United States Department of Defense data leaked by Anonymous hackers

A group called the "Wikiboat" belongs to Anonymous hackers have attacked the Defense.gov website and leaked data from the website. They have published the leaked data to the pastebin note. Also, today the Wikiboat targeted the GEMA.de website and took it offline.

The leaked data includes some officials name, Emails ID's and Phone numbers as shown below:

Hackers claim that, they have not collect this data from any SQLi vulnerability, even this data is collected form other sources. Three weeks before they was threatening to take down the websites of companies like Apple, Bank of America and Toyota and leak sensitive data.

As part of its "Operation New Son ' they announced to attacks on a number of international companies.

Read More..

LulzSec hacker - Brit Ryan Cleary charged for Sony and Fox hacks

A 20-year-old Briton suspected of links to the hacking group Lulz Security is accused of cracking into websites for a Fox reality TV show, a venerable news show and other sites to deface them or steal personal information, federal prosecutors said Wednesday.

Ryan Cleary, 20, reportedly had ties to the well-known branch of Anonymous called LulzSec before he was arrested in London last June (although the hacktivist group denies his involvement with it). U.S. federal prosecutors said today that he worked to take down, deface, and steal personal information from Web sites.

In a separate and similar case filed against Cleary in the United Kingdom in 2011, he faces allegations that he and others hacked a law enforcement agency, the Serious Organized Crime Agency, and various British music sites - all while he was still a teenager.

Commenting on Tuesday’s indictment, FBI spokesperson Laura Eimiller said, “Cleary is a skilled hacker. He controlled his own botnet, employed sophisticated methods and his broad geographic scope affected a large number of businesses and individuals.”Those businesses included Sony Pictures Entertainment, Fox Entertainment and the Public Broadcasting Service.

The attacks, carried out between April and June last year, made international headlines as global companies began to wonder if they would be next to suffer at the hands of LulzSec, an off-shoot of the larger Anonymous hacking group.

Cleary is charged with one count of conspiracy and two counts of unauthorized impairment of a protected computer. He faces a maximum sentence of 25 years in prison if convicted.

In September 2011, the FBI arrested LulzSec member Cody Kretsinger, a 24-year-old Phoenix citizen. He pleaded guilty to participating in an attack on Sony Pictures’ website, stealing personal information from registered users of the site and, according to Sony, causing over $500,000 of damage in the process.

Read More..

MALWARE - June 2012 | The Hacker News Magazine Released

Welcome readers, techies working in the darkness of night and any other internet security minded folk. June finds us exploring the new "F" word: Malware. You will learn lots from our regular author, Perluigi Paganini as he takes you through the history of malware and its consequences.

We introduce two new authors, Charlie Indigo who will get your mind to thinking about the future of internet security and just what kind of world we will be living in. Gerald Matthews gives us an overview of malware and how the FBI, of all people, helped us out.

Our founder, Mohit Kumar writes about the topic in general and Ann Smith ,Our Executive Editor, of course, will wow you with a thorough provoking editorial. Thanks again for your readership......we hope to hear from you soon.

Download MALWARE - The Hacker News Magazine

Read More..

Google's MarkMonitor account hacked by #UGNazi via Social Engineering

The well-known Hacker group UGNazi claimed that they gained access to the Google's MarkMonitor account.  According to their press release, hackers managed to reset the account via social engineering attack. 

"The agent that helped us reset the account should get some what of credit, she helped us alot on reseting Google's MarkMonitor account " hacker said in the press release.

"3 Days ago, We gained access into Google's registrar MarkMonitor, the following picture goes to show how no one is safe http://i.imgur.com/KDWja.png" The tweet from hackers account reads.

"i suggest you move to a more secure registrar. but then again, we are Social Engineering Gods." The statement clearly shows the group is strong in social engineering attacks. Earlier of this month, the group hacked the WHMCS via social engineering attack.

"So, this just goes to show, even Google can be Social Engineered. P.S. It was Google's Account Manager, Olga Was, so technically, we did Social Engineer Google. :)."Hacker said.

At the time of writing, there is no official statement made from Google or Mark Monitor about the hack.

Read More..

Windows 7 Manager 4.0.8

Windows 7 Manager 4.0.8 + crack/serial/keygen
Size: 13 MB

Windows 7 Manager is a system utility that helps you optimize, tweak, and clean up Windows 7. It will increase your system speed, improve system security, and meet all of your expectations.

