the-hacker-news

It's Insanely Easy to Bypass Samsung Galaxy S8 Iris Scanner with a Photo Samsung recently launched its new flagship smartphones, the Galaxy S8 and Galaxy S8 Plus, with both Facial and IRIS Recognition features, making it easier for users to unlock their smartphone and signing into websites. We already knew that the Galaxy S8's  facial unlock feature could be easily fooled  with just a simple photograph of the device owner, but now hackers have also discovered a simple way to bypass the iris-based authentication, which Samsung wants you to think is unbeatable. All it took for German hacking group Chaos Computer Club (CCC) to  break  the Galaxy S8's iris-recognition system was nothing but a camera, a printer, and a contact lens. The white hat hacking group also published a video showing how to defeat Samsung's iris scanner. Video Demonstration — Bypassing Iris Scanner The process was very simple. The CCC group simply used the night mode setting on a Sony digital camera...

All in One Command Injection and Exploitation Tool How To Tips And Tricks Commix – Automated All-In-One OS Command Injection And Exploitation Tool December 31, 2016 The White Cat 294 Views 0 Comment commix, GitHub, injector Commix, other wise known as [ comm ]and [ i ]njection e[ x ]ploiter is an automated tool written by that can be used from web developers, penetration testers or even security researchers in order to test web-based applications with the view to find bugs, errors or vulnerabilities related to command injection attacks. By using this tool, it is very easy to find and exploit a command injection vulnerability in a certain vulnerable parameter or HTTP header. System requirements: Python version 2.6.x or 2.7.x Linux or Mac OS X or Windows (experimental) Download & Installation: Download commix by cloning the Git repository:git clone https://github.com/commixproject/commix.git commix Commix comes packaged on the official repositories of the following Linux distrib...

PoisonTap: This $5 Device Hacks A Locked Computer In Seconds Short Bytes: What can you do with your $5 bill? You can get a trickster Raspberry Pi Zero which can fool a locked and password protected computer. It can hijack cookies, create backdoors, compromise the internal router, and above all, make the computer believe it’s connected to the internet. Ihave known many sorts of USB devices capable of killing a computer, enhance the security of a machine, perform HIV tests with 95% accuracy, used as a password generator, and much more. Pi boards are often a part of various DIY hacks. For instance, using it as a device for Wardriving around your city. We have seen many instances of people taking advantage of the USB to gain access to a device. A Raspberry Pi board can be a good companion while doing such activities. Usually, these USB hacking activities take advantage of one or more vulnerabilities in the operating system. But, what about a $5 Raspberry Pi Zero that’s an imposter. PoisonT...

Hardware Wallet For Bitcoin Storage Breached KeepKey, a hardware wallet designed for the secure storage of bitcoin and other virtual currency, informed users on Saturday that the company’s systems had been targeted by a hacker on Christmas Day. KeepKey founder Darin Stanchfield said the attacker activated a new phone number under his PIN-protected Verizon account and used it to hijack his email via its account recovery mechanism. The hacker then started resetting the passwords of accounts linked to the compromised email address, including the firm’s Twitter account. Stanchfield said they had managed to shut down affected email services within half an hour and began reversing the account resets from a secure email server. Related Google Denies Allegations That It Has Been Stealing Money from Publishers In the meantime, the cybercriminal contacted the company and demanded 30 bitcoin. In return, he promised to stop the attack, destroy the data he had stolen, and inform KeepKey of the meth...

Currently, it is pouring rain outside, I’ve watched every interesting show on Netflix and I need to find an excuse not to clean my apartment. I consider writing a blog post on a Sunday afternoon a great excuse not to wave the cleaning fairy’s wand. I don’t feel like writing a pure malware reverse engineering blog though, so I decided to give this blog a little twist. I infected a virtual machine with some interesting malware called Poweliks. The goal of this blog is to extract indicators of compromise (IOC’s) out of this  Poweliks sample , making use of the infected machine, a memory dump and the sample itself. This approach is a more dynamic malware analysis approach (i.e. analyzing the malware by running it), rather than a full malware reverse-engineering approach (analyzing the static sample). The reason why I find Poweliks interesting enough to blog about, is because  Poweliks does not leave any trace on the file system : it hides itself exclusively in the registry and mem...