File-sharing site hit by hackers

14 September 2011 Last updated at 10:24 GMT Fake security software is proving to be big business for some cyber criminals. File-sharing site BitTorrent has warned users that any downloads taken from its site during a two-hour period overnight may contain malware.

It revealed that hackers had injected scareware into its download software.

When installed, the program pops up fake warnings that a virus has been detected and prompts users for payment to remove it.

BitTorrent has become synonymous with illegal downloads but it also has legitimate content.

"This morning at approximately 4.20 am Pacific Time, the uTorrent.com and BitTorrent web services were compromised. Our standard software download was replaced with a type of fake anti-virus 'scareware' program," the company said in its blog.

The scareware is identified as belonging to the Security Shield malware brand.

"Just after 6am Pacific Time we took the affected servers offline to neutralise the threat. Our servers are now back online and functioning normally...We sincerely apologise to any users who were affected," it added.

Later it issued an update, claiming just uTorrent was affected.

Despite clarifications, Sophos security expert Paul Ducklin suggested users needed to be extra careful.

"Since the two sites share the same network infrastructure you might want to ignore that blog update and assume that any downloads from BitTorrent Inc were dodgy and give yourself a thorough anti-malware checkover," he said.

Turning tables

In separate news, the ongoing battle between file-sharing site and the creative industries has taken an unusual turn as digital locker Hotfile counter-sues Warner Bros.

The movie studio had originally taken Hotfile to court in the US, claiming it was hosting pirated films.

But, in a twist, Hotfile claims that the automated software Warner uses to take down content has removed files over which the movie house has no rights.

In one instance, it said, Warner's attempts to remove copies of its movie 'The Box', also took down the audio book 'Cancer: Out of the Box' by Ty M.Bollinger as well as the BBC show 'The Box that saved Britain'.

View the original article here

Read More

Hackers issue bogus security certificates for CIA

AMSTERDAM — Hackers who broke into a web security firm issued hundreds of bogus security certificates for spy agency websites including the CIA as well as for Internet giants like Google, Microsoft and Twitter, the Dutch government said Monday.

Information Technology experts say they suspect the hackers were probably cooperating with the Iranian government, and hundreds of thousands of private communications between Iranian Internet users and Google were likely monitored in August.

Roel Schouwenberg of Internet security firm Kaspersky said Monday night that the incident could have a larger political impact than Stuxnet — a computer worm discovered in July 2010 which targeted Siemens industrial software and equipment running on Microsoft Windows.  (Msnbc.com is a joint venture of Microsoft and NBCUniversal.)

"A government operation is the most plausible scenario" he added.

The latest versions of browsers such as Microsoft's Internet Explorer, Google's Chrome and Mozilla's Firefox are now rejecting certificates issued by the firm that was hacked, DigiNotar.

In a statement Monday, the Dutch government released findings that greatly expand the scope of the hacking attack that DigiNotar first acknowledged last week. External IT experts reviewing DigiNotar's computer systems said the hack may have begun in June, not July as DigiNotar had previously asserted.

The experts said it had affected access not only to Google, but included 531 fake certificates for some 344 domains including sites operated by Yahoo, Facebook, Microsoft, Skype, AOL, Mozilla, TorProject, and WordPress, as well as spy agencies including the CIA, Israel's Mossad and Britain's MI6.

DigiNotar is one of many companies that sell the "SSL" security certificates widely used to authenticate websites and guarantee that communications between a user's browser and a website are secure.

In theory, a fraudulent certificate can be used to trick a user into visiting a fake version of a website, or used to monitor communications with the real sites without users noticing.

But in order to actually pass off a fake certificate, a hacker must be able to steer his target's Internet traffic through a server he controls. That's something that only an Internet service provider can easily do — or a government that commands one.

The external review by Fox-IT — A Dutch company, with offices in Aruba and Great Britain — found that one fake certificate for Google.com was used 300,000 times between its activation Aug. 4 and when it was revoked on Aug. 29. Almost all usage came from Iran.

