Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

HF News // Edition 239



[Image: zvUVkJO.png]

The edition you are currently reading is the #239th edition of the HF News. To read any older editions of the HF News, please go here.



[Image: er0eIHN.png]

Glitches and Downtime
On May 7th, 2015 Omniscient announced that Cloudflare has an exploit that was being used to bypass their security, therefore causing HF glitches and downtime. Many users were faced with the issue of having access to other users' accounts, however even though it appeared as if you were logged in to another account, you were still not able to complete any actions as it was all just an issue with the Cloudflare exploit. Omniscient reported this exploit to Cloudflare months ago and in the end, they dismissed it. The issue that should have been taken care of months ago obviously frustrated Omniscient and a change was required to deal with the situation. That night Omniscient decided to pay for a new account with Sucuri, changed server configurations, and began the necessary changes to add their protection into our serving scheme. The remaining downfall of the situation is that NSFW might be lost, at least in its current form. Other than that the new change seems to be working just fine however Omniscient did state that he can already see limitations and problems with Sucuri. Omniscient also stated that changes will occur and odd behaviors will happen so don't hesitate to let him know if you experience these. For now we'll all just have to sit back and see what happens in the near future. To read the official announcement from Omniscient you may feel free to do so, here.

All Countries Now Unblocked Except for Three
For the first time in about 8 years on May 7th, 2015 Omniscient unblocked every country except for China, Russia, and North Korea. After viewing the statistics it appeared that 40% of the traffic to HF was indeed blocked. Regardless of the unblocking however Omniscient is unsure how long it will last. If problems start to occur with certain countries it is likely for them to be placed back onto the block list. Also VPN's, Proxies and Datacenters are still blocked. To read the the announcement thread you may do so, here.

New Feature for the Show Groups Page
On May 7th, 2015 Omniscient announced he added the ability to view the owner of a group for any group on the show groups page as he felt it was needed. A cool little feature indeed just to make the page a bit more defined. Omniscient also stated in the thread that he will be coding some special functions for group owners to edit their own leaders. To view the new feature simply visit the show groups page located, here. To read the thread from Omniscient you may do so, here.

New Feature: Trust Scan
On May 8th, 2015 Omniscient officially removed trust scan from beta status. To use this feature simply click on the link for it on any users profile page next to their reputation. There is also a link listed for it on the Extras page. The trust scan feature is currently available to all EP1C and UB3R members. You may read the beta and official Trust Scan release threads here, and here.



[Image: 80tinuL.png]

User News
Bans*
  • H3God was banned for low quality posting.
  • Single Core was banned for low quality posting.
  • Druze was banned for advertising disallowed sites.
  • TO0R was banned for advertising disallowed sites.

Vacations
Closures
Repfucks
  • H3God was repfucked for low quality posting.
  • Single Core was repfucked for low quality posting.
  • DamienVC was repfucked.

Awards
* - As of the Monday prior to release.



[Image: 8foDQrv.png]

Announcement Threads

---Trust Scan Released - Omniscient
---The new Trust Scan feature for Ub3r and 3P1C members has been fully released.

---Sales Tag Price Reduction - Omniscient
---The new Sales Tags have had a price reduction from $6 OMC to $5 OMC.

---Show Group Owner - Omniscient
---A nice little feature to show the group owners apart from the leaders on the showgroups page.

---Downtime - Omniscient
---Last Saturday Hack Forums experienced extended downtime due to an attack that bypassed Cloudfare's security measures. Omniscient goes on to say, "I won't be intimidated by attacks."

---DDOS Protection Changes - Omniscient
---A lengthy thread letting members know of a Cloudfare exploit and the changes to Hack Forums' DDOS Protection. Due to the exploit, Omniscient has started to use Sucuri.

---World Unblock - Omniscient
---Omniscient has unblocked almost every country which makes up about 40 percent of Hack Forums traffic!

---Any Better? - Omniscient
---Due to the change in DDOS protection, some problems with double cache and incorrect session handling have occurred.

Informational Threads

---Currency Exchange - Omniscient
---Omniscient has posted a reminder that all currency exchanges must go in it's respected section and not in the Buyers Bay.

