WordPress Sites Hacked Using Vulnerability

A critical Zero-day flaw in WordPress that was silently patched by the company before hackers have had their hands on the nasty bug to exploit millions of WordPress websites.

To ensure the security of millions of websites and its users, WordPress delayed the vulnerability disclosure for over a week and worked with security companies and hosts to install the patch, ensuring that the issue was dealt with in short order before it became public.


But even after the company's effort to protect its customers, thousands of admins did not bother to update their websites, which are still vulnerable to the critical bug and has already been exploited by hackers.

While WordPress includes a default feature that automatically updates unpatched websites, some admins running critical services disable this feature for first testing and then applying patches.

Even the news blog of famous Linux distribution OpenSUSE (news.opensuse.org) was also hacked, but restored immediately without breach of any other part of openSUSE's infrastructure.

The vulnerability resided in WordPress REST API that would lead to the creation of new flaws, allowing an unauthenticated attacker to delete pages or modify all pages on unpatched websites and redirect their visitors to malicious exploits and a large number of attacks.

The security researcher at Sucuri, who privately disclosed the flaw to WordPress, said they started noticing the attacks leveraging this bug less than 48 hours after disclosure. They noticed at least four different campaigns targeting still unpatched websites.

In one such campaign, hackers were successful in replacing the content of over 66,000 web pages with "Hacked by" messages. Rest campaigns have targeted roughly 1000 pages in total.

Besides defacing websites, such attacks appear to be carried out mostly for black hat SEO campaign in order to spread spam and gain ranking in search engine, which is also known as search engine poisoning.

So, site administrators who have not yet updated their websites to the latest WordPress release 4.7.2 are urged to patch them immediately before becoming next target of SEO spammers and hackers.Humble request to do so for your own safety.

Read more

Microsoft will Inform You If Government is Spying on You

Following in the footsteps of Twitter, Facebook and Google, Microsoft promises to notify users of its e-mail (Outlook) and cloud storage (OneDrive) services if government hackers may have targeted their accounts.

The company already notifies users if an unauthorized person tries to access their Outlook or OneDrive accounts. But from now on, the company will also inform if it suspects government-sponsored hackers.

Ex-Employee: Microsoft Didn't Notify When China Spied Tibetans Leaders

The move could be taken in the wake of the claims made by Microsoft's former employees that several years ago Chinese government hacked into more than a thousand Hotmail email accounts of international leaders of Tibetan and Uighur minorities, but the company decided not to tell the victims, allowing the hackers to continue their campaign.

Instead of alerting those leaders of the hacking attempts, Microsoft simply recommended them to change their passwords without disclosing the reason, after an internal debate in 2011, Reuters reported.

However, Microsoft announced Wednesday that if the company strongly suspects that your account is being hijacked or targeted by hackers working in the interest of a nation-state, it will notify you via an email.

Here's what Microsoft Vice President Scott Charney writes:

"We're taking this additional step of specifically letting you know if we have evidence that the attacker may be 'state-sponsored' because it is likely that the attack could be more sophisticated or more sustained than attacks from cybercriminals and others. These notifications do not mean that Microsoft's own systems have in any way been compromised."

Just last week, Yahoo promised to alert its users whom it suspected were being spied on by state-sponsored hackers. Other big tech companies including Twitter, Facebook and Google, had previously assured their users that they would notify them of any potential government spying.

And now Microsoft is the latest company to join the list.

Government: We'll Sue You if You Do That!

This is a good news for Microsoft users, but it seems that the United Kingdom is not happy with this decision by all the major tech firms, because the country seeks access to personal communications in order to fight terrorism and protect national security.

The UK government is pushing a new Investigatory Powers Bill that will take the bosses of any company that warns its users that security organizations, such as GCHQ (the Government Communications Headquarters), MI5 and MI6, are spying on them.

Specifically, UK ministers want to make it a criminal offence for Twitter, Google and other tech firms under which they could face up to two years in prison.

Read more

Want WhatsApp Free Video Calling? This Leaked Screenshot Reveals Upcoming Feature

Raise your hands if you want Free Video Calling feature in WhatsApp.

I am in, and I think most of you people.

And the good news is that it looks like WhatsApp's much-awaited Free Video Calling feature is on its way, according to the recently leaked screenshots.

Free Video Calling Feature in WhatsApp

German technology blog Macerkopf.de has posted what it claims are screenshots from an unreleased version of the popular messaging client WhatsApp for iOS.

