Mubasher Ashfaq

Cyber War Between India and Pakistan in May 2025: How Pakistan Gained Digital Dominance

noreply@blogger.com (Mubasher Ashfaq) — Tue, 09 Dec 2025 11:51:00 +0000

Cyber War Between India and Pakistan in May 2025: How Pakistan Gained Digital Dominance

Introduction to the 2025 Cyber Conflict

The world watched with wide eyes in May 2025 as India and Pakistan entered one of the most violent cyber competitions South Asia had ever seen. rather of tanks and spurts, this war played out through firewalls, translated networks, digital waiters, and artificial intelligence.

And unexpectedly to numerous judges, Pakistan surfaced with a clear upper hand showing remarkable cyber strength, protective strategy, and digital adaptability.

The Rising Importance of Cyber Warfare

Countries no longer calculate solely on physical munitions. In ultramodern conflict, a well timed cyber strike can cripple electricity grids, shut down air defence, concession military communication, and leak state secrets each without firing a single shot.

Why May 2025 Became a Turning Point

Pressures had been stewing, but May 2025 brought unknown digital aggression. A series of cyber intrusions, misinformation juggernauts, and politic attacks escalated into a full scale cyber battle.

Pakistan’s response? Fast, sharp, coordinated and deeply effective.

Background of Indo Pak Cyber Tensions

A History of Digital Skirmishes

The two countries have changed cyber dabs for times substantially website vandalism, data leaks, and small position infiltrations.

But 2025 was different. Both sides came prepared with stronger capabilities and advanced stakes.

The Build Up Before the May 2025 Incident

In the months leading up, Pakistan had quietly strengthened its cyber units and upgraded its digital surveillance. Meanwhile, India plodded with system vulnerabilities and internal collaboration gaps.

The Triggering Event of the Cyber War

Escalation Through Digital Provocations

Intelligence reports indicated suspicious intrusions targeting sensitive Pakistani networks. Once vindicated, Pakistan launched acounter response that set off a chain response.

Pakistan’s Rapid Response Strategy

Pakistan actuated its exigency cyber cells, erected on structure, speed, and perfection. Rather than replying blindly, Pakistan ran strategiccounter-attacks backed by real- time intelligence.

Pakistan’s Cyber Power Structure

Skilled Hackers and Ethical Hacking Communities

Pakistan’s ethical hacking communities including trained cybersecurity professionals and youthful digital experimenters played a massive part.

Their moxie in surveillance, penetration testing, and trouble stalking gave Pakistan a real edge.

Government Backed Cyber Defence Cells

By 2025, Pakistan had completely integrated cyber command units working under public security agencies. These brigades covered pitfalls 24/7 and stationed immediate countermeasures.

Use of AI and Machine Learning in Cyber Ops

Pakistan leveraged AI to descry anomalies, block incoming attacks, and automate responses that would have taken humans much longer to execute.

India’s Cyber Approach and Weak Points

Overreliance on Legacy Systems

India’s digital structure still included outdated waiters and weak encryption readily targets for advanced attacks.

Internal Security Gaps

Multitudinous state position agencies operated without central collaboration. This misalignment created exploitable loopholes.

Vulnerabilities in Communication Networks

Cyber judges set up vulnerabilities in certain Indian wireless and satellite communication systems, making them high targets for hindrance.

Major Cyber Battles Fought in May 2025

Attacks on Critical Infrastructure

Pakistan’s bushwhackers concentrated onnon-civilian targets, including

Strategic communication gateways
Early warning systems
Military data waiters

These strikes caused major dislocations on the Indian side.

Defensive Moves From Pakistan

Pakistan shielded its digital means through

Multi layer encryption
Real time trouble insulation
Distributed backup networks

Digital Intelligence and Counter Attacks

Pakistan traced attack origins and collapsed several Indian attack waiters, negativing active pitfalls.

How Pakistan Achieved Cyber Superiority

Advanced Reconnaissance Techniques

Before responding, Pakistan’s cyber experts scrutinized Indian networks for weak points, icing attacks were precise and effective.

Strong Coordination Between Agencies

Pakistan’s cyber units, air defence brigades, and intelligence services worked in complete sync commodity India plodded with.

Real Time Cyber Monitoring Systems

State of the art SIEM and SOC systems allowed Pakistan to descry and fight pitfalls incontinently.

Air Defence Impact During the Cyber War

Pakistan's Integrated Air Defence Response

India tried to exploit airspace vulnerabilities, but Pakistan combined cyber tools with physical air defence, creating a mongrel guard.

Neutralizing Indian Drone and Missile Guidance

Several Indian drone systems faced navigation failures after Pakistani drivers disintegrated their guidance software.

Role of Cyber Tools in Air Security

Cyber jamming, AI powered radar integration, and secure communication channels gave Pakistan a decisive edge.

Defeating India Digitally and Strategically

Shutting Down Indian Military Networks

Crucial military networks in India faced outages, decelerating their response time and disabling several digital operations.

Exposure of Critical Indian Weaknesses

Pakistan’s intelligence brigades linked gaps in Indian defence fabrics, exposing several areas demanding modernization.

Maintaining Control Without Physical Conflict

The most emotional part? Pakistan kept the conflict digital, guarding civilians and avoiding escalation.

Lessons Learned From the Cyber Conflict

Importance of Cyber Preparedness

The May 2025 war proved that cyber power is as pivotal as nuclear or conventional strength.