"The list of domains and the fact that 99 percent of the users are in Iran suggest that the objective of the hackers is to intercept private communications in Iran," it concluded.

The hack of DigiNotar closely resembles one in March of the U.S. security certificate issuer Comodo Inc., which was also attributed to an Iranian hacker. The Fox-IT report said that the hackers erased some evidence of their break-in but purposefully left behind at least one message in one script: "My signature as always, Janam Fadaye Rabhar," which means "I will sacrifice my soul for my leader" in the Farsi language spoken by Iranians.

The same signature line was used by the Comodo hacker, apparently in reference to Iran's religious leader Ayatollah Ali Khamenei.

In a blog posting, U.S. security firm Trend Micro described the attack as "massive," writing that according to its data "Internet users in more than 40 different networks of ISPs and universities in Iran were confronted with rogue SSL certificates issued by DigiNotar."

Gervase Markham, a Mozilla developer who has been involved in the response to the DigiNotar failure, warned Iranian Internet users to update their browsers, "log out of and back into every email and social media service you have" and change all passwords.

Ot van Daalen of Dutch online civil liberties group Bits of Freedom said he believed the DigiNotar incident will ultimately lead to a reform of authentication technology.

Although no users in the Netherlands are known to have been victimized directly by the hack, it has caused a major headache for the Dutch government, which relied on DigiNotar for authentication of many of its websites.

Interior Minister Piet Hein Donner announced in the early hours of Saturday morning that the safety of websites including the country's social security agency, police and tax authorities could no longer be guaranteed.

The Dutch government took over management of DigiNotar, a subsidiary of Chicago-based Vasco Inc., but kept the websites operating as it scrambles to find replacement security providers.

Donner said Monday he has reached a deal with Microsoft under which it won't block some of the web certificates in the Netherlands for the next week in order to prevent a widespread disruption of government services, which might prove worse than any potential hacking.

"The entire Internet is not a phenomenon that lends itself well to government rules," Donner said at a press conference.

Copyright 2011 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

View the original article here

Read More

Hackers' bragging rights at stake at RankMyHack.com

Screenshot of RankMyHack.com home page

Is hacking cool if you have to advertise you're doing it? Isn't the whole point to be on the DL? Well, some are throwing out that notion and going for the glory on RankMyHack.com, "the world's first elite hacker ranking system."

On this site, hackers are obliged to "submit proof" of their website hacks in exchange for "Ranking Points" that can earn them "a place on the leaderboard of legends. The bigger the site, the bigger the points." The sites, times and dates for hacks are listed under each username.

Feeding off the gamer part of hackers, the site then allows them to use those points to "duel" with others on the site "and protect your legacy in one on one digital combat."

The New York Times reported that the site has already taken in evidence of more than 1,200 hacks. The Times' Riva Richmond gives us some more behind-the-scenes insights:

The site was created by a hacker nicknamed Solar to bring a little accountability to the online forums and chat rooms where hackers gather to learn tricks of the trade, buy and sell contraband and form alliances. There, eBay-style ratings systems meant to establish reputations are routinely abused, morality tends to be fluid and anonymous young people often talk big while carrying a small stick.

RankMyHack offers a way to separate the skilled from the so-called script kiddies by verifying hacks using codes that participants must plant somewhere on sites they have compromised.

So far, the top ranking hacker on the site is a user named Mudkip, who has nearly 4 million points hacking just 16 sites. But one of the sites was huffingtonpost.com, which gave Mudkip 1.6 million points as the site with the highest amount of points possible.

The closest hacker to Mudkip is Rafael, who has 1.7 million points. His biggest hack: stackoverflow.com on August 14, for 1.2 million points.

The site also provides a resources page that gives links to mainstream hacking resources, forums and tutorials. They're not even paint-by-numbers hacks as much as links to sites that alert the average web surfer to dangers that lurk outside and give them tips on how to fortify against it.  

