How to Hack a Computer Using Just An Image 2015

Next time when someone sends you a photo of a cute cat or a hot chick than be careful before you click on the image to view — it might hack your machine.

Yes, the normal looking images could hack your computers — thanks to a technique discovered by security researcher Saumil Shah from India.

Dubbed "Stegosploit," the technique lets hackers hide malicious code inside the pixels of an image, hiding a malware exploit in plain sight to infect target victims.

Just look at the image and you are HACKED!

Shah demonstrated the technique during a talk titled, "Stegosploit: Hacking With Pictures," he gave on Thursday at the Amsterdam hacking conference Hack In The Box.

According to Shah, "a good exploit is one that is delivered in style."

Keeping this in mind, Shah discovered a way to hide malicious code directly into an image, rather than hiding it in email attachments, PDFs or other types of files that are typically used to deliver and spread malicious exploits.

To do so, Shah used Steganography — a technique of hiding messages and contents within a digital graphic image, making the messages impossible to spot with the naked eye.

Here's How to Hack digital pictures to send malicious exploits:

Until now Steganography is used to communicate secretly with each other by disguising a message in a way that anyone intercepting the communication will not realise it's true purpose.

Steganography is also being used by terrorist organisations to communicate securely with each other by sending messages to image and video files, due to which NSA officials are forced to watch Pornand much porn.

However in this case, instead of secret messages, the malicious code or exploit is encoded inside the image’s pixels, which is then decoded using an HTML 5 Canvas element that allows for dynamic, scriptable rendering of images.

The "Secret Sauce" behind Stegosploit — this is what Shah calls it.

"I don’t need to host a blog," Shah told Motherboard, "I don’t need to host a website at all. I don’t even need to register a domain. I can [just] take an image, upload it somewhere and if I just point you toward that image, and you load this image in a browser, it will detonate."

The malicious code, dubbed IMAJS, is a combination of both image code as well as JavaScript hidden into a JPG or PNG image file. Shah hides the malicious code within the image’s pixels, and unless somebody zoom a lot into it, the image looks just fine from the outside.

Video Demonstration:

Shah demonstrated to Lorenzo Franceschi of Motherboard exactly how his hack works. He used Franceschi’s profile picture and then prepared a demonstration video using his picture as the scapegoat.

In the first video presentation, Shah shows a step by step process on how it is possible to hide malicious code inside an image file using steganography technique. You can watch the video given below:

In the second video, Shah shows how his Stegosploit actually works. His exploit works only when the target opens the image file on his or her web browser and clicks on the picture.

You are HACKED!

Once the image is clicked, the system’s CPU shoots up to 100 percent usage, which indicates the exploit successfully worked. The malicious code IMAJS then sends the target machine’s data back to the attacker, thereby creating a text file on the target computer that says — "You are hacked!"

Shah also has programmed his malicious image to do more stealthy tasks, like downloading and installing spyware on victim’s machine, as well as stealing sensitive data out of the victim’s computer.

The bottom line here is:

You should not presume the image files as "innocent" anymore, as they can hide malicious code deep inside its pixels that could infect your computers.

Therefore, always make sure before you click on one.

Shah has been working on the research [PDF] during his spare time for almost five years, but he has not tested his technique on popular image sharing websites like Dropbox or Imgur. He also admitted that his method might not work everywhere.

SOURCE- THEHACKERNEWS

Microsoft Plans to Add Secure Shell (SSH) to Windows

Until now Unix and Linux system administrators have to download a third-party SSH client software like Putty on their Windows machines to securely manage their machines and servers remotely through Secure Shell protocol or Shell Session (better known as SSH).

This might have always been an awkward feature of Windows platform, as it lacks both – a native SSH client software for connecting to Linux machines, and an SSH server to support inbound connections from Linux machines. But…

Believe it or not:

You don't need to deal with any third-party SSH client now, as Microsoft is working on supporting OpenSSH.

Yes, Microsoft has finally decided to bring OpenSSH client and server to Windows.

The PowerShell team at Microsoft has announced that the company is going to support and contribute to OpenSSH community in an effort to deliver better SSH support in the PowerShell and Windows SSH software solutions.

So, the upcoming version of Windows PowerShell – the command-line shell and scripting language – will allow users to manage Windows and Linux computers through SSH.

