WhatsApp to share data with Facebook.

             WhatsApp being one of the major messaging application owned by the social networking giant Facebook is used by billions of users across globe. Recently there is a news that WhatsApp is going to share personal information with Facebook.

             When Facebook owned WhatsApp for about $20 billion CEO Mark stated that the two platforms will co-exist as an independent separate platforms. The beta release of WhatsApp is believed to be having a code that share data with Facebook.

              The new feature dubbed as "Share my account info" if enabled will share the personal data with Facebook inorder to provide better user experience to users and it is also stated that it contains option such as sharing photo from WhatsApp and Vice versa for a photo album.

              Many stated that it is just the first step towards the deep integration of Facebook with WhatsApp but it has to be officially released by the giant.

               Also it contains an optional feature known as "Show security indicators" if enabled users messages will be encrypted with end to end encryption.

               End to end encryption means the messages emerging from one user will be encrypted and then can only be decrypted at the other end who is the intended user. No third party entity can decrypt the message even WhatsApp similar to that of the encryption by Apple for iMessages.

               Official update is to be released by WhatsApp and the optional features according to WhatsApp will provide better user privacy.

P.S : The post is to create awareness and not to create any negative impact.

                    

Crash Android, iProducts and also some Desktops.

                 Wanna crash cool gadgets like iPhone, iPad, Mac, Android devices and also some Desktop that has low processing power ? Then you are at right post. Recently a small hack has been released that can crash the above mentioned products.

                   There is a message in many social media spreading saying click the link and the link will be "#crashsafari" once the user clicks on the link then the browser will stop responding and the device may enter into a loop of restart also.

                   A simple link and has simple coding will cause the crash of your browser and it is due to the small script that has been placed in the page source code. 

                   The script contains a loop for 100000 times which calls the history.pushstate() HTML5 API which will insert the history entry into the browser and at the same time at one stage it will become unable to render the page by browser and enters Not Responding state.

                   Simple way to recover is to quit the application if iProducts and to kill the process in Task Manager if Windows. The opened tabs will be lost and if clicked on Restore then again it will happen.


Tested Browser : Safari in iPhone, iPad and Mac ; Firefox, Chrome in Windows, Android devices.

                    IE is not affected to this at normal settings and Chrome and Firefox crash occurs at a point when more resource has been consumed and there is no way. The link that causes crash is here. THE AUTHOR IS NOT RESPONSIBLE FOR ANY DAMAGE OCCURED BY CLICKING ON THE LINK AND SHOULD BE USED FOR EDUCATIONAL PURPOSE ONLY. If you are keen in testing test it with Virtual Machine not with Host machine.

P.S: The post is to create awareness and not to be misused.

Using Shareit ? - Its security password is 12345678.

               One of the major electronic manufacturers is Lenovo and it has been a hard days for Lenovo as they were charged for #Superfish Malware, #Installing Rootkits, #Website Hacked and then #Pre-installed Spyware. Now it is a flaw in its product.

               #Shareit - One of the famous application that has been used by millions for file transfer and also to share other media at very fast rate. Shareit protects users data with password and there has been major three flaws released with this product.

1. Man in the Middle Attack
2. Security Protocol Bypass
3. Poor Cryptographic storage.

                Man in the Middle attack is possible in which any one can sniff the packet that are being transferred between users and the attacker can also change the traffic that is being transmitted.

                Security Protocol Bypass is one such in which using the application any user can create a Wi-Fi hotspot to send files and that hotspot is not secured with password and thus anyone can connect to that open Wi-Fi and can sniff the traffic.

                The next flaw is one of the mass in which the security key used to secure the user data is none other than "12345678" which is a hard coded value in the source code itself. The key that are using "12345678" is the Third Worst password of 2015 as per password management company.

               The flaws has been patched and the new version has been rolled out for both Android and Windows users are advised to update the application to avoid any data loss.

P.S: The post is to create awareness and not to  create any negative impact.

Most widely used Hacking Tools.

