Hacking

What is hacking?definitoin

2020-04-30T11:39:00.002+05:00

What is hacking? definition

Hacking Definition

Hacking is identifying weakness among computer systems and networks in conformity with make the most of its weaknesses according to obtain access. Example over Hacking: Using a password cracking algorithm after gain access to a system.

Hacking Attacks

Computers hold come to be obligatory after drive a successful business. It is no longer adequate after having isolated computer systems; he needs after remain networked to facilitate verbal exchange along exterior businesses. This exposes to them in conformity with the outside world yet hacking. Hacking potential the use of computers in imitation to make deceptive acts such as fraud, privacy invasion, stealing corporate/personal data, etc. Cybercrimes charge dense companies tens of millions on bucks each and every year. Businesses want in accordance with protect themselves in opposition to certain attacks.

What Is Hacker?

In that tutorial, we wish to learn-
A Hacker is a person who finds or exploits the weak spot between computer systems and/or networks to reap access. Hackers are normally mature pc programmers including knowledge on computer security.

Hackers are categorized according to the intention of their actions. The consequent listing classifies hackers in accordance with their intent.

What Is Hacking?

Symbol Description
What is Hacking? An Introduction Ethical Hacker (White hat): A hacker whoever features get entry to in imitation of structures including a discriminate in conformity with restore the identified weaknesses. They may additionally perform entry Testing or vulnerability assessments.
What is Hacking? An Introduction Cracker (Black hat): A hacker who positive factors unauthorized get right of entry to in imitation of laptop structures for non-public gain. The desire is usually to snitch corporate data, violate privateness rights, transfer funds beyond bank money owed, etc.
What is Hacking? An Introduction Grey hat: A hacker who is of into ethical or black cap hackers. He/she breaks between pc systems without mastership including a digest after perceive weaknesses and expose them in accordance with the system owner.
What is Hacking? An Introduction Script kiddies: A non-skilled character whosoever positive factors get entry to pc structures the usage of in the meanwhile taken tools.
What is Hacking? An Introduction Hacktivist: A hacker whosoever utilizes hacking in conformity with send social, religious, or political, etc. messages. This is generally taken by hijacking websites then leaving the tidings over the hijacked website.
What is Hacking? An Introduction Phreaker: A hacker whosoever identifies yet exploits weaknesses into telephones alternatively concerning computers.

What is Cybercrime?

Cyber guilt is the use of computer systems or networks after function illegal things to do certain as like spreading pc viruses, online bullying, execution unauthorized electronic capital transfers, etc. Most cybercrimes are made through the internet. Some cybercrimes perform also lie received out the use of Mobile phones with the aid of SMS and online chatting applications.

Common Hacking Terminologies
What is Cyber Crime?
Types over Cyber Crime
What is Ethical Hacking?
Why Ethical Hacking?
Legality of Ethical Hacking

Summary

Before we continue some further, let’s look at some regarding the just commonly old terminologies within the ball about hacking.
The consequent list presents the common types of cybercrimes:
Computer Fraud: Intentional craft because of private attain by way of the uses on computer systems.
Privacy violation: Exposing private facts such as email addresses, smartphone numbers, estimate details, etc. of convivial media, websites, etc.
Identity Theft: Stealing non-public information beyond anyone and impersonating as a person.
Sharing copyrighted files/information: This includes distributing copyright out of danger documents certain namely eBooks yet pc applications etc.
Electronic fund transfer: This includes being an un-authorized get right of entry to in accordance with bank laptop networks and making unlawful capital transfers.
Electronic cash laundering: This includes the usage of the computer to tidy up money.
ATM Fraud: This includes intercepting ATM card details certain as much tale number or PIN numbers. These important points are below used after retirement savings besides the choked accounts.
Denial regarding Service Attacks: This includes the uses regarding computers among a couple of places in accordance with assault servers with a try on shutting to them down.
Spam: Sending unauthorized emails. These emails typically contain advertisements.

What is Ethical Hacking?

Ethical Hacking is figuring out weak points within computer structures and/or computer networks or coming with countermeasures to that amount to protect the weaknesses. Ethical hackers ought to anticipate by way of the consonant rules.

Get written authority beyond the owner over the pc system and/or laptop community earlier than hacking.
Protect the privateness regarding the corporation been hacked.
Transparently report every the identified weaknesses into the pc system according to the organization.
Inform hardware yet software program carriers over the recognized weaknesses.
Why Ethical Hacking?
Information is one regarding the most valuable property on an organization. Keeping facts impenetrable execute shield an organization’s image then retailer an organization a cluster of money.
Hacking does propulsion in conformity with impairment of business because corporations that deal with cash such so PayPal. Ethical hacking puts them a bottom in advance regarding the cybercriminals who would in any other case lead to loss of business.
Legality over Ethical Hacking
Ethical Hacking is a felony agreement the hacker abides by means of the policies stipulated in the upstairs section about the setting over ethical hacking. The International Council concerning E-Commerce Consultants (EC-Council) offers a certification software that checks an individual’s skills. Those any pass the experiment are awarded together with certificates. The certificates are guessed in imitation of stay renewed since incomplete time.

Summary
Hacking is figuring out yet exploiting weaknesses of laptop structures and/or laptop networks.
Cybercrime is committing a guilt with the aid concerning computer systems and information technological know-how infrastructure.
Ethical Hacking is in regard to improving the protection of laptop systems and/or pc networks.
Ethical Hacking is legal.

IPhone 11 vulnerability

2020-04-28T17:26:00.003+05:00

iPhone 11 vulnerabilities

iPhone 11 vulnerability

Seven days prior watched contradicting cases about iPhone 11 vulnerabilities, with a security association ensuring that they'd been mishandled in obvious ambushes, and Apple communicating that it can find no verification of this.

iPhone 11 vulnerabilities according to research's

Two driving security researchers have now said something in regards to this, agreeing with Apple on one point, while communicating it remains possible that the bugs are manhandled …

iPhone 11 vulnerability found by Zecops

Everyone right now appears to confide in one of Apple's declarations: that the iOS Mail application vulnerabilities found by ZecOps can't be mishandled in solitude. Apple expressed:

iPhone 11 vulnerability according to investigation

The investigator perceived three issues in Mail, anyway alone they're missing to avoid iPhone and iPad security protections.

DevOps recognizes this, and it has been bolstered by other security investigators. In any case, as we noticed seven days back, that doesn't infer that they couldn't are mishandled close by various vulnerabilities so on hold out a successful attack.

The renouncing is certainly not an entire nullification of the case. the truth ought to demonstrate that the genuine vulnerabilities alone can't evade security shields, anyway that they will be gotten together with existing undertakings so on an endeavor to do all things considered.

Wired reports that our take has now been resounded by two conspicuous security experts.

iOS security examiner and Guardian Firewall producer Will Strafach raises that while Apple and ZecOps are directly about the compelled utility of the Mail bugs alone, it's up 'til now basic to require these varieties of bugs really.

"A zero-click like this is oftentimes consistently especially intriguing in light of the fact that it's definitely not a full undertaking chain, yet in view of the character of how it capacities, it could engage something style of a raving achievement and-grab for post box data. To be sure, even the chance of copying messages then self-deleting the made 'attack email' is a style of frightening."

Past NSA software engineer Patrick Wardle agrees, pointing out that nonattendance of confirmation isn't verification of nonappearance, and saying it wouldn't be shocking that Apple would be not ready to recognize these ambushes whether they have happened.

"It is outlandish that if this weakness was used in incredibly centered around ambushes that Apple would find verification of such attack," Wardle says. "Regardless, it'd be valuable for Apple to communicate how they showed up at these goals."

In fact, even the crudest zero-click ambushes leave little follow, which makes tailing them an issue. Security specialists express that generally speaking, the very features that make programming increasingly secure consistently make zero-click ambushes all the more energetically to recognize.

"We don't see a ton of those zero snap vulnerabilities abused inside the wild which is in light of the fact that they're so difficult to distinguish—it's not because they're not out there."

If the iPhone 11 vulnerabilities are mishandled, in any case, this is normally often generally likely against express, noticeable targets.

How to hack Facebook using kali linux

2020-04-27T17:39:00.001+05:00

How to hack Facebook using Kali Linux

Hack Facebook

I want to teach you how to have a Facebook account in Catalina's with shellfish tool I have created this account so it's not my personal account it's just for the baby I am going to use a bigger box of Kali Linux so if you don't have Kali Linux installed in your computer so now you can see how Kelly knows to install on my computer so I click on start like you can see this is the Kali Linux.

Hack Facebook with Kali Linux

So the first step that we have to do is we have to style fish tool so we open a terminator here we have to apply the following comma it is shit : and the following URL then we press ENTER and this command with plan this tool from github repository so you will have a screenshot like this after download is complete we need to go in the folder directory of shellfish by using City commands and we have to check the files using air as common like this we type CD [Music] you have to have a screenshot like this and this is the most important comment shellfish that Sh because we are going to use that to to hack a Facebook so now we need to leave access permission to the main budget script called shellfish that Sh so we're going to use the following command to do this chmod plus x shellfish that Sh then we can ruin shellfish by using the following command that's large shellfish that is age okay had a mistake now forget to type the exactly the same okay have an arrow in this command it is the plus sign now we can route the shelfing by using the following command so like you can see you are going to have a screen like this so I have a lot of examples from fetch like Facebook Instagram snapchat so in this case we are going to use Facebook so we have to choose an option and it is the option to choose an option to and then press Enter so we have to wait until the download is complete [Music] so when it finish we can see a link in this case if this so we have to send the link to the target so in my case I'm going to open this link in the browser opera you will have the browser opera so I'm going to copy the link if you can see in my screen I have some information about the target so I can see the IP address I can see the has named the the DNS and I can see his location in this case I am my country Ecuador so I can see the state and I can see the city location so I am going to use a VPN later so I am going to show you again what happened so here I have the browser opera and now you can see this is a similar page of Facebook so we have to send the link to the target and the target is going to try to login and we can get the email and the password so here I am going to logging in my Facebook account [Music] and we're going to see what happened in Kali Linux so I put my email and my password in the Facebook page so when a target tried to do that we are going to get the email and password so I click login so now you can see we got a Facebook account in Kali Linux in this case the account is this and the password is this now you can see I got a Facebook account and this is the email and this is the puzzle so now I am gonna change the password and you can see what happens so I tie my current password and it is 1 2 3 4 5 6 km square bracket and my new password is gonna be 1 2 3 4 5 6 7 a so I copy this I click on Save Changes so it shows a message that I have to choose a more secure password so my new password is going to be one two three four five six seven eight plus plus that again I copy this and I click on side chains okay I log out and I'm gonna try to do the same process again copy the link in the browser opera English and here I have again the Facebook page so how I tie my email and I had to type the new password so it is one two three four five six seven a-plus-plus that you have to see what happened in Kali Linux I click on login and like you can see I have a new password in my Kali Linux virtual box so now you can see it is working and I have the chance to use a VPN in the browser opera so I am going to use this because I am going to change my location so we are going to see what happened in the IP continent in IP country and stay and see the location and the ISP I type again a link okay it's not working with the VPN because it's a tunnel so that's it .

