Mozilla Firefox4.0.1 First Security Update

Mozilla Released it's first release of Mozilla Firefox Firefox 4.0.1 which is a open source browser.

Fourteen flaws have been found in Firefox 4.0.1 from which 13 flaws are categorized as critical Vulnerabilities and one is mentioned low impact Vulnerability.

The biggest category of fixed vulnerabilities in Firefox 4.0.1 are memory safety related issues, with 10 identified flaws.

"Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products," Mozilla warned in its advisory. "Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code." 

You can check their warning here - Here

The high impact category of flaws is in WebGL and its related WebGLES graphics library. Mozilla is providing three fixes for WebGLES flaws in the Firefox 4.0.1 update.

 As opposed to the critical memory flaws that Mozilla is patching with the Firefox 4.0.1 release, the XSLT flaw will not lead to arbitrary code execution. According to Mozilla, the XSLT flaw could have been used by an attacker to help launch some form of memory corruption that could possibly make another attack more reliable.  

The Firefox 4.0.1 release is the first update to Mozilla's browser since Firefox 4 release in March. Firefox developers are currently on Firefox 5, which may release at JUNE last

Hacker Used SQL-injection to Get 675K Credit Card

A computer hacker from Georgia has pleaded guilty to fraud and identity theft after authorities found him with more than 675,000 stolen credit card accounts on his home computers, Credit card companies have traced more than $36 million in fraudulent transactions to the accounts that were breached by Rogelio Hackett.

How he did it? Hacker briefly used the SQL-injection attack on web resources he was able to use different SQL vulnerabilities despite that this kind of vulnerability is well known. SQL injection is one of the popular attacks on web application’s backend database it is not like XSS vulnerability where attacker uses JavaScript to target the client browser, SQL injection targets the SQL statement being executed by the application on the backend database.

Hackers usually identify the SQL injection vulnerability by adding invalid or unexpected characters to a parameter value and watch for errors in application’s response. For example:

http://www.example.com/users.asp?id=mark’

If the request generates an error, it is a good indication of a mishandled quotation mark and the application may be vulnerable to SQL injection attacks. While I think that automated tools can do fast job in checking these vulnerabilities such as Havij a very fast tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

Attack with SQL-code uses poorly written Web-based applications that directly write data into the database. In fact, SQL-injection does not depend on application language as mistakes in programming allow SQL-injection use almost any programming language.

That’s why it is very important to conduct Application black-box penetration testing as this can reveal OWASP Top 10 application vulnerabilities, including SQL injection, parameter manipulation, cookie poisoning, and XSS.

An attacker who wishes to grab usernames and passwords might try phishing and social engineering attacks against some user’s application. On the other hand, Hackers can try to pull everyone’s credentials directly from the database.

Data Breach Investigations Report for 2011

Latest data breach reports for 2011 with comparisons is out with some shocking statistics.
361 million >> 144 million >> 4 million. Thus goes the tally of total records compromised across the combined caseload of Verizon and the United States Secret Service (USSS) over the last three years. After four years of increasing losses culminating in 2008’s record-setting 361 million, we speculated whether 2009’s drop to 144 million was a fluke or a sign of things to come. 2010’s total of less than four million compromised records seems to suggest it was a sign.But of what? And is it a permanent change in direction or a temporary detour?To help us answer that, we are very glad to have the United States Secret Service (USSS) back with us for the 2011 DBIR.

Additionally, we have the pleasure of welcoming the Dutch National High Tech Crime Unit (NHTCU) to the team. Through this cooperative effort, we had the privilege—and challenge—of examining about 800 new data compromise incidents since our last report (with 761 of those for 2010). To put that in perspective, the entire Verizon-USSS dataset from 2004 to 2009 numbered just over 900 breaches. We very nearly doubled the size of our dataset in 2010 alone!

Download pdf report here

European Space Agency (ESA.INT) Hacked – Full Disclosure

( European Space Agency )

The European Space Agency (ESA), established in 1975, is an intergovernmental organisation dedicated to the exploration of space, currently with 18 member states. Headquartered in Paris, ESA has a staff of more than 2,000 with an annual budget of about €3.99 billion / $5.65 billion US dollars (2011).
ESA’s space flight program includes human spaceflight, mainly through the participation in the International Space Station program, the launch and operations of unmanned exploration missions to other planets and the Moon, Earth observation, science, telecommunication as well as maintaining a major spaceport, the Guiana Space Centre at Kourou, French Guiana, and designing launch vehicles. The main European launch vehicle Ariane 5 is operated through Arianespace with ESA sharing in the costs of launching and further developing this launch vehicle.
More here.