"A popular request the PowerShell team has received is to use Secure Shell protocol and Shell session (aka SSH) to interoperate between Windows and Linux – both Linux connecting to and managing Windows via SSH and, vice versa, Windows connecting to and managing Linux via SSH," explained Angel Calvo, PowerShell Team Group Software Engineering Manager.

"Thus, the combination of PowerShell and SSH will deliver a robust and secure solution to automate and to remotely manage Linux and Windows systems."

For those who are unaware, SSH is basically designed to offer the best security when accessing another computer remotely. It not only encrypts the remote session, but also provides better authentication facilities, with features like secure file transferring and network port forwarding.

This is not first time Microsoft has planned to adopt SSH for its Windows platform, the company had tried to allow the secure shell protocol to be used within Windows twice but was unable to implement it.

However, developers who are eager to use this new functionality in PowerShell still have to wait for some time, as the project is still in the early planning phase. So far, there isn’t any definite release date.!!

FBI: Banned Security Researcher Admitted to Hacking Plane In-Flight !!

A security researcher who was pulled out from a United Airlines flight last month had previously admitted to Federal Bureau of Investigation (FBI) that he had taken control of an airplane and made it fly briefly sideways.

Chris Roberts, the founder of One World Labs, was recently detained, questioned and had his equipment taken by federal agents after he landed on a United flight from Chicago to Syracuse, New York following his tweet suggesting he might hack into the plane's in-flight entertainment system.

In that particular tweet, Roberts joked: "Find me on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? 'PASS OXYGEN ON' Anyone? :)"

The federal agents addressed the tweet immediately and took it seriously following the Roberts’ capabilities of such hacking tactics.

In the FBI affidavit first made public Friday - first obtained by APTN National News - Roberts told the FBI earlier this year about not once, but repeatedly hacking into aircrafts' in-flight entertainment (IFE) systems while on board.

"During these conversations, Mr. Roberts stated ... he had exploited [flaws] with IFE systems on aircraft while in flight. He compromised the IFE systems approximately 15 to 20 times during the period 2011 through 2014," FBI Special Agent Mark Hurley wrote in his application. "He last exploited an IFE system during the middle of 2014."

How the researcher made this possible?

The documents claim that Roberts connected his laptop to the plane’s IFE system via a modified Ethernet cable, allowing him to access other airplane systems.

During at least one instance, Roberts reportedly claimed to have overwritten the code on the airplane's Thrust Management Computer while aboard a flight and successfully controlled the system to issue the climb command.

By issuing the ‘CLB’ or climb command, Roberts "caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane," according to the FBI warrant application.

No Systems were Harmed:

Roberts claimed via Twitter that no systems were harmed during the trip. Moreover, Roberts told Wired in an interview that the FBI has taken his remarks about hacking "out of context" of their discussions with the agency.

Roberts claimed that he had only watched data traffic on airplanes, and he has only attempted the hack in a simulated environment because he believed that such hack attacks were possible.

"It would appear from what I’ve seen that the federal guys took one paragraph out of a lot of discussions and a lot of meetings and notes and just chose that one as opposed to plenty of others," he said, declining to elaborate further.

Since this incident, United Airlines has launched a bug bounty program inviting security researchers and bug hunters to report vulnerabilities in its websites, apps and web portals.

Roberts has neither been arrested by the FBI nor charged with any crime.

Source :- TheHackerNews

Hackers Stole $300 Million from 100 Banks Using Malware 2015 !!

Despite increased online and mobile banking security, banks are more often being targeted by hackers. A hacker group has infiltrated a number of banks and financial institutions in several countries, stealing hundreds of Millions of dollars in possibly the biggest bank heist the world has ever seen.

According to a report published by the New York Times on Saturday, hackers have stolen as much as $1 Billion from more than 100 banks and other financial companies in almost 30 nations, making it "the most sophisticated attack the world has seen to date."

In late 2013, banks in Russia, Japan, Europe, the United States and other countries fell victim to a massive, sophisticated malware hack that allowed the hackers to spy on bank officials in order to mimic their behavior, according to an upcoming report by Kaspersky Labs received by the NY Times.