              There has been many discussions that the word "#Ethical Hacking" has to be banned by saying that if Ethical Hacking is permitted then Ethical Murder should also be allowed, but without having a Penetration Testing on their own Infrastrucure I dont know how they know the security loopholes that exists.

               It is just a simple post to educate people on hacking tools that are most widely used by both Security Researchers and also by Cyber Criminals. The tools that are discussed below will create a hell amount of noise (Easy to detect) if not handled properly.

1. Kali Linux :

               If you are into cyber security this will not be a new word and it is a Linux Distribution with Debian kernel and fully loaded with pure hacking tools used to find the security of the infrastructure and the latest version is 2.0.

2. Metasploit :

                If you want to go deep and exploit the security vulnerabilities then it is the right tool. Metasploit built on Ruby language and has an awesome evasion module and if you master this tool, you can do anything with target machine if properly used.

3. Burp Suite :

                In many places you might heard of the word "PROXY" and you have to configure it in browser to use Internet. Burp Suite is a simple jar file that serves the proxy functionality. If you are into web application pen testing without Burp your work will not be finished.

4. Cain and Abel :

                 Awesome tool to crack Wireless passwords (Wi-Fi) and aslo to break the Windows authentication (Login) keys and also used to find passwords through Man-in-the-Middle (MiTM) attacks.

5. Wireshark :

                  Simple but Powerful tool used for protocol Analysis, packet analysis, Forensics and many more area. It will make a copy of the packets that are being transmitted in the Internet. To put it simple consider you can get what others are transmitting from their own system.

6. Nmap :

                   Port scanning tool but not only scanning tool with its advanced Script Engine (NSE) many more purposes can be accomplished. Very noisy if not used properly.

                    The above are few list of tools and remember they are Hacking tools and if used without proper configuration and wrong intent will simple put you behind bars before even you get the output from the tool.  THE AUTHOR IS NOT RESPONSIBLE FOR ANY DAMAGE DONE BY RUNNING THE TOOLS MENTIONED IN THIS POST AND SHOULD BE USED ONLY FOR EDUCATIONAL PURPOSE.

P.S : The post is to create awareness and not to misused.

Apple testing Li-Fi Technology for its devices.

                 People on large scale using Wi-Fi technology to transfer data from one node to another node and now there has been a technology invented to almost replace the Wi-Fi technology. Recently there is a news that Apple is testing the feature in its device.

               Li-Fi is the technology where light will be used to transfer data between nodes and it is still in development phase and now there is a news that Apple is going to incorporate that in the devices.

               Apple's iOS 9.1 source code is said to contain some indication for Li-Fi compatibility and the news has been confirmed by an Apple insider according to a Twitter user and also there is some news regarding new patent filed by Apple which shows they are working on some new technology related to Li-Fi.

               There has been many rumors about the iphone 7 in Internet and some even started that iphone 7 will be having Li-Fi technology and actually the technology is just proved theoretically and yet to be implemented.

               Many manufacturers are working to make it commercial and if it has been implemented successfully then the data transfer will be 100 times more faster with the speed of 220 Gbps.

               The technology Li-Fi may be implemented as commercial in near decade. 

P.S: The post is to create awaraness and not to create any negative impact.

Facebook's Built-in Tor Support.

           Are you concerned about your privacy in cyber space ? Are you feeling insecure thinking that someone is spying on you ? Then you should give a try to TOR (The Onion Routing) network. Recently Facebook adds in-built support to TOR.

           #TOR network has been many used by millions to hide their identity while surfing in cyber space and the way TOR works provides this anonymity and many of you might not be knowing that there is an .onion domain exists.

           .onion domain is another TLD (Top Level Domain) like .com. that we are using normally and the way .onion domain working provides services as a hidden service by hiding both the sender and the server identity.

            Few months back Facebook started a new .onion domain site inorder to provide ultimate anonymity to their user. Now, Facebook is adding TOR support to its Android App users.

           In order to use it you should have a #Orbot Proxy (To establish TOR network with proper settings) then you can open your Facebook app in Android device and select "Use TOR via Orbot" in the app setting menu.