******************************************************************
(+) Authors : TinKode
(+) WebSite : TinKode27.BayWords.Com
(+) Date    : 17.04.2011
(+) Hour    : 17:17 PM
(+) Targets : www.esa.int (European Space Agency)
(+) Document: ESA.int Full Disclosure (Hacked)
(+) Method  : UnKn0Wn
******************************************************************

Text Files:

• Main informations about server.  Click here.
• Main accounts from ESA.INT (Root Accounts,  Emails, FTPs,  Admins,  Editors,  etc). Click here.

Emails:

Preview of Root accounts,  Emails,  FTPs,  etc:

[Root Account]
---------------------------------------------------------------------
Username = root
Password = *8009BCFDDF013C178B831737138F2A3D8E652B8E (SHA1)

[DB Accounts]
---------------------------------------------------------------------
Username = jbossuser
Password = 49c6641168b072d0

Username = psocrat
Password = 49c6641168b072d0 

Username = root
Password = 49c6641168b072d0 

Username = jbossuser
Password = 7fe05ad56133d52b 

Username = psocrat
Password = 7fe05ad56133d52b 

[Administrator Account]
---------------------------------------------------------------------
username = rnay06
password = eduxxxr3
admin    = y

[Editor account]
---------------------------------------------------------------------
Username = editor
Password = editor2005

[FTP Accounts]
---------------------------------------------------------------------
Password : service2004
Username : nrtservice
Webserver: localhost
Protocol : scp

Username : riverusr
Password : usrriver
WebServer: styx.esrin.esa.it
Protocol : ftp

Username : mapinject
Password : .mapinject
Webserver: ssems1.esrin.esa.int
Protocol : sftp

Password : fire
Username : wfaa
WebServer: twin.esrin.esa.int
Protocol : ftp

Password : MMvomir07.
Username : uvomir
Webserver: 193.204.231.156
More     : http://whois.domaintools.com/193.204.231.156
Protocol : sftp

Password : 12qwas
Username : kimv
Webserver: kes.esrin.esa.int
Protocol : ftp

Password : Bk7Wdkf6hY
Username : emathot
Webserver: testlab4.esrin.esa.int
Protocol : ftp

Password : MecoGPOD123
Username : MecoGPOD
Webserver: metheny.esrin.esa.int
Protocol : ftp

Password : brteon
Username : betlem
Webserver: uranus.esrin.esa.it
Protocol : ftp

Password : ch9l
Username : ftpriv
Webserver: uranus.esrin.esa.int
Protocol : ftp

Password : .mapinject
Username : mapinject
Webserver: ssems1.esrin.esa.int
Protocol : sftp

Password : esa2004
Username : Olivier
Webserver: dummy.server.esa.int
Protocol : ftp

Password : .passWIL
Username : wilkinsa
Webserver: esa-mm.esa.int
Protocol : ftp

The ESA Logs:

source:tinkode

Asia runs out of IPv4 addresses

The Asia Pacific Network Information Centre (APNIC) has run out of all but a handful of IPv4 addresses that it is holding in reserve for start-up network operators.

APNIC is the first of the Internet's five regional Internet registries to deplete its free pool of IPv4 address space.
APNIC's news is another sign that CIOs and other IT executives need to begin migrating to IPv6, the long-anticipated upgrade to the Internet's main communications protocol known as IPv4.

"For anybody who hasn't figured out that it's time to do IPv6, this is another wake-up call for them," says Owen DeLong, an IPv6 evangelist at Hurricane Electric and a member of the advisory council of the American Registry for Internet Numbers (ARIN), the North American counterpart to APNIC.
Any CIO who isn't planning for IPv6 is "driving toward a brick wall and closing your eyes and hoping that it's going to disappear before you get there," DeLong says. Ignoring IPv6 "is not the best strategy."
Most IPv4 address space is expected to be handed out by the regional Internet registries by the end of 2011.

IPv4 uses 32-bit addresses and can support 4.3 billion devices connected directly to the Internet. IPv6, on the other hand, uses 128-bit addresses and supports a virtually unlimited number of devices -- 2 to the 128th power.
The Asia Pacific region has been gobbling up the most IPv4 address space in recent years. Geoff Huston, Chief Scientist at APNIC, said APNIC allocated more than 58 million IPv4 addresses in the last two months alone: 41.2 million in March and 16.8 million in April. Among the largest allocations since February 1 were 8.3 million to NTT Communications of Japan, 4.1 million addresses to China Mobile, 4.1 million addresses to KDDI of Japan. and 3.1 million to North Star Information of China. Three other carriers -- India's Bharti Airtel Ltd.,  Pakistan Telecommunications and Chinanet Hunan Province Network -- all received 2 million IPv4 addresses.
APNIC has depleted its IPv4 address space "dramatically faster than people expected," DeLong says. "My guess is that a lot of operators in the Asia Pacific region realized the time of IPv4 depletion was drawing near and they rushed to get their applications in."


