Archive for April 30, 2014

Popular Image Board 4chan hacked, moderator accounts targeted

The Popular Image Board 4chan has admitted to having suffered a security breach that allowed an intruder to access administrative functions and information from a 4chan database.

The breach which is said to have taken place last week was limited to moderation panels, their reports queue, and some tables in their backend database.

4Chan says the primary target of this security breach is their moderator account names and login credentials.  Hackers also managed to access pass credentials of three 4Chan pass users.

4Chan said it doesn't process any payment information, all of them are being processed by Stripe. So, there is no financial data involved in this breach.

The vulnerability responsible for the data breach has reportedly been patched, after 4chan became aware of it.

Update your Adobe flash player to stay safe


Few days after Microsoft published a security advisory about a new critical security bug in IE that is being used in limited and targeted attacks, Adobe has issued an emergency security update to fix a critical vulnerability(CVE-2014-0515) in flash player.

Please note that it is completely unrelated to IE Exploit in which bug was in IE and the flash file(.swf) used for making the attack successful.  But, in this case, the bug exists in the flash player plugin. 

So, people who use vulnerable version of Adobe Flash player likely to be vulnerable to this attack.

If you are using windows or Mac, make sure you have the latest flash player version 13.0.0.206.  If you are using Linux, make sure to update to the latest version 11.2.202.356.

This new zero-day flash exploit was spotted as being used in Watering-hole attacks by researchers at Kaspersky Labs in early April.

According to SecureList, this flash exploit spread from a Syrian Justice Ministry website(jpic.gov.sy).  Researchers believe the attack was designed to compromise the computers of Syrian dissidents complaining about the government.

AOL security breach affects a significant number of users


Over the past few days, a large number of AOL users reported of being victim to Email Spoofing attacks -- Recipients received emails purportedly from their friend's email ID containing links to spam web pages. 

Today, AOL said it had launched an investigation into the security breach that allowed hackers to access its users' data including email IDs and encrypted passwords.

The company said it is working with cyber forensics experts and federal authorities to investigate the security breach.

AOL have determined that the following information have been accessed by intruders : Email IDs, postal addresses, address book contact info, encrypted passwords and encrypted answers to security questions and certain employee info.

AOL said it has no information indicating that the encryption on passwords or answers to security questions was broken.  Also they believe this breach doesn't involve any financial data.

AOL suggest users to change their password as well as security questions.

New Zero-day vulnerability affects all IE Versions from 6 to 11

A new Zero-day vulnerability in the Internet Explorer impacts all IE Versions from 6 to 11 and is being exploited in limited and targeted attacks. The worst part is there is no patch.

The zero-day exploit have been Dubbed as "Operation Clandestine Fox" by FireEye, is currently targeting only users of Internet explorer 9 through IE11.

To get infected by malware, user don't need to open a suspicious email attachments.  A simple visit to malicious webpage loaded with this IE exploit code will deliver the malware into your system.

According to FireEye report, the exploit page loads a malicious flash file(.swf) that calls javascript in IE to trigger the IE vulnerability.  The reason why attackers used the flash file is to make the attack successful bypassing the ASLR and DEP Protections.

What do you can do to protect yourself?
Microsoft didn't mention when it is going to release the patch. But, it has issued few workarounds for IE users.

One of them is to use the Enhanced Mitigation Experience Toolkit(EMET), a free software from Microsoft that will help in mitigating the exploitation of vulnerabilities by adding additional protection layers.

Micorosof also suggested few other workarounds such as disabling IE extension VGX.dll by entering the following command in cmd:
"%SystemRoot%\System32\regsvr32.exe" -u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll" 

E-Bytes for this week

Google Refunds buyers scammed by fake android antivirus app:
Google has offered Refunds and $5 promotional credit to thousands of users who were scammed by fake Android app "Virus Shield".

Facebook Servers can be used by attackers to DDOS any websites:
Researcher found a bug in facebook Notes that allows anyone to launch Denial of service attack against any websites using the power of Facebook Servers. 

BJP blocks access to its website in Pakistan:
Hackers from Pakistan defaced the several websites related to Bharatiya Janata Party(BJP) including website of Senior BJP Leader LK Advani.  Following the repeated hacking attacks, BJP has blocked its website for visitors from Pakistan.

Bitcoin Malware in Google Play store:
LookOut spotted five android applications on Google Play Store that turns the infected android devices into a distributed Bitcoin mining rig. 

Nullcrew claimed to have breached servers of nine organizations including Teleco Systems, Klas Telecom, Science and Technology center, National credit union, Spokeo and leaked databases.