Be a Geek

Lg knock codeport

2014-06-25T00:38:00.002-07:00

What if instead of launching applications using gestures, you’d like to use gestures to secure your device? LG offers such functionality through the Knock Code security system found on their newer handsets. But thanks to XDA Recognized Developer MohammadAG and the magic of Xposed Framework, you can use it on your device as well.

There are a few caveats with this implementation. For starters, rather than being able to enter your knock code while the device is off, you first have to power on your screen, after which you can input the code. In addition, the module is currently only compatible with Android 4.4, but compatibility will be added for 4.2 and 4.3 very soon. Finally, while using a knock code is fairly convenient, this is not a very secure method of locking your device. This is because due to a limitation in Xposed, the file where the code is stored is world-readable. Furthermore, this essentially functions as a 2×2 PIN password, which itself isn’t very difficult to break. If you wish to get Knock On-style functionality on your own device, head over to the module thread and give this a shot.

Run windows programs on linux

2014-06-22T02:32:00.000-07:00

Ubuntu is pretty neat ,but with windows software its even better!
Almost any windows software can be run on ubuntu using a software WINE.

Official website-http://www.winehq.org/
A nice set of instructions is already present on the web, here are some useful links-
http://www.wikihow.com/Install-Wine-on-Ubuntu
http://www.winehq.org/download/ubuntu

Most of the softwares work fine but there is a problem with .NET Framework.
I will post a solution soon.If u have any query related to it or anything else, Please do comment.

learn linux terminal

2014-06-21T22:04:00.002-07:00

I once heard an author say that when you are a child you use a computer by looking at the pictures. When you grow up, you learn to read and write.

Linux is a very powerful os but to unleash its full power , terminal use is a must.
I was just googling around and found a cool website t0 learn Linux terminal.
Here's the link - http://linuxcommand.org/lc3_learning_the_shell.php .Enjoy

Alleged Amazon smartphone to reportedly come with tilt gesture support

2014-04-26T10:22:00.003-07:00

Alleged Amazon smartphone to reportedly come with tilt gesture support

We have already seen the first alleged glimpse of Amazon's upcoming smartphone's prototype - one of the two rumoured devices that the online retail giant is said to have been working on for more than a year.Now, a new leak tips that the alleged Amazon smartphone, much like the company's Kindle tablet range, will run a highly customised Android OS and will also support tilt gestures for interacting with various apps.
BGR, citing some of its sources, claims that the alleged Amazon smartphone will make use of a combination of cameras, sensors and software for interacting with the device. Further, the report notes that the combination will make use of a number of 3D effects on the Amazon smartphone.
As reported earlier, the prototype high-end model of the rumoured Amazon smartphone is said to sport a total of six cameras: one at the rear, one at the top-front panel, while four are placed on four corners on the front. The report also suggested that the four camera units are low-power infrared cameras that would work with other sensors on the Amazon smartphone for the 3D effects on the screen.
BGR also claims that the Internet retailer will introduce new gesture controls on its first smartphone, such as tilt in different directions while the device is being used to display additional details on the display without even touching the screen.
The report further details some of the gesture functions in the yet-to-be-named Amazon smartphone, like if a user performs tilt gesture after searching a place in the maps app, Yelp ratings will appear for various results on the searched place's map.
Another tilt gesture function is said to be used in Amazon's video store, which is likely to show IMDb ratings on top of movie thumbnails.
In addition, apart from sensors and multiple gesture functions, the alleged Amazon smartphone is said to come with optical character recognition (OCR) and other technology which will automatically recognise text and convert it to a digital note if a user captures image of signs and other real-life objects with printed text using the device's primary rear camera.
An earlier leak had tipped that the e-commerce giant has been working with third-party developers to build apps for its 3D interface. Another report had suggested that Amazon has been preparing to launch its long-rumoured smartphone in the second half of the year, citing people briefed on the company's plans.

First Paid Fake Android Antivirus App Downloaded 10,000 times from Google Play Store

2014-04-12T09:23:00.001-07:00

First Paid Fake Android Antivirus App Downloaded 10,000 times from Google Play Store

Well, we all are very conscious, when it comes to the security of our personal information, security of our financial data and security of everything related to us. In the world of Smart devices where our Smartphones knows more than we know ourselves.

To keep our device protected from harmful viruses, malware or spyware, we totally depend on various security products such as antivirus, firewall and privacy guard apps, that we typically install from some trusted sources, Google Play Store. Most Antivirus apps are available to download for free, but some of them are paid with extra premium features like advance firewall protection, anti theft, App Locker or Cloud Backup etc.

But do you believe that just because you're downloading an application from an official app store and also if its a premium paid version, you're safe from malicious software? Think twice.

PAID, BUT FAKE ANTIVIRUS APP

In Past, Mobile Security Researchers had spotted numerous fake mobile antivirus scanners that were available for free download at Google's Play marketplace, but its the first time when a cyber criminals are offering a fake, but paid Antivirus Solution called ‘Virus Shield’ for your Android device at Google’s play store.

Virus Shield masquerade itself as an antivirus that claims to "protect you and your personal information from harmful viruses, malware, and spyware" and also "Improve the speed of your phone," which it does with just a click.

Moreover, it claims to have least effect on battery, run in the background, and in addition it also acts as adblock software that will stop those "pesky advertisements," which we deal every day.

MORE THAN $40,000 FRAUD AT GOOGLE PLAY STORE

Virus Shield antivirus app costs $3.99, and has been on the Google Play Store for just over a week and has already been successfully downloaded more than 10,000 times by Smartphones users with a 4.7 star review from 1,700 people, that means total amount received by developer is more than $40,000.

Even 2,607 users had hit the Google "recommend" button, which means that the antivirus app must be doing great to users who look for trusted and efficient antivirus app to secure their devices.

WHAT A SCANNER - VIRUS SHIELD

Surely it doesn't scan or detect anything. Android Police has discovered that the app only changes a red "X" graphic to a red "check" graphic, that’s it, nothing less or more.

The virus shield antivirus app is a total scam and it doesn't scan or secure your device, which means thousands of users have been scammed out of their money.

When the creator (email : Jesse_Carter@live.com) tracked down by the investigators, it revealed that the creator was a well known scammer who was also accused and banned from forums for trying to scam people out of various low-valued online game items.

You can check out the code for yourself from here, as the android police have decompiled the app and mirrored the java code on GitHub.

HOW TO PROTECT YOURSELF

There is no such way to protect you from these kinds of fraudsters. All you can do is report the Virus Shield via the Play Store app by listing the app’s "flag as inappropriate," then tap "other objection" and write about the app’s fraud to users. Alternatively, you can report it on the web. Users are advised to only download applications from known and trusted publishers

How to encrypt your files before uploading to Cloud Storage using CloudFogger

2014-04-12T09:18:00.000-07:00

How to encrypt your files before uploading to Cloud Storage using CloudFogger

In this Internet savvy generation, we want all of our data to be secured at some place. Having backups of your data is always a good idea, whether that data is stored in the Cloud or on your computer.

But everyone who is following the Edward Snowden leaks of the NSA's PRISM program now pushed to hardening their Mobile devices and computers for security, privacy, and anonymity.

There are many Free Cloud storage providers including Google Drive, Dropbox, Box, RapidShare, Amazon Cloud Drive, Microsoft SkyDrive and many more. These services have a limitation that all data is unencrypted, or even if it is encrypted, the encryption keys are still generated by the company's software, meaning the company still has an access to your data.

So as an end user, we must think about the security and privacy of our data. We should first encrypt our files on the system level and then upload a copy of it on the cloud storage.

For this a robust and highly user friendly tool called CloudFogger is available at free of cost and for using it you even need not to be a GEEK. It provides encryption of 256 bit AES for your files.

Easy to Install and Easy to use: Follow the steps to crypt your files using CloudFogger:

Step-1: Download and Install CloudFogger from its website. Open and create an account first:

Step-2: Select the folder you are using for syncing with cloud storage (Google Drive, Sky Drive, and Dropox etc.)

Step-3: Now you just need to drop your files into that folder. A Small Green overlay-symbol will appear on your files, i.e. Your files are now encrypted and ready to upload/sync with your Cloud storage account. That's it!

The New file extension for all encrypted files will be ".cfog", that can be accessed only if decrypted using your own CloudFogger keys.

You can also encrypt documents manually, just by right clicking it, select cloudfogger->Fogg file(s) and you can access the file yourself using a virtual drive created by cloudfogger without decrypting each file.

This client-side encryption ensures that nobody will be able to access your protected documents and files without your password. RSA private keys are stored on the Cloudfogger server to allow convenient installation of the product on several devices, but all keys are again encrypted with 256 bit AES based on the user's password and the company claims that user passwords will be never ever transmitted to their Cloudfogger servers.

Each file uses its own, unique AES key, that allows sharing files with different people, so you can add the email addresses of your friends, if you want them to allow decrypt your private document, image or etc.

For most users, finding a truly protected Cloud service can be a challenge, as many services obviously have security gaps that leave data wide open to third party attacks, leaks, or hacking.

CloudFogger is an application available for Windows, Mac, Andoird, iOS. There are many more similar tools and services that are available i.e. SpiderOak, Mozy, Carbonite, IDrive or BoxCryptor and many more.

However, CloudFogger is not an open source software, so there is an alternate available called "CryptSync", which is an open source tool for encrypting the files before uploading to cloud server and it also does not store your files on the developer’s server like CloudFogger.

This way, even if programs like NSA's PRISM continue to stand unchallenged, people can rest easy knowing that their data is truly protected.

'123456' giving tough competition to 'password' in Worst 25 Passwords of 2013

2014-04-12T09:16:00.000-07:00

'123456' giving tough competition to 'password' in Worst 25 Passwords of 2013

123456, password, 12345678, qwerty… or abc123, How many of you have your password one of these??? I think quite a many of you.

Even after countless warnings and advices given to the users by many security researchers, people are continuously using a weak strength of password chains.

After observing many cyber attacks in 2013, we have seen many incidents where an attacker can predict or brute-force your passwords very easily.

From 2012, the only change till now is that the string “password” has shifted to the second place in a list of the most commonly used passphrases and string “123456” has taken the first place recently, according to an annual "Worst Passwords" report released by SplashData, a password management software company

They announced the annual list of 25 most common passwords i.e. Obviously the worst password that found on the Internet. The Most common lists of the passwords this year are "qwerty," "abc123," "111111," and "iloveyou", which are really easily guessable.

"Another interesting aspect of this year's list is that most short numerical passwords showed up even though websites are starting to enforce stronger password policies," says Morgan Slain, CEO of SplashData.

Below are the worst passwords list of 2013 with Rank and showing the comparison of it from 2012:

If you are also using one of these passwords or other dictionary words, then you are advised to change it as soon as possible. We further advise you to use different passwords for different accounts, as if one of your account gets hacked, you’ll be totally ruined.

The above list of passwords was compiled from data dumps of stolen passwords posted online, and the firm says it was especially influenced by the millions of Adobe accounts that were compromised in the fall.

Fact & figure

Stricture Consulting Group attempted to decrypt the leaked Adobe passwords and released an estimate that almost 2 million of the more than 130 million users affected by the breach appeared to be using "123456" as a password.

Now when you talk about various security measures to protect your privacy and data, installing an Antivirus doesn’t mean that here your work gets over and you are safe enough. “God helps those who help themselves” likewise nobody can secure your privacy unless and until you yourself not willing to.

Here I have listed some useful tips to make your password strength secure and easier to remember:

Use a combination of lowercase, uppercase, numbers, and special characters of 8 characters long or more like s9%w^8@t$i
Use short passphrases with special characters separating to make it difficult for crackers and could be easily remembered like cry%like@me (cry like me)
Avoid using the same combination of passwords for different websites
If it is difficult for you to remember different passwords for different websites and accounts than try using Password manager applications like RoboForm, 1Password, LastPass.

STAY SECURE, STAY SAFE!

Learn to Encrypt Your Emails against an invasion of privacy by NSA

2014-04-12T09:14:00.003-07:00

Learn to Encrypt Your Emails against an invasion of privacy by NSA

Now that we have enough details about how the NSA's Surveillance program, running for a long time against almost each country of this planet.

Hundreds of top-secret NSA documents provided by whistleblower Edward Snowden already exposed that Spying projects like PRISM and MUSCULAR are tapping directly into Google and Yahoo internal networks to access our Emails. NSA's tactics are even capable to defeat the SSL encryption, so unsecured email can easily be monitored and even altered as it travels through the Internet.

One major point on which all of us are worrying is about the privacy of communication among each other and If you're looking for a little personal privacy in your communications you will need to encrypt your messages.

To avoid privacy breaches; rather I should say to make it more difficult for the NSA or British GCHQ surveillance program to read our communication, we should use PGP encryption (Pretty Good Privacy).

Why we should Encrypt our Emails? Each public mail service provider sends information from sender to recipient like a postcard which has a recipient’s address and the content to be conveyed; and is open to the medium used for sending the card. Encryption is an envelope of the content of the document to be sent and leave the recipient’s address open so that it can reach to the destination. So by encrypting your mail, even if any mail service provider is keeping a record of all mails, you need not to worry that your document is being read by third person neither by NSA people.

Encrypting your email may sound daunting, but it's actually quite simple. We are going to use something called GNU Privacy Guard (GnuPG) or Gpg4win (Windows).

Installation

Step 1: Download the Gpg4win on windows machine and install it.

Step 2: Go ahead and after successful installation, close the window.

Generating your PGP pair key:

Step 3: Now open Kleopatra tool (A GUI GPG Key Manager) to create a new asymmetric key pair (public & private). Click on File -> New Certificate.

Step 4: In the key generation wizard, click on "Create a personal OpenPGP key pair" and in the next window enter your basic details:

Step 5: In the next window, once review your details and click "Create Key". It will prompt you for entering a passphrase. Set a strong password and confirm it once again in the next window.

Step 6: Within a few seconds (depending on your system speed), Your Key pair will be generated (as shown).

Step 7: You should "Make a backup of your file pair" somewhere safe. You can also export the public key to the public directory by clicking on the Upload Certificate to Directory Service.

Step 8: Once done, the key manager main interface will show your certificate as shown:

Step 9: Select your newly generated certificate -> Right click -> click on Export Certificates to save your Public keys on the desktop.

You will have to exchange your public keys with whom you want to make secure communication via mails. Many people post their public keys to their personal websites. You can send it as attachments to everyone you email, just so they have them.

Once your friends will have your Public keys, they can import it Kleoptra software via 'Import Certification' option from the menu.

Composing an encrypted email:

Step 1: Open Outlook -> Compose a new mail and write the recipient’s address, Subject and your message.

Note: You should already have your email ID configured over Outlook software on windows machine and if your Outlook doesn't have OpenPGP, then you can install 'Outlook Privacy Plugin' to enable it.

Step 2: Under GpgOL menu (as shown), click on 'Encrypt'. The software will automatically import the public keys of the recipient from the Key Manager (only if exists or imported before).

Step 3: If you also want to attach some files to this encrypted email, then under GpgOL menu, click Encrypted File and select the file to be attached and SEND mail.

When you or the recipient will receive the encrypted mail, one should first decrypt it using private keys.

Step 4: Under GpgOL menu, click on 'Decrypt' to convert the email into readable form. To proceed, It will ask for the secret passphrase entered at the time of creation of key pair.

That's it! Other than Outlook you can also use various desktop email clients (Thunderbird or Postbox) or web mail, that also support PGP encryption. You can import your key pair to other software also in order to manage the same account.

Introducing New Samsung Galaxy Tab Note 10.1

2014-04-12T09:09:00.003-07:00

Introducing New Samsung Galaxy Tab Note 10.1

Samsung Galaxy Tab 10.1

Samsung introduce new 10.1 inch Tablet with S pen specific features. This tablet support Android 4.0 Ice Cream sandwich OS. and its running on 1.4 GHz dual-core CPU with 1GB RAM. Both side Camera with 3 MGpx rear front facing camera and 2 MGpx at backside on this Tab. This tablet has specially design for creative designers, students and for business professionals purpose.In this Tab Adobe Photoshop and Adobe Ideas apps are pre installed.
and it will be coming in 16GB, 32GB, 64 GB versions with a micro SD card slot capable of accepting another 32GB worth of space. ..

Features:

Resolution 10.1 inch (1280*800) WXGA
1.4dual core CPU
1Gb RAM
Wifi
Bluetooth 3.0

Press Release:

Boost your Creativity and Productivity with GALAXY Note 10.1

A new device category, GALAXY Note 10.1 comes with an immersive 10.1'' screen and

S Pen versatility to unlock your creativity and productivity

Barcelona, February 27, 2012 – At Mobile World Congress, Samsung announced the launch of GALAXY Note 10.1, which expands the GALAXY Note experience in creativity, productivity, and learning.

With its large display, GALAXY Note 10.1 provides multi-screen functionality to maximize efficiency in learning, work and creative endeavors. Its multi-screen functionality enables you to do a true multi-tasking, by viewing Internet pages, videos or other applications side by side while writing or sketching your ideas.

GALAXY Note 10.1 features S Note, a unique and efficient tool that lets you combine notes or sketches together with web content, images and other digital media into your own personalized storyboards. It gives you a new way to create stories as S Note provides various ready-to-use templates such as meeting minutes, recipe, cards, diary, magazine and more. Also, hand-drawn geometric shapes can be perfectly digitized by using the Shape Match function, which helps users to create more organized idea sketches and storyboards.

Moreover, by using the S Note's integrated knowledge search engines, users can quickly search, obtain information, and easily drag & drop the cropped images and content onto S Notes without having to switch between screens.

GALAXY Note 10.1 enables an extraordinary learning experience. Students can watch a lecture live-streamed on video while writing down comments on S Note; research a college essay on the web while taking notes; or even read a full e-textbook while annotating it. Similar to the Shape Match, Formula Match function helps to correct and digitize formulas hand-drawn with S Pen, making the device a more powerful education tool.

Users can fully enjoy PC-like premium photo editing and drawing experiences with Adobe® Photoshop® Touch and Adobe Ideas. Photoshop Touch lets users transform images with core Photoshop features and combine multiple photos into layered images, make popular edits, apply professional effects, and more. Adobe Ideas is an easy-to-master drawing tool that allows users to sketch ideas, choose amazing color themes and import images. Both are specially optimized for S pen and are exclusively pre-loaded on Samsung GALAXY Note 10.1.

"GALAXY Note 10.1 takes productivity on a Note to a whole new level. With a larger, fully utilizable screen and superior performance, it combines the intuitiveness of handwriting with all the versatility of digital content to let users be more productive across all of life's demanding tasks-whether working, learning, or simply creating their own stories," said JK Shin, President of IT & Mobile Communications Division at Samsung Electronics. "With GALAXY Note 10.1 we are demonstrating Samsung's commitment to extend the mobile category and are working with key partners like Adobe to provide extraordinary experiences for users that enable them to be more productive, express themselves creatively and add a touch of fulfillment to their lives."

Ensuring intuitive multitasking and web browsing, GALAXY Note 10.1 runs on AndroidTM 4.0 (Ice Cream Sandwich) and features a 1.4GHz dual-core processor and HSPA+ connectivity. Its real-time video streaming and Full HD video playback add to the device's content versatility.

GALAXY Note 10.1's innovative S Pen, the most advanced pen input solution on the market, is completely integrated into the device's original applications. It provides enhanced pressure sensitivity, superior accuracy and control when editing or writing, providing an analog pen writing experience on a digital device.

The GALAXY Note 10.1 is exhibited at Samsung stand (Hall 8), Mobile World

Google Chrome 35.0.1912.2 Dev And Firefox 29.0 Beta 3 Updated

2014-04-12T09:07:00.005-07:00

Google Chrome 35.0.1912.2 Dev And Firefox 29.0 Beta 3 Updated

Google Chrome 35.0.1912.2 Dev And Firefox 29.0 Beta 3 Updated. New Firefox change their graphics and updates with speed. Both browser has fixed their bugs with new updates to get fast and free browsing.

Firefox 29.0 Beta 3
Filename: Firefox Setup 29.0b3.exe
File size: 28.82MB (30,218,912 bytes)
Requirements: Windows 2000 / XP / Vista / Windows7 / XP64 / Vista64 / Windows7 64 / Windows8 / Windows8 64
Languages: en-US
License: Open Source
Download available

Google Chrome 35.0.1912.2 Dev Beta
Filename: 35.0.1912.2_chrome_installer.exe
File size: 31KB (32,097 bytes)
Requirements: Windows XP / Vista / Windows7 / XP64 / Vista64 / Windows7 64 / Windows8 / Windows8 64
Languages: Multiple languages
License: Open Source
You can also download Chrome for OSX and Linux too.
Download available

Twitter Gets Banned In Turkey

2014-04-12T09:06:00.002-07:00

Twitter Gets Banned In Turkey

Twitter Gets Banned In Turkey. Twitter Blocked In Turkey due to leak post against Turkish Government. As well as Iran, Egypt, China already blocked twitter due to privacy policy. Twitter have 200 million active users.

According to Dailydot, Turkish journalist Erdem Arda Gunes explained how the ban was implemented to the Daily Dot. “The ban started after midnight and got into effect gradually depending which internet providers they used, but it's a court order (actually four different courts) which means every provider, including GSM companies, are obliged to implement this ban.

But still Turkey user can send tweet from Sms service, Avea and Vodafone users can text START to 2444 and Turkcell subscribers can text START to 2555, also use twitter with proxies, Vpn and SMS services.

Apple iRing The Bluetooth Ring Concept

2014-04-12T09:02:00.005-07:00

Apple iRing The Bluetooth Ring Concept

This Gadget is unique because its has great concept of Bluetooth ring which has designed by Victor Solo. This ring connectivity with wireless bluetooth of your ipad and iphone. After connected you can play songs, volume control up and down, skip music, and with play and pause function controls on the ring. iRing features as a touch sensitive functions strip.

The below image show that how its will look on finger

Bypass Victim Smartphone Through Viber App

2014-04-12T08:59:00.002-07:00

Bypass Victim Smartphone Through Viber App

Bypass Smartphone Lock Screen Through Viber App:

First send viber message to victim
Victim get viber message popups do some action on it.
Then send another message to victim mobile.
Victim mobile again get popup. Press back button of victim mobile.
Now you get a full access of victim phone.

Introducing New JARVIS Operating System

2014-04-12T08:57:00.005-07:00

Introducing New JARVIS Operating System

Jarvis v0.1 (Artificial Intelligence based Operating System). Indian Cyber Security researchers has designed JARVIS. HOC talked with one of the developer named Chiragh Dewan, 18 year old, who is pursuing BCA. Its totally different from other OS because its function can be control by voice.

1) Introduction on Jarvis OS

Jarvis is different, because it can interact with its users using voice and gestures. It’s also a server which can be accessed by many clients (we call them nodes), so basically it's a new concept, one which is new and better than anything available in the market.

2) Introduce Developer & Their Team
Himanshu Vaishnav and Chiragh dewan originally founded this project. We were driven by our passion about bringing Jarvis to life. We designed the system Together. This project is output of our combined efforts and our individual knowledge.

Our team consist of 7 members both founders [Chiragh & Himanshu], Vikas [AIML], Vinmay [API], Sravan [UI], Mayur [Programming].

3) Aim to make Jarvis OS
To make a new product, a new technology with a fresh approach to the technology. Our motto is making Jarvis a companion to its user, we are making a life Automation system.

4) Features of Jarvis OS
Jarvis interact with humans with voice, gestures, sensors, and behavior. It will automate it's user's life with its capabilities of learning from usage and use previous data to generate new facts.

5) How much time is remaining to launch Jarvis OS?
We are at working hard to finish the first public version, world will know when we will launch.

6) Jarvis OS is Free or Paid?
Haven’t decided yet!!!

Researchers Get $10,000 for Hacking Google Server with Malicious XML

2014-04-12T08:56:00.001-07:00

Researchers Get $10,000 for Hacking Google Server with Malicious XML

A critical vulnerability has been uncovered in Google that could allow an attacker to access the internal files of Google’s production servers. Sounds ridiculous but has been proven by the security researchers from Detectify.

The vulnerability resides in the Toolbar Button Gallery (as shown). The team of researchers found a loophole after they noticed that Google Toolbar Button Gallery allows users to customize their toolbars with new buttons. So, for the developers, it is easy to create their own buttons by uploading XML files containing metadata for styling and other such properties.

This feature of Google search engine is vulnerable to XML External Entity (XXE). It is an XML injection that allows an attacker to force a badly configured XML parser to "include" or "load" unwanted functionality that can compromise the security of a web application.

“The root cause of XXE vulnerabilities is naive XML parsers that blindly interpret the DTD of the user supplied XML documents. By doing so, you risk having your parser doing a bunch of nasty things. Some issues include: local file access, SSRF and remote file includes, Denial of Service and possible remote code execution. If you want to know how to patch these issues, check out the OWASP page on how to secure XML parsers in various languages and platforms," the researchers wrote on a blog post.

Using the same, the researchers crafted their own button containing fishy XML entities. By sending it, they gain access to internal files stored in one of Google's production servers and managed to read the “/etc/passwd” and the “/etc/hosts” files from the server.

By exploiting the same vulnerability the researchers said they could have access any other file on their server, or could have gain access to their internal systems through the SSRF exploitation.

The researchers straight away reported the vulnerability to the Google’s security team and rewarded with $10,000 (€7,200) bounty for identifying an XML External Entity (XXE) vulnerability in one of the search engine’s features.

Flappy Bird Developer Has Removed Game From App Stores

2014-04-12T08:54:00.003-07:00

Flappy Bird Developer Has Removed Game From App Stores

Flappy Bird Developer Has Removed Game From the App Stores. The Vietnam based developer Dong Ngyen was created the game Flappy Bird in iOS and Android app platforms. According to BBC, He created the game in just two to three days, was making as much as $50,000 (£30,482) a day from the game's advertising revenue.

The game, which was released on May 24, 2013, was removed from both Apple's App Store and Google Play by its creator on February 10, 2014. On February 8, 2014, Nguyen announced on Twitter.
Also he said that taking down the game has "nothing to do with legal issues". On February 9, 2014, almost exactly 22 hours after this announcement, the game was removed from both Apple's App Store and Google Play.

Flappy Bird is a side-scrolling mobile game featuring 2D retro style graphics. The objective is to direct a flying bird, which moves continuously to the right, between each oncoming set of pipes without colliding with them, which otherwise ends the game. The bird briefly flaps upward each time the player taps the screen, and the player is scored on the number of pipe sets the bird successfully passes through.

How To Identify Fake Facebook Profiles

2014-04-12T08:51:00.000-07:00

How To Identify Fake Facebook Profiles

How can you detect the Fake FB Profile. On these days we are getting so many friend request specially by girls, but there is no way to identify that account is fake or original. So don't worry we are going to tell you simple method to detect fake Facebook account.

So this is a Facebook account which named by Sarikha Agarwal. Now we need to verify this account real or fake, so our first step is going to the images.google.com and click on camera image.

So when you click on search by image you will get popup like below image.

Now go to that profile, right click on image and click on copy image URL

now profile pic URL has copied.. now again go to images.google.com Tab and paste image URL

When you enter then you get related images search...

Now you can better see that this profile is real or fake..So here is a proof that this profile is fake. Enjoy the trick..

Be aware when you will going to add an beautiful or smart unknown person as your friend. So be checked first.. there are lot of fake profiles made everyday. This person might be spy on your profile and steal personal information like your photos, etc for their hacking stuffs.. So Be Safe Online..

Forensic Memory Analysis And Techniques For Windows, Linux And Mac OS

2014-04-12T08:50:00.000-07:00

Forensic Memory Analysis And Techniques For Windows, Linux And Mac OS

ABSTRACT
Due to the increased number of cases of cyber-crimes and intrusions, along with the storage capacity of hard disks and devices, it was necessary to extend the techniques of computer forensics, currently works consist in collection and analysis of static data stored hard drives, seeking to acquire evidence related to the occurrence of malicious activities in computer systems after its occurrence.
With the evolution of technological resources and the popularity of the Internet, it has become impractical to maintain only the traditional approach, due to the large volume of information to be analyzed and the growth of digital attacks. In this context, the analysis of data stored in volatile memory comes up with new techniques, it is necessary to check the processes that were running, established connections, or even access keys encrypted volumes, without causing the loss of sensitive information to the investigation, thus allowing the recovery of important data to the computer forensics.

Concept
Memory forensics is a promising technique that involves the process of capturing and analyzing data stored in volatile memory. Since, by volatile memory, which means that data can be lost on system shutdown, or can be rewritten in the normal functioning of the same. This characteristic of constant flux, the data in memory are usually less structured and predictable.

Data contained in the memory
The overview of the information stored in memory, everything is running on a computer is stored temporarily in memory, either in volatile memory, the paging file is related to virtual memory. By extracting an image of memory known as 'dump' memory is possible to identify the relationship of the running processes, it is possible to establish a relationship between the processes in order to identify which processes have started other processes, likewise, is feasible to identify which files, libraries, registry keys and sockets that were in use by each process. In summary, it is possible to map how the system was being used when generating the 'dump' memory and also recover executable programs stored in memory.

More information about “Dumps”
This is the method currently used by the experts in computer forensics to acquire the contents of RAM.
There are several programs that help the image acquisition memory system, this work. These tools make reading memory bit-by-bit and copy its contents to a file, the "dump" of memory. This file will have the same physical memory size of the system.
What should be taken into account, regardless of the tool being used, is that, as shown by the "Locard Exchange Principle", when an acquisition program dump is executed, it must be loaded into memory, meaning it will traces, and that some of the memory space that could contain valuable information will be used, and can even lead to changes in the area occupied by processes to paging files. Furthermore, while the tool is reading the contents of the memory, the status of the system is not frozen, which means that while some pages are being copied, and others may be changed if the process is that use is still running, for example. What will define the time spent to collect the image are factors such as processor speed, bus fees and operations in and out of the disc.

Creating "Forensic Image" with FTK Imager

INTRODUCTION
FTK Imager is a free tool provided by Access to Data acquiring forensic images. The tool allows you to create, mainly disk images…Besides creating forensic disk images, we can perform memory dumps and even perform a forensic analysis on the small image created. There are many other fucionalidades you will discover when you are working with it. The FTK Imager was created by the company AccessData and is free.

STEP TO STEP
Well, I'm looking for a simple and practical way to demonstrate these concepts. Let's click on the "File" menu and click the "Create Disk Image" and choose which disk or partition, or we will make the image. To choose the option to perform a forensic image of the disc, we will on the "Physical Drive”, if we want to make the image of a partition, let the option "Logical Drive". Look the pictures below:

Figure 1) FTK Imager.

Figure 2) Logical Drive.

Figure 3) Physical Drive.

Then I'll do the forensic image of a USB stick plugged into my machine, and also choose the option "Physical Drive ". Can I choose which device I want to make the image and then I click on the "Finish" button.

Figure 4) Select Drive.

Now click on "checkbox Verify images after area They created". With this option selected, the tool will calculate the "hash" MD5 and SHA1 image created after that, click the "ADD" button.

Figure 5) Create Image.

Let's select "RAW", to perform forensic image format which is the tool of "DD" and click "Next".

Figure 6) Select RAW.

Will request some information on evidência. We can fill these information . After that, click on "Next".

Figure 7) Evidence Item Information.

Figure 8) Select Image Destination.

We will choose the output directory (where the forensic image is saved). "Image Filename" is where you must enter the filename of my image. In the "Image Fragment Size" I can put zero because I do not want my fragmented image. If I wanted to break into pieces, I put this field size in MB that every piece of my image would have. After that , just click on the "Finish" button.

Figure 9) The output directory.

Just click on the "Start" button.

Figure 10) Create Image.

Figure 11) Image Sumary.

When the process of image acquisition forensics has finished , we can display a summary with various information.
In the same directory where the image was stored was created a “txt”, which is like a log , which has the same summary information.

Extraction of digital artifacts with Volatility:
INTRODUCTION
Volatility is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of samples of digital artifacts from volatile memory (RAM).

STEP TO STEP
The tool supports a variety of formats "dump", performs some automatic conversion between formats and can be used on any platform that supports Python. Installation and use are simple, simply unzip the package supplied by Systems Volatility in a system where Python already installed.
C:\Volatility>python volatility

Figure 1) Supported Internel Comands.
Example: volatility pslist -f /path/to/my/file

Figure 2) Use the command volatility
The image 3 shows the use of the command "ident", which can be used to identify the date and time the image was collected, as well as providing information about the operating system on which the dump was generated:
C:\Volatility>python volatility ident –f C:\memorytest_rafael_fontes.dmp

Figure 3) Command ident.
You can use the --help option with any command to get help:
C:\Volatility>python volatility ident –-help

Figure 4) Option Volatility help tool.

To list the processes that were running at the time it was generated dump can use the "pslist." As can be seen below, the output will contain the name of the process, its identifier (Pid) and father process ID (PPID) beyond the time when it was started and other useful information.
C:\Volatility>python volatility pslist –f C:\memorytest_rafael_fontes.dmp

Figure 5) Use the command pslist.

The "connscan" provides information about the network connections that were active at the time the data were collected memory. Already the "sockets" displays the open sockets at the time the dump was generated. The command "files" displays open files for each process. You can specify the case number on the command line to display only those files opened by a particular process.
C:\Volatility>python volatility files –p 1740 –f C:\ memorytest_rafael_fontes.dmp

Figure 6) Use the command files.

The command "dlllist" displays a list of DLLs loaded for each process, and the command "regobjkeys" displays a list of registry keys opened by each process.
C:\Volatility>python volatility dlllist –p 1740 –f C:\memorytest_rafael_fontes.dmp

Figure 7) Use the command dlllist
C:\Volatility>python volatility regobjkeys –p 1740 –f C:\memorytest_rafael_fontes.dmp

Figure 8) Use the command regobjkeys.

It is possible, through command "procdump" extracting executable from the dump of memory, allowing access to the code that was running on the machine, and thus better understand their behavior.
C:\Volatility>python volatility procdump –p 1740 –f C:\ memorytest_rafael_fontes.dmp

Add caption

Figure 9) Use the command procdump.
It was possible to observe the generation of executable "executable.1740.exe" and the occurrence of informational messages like "Memory Not Accesible" after using the command "ProcDump". This is because not all the virtual memory addresses are accessible on the image because it may have been, for example, paged to disk. Thus, these messages provide an audit log so that you can determine which parts of the executable generated were successfully retrieved.

Practical examples,to determine the date and time of the image, for example, one can use the following command:
>>> Python volatility datetime -f target-2013-10-10.img
    Image Local date and time: Mon Oct 10 16:20:12 2013
The command pslist, in turn, determines the procedures that were running at the time the image was captured:

>>> Python volatility pslist -f target-2013-10-10.img
Name Pid PPID THDs HNDs Time
lsass.exe 536 480 20 369 Mon Oct 10 16:22:18 2013
To determine which system ports were open, one can employ the command "socks". For the system under analysis, it is possible to detect, for example, the process LSASS.exe listening on port 4500.
>>> Python volatility sockets -f target-2013-10-10.img

Forensic Memory for Linux distributions:

S.M.A.R.T Linux http://smartlinux.sourceforge.net/

Figure 1) S.M.AR.T. Linux.
S.M.A.R.T. Linux is a bootable floppy distribution containing tool (smartmontools) for monitoring IDE/SCSI hard disks (using Self-Monitoring, Analysis and Reporting Technology). Why floppy? Probably because all other distributions containing this useful utility are CD versions [and not everybody has a CD-ROM ;)]. It's going to be free, small, helpful and easy to use. Current version is based on Kernel 2.4.26, uClibc 0.9.24 and BusyBox 1.00 official release. Built on Slackware 10.0.

The Sleuth Kit and Autopsy: http://www.sleuthkit.org/

Autopsy™ and The Sleuth Kit™ are open source digital investigation tools (a.k.a. digital forensic tools) that run on Windows, Linux, OS X, and other Unix systems. They can be used to analyze disk images and perform in-depth analysis of file systems (such as NTFS, FAT, HFS+, Ext3, and UFS) and several volume system types.

CAINE (Computer Aided Investigative Environment)
http://www.caine-live.net/

Figure 4) C.A.I.N.E.
CAINE(Italian GNU/Linux live distribution created as a project of Digital Forensics) offers a complete forensic environment that is organized to integrate existing software tools as software modules and to provide a friendly graphical interface.
The main design objectives that CAINE aims to guarantee are the following:
• An interoperable environment that supports the digital investigator during the four phases of the digital investigation.
• A user friendly graphical interface.
• A semi-automated compilation of the final report.

For MAC OS X
Below are some tools that can be used for forensic analysis on computers with Mac OS X.

Mac OS X Forensics Imager
http://www.appleexaminer.com/Utils/Downloads.html

Figure 1) Mac OS X Forensics Imager.
Tool for imaging disk byte by byte format Encase or FTK for later forensic analysis in these tools.

Metadata Extractor
Application to extract meta-data files for a specific folder in Mac Displays location on google maps in case there are geo-location information in the file.

File Juicer
http://echoone.com/filejuicer/

Figure 2) File Juicer 1.

Figure 3) File Juicer 2.

Commercial software that enables the extraction of images and texts from any file. Ignores format, and scans files byte by byte for identifying the data supported. Among other features, there are the following, which find application in forensic analysis:

•   Extract images from PowerPoint presentations and PDFs
•   Recover deleted pictures and videos from memory cards
•   Recover text from corrupt
•   Extract images and html files from the cache of Safari
•   Extract attachments from email archives
•   Generate Word document from simple PDFs
•   Recover photos from iPods in TIFF
•   Convert ZIP files which are in. EXE
•   Extract JPEG images in RAW format (Canon & Nikon)
•   Extracting data from different types of cache file
•   Find and extract file in general data in JPEG, JP2, PNG, GIF, PDF, BMP, WMF, EMF, PICT, TIFF, Flash, Zip, HTML, WAV, MP3, AVI, MOV, MPG, WMV, MP4, AU, AIFF or text.