CARBANAK BANKING MALWARE IN THE WILD

In order to infect bank staffs, the hacker group sent malicious emails to hundreds of employees at different banks. Once open, the email downloads a malware program called Carbanak, that allegedly allowed perpetrators to transfer money from the banks to fake accounts or ATMs monitored by criminals.

The exact figure of the stolen amount is unclear, though, according to the cybersecurity firm, the total theft could be more than $300 Million. Because, the hackers only swiped $10 million at a time and some banks were targeted more than once.

"This is likely the most sophisticated attack the world has seen to date in terms of the tactics and methods that cybercriminals have used to remain covert," Chris Doggett, manager of Kaspersky's North American office in Boston, told the Times.

However, the cyber security firm does not name the banks and financial institutions involved in the massive theft operation in its report. But, the interesting part is that no banks have come forward to reveal that they have been hacked in this largest theft.

HISTORY OF CYBER HEIST

This is not first time when hackers have made banks and financial institutions as their target. In past, they had carried out a number of bank crimes. The list is given below:

• In March, 2012 - A Russian hacker was sentenced to two years in US prison for his involvement in a global bank Million Dollar Fraud scheme that used hundreds of phony bank accounts to steal over $3 million from dozens of U.S.accounts. He was responsible for the Zeus banking malware that was used to carry out the fraud.
• In October, 2012 - FBI arrested 14 people who used cash advance kiosks at casinos located in Southern California and Nevada and robbed over $1 million from Citibank.
• In May, 2013 - A gang of cyber-criminals operating in 26 countries stole $45 Million by hacking into the database of prepaid debit cards, making it the biggest bank robbery in the history.
• In July, 2013 - A hacker group allegedly broke into the computer networks of more than a dozen of major American and International corporations and stole 160 million credit card numbers over the course of 7 years, making it the largest data theft case ever prosecuted in the U.S.
• In October, 2013 - The Dutch police arrested four people who used TorRat Malware to target two out of three major Banks in the Netherlands and stole over Millions of Dollars from Banking Accounts.

London Railway System Passwords Exposed During TV Documentary 2015 !!

The Weakest Link In the Information Security Chain is still – Humans.

And this news has ability to prove this fact Right.

One of London's busiest railway stations has unwittingly exposed their system credentials during a BBC documentary. The sensitive credentials printed and attached to the top of a station controller's monitor were aired on Wednesday night on BBC.

What could be even worse?

If you think that the credentials might have been shown off in the documentary for a while or some seconds, then you are still unaware of the limit of their stupidity.

The login credentials were visible for about 44 minute in the BBC documentary "Nick and Margaret: The Trouble with Our Trains" on Wednesday night, which featured Nick Hewer and Margaret Mountford – the two business experts, both famous for their supporting role on The Apprentice.

The documentary was available on the YouTube, but have now been removed due to security concerns.

While talking about the concerns of the British railway network, the duo walked into London Waterloo's control room where these sensitive credentials were seen stuck to a monitor of a system.

A screenshot of the offending monitor with the machine-produced login was captured and shown above. The screenshot points to a particular workstation signaller's control desk seems to be running a type of software that controls signals and trains over‪ the final approach to Waterloo station‬.

Now this is going to be a great idea to keep passwords. Isn’t this? I mean if it is, then what’s the need of putting passwords for the devices if you stuck it on the top of that device.

This shows that we are just humans. Remembering so many personal passwords of our different online accounts and then to remember the passwords of others – Ahh! Quite a tough Job.

Okay, now let’s come to another security concern. What would you expect next?

Password3, Wow! Isn’t this great password?

I mean, at least keep a strong password that take some time to guess and crack. Password3 could be in the list of top ten weakest passwords.

The incident occur few days after the news came that the computer systems controlling the railway signalling system in the United Kingdom could potentially be hacked by cyber criminals to cause incoming trains to crash into one another at highest speeds.

However, this security blunder of revealing passwords mistakenly in an interview, video or news channel is not new at all.

Last year, the World Cup security centre’s internal Wi-Fi passwords for the FIFA World Cup 2014 were broadcast live. Also, French TV network TV5Monde failed to keep its passwords secret and revealed a collection of the TV station’s usernames and passwords live on TV!!

Keep Connected !!  

Like On Facebook !!