           After the connection has been successfully established others including your ISP (Internet Service Provider) can not look into what data your are looking or requesting to the server.

           You can download the official Orbot proxy from here. The full functinality is still in testing phase and will be released soon by Facebook. 

Official Facebook .onion domain site link : https://facebookcorewwwi.onion   (Don't try Firefox or Chrome browser. It will work only in Tor browser).

P.S : The post is to create awareness and not to be misused.

WhatsApp is now Free Forever.

              #WhatsApp being one of the famous and mostly used messaging application owned by Facebook has an annual fee that has to be paid to retain the service. Recently WhatsApp founder announced that they are dropping the policy.

                 WhatsApp charges 99 cents for other nation users and 55 INR for Indian users but as for Indians they dint charge it. WhatsApp notified that due to many users in India not having Credit cards they made an exception and so no charges collected for Indian users.

                  Now WhatsApp has stated that they are dropping the policy and WhatsApp is a free service to use for ever in lifetime and there will be no charge levied on users.

                  Of course for earning profit they have imposed their own ways such as they will be giving a solution to business usage as a separate thing like A bank can buy premium service for WhatsApp business and they can communicate with their customers through that.

                  The same strategy has been followed by Facebook with its messenger application before.

P.S : The post is to create awareness and not to create any negative impact.

Hacking Wi-Fi Passwords through Smart Doorbells.

                As an advancement in Internet there comes a new era in which all electronic components are made smart by connecting them to the Internet in the name of #IoT (Internet of Things). Recently a security issue has been raised due to a IoT device.

                Security has been a major issue which threatens the whole cyber security industry if IoT is considered and now the security problem in the Smart Doorbell has been discovered.

                 Smart Doorbells are one such component that will produce the message to the phone if any user presses the door bell and even the user can see the image of the visitor through camera. Owner can even communciate with the visitor without evening opening the door.

                 The device has many other feature and it has been served as one such amazing component and then the security researchers started their work on this new smart device.

                 When the orange button behind the door bell is pressed the door bell can be changed to the Access Point (AP). An Access Point is the component through which Internet connectivity can be obtained.

                  After activating it as an AP then if any user connects to it and then navigating to the IP http://IP/gainspan/system/config/network then the user can see the home wi-fi password as plain text in the config file.

                   This means if any attacker presses the orange button and activating the device as AP can get the Home Wi-Fi password or the Wi-Fi password to which the door bell has been connected.

                   It is said that the component should be hidden from public viewing. 

P.S: The post is to create awareness and not to create any negative impact.

Hard-Coded password in Fortinet Firewalls.

               Cyber security is considered to be a myth these days and whatever security implementation placed in place, attacker finds a way to exploit it. Recently a famous Firewall vendor solution found to have a hardcoded password.

                Firewall is the security component everyone came across while considering cyber securiy. What if it is having a backdoor to access with hardcoded password. Hardcoded passwords are nothing but Passwords embedded in the coding itself.

                Actually Hardcoded passwords are left by developer due to the laziness or negligence to make complex coding to generate password or to enforce any secure coding practices.

                 Famous Firewall solution provider #Fortinet is accused of having a hardcoded password which allows the SSH login for the user with username Fortimanager_Access and password : FGTAbc11*xy+Qqz27. This is the hardcoded password found in Fortinet.

               The exploit code has been released publicly and with that code the attacker can exploit the Management user account and will get access to the Firewall maintainence page.

               The whole exploit code for the vulnerability can be found here. This has been notified to Fortinet and they have fixed it anyhow the Fortinet Firewall manufactured between November 2012 and July 2014.

                If the firmware has not been upgraded by the user then there is a chance of the vulnerability exists still in the firmware and users are advised to upgrade the firmware to avoid any further damage.

P.S: The post is to create awareness and not to create any negative impact.

Internet Explorer Support Stopped for 8,9 and 10.

