There is a worldwide, highly-distributed WordPress attack that is ongoing on most of the WordPress powered blogs.
The following steps can be used to secure (by password protection) wp-login.php for all WordPress sites in your cPanel account:
How to Password Protect the wp-login.php File
There are two (2) steps in accomplishing this. First you need to define a password in the .wpadmin file, and then you activate the security in the .htaccess file. Read the rest of this entry »
After loosing Norton AntiVirus Corporate Edition source code in 2006, now Symantec is asking its customer to stop usage of Norton/PcAnywhere which was also leaked on Internet.
The security firm said the theft occurred in 2006, compromising 2006-era version of Norton Antivirus Corporate Edition, Norton Internet Security and Norton SystemWorks and most important "pcAnywhere", which could allow malicious users to gain complete access to systems and data very easily.
Also it is intresting to add that the guy who hacked that code also released source code of Indian Spy software
“So far we have discovered within the Indian Spy Program source codes of a dozen software companies which have signed agreements with Indian TANCS programme and CBI”
What does that mean? Indian agencies are doing signed agreements for spying using Symantec/Norton products and others???? must be those agreements are not in favor of Pakistan 🙂
"The headline is very embarrassing to Symantec,"
Anup Ghosh, founder and CEO of Virginian security firm Invincea, told FoxNews.com at the time.
"But this has now become the normal in securities. Every single corporation is susceptible to threats."
hahahah, very funny!!!!
“Symantec recommends disabling the product until Symantec releases a final set of software updates that resolve currently known vulnerability risks,” the company wrote in an online statement about the hacking.
The “The Lords of Dharmaraja”, the hacking group who authored the Pastebin note, has released the code online(last week).
Some security tips from (Ira Victor, a security expert in Nevada):-
1. Do not use a "suite" of security protection from any one firm. A mixture of best of breed security is more secure.
2. Usernames and passwords alone are not enough protection for remote access. A single-use password system makes unauthorized remote access exponentially harder for cyber criminals.
3. Do not run computers in "Administrator" mode. Run systems in "User mode" so that malware does not install automatically.
4. Businesses should deploy application "whitelisting." This will prevent unauthorized malware from running on computers.
Have you ever got used to a Firefox or Thunderbird addon that you really like, or just can't live without, and then a new version of either Firefox or Thunderbird is released, and suddenly your addon no longer works?
Of course, the generally recommended way is to search http://addon.mozilla.org for a new version, but sometimes when you try to update your addons, you find there is no new version, or it seems like nobody is maintaining the addon any more. I tend to live on the leading edge of new Firefox releases, I want the new features, I want the latest, and I want it now, so I quite frequently hit this problem. Fortunately, there is an easy way to keep using your favorite addons, usually with little or no risk.
The summary for those who just want to skim and jump in:
- Download the addon file you want to update
- Rename the addon archive file to add .zip to the end
- Extract install.rdf
- Edit install.rdf, find and change maxVersion, save the change
- Pack install.rdf back into the install archive
- Rename the file back to it's original .xpi name
- Install using File, Open
The detail for those who need all the steps:
You will need only two free tools to help you do this job, the totally free 7-Zip or some other ZIP file management utility and hopefully knows how to use it. The other tool is a simple text editor. Microsoft's Notepad will do, but any other text editor will work if you have any particular preference. My preference is NotePad++ which is a good free programming and general purpose text editor.A warning is the first important note here; always backup your Firefox or Thunderbird installation directory before doing any "hacking". While a problem is extremely rare, problems can happen, and you will only have yourself to blame if you don't take appropriate precautions before making any unsupported changes. I won't take any responsibility for any problems you inflict on yourself through sharing with you what I do on my own computer(s). It is often a good practice anyway to backup your installation directory before installing any new addon, just because you never really know what can happen, though usually by the time anything is approved and available for public download on http://addon.mozilla.org, it has been fairly well tested by others and proved to be safe. At the very least, before following my tips here, backup your profile and addons directories by making a copy of them to some other location on your disk. If you don't know how to do that, or don't know where your profile and other directories (folders) are, I don't suggest you try my tricks. Read Gizmo's article How to Back up Mozilla Firefox and Thunderbird, in which among other things Gizmo mentions using tools such as MozBackup which shields you for knowing how to do it manually.
