XBox Live Hacked or Suffering Connection Issues

Today Xbox Live users are suffering some Connection Issues and this is excepted as yesterday only the Xbox live account of Xbox’s Live Programming director’s was Hacked. So this points to the Xbox Live is been hacked aka compromised.

It is more likely that the Xbox live is hacked as the account of one of the makers of the Xbox live account was hacked yesterday only. While this can be a Connection issues too as the Expansion pack of Modern Warfare : “Stimulus Package” is out today which may have caused problems for the Xbox live servers as of large incensement in the connections ...

 

Xbox Support’s Twitter account is loaded with communications with customers about the problem, and the official support website at www.xbox.com/support is being bombarded by users.

 

“We’re aware of the issue and it is being worked on. Stay tuned for updates.”

 

An error code of 80150019 have been shown to the users of the Xbox live users. As the users are like not happy with this situation and would be likely as the Microsoft is in problems again.

 

… Talking about the Hacked account of Major Nelson’s of Xbox Live, Shortly after the hack happened, the Web site Lightzz took credit for the hack, posting a video of it, along with the hacker's Skype name. He is offering to hack other accounts as well.

 

Well whatever is going we will update this post as soon as Microsoft figures it out is it hacked or connection issues.

Read More

Ubisoft Hacked : Fake or Real ?

Some days ago we got news about Ubisoft being hacked by some hackers and was being believed till yet but after then some news breached out that the images of the hack was fake.

 

So, this is kind of big story. The ubisoft is a company which is been known and you can say is good in DRM and Anti-Hackers activity, as you can see there games such as Assassin's Creed and many others have been out of cracked games folder and are a DRM king game…

 

But as you can see we and most ‘em gamers won't be happy with the Ubisoft’s way of gamming. So what they do they hacked the Ubisoft’s website for a short while some days ago on 14th March 2010.

 

Its right if you see it from my mindset :D but as they gamers are freaked out on the ubisoft for there way of gaming products. This is what would be happing as of crackers won't be so patient to crack some ubisoft shit.

Screen’s

 

 

 

When it Faked out

2nd part starts now when some news break out that the images of the hack were fake and The ubisoft’s was down just for the maintenance work. Well we don't know if the site was hacked or not but various sources are saying it was and some are saying it wasn't.

 

Whatever is the truth the thing here is that DRM is what lets every hacker to work against any company. You don't believe me then see iPhone, iPod, Halo, Call Of Duty etc are some victims of DRM which hackers and crackers have cracked out.

 

Screen’s

 

 

This image shows another story of the incident which Ubisoft would have gone through. Whatever happened.

 

What Do You Think Fake Or Real ?

Read More

BlackBerry Smoked at ShmooCon : Spyware

Just few days ago the big ShmooCon 2010 took place at the Washington DC from 5th to 7th of this month. It was obvious that some new would come from the con, and yes, one security researcher have done it.

BlackBerry phones have been hit this time with a new spyware which can do alot of stuff like the ability to access and dump the BlackBerry's contacts, email messages, phone logs, the device's current location and the recording made by the BlackBerry's microphone….

 

And the program which hacks the blackberry is called txsBBSPY written by Tyler Shields, a senior security researcher at Veracode, Well it seems that the engineers would be working on it.

 

The great thing about this software is that we don't need to make it hidden on some firmware or something its an application for the BlackBerry phones. Just install it and you can monitor the stuff you want to do.

 

“ The application was built using the controlled APIs that Research In Motion, the BlackBerry's maker, makes available to developers. In order to sign a BlackBerry application developed using these APIs, the developer has to apply for the signing keys and pay a small fee.

 

Once he has the keys, he can sign the application and a hash of the code is sent to RIM. However, RIM doesn't get the full source code of the application. ”

 

"Finally, it should be noted that while we chose BlackBerry for our proof-of-concept, this is not just a BlackBerry problem. All mobile platforms provide similar mechanisms for writing applications that have access to the user’s personal, potentially sensitive information," Eng writes.

 

 

TXSBBSpy Demo from Veracode on Vimeo.

 

 

Here is the video which they have used to demonstrate the idea behind this spyware. Hope you guys enjoy it and there are some good news too which adds fire to this thing is that these guys have also released the spyware source code.

 

Here are the source codes and the slides of this demonstration which you will need more then me.

Slides: Blackberry Mobile Spyware — The Monkey Steals the Berries
Source: txsBBSpy.java

Conclusion

This brings me to a conclusion that its not necessary that the official App stores are always safe as the if i could make this application and distribute in the open then anybody can do that.