               Microsoft has made many shocking moves to promote its new operating system named #Windows 10. Now there has been a hard decision taken by Microsoft regarding the support for Internet Explorer.

                Internet Explorer is the in built Internet Browser shipped with Windows operating system and it has variant such as versions 8 9 and 10. The new browser named #Edge browser has been integrated in Windows 10.

                Microsoft has decided to stop the support for Internet Explorer 8 9 and 10 from today (12.1.16) after releasing a security patch for the versions.

                After today (12.1.16) there will be no support and if there has been any security bug discovered will not be patched by Microsoft which may be a good news for some attackers.

                 This has been done by Microsoft and they also stated that to upgrade the browser to version 11 which is #Edge browser that is only now available in #Windows 10, so any user wishes to receive support for browser they have to move to Windows 10.

                  This may be a move by Microsoft to make their users to move to Windows 10 and use Microsoft Edge Browser.

P.S: The post is to create awareness and not to create any negative impact.

BangStresser - A Historic DDoS tool if proved.

             One of the main reason for the cyber attack is to make financial loss and also the business reputation loss. This can be very well accomplished by the Denial of Service (DoS) attack. Recently a large scale DDoS (Distributed Denial of Service) attack has been recorded.

               Last week Donald Trump website has been taken down and now it has been the BBC's website which has been taken down by the hackers and it is one of the major DDoS attack ever made.

               BBC stated it as Maintainence time but the group calling themselves #New World Hacking claims responsibility for the downtime of the BBC website and the hack last week on Donald Trump website.

               A person belonging to the same group under the name #Ownz has stated that they has a tool named #BangStresset which is capable to performing a DDoS attack of about 602 Gbps.

               Although the screenshots posted by the user has been yet been proved authentic and if proved it could be the historic attack and highest rate of DDoS attack ever made.

                They also posted that they have bypassed two Amazon Web Services server for this purpose and all the statement has not yet been proved and if proved it will be worst DDoS ever.

                  They also stated that their aim was to take ISIS propaganda down.

P.S: The post is to create awareness and not to create any negative impact.

Use Windows 7 at your own Risk.

             The title may look weird to some users but true it is the statement given by Microsoft itself and it may be one of the campaign by Microsoft to make its users install #Windows 10. Recently Microsoft released a statement that Windows 7 users can use it at their own risk.

             Microsoft rolled out #Windows 10 five months ago and it has promised that it will have one billion users running Windows 10 by 2017 and now 55 percent of users are running Windows 7.

             Microsoft chief officer stated that the users of Windows 7 can use it at their own risk. The important thing is that Windows 7 has security support upto 2020 as stated and also the softwares releasing now are compatible with Windows 7 also.

              The statement is not very clear of course Windows 10 offers more security and many more features according to the documentation and having support upto 2020 why its user risk to use Windows 7 is the question among many users.

              According to some sources this is the step taken by Microsoft to push users to use Windows 10 to reach its goal of having one billion systems running Windows 10 by 2017 which already reached 200 million as per their statement.

               This is a shocking statement as Microsoft followed many policies such as pop up message and also forced upgrade and now a statement to make users use Windows 10. 

P.S: The post is to create awareness and not to create any negative impact.

Hack HTTPS Traffic - Bicycle Attack.

                It is rightly stated that there is no absolute security in the Cyber world and we are using technology to provide security to atmost level and even then they can be torn apart. Recently an attack has been revealed for HTTPS traffic.

               All the web pages we are using uses HTTP (#Hyper Text Transfer Protocol) for fetching and  communicating some data and due to the insecurity of the protocol we moved to HTTPS (HTTP Secure) protocol to safeguard our sensitive data if transferred.

                It doesnot ends here HTTPS has many attack such as SSL Stripping, BEAST attack and now an attack has been revealed with which a potential attacker can get information such as Cookie header length, GPS coordinates and also the Password length.

                HTTPS works along with TLS and according to this attack it will tear down the traffic that are being transmitted below TLS and then it will give the hacker information about the data that is being transmitted.