---White Pages - Omniscient
---Users may be experiencing a white page when refreshing their pages. This is due to a javascript check page and your browser not being able to solve it fast enough.

Entertaining Threads

---Yo mamma jokes - Nickfost
---A hilarious thread with members posting tons of jokes!

Member Feedback Threads

---Saturday's in depth 4 year feedback - Satu
---Satu's feedback thread.

---Dean Winchester Feedback / 3 years / 10'000 posts / 930 rep - Dean Winchester
---Dean Winchester's feedback thread.

Contests & Giveaways

---[V2][NO SIGNATURE] WIN TONS OF MONEY EASY AND FAST l Get $5 off LuminosityLink l NEW - KFC Watermelon
---Check out this really awesome giveaway to win tons of different prizes!



[Image: 978vPdk.png]

Interview - TommyD (Click to View)

[Image: support1.png]


[Image: 4GbJDmC.png]

GPU Based Linux Rootkit and Keylogger Changes The Game
New pieces of software have been created by a team of developers that "run on an infected computer’s graphics processor unit (GPU) instead of its central processor unit (CPU), in order to enhance their stealthiness and computational efficiency." These two pieces of malware are called "Jellyfish Rootkit" and "Demon Keylogger". Both of their sources have been posted on GitHub which you can find by clicking on the source of this article. There are no GPU malware analysis tools online which makes these beautiful pieces of malware very hard to find. These types of malware run without exploiting any current processes in the operating system kernel which is why they stay undetected. It also exploits GPU capabilities by mining for different cryptocoins such as Bitcoin. These programs can spark many new ideas into the minds of hackers. >>Source

Millions of Sites At Risk After WordPress Vulnerability
Millions of Wordpress sites are at risk right now after a XSS (cross-site scripting) vulnerability was present in the default installation. This XSS vulnerability is classified as a document object model (DOM) which is responsible for images, headers, text, and links in a web browser. The DOM based attack does not change the page itself but rather the client side code contained in the page which now acts differently due to the malicious attack. These DOM-based XSS attacks are harder to find then the typical XSS attack because they are located in the script code of the website. The DOM-based XSS attack requires an administrator to click on the specific link while logging into the vulnerable WordPress installation. Once the administrator clicks on that link, the hacker will have full control of the website. It is not exactly clear on how many websites are vulnerable to these attacks but the JetPack plugin which is vulnerable to these types of attacks comes installed default by millions of WordPress templates. >>Source

Major Cisco UCS 0-Day Vulnerability Patched
A remote code execution vulnerability that could potentially give determined attackers root access to the host has been discovered and patched in Cisco's UCS (Unified Computing System) central software. Although little is currently known about the specifics pertaining to this vulnerability, the National Vulnerability Database, due to its ease of exploitability and potential impact, gave the vulnerability a critical score of 10.0. The vulnerability is triggered by sending malicious, custom HTTP requests to version 1.2 and below of UCS. Not only can it be performed across the Internet, but no authentication is required and still allows unprivileged users to gain unrestricted access to the machine. It is not known if this vulnerability was used in the wild, but it is a safe assumption that it was and that Cisco's quick response was done to prevent more people from being affected. >>Source

Uber Was Hacked
You're out drinking with friends on a Saturday night and you know you're not well enough to drive home. The cab company says they will be there in three hours, but that's way too long of a wait. Uber is the company that will send a driver to wherever you are in a short amount of time. Used by millions of people, Uber has been a target of cyber-attacks for a very long time, and it seems as if it has finally been executed successfully. Many customers have reported seeing drivers requested and bank transactions that they did not authorize. At first, it was unclear as to whether or not Uber was hacked or if people's accounts were being logged in due to the fact that they use the same passwords for other sites and services, but when Uber came forward about their security error, there was no doubt. Uber had left a secure database key, originally intended to be used only by a few private Uber employees, on a publicly available GitHub archive. Dan Goodin, a security analyst, has compared it to locking your house and keeping a key under the mat. >>Source



[Image: rxoWiQm.png]