Once you have taken your backup, the first step is to find and download the latest version of the addon you want, and download a copy to your disk. Remember, at this point you can not simply click the Install link, because you know the installer will tell you the addon is unsupported for your version of Firefox or Thunderbird, which is more than likely why you are reading this article! Normally, you would click the Install button, but in this case, you want to save the file to disk, so right click on the install (or Add to Firefox / Add to Thunderbird) button, and then click 'Save Link As'. Choose a location on your disk, make a new folder if necessary. The file you download will be named something like better_gmail_2-0.6-fx.xpi. On rare occasions you may find that when using Firefox, you just can't click 'Save Link As' for some reason. Try a different browser, you may have better luck saving the file when the browser itself is not capable of actually installing the addon.
Having saved the addon, you will need to extract one file named install.rdf from it, make a change, and then pack it back into the file. Since the addon is just a zip file containing all the supporting files necessary for the addon, the easiest way to extract files is to rename the original by changing the .xpi extension to .zip, or by simply adding .zip to the end of the file name temporarily. You will need to extract the install.rdf file from the zip file, edit it, and then put it back in again, so if you're not comfortable with these tasks without me describing them in great detail, don't try. Ask somebody else who is comfortable using zip to extract a file and pack it back in again to help you with this process.
Once you have the install.rdf file extracted, open it with your text editor, and look for lines like the ones listed below. Many addons don't have these lines, so they are not checking for specific versions, and you should not see any incompatibility messages.
<em:targetApplication>
<Description>
<em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
<em:minVersion>1.0</em:minVersion>
<em:maxVersion>3.0</em:maxVersion>
</Description>
</em:targetApplication>The part you need to change is the line with the maxVersion setting. As long as I am running Firefox 3.0.1, this addon should work for me, but when I upgrade to 3.1, or 4, it will no longer work. The next step is to change the maxVersion setting to at least the version you are currently running, I usually just change it to 9.0 which means I can run any version that will be released for some time to come.
<em:targetApplication>
<Description>
<em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
<em:minVersion>1.0</em:minVersion>
<em:maxVersion>9.0</em:maxVersion>
</Description>
</em:targetApplication>If your install.rdf looks really weird when you open it, and seems to have just a few lines that look really long, and don't all display on the screen, don't panic. Most likely, the addon programmer has used a Unix or Linux system to create the files, or they have used an editor that does not automatically wrap lines. The Unix or Linux option may be the more likely of the two, and if you don't know what I mean by line termination characters and vi, explaining more would only confuse you even more. Either way, some Windows text editors will know what to do with a non-typical Windows text file, Notepad will not, so if you see just a few long lines, just use Ctrl F, or click Edit, Find, and then type maxVersion. All you need is to find this setting, change it, and save it. Don't worry about the strange file formatting.
After making the change, save the install.rdf file, pack it back into the addon zip archive, and rename it back to it's original name ending in .xpi. The last step is to actually install it, and to do this, rather than browsing to http://addon.mozilla.org, simply click File, Open File, select your modified .xpi file and click the Install Now button. At this point, unless you made any mistakes or any other problems were detected during installation, your addon is installed and will be ready for use when you restart Firefox. The procedure is same for Thunderbird addons.
As I said, problems are rare, however you don't know everything the programmer did when writing the addon, so monitor everything carefully until you are sure everything is functioning as it should. There may be specific features in different releases of Firefox or Thunderbird being used by the addon programmer which might really make the addon incompatible with a newer release. In general, unless there is a major change, most things should be safe. The real point is, be careful, and keep backups so that you don't have any reason to curse yourself for making the change, and me for telling you how to do it.
Yappy,
I just won a price by "Liking" a page on facebook "Like & Win" competition
Actually some company announced that they will give free gifts to the 2000th and 2011th users, who like their facebook page.