How Nations Can Strengthen Defence Systems

Countries must:

Invest in cyber education
Make stronger AI powered defence
Reduce reliance on growing technology

The Future of Indo-Pak Cyber Relations

Potential for Diplomacy

Still, escalation can be averted in future, If both nations borrow structured cyber agreements.

Risks of Future Escalations

Ignoring vulnerabilities could lead to indeed more dangerous conflicts.

Conclusion

The cyber clash of May 2025 between India and Pakistan reshaped South Asia’s security geography. Pakistan’s success lay in medication, smart strategy, slice edge tech, and tight collaboration. The conflict made one thing clear the coming generation of warfare will be fought not just on borders but in bytes, waiters, and algorithms.

FAQs

What triggered the cyber war in May 2025?

A series of digital intrusions andcounter-attacks escalated pressures fleetly.

How did Pakistan overpower India digitally?

Through better collaboration, AI grounded defence systems, and exploiting Indian network vulnerabilities.

Did air defence really play a role in the cyber war?

Yes cyber tools were used to disrupt drone signals and cover airspace.

Can such a conflict happen again?

Absolutely, unless both countries strengthen cyber protocols and politic channels.

What’s the biggest lesson for nations worldwide?

Ultramodern wars demand strong digital defences just as important as physical bones.

Unveiling the Latest Zoom Hack: Windows Compromise and Login Password Vulnerability

noreply@blogger.com (Mubasher Ashfaq) — Thu, 02 Apr 2020 16:14:00 +0000

New Zoom Hack Lets Hackers Compromise Windows and Its Login Password

Zoom has been there for nine years, but the immediate requirement of an easy-to-use video conferencing app during the coronavirus pandemic overnight made it one of the most favorite communication tool for millions of people around the globe.

No doubt, Zoom is an efficient online video meeting solution that's helping people stay socially connected during these unprecedented times, but it's still not the best choice for everyone—especially those who really care about their privacy and security.

According to cybersecurity expert @_g0dmode, the Zoom video conferencing software for Windows is vulnerable to a classic 'UNC path injection' vulnerability that could allow remote attackers to steal victims' Windows login credentials and even execute arbitrary commands on their systems.

Such attacks are possible because Zoom for Windows supports remote UNC paths that convert potentially insecure URIs into hyperlinks when received via chat messages to a recipient in a personal or group chat.

Hacking Zoom to Steal Windows Passwords Remotely

Confirmed by researcher Matthew Hickey and demonstrated by Mohamed Baset, the first attack scenario involves the SMBRelay technique that exploits the fact that Windows automatically exposes a user's login username and NTLM password hashes to a remote SMB server when attempting to connect and download a file hosted on it.

To steal Windows login credentials of a targeted user, all an attacker needs to do is sent a crafted URL (i.e., \\x.x.x.x\abc_file) to a victim via a chat interface.

Once clicked, the attack would eventually allow the attacker-controlled SMB share to automatically capture authentication data from Windows, without the knowledge of the targeted user.

To be noted, the captured passwords are not plaintext; instead, NTLM hashes of them, but a weak one can easily be cracked in seconds using password cracking tools like HashCat or John the Ripper.

In a shared environment, like office space, stolen Windows login credentials can be reused immediately to compromise other users or IT resources, and launch further attacks.

Exploiting Zoom to Compromise Windows Systems Remotely

Besides stealing Windows credentials, the flaw can also be exploited to launch any program already present on a targeted computer or execute arbitrary commands to compromise it remotely, confirmed by Google security researcher Tavis Ormandy & CEO of Virus Community.

As shown, Ormandy demonstrated how the UNC path injection flaw in Zoom can also be exploited to run a batch script—without a prompt—containing malicious commands when called from the Windows default download directory.

The second attack scenario relies on the fact that browsers running on Windows operating system automatically save downloaded in a default folder, which can be abused to first trick a user into downloading the batch script and then triggering it using the zoom bug.

To be noted, to exploit this issue, an attacker must be aware of the Windows username for the targeted user, which, however, can easily be obtained using the first SMBRelay attack.

In addition, another security researcher going by the name 'pwnsdx' on Twitter shared another trick with The Hacker News that could let attackers hide malicious links when displayed at the recipients' end, potentially making it look more convincing and practical.

What Should Zoom Users Do?

Zoom has already been notified of this bug, but since the flaw has not yet been patched, users are advised to either use an alternative video conferencing software or Zoom in their web browsers instead of installing a dedicated client app on their systems.

(Update: A day after we published this report, Zoom apologies for falling short of privacy and security expectations and released an updated version if it software to patch recently reported multiple security issues, including UNC path injection.)

Some of the best alternative video conferencing and chat software are:

Skype & Microsoft Teams (up to 50 participants)
Google Hangouts Meet (up to 250 participants)
Google Duo
Jitsi (free, encrypted, open source, up to 75 participants)
FaceTime and Signal for privacy

Besides using a strong password, Windows users can also change the security policy settings to restrict the operating system from automatically passing their NTML credentials to a remote SMB server.

More Zoom-related Security and Privacy Incidents

This is not the only issue to have been uncovered in Zoom video conferencing software over the past couple of days, raising privacy and security concerns among millions of users.

The FBI is warning zoom users of the "Zoom-Bombing" attack after some people find a way to sneak their way into unsuspecting meetings and online gatherings and bombarded them with pornographic images or racist comments.

