How to Regain Access to your Hacked Facebook Account Easily

Step 1

Visit http://www.facebook.com/hacked.

Step 2

Click My Account Is Compromised as shown in below screenshot

Step 3

Now enter your Email,Phone Or Username and Click on Search

And now identify your account & now click on continue without entering the password and then you will be redirected to another page as show in Step 4.

Step 4

Now choose your option to reset your password....

Read More...

How to Hide a folder without any third party Software

To Hide:
Rename any folder with extension

{645FF040-5081-101B-9F08-00AA002F954E}

For eg,
If u’ve a folder with name “abc”
press F2,
then type,

abc.{645FF040-5081-101B-9F08-00AA002F954E}

and Press Enter.

To get back to its original form :
Make a new batch file with any name and type

ren abc.{645FF040-5081-101B-9F08-00AA002F954E} abc

and save it as abc.bat

Read More...

How to access blocked sites or country restricted sites

Stealthy allows you to instantaneously get and setup a working proxy from a click of a button.

If you are worried about the permissions required by the extension check out this certificate: http://www.softpedia.com/progClean/Stealthy-for-Chrome-Clean-215173.html
Does your country/company blocks you out of facebook, youtube or others?

Stealthy is the solution for you.

• Hide your IP address for your privacy online.
  
• Access all content privately without censorship; bypass firewalls.

It provide the proxies, so you don't have to bother searching for lists that usually don't work. The extension automatically selects and sets up tested proxies from the cloud.

The term Stealthy refers to military aircraft that can penetrate into enemy territory undetected by radar. In a way, that’s what this browser extension does.

Some organizations and governments block access to web pages, and certain online services are not available in all countries. With Stealthy, users can make themselves undetectable, and thereby able to bypass the censorship.

This can be tremendously important in countries like China or Iran, where regimes censor the Internet. But even in countries like Germany, many people cannot watch music videos on YouTube because of a licensing dispute with GEMA. With Stealthy installed, this is not an issue, as you can get a foreign IP address and play the videos without issue.

Once installed, a small stealth aircraft icon will be appear in your navigation bar. The color is red by default, indicating Stealthy is off. After clicking on it, Stealthy automatically searches for an appropriate proxy, sets up your browser, and turns the icon green, meaning you are now in Stealth mode.

How does it works:
The extension works by placing an icon on the upper right part of your browser, after installation Stealthy will be off by default, you will need to turn it on. With the click it switches between ON (green icon) and OFF (red icon), in the (unlikely) case that the proxy assigned to you doesn't work or is too slow you should turn Stealthy off and on again in order to get a new one.
Configuration:
This is the preferences window, you access there by clicking on the small arrow in the right side of Stealthy's icon.

Yo can chose between uses:

• Normal use for achieve anonymity
• Pretend that you are in the US
• Use a service that requires you to be in an specific country by providing the country code.

You can also chose the behavior on start-up:

• Leave it as it was previously set
• Automatically set it Off
• Automatically set it On.

The last option cleanup your network settings in case you lost connectivity to internet, or Stealthy refuses to work

 

 

Stealthy for Chrome (recommended): 

http://chrome.google.com/webstore/detail/ieaebnkibonmpbhdaanjkmedikadnoje

Stealthy for Firefox: 

http://addons.mozilla.org/en-us/firefox/addon/stealthy/

Read More...

How to Access Data of a Password Protected User in Windows XP

Steps :

1. Boot the machine from Windows XP bootable CD.

2. At the setup screen, select R to repair using Recovery Console.

3. Now the console program will prompt you to select the Windows folder 
(eg. C:\WINDOWS) where the Windows is installed (you need to enter a 
number from the list of folders shown to you).

4. Type 'HELP' (without single quotes) and press enter for available 
commands. This is like a DOS program, but some features are not 
available

5. Change the current directory to the user's directory where you want to backup.

6. Type 'CD "C:\Documents and Settings\USERNAME"' (without single quotes) and press enter. 

7. Now the current directory will change to "C:\Documents and Settings\USERNAME".

8. Now change the directory to Desktop by entering 'CD Desktop' (without
 single quotes) and press enter to go to the desktop folder.

9. Type 'DIR' (Without single quotes) and press enter, you will be liwted all the available files in Desktop.

10. Type 'COPY a.doc D:\BACKUP' (without quotes) and press enter, where 
a.doc is a file available in Desktop and the folder D:\BACKUP available 
to copy the files.

11. As in step 7,8,9,10 you can backup other folders like "My Documents", "My Music", etc.

12. Note that you cannot use wildcards for COPY, i.e. you cannot copy 
all the files in a folder at once. You must copy one file by one.

Any data which has not backed up will be permanently deleted when you re-format the hard drive, so make sure you back up any thing you want to keep.

Read More...

Destroy Websites with Asteroids Shooting Game JavaScript

1. Simply Drag tthe below image to your bookmarks bar for using it on any website anytime
2. Now just visit any website which you wanna play with and click the link or paste the JavaScript.
3. Now it time to play

   just use arrow keys ← ↑ → ↓ and Space key to shoot at objects.

OR

Simple click the Below Image

Read More...