Famous Online Indian Portal ‘Rediff’ Hacked By Palestinian Hacker 2015

On 30th April, 2015, a Palestinian-friendly hacker going with the online handle of HolaKo hacked and defaced a subdomain of Rediff.com, a famous Indian news, information, shopping and entertainment web portal.

The targeted domain (businessemail.rediff.com) belongs to Rediff enterprise providing emails, Windows andLinux web hosting services in India.

In an exclusive conversation with HolaKo, HackRead was told that reason for targeting Rediff was to deliver a message about Israeli occupation of Palestinianland.

The deface message was left in following words: 

HACKED BY HOLAKO, REDIFF MAIL OWNED!? W00T !! WE ARE THE BEST OF THE REST. FREE PALESTINE ! #SAVEGAZA

A full preview of the deface page is available below:

Link of targeted domain along with its zone-h mirror as a proof of hack is available below:

http://businessemail.rediff.com/
http://www.zone-h.org/mirror/id/24135554

 I THINK THEY FOUND OUT I AM IN THEIR SERVER 

HolaKo claims he had access to Rediff’s databases, emails and login data, but the access was cutoff by site admin later on. 

In past the hacker was in news for defacing Institute of Electrical and Electronics Engineers (IEEE,org) website in support of Palestine. You can contact the hacker here.{AT YUOUR OWN RISK}

At the time of publishing this article, the targeted Rediff domain was restored and accessible online. 

Website and Twitter account of high-tech automaker HACKED by Tesla

The website and Twitter account of high-tech automaker Tesla were hacked over the weekend as part of a prank by angry rival hackers. Tesla CEO Elon Musk’s personal twitter account was also hacked around Saturday night (US Standard Time).

The first sign of hijacking was noticed around 1:52 p.m., when the company’s Twitter account had a tweet that declared it being under the control of attackers and the name changed from “Tesla Motors” to  “#RIPPRGANG”. The tweet posted on the carmaker’s account said, “This Twitter is now run [sic] by Henry Blair Strater [sic] from Oswego Illinois, call me at [number redacted]”. 

A few minutes later, the account began promising free Teslas to those who followed certain accounts or to those who called a certain phone number. The number belonged to a repair shop in Illinois which was flooded with calls.

Nearly at that time, Tesla’s website was hacked by the same attackers. Visitors were redirected to a website with ISIS in the URL, a Laden-ranting video and a picture of a man resembling Osama Bin Laden.

(PC-google images)

The Twitter account war restored around 2:45 p.m., an hour after it was uncompromised and the website was back to its usual state at around 6:30 p.m.

Elon Musk’s Twitter account was hijacked by miscreants who claimed to be from the infamous Lizard Squad Hacking crew, known as Autismsquad.

Hacking WordPress Website with Just a Single Comment !

Most of the time, we have reported about WordPress vulnerabilities involving vulnerable plugins, but this time a Finnish security researcher has discovered a critical zero-day vulnerability in the core engine of the WordPress content management system.

The vulnerability, found by Jouko Pynnönen of Finland-based security firm Klikki Oy, is a Cross-Site Scripting (XSS) flaw buried deep into the WordPress’ comments system.

The vulnerability affects the WordPress versions 3.9.3, 4.1.1, 4.1.2, and the latest WordPress version 4.2.

Pynnönen disclosed the details of the zero-day flaw, along with a video and a proof-of-concept code for an exploit of the bug, on his blog post on Sunday before the WordPress team could manage to release a patch.

Why the researcher made the 0-Day Public?

A similar cross-site-scripting (XSS) vulnerability was patched this week by WordPress developers, which was nearly 14 months after the bug was reported to the team.

Due to fear of delay in fixing this hole, Pynnönen went public with the details of critical zero-day vulnerability in WordPress 4.2 and below, so that the users of the popular content management system could be warned beforehand.

Moreover, Pynnonen reported the vulnerability to the WordPress team but they "refused all communication attempts" he made since November 2014.

The exploitation of the 0-Day vulnerability:

The vulnerability allows a hacker to inject malicious JavaScript code into the comments section that appears at the bottom of Millions of WordPress blogs or article posts worldwide. However, this action should be blocked under ordinary circumstances.

This could allow hackers to change passwords, add new administrators, or take other actions that could only be performed by the legitimate administrator of the website. This is what we call a cross-site scripting attack.