Just yesterday, another report confirmed that Zoom doesn't use end-to-end encryption to protect calling data of its users from prying eyes despite telling users that "Zoom is using an end to end encrypted connection."

Last week, Zoom updated its iOS app after it was caught sharing users' device information with Facebook, raising legitimate concerns over users' privacy.

Earlier this year, Zoom also patched another privacy bug in its software that could have let uninvited people join private meetings and remotely eavesdrop on private audio, video, and documents shared throughout the session.

Conclusion

The discovery of the latest Zoom hack revealing a significant Windows compromise and login password vulnerability is a matter of great concern for users worldwide. This revelation highlights the critical need for heightened cybersecurity measures and vigilance when using video conferencing platforms. Hackers exploiting such vulnerabilities could gain unauthorized access to Windows systems and compromise sensitive data, including login passwords.

To safeguard against potential attacks, it is crucial for users to promptly update their Zoom software and operating systems with the latest security patches. Additionally, adopting strong and unique passwords, enabling two-factor authentication, and exercising caution while clicking on suspicious links or downloading files can greatly mitigate the risk of falling victim to such hacks.

Furthermore, it is essential for Zoom and other video conferencing platforms to take swift action in addressing these vulnerabilities and reinforcing their security infrastructure. Implementing robust encryption protocols, conducting regular security audits, and fostering a culture of cybersecurity awareness among users are pivotal steps towards ensuring a safer digital environment.

Ultimately, the unveiling of this Zoom hack serves as a reminder of the evolving threat landscape and the ongoing need for individuals, organizations, and technology providers to remain proactive in safeguarding their digital lives. By staying informed, implementing best practices, and leveraging the latest security measures, users can fortify their defenses and protect themselves against emerging cyber threats.

FBI Had Unlocked iPhone 11 Max Pro Using Third Party Resources

noreply@blogger.com (Mubasher Ashfaq) — Tue, 21 Jan 2020 19:47:00 +0000

FBI Had Unlocked iPhone 11 Max Pro Using Third Party Resources

Apple products are touted to be having the best security features when compared to others. While it’s said so, any gadget makers are forced to unlock/crack their devices when ordered by law enforcement for investigation purposes. Though many comply, Apple doesn’t, at least not so easily. This made the company a target for Trump’s administration in many cases.

Yet, the lawyer Barr scolded Apple for not giving them substantial assistance in the case. This led even Trump to make a statement on Apple. While this being the case, a report from Forbes claims that FBI has used a third-party service called GrayKey to unlock iPhone 11 Max Pro last year, which belonged to a person called Baris Koch for investigation purposes.

Baris Koch helped his brother, Izmir Koch flew away from the US to Russia via Mexico and Europe using Baris’ passport and details. This led Baris to face a trial soon for making false claims to FBI and misprision of a felony. All this is because he helped his brother, who’s convicted with hate crime and sentenced to 30 months of prison.

As Forbes reported, it had contacted Koch’s lawyer to confirm that they haven’t given Koch’s passcode nor being forced for FaceID, yet FBI somehow unlocked the phone. The confirmation came when a search warrant reported that the FBI used a device called GrayKey to unlock iPhone. The real question now is, of government is capable of unlocking phones anyway, why would it force Apple to unlock it officially?

Apple Bug Bounty Program, Hack Apple And Earn 1 Million Dollars

noreply@blogger.com (Mubasher Ashfaq) — Sun, 22 Dec 2019 13:33:00 +0000

Hack Apple And Earn 1 Million Dollars

Apple Bug Bounty Program

Apple Invited Hackers for Bug Bounty program
Earn up-to 1 Million Dollars
Open for all CyberSecurity researchers
Previously Apple Bug Bounty Program opens for selected security researchers, and now it’s open for all.

Eligibility to Hack

To be eligible for an Apple Security Bounty, the issue must occur on the latest publicly available versions of iOS, iPadOS, macOS, tvOS, or watchOS with a standard configuration and, where relevant, on the latest publicly available hardware.

These eligibility rules are meant to protect customers until an update is available, ensure Apple can quickly verify reports and create necessary updates, and properly reward those doing original research. Researchers must:

Be the first party to report the issue to Apple Product Security.
Provide a clear report, which includes a working exploit (detailed below).
Not disclose the issue publicly before Apple releases the security advisory for the report. (Generally, the advisory is released along with the associated update to resolve the issue).
Issues that are unknown to Apple and are unique to designated developer betas and public betas, including regressions, can result in a 50% bonus payment. Qualifying issues include:

Security issues introduced in certain designated developer beta or public beta releases, as noted on this page when available. Not all developers or public betas are eligible for this additional bonus.

Regressions of previously resolved issues, including those with published advisories, that have been reintroduced in a developer beta or public beta release, as noted on this page when available.

To be Payout Offers

Unauthorized iCloud Account Access

$25,000 for Limited unauthorized control of an iCloud account.

$100,000 for Broad unauthorized control of an iCloud account.

Physical Access to Device: Lock Screen Bypass

$25,000 for Access to a small amount of sensitive data from the lock screen (but not including a list of installed apps or the layout of the home screen).

$50,000 for Partial access to sensitive data from the lock screen.

$100,000 for Broad access to sensitive data from the lock screen.

Physical Access to Device: User Data Extraction

$100,000 for Partial extraction of sensitive data from the locked device after first unlock.

$250,000 for Broad extraction of sensitive data from the locked device after first unlock.