Hackers Trick 3 British Private Equity Firms Into Sending Them $1.3 Million

2020-04-25T20:26:00.000+05:00

Hackers Trick 3 British Private Equity Firms Into Sending Them $1.3 Million

In a current extremely focused BEC assault, hackers managed to trick three British personal fairness corporations into wire-transferring a complete of $1.three million to the financial institution accounts fraudsters have entry to — whereas the victimized executives thought they closed an funding take care of some startups.

According to the cybersecurity agency Check Point, who shared its newest investigation with The Hacker News, almost $700,000 of the whole wire transferred quantity has completely misplaced to the attackers, with the remainder of the quantity recovered after researchers alerted the focused corporations in time.

Dubbed 'The Florentine Banker,' the delicate cybercrime gang behind this assault, "appears to have honed their strategies over a number of assaults, from a minimum of a number of years of exercise and has confirmed to be a resourceful adversary, shortly adapting new conditions," the researchers mentioned.

'The strategies they use, particularly the lookalike domains method, current an extreme risk — not solely to the initially attacked group but additionally to the third-parties with whom they communicated utilizing the lookalike area.'

The safety agency mentioned earlier spear-phishing campaigns launched by the identical group of hackers primarily focused the manufacturing, development, authorized, and finance sectors positioned within the US, Canada, Switzerland, Italy, Germany, and India, amongst others.

How did hackers do it?

The investigation follows Check Point's earlier report revealed final December, which described the same BEC (enterprise electronic mail compromise) incident that resulted in the theft of $1 million from a Chinese enterprise capital agency.

The quantity, which was seed funding supposed for an Israeli startup, was as a substitute routed to a checking account below the attacker's management by way of a carefully-planned man-in-the-middle (MITM) assault.

The fraud scheme, which has since caught three UK and Israeli primarily based finance corporations within the internet, works by sending phishing emails to excessive-profile people within the goal group to realize management of the account and perform intensive reconnaissance to grasp the character of enterprise and the important thing roles inside the corporate.

In the subsequent section, the attackers tamper with the sufferer's Outlook mailbox by creating new guidelines that might divert related electronic mail to a special folder, such because the RSS Feeds folder, that is not generally utilized by the person in query.

Aside from infiltrating the high-level company electronic mail account and monitoring messages, the hackers register separate lookalike domains that mimic the professional domains of the entities concerned within the electronic mail correspondences they need to intercept, thus permitting them to perpetrate a MITM assault by sending emails from the fraudulent domains on behalf of the 2 events.

'For instance, if there was a correspondence between 'finance-firm.com' and 'banking-service.com,' the attackers might register comparable domains like 'finance-firms.com' and 'banking-services.com,' the staff mentioned.

Put in another way, the Florentine Banker group despatched one mail every from the spoofed domains to the counterparty, thus inserting itself into the dialog and deceiving the recipient into pondering that the supply of the e-mail is professional.

'Every electronic mail despatched by either side was in actuality despatched to the attacker, who then reviewed the e-mail, determined if any content material wanted to be edited, after which forwarded the e-mail from the related lookalike area to its authentic vacation spot,' Check Point researchers mentioned in a separate weblog put up on BEC scams.

Armed with this set-up, the attackers then start injecting fraudulent checking account data (related to accounts positioned in Hong Kong and the UK) within the emails to intercept cash transfers and provoke new wire requests.
FBI Sounds Warning Against BEC Attacks
Business electronic mail compromise (BEC) assaults have surged in recent times as organized cybercrime teams attempt to revenue off electronic mail scams directed towards large companies.
Last month, Palo Alto Networks' Unit 42 risk intelligence staff examined BEC operations figuring out of Nigeria, uncovering that the group — dubbed 'SilverTerrier' — carried out a median of 92,739 assaults a month in 2019.
According to the Federal Bureau of Investigation's 2019 Internet Crime Report, BEC-related scams alone accounted for 23,775 complaints amounting to losses of over $1.7 billion.

In an advisory revealed by the FBI early this month, the company warned of cybercriminals conducting BEC assaults by means of cloud-based electronic mail companies, including the scams value US companies greater than $2.1 billion between 2014 and 2019.

'Cybercriminals analyze the content material of compromised electronic mail accounts for proof of monetary transactions,' the FBI warned. 'Often, the actors configure mailbox guidelines of a compromised account to delete key messages. They may allow automated forwarding to an out of doors electronic mail account.'

The bureau additionally issued a separate warning highlighting how crooks are updating the worthwhile rip-off method to capitalize on the ongoing coronavirus pandemic and carry out fraudulent wire transfers.

In the face of such ongoing threats, it is really helpful that customers activate two-factor authentication to save their accounts and guarantee fund switch and cost requests are verified by means of cellphone calls confirming the transaction.

For extra steering on methods to mitigate the danger, head to the FBI's alert here.

Android hacking

2020-04-25T10:48:00.001+05:00

THIS IS ONLY FOR EDUCATION PURPOSES DONT USE IT ILLEGALLY.

New Zoom Hack Lets Hackers Compromise Windows and Its Login Password

2020-04-24T16:08:00.000+05:00

New Zoom Hack Lets Hackers Compromise Windows and Its Login Password

Zoom has been there for 9 years, however, the fast requirement of an easy-to-use video conferencing app in the course of the coronavirus pandemic in a single day made it one of the vital favorite communication software for tens of millions of individuals across the globe.

No doubt, Zoom is an environment-friendly online video assembly resolution that is serving to individuals keep socially related throughout these unprecedented occasions, however, it's nonetheless not the only option for everybody—particularly those that actually care about their privateness and safety.

According to cybersecurity skilled @_g0dmode, the Zoom video conferencing software program for Windows is weak to a basic 'UNC path injection' vulnerability that might permit distant attackers to steal victims' Windows login credentials and even execute arbitrary instructions on their techniques.

Such assaults are attainable as a result of Zoom for Windows helps distant UNC paths that convert doubtlessly insecure URIs into hyperlinks when obtained by way of chat messages to a recipient in a private or group chat.

Hacking Zoom to Steal Windows Passwords Remotely

Confirmed by researcher Matthew Hickey and demonstrated by Mohamed Baset, the primary assault situation includes the SMBRelay method that exploits the truth that Windows routinely exposes a person's login username and NTLM password hashes to a distant SMB server when trying to attach and obtain a file hosted on it.

To steal Windows login credentials of a focused person, all an attacker must do is shipped a crafted URL (i.e., \x.x.x.xabc_file) to a sufferer by way of a chat interface.

Once clicked, the assault would ultimately permit the attacker-controlled SMB share to routinely seize authentication information from Windows, without the data of the focused person.

To be famous, the captured passwords usually are not plaintext; as an alternative, NTLM hashes of them, however, a weak one can simply be cracked in seconds utilizing password cracking instruments like HashCat or John the Ripper.

In a shared setting, like workplace house, stolen Windows login credentials might be reused instantly to compromise different customers or IT assets, and launch additional assaults.

Exploiting Zoom to Compromise Windows Systems Remotely

Besides stealing Windows credentials, the flaw will also be exploited to launch any program already current on a focused pc or execute arbitrary instructions to compromise it remotely, confirmed by Google safety researcher Tavis Ormandy.

As proven, Ormandy demonstrated how the UNC path injection flaw in Zoom will also be exploited to run a batch script—with no immediate—containing malicious instructions when referred to as from the Windows default obtain the listing.

The second assault situation depends on the truth that browsers working on the Windows working system routinely save downloaded in a default folder, which might be abused to first trick a person into downloading the batch script after which triggering it utilizing the zoom bug.

To be famous, to take advantage of this situation, an attacker should concentrate on the Windows username for the focused person, which, nevertheless, can simply be obtained utilizing the primary SMBRelay assault.

In addition, one other safety researcher going by the title 'pwnsdx' on Twitter shared one other trick with The Hacker News that might let attackers hide malicious links when displayed on the recipients' finish, doubtlessly making it look extra convincing and sensible.

What Should Zoom Users Do?

Zoom has already been notified of this bug, however for the reason, that flaw has not but been patched, customers are suggested to both use another video conferencing software program or Zoom of their net browsers as an alternative of putting in a devoted shopper app on their techniques.

(Update: A day after we printed this report, Zoom apologies for falling in need of privateness and safety expectations and released an up to date model if it software program to patch just lately reported a number of safety points, together with UNC path injection.)

Some of the most effective different video conferencing and chat software program are:

Skype & Microsoft Teams (as much as 50 contributors)

Google Hangouts Meet (as much as 250 contributors)

Google Duo

Jitsi (free, self-host, open-source, as much as 75 contributors)

FaceTime and Signal for privateness

Besides utilizing a powerful password, Windows customers also can change the security policy settings to limit the working system from routinely passing their NTML credentials to a distant SMB server.

More Zoom-related Security and Privacy Incidents

This shouldn't be the one situation to have been uncovered in the Zoom video conferencing software program over the previous couple of days, elevating privateness and safety considerations amongst tens of millions of customers.

The FBI is warning zoom customers of the "Zoom-Bombing" assault after some individuals discover an approach to sneak their approach into unsuspecting conferences and on-line gatherings and bombarded them with pornographic photos or racist feedback.

Just yesterday, one other report confirmed that Zoom doesn't use end-to-end encryption to guard calling information of its customers from prying eyes regardless of telling customers that "Zoom is using an end to end encrypted connection."

Last week, Zoom updated its iOS app after it was caught sharing customers' machine data with Facebook, elevating official considerations over customers' privateness.

Earlier this yr, Zoom additionally patched another privacy bug in its software program that might have let uninvited individuals be part of personal conferences and remotely snoop on personal audio, video, and paperwork shared all through the session.