APNIC is holding 16.7 million IPv4 addresses -- dubbed a /8 in network engineering terms -- in reserve to distribute in tiny allotments of around 1,000 addresses each to new and emerging IPv6-based networks so they can continue to communicate with the largely IPv4-based Internet infrastructure.
ARIN, which doles out IPv4 and IPv6 address space to companies operating in North America, predicts that it will run out of IPv4 addresses this fall.
"RIPE [the European Internet registry] is going to be the next one to run out. I wouldn't count on them making it until July," DeLong says. "I think ARIN will make it to the end of this year; maybe we'll run out in October or November."

Adobe confirms critical Flash zero-day bug

For the second time in the last four weeks, Adobe has told users that hackers are exploiting an unpatched bug in Flash Player, again by embedding malicious code inside a Microsoft Office document.

In a security advisory issued Monday, Adobe said that attackers are exploiting the vulnerability by embedding Flash attack files within a Microsoft Word document sent as an email attachment.

dobe did not spell out a patch timeline for the newest Flash zero-day.
Four weeks ago, Adobe issued a similar warning about a different flaw that hackers manipulated via attack code tucked inside Excel spreadsheet attachments.
Later, RSA Security confirmed that the March vulnerability had been used by cybercriminals to gain a foothold on its corporate network, then steal information related to the company's SecurID two-factor authentication products.
Adobe patched last month's Flash bug on March 21.
Mila Parkour, the independent security researcher who reported the newest Flash flaw to Adobe, said attackers have inserted a malicious Flash Player file into a Word document named "Disentangling Industrial Policy and Competition Policy," which is then sent to targeted recipients as an attachment.
The email message's subject heading is "Disentangling Industrial Policy and Competition Policy in China," Parkour said in an April 6 entry on her Contagio Malware Dump blog.
One message that Parkour cited claimed the attached Word document was a copy of the American Bar Association's Antitrust Source newsletter, hinting that the target recipients may have been the legal departments at corporations or government agencies.
People seeing the email and attachment could be expected to fall for the ruse, since the most recent issue of Antitrust Source does contain an article by the same name. The legitimate article is available on the newsletter's Web site ( download PDF document).
Parkour has reported numerous vulnerabilities to Adobe, including one last September in the company's popular PDF viewer, Adobe Reader.
The Flash vulnerability also exists in Adobe Reader and Acrobat, both of which include code that renders Flash content inserted into PDF files.
"At this time, Adobe is not aware of any attacks via PDF targeting Adobe Reader and Acrobat," Adobe said in the advisory.



Last month, Microsoft urged Excel users to install and run the Enhanced Mitigation Experience Toolkit (EMET) to block those attacks, and said that Excel 2010 was not susceptible to the exploit because of its "Protected View" sandbox.
While those same recommendations may apply today for Word, Microsoft was not immediately able to confirm that to Computerworld.
Currently, only one anti-virus firm, Commtouch, has issued a signature that tags the rogue Word document as a threat, according to VirusTotal, a free service that analyzes suspicious files.
Flash vulnerabilities are an attractive target to hackers, said Andrew Storms, director of security operations at nCircle Security. When asked if the rash of Flash flaws meant it was time for companies to consider ditching the browser plug-in, Storms answered, "That's going to be incredibly hard due to the pervasiveness of its use in valid business systems."

IPAD 2 JAILBROKEN IN JUST ONE WEEK

Hackers have already managed to break open Apple's latest iPad, with developer and hacker Comex saying he had managed to do so remotely over the weekend. While proof of the jailbreak has shown up in photos and video on the Internet, it will not be made available immediately as it must be packaged for public use.

According to talk on Twitter, versions for both the Wi-Fi and 3G models of the iPad could be released shortly, although no specific date for its release has been given.

While the speed of the jailbreak may be surprising, iOS 4.3 (which the iPad runs on) had also been cracked open quickly: hackers there only needed about 24 hours. In that case developers likely had access to beta versions of the operating system, allowing those working on the crack to test out their work before iOS 4.3's actual release.

Details on the actual jailbreak have not been disclosed, probably to prevent Apple from moving quickly to close the hole. "Would've had it yesterday if I didn't have to spend 1.5 days looking for a replacement exploit (which came from a most unexpected place…)," Comex tweeted Sunday.

He also used a friend's iPad nearly 2,500 miles away and jailbroke it remotely, meaning whatever was done to hack the tablet device may be able to be done akin to what the iPhone Dev Team did with jailbreakme.com last August.

As always, jailbreaking any iOS device comes with risks. There is no guarantee that the hack will work on every device, and updates can sometimes cause the hack to stop working. Additionally, Apple's warranty becomes void if a device is jailbroken.