User-Installed App: Unauthorized Access to Sensitive Data

$25,000. App access to a small amount of sensitive data normally protected by a TCC prompt.

$50,000 for Partial app access to sensitive data normally protected by a TCC prompt.

$100,000 for Broad app access to sensitive data normally protected by a TCC prompt or the platform sandbox.

User-Installed App: Kernel Code Execution

$100,000 for Kernel code execution reachable from an app.

$150,000 for Kernel code execution reachable from an app, including PPL bypass or kernel PAC bypass.

User-Installed App: CPU Side-Channel Attack

$250,000 for CPU side-channel attack allowing any sensitive data to be leaked from other processes or higher privilege levels.

Network Attack with User Interaction: One-Click Unauthorized Access to Sensitive Data

$75,000 for One-click remote partial access to sensitive data.

$150,000 for One-click remote broad access to sensitive data.

Network Attack with User Interaction: One-Click Kernel Code Execution

$150,000 for One-click remote kernel code execution.

$250,000 for One-click remote kernel code execution, including PPL bypass or kernel PAC bypass.

Network Attack without User Interaction: Zero-Click Radio to Kernel with Physical Proximity

$50,000 for Zero-click code execution on a radio (e.g. baseband, Bluetooth or Wi-Fi) with only
physical proximity, with no escalation to kernel.

$200,000 for Zero-click partial access to sensitive data, with only physical proximity.

$250,000 for Zero-click kernel code execution, with only physical proximity.

Network Attack without User Interaction: Zero-Click Unauthorized Access to Sensitive Data

$100,000 for Zero-click attack that can turn on and collect information from a sensor (e.g., camera, microphone, or GPS).

$250,000 for Zero-click partial access to sensitive data, without physical proximity.

$500,000 for Zero-click broad access to sensitive data.

Network Attack without User Interaction: Zero-Click Kernel Code Execution with Persistence and Kernel PAC Bypass

$1,000,000 for Zero-click remote chain with full kernel execution and persistence, including kernel PAC bypass, on latest shipping hardware.

How To Report Apple vulnerability?

Once you found the vulnerability, you need to send the report by email to product-security@apple.com. Whenever possible, encrypt all communications with the Apple Product Security PGP Key. Include all relevant videos, crash logs, and system diagnosis reports in your email.

Unprotected 267 Million Facebook User ID'S And Phone Numbers Leaked Online

noreply@blogger.com (Mubasher Ashfaq) — Fri, 20 Dec 2019 19:47:00 +0000

Unprotected 267 Million Facebook User ID'S And Phone Numbers Leaked Online

There are total of 267,140,436 users records found.
Including Facebook user ID
Including Profile name and Phone number

The Database found by a security researcher named Bob Diachenko included user’s profile name and phone number for 267 million Facebook users.

According to the researcher, the databases were unprotected and uploaded to the hacker forum.

According to Comparative partnered with security researcher Bob Diachenko to uncover the Elastic-search cluster.

Diachenko immediately notified the internet service provider managing the IP address of the server so that access could be removed. However, Diachenko says the data was also posted to a hacker forum as a download.

The database was exposed for nearly two weeks before access was removed.
December 4 – The database was first indexed.
December 12 – The data was posted as a download on a hacker forum.
December 14 – Diachenko discovered the database and immediately sent an abuse report to the ISP managing the IP address of the server.
December 19 – The database is now unavailable.

How To secure your Facebook account

Method 1

Open your Facebook account
Go to Settings
Click on Privacy
Set relevant fields to Friends or Only Me
Set “Do you want search engines outside of Facebook to link to your profile” to NO
It will help to protect your profile from advertisers or third parties companies.

Method 2

Don’t use your Facebook password similar to your any other account
Never share your password. Always Create Unique password
Change your password regularly.
Use Facebook extra security features like 2 Factor authentication
Log out Facebook when you use other computers
Do not use Public Wi-Fi
Do not click unknown link on your Computer or App
It is not the first time that the Facebook database has leaked.

Previously Leaked

In April 2019, 540 million Facebook records found by Upguard security researchers.

In September 2019, we have reported 419 million Facebook user’s database had leaked. Including 133 million records on U.S.-based Facebook users, 18 million records of users in the U.K, and another with more than 50 million records on users in Vietnam.

In October 2018, 30 Million Facebook Users Account Hacked officially, including User’s Personal Info, Email Address, Phone Number, and Location exposed.

North Korean Hackers Used A Basic Hacking Trick To Hack ISRO’s Server

noreply@blogger.com (Mubasher Ashfaq) — Sun, 10 Nov 2019 16:29:00 +0000

North Korean Hackers Used A Basic Hacking Trick To Hack ISRO’s Server

Yesterday, we share a piece of detailed information about the hacks conducted on ISRO space station. A group of Korean hackers, Lazarus, hacked into the systems of Indian Space Station using a malware known as DTrack.

It has been suggested by some sources that ISRO employees may have received a phishing email, something close to what we all receive on a daily basis, the mail when opened infected the systems of the Space Stations.

How was the hack conducted by Lazarus?

Yash Kadakia, founder of Security Brigade, a cybersecurity firm based in Mumbai, said in an interview with Financial Times that the hack conducted by the Korean hackers was not very technical and beyond the seven skies, it was just a phishing mail, an unpatched browser and lack of monitoring that spill the tea and made it easy for the hackers to infiltrate the systems.