The screenshots are from an unreleased version of the software (version 2.12.16.2), which is currently being tested internally, but at present it is not clear whether or not those screenshots are legitimate.

But, if the leaked screenshots are real, and WhatsApp adds the Free Video Calling feature, then the company could take an enormous bite out of some of its top rival.

WhatsApp Video Calling feature will allow you to make video calls to your friends and family anywhere in the world for free as long as you have a Wi-Fi network or an effective data plan on your registered number.

Here are the allegedly leaked images of video calling feature in action:

WhatsApp has added several new features to its messaging service in order to enhance the user experience. Just this year, WhatsApp finally added free voice call feature, and with the launch of video support, the messaging app will more firmly lock users into its ecosystem.

Read more

How to Connect to Protected Wi-Fi Hotspots for Free Without Any Passwords

Step 1: Install Instabridge

Instabridge – Free internet is available for computers.

Step 2: Set Up Your Preferences

When you first launch Instabridge, you’ll have to go through a one-time setup process. First, tap I am new, then review and Accept the Terms of Service.

Next, Instabridge will ask you to verify your phone number. This is done so that your friends will be able to find you and connect to your shared Wi-Fi networks, but it is not required. If you’d rather not share your phone number, hit Skip. Otherwise, hit OK.

If you opted to verify your phone number, a text message will be sent to your phone and Instabridge will automatically detect it. Once that has happened, a button will show up in the upper right-hand corner where you can hit Done.

Next, you’ll be given a chance to review your settings. From here, you can set your phone to automatically connect to My own networks, Friend Networks (networks shared with you by friends), and Community Networks (networks shared by other users).

The last two options help improve the Instabridge network and app, so leave them turned on and press the Done button up top.

Step 3: Add Your Wi-Fi Networks

If you are connected to a Wi-Fi access point when setup has finished, the app will automatically ask if you would like to save and share the login credentials for that network. If you are not currently connected, you can get to this same interface at a later time from the app’s main screen.

Under the Networks you can connect to field, you will see your current Wi-Fi connection. Tap the Share or backup this hotspot button to begin.

From here, tap the Share with… field, then select who you’d like to share this Wi-Fi connection’s password with. If it’s a public access point, feel free to contribute to the cause and share the password with All Users. Otherwise, if this is your home network, it would be best to choose either Friends or Just me, no one else for security reasons.

With the Friends option, you’ll be given a chance to select which friends to share this connection information with. They will need to have the app installed on their device to connect to your network.

You can view the amount of times that other users have connected to networks that you’ve shared by tapping the second tab from the app’s home screen.

.

Step 4: Connect to Free Wi-Fi Networks

Instabridge makes it easy to discover free Wi-Fi connections in your area. From the app’s main screen, simply tap the third tab (the one with the Earth icon) to begin.

Grey dots represent public Wi-Fi connections that require payment or restrict access in some regard. Pink dots mark free, open Wi-Fi connections that are available for you to use. Tap any of the dots, and you’ll be taken into Google Maps so that you can navigate to within range of the signal.

When you’re ready to connect to one of these networks, simply tap it from Networks you can connect to field on the app’s main screen, and connection will occur automatically.

How many free Wi-Fi networks are available in your area?

Read more

Hack a facebook account- Tab napping attack(advance Phishing attack)

Actually tab napping is a script which is when put on your blog or site by you and victim visits
it(for playing games or reading articles or anything else) when victim opens a new tab for help(how to play or read full article),after 4-5 seconds when he
return to previous tab, then  victim will be redirected to facebook login page. when
As victim types username and password , it will be send to you..
(Note:-New tab for help is also you have to provide in order to distract the victim for few seconds.)
1. Download tab napping file from here
2.Upload to free webhosting site like 000webhost, 110mb.com etc

3. The website contain a game and send your website address(your tab napping website
where you upload all the files) to victim and tell him/her that if your are smart then
play this game and win the prize. And tell him that for tips(help) how to play it, Go to google

4.when victim came back to the website , it will be automatically redirected and saying
them to login with facebook account to continue.
5.When your victim log in with facebook account then password will saved in your
website and he/she will be redirected to main game page.
6.Now just open www.example.com/fb/password.html and you will see the email
and passwords.
Enjoy…..

Read more

How to Hack Whatsapp Account

We have received many requests for some advance level Hacking tips so in this post of Learn Hacking, we are going to share one of our Coolest Hacks till date ie.. How to Hack Whatsapp Account 

Though I am pretty sure most of you might be knowing about whatsapp but still here is a brief into about the same.