 

Well that's what they also want to prove with this spyware to the industry and it makes sense to me as they have also said this can be done to many of the other mobile phones like iPhones etc.

 

Happy Hacking @hackerthedude

Read More

Can You Believe Playstation 3 Just Got Rooted - Geohot

Well its kinda like the days are over of PS3 to be called secure because of a true fact that, the hacker behind some of the iPhone jail breaking and iPod too is behind the Playstation 3 Hardware and is nearly finished with the exploit.

 

 

On 22nd of this month the so known hacker George Hotz aka Geohot have claimed that he have successfully hacked the play station 3 box which he got from his friend.

 

“I have read/write access to the entire system memory, and HV level access to the processor. In other words, I have hacked the PS3. The rest is just software. And reversing. I have a lot of reversing ahead of me, as I now have dumps of LV0 and LV1. I've also dumped the NAND without removing it or a modchip.”

 

The exploit which he is talking about and is working on is not till yet done and haven't been released by him….

 

As of now the Geohot is kind of quite about the exploit and its usage and writing about it :

 

“As far as the exploit goes, I’m not revealing it yet. The theory isn’t really patchable, but they can make implementations much harder.”

 

Well lets see what happens when the exploit would be out and there would be fight between the sony and geohot on the security hole as he is also not sure about the whole thing that it could be patched or not.

 

In particular, he said, he would publish details of the console's "root key", a master code that once known would make it easier for others to decipher and hack other security features on the console.

 

On the other hand the sony officials are working hard to find what the George finded in the console. As of now they have said "We are investigating the report and will clarify the situation once we have more information,".

 

He says alot of reverse engineering have been left for him with the box to hack it fully.

 

Lets hop he finds the right exploit to hack the ps3. As it would be the first time after 3 Years and 2 months and some days that the Sony ps3 which is so know for its security is hacked successfully in which anybody can run pirated games and even modify them.

 

 

Hope For the Best ..

Read More

Techcrunch Hacked

TechCrunch : The biggest network of tech news showdown and one of the most visited websites in the world have been hacked just 11 minutes later we got this news. I am investigating about it, as soon we will get the news we will update this post.

 

Update 1 : The Blog is back after 15 minutes of hacked state.

Update 2 : We got some more screens and at 25 minutes after the hack the blog got again hacked with a new words from the hacker..

Update 3 : Official Message come from the TechCrunch Team ":

“Earlier tonight techcrunch.com was compromised by a security exploit.
We're working to identify the exploit and will bring the site back online shortly.”

The Hack is some kind of a link which have a anchor text of “Rapidshare Download”, as it is the most obvious reason people will click on it.

 

But in the meantime the geniuses behind the techcrunch team have seen this and is working on this matter showing a notice on their blog “We'll be back shortly.”

 

Screens

Here are some of the screens when the techcrunch was hacked and the later one’s also.

 

 Time when hacked

 

11 Minutes later

 

New Hacked notice

 

The Hackers Link

 

Well we don't know till yet how the website was defaced and where the link took the visitors too as soon as the team behind the techcrunch reveals it.

 

Its a big news as its the first time a big blog like techcrunch have been hacked. The link which the hacker is tooking to is a some kind of a torrent sharing portal which would be his only.

 

What do you think ?

Read More

Deep Look At Netdevilz XSS : Whois.com Hacked

These days xss and sql injection and mostly blind sql injections are working allot as we have also covered many of them like the Intel one, and many others too but this time the big domain tool whois.com is hacked.

 

 

Well i am not sure that many of you guys won't know what is whois, so here is the basic information about it.

 

WHOIS (pronounced as the phrase who is) is a query/response protocol that is widely used for querying databases in order to determine the registrant or assignee of Internet resources, such as a domain name, an IP address block, or an autonomous system number. ~ via Wiki

 

The WHOIS system originated as a method for system administrators to obtain contact information for IP address assignments or domain name administrators So, the end of the story tells that it is useful…

 

The Website was hacked about 1 to 2 days ago, by any hacker named Netdevil as of till now the hacker is pretty good in it as he have also previously hacked photobucket.com, which is another pretty popular photo sharing website, back in 2008.

 

This Turkish hacker have also Hacked ICANN website back also and have stricked again now in 2010 attacking Whois.com. Well i am not sure about it but some guys are saying that Netdevilz have also Hacked xiana.com and xssed.com before.

Screen Shots

 

 

 

*Click to view Full Size

 

XSS

Well until now you would be sure that Netdevilz used the XSS vulnerability in the web form to attack the website and hack the whole domain or you can say Full Ownage. The attack is a kind of clever and is my favorite XSS, A poisoned whois xD

 

If you look at the screenshot above of the xss, you would find the attacker script have been initialized the vector on the name of the form ..