Hacking doesn't mean that these sites have been damaged, only that the hackers have been able to breach defenses. Just because they can, doesn't mean they took advantage of those vulnerabilities.

As Richmond writes, "Solar argued that the hacks would occur regardless, and that the site was positive because hackers did not need to do damage to prove they had infiltrated a site."

There are already some interesting theories about the site itself.

VentureBeat muses, "Of course, it would be really brilliant if RankMyHack.com were a fake site created by law enforcement to entrap criminal hackers." CNET ascribes some kind of money motivator to users: "There also appears to be some sort of monetary compensation for hacking. In the site's membership rules, it says that users who enter hacking competitions will receive 'payouts' from Rank My Hack via PayPal within seven days of a competition's closing date."

What do you think?

More stories:

Check out Technolog on Facebook, and on Twitter, follow Athima Chansanchai, who is also trying to keep her head above water in the Google+ stream.

View the original article here

Read More

US gov't eyes recruiting hackers | OFW Magazine

WASHINGTON, Aug 2 (Reuters) – The US National Security Agency has a challenge for hackers who think they’re hot stuff: prove it by working on the “hardest problems on Earth.”

Computer hacker skills are in great demand in the U.S. government to fight the cyber wars that pose a growing national security threat — and they are in short supply.

For that very reason an alphabet soup of federal agencies — DOD, DHS, NASA, NSA — are descending on Las Vegas this week for Defcon, an annual hacker convention where the $150 entrance fee is cash only — no registration, no credit cards, no names taken. Attendance is expected to top 10,000.

The National Security Agency is among the keen suitors. The spy agency plays both offense and defense in the cyber wars. It conducts electronic eavesdropping on adversaries and protects U.S. computer networks that hold super secret material — a prize target for America’s enemies.

“Today it’s cyber warriors that we’re looking for, not rocket scientists,” said Richard “Dickie” George, technical director of the NSA’s Information Assurance Directorate, the agency’s cyber-defense side.

“That’s the race that we’re in today. And we need the best and brightest to be ready to take on this cyber warrior status,” he told Reuters in an interview.

The NSA is hiring about 1,500 people in the fiscal year which ends Sept. 30 and another 1,500 next year, most of them cyber experts. With a workforce of just over 30,000, the Fort Meade, Maryland-based NSA dwarfs other intelligence agencies, including the CIA.

It also engages in cyber-spying and other offensive operations, something it rarely, if ever, discusses publicly.

But at Defcon, the NSA and other “Feds” will be competing with corporations looking for hacking talent too.

The NSA needs cyber security experts to harden networks, defend them with updates, do “penetration testing” to find security holes and watch for any signs of cyber attacks.

The NSA is expanding its fold of hackers, but George said there is a shortage of those skills. “We are straining to hire the people that we need.”

MISFITS OR FIT-INS?

It might seem to be an odd-couple fit — strait-laced government types with their rules and missions trying to recruit hackers who by definition want to defy authorities.

George said the NSA is actually an environment where the hacker mindset fits right in to work with “a critical mass of people

http://ofwmagazine.com/2011/08/02/us-govt-eyes-recruiting-hackers/

View the original article here

Read More

Government hankers for hackers | OFW Magazine

WASHINGTON (Reuters) – The National Security Agency has a challenge for hackers who think they’re hot stuff: prove it by working on the “hardest problems on Earth.”

Computer hacker skills are in great demand in the U.S. government to fight the cyber wars that pose a growing national security threat — and they are in short supply.

For that very reason an alphabet soup of federal agencies — DOD, DHS, NASA, NSA — are descending on Las Vegas this week for Defcon, an annual hacker convention where the $150 entrance fee is cash only — no registration, no credit cards, no names taken. Attendance is expected to top 10,000.

