Ransomware virus threat getting worse

Taking advantage of anonymous payment services, cyber criminals are increasingly using a malicious software 'ransomware' that holds a computer hostage until the victim pays to free it, online security firm McAfee says.
"Ransomware has become an increasing problem during the last several quarters and the situation continues to worsen. The number of new, unique samples this quarter is greater than 312,000, slightly less than last quarter but still the second highest figure recorded by the firm," the McAfee Labs Threats Report Third Quarter 2013, said.

Petroleum Ministry warns PSU oil companies of cyber attacks

Following an advisory by the Indian Computer Emergency Response Team (CERT), the Petroleum and Natural Gas Ministry has alerted all the heads of oil marketing companies (OMCs) about the possibility of cyber attacks.
http://goo.gl/z9miIx

Indian tweens use risky or low level security passwords

 Indian tweens, children between the age of 8-12 years, are enthusiastically adopting Internet using multiple devices, but use risky or low level security passwords, a survey by cyber security major McAffee revealed.

McAfee's Tweens and Technology Report 2013 said online tweens are potentially vulnerable to risky behaviour on the Internet a good number of them have chatted to someone online that they didn't know previously.
A disturbing trend on the rise among tweens is their apathy towards their own online safety. 58 per cent of the respondents surveyed use risky or low level security passwords online and Almost half of the tweens surveyed share information about themselves over FB (41 per cent), it added.
Another dangerous trend that the survey by the US-based firm revealed is that Indian tweens are becoming more trusting of the virtual world to familiarise themselves with unknown people, in spite of being aware that it is risky.


http://zeenews.india.com/news/net-news/tweens-fast-adopting-internet-but-apathetic-towards-security_892783.html

Top Ten Biggest Cyber Crimes

 Though slightly outdated but still gives useful information on cyber attacks in modern times

Source  : http://www.infosecisland.com/blogview/17807-Top-Ten-Biggest-Cyber-Attacks-Of-All-Time.html

News Super Computing 13: GPUs would make terrific network monitors

1. A network researcher at the U.S. Department of Energy's Fermi National Accelerator Laboratory has found a potential new use for graphics processing units -- capturing data about network traffic in real time.
2. GPU-based network monitors could be uniquely qualified to keep pace with all the traffic flowing through networks running at 10Gbps (gigabits per second) or more, said Fermilab's Wenji Wu. 
3. What he is trying to tell that all the present technologies and tools used have their limitation and their traffic monitoring capabilities are extremely fault prone
4. CPUs don't have the memory bandwidth or the compute power to keep pace with the largest networks in real time. As a result, they can drop packets. 
5. Thus GPU are the future.
6. Checkout more at   http://goo.gl/Qqmy6N

Aviation industry vulnerable to cyber attacks: IATA

1. Think about the scenario when you suddenly find that the destination of your flight has been changed because the navigation system has been hacked and it has been set to some other country.  And most scary is the fact that all this is because of a prank by 12 year old. 
2. Faced with cyber security threats, the aviation industry, which has spent over US$ 100 billion on security since 9/11, should share best practices and partner with governments to adapt to new challenges and tackle them, airlines' body IATAhas said.
3. Noting that aviation now relies on computer systems for almost every aspect of the business, leaving it potentially vulnerable to cyber attack, IATA asked the industry, governments, regulators and manufacturers to work together to share best practices and mitigation strategies.
4. Checkout the complete article at http://goo.gl/VvuKH5

Spurt in attacks on Indian websites

Cyber attacks against Indian websites have increased exponentially in 2013, despite the government supposedly building a credible cyber defence system.

According to confidential reports by CERT-In (Indian Computer Emergency Response Team), 4,191 Indian websites were defaced or hacked into in August, 2,380 in July, 2,858 in June and 1,808 in May. An overwhelming percentage of these attacks occurred in the .in domain, whose servers are in India - 80% in June and over 60% thereafter.

Checkout full article here http://goo.gl/N9aTWB

Winamp is going to be silenced forever

http://cyberoxen.com/winamp-was-there-not-for-long-its-gonna-be-silenced-forever-%e2%80%a2-the-register/

Snowden Likely Used SSH Keys to Access Classified NSA Data

Using public statements from Edward Snowden and NSA officials, digital-certificate firm Venafi pieces together a likely scenario for how the former contractor accessed classified documents.