Have one thing to say about this text? Comment beneath or share it with us on Facebook, Twitter, or our LinkedIn Group.

Zero-Day Warning: It's Possible to Hack iPhones Just by Sending Emails

2020-04-23T18:11:00.000+05:00

Zero-Day Warning: It's Possible to Hack iPhones Just by Sending Emails

Watch out Apple customers!

The default mailing app pre-installed on thousands and thousands of iPhones and iPads has been discovered weak to two vital flaws that attackers are exploiting at intervals the wild, a minimum of, from the final word 2 years to spy on high-profile victims.

The flaws could ultimately let distant hackers on the QT take full management over Apple units simply by causing associate e-mail to any targeted explicit person along with his e-mail account logged-in to the weak app.

According to cybersecurity researchers at ZecOps, the bugs in question are distant code execution flaws that reside at intervals the MIME library of Apple's mail app—first, as a result of associate out-of-bounds write bug and second, could also be a heap overflow concern.

Though every flaw gets triggered whereas process the content material of associate e-mail, the second flaw is additional harmful as a result of it's getting to be exploited with 'zero-click,' the place no interaction is needed from the targeted recipients.

8-Years-Old Apple Zero-Days Exploited at intervals the Wild

According to the researchers, every flaw existed in varied fashions of iPhone and iPad for the final word Eight years for the principle that launch of iOS six and, sadly, in addition, have a sway on the present iOS thirteen.4.1 with no patch however replace out there for the common variations.

What's additional worrisome is that kind of groups of attackers are already exploiting these flaws—for a minimum of 2 years as zero-days at intervals the wild—to focus on folks from varied industries and organizations, MSSPs from Kingdom of Saudi Arabia and Israel, and journalists in Europe.

"With terribly restricted information, we have a tendency to were able to see that a minimum of six organizations were wedged by this vulnerability – and thus the complete scope of abuse of this vulnerability is mammoth," the researchers mentioned.

"While ZecOps refrain from attributing these attacks to a particular threat actor, we have a tendency to are aware that a minimum of 1 'hackers-for-hire' organization is marketing exploits victimization vulnerabilities that leverage email addresses as a result of the most symbol.

According to the researchers, it is often powerful for Apple users to know if they were targeted as a district of those cyber-attacks as a result of it looks that attackers delete the malicious email straight off when gaining remote access to the victims' device.

"Noteworthy, tho' the knowledge confirms that the exploit emails are obtained and processed by victims' iOS units, corresponding emails that have got to ar obtained and saved on the mail-server ar lacking. Therefore, we have a tendency to infer that these emails are deleted deliberately as an element of associate assault's operational safety cleanup measures," the researchers aforementioned.

"Besides a short-lived retardation of a cellular mail utility, customers should not observe another abnormal conduct."

To be noted, on booming exploitation, the vulnerability runs malicious code at intervals the context of the MobileMail or mailed application, permitting attackers "to leak, modify, and delete emails."

However, to remotely take full management over the system, attackers should chain it along with a separate kernel vulnerability.

Though ZecOps hasn't talked regarding any part on what sort of malware attackers are utilizing to focus on customers, it did think that attackers are exploiting the failings alongside completely different kernel points to with efficiency spy on their victims.

Beware! No Patch however on the market

Researchers detected in-the-wild-attacks and set the associated flaws nearly 2 months at intervals the past and reported it to the Apple safety cluster.

At the time of writing, alone the beta thirteen.4.5 model of iOS, launched merely final week, contains safety patches for each zero-day vulnerabilities.

For thousands and thousands of iPhone and iPad customers, a public software system program patch can quickly be out there with the discharge of the approaching iOS replace.

Meanwhile, Apple customers are powerfully recommended to do to to to not use their smartphones' constitutional mail utility; as another, quickly swap to Outlook or Gmail apps.

In a chunk of separate data, we have a tendency to at the moment reported regarding one alternative in-the-wild iPhone hacking promoting campaign the place Chinese hackers are caught that focus on Uyghur Muslims with exploit iOS chains and adware apps.

Things You Should Do When Your Email Gets Hacked

2020-04-22T20:22:00.002+05:00

Things You Should Do When Your Email Gets Hacked

If a pal tells you that you simply have been sending them unusual emails or spamming their social media pages with posts that you simply aren’t more likely to ship, you’re most likely already conscious of what occurred: your e-mail account has been hacked. A hacked e-mail account might result in extra severe issues, reminiscent of identity theft, and different safety and privateness intrusions, which might have an effect on your funds and repute. But earlier than (or after) you panic, settle down, pull your self collectively, and observe these easy steps:

1. Change your password

Hackers received all the time to change your account passwords. This means you continue to have entry to your account, and you may forestall additional or future assaults from occurring. To change your password, merely use the “Forgot Password” hyperlink at your login web page. Do this for all of your accounts throughout all of your gadgets.

What it's good to keep in mind:

Use lengthy, distinctive, and complicated passwords or passphrases for various accounts. Password managers might help create and handle a number of password accounts.

Enable 2-step verification. The additional step would require a code despatched to your cellphone to log into an account or each time account settings are modified. Unless the hacker has your machine, you alone can enter the code.

[READ: InfoSec Guide: Mitigating Email Threats]

2. Check your settings

Scan your account settings and test if something was modified. Hackers might have your emails forwarded to them, which might permit them to obtain login data and acquire your contacts’ e-mail addresses. If you utilize an e-mail signature, test for any doubtful adjustments which may have been made.

What it's good to keep in mind:

Send an alert message to your contacts informing them that your e-mail has been hacked and to disregard any suspicious message or put up coming from you, or bearing your identity, till you allow them to know that you've got resolved the problem. Warn them about clicking on despatched hyperlinks as properly.

[READ: Rising Above Spam and Other Threats via Machine Learning]

3. Scan your laptop and different gadgets for malware

Regularly run a malware scan. When your account will get hacked, instantly test for malware, or remnants of malware that is likely to be lively in your laptop.

What it's good to keep in mind:

If your scans detected malware, change your password once more and re-check your settings. Changing your passwords without cleansing your system may not lock hackers out of your accounts if in case you have malware sending them your new keys.

[READ: Delving Into the World of Business Email Compromise (BEC)]

4. Implement preventive measures

Prevent hackers from breaking into your accounts once more. You can begin by avoiding suspicious phishing emails, or hyperlinks and attachments present in them. This goes for social networks as properly. Clicking on doubtful hyperlinks or posts can finally result in the phishing pages or the obtain of information-stealing malware.

What it's good to keep in mind:

Use safe and personal networks. This might help forestall hackers from stepping into your community.

Limit your publicity on social networks and the quantity of knowledge you present to the general public. Hackers and id thieves are fast to assemble private data on social media so watch out and preserve private particulars personal.

Bookmark trusted web sites, together with on-line purchasing websites you incessantly use. This will forestall you from by chance touchdown on the incorrect web site the place hackers might slip malicious code or phishing hyperlinks.

[READ: Outsmarting Email Hackers With AI and Machine Learning]

Employing safety merchandise that makes the most of machine learning and synthetic intelligence can higher shield customers from e-mail hacks and different cyberattacks reminiscent of enterprise e-mail compromise (BEC), which caused total global losses of $12.5 billion this yr.

Security options that apply AI and ML applied sciences – reminiscent of Trend Micro’s Writing Style DNA, which may be taught a person’s writing fashion primarily based on previous emails to thwart suspected forgeries – might help preserve e-mail scammers at bay.

To shield in opposition to spam and e-mail threats, enterprises can benefit from Trend Micro™ endpoint options reminiscent of Trend Micro Smart Protection Suites and Worry-Free™ Business Security. Both options detect malicious records data and spam and block all associated malicious URLs. Trend Micro Deep Discovery™ has a layer for e-mail inspection that may shield enterprises by detecting malicious attachments and URLs. Deep Discovery can detect distant scripts even when they aren't being downloaded on the bodily endpoint.

Trend Micro™ Hosted Email Security is a no-maintenance cloud resolution that delivers constantly up to date safety to cease spam, malware, spear phishing, ransomware, and superior focused assaults earlier than they attain the community.

HTML AND CSS

2020-04-19T17:48:00.002+05:00

Learn html and css in 60 minutes by watching this video believe me you will learn html and css

Wikileaks

2020-04-19T12:13:00.001+05:00

Wikileaks

WikiLeaks is an international organisation that publishes news leaks and classified media provided by anonymous sources. Its website, developed in 2006 in Iceland by Sunshine Press, claimed in 2015 to have released online 10 million documents in its first 10 years. Julian Assange, an Australian Internet activist, is generally described as its founder and director.

Wikileaks releases

The group has released a number of document caches. Early releases included document of equipment expenditures and holdings in the Afghanistan war, a report informing a corruption investigation in Kenya, and a manual for operations at the U.S. prison at Guantanamo Bay, Cuba. In April 2010, WikiLeaks released the Murder footage from the 12 July 2007 Baghdad airstrike in which Iraqi journalists were among those killed. Other releases in 2010 included the Afghan War Diary and the "Iraq War Logs". The latter allowed the mapping of 109,032 deaths in "significant" attacks by insurgents in Iraq that had been reported to Multi-National Force – Iraq, including about 15,000 that had not been previously published. In 2010, WikiLeaks also released the US State Department diplomatic "cables", classified cables that had been sent to the US State Department. In April 2011, WikiLeaks began publishing 779 secret files relating to prisoners detained in the Guantanamo Bay detention camp. In 2012, WikiLeaks released the "Syria Files," over two million emails sent by Syrian politicians, corporations and government ministries. In 2015, WikiLeaks published Saudi Arabian diplomatic cables,[documents detailing spying by the U.S. National Security Agency on successive French Presidents, and the intellectual property chapter of the Trans-Pacific Partnership, a controversial international trade agreement which had been negotiated in secret.

In private conversations from November 2015 that were later leaked, Julian Assange expressed a preference for a GOP victory in the 2016 election, explaining that would then form a block to reign in their worst qualities. With Hillary in charge, GOP will be pushing for her worst qualities, will be mute. In further leaked correspondence with the Trump campaign on election day (8 November 2016), WikiLeaks encouraged the Trump campaign to contest the election results as being

In 2016, WikiLeaks released 300,000 emails that were coming from Turkey's ruling Justice and Development Party, later found to be taken from public mailing archives,and over 50,000 emails from the Turkish minister of energy.In 2017, WikiLeaks published internal CIA documents that describe tools that used by the agency to hack devices such as mobile phones and routers.