The National Security Agency is among the keen suitors. The spy agency plays both offense and defense in the cyber wars. It conducts electronic eavesdropping on adversaries and protects U.S. computer networks that hold super secret material — a prize target for America’s enemies.

“Today it’s cyber warriors that we’re looking for, not rocket scientists,” said Richard “Dickie” George, technical director of the NSA’s Information Assurance Directorate, the agency’s cyber-defense side.

“That’s the race that we’re in today. And we need the best and brightest to be ready to take on this cyber warrior status,” he told Reuters in an interview.

The NSA is hiring about 1,500 people in the fiscal year which ends September 30 and another 1,500 next year, most of them cyber experts. With a workforce of just over 30,000, the Fort Meade, Maryland-based NSA dwarfs other intelligence agencies, including the CIA.

It also engages in cyber-spying and other offensive operations, something it rarely, if ever, discusses publicly.

But at Defcon, the NSA and other “Feds” will be competing with corporations looking for hacking talent too.

The NSA needs cyber security experts to harden networks, defend them with updates, do “penetration testing” to find security holes and watch for any signs of cyber attacks.

The NSA is expanding its fold of hackers, but George said there is a shortage of those skills. “We are straining to hire the people that we need.”

MISFITS OR FIT-INS?

It might seem to be an odd-couple fit — strait-laced government types with their rules and missions trying to recruit hackers who by definition want to defy authorities.

George said the NSA is actually an environment where the hacker mindset fits right in to work with “a critical mass of people that are just like them.”

But what about culture rifts?

“When I walk down the hall there

http://ofwmagazine.com/2011/08/02/government-hankers-for-hackers/

View the original article here

Read More

Hackers target Murdoch newspaper Web site

Fake news story that LulzSec created for visitors to The Sun.

(Credit: ZDNet)

The LulzSec hacker group has turned its sights on Rupert Murdoch's U.K. newspaper The Sun, hacking the site to direct visitors to a fake article claiming the media mogul had died and releasing information on journalists.

The group announced on Twitter that "The Sun's homepage now redirects to the Murdoch death story on the recently-owned New Times website. Can you spell success, gentlemen?"

The New Times site was inaccessible this afternoon, but screenshots captured before it was taken off line show a headline that says "Media Moguls Body Discovered" and a story that said Murdoch had taken a large quantity of palladium, a metal that resembles platinum.

"Officers on the scene report a broken glass, a box of vintage wine, and what seems to be a family album strewn across the floor, containing images from days gone by; some containing handpainted portraits of Murdoch in his early days, donning a top hat and monocle," the fake news article said in an obvious reference to the LulzSec mascot.

Meanwhile, The Sun site later redirected to LulzSec's Twitter feed.

LulzSec also tweeted the name and phone number of a Sun online editor and two others associated with the company and encouraged followers to call them. And a LulzSec associate, Sabu, posted in a tweet what looks like an old e-mail address and password for Rebekah Brooks, former Sun editor and ex-chief executive of News International, which published News of the World before it shut down earlier this month over the allegations. Brooks resigned from News International last week and was arrested over the weekend. She was an editor at News of the World when mobile phone voice mail hacking allegedly occurred.

News International had released a statement earlier in the day, but the page redirected to LulzSec's Twitter feed, at least temporarily before being inaccessible. "So News International released this AMAZING statement on The Sun: http://newsintco.uk/statement_regarding_the_sun.html/ We improved it for them though!" the hackers said in a tweet, followed by: "Oh, we forgot to mention that we sailed over to News International and wrecked them too. Nearing 300,000 followers...full steam ahead!" The News International site was indeed inaccessible this afternoon.

Murdoch's media empire is embroiled in a scandal in which journalists and others working for the now-defunct News of the World allegedly hacked into mobile phone systems to listen to voice mails of news subjects, including celebrities, members of the royal family, murder victims, soldiers killed in Iraq and Afghanistan, and people who died in the September 11, 2001, terrorist attacks.