Mr. Kadakia also said that the same server was used to send spam links to senior nuclear scientists of Kudankulam Nuclear Plant which was also targeted by the hackers before and later was used to target the scientists at ISRO.

Mr. Kadakia, who is working along with South-Korea based malware analysts, IssueMaker labs, also said that they have the email address of the scientist who received the phishing mail and has shared the email with National Critical Information Infrastructure Protection Centre (NCIIPC) for further investigation.

However, Mr. Kadakia also said that it is not yet confirmed if the phishing email was successfully executed and whether the scientist used the email on his personal device or the company’s system.

The Korean hackers breached the domain controllers which gave them access to the main system, steal data and respond to security authentication requests. An ISRO official also confirmed that the organization received an alert from the Computer Emergency Response Team, India during Chadrayaan 2 mission but ISRO remained unaffected, as per The Quint.

According to the Cyber Experts, ISRO was one of the five government agencies on the targets of Lazarus, the Korean Hacker group. The space station was also informed about the situation before the mission started facing several communication issues with the Lander Vikram, but ISRO kept saying that the internal systems are free from any threats.

Not to forget, the Delhi based website of the current government of India was also hacked by a group of Hackers based in Pakistan, and posted hate messages against the Prime minister of India.

Facebook’s Data Sharing and Privacy Rules: 5 Takeaways From Our Investigation.

noreply@blogger.com (Mubasher Ashfaq) — Fri, 21 Dec 2018 20:07:00 +0000

Facebook’s Data Sharing and Privacy Rules: 5 Takeaways From Our Investigation.

Facebook deals in data

“We don’t sell data to anyone,” Mark Zuckerberg, Facebook’s founder, told Congress during a hearing in April. His pledge — that the torrent of data Facebook collects from its 2.2 billion users will always remain safely in Facebook’s hands — has been a cornerstone of the company’s defensive strategy this year, as lawmakers, regulators and activists have pummeled the social network over a series of privacy breaches and public relations blunders.

While it is true that Facebook hasn't sold users’ data, for years it has struck deals to share the information with dozens of Silicon Valley companies. These partners were given more intrusive access to user data than Facebook has ever disclosed. In turn, the deals helped Facebook bring in new users, encourage them to use the social network more often, and drive up advertising revenue.

Facebook’s largest partners got far more access than Cambridge Analytica did

Revelations in March that a political consulting firm linked to President Trump had improperly obtained data on as many as 87 million Facebook users set off the worst crisis in Facebook’s history. The company’s stock plunged, as regulators around the world demanded answers and users worried that Facebook wasn’t protecting their data. In response, Facebook pointed to changes it had made to its privacy policy in 2014, saying that developers no longer had the kind of access that Cambridge had exploited.

But The Times’s investigation reveals that Facebook continued to give huge tech companies, including Microsoft and Amazon, access to much more: the data of hundreds of millions of people a month, including email addresses and phone numbers — without users’ knowledge or consent.

Facebook never directly told users that it was sharing this data

Internal documents obtained by The Times show that Facebook shared data with more than 150 companies — most of them tech businesses, but also automakers, media organizations (including The Times) and others.

While Facebook users can control what data they share with most of the thousands of apps on Facebook’s platform, some companies had access to users’ data even if they had disabled all sharing. Many of the partners’ applications never even appeared in Facebook’s user application settings. According to Facebook, each of the outside companies acted as an extension of the social network. Any information a user shared with friends on Facebook, the company argues, could be shared with these partner companies without additional consent.

Facebook was sloppy

The data partnerships date to 2010, at the start of a period of headlong growth and expansion for Facebook. Within a few years, the social network had struck so many of these deals that Facebook employees built a tool to track the different types of access the partners had.

Despite this, Facebook appears not to have kept close tabs on how its users’ data flowed out into the world. A Russian social media company, Yandex, that has been accused of having overly close ties to the Kremlin, still had access to Facebook’s unique user IDs for years after Facebook had cut off other applications from the data, citing security concerns.

Likewise, Facebook gave Yahoo the ability to display a Facebook user’s news feed — including friends’ posts — on the search company’s home page. Yahoo got rid of the feature in 2012. But as of last year, it still had access to data for close to 100,000 people a month.

Regulators let it happen

Under the terms of a 2011 consent agreement with the Federal Trade Commission, Facebook was required to strengthen privacy safeguards and disclose data practices more thoroughly. The company hired an independent firm, PricewaterhouseCoopers, to formally assess its privacy procedures and report back to the F.T.C. every two years.

Four former officials and employees of the F.T.C., briefed on The Times’s findings, said the data-sharing deals likely violated the consent agreement, since users had no way of knowing which companies Facebook had shared their data with, and no clear means of granting or withholding permission. At least one assessment by PricewaterhouseCoopers, in 2013, found that Facebook had done little to ensure that the shared data was appropriately safeguarded.

Facebook maintains that the partnerships are covered by an exemption to the consent decree. A spokeswoman for the F.T.C., which last spring opened a new investigation into Facebook, declined to say whether the commission agreed.

PayPal come to Pakistan.

noreply@blogger.com (Mubasher Ashfaq) — Wed, 21 Nov 2018 22:25:00 +0000

PayPal come to Pakistan

There has been a repeated demand from freelancers and e-commerce players to bring PayPal to Pakistan. Finance Minister Asad Umar has also shown commitment to facilitating its arrival. There is also a demand that we should set up our own PayPal-like payment gateway.