 

http://domains.whois.com/domain.php?action=check_availability&goto=metarefresh&formaction=%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E

 

Well the &formaction is a kind of vulnerable to XSS and is hence attacked, i would like to thanks Security-Shell for this information of the XSS initializer and looking at the xss in the website.

 

Conclusion

Try it, if this works then awesome or it might be fixed till yet Enjoy this little hack, if you guy would like to learn more about xss hacking then you can see the
Basic XSS hacking article on the blog.

 

Thanks to d3v1l from Security-Shell For this information about the xss.

 

Happy Hacking @hackerthedude

Read More

US Army Website Defaced : TinKode Strike Again

Tinkode is an awesome hacker who have hacked many websites previous with his qualities in sql injections and Xss abilities and have defaced many big websites.

 

But this time Tinkode website is also down. Tinkode some days before hacked and defaced the website of UN Army website named http://onestop.army.mil with the vulnerability of Blind Sql injection in it.

 

But Apparently his website is down too and the reason remains the same he hacked the website of UN Army. The day Army website was hacked just the other day of it the website of Tinkode was down. I was having a eye on this and was pretty sure about this incident...

 

The US army website is Down and as is the website of Tinkode. The vulnerability he used was same as most of the big website including Intel, and many others are being hacked. Which we have covered in the previous posts.

 

SceenShots

Screen Shots tells the story easy way. So enjoy them -

 

 1=1– (True)

 

 

1=2– (False)

 

 

all main informations about webserver.

 

 

so let’s see the tables from principal database “AHOS”

 

Note : Last Screenshot isn't Here because of privacy.

 

 

Conclusion

This is a clear vision of what happens to the hackers, when they found a vulnerability in the website and hack them. But whatever is the main reason of letting down the website of Tinkode the matter remains the same.

 

Tinkode which have previously hacked many ig websites like Kaspersky Thailand, Nasa.gov, ESET NOD 32, Apple, Yahoo Blind SQL Injection etc Ya, he is awesome .

 

You can follow him on Twitter Here

Read More

Nir Goldshlager Founds XSS Vulnerability in Google And Twitter

A security researcher uncovered some holes in Google Calendar and Twitter that may allow an attacker to steal cookies and user session IDs.

 

Nir Goldshlageer is a security researcher, he recently found an Xss vulnerability in the Google Calendar and Twitter too. The HTML injection issue affecting Google Calendar as well that he said could be used to redirect a victim to an attack site anytime the user viewed his or her Google Calendar agenda events.

 

“When the victim…(adds) this malicious code, his cookies (and) session ID will be stolen and will be sent to the attacker site," he said. "Then the attacker will be able to get full control of the victim’s Google accounts like: Google Calendar account, Google Groups, iGoogle, etc.”

 

Obviously when the hacker, hacks the Google calendar account he will be able to easily hack the Google account as all the Google services are joint to each other. This is big vulnerability in the Google i am saying it from the starting but lets see what Google do next.

 

"They should fix this immediately, because an attacker can redirect a victim to any site that he wants, and the XSS issue an attacker can steal the victim's cookies and get full control of his accounts," Nir Goldshlageer said.

 

Whatever is the story the Google and twitter are a big targets that are continued to be a target for hackers like us.

 

What do You think ?

Read More

Intel Website Hacked : Another SQL Injection From Unu

This is kind of a luck because the amount of SQL injections are affecting the large website is just unbearable. This time the Hacker is one the best and my favorite hacker in the world "unu". unu have previously hacked some really popular website like The Wall Street Journal and Kaspersky Lab’s Websites.

 

I know this news is petty late as the Intel website was down near 23rd of December of 2009. which you can say about 1 week ago.But when the website was hacked, it was lead down and was showing a message of “investigating the matter.”

 

Not only is the website vulnerable to sql injection but it also allows load_file to be executed making it very dangerous because with a little patience, a writable directory can be found and injection a malicious code we get command line access with which we can do virtually anything we want with the website.

 

 

Upload phpshells, redirects, infect pages with Trojan droppers, even deface the whole website.

 

This is a kind of pity on the Intel security engineers,  but what can we do, if they don't pay to the security professionals....

 

Screenshots : Telling the Story

Screenshot tells everything, they reveal all the stuff and thus the story behind the hack of the Intel's website. Ok enjoy the story which is the based on the SQL injection.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Conclusion

The growing number of SQL injections are growing and there is a need to look at the security against the SQL injection vulnerabilities or websites like Intel will grow to the attacked and be attacked several times.

 

Happy Hacking @hackerthedude

Read More