GitHub users are targeted by a phishing campaign

2020-04-18T11:56:00.004+05:00

GitHub users are targeted by a phishing campaign designed to steal their GitHub login credentials and time-based one-time password (totp) codes.

The attack, referred to Sawfish by GitHub SIRT, comes through a Github message that claims the target account has experienced unauthorized activity of some type, GitHub SIRT wrote in a blog. A handy link to rectify the situation is included where the alterations can be viewed.

The link, in fact, turns out to be a redirect to a phishing website that mimics the GitHub login page. Here the victim’s credentials are harvested. For those using totp two-factor authentication the malicious site takes and sends the codes in real time to the attacker allowing the GitHub account to be instantly accessed.

In some cases this access is used to grab and download repositories contents, GitHub SIRT said.

Accountt protect by hardware security keys are not vulnerable to this attack.

GitHub SIRT listed six ttps being used by the threat actors behind the campaign.

The phishing email is sourced from legitimate domains, using compromised email servers or stolen API credentials for legitimate bulk email providers.

Targets currently-active GitHub users across many companies in the tech sector and in multiple countries via email addresses used for public commits.

Use of URL-shortening services to conceal the true destination of the malicious link.

Use of PHP-based redirectors on compromised websites to redirect the victim from a less suspicious-looking URL to another malicious one.

In many cases, the attacker quickly downloads private repository contents accessible to the compromised user, including those owned by organization accounts and other collaborators.

Github administrators are searching for the phishing sites being used and when found filing takedown requests. They also suggest switching from totp two-factor authentication to a hardware key or webauthn two-factor authentication.

If any user thinks they have clicked on a fraudulent message they should quickly reset their login credentials.

How To C0ntrol Andr0id Using T3rmux Explained?

2020-04-17T17:35:00.001+05:00

The best way of hacking a phone using termux

Requirements

1). Android 5.0

2).download termux from play store

3).install metasploit framework in termux

4).fast wifi connection

trust me this video will work for you.

Zoom-Bombs, Bad Passwords, and a Big Target: Why NFL Draft Season Is Ripe to Be Hacked

2020-04-17T12:34:00.001+05:00

I am back

Depending on how you look at it, next week’s first-ever virtual NFL draft is either a much-needed distraction from the daily misery of pandemic news or a needless distraction at a time when we should be reassessing our priorities. Either way, regardless of gripes from GMs and those nerds in the media, it’s happening. On Thursday night, Roger Goodell, from a bunker in Westchester County, will officially put the Bengals on the clock.

To get to this point, the league and its teams have scrambled to build a virtual draft infrastructure, just as they’ve done all draft season to keep team personnel connected under stay-at-home guidelines. The scale and ambition of the operation is impressive. The league should be lauded for the fundraising aspect and for mandating that, throughout the draft, all team execs and coaches—regardless of their state and local ordinances—stay in their separate homes (unlike a certain quarterback in Dallas), emphasizing the importance of social distancing.

But as the pandemic has made videoconferencing and virtual connectivity an absolute necessity in all walks of life, hackers have taken advantage; schools and churches have been hacked. Now consider the combination of 1) a billion-dollar corporation 2) an unprecedented undertaking and 3) a cast of thousands of less-than-tech-savvy users. Altogether, it means the NFL will, almost undoubtedly, be targeted.

Illustration by SI Art

“Imagine my goal is to hack a team" says Patrick Wardle, a former NSA hacker and now principal security researcher at Jamf, an Apple device management solution. "There’s now a whole new remotely accessible system that was put together quite rapidly, which handles a lot of sensitive information. To me, that's an intriguing new attack surface."

As we approach the culmination of an unprecedented draft season, I spoke to security experts and hackers about this past month, packed with ill-conceived video conferences; about the potential for compromised email addresses; and about a handful of coaches and decision-makers who likely heard “virtual draft” and thought of a favorite scene from Tron.

So, pull on your Guy Fawkes mask—or whatever; your kid’s Iron Man mask from Halloween will do just fine—and open your mind to just the slightest bit of roguishness. This is how the NFL draft could be hacked. Or, maybe, how it already has been.

* * *

The league office is confident in the work it has done. “We are working closely with our tech partners to ensure a smooth operation” throughout the draft, says NFL spokesperson Brian McCarthy. “We are not disclosing our cybersecurity processes other than to say: They are comprehensive and thoughtful.” Regarding the 32 franchises, McCarthy says every team has been consulted on its setup and provided with best practices. Those clubs, though, “are ultimately responsible for their communication systems.”

Together, those teams and the league office will conduct a mock draft next week to test the virtual system. And the chances of the draft presentation itself getting hacked are minuscule (for reasons we’ll get into later). But equipping teams with the knowledge to build their own infrastructures is one thing. Making sure those teams follow through is another. And making sure individuals use that technology securely? Well ...

Which GIF best encapsulates the attitude toward technology held by a portion of the NFL’s old guard?

Option 1: Dave Gettleman air-keyboarding at the Saquon Barkley presser

Option 2: Bill Belichick working the tablet

Option 3: Gruden and Co. in the Raiders’ war room

(I kid! Gruden’s Raiders are far more forward-thinking than they get credit for.)

If you work a desk job, you’re likely glued to a screen for the majority of your waking hours. But that’s not the experience of the majority of the NFL’s decision makers—especially coaches, who do most of their work on the field, teaching face to face or on grease boards. Even putting aside the subset of coaches who outwardly resist technology (you know who you are), there is undoubtedly a large set who don’t interact with technology frequently. And while security has been a team-level concern throughout NFL history—how many guys have lost playbooks over the years?—an unprecedented, heavy reliance on tech has made teams deeply susceptible this draft season.

Consider the two most famous sports hacks of the past decade. First: Astros hacker Chris Correa, who as a scouting director with the Cardinals broke into Houston’s database, which contained proprietary notes on players, opponents and prospects. Second: Laremy Tunsil’s NFL draft-day experience in 2016. That afternoon, a video leaked to the world on his Twitter account, showing the prospect smoking through a gas mask bong, setting off a draft-night slide.

Buckle up for an in-depth breakdown of how those hacks went down. In the Astros’ case, Houston had hired analyst Sig Mejdal away from the Cardinals. When he left St. Louis, Mejdal handed over his laptop and its password to Correa, who later used a variation on that Cardinals password to log into Mejdal’s Astros account. He’d barely changed it. In Tunsil’s case, according to an SB Nation report, he’d given his iCloud password to someone who was tasked with setting up a new phone for the draftee. That person had access to Tunsil’s iCloud right up until the first night of the draft.

You don’t need to be Inspector Poirot to see the problem. In each case, the victim volunteered his password to the person who would subsequently hack him. The moral of the story: Don’t give out your password.

Tunsil, as a 21-year-old, was likely much more comfortable with technology than your average NFL coach. And Mejdal? He was a tech-savvy former NASA engineer. The point: Even those of us you wouldn’t expect to slip up do. Of the hundreds of draft-day decision makers across the league, it’s hard to believe that not a single one of them has in the recent past given a password to someone else—maybe to a team tech person, maybe to a lower-level staffer who changed teams ...

But let’s suspend disbelief and pretend that hasn’t happened. Not even once. If you think they’re all in the clear, then—well, you mustn’t have noticed how many more words are left in this thing.

* * *

Over weeks of quarantine, a large portion of the workforce—many NFL teams included—has become intimately familiar with Zoom. It has been the videoconferencing app of choice because of its user-friendliness, seemingly built so grandma and grandpa in Arizona can see the kids in New York. But that user-friendly interface came at the expense of security.

Zoom-bombing, the cruel trend of dropping in on strangers’ Zoom conferences uninvited to share offensive words and pictures, has become the modern-day equivalent of yelling Baba Booey. And sometimes hacking Zoom can be as simple as searching the internet for meeting links. For instance, many Alcoholics Anonymous organizers post Zoom links publicly, since they can’t send them privately, on account of the “anonymous” part. That’s led to low-brow “hackers” joining meetings and taunting participants in the name of a brand of comedy that lacks actual humor.

Along with crashing live meetings, hackers have been able to access listings for private Zoom meetings, as well as recordings of past Zoom meetings. Zoom has worked fast to patch up holes and make security more of a priority—better late than never—but any NFL team that has been using it is at risk. (Zoom has released a few statements addressing their security and privacy issues.)

“They’ve done an impressive job addressing the reported [security and privacy] issues, but Zoom was clearly a victim of its own success,” Wardle explains. “You have this application that, before this pandemic, was a somewhat of a niche product, and then its popularity skyrocketed. So hackers started to look at it. So did security researchers and, unfortunately, as security researchers started to poke at it, a lot of security and privacy issues fell out very easily. That's not a good look.”

Zoom, alone, is not the problem. Consider the last public leaguewide hack. That one was pulled off by OurMine, which (according to media reports that primarily reference the work of rival hacker groups) is a hacker collective of teenagers in Saudi Arabia. Corresponding through the encrypted messaging app Signal, a representative of OurMine, who declined to provide a name and will henceforth be known here as “OurMine Guy,” said that the outfit is actually based out of Dubai. (The presumably spoofed phone number from which OurMine Guy corresponded had a Kentucky area code.) Wherever the group is based, OurMine has pulled off some of the biggest hacks in the history, albeit brief, of social media. Among others, they’ve hacked Mark Zuckerberg, The New York Times and Real Madrid. In January, they returned from a two-year hiatus to unveil a hack of 15 NFL teams’ Twitter accounts.

According to OurMine Guy, they accessed those team accounts by exploiting a vulnerability on Khoros, a third-party provider of social media management and marketing services. (Khoros denied that its platform was compromised.)

Now, an NFL team’s draft board is not the nuclear launch codes, and the stakes are even lower when we’re talking about a team’s Twitter feed. But: Weeks of Zoom meetings (or virtual gatherings held on similar videoconferencing platforms) could get out there. Or maybe they already have. Relying on a third-party company has risks, especially when you’re a multibillion-dollar operation.

On draft night, teams will communicate with the league using Microsoft Teams—not coincidentally, Microsoft is an NFL sponsor. “You would have to imagine a product from Microsoft has been designed with more security and privacy in mind,” says Wardle. “Especially in terms of security, that’s an area where [recently] Microsoft has a solid track record.”

