#opBlackSummer: Two US Petroleum companies websites breached by AQEA & TCA

Al-Qaeda Electronic Army and Tunisian Army recently attacked several U.S. Government websites as part of their operation called "#opBlackSummer" - an operation against America.

Now the hackers took their operation to next level by launching cyber attack against Petroleum and Gas companies.  Yesterday, EHN got notification that the Team breached the two U.S. Petroleum websites.

They identified the SQL Injection vulnerability in the websites belong to "Chevron Corporation(chevron.com) -an American multinational energy corporation  " and "Oceaneering International, Inc(oceaneering.com)- a subsea engineering and applied technology company based in Houston, Texas, U.S.A.".  We have verified the existence of the vulnerability.

The team managed to exploit this vulnerability and extracted sensitive data from the target databases. The hacker said to have compromised important data including email addresses, passwords, and 270 IP address belong to Companies' computers.

The hackers claim they will send these IP address details to their Chinese hackers team to do some malicious work.

TCA said this operation will continue till September.  The hackers said they are planning to "give a great surprise for the USA" on 11th Septemebr (9/11), the date on which al-Qaeda hijacked four airliners and carried out suicide attacks against targets in the United States.

Read More

Another iPhone passcode vulnerability found

Barely have owners of devices running Apple’s iOS recovered from a newly discovered passcode vulnerability for devices running iOS 6.1 when a second bug surfaced this week.

The new bug may potentially allow access to a user’s contact list, voicemails and more, security vendor Sophos said in a blog post. “In this second version of the exploit, a hacker can also make the iPhone screen go black, thereby allowing him or her to plug the phone into a computer via USB and grab data off the device without a PIN or passcode credentials,” it said. The first vulnerability had surfaced earlier this month.

Sophos said both attacks involve using the Emergency Call function, the lock/sleep button, and the screenshot feature.

“When placing the emergency call, an attacker could cancel the call while holding the lock/sleep button in order to access data on the phone,” it said.

But the attacker will have to have physical access to the device.

“Exploiting this second bug still requires a certain degree of dexterity, if not a prehensile tail. But the bug still implies a risk to iOS 6.1 users’ data and Vulnerability Lab estimates it’s a high risk,” Sophos added.

via TJD, GMA News

Read More