#inj3ct0r

[fileencryption]

vBulletin experiencing major security breach – user password change is mandatory

vBulletin admits to have been hacked and is currently investigating the matter. The company also issued a statement regarding this breach, advising all users to immediately change their credentials, after a master password reset: “Very recently, our security team discovered sophisticated attacks on our network, involving the illegal access of forum user information, possibly including […]

The post vBulletin experiencing major security breach – user password change is mandatory appeared first on SecurEncrypt - HIPAA/HITECH File Encryption Software. #security

via SecurEncrypt http://ift.tt/17nCNwf

[coder-maf]

A good website to learn tips & tricks

[knowtoomuch]

nasa...get your shit together... don't make me go in and start patching shit ffs.. i will require a free trip to the moon and a few hundred thousand dollars...aren't the scientists  there suppose to be on their shit...come on lol. so lucky they gave you a pass but that shit needs to be fixed!! this shit makes me think about the old days though when it first got hacked. milw0rm ytcracker etc.

Members of two hacker collectives, Team r00tw0rm and Team inj3ct0r, identified an SQL injection vulnerability on one of the subdomains owned by NASA and hosted on the domainnasa.gov. By leveraging the security hole, the hackers obtained a 6 gigabyte database, but refused to disclose the name of the flawed subdomain to give the agency time to patch it up.

A sample of the database reveals information such as usernames, email addresses, names, IDs, login dates, passwords, and other data. “Complete Database is in GB's, well we aren't leaking it. We may keep all parts in our private home! Yet only little bit dump or few columns data is released just to inform NASA that being National Aeronautics and Space Administration you must also keep your servers up to date!” the hackers said. They claim they informed NASA a few days ago, but since the organization failed to respond, they leaked part of the database to attract the agency’s attention. NASA domains and subdomains have been found to be vulnerable on numerous occasions in the past several days. Members of TeamHav0k also found a subdomain that can easily be exploited by hackers. They identified a cross-site scripting (XSS) vulnerability and made a screenshot to prove their findings. “Well here’s another XSS in NASA.... I was surprised at how easy it was just a simple check of the src of the page they only filtered out stuff like < / > and i think the = as well,” a TeamHav0k representative said. Last week the Kennedy Space Center was found to contain a similar weakness, but after being contacted, the site's administrators promised to look into it. A few years ago the veterans of the hacking scene proved their skills by hacking into NASA. Now, the organization has so many sites and they’re so full of security holes that it’s hard for even a novice hacker to resist the temptation.

[h4x0r3d]

  Members of two hacker collectives, Team r00tw0rm and Team inj3ct0r, identified an SQL injection vulnerability on one of the subdomains owned by NASA and hosted on the domain nasa.gov. By leveraging the security hole, the hackers obtained a 6 gigabyte database, but refused to disclose the name of the flawed subdomain to give the agency time to patch it up. A sample of the database reveals information such as usernames, email addresses, names, IDs, login dates, passwords, and other data. “Complete Database is in GB's, well we aren't leaking it. We may keep all parts in our private home! Yet only little bit dump or few columns data is released just to inform NASA that being National Aeronautics and Space Administration you must also keep your servers up to date!” the hackers said. They claim they informed NASA a few days ago, but since the organization failed to respond, they leaked part of the database to attract the agency’s attention. NASA domains and subdomains have been found to be vulnerable on numerous occasions in the past several days. Members of TeamHav0k also found a subdomain that can easily be exploited by hackers. They identified a cross-site scripting (XSS) vulnerability and made a screenshot to prove their findings. “Well here’s another XSS in NASA.... I was surprised at how easy it was just a simple check of the src of the page they only filtered out stuff like < / > and i think the = as well,” a TeamHav0k representative said. Last week the Kennedy Space Center was found to contain a similar weakness, but after being contacted, the site's administrators promised to look into it. A few years ago the veterans of the hacking scene proved their skills by hacking into NASA. Now, the organization has so many sites and they’re so full of security holes that it’s hard for even a novice hacker to resist the temptation.

[h4x0r3d]

- The hackers show their support for AntiSec

The official website of the US Census Bureau (census.gov), the government organization that gathers demographic and economic data, was hacked by members of r00tw0rm and inj3ct0r, the hackers obtaining what they call a “secret zip file.” A Pastebin file reveals a sample of the data they obtained from the agency’s servers, including table names and columns. According to the hackers, this hack was performed to attract the attention of the site’s administrators and determine them to patch up the security holes, but also to show their support for AntiSec. The same hacker collectives managed to gain access to a NASA subdomain, obtaining 6 gigabytes worth of information. They took the time to notify the Space Administration of the vulnerability and leaked only part of the database to prove that they possess the data.

[urbanareas]

[networkspokesman-blog]

inj3ct0r ataca servidor web de la OTAN

Ayer día 5 inj3ct0r, el conocido grupo hacker, anunció su ingreso al servidor web de la OTAN. Para probarlo, publicó2.646 archivos comprimidos en uno de nombre NATO Tomcat 5.5 Servlet Backup Ph33r 1337day.com.zip. Le dejó este mensaje:

      NATO lamers! I’ve been watching you day and night since then! W00t! Your Machines               rooted! Servers restored to default! what else! Fuck you and your crimes! and soon enough         all your stupid ideas will be published on WikiLeaks!

      Greetz.. I stand alone :)

The Hacker News habló con ellos. La principal razón del hacking es el apoyo de la OTAN al desarrollo y financiación de armas nucleares. Para conseguirlo, inj3ct0r utilizó un exploit 0day, es decir, una vulnerabilidad probablemente descubierta por ellos, contra el servidor Tomcat 5.5 que sirve las páginas web de la OTAN. El exploit les permitió ingresar con privilegios de administrador al sistema.

Lo normal en esos casos es que el atacante haga un web defacement, un cambio en el contenido de la página para presentar un mensaje político-social, una broma, o simplemente una especie de tarjeta de presentación. Sin embargo, inj3ct0r sólo respaldó el servidor para entregarlo a la red.

Los archivos conservan la estructura típica de un servidor Tomcat. A primera vista, no aparece información relevante. Salvo archivos de configuración del propio servidor, con las contraseñas colocadas por defecto por los propios hackers. Muy pocos de ellos evidencian que pertenecen a la OTAN. Ésta, por su parte, al momento de escribir estas líneas no ha confirmado el ataque y su servidor parece correr con normalidad.

La OTAN manifestó semanas atrás la existencia de un ataque, aunque entonces la información sustraída pertenecía a un servidor administrado por un tercero para su servicio “NATO e-Bookshop”.

inj3ct0r es bien conocido por su foro —caído al momento de escribir estas líneas—, y por sus exploits contra Facebook en 2009, utilizando la tradicional técnica de inyección sql. Sitios hacker como Carders.cc, Backtrack-linux.org y Exploit-db.orgtambién cayeron. En otra entrevista ofrecen un par de reflexiones interesantes sobre el arte de vulnerar sistemas:

¿Crear exploits es un crimen o ayuda a los desarrolladores? Hay un ying para cada yang. Si hay desarrolladores, ¡habrá hackers! Sólo estamos balanceando la ecuación con nuestra existencia.

¿Qué mensaje le gustaría dar a la comunidad hacker que se suscribe a su revista? Se un chico. Se sincero, no serio, en todo lo que hagas. Si no lo disfrutas, no lo vas a hacer bien.

Las motivaciones de inj3ct0r son técnico-políticas; algo que no debe extrañarnos hoy en día.