Related links
News Corp. exec resigns over phone hacking
British tabloid to shutter in wake of phone hacking scandal
Kevin Mitnick shows how easy it is to hack a phone

Spokespeople for News Corp., parent company of The Sun and News International, did not immediately respond to phone messages and e-mails seeking comment.

Earlier today news came out that a former News of the World journalist turned whistleblower had been found dead of unknown causes. The Guardian reported that Sean Hoare, who had been dismissed from News of the World, had been found dead in his home last night.

Hoare had told The New York Times last September that Andy Coulson, an editor at News of the World, had not only known about the phone hacking but had encouraged it. Hoare also had told told The New York Times that the newspaper paid police to help locate people by using location-tracking technology in their mobile phones that communicates with cell phone towers. Coulson, who denied the allegations at the time, resigned from the newspaper after a journalist there and a private investigator hired by the paper were convicted of phone hacking and went on to become the communications director for British Prime Minister David Cameron. Coulson resigned in January amid renewed media coverage of the scandal.

LulzSec boasted about their hack on Murdoch newspaper The Sun in a tweet.

Public outcry has intensified since The Guardian reported two weeks ago that the private investigator who served time in jail for an earlier hacking case involving the News of the World may have interfered with a police investigation of a missing 13-year-old girl by breaking into her cell phone and deleting voice mail messages before she was found dead in 2002. The allegations have widened to include phones belonging to the families of two other child murder victims and a "handful" of the 52 families who lost loved ones in the 2005 London bombings, among others. The News of the World also is accused of bribing police to divulge classified information about Queen Elizabeth II, Prince Charles, and other members of the royal family, and of voice mail and bank account of former British Prime Minister Gordon Brown and medical records of his son, a charge newspaper executives have denied.

News Corp. is considering promoting Chief Operating Officer Chase Carey to replace Murdoch, Bloomberg reported today. Meanwhile, Murdoch, Brooks, and Murdoch's son, James, who is deputy chief operating officer of News Corp., are scheduled to appear before a Parliamentary hearing on Tuesday to answer questions about the matter.

The news of Hoare's death and other News Corp. scandal headlines may have lured LulzSec out of pseudo-retirement. The group had announced it was calling it quits June 25 but has been working with another loosely organized group of activists, Anonymous, on various attacks on corporate and government Web sites under the AntiSec banner. (Those hacking attacks are included in this chart.)

"Thank you for the love tonight," LulzSec tweeted. "I know we quit, but we couldn't sit by with our wine watching this walnut-faced Murdoch clowning around."

Earlier, the hackers tweeted this taunt: "Arrest us. We dare you. We are the unstoppable hacking generation and you are a wasted old sack of shit, Murdoch. ROW ROW FIGHT THE POWER!"

Updated 6:18 p.m. PT with more details and background on the phone hacking scandal and repercussions and late LulzSec tweets, and reports of release of Sun employee data.

View the original article here

Read More

Hackers tamper with Sun website

19 July 2011 Last updated at 11:10 GMT Visitors to the Sun's website were redirected to this spoof page A group of computer hackers has tampered with the website of the Sun, owned by News International.

At first, readers were redirected to a hoax story which said Rupert Murdoch had been found dead in his garden.

A group of hackers called Lulz Security, which has previously targeted companies including Sony, said on Twitter it was behind the attack.

Visitors to the Sun website were then redirected to the group's Twitter page, before News International took it down.

News International said it was "aware" of what was happening but made no further comment.

Readers trying to access thesun.co.uk were taken to new-times.co.uk and a story entitled "Media mogul's body discovered".

It suggested that Mr Murdoch had been found after he had "ingested a large quantity of palladium".

Disbanding

After that site stopped working, the Sun's address was re-directing to LulzSec's Twitter account, which claimed to be displaying "hacked internal Sun staff data" in one entry.

In another, the group said: "Arrest us. We dare you. We are the unstoppable hacking generation..."