Why Should I use Windows 7 Manager?

Windows 7 is the newest Operating System for home users and professionals alike. Windows 7 brings clarity to your world, so you can more safely and easily accomplish everyday tasks and instantly find what you want on your PC.

Windows 7 Manager is the powerful software tool to tweak and optimize your Windows 7, it bundles more than 30 different utilities in one and help your system faster and more stable, secure and personal!

Features and Benefits of Windows 7 Manager

Information

Get detailed system and all hardware information on your system; help you find out the installation key of Windows, Office products; show all detailed information of running processes and threads on your machine; Windows 7 Manager offers 1-clicking cleans your system automatically.

Optimizer
Tweak your system to improve windows startup and shutdown speed; tweak your hardware to increase system speed and performance; Optimize Task Schedule to turn off unnecessary system tasks.

Cleaner
Find out which files or folders engross your disk space and shown with chart; Find and clean junk files to increase Hard Disk space; Duplicate Files Finder can scan your computer for files with the same size, name and modification time; Registry Cleaner can easily checks your registry and repair incorrectly linked registry entries, automatically remove invalid entries; Registry Defrag rebuilds and re-indexs your registry to reduce application response time and registry access time.

Customization
Control what is started on Windows startup; tune up Windows 7 boot menu; edit context menus of mouse Right-Clicking; customize system desktop, menus, toolbar and notifications settings; automatically change your desktop wallpaper on background.

Security
You can improve desktop, menus, Windows logon securities, and enable numerous hidden performance options of system, disable system updates and error reports; hide and restrict to access drives, specify which applications are not allowed to be executed on your computer; encrypt/decrypt and shred files, change the location of system folders; Privacy Protector can maintain your personal privacy by eliminating the tracks that you leave behind; create lots of randomization password once.

Network
Optimize your Internet connection speed, manage all shares items; tweak your Internet Explorer easily.

Misc. Utilities
Show the collection of Windows utilities; split and merge any file.

Download : Rapidgator  Depositfiles  Turbobit

Read More..

SUPERAntiSpyware Professional 5.1.1002

SUPERAntiSpyware Professional 5.1.1002 Final + crack/serial/keygen
Size: 18 MB

SUPERAntiSpyware is the most thorough scanner on the market. Our Multi-Dimensional Scanning and Process Interrogation Technology will detect spyware that other products miss! SUPERAntiSpyware will remove ALL the Spyware, NOT just the easy ones! SUPERAntiSpyware features our unique Process Interrogation Technology (PIT) that allows threats to be detected no matter where they are hiding on your system. Many new types of threats utilize "Rootkits" or "Kernel Drivers" to hide themselves to avoid detection by standard anti-spyware applications.

SUPERAntiSpyware's Process Interrogation Technology locates even the toughest of threats. SUPERAntiSpyware is a next generation scanning system that goes beyond the typical rules based scanning methods. Our Multi-Dimensional Scanning system detects existing threats as well as threats of the future by analyzing threat characteristics in addition to code patterns.

Features:
• Quick, Complete and Custom Scanning of HDD, Registry, Memory and more
• Detect and Remove Spyware, Adware, Malware, Trojans, Dialers, Worms, KeyLoggers and many other threats
• Repair broken Internet Connections, Desktops, Registry Editing, Task Manager and more
• Real-Time Blocking of threats
• Schedule either Quick, Complete or Custom Scans Daily or Weekly
• Quarantine items detected and removed for complete protection
• Detailed scan logs with complete information about detected and removed threats and their locations

Download : Rapidgator  Depositfiles 

Read More..

TweetGif hacked and 10,000 Twitter Users data dumped by LulzSec Reborn

The hacker group known as "LulzSec Reborn" claimed to have hacked into the TweetGif website (tweetgif.com) and compromised the database. TweetGif is a thirt-party twitter app that lets users share animated GIFs.

After the security breach, the hackers dumped a part of database that containing the credentials for more than 10,000 Twitter accounts. The dump contains access tokens and the associated access token secrets which can be used to access users' Twitter accounts.

The leak also contains users names, locations, bio information, links to avatars, and the date of the last update.

The tokens remain valid even when the account password is changed. If you used the app, all you need to do is head into Twitter's settings and revoke access to the app—no massive password changes required.

Read More..