Backdoor WordPress Sites Begin Leaking Credentials
With a series of recent vulnerabilities in a variety of WordPress plugins, researchers have discovered that a number of sites running said plugins have been backdoored. Th exploited sites have backdoor code that runs when a user logs in, then steals their credentials and sends to hackers via a GET request. The site that is believed to be receiving a majority of the stolen credentials is conyouse[.]com. The code designed by the hackers cancels the original login method and instead runs their code. The researchers urge WordPress site owners to update to the latest security patches as soon as possible in an attempt to prevent attacks such of this from reoccurring. Other widely used WordPress Plugins eShop and TheCartPress also had vulnerabilities discovered this week that compromised any data that was sent through the plugins. It was discovered that EShop had a vulnerability in its HTTP cookie, thus allowing for the data to potentially be compromised. TheCartPress's vulnerability was linked to a cross-site scripting vulnerability. >>Source

Adobe Acrobat Security Updates Coming Soon
Adobe continues to offer a head's up on what's coming. Adobe announced yesterday that Acrobat and Reader for Windows and OS X will be receiving security updates next Tuesday. Adobe said that Reader XI 11.0.10 and earlier, Reader X 10.1.13 and earlier, Acrobat XI 11.0.10 and earlier and Acrobat X 10.1.13 and earlier will be affected by this soon to come update. Microsoft is expected to release details on its monthly security updates later this week. In January, Microsoft announced that it was limiting access to its Advanced Notification Service, a decade-long service that provided customers a description of security patches one week before Patch Tuesday. Microsoft will henceforth restrict access to its Premier support customers and participants in the Microsoft Active Protections Program. Patch Tuesday will, however, be coming to an end. Microsoft announced during its Ignite conference that in Windows 10, security updates will be available as they're needed. >>Source

UCS Remote Code Bug Patched by Cisco
Earlier this week, Cisco announced that it had patched a very serious remote code execution vulnerability that was found in its Unified Computing System Central Software. "An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device," Cisco said Wednesday in an advisory. "An exploit could allow the attack to execute arbitrary commands on the underlying operating system outhouse privileges of the root user." The UCS Central software failed to validate user input through its web framework, thus allowing for this remote attack. After the update, Cisco said that the is no other workarounds available and is not aware of any public exploits. Cisco is urging users to upgrade to UCS Central version 1.3, remarking that this vulnerability is a 10/10 on their severity scale. On March 23rd, Cisco warned users of SPA 200 and 500 series IP phones of a series of firmware vulnerabilities allowing hackers to intercept and listen to calls or even make phone calls. The company patched a total 16 vulnerabilities, those included, three days later. >>Source



[Image: qY7u4UW.png]

Steam Births and Later Kills Paid Mods
On April 23, it was announced by Valve that a platform to buy and sell game modifications through Steam was set up. These modifications have been allowed to be distributed for free since 2011 when the Steam Workshop was first introduced. The first game that was going to have paid modifications available was The Elder Scrolls: Skyrim. However, a few days later following an enormous backlash from the gaming community, Valve decided that it would be best to remove the option for game modifications to be paid for. "We've done this because it's clear we didn't understand exactly what we were doing," said Valve. "We've been shipping many features over the years aimed at allowing community creators to receive a share of the rewards, and in the past, they've been received well. It's obvious now that this case is different." Bethesda Softworks, publisher of games with large modding communities like Fallout: New Vegas, had this to say about the removal of paid mods: "Even though we had the best intentions, the feedback has been clear — this is not a feature you want. Your support means everything to us, and we hear you." >>Source

Retro Metal Gear Solid Clothing Line Coming Soon
On May 5th, an image was uploaded to the official Metal Gear Solid Facebook page displaying a strangely luxurious Metal Gear Solid picture with only the text “Metal Gear Solid: The 1984 Collection.” The caption below the picture read as follows: “Step back into the 80's with our new MGS collection coming very soon! Stay tuned!” It was later revealed that this image was a teaser for a line of clothing set to coincide with the upcoming Metal Gear Solid V: The Phantom Pain, which takes place in the year 1984. The clothing is coming from the video game-themed clothing retailer Insert Coin. The clothing available can be found here on Insert Coin’s website. Metal Gear Solid V: The Phantom Pain is set to release this upcoming September. >>Source

