Indian Researcher Can Hack Your Computer Using Just An Image

The hidden using steganography malicious code runs when you view the image in the browser.
Indian security researcher Saum Shah (Saumil Shah) published a report on the attack method developed by him, based on the popular among users sharing links to pictures. The expert was able to hide the harmful executable code in an arbitrary pixel images, thus leaving his exploit in the most prominent place.

Part 1:

Part 2:

The researchers note that hide malicious code directly in the image was the most difficult, and for this he had to use steganography. Parts of malicious code distributed in Shah pixel image that allows you to decode them back using Canvas element of HTML 5, a conductive dynamic rendering of images.

"For a successful attack I do not have to worry about hosting your own web-site. I do not even need any domain, - the expert emphasizes. - I can take a picture, post it in the public domain, and if the victim load it in your browser, it will compromise the system. "

Separately, an expert noted that the changes occurring in the final image of the presence of extraneous code, visible only at multiple zooming images. His attack technique called Shah Stegosploit, and its details he revealed in a recent held in Amsterdam conference on Information Security Hack In The Box. Video with the details of attack, and expert commentary published on YouTube.

PDF

US Cop Accused Of Hacking Into Police Systems

In the United States, a 45-year-old policeman charged with hacking into police systems of the New York Police Department (NYPD) and databases of various investigative agencies, including the FBI. The suspect agent would function as "auxiliary officer" used to hack the systems and networks in order to steal the personal information of thousands of people for personal gain, according to the prosecutor.

According to the indictment, the man several "electronic devices" have been installed in an office of the New York police giving him access to secure systems and remote databases, while he really did not have permission to log on to these systems. They have included an FBI database. One of the devices that the man would have had installed a hidden camera live images of the office sent it over the Internet. The second device was used to log on to the computers in the house remotely.

The man would have logged in with user names and passwords of other agents on the systems and then have all sorts of personal information of victims of traffic accidents searched. The suspect would then have the victims approached and have occurred as a lawyer, claiming that it will help the victims in their claim. The agent would have carried out more than 6,400 jobs in the database between May and August last year. If convicted, he could receive a sentence of up to 10 years.