But some teams could continue to opt for Zoom, or a less secure third party, for their internal draft communications. Remember: it’s user-friendly and, now more than ever, familiar. Regardless, the biggest risk, even with third parties, lies in the users themselves.

Michael Bazzell, a former FBI cybercrime investigator who now works as a privacy and security consultant (and who helped depict the highly realistic hacks on Mr. Robot, the wonderful Rami Malek vehicle), says the source of most breaches is usually a careless user.

“The biggest threat is not that someone’s going to break Zoom or Microsoft’s security protocol,” Bazzell says. “Every time I’ve had some kind of breach to a conference call with my clients, they were just sloppy. They email the code, and someone’s calendar is shared with others, possibly even public, or an email gets copied to the wrong person, and you’ve basically invited the intruder to come in.”

* * *

It’s one thing to be sloppy. It’s another to be sloppy and be a target.

Remember the 2016 presidential election? I won’t spoil the outcome for anyone who DVRed CNN’s coverage from that night, but what you probably remember from the lead-up to that vote is the word “emails.” Writing about emails. Talking about emails. Tweeting EMAILS, in all caps, which means you’re shouting it. (In hindsight, one might argue that things like “health care” and “wealth gap” and “housing” would have been more appropriate points of focus, but emails it was. I know, I know; stick to whatever tangentially sports-related thing I was getting at here ...)

“Emails” referred to a few different things back then, and one involved a hack. WikiLeaks published thousands of digital correspondences, allegedly from the personal account of Hillary Clinton’s campaign chairman, John Podesta, some of them revealing unflattering aspects of the campaign. The perpetrators of the hack, according to the U.S. intelligence community, were likely Russian.

Podesta, of course, hadn’t handed over his password to a Russian hacking group, or to an old coworker who happened to relocate to Moscow and open up a mom-and-pop hacking outfit. Those hackers got the goods by phishing—spear-phishing, to be exact, the term for the targeting of a specific person (as opposed to blasting a “Dear customer” email to a bunch of people at once).

In short, Podesta received an email, seemingly from Google, that instructed him to, for security purposes, click on a link and log in. That page was fake; he handed over his information to hackers. (In another layer of security failure, Podesta’s chief of staff reportedly passed the email to IT before he followed its instructions, and he was told the email was “legitimate.” What that staffer meant to write was “not legitimate,” and, boy, to err is human.)

It doesn’t require much of a leap to see how this would play out in the NFL. If I were heading up any team’s IT department, it would be one of the things I feared most. Hypothetically, this is how it would play out:

In this (again, hypothetical) scenario, we’ll pick on Sean McVay, because McVay is young, smart, handsome and successful. And those things should leave him thick-skinned.

A hacker trawls some publicly accessible resource—LinkedIn, or perhaps a team media guide—and learns that the Rams’ head of IT is Ira McTechface. (McTechface, of course, left L.A. years ago; I hear he’s a fly-fishing guide out in Montana now. But again: hypothetical.) So the hacker buys a domain and creates an email address: IMctechface@rarns.com. Our hacker can’t get a “rams.com” address, so the “m” is replaced with an “r” and “n,” which often goes unnoticed.

To further emphasize the hypothetical nature of this exercise: The Los Angeles Rams don't even own the Rams.com domain. And this guy's right: A ram IS a male sheep.

The hacker sends an email from this new account to McVay, whose own address can be discerned with a simple program that tests possible combinations of first and last names and initials. “Hey, coach,” our hacker writes, “the tech guys at the NFL said everyone needs to download this program to access the league’s videoconference during the virtual draft. Download and install it as soon as you get a chance.” This program is actually malware that gives the hacker access to McVay’s laptop screen, or to its microphone, or maybe to everything on McVay’s laptop.

Now, McVay is too young/smart/handsome/successful to find himself in some villain’s crosshair. More likely, a hacker would target someone older (ageism at work!), perhaps the Rams’ hypothetical 62-year-old assistant offensive line coach, who may lack McVay’s Q rating but who has access to much of the same sensitive information.

“Hackers are largely opportunistic,” Wardle says. “It’s like a thief coming into a neighborhood. You look at the first house. They have a dog, so skip that one. The second house has an alarm system, so skip that one as well. But the third one may have left the back door or a window ajar—that’s the one!”

Depending on the motive (we’ll get to that), perhaps our hacker is targeting one or two such employees across each of the 32 teams.

But, stop! Maybe we’re overthinking this. Phishing might not even be necessary.

Bazzell points out that pretty much everyone’s email address has been made public at some point, as part of some site’s security breach. Sometimes their personal information has been revealed too—even their password.

To prove his point, Bazzell tried to find the password for my email, which he had from my interview request. “I can see you’ve used the password [redacted],” he said moments later. “But that might be old.”

“Uuummm, yeah ... that one’s old,” I replied (while frantically changing my password).

But this is a former FBI guy, you say, with the awesome power of the federal government behind him.

Doesn’t matter. “This information is out there on sites anyone can access,” Bazzell said. “They’ll charge you maybe $2 for a trial period, and you can access practically anyone's online credentials.”

First, no, I did not seek out one of those sites. Second, there’s a simple solution to all of this. Everyone in the NFL should change their password!

Well, sort of. Another hypothetical: Let’s say Bill Belichick’s email and password have been leaked somewhere in a security breach. And let’s assume his password is Charizard1, after what is surely his favorite Pokémon, and because the bastards made him use letters and numbers in his password.

If the Patriots’ IT chief tells everyone to change their passwords this week, is Belichick just going to switch his to Charizard2? Or is he going to change the Z into a 2? (You know, like those dorky Derek Jeter RE2PECT shirts?) A hacker doesn’t have to sit there, hunched over a laptop, brow furrowed, guessing at every variation. Password-cracker programs will do that in an instant.

Maybe Belichick has another go-to password, as most people do. But if that one has been leaked in a breach, it and all of its variations are going to be available to a hacker too. It’s called a “brute-force attack”—it requires less effort than it sounds. And it could end in someone getting full access to Belichick’s email account.

Belichick, as evidenced by his six Super Bowl rings, might be smart enough to choose a wholly original, new password with no connection to any of his past ones. To paraphrase Knute Rockne, football games are won by effective password selection. But will every member of the Patriots’ front office and coaching staff do the same? And how about the other 31 franchises?

There are other ways to become more secure. Two-factor authentication helps. But again, is every member of your organization going to do it on both work and personal accounts? And, even if they do, two-factor isn’t unhackable.

* * *

Hacking groups are loosely split into two types: black hat and white hat. Black-hat hackers are just what they sound like, hacking to steal money or to cause disruption or chaos. They’re the guys who, for example, hold hospitals and schools ransom. White-hat hackers assist companies with security, alerting them to vulnerabilities (while often getting compensated for their work).

In between, though, is the gray hat. OurMine, the group that in January hacked team Twitter accounts, consider themselves white hat. OurMine Guy says it has a “goal to improve internet security by proving to the world that everything is hackable;” he claims it reported to Khoros the vulnerability it exploited. Others, though, consider OurMine black hat since it (lightly) vandalizes social media accounts to advertise its security services.

As for that NFL team Twitter hack, OurMine Guy claims his outfit is not familiar with the league and its teams; the NFL’s massive Twitter following simply presented a chance to promote their services.

Everyone might be vulnerable. But, as Bazzell says, “It’s more about, Are you being targeted? And [the NFL], I think, will be targeted, simply because of the financial aspect and the potential to glean very valuable data if you can hear what’s going on.”

It’s an unlikely scenario, but any hacker targeting the NFL will likely be on the black-hat end of the spectrum. The league runs a multibillion-dollar business. A hacker with access to a team’s sensitive information could, theoretically, sell that info or ask for a ransom under the threat of releasing it. And if it’s not money, it can be the challenge, or the reward that is the notoriety that comes with hacking such a huge organization.

There’s a more likely culprit, though—one that would value such information more than any black hat, and one that coaches and front office execs seem to fear more. Another team.

The upside is obvious. So is the downside. The NFL is draconian in punishing teams deemed to have cheated. Tom Brady was suspended four games for maybe thinking about possibly requesting that a staffer release a small amount of air from a game ball. If a team were to be caught hacking an opponent, Goodell would strip it of every draft pick from now until a time when the league consists of 89 teams across three planets, with a 37-week regular season.

There are potential law enforcement consequences as well. Correa was sentenced to 46 months in prison for hacking into the Astros’ database. Surely, this reinforces lessons learned from McGruff the Crime Dog—or, really, any trench-coated cartoon animal who ever gave you advice. Crime doesn’t pay. But what if you were almost certain you wouldn’t get caught?

“The thing is, nobody is really physically anywhere when snooping online,” says Bazzell. “There’s usually no forensic evidence left behind. [Hacking can be] listening in on a conference call. If you just sit there quietly, there’s often no way of knowing you are there unless someone is constantly monitoring the call log.

“Honestly, I’d be surprised if 10%-20% of the league hasn’t tried something. You see it all the time—a low-level staffer. ... And if you do get caught, as long as it’s not a higher-up ...”

How hard is it to get away with? Correa went to prison because, according to the FBI’s conclusion, he leaked his findings, believing the Astros were stealing from his Cardinals. (As the judge pointed out at sentencing, it’s like he broke into his neighbor’s house because he suspected they were stealing his stuff.) The Tunsil hacker has never been charged.

* * *

If you’re expecting to tune in Thursday night and see some very inappropriate images dropped over Roger Goodell’s visage, I’ve got some sour news for you: The broadcast itself will likely be exceedingly secure. While there are some additional stresses on ESPN—fewer engineers available at the network’s Bristol headquarters; the difficulty of setting up home shots for 58 prospects with minimal on-site presence—the network doesn’t rely on consumer commercial means for its video feeds, making them far less susceptible to an attack. But most of all: While Bristol has its charms, broadcasting video of people, places and things outside of Bristol is what ESPN does 365 days a year. There’s already a robust security apparatus in place. This draft isn’t a huge departure from what the network normally does.

Conversely, this is anything but business as usual for the teams. Two months ago, no one thought they’d be preparing for a virtual draft. If teams had more lead time, they might have done things differently, perhaps rented servers so they could self-host.