Whatsapp Messenger is a cross platform quick messaging application. Whatsapp is assured really the foremost fashionable quick electronic messaging for smartphones. Whatsapp Messenger is accessible for iPhone, Android, Windows Phone, Blackberry and Nokia and yes, those phones can all message each other. And you all have heard of it if you are not using it. Given below are the several whatsapp hacks or tricks you should know if you are using whatsapp.

Whatsapp hack to spy on some other account

So if all of you have noticed you cannot have your whatsapp account logged in two devices. Means session is given to only one MAC address. If the MAC (Media Access Control) address of the device seeking access changes then whatsapp asks you to again verify your account.

How to Hack Whatsapp Account

All you need is to get access to victim phone to get the victims phone “MAC address along with the verifying massage” which is acquired to verify your device.

• Get mac address on your android phone.
• Finding MAC address on an Android Phones
• On your phone’s home screen, click on menu, then go to setting.
• Click on about phone.
• Click on the status.
• And then view your Wi-Fi MAC address.
• As soon the message is received Push the MAC address as well as Verifying code to your server or mail it your ID. That banks on your convince.
• Cheat your phone’s MAC address to the Victims address and install whatsapp and after that type the verify code.
• And now its done. You get full access to the victim’s whatsapp ID. So now you can keep spying/watching your victim’s movements.
• That means you and the victim is using the same ID from different devices.
• Whatsapp hack to use it by not using your number
• This hack works by cheating the Whatsapp Verification Servers by sending a spoofed request for an authorisation code expected for a different phone.
• Install Whatsapp on your device. Whatsapp now opens a counter where it sends a verification message to its servers.
• Block the message service – it can be blocked by changing the message centre number or turning the phone into Airplane mode.

Whatsapp now gives a substitute method of verification – Select verify through SMS and fill in your email address. Once you click to send the SMS press cancel to abort the call for authorisation to the Whatsapp server.

• Now you have to do sms Spoofing.
• Examine your outbox and copy the message details into the spoofer application and send the spoofed verification.
• You will now receive messages expected for the spoofed number on your mobile device and you can communicate with people under the spoofed number.

Note:- This information has been shared to create awareness among people regarding the “Ways to Hack Whatsapp” so that you can protect yourself from getting hacked. In no way do we promote misusing of the information.

Read more

3 Tools to Reveal Who’s Hacking your WiFi

While using your home WiFi internet access you might face some slow downs of speed, this may be due to a normal internet down time or (if it persists for a long time) your wifi may be got hacked by a nearby hacker. There are many ways to protect your home Wi-Fi from being hacked, such as using a custom & hard to guess password or also changing the encryption type of the wireless key to WPA or WPA2 as they are meant to be more secure but not perfect against hackers. As we’ve seen there’s a way to Hack WPA/WPA2 Passwords using PIN vulnerability, that means even if you think your WiFi is protected with WPA/WPA2 encryption doesn’t mean it cannot be hacked.

3 Tools to Reveal Who’s Hacking Your WiFi

1. Wireless Network Watcher

Wireless Network Watcher programmed by Nirsoft, it helps you analyzing nearby computers connected to the same network (WiFi or Local network). It will analyze and list: Local IP address of the hacker, Computer/Device name, MAC address & other useful info.

Download WNW from Nirsoft

2. Who’s On My WiFi

Who’s on my WiFi is an very easy to use tool that will provide many information about the locally connected hackers on your WiFi home network.

Download Who’s On My WiFi

3. NetCut

The famous internet cutter can also be used to analyze who’s taking your internet connection after hacking your wifi. Netcut helps you also cut down internet access to connected users even if they know the wifi password, which also helps you protecting yourself from others using netcut.

Download Netcut

Read more

Shocking! Instagram HACKED! Researcher hacked into Instagram Server and Admin Panel

Ever wonder how to hack Instagram or how to hack a facebook account? Well, someone just did it!

But, remember, even responsibly reporting a security vulnerability could end up in taking legal actions against you.

An independent security researcher claims he was threatened by Facebook after he responsibly revealed a series of security vulnerabilities and configuration flaws that allowed him to successfully gained access to sensitive data stored on Instagram servers, including:

• Source Code of Instagram website
• SSL Certificates and Private Keys for Instagram
• Keys used to sign authentication cookies
• Personal details of Instagram Users and Employees
• Email server credentials
• Keys for over a half-dozen critical other functions

However, instead of paying him a reward, Facebook has threatened to sue the researcher of intentionally withholding flaws and information from its team.