Edward Snowden has not publicly stated how he leveraged his privileged access to certain servers and top-secret information at the National Security Agency into a wider fishing expedition, netting classified secrets that he had no clearance to access. The NSA hasn't provided much insight either.

This week, however, security researchers at certificate-management firm Venafi threw their collective hat into the ring, posting an analysis stating that Snowden likely used authentication keys to give his account privileged access to other servers in the network. Secure shell (SSH) keys are frequently used by system administrators to log into remote computers without a password, and Snowden likely gained access to others' keys or to privileged accounts and inserted his own keys, the company said.

The most significant clue is General Keith Alexander's testimony in which the NSA chief reportedly stated that Snowden "fabricated digital keys" to gain access to classified systems, Jeff Hudson, CEO of Venafi, told eWEEK.

"It all comes back to one thing: 'He fabricated the SSH keys,'" he said. "What he did was he allowed himself access to other systems and in the process he elevated his privilege."

More news at http://www.eweek.com/security/snowden-likely-used-ssh-keys-to-access-classified-nsa-data-venafi.html

Tor Stands Tall Against the NSA

The National Security Agency tried to crack the encryption protecting the Tor network -- known as a bulletproof vehicle for anonymous communication -- but was unable to do so, according to news reports based on revelations provided by former NSA systems administrator Edward Snowden.

Source Tech news

It seems fairly clear that the U.S. security agency has been trying to hack into Tor for some time. "The real question here concerns who the exploit was targeting," suggested Ken Westin, founder of mobileprivacy.org. "Was is it people law enforcement had probable cause to monitor, or was it a blanket exploit that targeted all users of Tor?" It's pretty reasonable to assume the latter, Westin opined.

Follow  it here on http://www.technewsworld.com/story/79133.html

Whats App is not secure due to weak encryption policies

A serious vulnerability in WhatsApp allows anyone who is able to eavesdrop on WhatsApp connection to decrypt users' messages.

Whatsapp, the mobile application for instant messaging platform has become one of the main communication tools of the present day and its popularity makes it attractive for security researchers and hackers.

This time it is debated in the protection of the messages exchanged through the application, thanks to a vulnerability in the crypto implementation they can be intercepted by an attacker.

Thijs Alkemade is a computer science student at Utrecht University in The Netherlands who works on the open source Adium instant messaging project, during its research activity he disclosed a serious issue in the encryption used to secure WhatsApp messages.

In the post titled "Piercing Through WhatsApp’s Encryption" Alkemade remarked that Whatsapp has been plagued by numerous security issues recently, easily stolen passwords, unencrypted messages and even a website that can change anyone’s status.

"You should assume that anyone who is able to eavesdrop on your WhatsApp connection is capable of decrypting your messages, given enough effort. You should consider all your previous WhatsApp conversations compromised. There is nothing a WhatsApp user can do about this but expect to stop using it until the developers can update it." states the researcher.

An attacker sniffing a WhatsApp conversation is able to recover most of the plaintext bytes sent, WhatsApp uses RC4 software stream cipher to generate a stream of bytes that are encrypted with the XOR additive cipher.

The mistakes are:

• The same encryption key in both directions
• The same HMAC key in both directions

Below the trick used by the researcher to reveal the messages sent with WhatsApp exploiting first issue:

WhatsApp adopts the same key for the incoming and the outgoing RC4 stream, "we know that ciphertext byte i on the incoming stream xored with ciphertext byte i on the outgoing stream will be equal to xoring plaintext byte i on the incoming stream with plaintext byte i of the outgoing stream. By xoring this with either of the plaintext bytes, we can uncover the other byte."

The technique doesn't directly reveal all bytes but works in many cases, another element that advantage the attacker is that messages follow the same structure and are easy to predict starting from the portion of plaintext that is disclosed.

The second issue related to the HMAC id more difficult to exploit, Alkemade said WhatsApp also uses the same HMAC key in both directions, another implementation error that puts messages at risk, but is more difficult to exploit.

The MAC is used to detect data alteration but it is not enough to detect all forms of tampering, the attacker potentially could manipulate any message.

"TLS counters this by including a sequence number in the plaintext of every message and by using a different key for the HMAC for messages from the server to the client and for messages from the client to the server. WhatsApp does not use such a sequence counter and it reuses the key used for RC4 for the HMAC."