Delta Force Xtreme 2 Full Crack.. As these games with the FPS genre that has been "Free Full Download" share previously, the PC game Delta Force Xtreme 2 Full Crack, we will be given a variety of exciting missions and also very entertaining. A fierce battle with rebel groups, ambushes, hostage rescue and other missions will colorize our adventures as a member of the elite anti-terrorist detachment of the U.S. military. For those of you who are interested in trying to play the game Delta Force Xtreme 2 Full Crack, please download.

Delta Force Xtreme 2 Full Crack screenshot:

Delta Force Xtreme 2 Full Crack System Requirements:

• Video Card: Direct3D video card with 64 MB or higher
• OS: Windows® XP, VISTA (32 & 64 bit editions)
• CPU: Pentium® 4 Minimum CPU Required
• RAM: 1 GB or greater required
• Hard Drive: 2 GB available
• Direct X: DirectX 9.0c or greater required
• Internet: Up to 150 simultaneous players via NovaWorld

How to install Delta Force Xtreme 2 Full Crack:

1. Extract
2. Change the extension. Rar to iso. Example:
   - [www.indowebster.com]-rld-dfx2.rar
   - [www.indowebster.com]-rld-dfx2.iso
3. Mount / Burn ISO file
4. Run setup to install
5. Copy and paste crack file into the game installation directory
6. Completed

Download Delta Force Xtreme 2 Full Version - (969MB)

Read More..

Video Booth Pro 2.4.1.8 Full Crack

Video Booth Pro 2.4.1.8 Full Crack is an interesting software that will maximize the ability of the webcam to take pictures and make videos from your laptop screen. By leveraging the Video Booth Pro 2.4.1.8 Full Crack, you can provide a variety of interesting effects to beautify and enhance your pictures or videos has take with your webcam.

Video Booth Pro 2.4.1.8 Full Crack screenshot:

Video Booth Pro 2.4.1.8 Full Crack Features:

• Take snapshots - capture your special look easily.
  Video Booth makes it easy to take snapshots with your built-in or computer-connected cameras. Just launch this application, locate images, and click. Take a single picture or take four pictures in succession using the "Continuous Shooting" mode which makes your pictures more special. Before photo is snapped, Video Booth flashes your screen to let you know that it is taking the last display showing in the main window.
• Record video clips smoothly and stably.
  With Video Booth, recording video clips by your webcam is fairly easy, just clicks away. What more importantly is that the video clips captured by Video Booth are very smooth and stable. Effects can be added to your video and make it more fun to upload to YouTube and to share with your family and friends.
• Adding some effects and see how fascinating it could be.
  Using the effects to transform your look, make your smiles fantastic or freaky. Snap a picture of yourself in outer space, or take a walk in a beautiful fall woods. Start your journey of fun with all these effects offered by Video Booth which work perfectly for snap shooting and video recording.

How to install Video Booth Pro 2.4.1.8 Full Crack:

1. Extract
2. Run setup to install
3. Copy & Replace crack file to:
   C:\Program Files\VideoBooth
4. Completed

Download Video Booth Pro 2.4.1.8 Full Crack - (13MB)
Password: koskomputer

Note: If you feel the effects available options in the video booth pros still lacking a lot, please go to the link below to download other interesting effects:

Read More..

Flame and Stuxnet malware unleashed by same Master

Two weeks ago, when we announced the discovery of the Flame malware we said that we saw no strong similarity between its code and programming style with that of the Tilded platform which Stuxnet and Duqu are based on.

Flame and Tilded are completely different projects based on different architectures and each with their own distinct characteristics. For instance, Flame never uses system drivers, while Stuxnet and Duqu’s main method of loading modules for execution is via a kernel driver.

But it turns out we were wrong. Wrong, in that we believed Flame and Stuxnet were two unrelated projects.

Our research unearthed some previously unknown facts that completely transform the current view of how Stuxnet was created and its link with Flame.

The Flame inside Stuxnet

First of all, let’s recap the Stuxnet story. We managed to recover just three different variants of the worm, created in June 2009, and in March and April 2010.

The March 2010 variant was responsible for the greatest number of infections and was detected in June 2010 by specialists from the company VirusBlokAda in Belarus. This particular version was subjected to the most detailed analysis by anti-malware companies.