First, let’s look at some of the reasons why freelancers and e-commerce players want PayPal or a similar platform to come to Pakistan. We will later discuss whether we need PayPal or a local payment platform can solve our problems.

Why PayPal matters?

Pakistan is the fourth largest freelancer community in the world. As per the estimates of Payoneer, Pakistani freelancers bring about $1 billion to Pakistan via other sources.

Most of these platforms charge a fee between five per cent and 30pc. Having access to PayPal allows freelancers to ask their customers to send money via this platform, which costs them only 2.5pc. PayPal allows sending the invoice directly to the customer or easy integration in the website within two minutes.

There are also companies that sell subscription software like $10 a month or $80 a month. Platforms like PayPal offer easy recurring payment setups. Customers feel safe in allowing such platforms to store their credit card and keep charging them every month.

Customers also trust PayPal because it offers an easy dispute mechanism. They know they can file an easy dispute with PayPal if the service provider fails to deliver.

There are payment gateways available for freelancers from banks in Pakistan. However, the process to get such a payment gateway is not straightforward compared to international gateways. Freelancers are not interested in integrating them as the process is often very difficult.

International e-commerce players

E-commerce has a huge potential for Pakistani companies, including those in Sialkot and Faisalabad. They can establish their brands online and sell internationally. Local players don’t need PayPal as most customers don’t know about it. However, international customers trust PayPal. Research shows that having PayPal or an e-commerce website can increase sales by up to 50pc because of the trust factor.

There are many e-commerce players that get inventory from China for their products. Using a Pakistani payment gateway doesn’t work for them because the process of converting money to the rupee at a lower rate and then sending it to China is very slow.

These companies also use Facebook and Google ads to advertise their products, which are taxed heavily in Pakistan. So they keep their money outside instead of bringing it to Pakistan. This is costing Pakistan dearly and keeping these players outside of our taxation system.

Do we really need PayPal?

With PayPal, we get more business because of the trust factor. As a country, we should enable our entrepreneurs to do business globally. Allowing PayPal or making it easy for such platforms will help us get out of the way of entrepreneurs.

Whoever has an option to set up a company abroad or use the accounts of their aunts and uncles prefers to open a PayPal or similar company’s account internationally.

They prefer PayPal because they feel they are being squashed by first getting a lower exchange rate and then paying a higher one to pay Google, Facebook and their suppliers in China or elsewhere. We should enable PayPal and other international players like Stripe to easily come and expand here.

Will PayPal come Pakistan?

PayPal has issues with the Financial Action Task Force (FATF). We also have $2.5 million State Bank of Pakistan (SBP) fee, which makes it a total no-go area for companies like Freelancer. The fee can be removed as a first step.

It might still be difficult for PayPal to come to Pakistan due to the risks of fraud and money laundering. There are countries such as Costa Rica that have set up risk funds as collateral for companies like PayPal. Having such funds can decrease the risk for these companies.

Case for a local payment platform

There is a huge need for enabling our own companies to build platforms like PayPal. The SBP licence fee of $2.5m simply discourages any innovation that is required in this space. There are various reasons why having a local platform will help us greatly.

One, money will be retained locally. This is one of the biggest reasons. Money from Freelancer or other e-commerce players will be kept locally. This has to be allowed in both dollars and rupees. Otherwise, there will be minimal adoption by players. Getting the rupee at a lower rate and then paying a higher rate to buy services abroad or even get taxed at 4-5pc doesn’t make sense for them.

Money will be converted to the rupee as soon as the account holder transfers it to their bank account. This will keep the SBP happy as well.

Two, it will help boost local e-commerce players. Having a good dispute mechanism will increase the trust of local Pakistani e-commerce players. This will build the trust of the e-commerce store for online transactions.

Three, it will save us from the Visa and MasterCard processing fees. MasterCard and Visa get a cut for every transaction that happens online involving the transfer of money from one account to another on the same platform. We can move towards eliminating these platforms from our payment system. China has successfully done it. Although we may not be able to do it at the scale of China, documenting the economy will help us greatly.

Chinese spies reportedly inserted microchips into servers used by Apple, Amazon, and others.

noreply@blogger.com (Mubasher Ashfaq) — Thu, 04 Oct 2018 22:08:00 +0000

Chinese spies reportedly inserted microchips into servers used by Apple, Amazon, and others.

A new report citing current and former US intelligence sources claims details an audacious hack.

Chinese spies have infiltrated the supply chain for servers used by nearly 30 US companies, including government contractors, Apple, and Amazon, according to an explosive report from Bloomberg Business week.

The operation is perhaps the most audacious example of hardware hacking by a nation state ever publicly reported, with a branch of China’s armed forces reportedly forcing Chinese manufacturers to insert microchips into US-designed servers. The chips were “not much bigger than a grain of rice,” reports Bloomberg, but able to subvert the hardware they’re installed on, siphoning off data and letting in new code like a Trojan Horse.

According to Bloomberg, Amazon and Apple discovered the hack through internal investigations and reported it to US authorities. The publication says there’s no direct evidence that the companies’ data or that of users was stolen or tampered with, but both firms worked quietly to remove the compromised servers from their infrastructure.

Both Amazon and Apple strongly refute the story. Amazon says it is “untrue” that it knew of “servers containing malicious chips or modifications in data centers based in China,” or that it “worked with the FBI to investigate or provide data about malicious hardware.” Apple is equally definitive, telling Bloomberg: “On this we can be very clear: Apple has never found malicious chips, ‘hardware manipulations’ or vulnerabilities purposely planted in any server.”