Alkemade is very critical to the development team of the popular platform:

“There are many pitfalls when developing a streaming encryption protocol. Considering they don’t know how to use a xor correctly, maybe the WhatsApp developers should stop trying to do this themselves and accept the solution that has been reviewed, updated and fixed for more than 15 years, like TLS,” he said.

I agree with the thinking of the researcher, security for applications such as WhatsApp is crucial given its level of penetration, it is true that the interest of the scientific community and cybercrime will surely lead them to discover new vulnerabilities to which WhatsApp have to provide a quick solution.

Alkemade confirmed that there is no remediation for the flaw in this moment, that's why he suggest to stop using WhatsApp until developers produce a patch.

Read more: http://thehackernews.com/2013/10/vulnerability-in-whatsapp-allows.html#ixzz2hsut182j 
Follow us: @TheHackersNews on Twitter | TheHackerNews on Facebook

Your wifi password is Known

You are proud of your new Android Smart Phone, that was gifted you by your girlfriend or boyfriend on your birthday. Or you just received a gift packed Samsung Galaxy.
First thing you do is download fancy apps, connect it with your Facebook account, connect Twitter and all this after configuring your WiFi.
You enter your secure WiFi password and click "save it".
World over the google is actually saving all these password AND your SECURE password is NO MORE SECRET.
Be it Android, Apple or Symbian
all Smart apps are storing your wifi password.
Disturbing yet detailed report can be read here.
Happy Hunting

http://cyberoxen.com/google-knows-nearly-every-wi-fi-password-in-the-world-computerworld-blogs/

Digital ForensicsTools : Top 20

The digital forensics are the highly specialized field. The tools are customized and easy to use. 

• Only thing you require is a lot of will power, dedication and lots of computing power and space in your system.
• You can explore the in-depth information about what’s “under the hood” of a system.
•  Happy hunting.

The fields it can be implemented are

1. Internal human resources case, 
2. Investigation into unauthorized access to a server, 
3. You just want to learn a new skill, 
4. Conduct memory forensic analysis,
5. Hard drive forensic analysis, 
6. Forensic image exploration,
7. Forensic imaging and 
8. Mobile forensics. .

 http://www.gfi.com/blog/top-20-free-digital-forensic-investigation-tools-for-sysadmins/#sthash.l5vach7I.dpuf

Phishing seems to be the latest fad and going strong

Phishing, though very well known, well advertised and popular term of hacking, there are very few person who take it seriously. The usual perception is " This is not going to effect me. I am safe". Even White-house is falling prey to Phishing attacks repeatedly

Take a look at this report.

Thomson Reuters was not the only one hit by the Syrian Electronic Army in recent days; White House staffers were also targeted by the hackers.

The group's activity prompted Twitter to suspend various SEA accounts. "The Twitter managment [sic] has suspended the SEA account today after the SEA hacked into Thomson Reuters Twitter account and try to hack the White House twitter account with some success in it," the SEA wrote on its website.

The @Official_SEA12 feed is now live. The SEA said that account came back online after it threatened to hack even more Twitter accounts, though there is no indication that that was the case.

On the @Official_SEA12 account, the SEA posted what it says is the Hootsuite login and password for the White House. Passwords it secured for the @WhiteHouse account were all old, the group said. "You were lucky this time," the SEA wrote.

According to Nextgov, the hackers secured data via phishing expeditions. They sent emails to White House staffers, which included links from what appeared to be news sites like CNN or BBC. After clicking on the links, however, users were asked to sign in via Gmail or Twitter in order to read them. Those links were fake, and typing in the info allowed the SEA to log the passwords that were entered and secure access to the staffers' accounts.

The hackers were likely in search of passwords for high-profile Twitter accounts, which might have been contained within one of the staffers' emails. It appears the current password for @WhiteHouse, however, was not stored on any of the hacked accounts, saving it from a hack, for now.

Last night, the @ThomsonReuters Twitter account was infiltrated and the SEA tweeted Syria-related tweets with photos and pro-Syria hashtags.

The Syrian Electronic Army emerged in September. The hackers reportedly started attacking Western websites in retaliation for Innocence of Muslims, an anti-Islamic video that resulted in violent demonstrations in the Middle East. They have since been targeting news sites they believe are reporting news hostile to the Syrian government, including theFinancial Times, The Guardian, the BBC, and even The Onion.