MHTML EXPLOIT LATEST MICROSOFT BUG :P

Latest microsoft MHTML exploit is in fashion for hackers ;)

Microsoft is investigating new public reports of vulnerability in all supported editions of Microsoft Windows. The vulnerability could allow an attacker to cause a victim to run malicious scripts when visiting various Web sites, resulting in information disclosure. This impact is similar to server-side cross-site scripting (XSS) vulnerabilities.

MHTML, or Mime HTML, is a standard that allows web objects such as images to be combined with HTML into a single file. The vulnerability lies in how MHTML interprets Multipurpose Internet Mail Extensions (Mime) for content blocks in a document.

On a Blog post Friday afternoon Google Security Team members said “We’ve noticed some highly targeted and apparently politically motivated attacks against our users. We believe activists may have been a specific target. We’ve also seen attacks against users of another popular social site.”

Now we are finding that Microsoft and Google are working to create a fix on the server side so it can reduce the risk of MHTML Vulnerability, while you can check your machine to determine if you are vulnerable by using the test scenario previously posted by Microsoft.

As a workaround user can also disable ActiveX, but this would affect web applications including banking and e-commerce sites that use ActiveX to provide online services.

 May be a sad news for normal users but :D you know what i mean to say enjoy the exploit guys its not patched yet :P

PWN2OWN OVERVIEW & RESULTS

The Zero Day Initiative team is having the annual Pwn2Own contest March 9th, 10th, and 11th of 2011 in Vancouver. The contest always seems to be an interesting spectacle – seeing how fast certain systems are compromised, learning how companies respond to the vulnerability disclosures, and seeing patches come out up to the very last minute. The targets this year will be 4 popular web browsers and 4 mobile devices.

Browers

This year the web browser targets will be the latest release candidate (at the time of the contest) of the following products:

• Microsoft Internet Explorer
• Apple Safari
• Mozilla Firefox
• Google Chrome

Each browser will be installed on a 64-bit system running the latest version of either OS X or Windows 7.
A successful hack of IE, Safari, or Firefox will net the competitor a $15,000 USD cash prize, the laptop itself, and 20,000 ZDI reward points which immediately qualifies them for Silver standing. Benefits of ZDI Silver standing include a one-time $5,000 USD cash payment, 15% monetary bonus on all ZDI submissions in 2011, 25% reward point bonus on all ZDI submissions in 2011 and paid travel and registration to attend the DEFCON Conference in Las Vegas.
As for Chrome, the contest will be a two-part one. On day 1, Google will offer $20,000 USD and the CR-48 if a contestant can pop the browser and escape the sandbox using vulnerabilities purely present in Google-written code. If competitors are unsuccessful, on day 2 and 3 the ZDI will offer $10,000 USD for a sandbox escape in non-Google code and Google will offer $10,000 USD for the Chrome bug. Either way, plugins other than the built-in PDF support are out of scope.

Mobile Devices

The following are the target mobile devices for the contest:

• Dell Venue Pro running Windows 7
• iPhone 4 running iOS
• Blackberry Torch 9800 running Blackberry 6 OS
• Nexus S running Android

As mentioned previously, we’ve upped the ante this time around and the total cash pool allotted for prizes has risen to a whopping $125,000 USD. While HP TippingPoint is funding $105,000 of that, we’ve partnered with Google who has generously offered up $20,000 to the researcher who can best their Chrome browser.

Interestingly, an RF enclosure box will be used for the mobile targets as there seems to be the possibility that

The Results of Pwn2Own 2011

 Browsers

“Safari goes down first at #pwn2own”
“Stephen Fewer @stephenfewer just successfully compromised Internet Explorer (complete with a Protected Mode bypass) at Pwn2Own.”
The exploit used to exploit IE8 is not present in IE9, which ships on Monday.
Chrome and Firefox, the other browsers in the contest, went unchallenged.

MOBILE PHONES

the Apple iPhone 4 and RIM’s Blackberry Torch 9800 were both successfully compromised on day 2 of the contest.
Android and Windows Phone 7 based devices survived the challenge.
It was a vulnerability in WebKit that allowed the Blackberry to be compromised. Google has responded by patching the exploit in their WebKit-based Google Chrome.

REPORTS


Ars Technica has good write-ups on Day 1 and Day 2 of Pwn2Own 2011. In those write-ups you’ll find a lot more details of the winners and some of the compromises.

 

Trojan to Disable Cloud-Based Antivirus--BOHU

A recent blog entry from the Microsoft Malware Protection Center details information about a new malware (called Win32/Bohu.A) which is specifically designed to disable and mislead cloud-based antivirus software.
Cloud-based antivirus software differs from traditional antivirus software in that the antivirus client (running on the PC) sends important threat data to a server for backend analysis, and subsequently receives further detection and removal instruction.