“In a dream world, it would be better to have an NFL-sponsored server host all of the communications securely. Instead, you’re going to have this patchwork system where one team does it really well, really private, really secure. And then you’re going to have teams that say, ‘I have this app on my computer already, so let’s just use that.’ There are going to be people in senior positions who don’t want the fuss, and they’re going to dictate, ‘Let’s just use this thing my granddaughter uses, because that will be easiest.’ ”

We know that teams have been scrambling to get their execs set up in their homes, a challenge for many who were trying to quarantine. Falcons general manager Thomas Dimitroff told NBC’s Peter King that on draft night an IT staffer will enter through his side door and spend the night waiting in the basement, in the event he’s needed. There will be tech failures. (Remember, Belichick and the tablets?) Calls will be dropped, laptops will freeze, Wi-Fi will slow and cut out.

IT staffers will be on the front line, and after all this tech talk, we really should end on a football metaphor, so: Think of them as offensive linemen. Because, as OurMine Guy put it, “Hackers will always find new ways to get into [systems]. The IT team should be creative and think how the hacker will get into their system, so they [can] block it before it comes to them.”

There’s a good chance it’s been coming to them for weeks now, whether or not they realize it.

2020-04-17T12:29:00.004+05:00

Here’s an interactive tutorial that won’t make your child’s eyes glaze over

A student uses Exercise #2 to “mess up” the New York Times

There are plenty of ways to help your kids learn the basics of HTML. (I’m a fan of the no-nonsense videos at Khan Academy.) But when it came to teach my own daughters, they wanted something that seemed a little more… fun. Sitting down for a long lecture about angle brackets wasn’t going to cut it.

To fill the gap, I wrote Messing Up the Web, a micro-introduction that lets kids start playing and experimenting at the same time that they’re learning how the web works. Here’s what you need to know to use this tutorial with your own kids or students:

The goal of this lesson is to introduce HTML and the concept of elements. It doesn’t get your child to write a complete web page — that’s a task for the second, follow-up lesson.

What age is this tutorial for? It varies quite a bit depending on whether your test subject has seen HTML before. But most of the audience will be in the 9-to-14-year-old range.

Serious typing skills aren’t required.

I’ve provided the complete lesson, with step-by-step instructions, two exercises, screen captures, and a link to a sample page. There is also a unicorn. And a few ninjas.

Ready? It’s time to hand the laptop over to your kid. The learning goodness kicks off in the next section.

The easiest way to use this tutorial is to read this article from top to bottom. But if you get lost, here’s a mini table of contents to put you right:

How Your Web Browser WorksUnderstanding Tags and ElementsPutting On Your X-Ray GogglesExercise #1: Be an HTML DetectiveExercise #2: Vandalize the New York TimesWhat You Learned

If you’d prefer to work from paper, you can also grab a PDF version to print at home. (But then you’ll need to type the links instead of clicking them.)

Let’s start with something you already know. When you want to visit a web page, you use a web browser. Maybe that’s Chrome, or maybe that’s Safari, or maybe it’s something else — it really doesn’t matter.

Your web browser has two jobs. When you type in a web address or click a link, the browser politely asks a far-away computer to send the web page back to your computer. (Technically, that far-away computer is called a web server.) This is job #1 for your web browser.

Your web browser also has another responsibility. Job #2 is to take the web page and show it to you. Here’s where the magic happens. Your web browser needs to transform the ordinary text in the web page into something that looks a lot fancier.

How does this happen? The secret ingredient is a language called HTML (that’s HyperText Markup Language for you nerds).

Behind the scenes, every web page is just a bunch of ordinary text, written in HTML. The HTML tells the browser what to do, as in “make these words bold” and “start a list right here” and “put this awesome picture of my nose hair over here.” (OK, maybe not that last one.) All these special instructions to the browser are called markup — that’s the M part of HTML.

If you want to make your own web pages, you need to learn to write pages in this language. The good news is that it’s pretty easy! Complicated pages can be complicated, but simple pages aren’t hard to write or to understand.

Now, I’m not going to hit you with a full HTML document just yet. Instead, let’s spend a minute to learn the single most important idea in all of HTML. It’s called tags.

Tags are the most important ingredient in an HTML document. You can always recognize them because there are funny pointed brackets involved, like < and >. Take a look:

The time has come to learn.

Can you spot the tags here? No sweat, right? There are two — the weird code at the beginning and the at the end. These two tags look so similar because they’re partners. The tag marks the starting of a paragraph. The tag marks the end of the paragraph. HTML whizzes say that these two tags make up a paragraph element.

You can think of an element as a kind of container. It has a start, an end, and a bunch of text crammed in between. In this example, the paragraph element tells the browser that this sentence (“The time has come to learn”) belongs in its own paragraph. You can imagine it like this:

Why does this matter? Because in an ordinary web page there are piles of elements holding different things. Some elements hold the text that goes in paragraphs, other elements hold text for lists, and other elements hold random bits of text you want to decorate with funky colors, borders, and other effects. You’ll learn to do all that later. But for now, you’re just going to go looking for the containers.

It’s time to meet a tool that can help you take a look at the elements in a web page. This tool is called X-Ray Goggles. It’s a free, easy way to peek behind the curtain. You don’t even need to install anything on your computer. (If you’re curious, X-Ray Goggles was created by the Mozilla Foundation, which is a non-profit organization that develops the Firefox web browser. The Mozilla Foundation spends most of its time telling people why web standards are awesome, to help make sure that web pages look the same in every different browser.)

To get started with X-Ray Goggles, you need to get to your computer and start your browser. You can use almost any browser with X-Ray Goggles, including Chrome (our favorite), Firefox, Safari, and Internet Explorer. You should be able to use Microsoft’s newer Edge browser, but that wasn’t working at the time this was written.

To use X-Ray Goggles, you need to add a special bookmark to your browser toolbar. But there’s a trick. This bookmark doesn’t take you to a web page. Instead, it runs a tiny bit of JavaScript, which is the coding language built into every web browser. This bit of JavaScript lets you explore the current web page.

Setting up X-Ray Goggles

The easiest way to understand X-Ray Goggles is to try it out. Here’s what you need to do in your browser to set it up:

1. Go to http://prosetech.com/html4kids/goggles.

2. Make sure you can see your browser’s bookmark bar. If it’s not visible in Google Chrome, pop open the browser menu, then choose Bookmarks, and then check the Show bookmarks bar setting.

3. Now it’s time to add the magic X-Ray Goggles bookmark. On the X-Ray Goggles page, look for the pink button that says Drag and drop me in your bookmark bar.

4. Click the pink button, drag it up, and drop it onto the bookmark bar. Now you’ll see a new shortcut appear, named X-Ray Goggles.

Once you’ve added the X-Ray Goggles bookmark, you’re ready to learn some HTML (and vandalize some websites). As you’ll see, it’s easy.

Using X-Ray Goggles to peek at a page

Ordinarily, when you look at a page, you see the final, formatted result. For example, check out the Unicorns vs. Ninjas page here:

When you visit this page, your browser gets some HTML that has the content (the words about unicorns and ninjas) and the markup (the instructions that tell the browser how to make that content look nice). The browser follows all the instructions in the markup and shows you the final product.

It’s like you’re looking at a perfectly baked cupcake. But what if you could take a closer look and see the cupcake’s ingredient list?

Here’s how to run this next experiment:

1. Visit the Unicorns vs. Ninjas page.

2. Click the X-Ray Goggles bookmark in the toolbar. This activates X-Ray Goggles.

3. Now you can explore the page just by moving your mouse around. Wherever you go, X-Ray Goggles finds the HTML element under your mouse and highlights it with a pink box. For example, if you hover over the “Unicorns vs. Ninjas” title at the top of the page, you’ll see the element name <h1> in the top-left corner of the pink box.

4. When you’re finished, turn off X-Ray Goggles by pressing the Esc key.

With your brand-new X-Ray Goggles, you are now a HTML detective trainee. Let’s see how you do.

Using X-Ray Goggles, snoop around the Unicorns vs. Ninjas page. How many different HTML elements can you find? Write down the name of each one, with your theory about what it does. For example, you already saw <h1>, which stands for “number 1 heading” — in other words, this is the element that holds the most important title on your web page.

Take a moment to list the elements you find. For each one, write down the element’s name, and make a guess about what it’s used for. Crafty detectives should be able to find seven altogether.

Are you sure you found them all? Double-check your list to see if you found and , which are buried a bit deeper in the page. These two elements are used to put small bits of text in bold letters or italics.

The trick is that and show up inside other elements. HTML is sneaky that way. It lets you put one element inside another element, and that element inside another element, and so on, like you have a gift box with way too many layers of wrapping paper.

In the Unicorns vs. Ninjas page, the element is used several times for the names of ancient Japanese ninja weapons. These words are part of a paragraph, so the element is used inside the element. The shading in X-Ray Goggles makes this setup pretty clear. When you hover over the element, you see just a word in italics.

When you hover over the element you see the entire paragraph shaded in, including the normal part and the italicized bits.

How about the mysterious <html> and <body> elements — did you find them? It’s easy to breeze right pass these two ingredients. The <body> element is a special kind of container that holds the entire page. To find it, move your mouse toward the edge of the page, to the margin area that surrounds the facts about unicorns and ninjas.

Keep moving it even closer to the edge, and you’ll go past the <body> element and into the <html> element.

You might wonder what’s the point of having the <body> and <html> containers that hold everything. The reason is that web pages can have a few extra details in them, like a title that shows up at the top of the browser tab, information about the language the web page is written in (English, French, Japanese, whatever), links to stylesheet files that give you fancy fonts, and even links to code files that make things happen.

The <body> section holds the markup for the page, but it doesn’t include any of these extra details. The <html> container, on the other hand, is the Big Boss. It holds everything, including the <body> section and every other extra detail about your page. There’s nothing outside of the <html> element, because the <html> element is your page.

So did you find them all the elements in this exercise? Here’s a list that reviews every element X-Ray Goggles can find in the Unicorns vs. Ninjas page, and explains what the element does:

<h1> The most important heading, which is a level-1 heading.

A paragraph of text

<h2> A smaller level-2 heading

A small section of text that’s in italics (slanted letters)

A small section of text that’s in bold (darker letters)

<body> A container for all the content in your web page

<html> The mega-container for everything, including the <body> element (with your web page content) and other information about your page

Making changes with X-Ray Goggles

As you just saw, X-Ray Goggles is a great tool for hunting down HTML elements in the wild. But the real fun happens when you change the content of an element — the text that goes inside the container. Ever had the secret urge to rewrite the front page of your favorite site? X-Ray Goggles can make it happen. (The changes are temporary, of course. They show up on your computer, thanks to X-Ray Goggles, but no one else will be the wiser.)

