1 Million Dollar Hacked In 60 Seconds From Citibank

FBI have arrested 14 people over the theft of $1 million from Citibank using cash advance kiosks at casinos located in Southern California and Nevada.

Authorities say the suspects would open accounts at Citibank, then go to casinos in California and Nevada and withdraw the money from cash-advance kiosks as many times as they could in a 60-second span. Someone had figured

FBI Special Agent in Charge Daphne Hearn commented, “While advancements in technology have created a world of accessibility to users and a convenience for consumers, they have also left room for criminals to exploit even the smallest of loopholes. For over 100 years the FBI has kept pace with technological and communication changes in the business world where these types of electronic transactions are the standard and we will continue to do so in order to help protect commercial enterprise and our nation’s economy.”

Hacker wins $60,000 prize for breaking into Google Chrome

A hacker known as Pinkie Pie scored another win in a Google-sponsored contest by uncovering a flaw in the Chrome browser.

Hack into Google Chrome, and you could win $60,000, at least if you do it through Google's Pwnium 2 competition.
That's just what happened to a hacker dubbed Pinkie Pie, who won the award on Tuesday by exploiting a security hole in Chrome.
In an effort to shore up its browser's defenses, Google holds the competition to challenge hackers to hack their way through Chrome's security to find previously unknown holes. Tuesday's Pwnium 2 contest was held at the Hack in the Box 2012 event in Kuala Lumpur, Malaysia.
"We're happy to confirm that we received a valid exploit from returning pwner Pinkie Pie," Google announced in a Chromium blog. "This pwn relies on a WebKit Scalable Vector Graphics (SVG) compromise to exploit the renderer process and a second bug in the IPC layer to escape the Chrome sandbox. Since this exploit depends entirely on bugs within Chrome to achieve code execution, it qualifies for our highest award level as a 'full Chrome exploit,' a $60,000 prize and free Chromebook."
Google's Chrome team quickly jumped on the exploit as soon as it was discovered, leading to an update to the browser to patch the hole after just 10 hours.
Pinkie Pie also won $60,000 in the first Pwnium competition, held earlier this year.

'Jesus,' 'welcome' join list of worst passwords

Internet users continue to use many of the same weak passwords used a year ago, according to a new list compiled from password files released by hackers.

Despite the vulnerability presented by weak passwords, many Internet users continue to put their security at risk by using common words or number sequences that are easily guessable.
Unchanged from last year, the three most popular passwords for 2012 were "password," "123456," and "12345678," according to SplashData's annual "25 Worst Passwords of the Year" list. The list was compiled from files containing millions of stolen passwords posted online by hackers.
But that isn't to say that our choices have stagnated; new entries to the list this year include "welcome," "Jesus," "ninja," "mustang," and "password1."
In a year punctuated by high-profile hacks that leaked millions of passwords, SplashData hopes the lists highlights the importance of choosing a robust password.

"We're hoping that with more publicity about how risky it is to use weak passwords, more people will start taking simple steps to protect themselves by using stronger passwords and using different passwords for different Web sites," SplashData CEO Morgan Slain said in a statement. "Just a little bit more effort in choosing better passwords will go a long way toward making you safer online."
A security breach revealed in July at Yahoo yielded nearly a half million login credentials stored in plain text. Other password thefts at LinkedIn, eHarmony, and Last.fm contributed to approximately 8 million passwords posted in two separate lists to hacker sites in early June.
SplashData's list, including changes in ranking from last year's list:

1. password (unchanged)
2. 123456 (unchanged)
3. 12345678 (unchanged)
4. abc123 (up 1)
5. qwerty (down 1)
6. monkey (unchanged)
7. letmein (up 1)
8. dragon (up 2)
9. 111111 (up 3)
10. baseball (up 1)
11. iloveyou (up 2)
12. trustno1 (down 3)
13. 1234567 (down 6)
14. sunshine (up 1)
15. master (down 1)
16. 123123 (up 4)
17. welcome (new)
18. shadow (up 1)
19. ashley (down 3)
20. football (up 5)
21. Jesus (new)
22. michael (up 2)
23. ninja (new)
24. mustang (new)
25. password1 (new)

Security experts suggest picking long passwords (the longer, the better) that include as many different characters as possible while excluding anything that can be personally linked, such as birthdates or names of relatives. Choosing passwords that include words found in common dictionaries is also discouraged.

Sony's PlayStation 3 experiences its biggest hack yet

A hacker group finds a secret set of codes that can decrypt the PlayStation 3's Level 0 security layer -- the holy grail of secrecy within Sony's console.

Sony may have trouble defending itself from this hack.

Hackers have found a way to break down one of the toughest defensive walls in Sony's PlayStation 3 software security, ensuring that those who use custom firmware can run homebrew software and pirated games forever.
A group calling itself "The Three Musketeers" on Monday released a secret set of LV0 codes that can decrypt the PlayStation 3's Level 0 (LV0) security layer used by the primary boot loader. This means that hackers should always have the ability to release custom firmware for the device any time Sony updates the console's software. Custom firmware gives PS3 owners the ability to run pirated games, homebrew software (such as retro game emulators), and even Linux.

"This means that all future firmwares and all future games are decryptable, and this time around they [Sony] really can't do anything about it," Marcan, one of the players in the fail0verflow exploit, wrote in a related Slashdot thread. "By extension, this means that given the usual cat-and-mouse game of analyzing and patching firmware, every current user of vulnerable or hacked firmware should be able to maintain that state through all future updates, as all future firmwares can be decrypted and patched and resigned for old PS3s."
Unfortunately, unless your PS3 runs custom firmware, or can downgrade to a custom firmware, the exploit means relatively nothing -- for now. Check out a very informative FAQ -- which derives from Marcan's observations of the breakthrough -- that describes the implications of the PS3 hack in plain english at the Wololo forums.
The group responsible for releasing the PS3 LV0 codes to the public only did so because a rival group had supposedly stolen the information, and planned to sell custom firmware based on it for profit.
"You can be sure that if it wouldn't have been for this leak, this key would never have seen the light of day, only the fear of our work being used by others to make money out of it has forced us to release this now," wrote the Musketeers in a note attached to the LV0 reveal.

Hackers steal customer data from Barnes & Noble keypads

   Point-of-sale terminals at 63 bookstores are found to have been modified to hijack customers' credit card and PIN information.

    Hackers broke into keypads at more than 60 Barnes & Noble bookstores and made off with the credit card information for customers who shopped at the stores as recently as last month.
The company discovered the breach on September 14 but kept it quiet while the FBI attempted to track the hackers. Hackers broke into the point-of-sale terminals at 63 stores across the country, including locations in New York City, San Diego, Miami, and Chicago.
    Since discovering the breach, the company has uninstalled all 7,000 point-of-sale terminals from its hundreds of stores for examination. Although only one terminal in each of the 63 targeted stores was found to have been compromised, the company has not reinstalled the keypads.
"Customers can make transactions securely today by asking booksellers to swipe their credit and signature debit cards through the card readers connected to cash registers," the company said in a statement.

    The company said it is advising customers to change their personal identification numbers and monitor their credit card statements. It also said it was "working with banks, payment card brands and issuers to identify accounts that may have been compromised, so banks and issuers can employ enhanced fraud security measures on potentially impacted accounts."
The company said its customer database is secure and that purchases made on BarnesandNoble.com, Nook, and Nook apps were unaffected.
The practice of credit card skimming has become more frequent in recent years. Last month, two Romanian men pled guilty to hacking point-of-sale terminals at hundreds of Subway sandwich stores in the U.S. to steal credit card data from more than 146,000 accounts