The attack was reportedly carried out via the US-based company Super Micro Computer Inc, commonly known as Supermicro. The firm is one of the world’s biggest suppliers of server motherboards, and contracts out manufacturing to factories in China and elsewhere.

Supermicro’s motherboards are used around the world, both for specialist products like MRI machines and weapon systems and for data centers used by tech giants. The company manufactures servers for hundreds of customers, including Elemental Technologies, a startup that specializes in video compression and that was acquired by Amazon in 2015.

“Think of Supermicro as the Microsoft of the hardware world,” a former US intelligence official told Bloomberg. “Attacking Supermicro motherboards is like attacking Windows. It’s like attacking the whole world."

According to Bloomberg, it was Elemental (via Supermicro) that was a prime target for the Chinese military. Elemental’s servers “could be found in Department of Defense data centers, the CIA’s drone operations, and the on board networks of Navy warships,” says the publication, with thousands more used by Apple and Amazon. In total, the attack affected almost 30 US companies, including government contractors and one major bank.

Parts of Bloomberg’s story have been previously reported. Apple did sever its relationship with Supermicro in 2016, but the iPhone-maker claimed this was due to an unrelated and minor security incident. Amazon reportedly distanced itself from Supermicro’s compromised servers by selling its Chinese infrastructure to a rival, for unknown reasons at the time. In a statement to Bloomberg, Amazon admitted finding “vulnerabilities” in Supermicro’s products, but said they were software, not hardware, related. Facebook, another potential customer, also found problems with Supermicro’s products, identifying malware in the company’s software and removing the servers from its data centers.

Bloomberg’s reporting has not been confirmed by on-the-record sources from the US intelligence community. The FBI and the Office of the Director of National Intelligence, representing the CIA and NSA, declined to comment for the story. However, it’s well known that such hardware sub versions are a big prize for a nation’s intelligence outfits — the NSA itself has been caught carrying out similar operations. They promise huge rewards in terms of stolen information, but leave behind physical trails, unlike software hacks.

As with other large-scale hacks and security failures, the repercussions of the operation as reported by Bloomberg will be difficult to judge. According to the publication, the US intelligence community’s investigation is still ongoing, three years after it was opened.

Facebook breach hit up to 5 Million EU users, and it faces up to $1.63 Billion in fines

noreply@blogger.com (Mubasher Ashfaq) — Tue, 02 Oct 2018 03:20:00 +0000

Facebook breach hit up to 5 Million EU users, and it faces up to $1.63 Billion in fines

Less than 10 percent of the 50 million users attacked in Facebook’s recent breach lived in the European Union, tweeted the Irish Data Protection Commission, which oversees privacy in the region. However, Facebook still could be liable for up to $1.63 billion in fines, or 4 percent of its $40.7 billion in annual global revenue for the prior financial year, if the EU determines it didn’t do enough to protect the security of its users.

Facebook wrote in response to the IDPC’s tweet that “We’re working with regulators including the Irish Data Protection Commission to share preliminary data about Friday’s security issue. As we work to confirm the location of those potentially affected, we plan to release further info soon.

Facebook alerted regulators and the public to the breach Friday morning after discovering it Tuesday afternoon. That’s important because it came under the 72-hour deadline for announcing hacks that can trigger an additional fine of up to 2 percent of a company’s global revenue if not met.

That hack saw sophisticated attackers combine three bugs in Facebook’s profile, privacy and video uploading features to steal the access token of 50 million users. These access tokens could allow the attackers to take over user accounts and act as them on Facebook, Instagram, Oculus and other sites that rely on Facebook’s login system. The EU’s GDPR laws threaten heavy fines for improper security practices and are seen as stricter than those in the U.S., so its findings during this investigation carry weight.

The big question remains what data was stolen and how it could potentially be misused. Unless investigators or journalists discover a nefarious application for that data, such as how Cambridge Analytica’s ill-gotten data was used to inform Donald Trump’s campaign strategy, it’s unlikely for the public to see this as more than just another of Facebook’s constant privacy scandals. It could still trigger regulation, or push partners away from using Facebook’s login system, but the world seems to be growing numb to the daily cyber security breaches that plague the internet.

Power of C++ (Do you know 40+ Operating Systems written in C++ Programming)

noreply@blogger.com (Mubasher Ashfaq) — Fri, 28 Sep 2018 23:27:00 +0000

Power of C++

(Do you know 40+ Operating Systems written in C++ Programming)

DG/UX
DDC-l
OpenVMS
Ultrix HP-UX
Enea OSE
Google Chrome OS
Android
HP-UX 11i
z/OS AIX (Advanced Interactive Exective)
OpenSolaris
OS/2
IBM Academic Operating System
ICL VME (Virtual Machine Entertainment)
MicroC/OS-III WindowsNT
Windows CE
Singularity Operating System
RTXC Quadros
OS-9
Solaris UNIX
Minix
BSD Unix
Darwin
Linux
OpenIndiana ReactOS
Inferno
MorphOS
EmuTOS
iOS
Maemo Windows Phone
iPoadLinux
Rockbox
eCos
ThreadX
Unix AmigaOS
Mint (Mint is now Tos)