Shortly afterwards, when news of Stuxnet had already become widespread, files related to its June 2009 incarnation were detected. This version, the so-called Stuxnet.A (1.0), differed considerably from the 2010 variants.

The main differences were:

• The 2009 variant didn’t use the MS10-046 LNK file vulnerability
• In 2009, Stuxnet only had one driver file; in 2010 there were two (the second was added specifically to work with the LNK vulnerability)
• In 2009, Stuxnet used a special trick with the “autorun.inf” file to infect USB drives.

All the other differences involve minor modifications to Stuxnet’s internal structure – some modules were deleted and their functions transferred to other modules.

The most significant of those changes involved “resource 207”.

Resource “207” is 520,192 bytes in size and can be found in the 2009 version of Stuxnet. It was later dropped altogether in the 2010 version, its code merged into other modules.

List of resources in the March 2010 variant of Stuxnet

List of resources in the 2009 variant of Stuxnet

Despite the fact that Stuxnet has been the subject of in-depth analysis by numerous companies and experts and lots has been written about its structure, for some reason, the mysterious “resource 207” from 2009 has gone largely unnoticed. But it turns out that this is the missing link between Flame and Stuxnet, two seemingly completely unrelated projects.

The Tocy story

In October 2010, our automatic system received a sample from the wild. It analyzed the file thoroughly and classified it as a new Stuxnet variant, Worm.Win32.Stuxnet.s.

With Stuxnet being such a big thing, we looked at the sample to see what it was! Sadly, it didn’t look like Stuxnet at all, it was quite different. So we decided to rename it to Tocy.a and thought “silly automatic systems!”.

When Flame was discovered in 2012, we started looking for older samples that we might have received.Between samples that looked almost identical to Flame, we found Tocy.a.

Going through the sample processing system logs, we noticed it was originally classified as Stuxnet. We thought, how was it possible? Why did the system think that this Flame sample was related to Stuxnet? Checking the logs, we discovered that the Tocy.a, an early module of Flame, was actually similar to “resource 207” from Stuxnet. It was actually so similar, that it made our automatic system classify it as Stuxnet. Practically, Tocy.a was similar to Stuxnet alone and to no other sample from our collection.

Going back to the story, this is how we discovered the incredible link between Flame and Stuxnet.

Resource 207

Resource 207 is an encrypted DLL file that contains another PE file inside (351,768 bytes).

Information about the date of the module’s creation

Information about the file in the resource 207

This PE file, 351,768 bytes in size, is actually a Flame plugin.

Or, to be more precise, "proto-Flame" – a module that obviously has a lot in common with the current version of “mssecmgr.ocx” and which had evolved into Flame by 2012.

We think it’s actually possible to talk about a ‘Flame’ platform, and that this particular module was created based on its source code.

A few days ago on Twitter I saw a rather humorous tweet that said Flame was so “hardcore” that a whole Stuxnet was contained in its bases. It turns out that Stuxnet’s resources actually contain a Flame platform component!

The correlations with the current variations of Flame include the following:

• Mutex names: TH_POOL_SHD_PQOMGMN_%dSYNCMTX andTH_POOL_SHD_MTX_GMN94XQ_%d
• String decryption algorithm
• Mangled class names: ?AVnxys_uwip and so on.
• Similar name to that used in the Flame architecture - with .ocx files (atmpsvcn.ocx)

Moreover, the file contains hallmarks that were earlier considered exclusive to Stuxnet:

• Names of “trigger” files: %temp%\dat3A.tmp & snsm7551.tmp
• Utilitarian module parsing functions and their interrelation and architecture
• Principles for assembling function return codes
• Similar shellcode style
• Structure for describing the version of vulnerable operating systems and checking algorithm
• Its own import

This is atmpsvcn.ocx – a Flame platform module inside Stuxnet.

Interestingly, the current variants of Flame rely on the dat3C.tmp file, whereas the Flame module inside Stuxnet used the “dat3a.tmp” file as an identifier to flag its presence in the system. One can wonder if there was also a “dat3b.tmp” somewhere in time.

Whole pieces of code from the latest Flame modules are identical to the code in atmpvsvcn.ocx. Of course, the most obvious similarity is the mutex names:

TH_POOL_SHD_PQOMGMN_%dSYNCMTX
TH_POOL_SHD_MTX_GMN94XQ_%d

Moreover, there are other known Flame modules using mutex TH_POOL_SHD_MTX_FSW95XQ_%d, that we have dated to 2010, e.g. comspol32.ocx.