                 In order to exploit this there are few pre requisite to be followed which is the Implementation should use Stream cipher and attacker must know the length of the rest.

                  If the attacker successfully exploits the attack then he/she can get GPS coordinates and Cookie header and also the password length with which the Brute Force attack on the password can be attempted.

                  It can be prevented if TLS stream cipher has been disabled from Webmaster side and use latest version of TLS 1.2 and also pad some data to the original data to mask the actual length.

                  The documentation about the attack can be found here.

P.S: The post is to create awareness and not to be misused.

Ransomware as a Service - Ransom32.

               Ransomware has been a serious malware as it causes unavailability to the data that are stored in our system. It comes under malware and recently a new service has been started as #Ransomware as a Service.

                Ransomware is a piece of malware that encrypts the total disk that contains the data with some algorithm and the key for decryption will be provided only when the victim pays some money as ransom.

                 It has been a serious threat and now it is a ransomware that was developed in Javascript and thus it is in Javascript that platforms that are vulnerable are #Windows, #Linux and #Mac OS X.

                 It has been hidden as NW.js and it has been given as an attachment or by any other means to the victim and once he/she triggers the download the script encrypts the total disk with AES algorithm and the victim has to pay the demanded bitcoins.

                The ransomware #Ransom32 has GUI in which user will have a dashboard which displays the status of how much the user has paid and how much remaining to pay and how to buy bitcoin article also.

                This has been sold as a service as such whoever can get that and only thing they have to give the location of their Bitcoin wallet and then the developer or author of the tool will have to be provided with some percent as a commission.

                Inorder to avoid these kind of ransomwares

1. Never ever click on link which you are never sure of (like Invoive, Unpaid bill, Refund etc.).
2. Make regular backup of all the files.
3. Install a good original Anti Virus software that has been updated regularly.
4. Be alert and never trust anyone in Cyber space.

P.S: The post is to create awareness and not to be misused.

Some facts about Spam emails.

              Every online user will receive a spam email to their email account. Actually how the spammers evade the security system and how many are falling as victim are mainly due to the users act.

               Spam are nothing but unwanted mails that are targeted for main focus such as Advertisement (not that only). Now there may be few questions within yourself how they get your email id?

               The answer is very simple it is the user who are giving their mail id. The possibilities may be Filling a survey online / offline, Providing data in untrusted sites, Disclosure of email account in social networking sites. There is another interesting thing.

                Actually spammers is not sure that you are using the account so they will send you a sample test mail with "Unsubscribe this Thread" option, we usually click it to prevent further irritation there comes the problem, clicking will notify spammer that "This email id is active", then you will be shooted with many mails.

                 One such thing used to evade the security system is by inserting the text in an image thus to evade system that looks for matching pattern. The best way to stop spamming is to report to the service provider about it. Google having option by which you can report Google then they deal with it.

                  The reason for this post is that there is a statistics that 70 percent of mails transferred are spam.

P.S : The post is to create awareness and not to create any negative impact.

Microsoft will notify user if Government is Spying.

                 In order to solve many cases or to gather evidence the Government Agencies or any other agency will spy on the users or criminals account. Many companies joined hands to notify the user if they are spied by Government agencies. Recently Microsoft also joins this and will notify the users.

                 Few months back there has been a hack in which many leaders accounts has been compromised to gather evidence and also to spy on them. At that time Microsoft simply asks them to change their password without revealing the actual reason.

                 Tech Giants Yahoo, Twitter, Google and Facebook stated that they will notify their users if their accounts are being accessed or spied by any Government Agencies. Now Microsoft also joins the line.

                  This may be shocking to some nations since they needed the access to the accounts to increase the national security and also to stop cyber terrorism, but this step of tech giants will increase privacy given to the users.

                  There has been another news that the OS developed by North Korea #Red Star OS which resembles Apple OS has a backdoor and all the activities are spied by North Korea itself, the nation spying on its own people.

                  Wishing all the readers a Prosperous and Happy New Year 2016.

P.S: The post is to create awareness and not to create any negative impact.