The Bohu Trojan originates in China where there is a predominate use of cloud-based antivirus software. Once a Windows based machine is infected the malware installs different network level filters to disrupt and block the antivirus client accessing the backend antivirus services on the Internet.
As well as writing random data at the end of its key payload components to avoid hash-based detection, Bohu also installs a Windows Sockets service provider interface (SPI) filter to block the antivirus network traffic as well as a Network Driver Interface Specification (NDIS) filter. The NDIS filter then stops the antivirus client from uploading data to the server by looking for the server addresses in the data packets.

Facebook unveils security tools after Zuckerberg's page hacked

Facebook today announced two new security measures -- wider use of HTTPS and the introduction of "social authentication" -- less than 24 hours after the Facebook page of company founder Mark Zuckerberg was defaced by a hacker.

A blog post by Facebook's Alex Rice ties the security announcement to Friday being "Data Privacy Day," but the press and bloggers are having a high time connecting the news and Zuckerberg's victimization, whether or not there is actually any connection.

The first new security measure involves expanding the use of HTTPS -- Hypertext Transfer Protocol Secure -- beyond password exchanges.

Rice writes: "Starting today we'll provide you with the ability to experience Facebook entirely over HTTPS. You should consider enabling this option if you frequently use Facebook from public Internet access points found at coffee shops, airports, libraries or schools. The option will exist as part of our advanced security features, which you can find in the 'Account Security' section of the Account Settings page."

The second measure is a captcha-like authentication mechanism that instead of relying on illegible printed words employs photographs of a Facebook user's own friends.
Rice continues: "Instead of showing you a traditional captcha on Facebook, one of the ways we may help verify your identity is through social authentication. We will show you a few pictures of your friends and ask you to name the person in those photos. Hackers halfway across the world might know your password, but they don't know who your friends are."
Meanwhile, Facebook has remained officially mum regarding yesterday's apparent hacking incident that saw someone insert a message onto Zuckerberg's Facebook fan page, which has attracted 2.8 million Facebook users. While it was removed relatively quickly, some 1,800 of those users managed to "like" the page and more than 400 left comments beforehand. The message read:
"Let the hacking begin: If facebook needs money, instead of going to the banks, why doesn't Facebook let its users invest in Facebook in a social way? Why not transform Facebook into a 'social business' the way Nobel Price [sic] winner Muhammad Yunus described it? #hackercup2011"

As of this writing, Zuckerberg's page remains disabled.

Droidmap: Nmap for Android Phones

Personally I am a android lover and i was very upset when SET and Metasploit were released for iphone and object neopwn :D But here is a good news for android lovers.Nmap is released for android also

 droidmap is an android application for root users that implements some functions of NMAP in a GUI in Android. This program comes with installer scripts for the installation of the required NMAP application that must be run to install the program to your phone. Please note that the installation process requires a Linux environment running the Android developer tools from the SDK and this program requires the Android Debug Bridge (adb) for installation.

This tool will be really handy for engineers who are on roaming profile and need to find quick result for their customers.
Download droidmap v0.0.1 (droidmap-0.01.tar.gz) here

USB Attack Vectors Move Beyond Flash Drives

You have all heard about the dangers that USB drives can pose. In 2008, the US Military suspended the use of USB drives after a large worm attack hit military systems.


Iran’s Nuclear power plant was hit with Stuxnet, supposedly from a USB drive. And following the recent Wikileaks disaster, the military is banning all removable devices from systems connected to SPIRNET, the government’s secret network:

Maj. Gen. Richard Webber, commander of Air Force Network Operations, issued the Dec. 3 “Cyber Control Order” — obtained by Danger Room — which directs airmen to “immediately cease use of removable media on all systems, servers, and stand alone machines residing on SIPRNET,” the Defense Department’s secret network. Similar directives have gone out to the military’s other branches.


So no more CD’s, DVD’s or thumb drives will be allowed near these machines.


Then there is always the threat of malicious hardware. For years the government has been worried about counterfeit electronic hardware mainly from Chinese manufactures that have built in backdoors.


Earlier this year millions of dollars of counterfeit Cisco equipment was confiscated that was to be sold to Marines in Iraq:


Ashoor purchased counterfeit Cisco Gigabit Interface Converters (GBICs) from an online vendor in China with the intention of selling them to the U.S. Department of Defense for use by Marine Corps personnel operating in Iraq, the DOJ said. The computer network for which the GBICs were intended is used by the Marine Corps to transmit troop movements, relay intelligence and maintain security for a military base west of Fallujah, Iraq, the DOJ said.


So security experts have been on the lookout for USB drives and even counterfeit routers, but what about an innocent looking USB keyboard, or mouse? How much attention would that garner?


Adrian Crenshaw (Security Specialist and Speaker) has shown from his recent work with the Arduino “Teensy” programmable keystroke device that almost any USB device, including keyboards, mice, and the innocent desktop toy could be used as an attack vector.