To try this out, start with the same Unicorns vs. Ninjas page you’ve been exploring. Hover over one of the elements — say, the <h1> element for the main title — and click it. You’ll see a panel pop open at the bottom of your browser window, with the HTML for that element.

Now change the title to something else. Be careful not to disturb the start tag <h1> at the beginning and the end tag </h1> at the end, or there goes your title! Instead, change the text inside (“Unicorns vs. Ninjas”) to say something different.

When you’re finished, click the Update button and X-Ray Goggles will show you what you really want to see. Your changed title replaces what was there before on the web page.

Now try changing one of the paragraphs. Depending on which paragraph you choose, you may see something a little messier in the panel. If your paragraph has bits of italicized or bold text, you’ll see the or tags show up alongside your text. Here’s an example of what you’ll see if you click the first paragraph under the “Weaponry” heading:

Ninjas are experts in hand-to-hand combat and masters of many exotic weapons, including the ninjato and katana (ninja swords), shuriken (throwing stars), and yumi (bow). But unicorns are tough competitors, with an unbreakable horn that never gets misplaced.

At first glance, this looks like a tag soup. But it’s actually pretty logical if you follow things through one tag at a time. The first line, with the start tag, obviously tells the browser that a new paragraph is starting. After that, the start tag switches on italic formatting, and the end tag turns if off. So if you have a line like this:

ninjato and katana (ninja swords), shuriken ...

The markup is telling the browser to turn italics on then switch it back off three separate times. Bold formatting with the and tags works the same.

NOTE: Not clear on the difference between tags and elements? Tags are the codes with the pointy brackets. So is a tag and is another tag. If you put tags together in the right way, you get an element. So ninjato is an example of the element for italics, with a start tag, end tag, and a word in between. Or, to put it another way, an element is like a hamburger. The tags are the bun, and the content is the juicy meat inside.

A note about spaces

You may notice that when you peek at the markup for an element, sometimes it shows up with extra spaces in it.

For example, you might expect to see this when you click on the first paragraph:

One is a rare creature with magical powers. The other is a stealthy assassin of the night. But in a showdown, who would take the crown?

But what you actually see is something like this:

One is a rare creature with magical powers. The other is astealthy assassin of the night. But in a showdown, who wouldtake the crown?

Something happened. There are extra spaces here that don’t appear on the page!

Well, it’s time to tell you one more important fact about the way HTML works. If your markup has more than one space in a row, your browser just treats it like there’s a singe space. In fact, it does the same thing for all the types of blank spacing you can put in a web page. For example, if you press the Enter key to make extra line breaks, that’s just like an ordinary space to HTML. The same is true if you use the Tab key to indent a line. In they eyes of HTML, all of this blank space isn’t important. In nerd-speak, this is called collapsing whitespace.

At this point, you’re probably wondering why HTML messes with your spaces. After all, if you organize some text just perfectly and HTML comes in and ignores all your spaces, squashing your words back together — rude!

But there’s actually a good reason that things work this way, as you’ll see as you get into HTML a bit deeper. When you’re writing markup, you’ll often use spaces, tabs, and line breaks to organize your elements and make your markup easier to read and edit. (Those are the spaces that you’re seeing sometimes in X-Ray Goggles.) If you really do want to add more spaces, blank lines, and indents that will show up on your web page, HTML has its own tools for that. But that’s a subject for the future.

Bonus challenge: Italicize a new word

You don’t need to limit yourself to editing words. You can also use X-Ray Goggles to add small bits of markup.

For example, you’ve seen that some paragraphs have and elements inside them. One good challenge is to try to add your own bold or italic formatting.

To do this, click a paragraph to start editing it with X-Ray Goggles. Then, find a word in the paragraph that you want to format. Add the start tag before the word and the end tag after the word. Then look at the page and see if your change took effect.

If you’re having trouble spotting the keys on your keyboard that make the pointy brackets, they’re easy to find. On most keyboards, you hold down Shift key and use the comma and period keys. And the forward slash (which you use for an end tag) shares the key with the question mark.

Eating the whole enchilada with View Source

X-Ray Goggles lets you focus on one element at a time. But here’s something you might not know — most browsers already have a feature that lets you see the full HTML markup for any web page. You can try it out with just a couple of clicks.

In Google Chrome, for example, start by right-clicking on an empty space somewhere on your web page. This action pops open a small menu. In the menu, choose View page source. Then Chrome will open a new tab that proudly shows all the HTML.

Try this trick out on the Unicorns vs. Ninjas page. You’ll see something like this:

The Unicorns vs. Ninjas page is pretty simple, by HTML standards. Even though there are some details in the markup that we haven’t talked about yet, it doesn’t look that confusing. But most web pages are not like Unicorns vs. Ninjas. They have a lot more details. They have tiny bits of formatting that are stuck to different words, paragraph, and sections. They have floating pictures, columns, and fancy design details. They often have code to track visitors, show ads, and make animations. Sometimes they have junk for supporting old browsers from the dinosaur ages. And they’re really long.

When you’re looking at a simple page like Unicorns vs. Ninjas, you can use the View Source feature. You can manage to eat the whole enchilada of your web page markup. But when you’ve got a more realistic web page, View Source doesn’t work as well X-Ray Goggles. It’s hard to scroll through all the markup and find the details you want. It’s hard to make sense of all the mess. Don’t believe us? Try the View Source feature on one of your favorite websites and see what you get.

Here’s your mission, should you choose to accept it. Sneak into the office of the world’s most famous newspaper, the New York Times. And deface the front page of their newspaper.

The only weapon you’ll need for this sabotage mission is the X-Ray Goggles bookmark. If you accept, tell no one and travel to http://nytimes.com

The first task is to change at least one (or maybe more) of the headlines on the front page. For example, when you see “U.S. Politicians Support Tax Relief,” you could change it to “U.S. Politicians Support Poopy Pants.” Not that you would do that.

But if you did do that — well, just remember that every change you make only shows up on your computer and it’s temporary. The next time you visit the New York Times front page, everything will be back to normal.

NOTE: You’ll find that some New York Times headings use the <h2> element that means level-2 heading, which is what you’d expect. But others use the element. If you look closely, you’ll see that the element is actually inside the <h2> element. The people who made the New York Times website use this design to create the visual layout of the page, which is pretty crowded and pretty complicated.

Advanced trick: Changing a picture

Tampering with headlines is a good start. But your fun doesn’t need to stop there. X-Ray Goggles also lets you replace pictures. But first you need to take a closer look at the HTML that’s involved.

The element that handles pictures in the <img> element. To see how it works, activate X-Ray Goggles and click on one of the pictures on the New York Times front page. You’ll see something like this:

Clearly, there’s no actual picture here, just a bunch of markup. And this markup looks a little different than what you’ve seen before. That’s because the <img> element has a trick.

When you use the <img> element, you need to tell it where to find the picture file you want to use. The web browser gets that picture, and then sticks it into the page. In the example above, this really long messy part:

https://static01.nyt.com/images/climate/06CLI-AUTOS1/06CLI-AUTOS1-threeByTwoMediumAt2X.jpg?quality=75&auto=webp&disable=upscale

is the web address that tells the browser where to find the picture. This information is actually stuffed inside the <img> start tag, which looks a bit weird, but don’t worry about that for now.

So how do you change it?

First you need to have a replacement picture at the ready. But you can’t just use one on your computer. You need to use one that’s already on the web, so your browser can find it. And one way to get that, is with a Google image search.

Here’s what to do:

1. Open a new tab to do your image search. Go to http://images.google.com, which is the Google search engine for images

2. Type in some words about the picture you want to find, and then click the search button. We went with “ugly chipmunk.”

3. Find the picture you like in the search results, and click it once to pop open a slightly larger preview.

4. Now for the fun part. Right-click the picture. When the menu pops up, choose Copy image address. (Don’t get distracted by some of the other, similarly named options.)

5. Go back to the tab that has the New York Times. If X-Ray Goggles isn’t activated, click the magic bookmark and then click on one of the images.

6. It’s time to make your edit in the X-Ray Goggles panel. Delete the entire web address for the picture. That’s everything that comes in between the quotation marks after the src=" part. When you’re finished, you will have this:

7. Now make sure your cursor is in between the quotation marks in the src="" part. Then, press Ctrl+V (or Command+V if you’re using a Mac) to paste the image link you copied. Now you’ll have something like this:

8. Presto! A new picture appears on the New York Times homepage.

NOTE: If you didn’t get a picture, the problem is almost certainly a tiny typo. When it comes to web addresses, tiny errors break everything. If you accidentally deleted part of the address, put a space or line break inside, or remove one of the quotation marks, this example won’t work. Remove what you’ve done and give these steps another run-through.)

In this tutorial you played with HTML. You didn’t write a page of your own, but you met some important concepts for the first time:

Tags. These are the codes with the pointy brackets, like and . HTML loves pointy brackets so much that I’m tempted to call it <HTML>

Elements. All the text in the page is some sort of container, which we call elements. To make a container, you put together a start tag and an end tag. Now you’ve got yourself an element.

Collapsing whitespace. HTML ignores extra space. Or, to be more precise, it treats every kind and combination of spaces, tabs, and line breaks as a single space.

HTML’s most famous elements. You met the super-useful for paragraphs, two different levels of heading, <h1> and <h2>, two way to format text, and , and the <img> picture.

If you’re clear on all those concepts, you’re ready to plunge ahead to the next step: learning to create a new HTML page of your own. Hopefully I’ll catch you doing exactly that in the next tutorial

2020-04-17T11:00:00.004+05:00

A white-hat hacker was able to hijack iPhone cameras using a chain of three vulnerabilities he discovered. The same approach would also work with the cameras on Macs.

Ryan Pickren disclosed the vulnerabilities to Apple in December of last year. The company fixed the most serious of them in January, and the rest last month.

The approach relied on an exception to the normal privacy requirement for apps to seek permission for camera or microphone access…

Forbes reports that the exception was Apple’s own apps — including Safari.

During December 2019, Pickren decided to put the notion that “bug hunting is all about finding assumptions in software and violating those assumptions to see what happens” to the test.