What People get Wrong about Crypto

noreply@blogger.com (Mubasher Ashfaq) — Thu, 13 Sep 2018 13:31:00 +0000

What People get Wrong about Crypto

My Name is Mubasher Ashfaq.
I am CEH and Security Researcher from Pakistan
I think for many people it's - the concept seen very abstract and i think the hardest thing is for people to understand, and to the extent that they get it wrong, i think probably it's because not enough people are explaining it very well, because most of the people are explain it as a payment mechanism, not as a store of value and why it might be a good store of value. so i think people don't understand the philosophy behind it, because the people now in the business where not 2009 and 2010 they didn't care about the philosophy. People who have got into it now talk more about block chain than bitcoin, because they're just looking for an alternative model to make money and they don't care about they're agnostic to the initial philosophical framework that drove people to adopt bitcoin to begin with and kept it alive from 2009 through 2009 through 2013 or '14 when all of a sudden, adoption started to grow. There was a small universe of people that actively worked to keep it alive by continuing to mine and continuing to buy and they were doing it because of the concept that they believed in, and that it's a people's money. And even what i told my friends years ago when i said, 'if you buy crypto, all you got to sit back and think about is don't think about how it's going to be priced today or tomorrow'. First, be prepared to lose everything you invest in, and wait until and wait for five years and don't even think about trading it. If bitcoin's alive in five years, t's going to be significantly higher than it is the day you buy it. since bitcoin has been created in 2009. it's outperformed every currency,
even with governments hostile to it, and a regulatory regime that's an uncertain regime and the governments have been designing, have been managing it in a way so people cannot know what to except. So it's amazing the valuation it has today given the fact that it only faces, it only faces headwinds, not tailwinds. Every government throughout the world is trying to figure out how to stop and kill bitcoin. I think over five years, you're going to accumulate a lot more wealth than you would in any other alternative investment, but again you don't want to buy more than you can afford to lose, because i could be wrong, and you'd making a statement to the government that says, 'what you're doing is completely unacceptable.' Because if you think about how the financial system works, the financial system punishes the saver and benefits the borrower, but only benefits a small classification of borrowers. You know, i calculated you know and i have a pretty good net worth i calculated that if i wanted to buy like a trophy property in Islamabad, that the cost of capital advantage that like Blackstone has to me, i would to have generate 30% more in cash flows in the building to just to be able to compensate for my cost of capital disadvantage relative to Blackstone. So we have to take a look at why is so such wealth concentrated so much wealth is concentrated because certain only a small universe of people have access to a cost of capital that's so much cheaper than just about anybody else and that cost of capital difference is so great that basically it means that they can win in every bid on any, any asset that they're interested in buying. and so there,s no competition for buying that best assets because only a small group of people have access tot he type of cost of capital
that essentially zero in nature. And that's a product of this financial system. It's a products of government, the government policy it's a product of the tax code. So right now it used to be you could accumulate some wealth through the power of compound interest but at zero interest rates, you can't compound any wealth anymore unless you want to take the risk of going into the markets, and everywhere, everybody is warning that the markets might be overvalued. So given the fact that the capital markets are overvalued because they're subsidized by those low interest rates, that the biggest institutions that have the biggest access to leverage at cost of capital significantly cheaper than anyone else can produce.

Then the question is, is what, what for a typical middle class person how do they accumulate wealth?
And i think their only answer is to put a certain percentage in crypto. There have been some studies that show that now, that if you put 5 to 10 % of your money in crypto that actually on a risk-adjusted basis it improves your total portfolio returns. So i think everybody should put something into crypto. And the people who move first make more money than those that move second, who'll make more money than those that move third, and eventually when crypto is broadly adopted, then people start using it as an exchange, and it will no longer be volatile in pricing, it'll be stable in pricing. But i want to be very clear is a lot of the volatility in pricing has to do worth uncertainty on government policy towards it. So the government is creating this while the government is trying to mitigate volatility in ordinary capital markets, they're trying to exacerbate volatility in crypto markets.

Cyber-Criminals are ever Increasing their Methodologies

noreply@blogger.com (Mubasher Ashfaq) — Tue, 11 Sep 2018 02:30:00 +0000

Cyber-Criminals are ever Increasing their Methodologies

Cyber-criminals are ever increasing their methodologies in stealing valuable/sensitive data such as financial data, health records, personal identifiable information and intellectual property. They are also resorting to other highly profitable strategies such as DDoS attacks, or holding data ransom using encryption techniques.

Blockchain has the potential to greatly improve everything from data integrity and digital identities to enabling safer IoT devices to prevent DDoS attacks. Blockchain may even play across the ‘CIA triad’ of confidentiality, integrity and availability, offering greater resilience, encryption, auditing and transparency.

A blockchain, as implied is a chain of digital “blocks” containing records of transactions. Each block is connected to all the blocks before and after it. This makes it difficult to tamper with a single record because a hacker would need to change the block containing that record as well as those linked to it to avoid detection. This alone might not seem like much of a deterrence, but blockchain has some other inherent characteristics that provide additional means of security.

To aid in thwarting those ambitious hackers blockchains are decentralized and defined over peer-to-peer networks which are updated continuously to ensure they are kept in sync with one another. Because they are not within a central location the single point of failure exploit ability factor is overcome as it would require vast amounts of computing power to access every instance of a certain blockchain transaction and alter every single one at the same time. There is some debate about whether this means smaller blockchain networks could be susceptible to attack, however the overall consensus is the larger the network the more resistant it is to exploitation.