Adrian (also known as “Irongeek”) created the tool for professional security pen testers, but it has really shown how USB attacks can and will move way beyond “Autorun.inf” infectors.

The Teensy programmable keystroke device is made from PJRC’s Teensy USB Development Board.


The computer does not see the Teensy device as a USB drive or another accessory, but as a human interface device (a keyboard). The Teensy circuit board can be inserted inside a keyboard or mouse and can be set to activate when a certain key is pressed or a certain condition is met.


So, for example, if the “Scroll Lock” or “Caps Lock” key is pressed, the teensy could send the commands to copy all the data from a certain directory.


The Teensy can also be set to activate via timer or whatever the pentester desires. And antivirus would not detect it as it would seem to be just standard keyboard input.


Also, the inside of the mouse or keyboard leaves amble room for the miniature teensy and whatever else the pentester may want to use. Inside a standard mouse case, Adrian was able to insert a Teensy device, a USB hub and flash memory.


With this type of setup, he could have the teensy device issue commands to run a script from the flash drive or even copy data from the system to flash storage.


I believe that with the Teensy programmable keystroke device, we are really looking at a new generation of intelligent malicious hardware that will be limited only by the imagination of the attacker.

Here is a video of perfect hardware hacking mouse+trojan=teensy mouse

Geinimi, Sophisticated New Android Trojan Found in Wild

The Threat:
A new Trojan affecting Android devices has recently emerged in China. Dubbed “Geinimi” based on its first known incarnation, this Trojan can compromise a significant amount of personal data on a user’s phone and send it to remote servers. The most sophisticated Android malware we’ve seen to date, Geinimi is also the first Android malware in the wild that displays botnet-like capabilities. Once the malware is installed on a user’s phone, it has the potential to receive commands from a remote server that allow the owner of that server to control the phone.

Geinimi is effectively being “grafted” onto repackaged versions of legitimate applications, primarily games, and distributed in third-party Chinese Android app markets. The affected applications request extensive permissions over and above the set that is requested by their legitimate original versions. Though the intent of this Trojan  isn’t entirely clear, the possibilities for intent range from a malicious ad-network to an attempt to create an Android botnet.
Lookout has already delivered an update for its Android users to protect them against known instances of the Trojan. If you are already a Lookout user (free or premium), you are protected and no action is needed.
How it Works:
When a host application containing Geinimi is launched on a user’s phone, the Trojan runs in the background and collects significant information that can compromise a user’s privacy. The specific information it collects includes location coordinates and unique identifiers for the device (IMEI) and SIM card (IMSI). At five minute intervals, Geinimi attempts to connect to a remote server using one of ten embedded domain names. A subset of the domain names includes www.widifu.com, www.udaore.com, www.frijd.com, www.islpast.com and www.piajesj.com. If it connects, Geinimi transmits collected device information to the remote server.
Though we have seen Geinimi communicate with a live server and transmit device data, we have yet to observe a fully operational control server sending commands back to the Trojan. Our analysis of Geinimi’s code is ongoing but we have evidence of the following capabilities:

• Send location coordinates (fine location)
• Send device identifiers (IMEI and IMSI)
• Download and prompt the user to install an app
• Prompt the user to uninstall an app
• Enumerate and send a list of installed apps to the server

While Geinimi can remotely initiate an app to be downloaded or uninstalled on a phone, a user still needs to confirm the installation or uninstallation.
Geinimi’s author(s) have raised the sophistication bar significantly over and above previously observed Android malware by employing techniques to obfuscate its activities. In addition to using an off-the-shelf bytecode obfuscator, significant chunks of command-and-control data are encrypted. While the techniques were easily identified and failed to thwart analysis, they did substantially increase the level of effort required to analyze the malware. The Lookout Security team is continuing to analyze capabilities of new and existing Geinimi variants and will provide more information as we uncover it.
Who is affected?
Currently we only have evidence that Geinimi is distributed through third-party Chinese app stores. To download an app from a third-party app store, Android users need to enable the installation of apps from “Unknown sources” (often called “sideloading”). Geinimi could be packaged into applications for Android phones in other geographic regions. We have not seen any applications compromised by the Geinimi Trojan in the official Google Android Market.
There are a number of applications—typically games—we have seen repackaged with the Geinimi Trojan and posted in Chinese app stores, including Monkey Jump 2, Sex Positions, President vs. Aliens, City Defense and Baseball Superstars 2010. It is important to remember that even though there are instances of the games repackaged with the Trojan, the original versions available in the official Google Android Market have not been affected. As the Lookout team finds more variants of the Geinimi Trojan grafted onto legitimate applications, we’ll provide timely updates.
As stated above, Lookout has already delivered an update for its Android users to protect them against known instances of the Trojan.