Pynnonen described the 0-day flaw as below:

"If triggered by a logged-in administrator, under default settings the attacker can leverage the vulnerability to execute arbitrary code on the server via the plugin and theme editors,"Pynnönen wrote in a blog post published Sunday evening.
"Alternatively the attacker could change the administrator's password, create new administrator accounts, or do whatever else the currently logged-in administrator can do on the target system."

How the 0-Day exploit works?

The zero-day exploit provided by the researcher works by posting a simple JavaScript code as a comment and then adding as long as 66,000 characters or over 64 KB in size.

When the comment is processed by someone with WordPress admin rights to the website, the malicious code will be executed without giving any indication to the admin.

By default, WordPress does not automatically publish a user's comment to a post until and unless the user has been approved by the administrator of the site.

Hackers can bypass this limitation by fooling the administrator with their benign first comment, which once approved would enable any further malicious comments from that person to be automatically approved and published to the same post.

WordPress patches the 0-Day flaw:

In order to fix the security hole, administrators should upgrade their CMS to Wordpress 4.2.1, which was released few hours ago.

"This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately," the WordPress team said of the latest version.

WordPress version 4.2.1 reportedly fixes the zero-day vulnerability reported by Pynnonen. So if you own a WordPress website, make sure that you run an updated version of the CMS with all the plugins up-to-date.

Stay connected!!

Crazy!!! Hacker Implants NFC Chip In His Hand To Hack Android Phones News

There is a very sleek line between hacking and security. The security used to protect the public could be misused by hackers against the public itself, and one shouldn’t forget that with the advance in technology, the techniques used by cyber criminals also improves.

Today, What hackers need to conduct a successful cyber attack?

Maybe just a computing device injected under the skin of their bodies, who can bear the pain, would be enough to help complete a successful cyber attack – also known as Biohacking.

This was exactly what presented by the former U.S. Navy petty officer and now engineer at APA Wireless Seth Wahle.

With no malicious intention, Wahle implanted a small NFC chip in his left hand right between his thumb and his pointer finger in order to display the risks of Biohacking.

Hacking Android devices using NFC implants:

For those unaware, NFC (Near Field Communications) chips embedded in our smartphone devices are used for transferring files and in various mobile payment applications.

Wahle's chip has an NFC antenna that is capable to hack Android devices and bypass almost all security measures. The chip can ping a nearby Android smartphone, prompting its user to open a link.

Once the user of the smartphone agrees to open that link, the link installs a malicious piece of software on the phone that allows the phone to connect to a remote computer controlled by the hacker.

The hacker would now be able to carry out further exploits on the victim's device, potentially putting all the important information and sensitive data of victim at risk.

How is NFC implant done?

In order to implant the NFC device, Wahle bought a chip designed to be injected into cattle and implanted the chip by an "unlicensed amateur" for $40 by using a needle which was larger than he had initially expected, Wahle told Forbes during a Skype call.

The worst part about NFC implant:

The chip implant into Wahle hand was almost invisible after few days. The major thing to worry about this technique is that the NFC chip goes completely undetected in almost all kinds of security measures, including the security checkpoints in airports and other high-security locations.

Wahle said that with the chip implanted in himself, he went through daily scans prior to leaving the military and the chip was never detected. But, he also notes that the X-rays would be able to detect the chip.

However, these Implantable NFC chips potentially open up a smart way for hackers to hack Android devices and networks and gain access to victims' sensitive information.

"This implanted chip can bypass pretty much any security measures that are in place at this point and we will show proof of that," said Rod Soto, the event’s secretary of the board and security consultant.

Limitations of the attacks:

There are some limitations to methods like this, as Wahle says that the remote connection made by a hacker to the server can only be kept if the affected Android device is not locked or rebooted.

However, these limitations could be overcome by various means. Like if, say, the affected phone is rebooted, a software run as a background service that starts on boot would fix the problem.

Wahle will be presenting his finding at the Hack Miami conference taking place this May, with Rod Soto. Both of them intended to alert about these latest strategies that can be used by hackers to hack terminals and networks.

They also admitted that this NFC implant-based attack could provide hackers and cyber criminals with a particularly useful "tool in their social engineering toolset."

For More Updated News Stay Connected 

LIKE US ON FACEBOOK