The matches are even more impressive at the code level:

getdecrypted function from Resource 207

getdecrypted function from mssecmgr.ocx

DecrypString function from Resource 207

DecryptString function from mssecmgr.ocx

DecryptString function from browse32.ocx (the Flame uninstaller module circulating in May-June 2012)

Mutex used in Resource 207

Mutex used in mssecmgr.ocx

Resource 207’s main functionality was to ensure Stuxnet propagation to removable USB drives via autorun.inf, as well as to exploit a then-unknown vulnerability in win32k.sys to escalate privileges in the system at stage of infection from USB drive.

Map of resources in Stuxnet 2009

Spreading via autorun.inf is another trick that the Stuxnet 2009 version and the current variants of Flame have in common. Resource 207 operates as an infector of removable drives, copying “Flame” module as “autorun.inf” file to removable media and adding a special real autorun.inf file at end of PE file. The Main body of Stuxnet copied to USB drive as “~XTRVWp.dat” file.
The PE file is correctly processed by the operating system as real autorun.inf and hence the module is executed when an infected device is accessed.

After this, the Flame module loads ~XTRVWp.dat (main Stuxnet body) from the USB drive and injects it to system process via using EoP vulnerability.

This particular code, which exactly matches the code in resource 207, is currently used by Flame, where it is executed by the “Autorun_infector” module.

An old 0-day

The Stuxnet Resouce 207 Flame-module contains an Escalation of Privilege exploit and is using it at stage of infection from USB drive for injecting main Stuxnet body to system processes. This is of interest in its own right.

The exploit code in the file atmpsvcn.ocx is similar to that which we, Kaspersky Lab, found in the 2010 versions of Stuxnet and which was subsequently addressed by the MS10-073 patch. The code’s style, logic and details of its implementation were the same in the 2009 and 2010 code. Clearly, these two pieces of exploit code were written by the same programmer.

However, a different exploit targeting a different vulnerability, which was older and was patched by 2010, was used in the 2009 version of Stuxnet.

At the time when “resource 207” was created (February 2009), the vulnerability was not publicly known and was thus, it was a true 0-day vulnerability.

Essentially, the vulnerability consists of the absence of input data checking, allowing the NtUserRegisterClassExWOW() function to overwrite a WORD of data beyond the allocated memory range in win32k.

The function’s address in the _gpsi structure is overwritten with the address of the shellcode in two steps. Then the NtUserMessageCall() function is called, which passes control to the shellcode with kernel-level privileges.

Neither function is exported to user mode, which means that addresses and parameters for calling services directly can be found by parsing modules on disk (user32&win32k).

This vulnerability description is strikingly similar to that of vulnerability “Windows Kernel Could Allow Elevation of Privilege (968537)”, which was closed in June 2009 with patch MS09-025; however, we are still analyzing the code and can’t provide a 100% confirmation of this as yet.

The main function exploiting the EoP vulnerability in Stuxnet 2009

The main function exploiting the EoP vulnerability in Stuxnet 2010

Code used to call controlled functions in the 2009 vulnerability

Code used to call controlled functions in the MS010-073 vulnerability

Conclusions

Our analysis suggest several important conclusions, which we summarize below:

• By the time Stuxnet was created (in January-June 2009), the Flame platform was already in existence (we currently date its creation to no later than summer 2008) and already had modular structure.
• The Stuxnet code of 2009 used a module built on the Flame platform, probably created specifically to operate as part of Stuxnet.
• The module was removed from Stuxnet in 2010 due to the addition of a new method of propagation (vulnerability MS10-046) instead of the “old” autorun.inf
• The Flame module in Stuxnet exploited a vulnerability which was unknown at the time, a true 0-day. This enabled an escalation of privileges, presumably exploiting MS09-025
• After 2009, the evolution of the Flame platform continued independently from Stuxnet.

The above conclusions point to the existence of two independent developer teams, which can be referred to as ”Team F” (Flame) and ”Team D” (Tilded). Each of these teams has been developing its own platform since 2007-2008 at the latest.

In 2009, part of the code from the Flame platform was used in Stuxnet. We believe that source code was used, rather than complete binary modules. Since 2010, the platforms have been developing independently from each other, although there has been interaction at least at the level of exploiting the same vulnerabilities.

Read More..