How to Stay Safe:

• Only download applications from trusted sources, such as reputable application markets. Remember to look at the developer name, reviews, and star ratings.
• Always check the permissions an app requests. Use common sense to ensure that the permissions an app requests match the features the app provides.
• Be aware that unusual behavior on your phone could be a sign that your phone is infected. Unusual behaviors include: unknown applications being installed without your knowledge, SMS messages being automatically sent to unknown recipients, or phone calls automatically being placed without you initiating them.
• Download a mobile security app for your phone that scans every app you download. Lookout users automatically receive protection against this Trojan.

With the discovery of this new malware, it is more important than ever to pay attention to what you’re downloading. Stay alert and ensure that you trust every app you download. Stay tuned for more details on this threat.

cross_fuzz: A Cross-Document DOM Binding Fuzzer!

Mr. Michal Zalewski – cross_fuzz. cross_fuzz is an amazingly effective cross-document DOM binding fuzzer, that helped Mr. Zalewski find a lot of cross browser vulnerabilities. We have been reading about the ‘existence‘ of such a tool from his blog, but only now can we see it for our selves.

A main reason behind releasing this tool to the public is that it will most possibly help fine tune this fuzzer and remove any errors that are currently affecting it. The author also has reasons to believe that because of an information leak prior to the public release of this fuzzer, certain unwanted entities might have gained access to a yet unknown vulnerability in the Microsoft Internet Explorer. The author has confirmed the same based on two search queries are looking for information on MSHTML.DLL functions – BreakAASpecial and BreakCircularMemoryReferences – that are unique to the stack signature of this vulnerability.


Back to the fuzzer – cross_fuzz dynamically generates extremely long interconnected sequences of DOM operations across multiple documents, inspects returned objects, recurses into them, and creates circular node references that stress-test garbage collection algorithms. It can also be easily extended to fuzz any DOM-enabled documents or browser plugins simply by providing new target documents.But, because of the design of the fuzzer, it is difficult to get clean, deterministic outputs. You just need to know how it presents itself!

Give cross_fuzz a trial or download it from here.

Security firm: Facebook is biggest mobile malware threat

The biggest mobile infection threat isn't malware that specifically targets mobile devices, according to new research from security firm BitDefender. Malware that targets Facebook is a far bigger problem for mobile security, the firm claims.


Spam links on social networks are infecting mobile devices via bad links on Facebook because the worms and other malware are often platform-independent and are widely spread as malware that targets PCs. 

BitDefender officials point to Google statistics, which reveal almost one quarter of Facebook users who fell for a recent scam on the social network did so from their mobile device. The URL that was studied was one that claimed to show users a girl's Facebook status which got her expelled from school. It generated 28,672 clicks -- 24 percent of which originated from mobile platforms. Users who clicked on the link -- whether on their PC or mobile device -- downloaded a Facebook worm and fell victim to an adword-based money grabbing scheme


"When data security researchers focus on finding malware specifically designed for mobile platforms, they lose sight of an important mobile platform threat source -- the social network," said George Petre, BitDefender Threat Intelligence Team Leader.

Tabnapping tutorial&how to stay secure

What is tabnapping?

tab napping is a new form of phishing..in which a attacker redirects a normal looking page to malformed page either in some time or when victims moves to other already opened tabs.This might sound simple but its very effective as victims feels comfortable with normal looking page and voilla he gets pawned when he moves back to orignal tab

this trick was developed by aza razkin

how to stay safe from tabnapping
1)Always look for the url in adress bar before logging in to important sites.

2)Try using no-script addon from firefox it will disable js and other malicious scripts which can be used by hackers.

3)Try using ctr+n for tabs






here is the video demonstrating  it practically


here is the code

A New Type of Phishing Attack from Aza Raskin on Vimeo.

Google enhances e-mail security in Apps

Google has taken a step to stop legitimate e-mail messages sent by its Apps customers from getting caught in spam filters.

Administrators for Google Apps can now enable digital signing of those messages, which helps recipients verify that the messages came from a known, vetted sender, wrote Adam Dawes, a Google Enterprise product manager on a company blog. 

The system uses DKIM, or DomainKeys Identified Mail, which verifies the domain name through which a message was sent by analyzing the message's cryptographic signature. If the message comes from a domain that is considered reputable, it won't be filtered out.
Some users of Google Apps have complained their e-mail from their custom domain has been blocked even if they have set up a proper Sender Policy Framework (SPF) record. The SPF record allows a domain owner to specify which hosts are allowed to send mail for their domain. 

A SPF record makes it more difficult for spammers to simply forge the "from" address in an e-mail message since the recipient will check the SPF record and filter inconsistent ones out.
Google has used DKIM and DomainKeys, another e-mail authentication method, for its Gmail customers for outbound e-mail since 2004.
In 2008, Google worked with eBay and PayPal to ensure messages from those organizations were always properly signed, due to the high prevalence of phishing e-mails. All unsigned messages purporting to be from those organizations are blocked.
DKIM is free for Google Apps users. Administrators can turn it on by going to the control panel and then to the "advanced tools" tab, Dawes wrote.