Continue reading the main story Iain Mackenzie Technology reporter, BBC News

The attack on the Sun website is in line with LulzSec's "hacktivist" ethos. Although it claims to do what it does for laughs, the group usually has a point to make.

Often it is trying to raise awareness of the poor security measures put in place by large organisations.

However, some of its hits have been more overtly political. In one case, LulzSec broke into the website of US broadcaster PBS after it showed a documentary that was critical of Wikileaks.

The attack on the Sun website has LulzSec's fingerprints all over it, with the combination of a mischief-making news story, and a target that is seen as being involved in corporate wrongdoing.

Clearly this is not the most significant development in the scandal currently engulfing News International. But the turning of the hacking tables is, at least, curiously ironic sideshow.

It is thought the Times website and the News International corporate website were taken down by the company as a precaution on Monday evening.

BBC technology reporter Iain MacKenzie said the attack on the Sun website was in line with LulzSec's "hacktivist" ethos, with the combination of a mischief-making news story, and a target that is seen as being involved in corporate wrongdoing.

He said: "Clearly this is not the most significant development in the scandal currently engulfing News International. But the turning of the hacking tables is, at least, curiously ironic sideshow."

Last month the hacking group announced it was disbanding.

Lulz Security made its announcement through its Twitter account, giving no reason for its decision.

A statement published on a file-sharing website said that its "planned 50-day cruise has expired".

The group leapt to prominence by carrying out attacks on various high-profile companies.

The first came in May 2011 when the hackers targeted Fox.com in retaliation for calling rapper and entertainer Common "vile" on the Fox News channel.

A month later, they turned their attention against Sony, taking data from thousands of people including names, e-mail addresses and dates of birth.

The group has also cyber-attacked broadcaster PBS, the CIA, and the United States Senate.

As a parting shot, it released a selection of documents apparently including confidential material taken from the Arizona police department and US telecoms giant AT&T.

View the original article here

Read More

'Hackers' held in US and Europe

19 July 2011 Last updated at 23:18 GMT Anonymous rose to fame attacking the Church of Scientology and Kiss bassist Gene Simmons Police in the US, Britain and the Netherlands have detained more than 20 people as part of an investigation into major cyber attacks.

Most of the arrests were in the US, where the FBI said 16 people had been held for alleged computer hacking.

Fourteen of them were suspected of an online attack on PayPal, claimed by hacking group Anonymous, said the FBI.

In Britain, a teenager was arrested in London, while four other suspects were detained by police in the Netherlands.

Wikileaks 'revenge'

The US indictment against 14 of those arrested on suspicion of December's attack on PayPal said it had been "retribution" for the site closing a donation account for the whistleblowing website Wikileaks.

The PayPal attack suspects were arrested in Alabama, Arizona, California, Colorado, Washington DC, Florida, Massachusetts, Nevada, New Mexico and Ohio, US officials said in a statement.

Investigators believe Anonymous is mostly made up of hackers in their teens and early 20s

The other two US suspects were held under separate indictments but similar charges in Florida and New Jersey.

In the UK, Scotland Yard told the BBC that it had arrested a 16-year-old boy in south London on suspicion of breaching the Computer Misuse Act 1990.

"The Metropolitan Police is liaising with the FBI and indeed with our Dutch colleagues," a Scotland Yard spokesman said.

As well as attacking PayPal, Anonymous also temporarily shut down MasterCard and Visa last December, after they froze Wikileaks accounts.

Anonymous targeted Amazon, too, after it removed Wikileaks content from one of its servers, but that attack was not successful.

The hacking group has used a technique known as a distributed denial of service (DDoS) in an attempt to take the sites offline.

DDoS attacks bombard a website with data until it cannot respond, rendering it inaccessible.

Anonymous rose to fame with a series of attacks on websites linked to the Church of Scientology and Gene Simmons, bassist with the rock group Kiss.

View the original article here

Read More