So what I did was simple, I just made a python script (that's not hacking, just power of programming) to win that price and start that script to check the page status and alert me when page like is near 1998-1999 🙂
import urllib2,time,winsound
from HTMLParser import HTMLParser
class MyHTMLParser(HTMLParser):
def __init__(self):
HTMLParser.__init__(self)
self.recording = 0
self.data = []
def handle_starttag(self, tag, attrs):
if tag == 'div':
for name, value in attrs:
if name == 'id' and value == 'profile_header':
#print "Encountered the beginning of a %s tag" % tag
self.recording = 1
break
def handle_endtag(self, tag):
if tag == 'div':
self.recording -=1
#print "Encountered the end of a %s tag" % tag
def handle_data(self, data):
if self.recording:
self.data.append(data)
var = 1
print "Checking current likes (remember 2000th and 2011th will get the price):"
while var == 1 :
print "......"
p = MyHTMLParser()
f = urllib2.urlopen('http://www.facebook.com/pages/Some_URL_for_like_and_win')
html = f.read()
p.feed(html)
#print p.data
print p.data[4];
string=p.data[4];
if string.startswith( '1,999' ):
winsound.PlaySound("SystemExclamation", winsound.SND_ALIAS)
print "Check the page and get the price"
p.close()
print "Sleeping for 5 minutes"
time.sleep(300)
Change this URL to the URL of your choice [http://www.facebook.com/pages/Some_URL_for_like_and_win]
Please note I am NOT responsible if that company sues you for cheating & for using programming skills in competition 🙂
Aloha
In addition to my previous post “Privacy is dead, People”
Google has publicly acknowledged that the WiFi data collected by its world-roving Street View cars contained entire emails, URLs, and passwords.
On Friday afternoon, with a blog post, senior vice president of engineering Alan Eustace also said – yet again – that most of the data is “fragmentary,” and that the company intends to delete the data “as soon as possible.”
“I would like to apologize again for the fact that we collected it in the first place,” Eustace wrote. “We are mortified by what happened.” The company has always said that the data collection was a “mistake,” saying that code developed by a single engineer was added to its cars although project leaders had no intention of doing so. Independent investigations have said that the data contained emails and passwords as well as home addresses and phone numbers.
In May, it was Eustace who revealed – with another blog post – that Google Street View cars had been collecting data sent over unsecured WiFi networks, contradicting previous claims from the company.
With earlier public statements, Google had said its cars were collecting only the SSIDs that identify WiFi networks and the MAC addresses that identify particular network hardware, including routers. Google uses such data in products that rely on location data, such as Google Maps.
Privacy authorities across the globe launched investigations of Google’s WiFi data collection, and some concluded that the company had violated local laws, including, most recently, Canada privacy commissioner Jennifer Stoddart. Spain has filed a lawsuit against the web giant. Seven investigations have been completed so far, and others are still pending.
When Eustace first revealed the WiFi payload collection, he said the company would review its “procedures to ensure that our controls are sufficiently robust to address these kinds of problems in the future.” And regulators demanded such reviews as well. So, with Friday’s blog post, Eustace also laid out the company’s new internal policies.
The company has appointed Google researcher Alma Whitten as director of privacy for both engineering and product management. “Her focus will be to ensure that we build effective privacy controls into our products and internal practices,” Eustace wrote.
“She has been our engineering lead on privacy for the last two years, and we will significantly increase the number of engineers and product managers working with her in this new role.”
Google has also vowed to increase privacy training among its employees. “We’re enhancing our core training for engineers and other important groups (such as product management and legal) with a particular focus on the responsible collection, use and handling of data.”
Beginning in December, all employees will also go through a new information security awareness program, which will include “clear guidance on both security and privacy.”
What’s more, engineering project leaders will keep document detailing the privacy design of each project they work on. “This document will record how user data is handled and will be reviewed regularly by managers, as well as by an independent internal audit team.”
Google has said that its cars collected about 600GB of WiFi payload data across 30 countries. Some of the data has already been deleted at the insistance of regulators in various countries, including Ireland, Denmark, and Austria. But after complaints from a UK-based independent privacy watchdog, it stopped the deletions, which were overseen by a third-party.
Google did not immediately respond when we asked when the deletion would resume. ®
Google has responded. “In some countries where we’ve been instructed to do so by the authorities, we have deleted the data, “a company spokeswoman said. “We want to delete the rest of the payload data as soon as possible and will continue to work with the authorities to determine the best way forward.”
Refrence:
