010 Hacker

White House considered cyberwar with Libya

2012-06-02T08:03:00.002+05:30

The American government considered hacking Gaddafi army computers before aiding in an airstrike against Libya.

In the days before President Obama approved American-led airstrikes in Libya without congressional go-ahead, the White House considered using cyberwarfare to attempt to crush the army of Colonel Muammar Gaddafi.

Hoping to cripple the Gaddafi government’s computer systems and bring down their air-defense network, The New York Times reports today that the Obama administration“intensely debated” if hacking into foreign computers would be a smart move during the start of the ongoing NATO missions in Libya that are largely supported by American troops.

Officials involved with the decision-making of the cyber-attack tell The Times that American authorities were concerned that officially entering an era of high-scale computer warfare could cause competing nations across the globe to respond with cyber crimes of their own against the Pentagon. The US has already accused China, Russia and North Korea of cyberwarfare in the past, however, and has denied responsibility for similar crimes waged against the nation of Iran.

As the US points fingers at superpowers abroad for cybercrimes, today they are admitting that they’ve very recently considered such a route themselves, though wholeheartedly denying it never happened.
Only weeks after the Libya mission began, though, the debate came up once again.
The Times report today also reveals that the Obama administration debated if cyberwarfare would be necessary in the Navy SEAL operation in May that led to the execution of Osama bin Laden at his Abbottabad, Pakistan compound. In that case again, report sources close to the matter, the US ultimately decided against hacking al-Qaeda computers, instead relying on more traditional military routes, such as stealth helicopters and boots on the ground.

“These cybercapabilities are still like the Ferrari that you keep in the garage and only take out for the big race and not just for a run around town, unless nothing else can get you there,” says one Obama official to the Times, speaking on condition of anonymity.
After the president approved American troops to aid in the NATO-led assault on Gaddafi’s army, Obama stood by his decision to make the move without getting the okay from Congress, even after lawmakers approached the commander-in-chief that he would be in clear violation of the War Powers Resolution Act of the Nixon White House. In his defense, President Obama insisted that the level of “hostilities” overseas did not necessitate a war.
Earlier in 2011, however, both the president and the Pentagon were involved in paperwork that equated cybercrimes on foreign nations as acts of war. According to the United States’ own policy, cybercrimes perpetrated against the US could call for a response from the American military. In that case, American-led cyber attacks on Gaddafi would almost certainly warrant retaliation with not just bytes, but bullets too.
In May of this year, one unnamed military official equated the new policy to The Wall Street Journal this way: “If you shut down our power grid, maybe we will put a missile down one of your smokestacks.”
Months later, the US was quick to point the finger at China for a series of Internet crimes waged against several nations, including the States and Taiwan, though lacked any evidence whatsoever.
In the past year, the United States has admitted that cyberattacks would be the future of international warfare, though has denied that they have practiced it themselves. Defense Secretary Leon Panetta even told a Capitol Hill hearing that the “next Pearl Harbor” could likely be caused by computer crimes.
Some, however, believe that the US has been behind acts like this all along, meanwhile denying their involvement. Stuxnet, a 2010 computer worm that targeted Iranian nuclear facilities, is believed by many to be of American origin and infiltrated with the help of Israel. Speaking at a TED Talk earlier this year, researcher Ralph Langner said, "My opinion is that the Mossad is involved but that the leading force is not Israel. The leading force behind Stuxnet is the cyber superpower – there is only one; and that's the United States."

China behind massive cyber attack on US?

2012-06-02T08:02:00.000+05:30

Without another scapegoat to pin the blame on, Americans are naming China as the culprit of a series of cyber attacks because, well, why not?
Jim Lewis of the Center for Strategic and International Studies tells Reuters that China is likely to blame for a massive series of cyber crimes that took the network of dozens of organizations by storm. Lewis, a cyber crime expert, can’t point reporters to any evidence in particular, but notes that the organizations infiltrated in the slew of attacks had information that China might want to have.
"Everything points to China. It could be the Russians, but there is more that points to China than Russia," Lewis says.
The United Nations, as well as the governments of the United States, India, South Korea, Canada and Taiwan are included in the list of 72 organizations targeted by a series of attacks conducted over a five year span.
Security company McAgee discovered the attacks and says that a “state actor” was responsible but won’t say who. Neither McAfee nor the Chinese offered comment on if China was responsible.
Vijay Mukhi, an Indian cyber-expert, adds to Reuters that he would not be surprised if the attacks came out of China because, he puts it, “that’s what China does.” Mukhi also notes, however, that India’s government barely protected their electronic data, saying their security is something out of the Stone Age.
While some of the networks targeted in the attacks included information held by other Asian governments (such as Taiwan and Hong Kong)and the Olympic Committees of the runner ops to the 2008 games that went to Beijing, the majority of those targeted were American companies and nonprofits.
If you ask Lewis, however, it’s got to be China.
“Who else spies on Taiwan?” he asks.
Lewis has long explored cyber crime and security issues in China. He is the author of the publication Building an Information Technology Industry in China: National Strategy and just last week told CNN that “China is very active in espionage.”

Pentagon creating new-generation cyberweapon

2012-06-02T07:59:00.003+05:30

A next-generation cyberweapon capable of knocking out enemy networks, even if they're not connected to the Internet - this is a primary goal for the Pentagon's research and development teams.

According to the Washington Post, the US military is ramping up its cyber-efforts in anticipation of a possible showdown with Iran or Syria.
The Pentagon had wanted to use cyber warfare technology during the NATO mission in Libya, but realized that it would have needed at least a year to properly develop the necessary weapon.

The Pentagon is creating a next-generation cyberweapon.

“We weren’t ready to do that in Libya. We are not ready to do that now, either,” the newspaper quoted an anonymous US official as saying.
US military officials are looking to create a weapon capable of targeting “offline” military systems, that would transmit damaging codes by radio. The US’s military’s Defense Advanced Research Projects Agency (DARPA) recently secured a half billion dollars in funding for such a project.
However, codes disseminated by such a weapon would need to be customized in order to have the right effect on enemy targets.
“Unless you already have a custom-written code for a system, chances are we don’t have a weapon for that because each system has different software and updates,” Joel Harding, an independent military consultant, explained.
The Pentagon is due to spend $3.4 billion on cyber technology in this year alone. The technology in the US military's current arsenal can disable components of an enemy weapons system, but not the system as a whole. Future cyber tools – like those currently in use – are likely to be used in combination with other tactics and arms.
The world’s first digital warhead, the computer worm Stuxnet, is believed to have disabled hundreds of centrifuges in an Iranian nuclear facility back in 2009 and 2010. Some blamed Mossad for the attack, saying that the US helped to develop the virus. The worm, however, lacked the precision and predictability necessary in a military operation.
The new generation of cyber warfare is thought to be more advanced, using a "fundamentally different approach than Stuxnet,” said an unnamed military official. “If I am trying to knock down an air defense system, I have to know precisely what is going to happen and when it will happen.”
The new weapon should minimize the possibility of collateral damage, for example the disruption of civilian systems. Developers also need to work around the fact that destructive codes could be sent back to attack American targets or used by foreign intelligences for their own ends.
Now, with the Pentagon’s cyber expenditures rising, defense officials are far from satisfied with how things are going. “I am still not remotely satisfied with where we are in cyber,” Deputy Secretary of Defense Ashton B. Carter said earlier this month. “I dare say we’d spend a lot more if we could figure out where to spend it.”

US launched cyber attacks on other nations

2012-06-02T07:57:00.001+05:30

The assumption that the US has the technological know-how to cripple a competing nation has always been just that: as assumption. In a recent sit-down interview, however, a former spy chief confirmed that America has already waged cyber attacks.Mike McConnell, the former director of national intelligence at the National Security Agency under George W Bush, tells Reuters this week that cyber war is more than a distant possibility. According to the current vice chairman at Booz Allen Hamilton, the US has already launched attacks on the computer networks of other nations.
Confirmed: US has already waged cyberattacks

McConnell did not add any input as to what countries have been hit with American cyber warfare in the past, but he did confirm that the US has already used the ability. When asked by Reuters if the United States had the capability to destroy the computer system of an adversary, McConnell responded “Yes.” When asked if it worked, he confirmed “yes” as well.
"Do we have the ability to attack, degrade or destroy? Sure. If you do that, what are the consequences? That is the question,” added McConnell.
Although the former spy chief neglected to name any countries that have been the target of American attacks, the US is believed by some to be the culprit behind a virus that targeted computer systems in Iran in 2010. Stuxnet, an advanced computer worm discovered in June of that year, impacted the computers used in conjunction with Iran’s nuclear program. In a January 2011 article in the New York Times, an American nuclear intelligence expert speaking on condition of anonymity said that the Israelis were behind Stuxnet, placing the blame on one of America’s most important allies. The expert adds in the article that Israel did indeed work hand-in-hand with the US in perfect Stuxnet before sending it to the Iranian networks, but that Washington wanted “plausible deniability.”
Other sources have since all but confirmed America’s involvement in the worm. German cyber security expert Ralph Langner told National Public Radio last year that the virus seemed like something out of science fiction, but added that, "Thinking about it for another minute, if it's not aliens, it's got to be the United States.” He went on to call the US “the leading force” behind Stuxnet, an assumption that many in Iran believe as well. While the Iranians have never officially recognized retaliation on their part, rumors of revenge via cyberwar have been rampant in recent weeks, particularly after news broke out of Mexico last month that hackers south of the border were being recruited by Iran to participate in an infiltration of American computers.
Before it launched an airstrike` attack on Libya in 2011, a cyberattack was considered as a route to oust Colonel Muammar Gaddafi, an Obama official said to the New York Times last year. In the end, however, America relied on other techniques. “These cybercapabilities are still like the Ferrari that you keep in the garage and only take out for the big race and not just for a run around town, unless nothing else can get you there,” the insider, speaking on condition of anonymity, told the Times.

‘Flame’ Virus explained: How it works and who’s behind it

2012-06-02T07:50:00.001+05:30

‘Flame’ Virus: How it works and who’s behind it

Flame may be the most powerful computer virus in history, and a nation-state is most likely to blame for unleashing it on the World Wide Web.Kaspersky's chief malware expert Vitaly Kamlyuk shared with RT the ins and outs of Stuxnet on steroids.
Iran appears to be the primary target of the data-snatching virus that has swept through the Middle East, though other countries have also been affected.The sheer complexity of the virus and its targets has led Moscow-based Kaspersky Lab to believe a state is behind the attack.

Kaspersky first spotted the virus in 2010, though it may have been wrecking havoc on computer systems for many years.Vitaly Kamlyuk told RT how his company discovered it, just what makes Flame so significant, features of the virus that could point towards its creator, and why we all lose out in this intensifying cyber-war.
RT: So, how did you spot the malware, was it a planned investigation, or did it come by surprise?
Vitaly Kamlyuk: It was by surprise. We were initially searching for a [different form of] malware. We were aware of the malware that had spread throughout the Middle East, attacked hundreds of computers and wiped their hard drives, making the systems unbootable after that. It was actually after an inquiry from the International Telecommunications Union, which is a part of the United Nations, who actually asked us to start conducting research. When we started looking for this mysterious malware in the Middle East, we discovered this suspicious application that turned out to be even more interesting than the initial target of our search.
RT: According to one of your experts, 'Flame' does not appear to cause physical damage, so why has it been dubbed the most hazardous cyber-attacks in history?
VK: It’s actually on the same level as the notoriously known Stuxnet and Duqu [attacks], because we suspect that there is a nation state behind the development of this cyber attack, and there are reasons for that. This application doesn’t fit into any of the existing groups of developed cyber attack tools. There are currently three groups. There are traditional cyber criminals who are hunting users’ data (like log-ins and passwords) to access bank accounts over the Internet and steal money, send spam, or conduct dubious attacks.This [Flame] doesn’t fit into the group of traditional cyber criminal malware. Also, it doesn’t fit into the activists’ malware who are using typically free and open source tools to attack computers on the Internet. And the third known group [at this time] is nation-states.
RT: What makes this malware different from all other Spyware programs and what damage can it do?
VK: It’s pretty advanced – one of the most sophisticated [examples of] malware we’ve ever seen. Even its size – it’s over 20 megabytes if you sum up all the sizes of the modules that are part of the attacking toolkit. It’s very big compared to Stuxnet, which was just hundreds of kilobytes of code: it’s over 20 megabyes. And the Stuxnet analysis took us several months, so you can imagine that a full analysis of this threat may take us up to a year. So we think it is one of the most sophisticated malware [programs] out there.
It’s also quite unique in the way it steals information. It’s possible to steal different types of information with the help of this spyware tool. It can record audio if a microphone is attached to the infected system, it can do screen captures and transmit visual data. It can steal information from the input boxes when they are hidden behind asterisks, password fields; it can get information from there.Also it can scan for locally visible Bluetooth devices if there is a Bluetooth adapter attached to the local system.
RT: Is there a connection between this new cyber threat and previous large-scale virus attacks?
VK: We are trying to compare and find similarities between this development and previous [ones] of course, but there are so few of them – Stuxnet or Duqu mostly. There is no reliable relation between Stuxnet and Flame as we call it…they are completely different. Because Stuxnet was a small application developed for a particular target with the specific objective to interact with industrial control systems and break them down. And Flame is a universal attacking tool kit used mostly for cyber espionage. So there are so things that [Flame] shares in common with Stuxnet and Duqu, and these are the vulnerabilities that are used by both [types of] malware. Probably one malware simply copied vulnerabilities from the other malware program when they were published.
RT: So this means that cyber warfare is evolving rapidly, and 'Flame' vividly confirms this trend. Can less technologically developed nations resist such attacks, or is it game over for them?
VK: It’s never game over in this area, because even if the country isn’t technologically developed in this area, it doesn’t prevent them from cooperating with organizations like ours and with private companies in the security industry that can provide them with valuable pieces of information which can actually result in the discovery of such threats. And when we discover such threats, we permanently add them to antivirus databases, and users from those nations can use freely available trial tools and commercial antivirus [software] to protect their systems.
RT: This enormous stratum of data that 'Flame' can gather, who would need it and is it really possible to analyze such an avalanche of information?
VK: First of all, when we’re talking about the size of data that is to be analyzed, we know that the attackers do not infect as many victims as possible. Their resources are limited; it seems that they understand that. They are keeping the number of infected machines more or less the same. So it’s the same level. When they finish analyzing data that has been stolen from one network, they remove the malware and switch to another.So we think that it’s still possible the extract only the data they are interested in.
RT: So can we call this a cyber war, and if so?
VK: Stuxnet and Duqu were bright examples of cyber weapons which could even physically destroy infrastructure, and this [Flame] is a continuation of this story. So this is another development in this roe which continues in addition to Stuxnet and Duqu.There are also nation stations supporting [these] developments. We think that cyber warfare has been going on for years already. People were just probably not aware of it because cyber warfare has a unique feature: it’s hidden. Nobody knows when cyber warfare operations are going on. This is the key feature of it.
RT: Who is behind these cyber attacks?
VK: Like with Stuxnet and Duqu, it’s currently unclear who is behind it. It’s very hard to find out who is behind it because when we try to follow the traces, who controls the application – it connects to the command and control centers – it turns out to be… dozens or even more servers spread around different countries around the world. More than 80 or 90 domains are associated with those servers. Most of them are registered with fake identities. So they’re pretty well protected and hidden. So it is unclear who is behind that, and we try not to speculate who could be behind such attacks. We try to base it on pure facts like the language we extract from the code. In this case, we only found traces of good English used inside the code.

How LSA Works with/without OSPF AREA 0 | Running OSPF without AREA 0 :Case Study

2012-03-29T10:57:00.000+05:30

Running OSPF without AREA 0
Topology 1: Connecting OSPF Area 2 and area 3 without using ABR.

Interface configurations are mentioned above in the topology.
Remember,
· ABR: ABR is a area border router that contain interfaces in atleast two separate area out of which one should always be in AREA 0.
So, surely above topology don’t have any ABR and we will be going to test how routers behavior in absence of backbone area.
After configuring OSPF routes on R1, R2, R3 as in above topology, we analysis all Routers neighbor table .

That shows Full Neighborship Status for neighbors . Take a look again at the neighbor table,
Neighborship is being maintained with it’s directly connected interfaces.
Now, if we will try to PING
· R2 S0/1 , surely we will get successful reply .
· R2 S0/0, we will get successful reply (as it is directly connected)
· R3 S0/0, obviously we R1 can’t reach 2.2.2.1 of R2 we will be unable to get reply from R3 s0/0.

Why? Just take a look at the neighborship table of R1 again .
So, what is happening behind the scenes when R1 trying to communicate with 2.2.2.0/24 network .
R1 can’t even find the path or from which interface R1 should send the packets .

Now lets take a look at the Router OSPF LSA’s,
· R1 having LSA1 (router-id) updates of only those routers in same area.
Reason : There is no ABR to send LSA3 (summary LSA) updates . ( remember ABR? )

After looking at LSA and neighbor-table, you can guess about the routes will be there in Routing Table.

Again, they are also from directly connected interfaces with Routers.
Now make it a bit interesting, we will going to add interfaces on R2 in Area 0 .

Now, compare neighborship table of Router R1,R2,R2 with and without AREA 0 (backbone area) .
R1 topology table with AREA 0

We can now clearly see LSA3 in the table, apart from networks of Area 0 R1 got one more network advertisement in LSA for 192.168.2.0/24 and 2.2.2.0/24 in summary LSA updates from R2(ABR router).
While in
R2 topology table without AREA 0

In the same way, AREA 0 will also make Router R2 as ABR now and that will add a lot to topology table of Router R2 .
Now, it is behaving like ABR as it is acting as both in AREA-2 and AREA-3 completely.

Router R3 also getting LSA1 and LSA3 updates from R2(ABR).

Note: LSA2 updates (network LSA) are only advertised in Non-broadcast where DR & BDR exist.
Now , also PING will be successful from any Router to any network in topology.
Conclusion:
OSPF will not form neighborship with inter-area(IA) routes if there is no backbone area exist or we do not use ABR . In other words, Each area share it’s link state database only through AREA0 to any other AREA. It will make neighborship only with directly connected networks
LSA 1,2 do not need Area0 to share it’s Acknowledgement but LSA2 will form only in non-broacast network (like frame-relay) where DR will be having responsibility to send updates but we must need to have AREA0 to send LSA 3, 4, 5 & 7 updates.
----------------------------------------------------------------------------
R1 Config
Using 1024 out of 57336 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
archive
log config
hidekeys
!
!
!
interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0
ip address 1.1.1.1 255.255.255.0
clock rate 2000000
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
clock rate 2000000
!
router ospf 100
router-id 1.1.1.1
log-adjacency-changes
network 1.1.1.0 0.0.0.255 area 2
network 192.168.1.0 0.0.0.255 area 2
!
ip forward-protocol nd
!
!
ip http server
no ip http secure-server
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
-------------------------------------------------------------
R2-ABR Config
R2-ABR#show configuration
Using 1114 out of 57336 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
archive
log config
hidekeys
!
!
interface FastEthernet0/0
ip address 172.16.1.1 255.255.0.0
duplex auto
speed auto
!
interface Serial0/0
ip address 1.1.1.2 255.255.255.0
clock rate 2000000
!
interface FastEthernet0/1
ip address 172.17.1.1 255.255.0.0
duplex auto
speed auto
!
interface Serial0/1
ip address 2.2.2.1 255.255.255.0
clock rate 2000000
!
router ospf 100
router-id 2.2.2.2
log-adjacency-changes
network 1.1.1.0 0.0.0.255 area 2
network 2.2.2.0 0.0.0.255 area 3
network 172.16.0.0 0.0.255.255 area 0
network 172.17.0.0 0.0.255.255 area 0
!
ip forward-protocol nd
!
!
ip http server
no ip http secure-server
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
-------------------------------------------------------------------------
R3 Config
Using 1024 out of 57336 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
!
!
archive
log config
hidekeys
!
!
!
interface FastEthernet0/0
ip address 192.168.2.1 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0
ip address 2.2.2.2 255.255.255.0
clock rate 2000000
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
clock rate 2000000
!
router ospf 100
router-id 3.3.3.3
log-adjacency-changes
network 2.2.2.0 0.0.0.255 area 3
network 192.168.2.0 0.0.0.255 area 3
!
ip forward-protocol nd
!
!
ip http server
no ip http secure-server
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end

What is CEF- Cisco Express Forwarding: Load-Balancing with Static Routing

2012-03-29T10:45:00.002+05:30

The topology is given below we will be using here :

We made loopbacks each on R1& R2 and configure default static-routing with next hop interfaces on R2.
Configuration is like this :
On R1:

Configuring Default-routes on R1:

On R2:

Now we did trace route from R1 to Loopback 2.2.2.2 on R2 :

Take a look … it is sending one packet from 12.12.12.0/24 network and other from
And this is what R1 shows but what’s happening behind the scenes on R2 ?
Enabling Debug ip packet on R2 will help to know the sources of packets.

So, this is interesting ….
It shows,
For one packet source is 12.12.12.1 (interface S0/0)
And for another 30.15.20.1 (interface S0/1) and the process take place like this and packets has been sent from each serial interface of R1 alternatively.
But here’s the catch ….
With trace route load-balancing is working fine but when I tried with PING to 2.2.2.2

And as usual #debug ip packets was enabled on R2 . Things are not in favor now L
They are only using same route to send and receive packets.

And at the same time on R1

Note: Routed packets via FIB …
I saw it is following only 30.15.20.0/24 network to send packets. No load balancing.
Look at the above picture carefully,
When R1 is sending packet s=30.15.20.1 , d=2.2.2.2, routed through RIB.
And When R2 is sending Acknowledgement reply for this packet when s=2.2.2.2 and d=30.15.20.1, routed via FIB.
Mummble …. Now whats that CEF, FIB, RIB ??
RIB - routing information base
FIB - forwarding information base
CEF- Cisco Express Forwarding
Once CEF is enabled, it will form the FIB table with the help of Routing table. Now router no longer looks on RIB and FIB acts as replacement for RIB.
CEF also generates adjacency table which pre-maps all of the next hop ip as well as MAC address so as we configure Static routing, CEF add routes to FIB (forwarding information base) and send the packets through the interface which is added first into the table and the static route we have configured first will be added first and will be used to send packets .
Since, here 30.15.20.0/24 is stored first as well as configured first for static route so it will be using 30.15.20.0/24

At the same moment and it will not check the routing table when sending packets to another router/network from then on unless there is change in the routing table and will forward all the packets based on CEF table only.
CEF is ON by default on the routers.

Now, try to debug after Disabling CEF on R1

We are successful to load-balance equally from R1-R2 by disabling CEF. J
NOTE: Routed via RIB not FIB i.e. No longer using FIB table created by CEF.
Now, why?? Why ?? traceroute is able to do load-balancing without disabling CEF ?
Better to find out through practical approach
CEF is enable (by default)
Enable #debug ip packet and
Traceroute to 2.2.2.2

Note : sending broad/multicast .

Now, why it was choosing 30.15.20.0/24 not 12.12.12.10/24 network when we are sending packets through PING??
Hope this is informative for you .
Thank you for reading.

WiFi Protected Standard vulnerability – Cracked, Bruteforced and Documented

2012-03-29T10:42:00.002+05:30

A new critical flaw in Wi-Fi Protected Standard (WPS) has recently been uncovered by Security researcher Stefan Viehböck that leaves wireless routers open to attack. The inherent vulnerability lies in the design protocol that splits the 8 digit PIN in two halves which reduces its complexity and henceforth the time required to crack it. Simple permutations and combinations deduce that an 8 digit pin will create 100 million possible combinations and during his testing Stefan found it takes 2 seconds to test each combination, so bruteforcing was not a feasible option.

Unfortunately, after entering the first 4 digits of a pin, the protocol used by WPS confirms if they are correct or not, which means the pairs can be attacked separately. Also, the remaining 4 digits is just a checksum, so if an attacker has the first 4 digits, he just have to try ~1000 combinations to crack it open , which brings it to a total of 11000 different combinations to the correct pin which reduces the attack time into a matter of hours. You can find the documented PDF here and read the awesomeness.
I guess router manufacturers are up for a software fix, till then , I guess we all have to go back to MAC address .

Chinese Hackers Trojan-ize US Access Card - The curious case of Sykipot Trojan

2012-03-29T10:41:00.001+05:30

Researchers at AlientVault have uncovered a new strain of Sykipot Trojan which has been used to compromise the Department of Defense-sanctioned smart cards used to authorise network and building access at many US government agencies, the Trojan has been adapted by Chinese hackers in order to lift credentials from compromised systems in order to access classified military networks. The Trojan inadvertently targets PCs attached to smart card readers running ActivClient, the client application of ActivIdentity, in what's been described as a 'smart card proxy' attack.

How to spread a Trojan Horse: Methods to spread Trojan Horse on Internet

2012-03-29T10:35:00.003+05:30

ICQ
IRC
Attachments
Physical Access
Browser And E-mail Software Bugs
NetBIOS (File Sharing)
Fake Programs
Un-trusted Sites And Freeware Software

ICQ

People can also get infected while chatting / talking / video messaging over ICQ or any other Instant Messenger Application. It is a risk that the user undertakes when it comes to receiving files no matter from whom or where it comes.
IRC

Here also, the threat comes from exchange of files no matter what they claim to be or where they come from. It is possible that some of these are infected files or disguised files.
Attachments

Any attachment, even if it is from a known source should be screened as it is possible that the source was infected earlier and is not aware of it.
Physical Access

Physical access to a target machine is perhaps the easiest way for an attacker to infect a machine. The motive may be a prank or just plain curiosity.
Browser and E-mail Software Bugs

Having outdated applications can expose the system to malicious programs such as Trojans without any other action on behalf of the attacker.
NetBIOS (File Sharing)

If port 139 is opened, the attacker can install trojan .exe and modify some system file, so that it will run the next time the system is rebooted. To block file sharing in Windows version, go to: Start->Settings->Control Panel->Network->File and Print Sharing and uncheck the boxes there.

Increasing Reliance Netconnect speed, Online Transaction failure and Customer Care woes

2012-03-29T10:34:00.001+05:30

Since my data card limit was over, so i got Reliance Netconnect from a colleague, thought it might come handy while posting “IP Subnetting - The easy way” at some simple surfing, I was already skeptic of taking the data card actually as I previously had a very bad experience with Reliance Netconnect and doubted if their broadband services are any good. I bet my MTS Mblaze makes it eat dirt any day ,but I had no option at that moment and thought , lets give the fucker another chance.

Ah well..you can say it was more than bad. Firstly, the data card has pretty bad speeds (~30 KBps) and then connection dropping issues. Mind you, I live in Delhi NCR and get full signal bars all the time on Reliance Netconnect Broadband + but still it barely managed to load Facebook. I thought, why not to change the DNS, on experimenting, I found Open DNS and Verizon DNS to be the most stable of all and I got a speed boost of 90-100 KBps : ]]
Here is how you can Increase speed of Reliance Netconnect Broadband + datacard -
Plugin your data card, launch application, go to settings, click on edit.

Click on advanced and put DNS server IPs. I found Verizon 4.2.2.2 //4.2.2.1 and Open DNS 208.67.222.222 // 208.67.220.220 work best for me. You can also try Google DNS 8.8.8.8 // 8.8.4.4 . Experiment and pick your choice.

Once done, click OK, save it and connect. you will get improved speeds..The whole process makes me wonder why Reliance’s default DNS is so slow . Do they even use their datacards at their home ? :|
On to my story, Since, even after changing DNS, the speeds were not good enough for me, so I thought, why not to recharge my MTS Data card online and then use it. Instantly I opened MTS website and after entering required details, transferring money to MTS from my online account, the page hanged and session was timed out. Responding to my sense of deja vu, I checked the data card and found it was not sending/receiving any data. the fucker dropped the connection just I when i was about to get my transaction completed.
I guess it took its revenge :X
I immediately emailed to MTS customer care/RechargeItNow/Bank customer care and I have *yet* to receive a helpful followup message on email. I contacted MTS customer care on phone and entered 1,1,1,1,<datacard MDN number>,1 waited for 2 minutes 46 seconds (yeah..i timed it) , the automated IVR said “after several tries you have not entered any number, so we are transferring your call to our expert” . Well..it wasn't my fault, again, there is some fault in their system as I tried 3 different valid MDN numbers later on and I got the same result. Nevertheless, I was put on call with an *expert* to whom I explained my issue and asked for escalation matrix, the details of email ID and in simple words, “what to do in case of transaction failure, the MTS way ? ”
The result was flabbergasting, the CCE spoke in an english which by all means was incomprehensible to me, I politely disconnected the call and then fumed for 2-3 minutes while looking at the Reliance datacard.

Protip : If you hate someone, gift him a Reliance datacard and watch him cry tears of blood :P

In the meantime i am still waiting for a positive response from my bank/MTS/rechargeitnow.
That was last night and I guess i have been outsmarted by a pathetic Reliance Netconnect.

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

2012-03-29T10:31:00.001+05:30

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

Manual testing is awesome, but automated checks are faster and maybe even more reliable. Here are some self-written tools you could use for your purposes:

#1
Joomla QPersonel Exploit
http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py

#2
Automated Joomla SQL Injection Exploiterhttp://www.xenuser.org/exploits/joomla_sqli_sploiter.py

#3
Joomla BF Quiz Exploithttp://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py

#4
Column Fuzzerhttp://xenuser.org/tools/column_finder.py

#5
Simple SQL Injection Vulnerability Scannerhttp://www.xenuser.org/tools/sqli_scanner.py

#6
Simple Log File Analyzerhttp://www.xenuser.org/tools/scan_log.py

#7
Simple Local File Inclusion Exploiterhttp://www.xenuser.org/tools/lfi_sploiter.py

These tools can help you to exploit vulnerabilities within Joomla or some extensions.

NOTE: Read the help (included in those tools) for details.

The Simple Log File Analyzer could be used for scanning your Apache log files. It shows if there are hack attempts.

Hacking PHP 4.4 sites in 20 seconds

2012-03-29T10:28:00.003+05:30

Now here is a real hacking tutorial in which I am going to hack a real website,and that too in less than 20 seconds.and I am not kidding. Actually sites with PHP 4.4 have a SQL injection vulnerability in them which makes their Admin control panel easily accessible,and I mean in one big shot,you will be admin of that site.
Remember,this tutorial is applicable on PHP4.4 machines with Apache running in parallel with them.Also,since I will be hacking REAL websites,I will not be displaying their URL’s or else I will be gunned down (by law of course :P).It will be partial in nature,that is I WILL not be teaching each and everything to you,I assume you know basics of SQL injection/PHP injection/Google searching,and if you don't then read these articles first -

Google Search Tips for Hacking
Google Secrets – Some Cool Google Dorks
Basics of SQL Injection
SQL injection by example
Simple Nmap Scanning

In the mean time,here is how you can start -
Step 1 – Search for them
Yep,make a Google dork to find sites running Apache and PHP 4.4 . Its quite easy.
Step 2 – Scan them
Start by scanning them using Nmap,Do and intense scan and find the open ports. If you find port 2000 open,then you have almost got it. most websites running PHP4.4 have this port for admin login.
Now just login using port 2000 ie -

http://www.website.com:2000

and you will be comfortably login into admin page like this -

Step 3 – Hack them
Now in the fields,you have to type -

username – admin
password – a’ or 1=1 or ‘b
domain - a’ or 1=1 or ‘b

and press go,you will login into admin

voila..you have hacked into admin. Actually sites based on PHP 4.4 have the vulnerability in them that they are vulnerable to SQL injection.It will literally take 20 seconds.

Advanced password hacking using Google – easy to learn, easy to apply

2012-03-29T10:26:00.003+05:30

Google is your best friend when it comes to hacking. The search engine giant has crawled loads of data which was intended to be protected by webmasters, but is being exploited and mined by smart users using Google dorks. Today I will be discussing some practical dorks which will help you gain passwords, databases and vulnerable directories. The basic methodology remains the same, query Google using specialized dorks with precise parameters and you are good to go. I assume you have basic working knowledge of google dorks.
Lets start, shall we ?

FTP passwords
ws_ftp.ini is a configuration file for a popular win32 FTP client that stores usernames, (weakly) encoded passwords, sites and directories that the user can store for later reference.

intitle:index.of ws_ftp.ini

You can also this dork which uses "parent directory" to avoid results other than directory listings

filetype:ini ws_ftp pwd
Or
"index of/" "ws_ftp.ini" "parent directory"

even if the site or file has been taken offlline, you can still search the contents in the Google cache using the following dork

"cache:www.abc.com/ws_ftp.ini"
where
www.abc.com is the site you want to check the dork for.

The ws_ftp password uses quite weak encryption algorithm, hence once you get the password, you can break it using the decryptor provided here or from here.

PHP Hacking
Sites made in PHP have a file known as “config.php” which stores configuration and the username and password for the sql database the site is hosting. This password is required only once per transaction (i.e when ever admin logins or a transaction is committed at administrator level) and hence will be specified by the ‘require_once’ parameter in the config file or in index file.

intitle:index.of config.php

to view php file contents

intitle:"Index of" phpinfo.php

you can also try the directory traversal attack in php using the following dork

inurl:download.php?=filename

if you are lucky, substitute the filename with ‘index.php’, download it, read it and get the password (hint:if you are not able to find it, try looking for globals.php).
Since most websites today deny this trick, but you may get lucky with some :)

SQL Dumps
We will be hunting for SQL password dumps saved in database, here ext:sql specifies the type of password dump, e10adc3949ba59abbe56e057f20f883e is the md5 hash for 123456; one of the most common password people keep..and intext dork will allows to search inside the dump.

ext:sql intext:@gmail.com intext:e10adc3949ba59abbe56e057f20f883e

ext:sql intext:"INSERT INTO" intext:@somemail.com intext:password

Remember kids

Use different email providers, substitute gmail/yahoomail instead of somemail ,or try custom domain mail providers.
Use different file extensions.
Use different type of hashes, some older ones might be using md4 and some others might be using other prominent encryption algorithms.
just mix everything up and try different combinations :)

Its not over..Yet
A very flexible query can be used to hunt for WS_FTP.log which in turn can disclose valuable information about the server.

+htpasswd +WS_FTP.LOG filetype:log

You can substitute "+htpasswd" for "+FILENAME" & you may get several results not mentioned before using the normal search. You can further explore filenames by using keywords like

phpinfo, admin, MySQL, password, htdocs, root, Cisco, Oracle, IIS, resume, inc, sql, users, mdb, frontpage, CMS, backend, https, editor, intranet

The list goes on and on.. Also you cam try this dork to data mine information about the uploader

"allinurl: "some.host.com" WS_FTP.LOG filetype:log"

which tells you more about who's uploading files to a specific site, quite handy for some passive reconnaissance.

Also..if you are one hell of a lazy b**tard ,you can do it using some software like Google Hacks..but remember, manual way is the way to go. I may have included some software specific password mining, but that would cripple your imagination. My recco ? go postal by using your imagination and developing your own dorks and queries.

A Brief Introduction To Internet Threat DDOS

2012-03-29T10:23:00.000+05:30

Why DDOS became a world's number one threat to IT Business?

What is DDOS?
DDOS is known as Distributed Denial of Service. DDOS attack is intent to cause a web service incurable, unavailable or unusable. Specialty of DDOS attack is that there is no limit of the number of the machines which are going to target a particular website or the host. The nature is in his name quoted "Distributed". In simple words the number of machines from the world sends unlimited number of connections to a particular single domain or the website. Suddenly traffic increases and that site or domain would not able to bare a sudden load and it goes down or temporary unavailable. Due to coming traffics from various IP addresses at a time, it is more difficult to detect and block traffic of all IP addresses.

Let's Go To Year 2000
First ever DDOS attack was faced by a famous search engine yahoo. Due to this attack yahoo got unavailable for 2 or 3 hours in worldwide. In a result of that yahoo had to face a big amount of loss in money in advertising revenue. E-Bay and CNN was also the victim of DDOS attack.

How Does Actually Attack Happen?
Here I have mentioned some common detailed steps that how this attack is actually done.
Step 1:-
First of all attackers scans a large amount of computers or networks for the open vulnerability. There are 65,535 port of any single machine. Attacker scans this all ports of each machine. This scenario is hard to accept theoretical but the logic is that this can be done within an hour with the automated tools. It can be done with the help of various port scanners. As a result of that port scanners gives attacker the list of the IP address of the machines on which the ports are open.

Step 2:-
As I have told, after the scan it gives attacker a vulnerable machine's ip address list. Then attacker decides to involve all machines in his attack. These systems are known as handlers. The common method of this is stack based buffer overflow. When this process is done then buffer gets overflowed. And the particular malicious data is stored on the Vitim's machine. This victim is not the real victim on which attacker is going to attack. He or she uses this victim to attack main victim. Now on that machine, attacker has his or her control. He can send commands to and the vulnerable machine will execute that command. This senerio doesn't happen to only one but it happens in 1000 or may be more vulnerable machines. That's why it is more difficult to catch the actual attacker in DDOS attack.

Step 3:-
After the gaining access to the system another attack is generated in order to take command in his/her hand whenever they want in future. This can be done with the help of RATs, Backdoors, Root kits or a Trojan

Step 4:-
Final attack takes place here. Hacker or attacker sends commands to their handlers or the vulnerable machines on which he has gained access. The attack can be in a manner of flooding.

For example if an attacker has command over 100 machines and if he sends instruction that each machines has to ping a particular websites 100 times then, simple calculation 100* 100 = 10000 hits goes to the website and it may go down.

To put in a nutshell, DDOs attack is very advance attack, executed by hackers to crash a whole network. There would be a large number of impact goes on a business like cost impact, delay of work impact, E-Reputation impact. Internet became more users friendly and handy in last 15 years. So it is obvious that hacking activity will take place for a sure later or sooner. To cure this big flaw there should be a recruitment of the ethical hacker, network administrators and cyber security experts who has an ability to detect and mitigate the attack in organization. Because, prevention is better than cure.

How China Do Social Networking Behind Firewall | INFOGRAPHIC

2012-03-29T10:21:00.001+05:30

China’s notorious Great Firewall — or as they call it, the Golden Shield — is known for blocking some high profile sites. Facebook, YouTube and Twitter are all victims. But that has not kept the world’s most populous country from getting into social networking. Some 500 million Chinese citizens are online and a quarter of the world’s social network users live under the firewall.

So how then, do the Chinese connect online? On their own series of social networks, mimicking several blocked foreign counterparts. Renren and Kaixin001 fill Facebook’s void. Sina Weibo is the microblog of choice in Twitter’s absence. Youku is a video hosting platform, which only loosely enforces copyright laws; think of it as a YouTube-meets-Hulu, because many popular TV shows and movies are posted freely. Jiepang is the most popular location-based mobile app, with Foursquare-style checkins.

This infographic, created by G+ (not to be confused with Google+), takes a look at China’s answer to social networking. Of the country’s half billion Internet users, half of them are on multiple social networks and 30% log into at least one network each day. Chinese citizens spend an average of 2.7 hours online per day second to only the Japanese.

What is Pen-Testing? | Pen-Testing vs.Vulnerability Assessment | How Vulnerabilities Are Identified?

2012-03-29T10:19:00.000+05:30

Penetration testing is the process of attempting to gain access to resources without knowledge of usernames, passwords and other normal means of access. If the focus is on computer resources, then examples of a successful penetration would be obtaining or subverting confidential documents, price lists, databases and other protected information.

The main thing that separates a penetration tester from an attacker is permission. The penetration tester will have permission from the owner of the computing resources that are being tested and will be responsible to provide a report. The goal of a penetration test is to increase the security of the computing resources being tested.

In many cases, a penetration tester will be given user-level access and in those cases, the goal would be to elevate the status of the account or user other means to gain access to additional information that a user of that level should not have access to.

Some penetration testers are contracted to find one hole, but in many cases, they are expected to keep looking past the first hole so that additional vulnerabilities can be identified and fixed. It is important for the pen-tester to keep detailed notes about how the tests were done so that the results can be verified and so that any issues that were uncovered can be resolved.

It’s important to understand that it is very unlikely that a pen-tester will find all the security issues. As an example, if a penetration test was done yesterday, the organization may pass the test. However, today is Microsoft’s “patch Tuesday” and now there’s a brand new vulnerability in some Exchange mail servers that were previously considered secure, and next month it will be something else. Maintaining a secure network requires constant vigilance.

Pen-Testing vs.Vulnerability Assessment

There is often some confusion between penetration testing and vulnerability assessment. The two terms are related but penetration testing has more of an emphasis on gaining as much access as possible while vulnerability testing places the emphasis on identifying areas that are vulnerable to a computer attack.

An automated vulnerability scanner will often identify possible vulnerabilities based on service banners or other network responses that are not in fact what they seem. A vulnerability assessor will stop just before compromising a system, whereas a penetration tester will go as far as they can within the scope of the contract.

It is important to keep in mind that you are dealing with a ‘Test.’ A penetration test is like any other test in the sense that it is a sampling of all possible systems and configurations. Unless the contractor is hired to test only a single system, they will be unable to identify and penetrate all possible systems using all possible vulnerabilities. As such, any Penetration Test is a sampling of the environment. Furthermore, most testers will go after the easiest targets first.

How Vulnerabilities Are Identified?

Vulnerabilities need to be identified by both the penetration tester and the vulnerability scanner. The steps are similar for the security tester and an unauthorized attacker. The attacker may choose to proceed more slowly to avoid detection, but some penetration testers will also start slowly so that the target company can learn where their detection threshold is and make improvements.

The first step in either a penetration test or a vulnerability scan is reconnaissance. This is where the tester attempts to learn as much as possible about the target network as possible. This normally starts with identifying publicly accessible services such as mail and web servers from their service banners.

Many servers will report the Operating System they are running on, the version of software they are running,patches and modules that have been enabled, the current time, and perhaps even some internal information like aninternal server name or IP address.

Once the tester has an idea what software might be running on the target computers, that information needs to be verified. The tester really doesn’t KNOW what is running but he may have a pretty good idea. The information that the tester has can be combined and then compared with known vulnerabilities, and then those vulnerabilities can be tested to see if the results support or contradict the prior information.

In a stealthy penetration test, these first steps may be repeated for some time before the tester decides to launch a specific attack. In the case of a strict vulnerability assessment, the attack may never be launched so the owners of the target computer would never really know if this was an exploitable vulnerability or not.

Chrome hacker wins $60,000 for finding 'full' exploit

2012-03-29T09:43:00.001+05:30

The winner, Sergey Glazunov, was the first to submit an entry in Google's Pwniumcompetition to find security exploits in Chrome.

by Don Reisinger

March 8, 2012

http://news.cnet.com/8301-13506_3-57393337-17/chrome-hacker-wins-$60000-for-finding-full-exploit/?part=rss&subj=news&tag=2547-1_3-0-20

Less than two weeks after Google launchedPwnium, a competition for hackers to find security exploits in Chrome, the search giant has announced its first winner.

Google's Sundar Pichai announced on his Google+ page yesterday that Chromium contributor Sergey Glazunov submitted the first successful entry to the Pwnium contest, revealing a "Full Chrome Exploit" that bypassed the browser's sandboxing security. The exploit makes it possible for a malicious hacker to do just about anything they want on an infected machine.

In an interview published yesterday by CNET sister site ZDNet, Justin Schuh of the Chrome security team said that Glazunov was able to execute "code with full permission of the logged-on user." Schuhcalled the feat "impressive," and said that it deserved the $60,000 bounty.

Glazunov is the first person to win cash from Google's Pwnium competition. The company launched the contest in late February with promises of awarding up to $1 million to those who can find security holes in Chrome. The highest $60,000 prize is given only to those who can obtain "Chrome/Windows 7 local OS user account persistence using only bugs in Chrome itself." A $40,000 prize will be awarded to individuals who can target Chrome with one of its own bugs, plus others found in the operating system. Google's $20,000 award is given to those who can find issues without using bugs in Chrome.

"We require each set of exploit bugs to be reliable, fully functional end to end, disjoint, of critical impact, present in the latest versions and genuinely '0-day,' i.e. not known to us or previously shared with third parties," Google wrote in its blog announcing the contest. "Contestant's exploits must be submitted to and judged by Google before being submitted anywhere else."

Now that Glazunov's discovery has been verified, Google is "working fast on a fix,"Pichai wrote on his Google+ page. The company says that it'll push the fix out in an auto-update.

"This is exciting; we launched Pwnium this year to encourage the security community to submit exploits for us to help make the web safer," Pichai wrote. "We look forward to any additional submissions to make Chrome even stronger for our users."

Reset Ubuntu 11.10 Password

2012-03-04T17:55:00.000+05:30

Hey Guys,
If you’ve forgotten your Ubuntu 11.10 Password you can reset it within 2 minutes. I will tell you two methods to reset your Ubuntu Password. The first one is by booting it in recovery mode and second one is by using any Live OS.

Let’s start with the recovery mode first as it takes less time and easy to do in comparison to the second one method:

Boot up your Ubuntu. Press and Hold ‘Shift’ Key while the machine is booting. You will get the GRUB Menu like this:

Select the second option which is ‘Recovery Mode’ and press Enter. After pressing enter system will start booting and you will get a list of options like this:

After that we need to make the filesystem writable so that we can change the password. To make it writable select the 3^rd option ‘remount’ and press Enter. After pressing enter you will get the following:

Press Enter here and you will get recovery menu with a list of options again:

Select the last option ‘root’ and press enter. If the root account password is not set then you will get a shell prompt like this:

Now you can enter commands to reset the password of any account.
#passwd <username>

Enter the new password and confirm it by entering again.

Now enter command ‘sync’.

Now Enter the command ‘reboot –f’ to reboot.

Now you can login with your new password.

Now if the root account is having a password then you will not get the shell at recovery mode. In this case you need to boot your ubuntu machine with any Live OS. I will be booting it again with Ubuntu 11.10.

Boot your machine with Ubuntu 11.10. You will get a screen asking to just try this as a live cd or install it on your machine:

Click on ‘Try Ubuntu’ to use it as a LIVE OS.

You will get desktop a live user. Now you need to mount the file system to change the password. First we need to know the device name of the filesystem to mount. To get the name of device enter the command ‘sudo fdisk –l’

Now as you can see the system type of /dev/sda1 is Linux.
So we need to mount the device ‘/dev/sda1’.

To mount this device enters the following command.
#sudo mount /dev/sda1 /tmp

Now we need to enter the command ‘sudo chroot /tmp’ to get the shell on your filesystem:

Now we’ve got the shell we can change the password of any user by entering the command ‘passwd <username>’

Now restart the machine by entering the command ‘reboot’ and you will be able to login with your new password.

DnsChanger Trojan

2012-03-04T09:50:00.001+05:30

Full Name:	DnsChanger Trojan
Type:	Trojan
Also Known as:	WIN32.DNSCHANGER.S TROJAN, Trojan.Flush.G (Symantec)



Category Description:	Trojans are malicious applications that pose themselves as legitimate software in order to trick users to install them. Once on the victim's machine, it may run any number of malicious process to steal vital information or inflict damage to other software.
Comment:	This trojan modifies the DNS server settings and redirect the browser to unwanted sites. May download an adware payload.

Manual removal:	1. Navigate to the following paths in the registry. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters "DhcpNameServer" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\%Random CLSID% "DhcpNameServer" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\%Random CLSID% "NameServer" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\%Random CLSID% "DhcpNameServer" 2. Look for unknown IP Addresses in the Data part. Change them into IP addresses for your DNS Servers. For more information contact your system administrator.
Properties:	Adds other software System Reconfiguration Redirects searches

Zero-day Smartphone Vulnerability exposes location and User Data

2012-02-26T15:58:00.001+05:30

Zero-day Smartphone Vulnerability exposes location and User Data

Smartphones are increasingly becoming the preferred device for both personal and professional computing, which has also attracted hackers to increase their focus on creating malware and other security vulnerabilities for these devices. A former McAfee researcher "Dmitri Alperovitch" has used a previously unknown hole in smartphone browsers to plant China-based malware that can record calls, pinpoint locations and access user texts and emails.

He conducted the experiment on a phone running Android operating system, although he saysApple Inc.'s iPhones are equally vulnerable. Android is particularly vulnerable because it has become the main operating system for mobile devices. Today most smartphones are android-based therefore there is a huge dividend for hackers to write Android-targeted malware compared to other operating systems.

Alperovitch, who has consulted with the U.S. intelligence community, is scheduled to demonstrate his findings Feb. 29 at the RSA conference in San Francisco, an annual cyber security gathering. Alperovitch and his team reversed engineered the malware called Nickispy and and took control of it.

A nice little piece of Android spyware, commonly known as 'NickiSpy.C' . For those unfamiliar, NickiSpy gained quite a bit of notoriety around July/August 2011, as it was one of the first malicious Android applications to have the ability to record phone calls. Alperovitch said he exploited a so-called zero-day vulnerability in smartphone browsers to secretly install the malware. Zero-day vulnerabilities are ones that are not yet known by the manufacturers and anti-virus companies.

The malware also intercepts texts and emails and tracks the phone's location, he said. In theory, it could be used to infiltrate a corporate network with which the phone connects. Like most pieces of Android spyware/malware, installation is dependant on the end-user. In an experiment he also delivered it through a classic "spear phishing" attack.

Protect from Malware : For Android, the danger is downloading apps outside of Google's App Market . If you're off somewhere getting apps from sources you don't know or trust, there could be consequences. For iPhone users, the line really is whether you jailbreak or not. Jailbreaking can be pretty easy, and getting pirated or bootlegged apps can seem like a great way to save money, but in doing so, you're basically handing out the smart phone equivalent of a front door key to Lord only knows.

Millions of pcAnywhere users still Vulnerable to hijacking

2012-02-26T15:53:00.002+05:30

Millions of pcAnywhere users still Vulnerable to hijacking

5 weeks before we reported that Symantec releases patch to address pcAnywhere source code exposure, because attackers had obtained the remote access software's source code. But According to H.D. Moore, chief security officer at Rapid7, estimated 150,000 to 200,000 PCs are running an as-yet-unpatched copy of the Symantec software.

While Symantec said it had patched all the known vulnerabilities in pcAnywhere. Symantec has released new information and a patch to address the recent code exposure incident. According to Computerworld report, PCs connected to the Internet, including as many as 5,000 running point-of-sale programs that collect consumer credit card data, could be hijacked by hackers exploiting bugs in the troubled program.

Symantec released a patch that eliminates known vulnerabilities affecting pcAnywhere 12.0 and pcAnywhere 12.1.At this time, Symantec recommends that all customers upgrade to pcAnywhere 12.5, apply all relevant patches as they are released, and follow general security best practices.

Moore said, even though Symantec has patched some flaws. With the source code at their disposal and the software's problems highlighted in the media, researchers on both sides of the law will spend time looking for vulnerabilities.

Appnimi ZIP Password Unlocker

2012-02-04T08:56:00.001+05:30

About Appnimi ZIP Password Unlocker

Appnimi ZIP Password Unlocker is designed to let you search for passwords of protected ZIP files. This program guarantees the most complicated passwords recovery. Appnimi ZIP Password Unlocker allows to search for the password of the protected ZIP file using Brute Force algorithm.
After recovering the password it will extract the files to a destination folder.

Features of Appnimi ZIP Password Unlocker

It is free
Easy to use
Support Windows 98, ME, NT, 2000, XP, 2003, Vista and Win 7 Systems
Recovers user password required to open the file
Brute-Force alogorithm are used to recover the password
Dictionary Attack using a word list can be used to recover the password.
The exe in the installation directory is portable
With an elegant GUI the user can set the parameters easily before starting the recovery process
Extract the files after recovery of password

Using Appnimi ZIP Password Unlocker

Download the zip file by clicking on the download link
Extract the zip
Run the installer in the zip file
Select the default settings while installing
Run "Appnimi ZIP Password Unlocker" using one of the shortcuts on desktop or in the startup menu.
Enter or select the path of the file whose password is to be recovered.
Enter the minimum and maximum length
Select Brute Force or Dictionary method of recovery
Enter the possible characters or path to dictionary/wordlist file.
Click on Start
The status bar gets updated at regular intervals showing the progress.

Screenshot

Initial Screen

Password Recovery in Progress

Password Recovered

Appnimi ZIP Password Unlocker

Version 2.1

Hits : 65992

Size : 0.54 MB

MD5 Hash : 7331e1bab55a38e64de5aa6e1fd7540a

SHA1 Hash : 913752c9aac35eb01a70fa3c371df9543c71e0bc

Download

Rar Password Unlocker

2012-02-04T08:40:00.000+05:30

About Appnimi RAR Password Unlocker

Appnimi RAR Password Unlocker is designed to let you search for passwords of protected RAR files. This program guarantees the most complicated passwords recovery. Appnimi RAR Password Unlocker allows to search for the password of the protected RAR file using Brute Force algorithm.
After recovering the password it will extract the files to a destination folder.

Features of Appnimi RAR Password Unlocker

It is free
Easy to use
Support Windows 98, ME, NT, 2000, XP, 2003, Vista and Win 7 Systems
Recovers user password required to open the file
Brute-Force alogorithm are used to recover the password
The exe in the installation directory is portable
With an elegant GUI the user can set the parameters easily before starting the recovery process
Extract the files after recovery of password

Using Appnimi RAR Password Unlocker

Download the setup zip file by clicking on the download link
Extract the zip
Run the installer in the rar file
Select the default settings while installing
Run "Appnimi RAR Password Unlocker" using one of the shortcuts on desktop or in the startup menu.
Enter or select the path of the file whose password is to be recovered.
Enter the minimum and maximum length
Enter the possible characters
Click on Start
The status bar gets updated at regular intervals showing the progress.

Screenshot
Initial Screen
Password Recovery in Progress

Password Recovered

Appnimi RAR Password Unlocker

Version 2.0

Hits : 22642

Size : 0.56 MB

MD5 Hash : 1bf40124660fbee4ad9594eedf0f618f

SHA1 Hash : 4769e706173ace2279983b30cf120692ff3d8aca

Download

Google Sites Directory

2012-02-01T11:11:00.003+05:30

There are thousands of Google related sites, services and features out there. Many are well known, some are not. We'd like to shed some light.

Google themselves operate an incredible amount of sites and bring out new ones ALL THE TIME. Since Google's services and partner options are well used there are many professionals who offer explanation, add-on's or additional descriptions and support to existing Google services.
If you have some dealings with Google you might appreciate this page as a resource. Don't forget to bookmark this page and send it off to your friends if you like it. We hope this collection is of service to you;

Google Sites and Services

Google (http://www.google.com/)
Froogle (http://froogle.google.com) product search engine (active beta)
Google News (http://news.google.com/)
Google Local (http://local.google.com/)
Google Wireless (http://www.google.com/options/wireless.html)
Google Scholar (http://scholar.google.com/)
Google Suggest (http://www.google.com/webhp?complete=1&hl=en)
Google Keyhole (http://www.keyhole.com/)
Google Print (http://print.google.com/print/faq.html) (beta) (Example (http://print.google.com/print/doc?isbn=0195128427))
Google Books (https://www.googlestore.com/)
AdWords (https://adwords.google.com)
AdSense (https://www.google.com/adsense/)
Gmail (http://www.gmail.com/) (private beta)
Google Labs (http://labs.google.com/) (a testing ground for Google services that are in beta)
Google Groups 2 (http://groups-beta.google.com/)
Official Google weblog (http://www.google.com/googleblog)
googlesyndication.com (http://www.googlesyndication.com/) - Official Google mirror
Early Google.com (http://web.archive.org/web/19981202230410/www.google.com/) - Google as on November 11, 1998 from Internet Archive

Google Regions and Google Countries, Google in other Languages

American Samoa (http://www.google.as/)
Anguilla (http://www.google.off.ai/)
Antigua and Barbuda (http://www.google.com.ag/)
Argentina (http://www.google.com.ar/)
Australia (http://www.google.com.au/)
Austria (http://www.google.at/)
Azerbaijan (http://www.google.az/)
Belgium (http://www.google.be/)
Brazil (http://www.google.com.br/)
British Virgin Islands (http://www.google.vg/)
Burundi (http://www.google.bi/)
Canada (http://www.google.ca/)
Chad (http://www.google.td/)
Chile (http://www.google.cl/)
Colombia (http://www.google.com.co/)
Costa Rica (http://www.google.co.cr/)
Côte d'Ivoire (http://www.google.ci/)
Cuba (http://www.google.com.cu/)
Dem. Rep. of the Congo (http://www.google.cd/)
Denmark (http://www.google.dk/)
Djibouti (http://www.google.dj/)
Dominican Republic (http://www.google.com.do/)
Ecuador (http://www.google.com.ec/)
El Salvador (http://www.google.com.sv/)
Federated States of Micronesia (http://www.google.fm/)
Fiji (http://www.google.com.fj/)
Finland (http://www.google.fi/)
France (http://www.google.fr/)
The Gambia (http://www.google.gm/)
Georgia (http://www.google.ge/)
Germany (http://www.google.de/)
Gibraltar (http://www.google.com.gi/)
Greece (http://www.google.com.gr/)
Greenland (http://www.google.gl/)
Guernsey (http://www.google.gg/)
Honduras (http://www.google.hn/)
Hong Kong (http://www.google.com.hk/)
Hungary (http://www.google.co.hu/)
India (http://www.google.co.in/)
Ireland (http://www.google.ie/)
Isle of Man (http://www.google.co.im/)
Israel (http://www.google.co.il/)
Italy (http://www.google.it/)
Jamaica (http://www.google.com.jm/)
Japan (http://www.google.co.jp/)
Jersey (http://www.google.co.je/)
Kazakhstan (http://www.google.kz/)
Korea (http://www.google.co.kr/)
Latvia (http://www.google.lv/)
Lesotho (http://www.google.co.ls/)
Liechtenstein (http://www.google.li/)
Lithuania (http://www.google.lt/)
Luxembourg (http://www.google.lu/)
Malawi (http://www.google.mw/)
Malaysia (http://www.google.com.my/)
Malta (http://www.google.com.mt/)
Mauritius (http://www.google.mu/)
México (http://www.google.com.mx/)
Montserrat (http://www.google.ms/)
Namibia (http://www.google.com.na/)
Nepal (http://www.google.com.np/)
Netherlands (http://www.google.nl/)
New Zealand (http://www.google.co.nz/)
Nicaragua (http://www.google.com.ni/)
Norfolk Island (http://www.google.com.nf/)
Pakistan (http://www.google.com.pk/)
Panamá (http://www.google.com.pa/)
Paraguay (http://www.google.com.py/)
Perú (http://www.google.com.pe/)
Philippines (http://www.google.com.ph/)
Pitcairn Islands (http://www.google.pn/)
Poland (http://www.google.pl/)
Portugal (http://www.google.pt/)
Puerto Rico (http://www.google.com.pr/)
Rep. of the Congo (http://www.google.cg/)
Romania (http://www.google.ro/)
Russia (http://www.google.ru/)
Rwanda (http://www.google.rw/)
Saint Helena (http://www.google.sh/)
San Marino (http://www.google.sm/)
Singapore (http://www.google.com.sg/)
Slovakia (http://www.google.sk/)
South Africa (http://www.google.co.za/)
Spain (http://www.google.es/)
Sweden (http://www.google.se/)
Switzerland (http://www.google.ch/)
Taiwan (http://www.google.com.tw/)
Thailand (http://www.google.co.th/)
Trinidad and Tobago (http://www.google.tt/)
Turkey (http://www.google.com.tr/)
Ukraine (http://www.google.com.ua/)
United Arab Emirates (http://www.google.ae/)
United Kingdom (http://www.google.co.uk/)
Uruguay (http://www.google.com.uy/)
Uzbekistan (http://www.google.uz/)
Vanuatu (http://www.google.vu/)
Venezuela (http://www.google.co.ve/)
Vietnam (http://www.google.co.vn/)

Google News Country Links

Australia (http://news.google.com/news/en/au/main.html)
Canada (http://news.google.com/news/en/ca/main.html)
France (http://news.google.com/news/fr/fr/main.html)
Germany (http://news.google.com/news/de/de/main.html)
India (http://news.google.com/news/en/in/main.html)
Italy (http://news.google.com/news/it/it/main.html)
New Zealand (http://news.google.com/news/en/nz/main.html)
Spain (http://news.google.com/news/es/es/main.html)
U.K. (http://news.google.com/news/en/uk/main.html)
U.S. (http://news.google.com/news/en/us/main.html)

Google Calculators and Tools

Sites about Google

Google Fight (http://www.googlefight.com/) - instantly compare two search queries
The Unofficial Google Directory (http://www.google-directory.co.uk/) - collection of tools and resources
Google World - a directory to find any type of information about the world according to Google (http://google.indicateur.com/)
The Unofficial Google Fan Club (http://www.ugfc.org/)
Google Blogoscoped (http://blog.outer-court.com/)
Google Watch China Organization (http://www.google-watch-china.org)
Google Watch (Why we nominated Google for the 2003 U.S. corporate Big Brother of the Year) (http://www.google-watch.org/bigbro.html)
Google IPO Coverage (http://www.google-ipo.com/)
Google News (http://www.realseo.com/archives/cat_google_news.html)

Google parodies

Cthuugle Search Fhtagn! (http://www.cthuugle.com/) The complete HP Lovecraft Search Engine
elgooG (http://www.alltooflat.com/geeky/elgoog/) the elgooG Search Engine

010 Hacker

White House considered cyberwar with Libya

China behind massive cyber attack on US?

Pentagon creating new-generation cyberweapon

US launched cyber attacks on other nations

‘Flame’ Virus explained: How it works and who’s behind it

How LSA Works with/without OSPF AREA 0 | Running OSPF without AREA 0 :Case Study

What is CEF- Cisco Express Forwarding: Load-Balancing with Static Routing

WiFi Protected Standard vulnerability – Cracked, Bruteforced and Documented

Chinese Hackers Trojan-ize US Access Card - The curious case of Sykipot Trojan

How to spread a Trojan Horse: Methods to spread Trojan Horse on Internet

Increasing Reliance Netconnect speed, Online Transaction failure and Customer Care woes

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

Hacking PHP 4.4 sites in 20 seconds

Advanced password hacking using Google – easy to learn, easy to apply

A Brief Introduction To Internet Threat DDOS

How China Do Social Networking Behind Firewall | INFOGRAPHIC

What is Pen-Testing? | Pen-Testing vs.Vulnerability Assessment | How Vulnerabilities Are Identified?

Chrome hacker wins $60,000 for finding 'full' exploit

Reset Ubuntu 11.10 Password

DnsChanger Trojan

Zero-day Smartphone Vulnerability exposes location and User Data

Millions of pcAnywhere users still Vulnerable to hijacking

Appnimi ZIP Password Unlocker

About Appnimi ZIP Password Unlocker

Features of Appnimi ZIP Password Unlocker

Using Appnimi ZIP Password Unlocker

Screenshot

Appnimi ZIP Password Unlocker

Rar Password Unlocker

About Appnimi RAR Password Unlocker

Features of Appnimi RAR Password Unlocker

Using Appnimi RAR Password Unlocker

Screenshot

Appnimi RAR Password Unlocker

Google Sites Directory

Google Sites and Services

Google Regions and Google Countries, Google in other Languages

American Samoa (http://www.google.as/)

Anguilla (http://www.google.off.ai/)

Antigua and Barbuda (http://www.google.com.ag/)

Argentina (http://www.google.com.ar/)

Australia (http://www.google.com.au/)

Austria (http://www.google.at/)

Azerbaijan (http://www.google.az/)

Belgium (http://www.google.be/)

Brazil (http://www.google.com.br/)

British Virgin Islands (http://www.google.vg/)

Burundi (http://www.google.bi/)

Canada (http://www.google.ca/)

Chad (http://www.google.td/)

Chile (http://www.google.cl/)

Colombia (http://www.google.com.co/)

Costa Rica (http://www.google.co.cr/)

Côte d'Ivoire (http://www.google.ci/)

Cuba (http://www.google.com.cu/)

Dem. Rep. of the Congo (http://www.google.cd/)

Denmark (http://www.google.dk/)

Djibouti (http://www.google.dj/)

Dominican Republic (http://www.google.com.do/)

Ecuador (http://www.google.com.ec/)

El Salvador (http://www.google.com.sv/)

Federated States of Micronesia (http://www.google.fm/)

Fiji (http://www.google.com.fj/)

Finland (http://www.google.fi/)

France (http://www.google.fr/)

The Gambia (http://www.google.gm/)

Georgia (http://www.google.ge/)

Germany (http://www.google.de/)

Gibraltar (http://www.google.com.gi/)

Greece (http://www.google.com.gr/)

Greenland (http://www.google.gl/)

Guernsey (http://www.google.gg/)

Honduras (http://www.google.hn/)

Hong Kong (http://www.google.com.hk/)

Hungary (http://www.google.co.hu/)

India (http://www.google.co.in/)

Ireland (http://www.google.ie/)

Isle of Man (http://www.google.co.im/)

Israel (http://www.google.co.il/)