CONCLUSION
There are several trends that are revolutionizing the Forensic Memory. The process to do the analysis in memory forensics also walks for a better solution and refinement of the technique, it is an approach increasingly relevant in the context of Computer Forensics. In certain cases the popularity and use of tools for encrypting volumes as TrueCrypt, or creating malware residing only in volatile memory, raise the difficulty of analyzing the data stored in these devices.
However, it is interesting to note that the Forensic Memory is best seen as a complement to other approaches. An example of this is the procedure in which an investigation after the image capture of volatile memory, it uses the "Analysis of Living Systems" as a way to determine the next step in solving the case. Later, in the laboratory, we use the "Memory Forensics" as a complement to traditional forensics, giving greater agility and precision to the process.
I hope my article has helped computational experts and specialists in information security.

2014-04-10T10:11:00.001-07:00

ARPwner – ARP & DNS Poisoning Attack Tool

ARPwner is a tool to do ARP poisoning and DNS poisoning attacks, with a simple GUI and
a plugin system to do filtering of the information gathered, also has a implementation of SSLstrip and is coded in python.

Download

winAUTOPWN v3.0 Released - System vulnerability exploitation

2014-04-10T10:10:00.001-07:00

winAUTOPWN v3.0 Released - System vulnerability exploitation
Framework

WINAUTOPWN ACTIVE SYSTEMS TRANSGRESSOR GUI [ C4 - WAST ] is a Systems and Network Exploitation Framework built on the famous winAUTOPWN as a backend.
C4 - WAST gives users the freedom to select individual exploits and use them.
BSDAUTOPWN has been compiled, like always for various flavours and has been upgraded to version 1.8 alongwith all applicable exploits
WINAUTOPWN requires PERL,PHP,PYTHON,RUBY and its dependencies alongwith a few others' too for smooth working of exploits included in it.

Download

Intercepter Sniffer

2014-04-10T10:08:00.001-07:00

Intercepter Sniffer

Intercepter is a sniffer tool which offers various capabilities including sniffing for password hashes related to ICQ/IRC/AIM/FTP/IMAP/POP3/SMTP/LDAP/BNC/SOCKS/HTTP/
WWW/NNTP/CVS/TELNET/MRA/DC++/VNC/MYSQL and ORACLE. It also sniffs ICQ/
AIM/JABBER/YAHOO/MSN/GADU-GADU/IRC and MRA protocols. It has a built-in arp poisoning module, can change MAC addresses of LAN adapters, and has various other interesting functionality.

Download

The Mole: Automatic SQL Injection Exploitation Tool

2014-04-10T10:07:00.003-07:00

The Mole: Automatic SQL Injection Exploitation Tool

Mole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a Boolean query based technique. The Mole uses a command based interface, allowing the user to indicate the action he wants to perform easily.
Read more

Download

Havij v1.15 Advanced SQL Injection

2014-04-10T10:06:00.005-07:00

Havij v1.15 Advanced SQL Injection

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

Download

Sqlninja 0.2.6

2014-04-10T10:06:00.001-07:00

Sqlninja 0.2.6

Features:
>> Fingerprint of the remote SQL Server (version, user performing the queries, user privileges, xp_cmdshell availability, DB authentication mode)
>> Bruteforce of 'sa' password (in 2 flavors: dictionary-based and incremental).
>> Creation of a custom xp_cmdshell if the original one has been removed
>> Upload of netcat (or any other executable) using only normal HTTP requests (no FTP/TFTP needed).
>> TCP/UDP portscan from the target SQL Server to the attacking machine, in order
to find a port that is allowed by the firewall of the target network
and use it for a reverse shell.
>> Direct and reverse bindshell, both TCP and UDP
>> ICMP-tunneled shell, when no TCP/UDP ports are available for a direct/reverse
shell but the DB can ping your box. >> DNS-tunneled pseudo-shell, when no TCP/UDP ports are available for
a direct/reverse shell, but the DB server can resolve external hostnames
(check the documentation for details about how this works). >> Evasion techniques to confuse a few IDS/IPS/WAF.
>> Integration with Metasploit3, to obtain a graphical access to the remote DB
server through a VNC server injection.
Download

Ani-Shell

2014-04-10T10:05:00.004-07:00

Ani-Shell

Ani-Shell is a simple PHP shell with some unique features like Mass Mailer , A simple Web-Server Fuzzer , DDoser, Back Connect , Bind Shell etc etc ! This shell has immense capabilities and have been written with some coding standards in mind for better editing and customization.

Customisation
1. Email Trace back is set to Off as default and emails will not be sent , If you are setting
this feature on make sure you change the default email address (lionaneesh@gmail.com)
to Your email address , Please Change it before using.
2. Username and Passwords are set to lionaneesh and lionaneesh respectively , Please change them for better
security.
3. As a default Lock Mode is set to on! This should not be change unless you want your shell exposed.

Default Login
Username : lionaneesh
Password : lionaneesh

Features
    Shell
    Platform Independent
    Mass - Mailer
    Small Web-Server Fuzzer
    DDoser
    Design
    Secure Login
    Deletion of Files
    Bind Shell
    Back Connect
    Fixed Some Coding errors!
    Rename Files
    Encoded Title
    Traceback (Email Alerts)
    PHP Evaluate
    Better Command Execution (even supports older version of PHP)
    Mass Code Injector (Appender and Overwriter)
    Lock Mode Customization

Latest Version Addition
    Mail Bomber (With Less Spam detection feature)
    PHP Decoder
    Better Uploader
    Fixed some Coding errors

Download