New Assassin’s Creed Teaser
On May 12th, Ubisoft is set to formally announce the next installment in the Assassin’s Creed game series. However, on May 8th a teaser image for the game was revealed, showing brass knuckles, the Charles Dickens quote "We Forge The Chains We Wear In Life," the phrase “God Save the Queen,” and the word “Rooks,” which may be in reference to the birds commonly found in Northern Europe. Next to the text “Rooks” is a carved image of a bird, seemingly confirming the meaning for the term. According to a leak from last year, the game’s title is to be Assassin’s Creed: Victory, although this has yet to be directly confirmed by Ubisoft. The game is reported to be released on the Xbox One, Playstation 4, and PC. >>Source



[Image: DbvKfaQ.png]

Hints of Samsung Galaxy Note 5
Now that Samsung’s Galaxy S6 is out of the gate, the Internet’s attention is gravitating towards Samsung’s bigger flagship: the Galaxy Note 5. Samsung typically busts out the new Note in September at IFA (International Franchise Association), but the very first rumors about the "phablet" are already out, and we expect to see a whole lot more of them ahead of its launch.

Unlike last year, the South Korean technology giant may limit itself to only one variant of the Galaxy Note 5 in 2015, with the device featuring a 2K (1600x2560) or 4K (2160x3840) flat-screen Super AMOLED display. The phablet is also expected to feature an Exynos 7422 processor, Samsung's first all-in-one solution, which will include the CPU, GPU, RAM, storage, and modem all on a single chip. >>Source

Samsung to spend $14 billion on ‘Semiconductor Valley’
The profits of Samsung's smartphones may have been wavering lately, but the company apparently thinks its semiconductor business is second to none. Samsung has begun construction on a massive semiconductor production plant in South Korea that will cost 15.6 trillion won (approx. $14 billion) to build. Dubbed “Samsung Semiconductor Valley,” it will be the most expensive semiconductor plant ever built. The plant — which is almost as big as the company's two largest semiconductor factories put together — is slated to begin production in 2017.

Samsung is leading the way in semiconductor production thanks to a cutting-edge 14-nanometer manufacturing process that allows chips to become smaller, faster, and more power efficient. The new facility will help Samsung produce these chips in greater numbers than ever before, and enable it to continue pushing the boundaries of what’s possible with mobile chips — further cementing its position in the industry. >>Source

Android M to feature many new privacy controls
Google's next Android update may put privacy back into its owners' hands — literally. Google is expected to release Android Version “M” next month, which will seemingly give control of app data back to the users. According to sources speaking to Bloomberg on Thursday, the next iteration of Android will give users the ability to hand-pick specific permissions to grant an app upon installation. This includes access to photos, contacts, and location data, according to the report.

The anticipated move would follow in the footsteps of Google's closest rival, Apple, which added similar security features more than two years ago. >>Source

[Image: support1.png]


[Image: BHzVGmB.png]

Do you enjoy reading the HF News? Do you think others might enjoy reading the HF News? Do you want to show your support for what we do?
Wear our Support Signature and show us you care! Numerous members don't even know we exist, make a change!

Support Signatures (Click to View)



[Image: XWz6Pmk.png]

Current Open Group Recruitments
Important Group Related Threads


[Image: BZrx7ya.png]

Omnicha.in Disables Casino after 22K OMC Stolen
After running successfully for over a month, the Omnicha.in Casino got it's first hit by hackers. Over the course of one month the hackers got away with over 22,000 OMC, worth nearly $57.2 at the time of writing. The casino portion of the website has been disabled until a safe replacement can be created.

Abraham Lincoln stated that the robbery was from the casino only and did not effect the online wallet. The stolen coins will be coming out of his own pocket and that it will not effect any of the users of the site.

Read more about it here.

Weekly Highlights
New OMC Exclusives

None this week

Click here to start your shop for a chance to be featured in the next edition.



[Image: zGA0ZXA.png]

Site Statistics
  • Total (Click to View)
  • Average (Click to View)

Ban Statistics
  • Last Week's Bans (Click to View)
  • Total Bans (Click to View)

Forum Counts
  • Tab Counts (Click to View)

Membership Counts
  • Groups (Click to View)

* - As of the Friday prior to release.