He opted to delve into Apple Safari for iOS and macOS, to “hammer the browser with obscure corner cases” until weird behavior was uncovered. Pickren focused on the camera security model, which he readily admits was “pretty intense.”

That’s something of an understatement as Apple has made the camera very secure, or so it thought, by requiring any and every app that wants access to be explicitly granted camera/microphone permission, permission that is handled by an OS alert box.

Pickren found the exception to the rule, Apple’s apps, which is what led him to prod away at the Mobile Safari app to see how he could gain unauthorized access to the camera and microphone.

Pickren found a total of seven zero-day vulnerabilities, and was able to combine three of them to gain access to the iPhone cameras and microphones.

The hacker reported the bugs to Apple, and received a $75,000 bug bounty payment as thanks.

A fellow security researcher said that it’s surprising hackers haven’t focused more on mobile devices for this type of attack. The ability to hijack iPhone cameras would be especially valuable, he suggested.

Security researcher Sean Wright told me that while everyone has been paying attention to their webcams on PCs and laptops, “few have been paying attention to their webcams as well as microphones on their mobiles.” Which, when you stop to think about it, is bizarre, as it’s a far more likely route an attacker will take to eavesdrop on victims. “People are a lot more likely to have their mobile on them for most of the time,” Wright says, “especially perhaps when discussing sensitive matters.”

Building a career in the field of ethical hacking - 5Ws and 1H

2020-04-17T10:56:00.000+05:00

With technological advancements, the IT industry is growing at a rapid rate. Companies continue to generate a huge amount of data every day, leading to the increased requirement of professionals who could ensure the safety and security of this data. Over time, cybersecurity has brought lucrative career opportunities for skilled enthusiasts, the most lucrative one being ethical hacking. If you have a keen interest in making your career as an ethical hacker, here is everything that you need to know.

What is ethical hacking?

Ethical hacking is the act of legally intruding into a system or network to detect its weaknesses and vulnerabilities. The practice helps the organisations to make sure that before a malicious hacker enters and exploits their network, the vulnerabilities are detected and dealt with. Ethical hacking is basically testing the network and understanding the scope for improvement in it. Ethical hackers may or may not use the exact same techniques, tools, and measures used by attackers. What differentiates them is that they have a permit from respective authorities that allows them to enter the network, scan, detect, and report all the vulnerabilities so that the organisation could strengthen their security measures.

Why is ethical hacking needed?

Whether it is e-commerce, healthcare, blockchain, government, or any other sector, the requirement of ethical hacking is growing more than ever due to the risk of data theft. Had ethical hacking not been there, all the users' data including passwords, credit card details, social security numbers, or sensitive corporate data could be easily stolen by malicious attackers. Companies in every sector are dealing with enormous cyberattacks either done by competitor organisations or individuals involved in cybercrimes.

To stand against such negative agents and to ensure data safety, organisations need hackers who can break into their web applications, devices, server, network, etc., and can create a protective shield. To maintain the trust of the clients and secure user data, organisations deploy complex security technologies through ethical hacking that can not be broken by attackers.

When do organisations need ethical hackers?

Last week, the database of one of the most popular food delivery apps in India was hacked. The hacker accessed major details of ~17 million users including the names, user names, numeric user IDs, email, and password hashes. These details were then put up on the darknet for sale without even considering a negotiation with the organisation. Such incidents could create a situation of panic as a lot of users generally keep the same password on their social media accounts, mobile applications, and even for mails.

Organisations need ethical hacking services all the time. Whether it is launching a new product, expanding the current product line, or branching out the business, companies have to keep on evaluating and improving their security measures to keep the user data secured. During an ongoing attack, ethical hackers play a key role as they track the issue faster to stop it as soon as possible and reduce the organisations' liability.

Organisations look up to ethical hackers when they want someone to use the general information of the company found online and try to penetrate into the system. They want the ethical hackers to imitate attacks that could be done by malicious hackers, try to enter in the wireless system of the company, test routers, firewalls, and switches, and intrude into the company's website and app to detect vulnerabilities before attackers could reach this stage.

Where is the need for ethical hacking felt? - Career opportunities for ethical hackers

Approximately, every industry today has some or all of its operations taking place online leading to growth in the requirement of ethical hackers. Some of the most prominent places where ethical hackers can work in different roles such as chief information security officer, information security analyst, ethical hacking trainer, network security administrator, and chief application security officer, include -

1. Government (non-defence and defence) -

The government, policymaker of every country contains a huge amount of sensitive data of each of its citizens and residents. Details about infantry weapons, missile systems, aircraft, radar, etc., and plans to deploy these in the situation of a national emergency is extremely confidential. The government needs ethical hackers to secure all this data and avoid unwanted intrusions. Within the government, ethical hackers could work in departments such as forensic, law, or investigative.

2. Banking and finance -

Public funds are extremely vulnerable to cyber-attacks. To deploy robust security measures on all financial services such as debit and credit cards, online banking, mobile banking, foreign currency exchange, accepting deposits, and advancing of loans, banks need professional ethical hackers. They help the banks in the implementation of advanced security measures to secure every transaction and user details.

3. Healthcare -

In the number of cybercrimes taking place in pharmaceutical companies, India stands at the 6th position with various healthcare machines, equipment, and devices at stake (source—: News18). Nothing is more important for an economy than providing effective healthcare services to its people and keeping their information safe. Ethical hackers help the healthcare industry in securing their research results, latest medical formulas, and other sensitive details.

4. Professional consulting firms -

A community of ethical hackers could work independently and can form professional consultancies to provide companies with the required knowledge about ethical hacking. Organisations which do not hire ethical hackers, choose such services to get their networks scanned and issues reported. Hackers understand every organisation's products and keep them informed about the latest practices in the cybersecurity world to avoid malicious risks.

Who can do ethical hacking?

To perform ethical hacking, an individual must be aware of the latest technology and security concepts used in various sectors such as education, healthcare, e-commerce, automobile, and biotechnology.

Courtesy: Internshala Trainings (trainings.internshala.com) - an online training platform

Read: 5 tips to ace your video job interviews from home during the lockdown

Read: Budding scope in agriculture technology

Wappalyzer discloses security breach after hacker starts emailing users

2020-04-17T10:52:00.002+05:00

Image: ZDNet, Wappalyzer

Tech company Wappalyzer has disclosed a security incident this week after a hacker began emailing its customers and offering to sell Wappalyzer's database for $2,000.

"If you receive this e-mail it's because we get the full database of Wappalyzer, and your e-mail is on the database," the hacker, going by the name of CyberMath, wrote in an email sent to Wappalyzer customers this week.

"I'm selling the full .sql for 2000$ in Bitcoin," the hacker added, while also sharing screenshots of the stolen database files.

Image: ZDNet

Wappalyzer did not dispute the fact that it suffered a security breach. As soon as the hacker began email customers, the company sent out an email of its own.

In a data breach notification email, Wappalyzer confirmed the incident and said the hack took place on January 20 when an intruder accessed one of its databases, which the company said it left exposed online due to a misconfiguration.

However, while the company admitted there was a hack, it downplayed the severity of the security breach.

"Some of our customers received an email from the perpetrator offering to sell stolen datasets. This data does not include personal information. If you receive such an email, mark it as spam and do not reply or click any links as it's likely a scam," the company told customers.

In an email interview today, Wappalyzer founder Elbert Alias told ZDNet that the stolen database mostly contained "technographic data."

The company, which started as a Firefox add-on in 2008, lets users scan websites and receive a report about what technology stacks (server type, CMS, JS libraries, etc.) the site is using. Users can look up one website at a time, multiple websites in bulk, or they can buy statistical data on the most common web technologies used today.

Technographic data is the data the company collects about all the scanned websites, and it is also the data the company sells through its Datasets section on its official website.

Alias told ZDNet the hacker breached and stole this data from a database powering its old website.

"Our new website went live two weeks ago and no longer uses the legacy database that was breached," Alias said.

Hacker also stole emails and billing info for 16,000 customers

But while most of the stolen data were stats about websites and their underlying technologies, some user information was also included.

"The database also contained email addresses of anyone who has requested a quote for a dataset, and billing addresses of anyone who has placed an order," Alias said.

Emails for up to 16,000 Wappalyzer customers were taken in the incident, Alias told ZDNet. The number of billing addresses is most likely lower, as not all customers who requested a price quote also followed through with an order.

Details like passwords or payment card details were not included.

All in all, the hacker doesn't appear to have stolen any meaningful information, hence the reason they're now trying to trick customers into buying the data.

"We've advised our users against attempting to purchase data from a criminal for Bitcoin, as they may well get nothing in return," Alias told us.

"The stolen data is already outdated. Our datasets are updated continuously and never contain data more than three months old."

[Below are Wappalyzer's breach notification email on the left and the hacker's email on the right.]

iPhone iMessage Hack: How To Send A Laser Light Show

2020-04-17T10:36:00.005+05:00

KEY POINTS

There are lots of iPhone hacks and tricks that users can enjoy

iPhone users have discovered lots of exciting hacks using their device one of them is by sending a laser light show

The iPhone hack is available on the iMessage app

The Apple iPhone is one of the premium smartphones available in the market today. Users know that there are lots of tricks that the iPhone offers. Interestingly, a new iPhone hack is gaining traction online, and among users, this time, it allows you to spend a special message using the iMessage app.

New iPhone iMessage Hack

The new iPhone iMessage hack allows users to see and send laser lights to the recipient. The trick is so simple and effortless. To make laser lights appear on the sender and on the receiver of the message, all the user has to do is type the words “pew pew” and send it to the intended recipient.

Another Way To Send Laser Lights Using iPhone?

On your iPhone, open a conversation in the Messages app and start typing. But, instead of tapping the blue, send arrow, press, and hold it until the Send with effect menu pops up. When that happens, tap the Send with effect located at the topmost part of the display.

The iPhone 11 helped Apple regain the crown as leader of the global smartphone market in the fourth quarter, according to analysts Photo: AFP / NICOLAS ASFOURI

Swipe from right to left using your finger in the middle of the screen until the laser light surfaces. After that, you can tap the blue send arrow located on the right side of the text and enjoy sending your messages with lasers.

Other Interesting Effects

There are a lot of features and exciting effects that you can enjoy with iPhone’s iMessage aside from sending or making a laser light show. For instance, when you write to someone “happy birthday,” you will see lots of balloons floating from under the screen going up. If you type the word congratulations, you will see confetti raining from the top of the display.