Tunisian government harvesting usernames and passwords

The Tunisian Internet Agency (Agence tunisienne d'Internet or ATI) is being blamed for the presence of injected JavaScript that captures usernames and passwords. The code has been discovered on login pages for Gmail, Yahoo, and Facebook, and said to be the reason for the recent rash of account hijackings reported by Tunisian protesters.


ATI is run by the Tunisian Ministry of Communications. They supply all of the privately held Tunisian ISPs, making them the main source of Internet access in the country. They’ve been under scrutiny for years, due to the fact that they make use of their authority to regulate the entire national network
. Last April, ATI earned international attention by blocking access to sites such as Flickr, YouTube
, and Vimeo.


According to Reporters Without Borders, authorities claim to target only pornographic or terrorist websites. “However, censorship applies above all to political opposition, independent news, and human rights websites.”


“When an Internet user attempts to access a prohibited website, the following automatic error message appears: “Error 404: page not found,” without displaying the familiar “Error 403” more typical of a blocked site...This strategy equates to a disguised form of censorship.”



As for the JavaScript itself, The Tech Herald has seen examples of the embedded script during live surfing sessions with sources in Tunisia, and in posted source code made available to the Web. The source for the GMail injection is here, the Yahoo injection is here, and Facebook is here.


Four different experts consulted by The Tech Herald independently confirmed our thoughts; the embedded code is siphoning off login credentials.


On Twitter, security researcher Gerry Kavanagh and Errata Security CTO David Maynor told us that you can tell the code is capturing login information by how it references the login element for the form.


“Suffice to say, the code is definitely doing something surreptitious,” Kavanagh noted.


Daniel Crowley, Technical Specialist for Core Security, and Rapid7’s Josh Abraham, broke the code down further. Crowley explained that the JavaScript is customized for each site’s login form. It will pull the username and password, and encode it with a weak crypto algorithm.


The newly encrypted data is placed into the URL, and a randomly generated five character key is added. The randomly generated key is meaningless, but it is assumed that it’s there to add a false sense of legitimacy to the URL.


The random characters and encrypted user information are delivered in the form of a GET request to a non working URL. In the Gmail example, you see this URL listed as http://www.google.com/wo0dh3ad. Abraham noted that the encryption makes it easy to capture usernames and passwords that would include special characters such as ‘%’ or ‘/’.


Considering that the backbone of the Tunisian Internet
is full of state run filters and firewalls designed to block access, configuring one to log the GET commands with the harvested data would be trivial. But is this a government sponsored action?


The likelihood that a group of criminals compromised the entire Tunisian infrastructure is virtually nonexistent. Code planting on this scale could only originate form an ISP. With their history of holding an iron grip on the Internet, ATI is the logical source of the information harvesting.


There is an upside however, as the embedded JavaScript only appears when one of the sites is accessed with HTTP instead of HTTPS. In each test case, we were able to confirm that Gmail and Yahoo were only compromised when HTTP was used. For Facebook on the other hand, the default is access is HTTP, so users in Tunisia will need to visit the HTTPS address manually.


Another interesting note is that it appears the embedded code has targeted Tunisian users for several months. Slim Amamou, of the Global Voices Advocacy blog, reported his findings on the code last July, and at the time, ATI was blocking Google’s HTTPS port, forcing users to default to HTTP.

The ATI website has been offline for more than a day. The outage started after Anonymous launched Operation: Tunisia. 

Google Bangladesh DNS HIJACKED BY TiGER-M@TE

sure enough, visitors of the company’s Bangladesh search site (Google.com.bd) see a defaced landing page rather than the usual search site. As far as I can tell, www.google.com.bd functions properly, so whether this really constitutes a ‘hack’ is up for debate.

Local Bangladesh media, including online newspaper bdnews24.com, reported on the news as well, quoting a CTO of a local ISP, who confirmed the hack.
Nevertheless, it seems like only a subset of users see the defaced landing page, while others report that they can visit and use the search engine without any hiccups.
According to Zone-h, Bangladeshi hacker TiGER-M@TE has been quite active with defacements lately, and has targeted some high-profile sites in the past, including the local website for American Express and Airtel (video).

This was a DNS hijack done in the .bd zone run by Bangladesh Telecommunications
Company Limited (BTCL). This wasn't Google hacked, per se. The hacker just decided to take advantage of what is probably the most noticeable domain in the .bd zone. They could have probably done this to any of them.

There is nothing Google could have done to prevent this. And no, DNSSEC would not have stopped this.

Anyways, it's fixed now globally. And if you used OpenDNS, our caches were cleared of the bogus records a while ago.