[Image: yDOaWz9.png]

What is your opinion on Xch4ng3 stepping down as an Admin?

Thornzzz
"Well, I'm not going to be in Opinion Weekly much, but I thought I'd be in it this week just to thank Xch4ng3 for taking the time out of his life to help members on HF and be the great Admin he was. He was a great Admin and is now a great Mentor and will always be a great Member."

Dex
"Xch4ng3 was a great person and Admin. He's going to missed as a Admin of the forum."

iHydra
"I never knew Xch4ng3 that well but he seemed like a great staff member who definently played a large role on Hack Forums."

xadamxk
"Although it saddens me to see Xch4ng3 stepping down, I am glad he did what he did for the community. Being staff on HF isn't an easy job, let alone being an Admin. We all have a personal life and a lot of members get caught up in the action of HF and leave their 'lives' behind them. I have respect for Xch4ng3 knowing that he was willing to resign his job as a site admin and step down due to his own life."



[Image: u9jMaRp.png]

New Header Images
What do you think of the color coding? Starting next edition, I will have permanent colors so you can begin remember blue is Site News and such.

Community Articles
I've listened to suggestions posted in this thread and got a good idea of what needs to get added. Most of the suggestions were about non-Writers contributing so very soon Writers will launch a "Moment in Time" section where non-Writers members will be able to submit their articles and get it featured on HF News.

Changes Incoming
School is ending this week for myself and I'm sure other Writers so I will have a lot more time to push out new changes faster and more efficiently.
[Image: bsijNbc.png]

Progression of HF News
Many have asked if HF News is going downhill so I finally finished recording post and view count of every single edition from the very first one till edition 238. As you can see from the graphs below, HF News has been going downhill but we'll see how it changes in the next 50 editions with all these changes I have planned.
View Progression (Click to View)

[Image: support1.png]


[Image: rp3q2yA.png]

Every week - assuming we get enough submissions - the HF News will feature the best submitted battlestation.
Send iHydra a message by clicking here and including an imgur link of your battlestation!

ToBeAdded's Battlestation






[Image: peZOLKP.png]

(1) (Click to View)

(2) (Click to View)

(3) (Click to View)

(4) (Click to View)

(5) (Click to View)

(6) (Click to View)



[Image: udN7Xob.png]

View Credits (Click to View)

[Image: support1.png]
Nice read this week guys, keep up the good work.
I can't read, can somebody post a voice recording so I can stay up to date?
Hey Hydra, are you guys experimenting with changing around posts 2 and 3? If so, I think it looks a lot better this way.
Reading this now, had to post first though. kek
I only do deals onsite through PM's/Contracts.
I do not use Discord, or Skype, or talk to members offsite whatsoever.
Awesome edition as always, keep it up.
No podcast? No Sir? ONE interview? Not bad.
Why the hell did this thread make the news?
https://hackforums.net/showthread.php?tid=2802548

---Yo mamma jokes - Nickfost ---A hilarious thread with members posting tons of jokes!
I only do deals onsite through PM's/Contracts.
I do not use Discord, or Skype, or talk to members offsite whatsoever.
(May 11, 2015 08:48 PM)clark.dll Wrote:  No podcast? No Sir? ONE interview? Not bad.

Now that is impressive.   
(May 11, 2015 08:49 PM)bοxxy Wrote:  Why the hell did this thread make the news?
https://hackforums.net/showthread.php?tid=2802548

---Yo mamma jokes - Nickfost ---A hilarious thread with members posting tons of jokes!

There weren't many entertaining threads this week, hence why it was added.
This looks like a good one, reading now.
(May 11, 2015 08:44 PM)Tonight Wrote:  I can't read, can somebody post a voice recording so I can stay up to date?

Orchid is going to be posting the podcast shortly, stay tuned.
time is of the essence


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Mix8 hours ago 7 55 8 hours ago
Last Post: Raijin
by MixOct 10, 2026 09:57 AM 20 332 Oct 10, 2026 09:57 AM
Last Post: Jamika
by MixSep 29, 2026 08:52 AM 8 99 Sep 29, 2026 08:52 AM
Last Post: clark.dll