Balloon and Internet

http://www.goodnet.org/articles/1141

We say "everyone" is online these days – but is that really true? According to Google's Project Loon, not at all. Two-thirds of the world's population is still without Internet access, and the initiative is working to turn that around – with balloons, no less.
So how does it work? Superpressure balloons sit some 20 km above the Earth's stratosphere, and a Google-developed algorithm determines where they need to go. The balloons are then moved remotely into a layer of wind, which will carry them where they need to go. Each balloon provides Internet to a ground area of about 40 km in diameter, at speeds similar to the 3G mobile data you get on your smartphone.



The project is launching its pilot this month, using 30 balloons over New Zealand's South Island. Up, up and away!

Watch the video   http://www.youtube.com/watch?v=m96tYpEk1Ao&feature=player_embedded

Create Your own mobile app: Even Novices can develop apps

It would be great if we all had the time, skills, and patience to learn computer coding, especially since technology pervades so many areas of our life. But thankfully, there are applications and web developers out there who provide ways for the rest of us to produce apps with little or no coding skills.

Back in June, I reviewed one such web application called Buzztouch, which is designed to allow anyone to create their own smartphone application. Now a similar program has just been released called Infinite Monkeys, a web-based tool geared toward niche communities who want to share content on the iPhone and Android platforms. Infinite Monkeys is not as polished theme wise as Buzztouch, but unlike the latter, Infinite Monkeys, says the developers, “Is completely web-based, and works on any computer or tablet device. You never touch the source code and don’t have to know what it is or how it works.” There are several other differences that also might make Infinite Monkey more accessible to non-programmers than Buzztouch. But you’re free to explore both and see which fits your needs.
Web-based GUI

Infinite Monkeys’ web-based graphic user interface allows users to incorporate existing web content from social networking sites like Twitter, Flickr, YouTube, and blogging sites.


These web-based apps of course don’t compare to more advanced apps like Angry Birds, but they are great for small niche communities and businesses, such as school associations, sports teams, churches, musicians and restaurants, who want to share content privately or publicly.



Infinite Monkeys provides three different app platform models, ranging from free to the pro level version of $499. But for many users, the free HTML 5 web-based, and ad-supported model should suffice.

Building An App

Infinite Monkey provides a seriously easy step-by-step process for creating a smartphone app in less than an hour; that is if you have an ample amount of content already posted on the web.


The great thing about using a web-based platform is that you can constantly add content and updates to your app via your blog site, YouTube channel, photo sharing site, etc.

The Infinite Monkey web application uses a familiar drag-and-drop process. You start off by giving your app a title, followed by choosing a privacy setting. You can make the app public, or private for closed community access which will prompt users to enter a password to view content.


You can of course customize the background image and splash screen, as well as the font colors for the title and other text.

Core Content

The core content of your app consists of primarily news and third-party feeds such as your blog site(s) and specific URLs.


Infinite Monkeys includes additional content models for music and books, food and beverages, events, sports, reference materials, and location services such as a map and directions.

With the click of a button you can easily preview your app at any point in the development process. The online app also includes an embedded short video tutorial for each of the three part steps and multifunction tools.

You have poor control over the content of your app, including links to streaming videos, live chatrooms, shared calendars for upcoming events, shopping links to recommended products, and tap–t0–call phone contact information.
Publishing App

The free version of Infinite Monkeys allows you to instantly post your HTML 5 version immediately to the web so that anyone with a web-enabled smartphone can access it through the assigned URL.

Since your app is ad-supported, Infinite Monkeys will host it for free on their server. While it is not nearly as polished as professional apps that you will find in say the iTunes App Store, it does provide a way for anyone to get their content into this space.

Check out more on http://www.makeuseof.com/tag/create-smartphone-app-infinite-monkeys-coding-knowledge-required/

SQL injection......a shot that doctors wont prescribe

Came across the wonderful site presenting a simple tutorial on SQL injection problems and their remedies. Posting as it is for the benefit of all.

SQL Injection Tutorial: All common SQL injection problems and Solutions

Hello readers of BTS,
    Today I'll write an tutorial for you what covers most problems while doing SQL injection and solutions to them. Probably every person who has looked at tutorials to hack a website have noticed that there are too much SQL tutorials. Almost every forum has 10 tutorials and blogs 5 tutorials about SQL injection, but actually those tutorials are stolen from somewhere else and the author doesn't probably even know why does SQL injection work. All of those tutorials are like textbooks with their ABC's and the result is just a mess. Everyone are writing tutorials about SQL, but nobody covers the problems what will come with that attack.