Wesley Weinberg, a senior security researcher at Synack, participated in Facebook's bug bounty program and started analyzing Instagram systems after one of his friends hinted him to a potentially vulnerable server located at sensu.instagram.com

The researcher found an RCE (Remote Code Execution) bug in the way it processed users’ session cookies that are generally used to remember users' log-in details.

Remote code execution bug was possible due to two weaknesses:

1. The Sensu-Admin web app running on the server contained a hard-coded Ruby secret token
2. The host running a version of Ruby (3.x) that was susceptible to code execution via the Ruby session cookie

Exploiting the vulnerability, Weinberg was able to force the server to vomit up a database containing login details, including credentials, of Instagram and Facebook employees.

Although the passwords were encrypted with ‘bcrypt’, Weinberg was able to crack a dozen of passwords that had been very weak (like changeme, instagram, password) in just a few minutes.

Exposed EVERYTHING including Your Selfies

Weinberg did not stop here. He took a close look at other configuration files he found on the server and discovered that one of the files contained some keys for Amazon Web Services accounts, the cloud computing service used to host Instagram's Sensu setup.

These keys listed 82 Amazon S3 buckets (storage units), but these buckets were unique. He found nothing sensitive in the latest file in that bucket, but when he looked at the older version of the file, he found another key pair that let him read the contents of all 82 buckets.

Weinberg had inadvertently stumbled upon almost EVERYTHING including:

• Instagram's source code
• SSL certificates and private keys (including for instagram.com and *.instagram.com)
• API keys that are used for interacting with other services
• Images uploaded by Instagram users
• Static content from the instagram.com website
• Email server credentials
• iOS/Android app signing keys
• Other sensitive data

"To say that I had gained access to basically all of Instagram's secret key material would probably be a fair statement," Weinberg wrote in his blog. "With the keys I obtained, I could now easily impersonate Instagram, or any valid user or staff member. While out of scope, I would have easily been able to gain full access to any user’s account, [personal] pictures and data."

Responsible Disclosure, but Facebook Threatens Lawsuit

Weinberg reported his findings to Facebook's security team, but the social media giant was concerned he had accessed private data of its users and employees while uncovering the issues.

Instead of receiving a reward from Facebook for his hard work, Weinberg was unqualified for the bug bounty program by Facebook.

In early December, Weinberg claims his boss Synack CEO, Jay Kaplan, received a scary call from Facebook security chief Alex Stamos regarding the weaknesses Weinberg discovered in Instagram that left Instagram and Facebook users wide open to a devastating attack.

Stamos "stated that he did not want to have to get Facebook's legal team involved, but that he was not sure if this was something he needed to go to law enforcement over," Weinberg wrote in his blog in a section entitled 'Threats and Intimidation.'

In response, Stamos issued a statement, saying he "did not threaten legal action against Synack or [Weinberg] nor did [he] ask for [Weinberg] to be fired."

Stamos said he only told Kaplan to "keep this out of the hands of the lawyers on both sides."

"Condoning researchers going well above and beyond what is necessary to find and fix critical issues would create a precedent that could be used by those aiming to violate the privacy of our users, and such behavior by legitimate security researchers puts the future of paid bug bounties at risk," Stamos added.

Facebook Responds

After the original publication by the researcher, Facebook issued its response, saying the claims are false and that Weinberg was never told not to publish his findings, rather only asked not to disclose the non-public information he accessed.

The social media giant confirmed the existence of the remote code execution bug in the sensu.instagram.com domain and promised a bug bounty of $2,500 as a reward to Weinberg and his friend who initially hinted that the server was openly accessible.

However, the other vulnerabilities that allowed Weinberg to gain access to sensitive data were not qualified, with Facebook saying he violated user privacy while accessing the data.

Here's the full statement by Facebook:

We are strong advocates of the security researcher community and have built positive relationships with thousands of people through our bug bounty program. These interactions must include trust, however, and that includes reporting the details of bugs that are found and not using them to access private information in an unauthorized manner. In this case, the researcher intentionally withheld bugs and information from our team and went far beyond the guidelines of our program to pull private, non-user data from internal systems. 

We paid him for his initial bug report based on the quality, even though he was not the first to report it, but we didn't pay for the subsequent information that he had withheld. At no point did we say he could not publish his findings — we asked that he refrain from disclosing the non-public information he accessed in violation of our program guidelines. We remain firmly committed to paying for high quality research and helping the community learn from researchers' hard work.

Read more