even provides details that he knows tech support doesn’t need. For example, if a tech support requires only the zip code on file, he’ll provide the full address anyway. It makes him appear more knowledgeable and less likely to be questioned. That’s classic social engineering.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You can pretty much do it at any company–impersonate an agent,” he shrugs and smiles. “Most people will fall for it unless they’ve been trained not to. But most companies aren’t doing that.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Some of his techniques are incredibly complicated and involve multiple levels of social engineering, like the method he developed for getting into PayPal.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The inside of a PayPal account is a trove of information for social engineers. Once logged in, you can see the last four digits of someone’s credit cards and bank accounts, and their current billing address. That information can, in turn, be used to obtain password resets on all sorts of other sites. More nefariously, once inside someone’s PayPal account, you can flat out rob them.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo explained exactly how it is done.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You have to add a bank account. You can make a virtual bank account on eTrade.com with info from FakeNameGenerator.com.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired verified that it’s possible to create online bank accounts with automatically generated information–although we were also required to enter a driver’s license number, which we got via a second site, using the information from FakeNameGenerator.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You call PayPal, and you have to have the last four of a payment method. You can get that from Amazon or you can impersonate a PayPal agent. They access your account from the last four. You tell them you want to add a phone number, and you add a Google Voice number. And then you say, I also want to add a new bank account I just got. And they add that for you.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Then you hang up, go to PayPal.com, and go to Reset My PayPal Account. It says send to a phone number and shows the last digits. You pick your Google Voice number, and then it [calls] your phone. You enter that, and you go to a new page of verification that says please enter your full bank account with routing number. You just add the bank account number you made with E-Trade. And once you click next, it prompts you to create a new password.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired was able to replicate this method and receive PayPal password resets. After we disclosed the issue to PayPal, the company closed this security hole. PayPal’s director of communications, Anuj Nayar, told Wired this was a temporary issue caused by product testing that was accidentally left open and had now been closed.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired’s subsequent tests found this to be the case, although we could still add a phone number to an account, PayPal would no longer send a password reset to it until it had been verified by logging in.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Busted</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was still sleeping when the police arrived at his apartment. Officers and a detective with the Long Beach Police Department searched his home and seized three of his netbooks and his iPod Touch. They put him in handcuffs and refused to let him change clothes out of the shorts and t-shirt he’d been sleeping in the night before. Then they took him to the Los Padrinos Juvenile Hall, where he spent the next two days.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">They raided his grandmother’s home, too.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I was in the bathroom and I heard some guys talking,” she says. “When I opened up the bathroom door there was this cop standing right at the door. He stood right inside this door and it startled me. He took me by my arm and told me to come in and sit down. I sat down and the three cops were standing over there and they just stood there. I was startled and some cops walked by with Derek, and he was handcuffed.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo suspects the raid was tied to UGNazi’s participation in the <a href="http://www.forbes.com/sites/andygreenberg/2012/05/22/hackers-impersonate-web-billing-firms-staff-to-spill-500000-users-passwords-and-credit-cards/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">WHMCS credit card dump</a>, when they dropped a half million credit card numbers on the open Web, and not the CloudFlare hack that ultimately landed UGNazi on the FBI’s hit list. Still, he expressed remorse for what had gone down with Prince and for people who were still having accounts compromised via methods he pioneered.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I called Matthew Prince the night before [the hack],” Cosmo told me. “I was going to tell him about it. I called through AT&T relay and he hung up on me. I was just going to let him know, ‘Your site’s about to get hacked.’ Josh was going to do it anyway, but…”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Did Cosmo really try to warn Prince? Prince confirms that he did get several calls via an AT&T relay the night before. And while a warning may seem far fetched, it would not be completely out of character.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><a href="http://www.wired.com/gadgetlab/?attachment_id=114934" rel="attachment wp-att-114934" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="alignleft size-medium wp-image-114934" data-lazy-loaded="true" height="300" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/Screen-Shot-2012-09-04-at-3.52.38-PM-119x300.png" style="border: none; display: block; float: left; margin: 0px; padding: 5px 20px 5px 0px;" title="Cosmo and Mikko" width="119" /></a>For example, I was hacked long after Cosmo was arrested and had lost his ability to do any more damage. Yet he managed to learn about how it was done and attempted to relay that information to me via Mikko Hypponen, whom we both follow on Twitter. It was too late, but, still, he made the effort.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">And then there’s the question of why he’s speaking to me at all. Why he’s essentially incriminating himself before he goes to trial. He ultimately reached me via Phobia, the guy who hacked me. Phobia said Cosmo wanted to tell me about a specific AOL account hack that they wanted closed. From my first interaction with Cosmo, weeks ago, through today, he has maintained this was his motivation for talking.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The method Cosmo described for taking an AOL account away from its owner is distressingly simple. Worse, multiple hackers described the AOL exploit as ancient and well known. In short, it takes nothing more than someone’s name and address to take over their AOL email.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">To get a password reset on a free AOL email or chat account, all one needs to give the over-the-phone tech-support worker is the first and last name and zip code on the account. For a paid account, AOL asks for either the address or the last four digits of the credit card on file.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo tells me this casually, while drinking water from a plastic bottle. I stare at him.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Yeah…. that’s all you need to do.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired was able to confirm this and received password resets on both paid and free accounts, despite being being unable to answer account security questions. In some cases, we even deliberately provided incorrect answers. After we informed AOL, it quickly halted issuing password resets over the phone.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“We looked into the matter and found that there was, in fact, a gap in our phone support processes,” AOL’s Senior Vice President for Mail and Mobile David Tempkin informed Wired via email. “We addressed the problem immediately, and as of today, AOL users are better protected — it’s no longer possible to hack into an account via a phone-based password reset.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As a direct result of Cosmo coming forward, PayPal and Aol changed their account security procedures. For me, this only adds to his enigma.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">I wonder how much of everything else Cosmo has told me is true. The only thing I am certain of is that online security is an illusion. But I think he is being honest now. I think he’s genuinely remorseful and just wants all these gaping account holes, many of which he found or helped publicize, closed at last before anyone else has their identity stolen, or the SWAT team sent to their door. That’s what I believe, at least.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">But then, he’s a very, very good liar.</div></div><a class="twitter-follow-button" data-show-count="false" href="https://twitter.com/thehackersmedia">Follow @thehackersmedia</a><script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script></div>

Cosmo the God Hacker

Cosmo is huge — 6 foot 7 and 220 pounds the last time he was weighed, at a detention facility in Long Beach, California on June 26. And yet...

Read more »