What is the cause of most problems related to SQL injection?

Webdevelopers aren't always really dumb and they have also heard of hackers and have implemented some security measures like WAF or manual protetion. WAF is an Web application firewall and will block all malicous requests, but WAF's are quite easy to bypass. Nobody would like to have their site hacked and they are also implementing some security, but ofcourse it would be false to say that if we fail then it's the servers fault. There's also a huge possibility that we're injecting otherwise than we should.

A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-site Scripting (XSS) and SQL Injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.

If you're interested about WAF's and how they're working then I suggest to read it from wikipedia http://en.wikipedia.org/wiki/Application_firewall

http://www.breakthesecurity.com/2013/02/sql-injection-tutorial-all-common-sql.html

XSS vulnerability tutorials

XSS is the most talked about vulnerability exploits....done by everyone..... newbies to experts...I came across this tutorial that i found educative as well as informative.

What is XSS?
Cross Site Scripting also known as XSS , is one of the most common web appliction vulnerability that allows an attacker to run his own client side scripts(especially Javascript) into web pages viewed by other users.

In a typical XSS attack, a hacker inject his malicious javascript code in the legitimate website . When a user visit the specially-crafted link , it will execute the malicious javascript. A successfully exploited XSS vulnerability will allow attackers to do phishing attacks, steal accounts and even worms. 

Example :Let us imagine, a hacker has discovered XSS vulnerability in Gmail and inject malicious script. When a user visit the site, it will execute the malicious script. The malicious code can be used to redirect users to fake gmail page or capture cookies. Using this stolen cookies, he can login into your account and change password.

It will be easy to understand XSS , if you have the following prerequisite:

• Strong Knowledge in HTML,javascript(Reference).
• Basic Knowledge in HTTP client-Server Architecure(Reference)
• [optional]Basic Knowledge about server side programming(php,asp,jsp)

XSS Attack:
Step 1: Finding Vulnerable Website
Hackers use google dork for finding the vulnerable sites for instance  "?search=" or ".php?q=" .  1337 target specific sites instead of using google search.  If you are going to test your own site, you have to check every page in your site for the vulnerability. 

Step 2: Testing the Vulnerability:
First of all, we have to find a input field so that we can inject our own script, for example: search box, username,password or any other input fields.

Test 1 :
Once we found the input field, let us try to put some string inside the field, for instance let me input "BTS". It will display the  result .

Now right click on the page and select view source.   search for the string "BTS" which we entered in the input field.  Note the location where the input is placed.

Test 2:
Now we are going to check whether the server sanitize our input or not.  In order to do this , let us input the <script> tag inside the input field. 

View the source of the page . Find the location where input displayed place in previous test.

Thank god, our code is not being sanitized by the server and the code is just same as what we entered in the field. If the server sanitize our input, the code may look like this &lt;script&gt;. This indicates that the website vulnerable to XSS attack and we can execute our own scripts .

Step 3: Exploiting the vulnerability
Now we know the site is somewhat vulnerable to XSS attack.  But let us make sure whether the site is completely vulnerable to this attack by injecting a full javascript code.  For instance, let us input <script>alert('BTS')</script> .

Now it will display pop-up box with 'BTS' string. Finally, we successfully exploit the XSS .  By extending the code with malicious script, a hacker can do steal cookies or deface the site and more.

Disclaimer: This article is for educative purpose only.

Intel is closing its shop for Desktop motherboards...RIP Desktops/towers

Reset Administrative password in Mac Book Pro

Yesterday while sipping our evening tea, my roommate  came to me with the problem "I have Forgotten my Administrative Password ". The device in use was MAC pro note book loaded with Mac OS. Frankly speaking I  have never worked on Apple before, only had it as a staple fruit diet. ;). However itook upon myself the challenge of resetting the Administrative password. given below are the steps followed.

Step 1 Reboot your Mac. As soon as you hear the loading  jingle, Press Apple key and 's'(or Command+s key)
Step 2 When you get the text/command prompt, type following using all the spaces correctly one by one

mount -uw /
rm /var/db/.AppleSetupDone
shutdown -h now

Step 3  restart and you will be prompted for setting up your account. follow those steps and you have got a new administrative account.

Only problem faced was that either you should have the Apple id handy or reregister again.

Happy hunting