Apple update to OS X Lion exposes encryption passwords

Apple's had a rough time lately on the security front. Last month it was caught out having delayed the release of a security update for Java, resulting in more than 600,000 Macs being recruited into a botnet. Now a quality assurance mistake can cause OS X users' FileVault encryption passwords to be exposed.

On Friday, David Emery posted to an encryption mailing list disclosing this flaw in the latest OS X Lion security update, 10.7.3, which was released in February.

It appears that a debug option was accidentally left enabled in FileVault, resulting in the user's password being saved in plain text in a log file accessible outside of
the encrypted area.

Anyone with access to the disk can read the file containing the password and use it to log into the encrypted area of the disk, rendering the encryption pointless and permitting access to potentially sensitive documents. This could occur through theft, physical access, or a piece of malware that knows where to look.

To my knowledge, this only applies to users of Snow Leopard who used the FileVault encryption option for their home directories. It does not impact users of FileVault2 who have turned on Apple's full disk encryption, nor does it impact users who did not upgrade from Snow Leopard.

The best course of action is to implement a full disk encryption solution like Sophos SafeGuard for Mac or Apple's included FileVault 2.

                 

Additionally, vulnerable users who do not encrypt their Time Machine backups risk replicating this log file to their backups, which could mean long-term storage of their unencrypted password.

This proves a very important point when it comes to encryption. While choosing a secure algorithm is important, it's rarely the most important factor. How products store, manage and secure keys and passwords is the most common failure point in assuring data protection.

This incident demonstrates the importance of implementation over technical arguments like key strength and password complexity. That Apple promises AES encryption doesn't mean anything if it chooses to store your password in an accessible log file.

Let's hope Apple is able to fix this problem quickly. However, the possibility that the plain text password has been backed up and the difficulty of ensuring both copies and the original plain text password are securely erased means retrieval could still be possible even after the fix is applied.

Once Apple users receive and apply the fix, they would be well advised to consider this password compromised, change it and ensure it is not used on any other systems.

Read More...

iPhones, Android devices hot targets among 50,000 network attacks on California university

Almost 50,000 separate network attacks each week take aim at the California State University, San Bernardino, and the latest trend is seeing attackers go after students' Google Android and Apple iPhone mobile devices.

"It's everything you can imagine," says Dr. Javier Torner, who is responsible for coordinating information security on the campus attended by 17,000 students. "[We've got] big bandwidth, 600Mbps of traffic, and it's everything from scans to SQL injections to brute-force attacks."

University information technology staff operate both open-source and commercially available intrusion-detection systems to monitor the incessant barrage, which originates mainly from the U.S., Russia and China, some of it automated, some not. Some attacks pound away day and night against university websites, trying to break in through them in order to get to another part of the network or post malware.

"They're trying to target our websites, and then going after mobile devices connected to a website," says Torner, the information security officer. He notes a large number of students now connect to the websites through their mobile Apple and Android tablets and smartphones, which outnumber traditional computers or Macs. So it's not surprising attackers are gunning for iOS and Android devices, and sometimes they succeed in compromising Web pages.

Android devices have a reputation for being more vulnerable to malware, but Apple iOS devices -- even ones that students themselves haven't "jailbroken," eliminating Apple's security -- also have been compromised through what appears to be Web-based malware, says Torner. "In Web pages, the payload now is more directed against mobile devices," he says.

This tallies with an observation made by analysts at Lookout Mobile Security last week that it has spotted for the first time websites that have been hacked to deliver malicious software to devices running Android in a drive-by download. Symantec last week said it has seen Android drive-by downloads since last November but that they have been limited. Drive-bys have been a common form of attack against PCs for quite a while, and now appear to be widening to mobile.

California State University, San Bernardino, operates an open-source SNORT intrusion-detection system, and has added the commercially available MetaFlows sensors to gain extra functionality in analyzing IP flows, Torner says. The dual monitoring systems lets the university run comparative analysis. Sometimes university students working on degrees in information assurance join forces with IT staff in hands-on training projects for this.

Torner says the experience in intrusion-detection monitoring shows that within just a few hours of software vulnerabilities being made public by vendors or others, attackers will start going after any possible weakness, especially Web holes. "They're trying to find an opening," he says. This makes the task of updates and patching critical.Occasionally an attacker or malware gets through and tries to go after university computers. There are about two or three incidents each month.

Read More...

SonicWall stands tall in SSL decryption testing

If one of the main advantages of a next-generation firewall is application and protocol identification and control, then SSL decryption is a basic requirement. We looked at the SSL decryption capabilities of the next-generation firewalls to see how well they would be able to discover applications, protocols, and URLs hidden within encrypted connections.

When SSL decryption is in place, the firewall performs a "sanctioned man-in-the-middle attack." This means that the firewall intercepts the SSL connection and performs a man-in-the-middle attack to decrypt the contents. Because the attack is done with the permission of the enterprise, it's called "sanctioned.''

This requires that the enterprise have a private certificate authority that is trusted by all users behind the firewall, and that the certificate authority can issue a "signing" certificate. The signing certificate is loaded into the next generation firewall, and for every SSL connection, the firewall generates a new certificate in real-time and uses it to secure the SSL connection between the end-user and the firewall, replacing the original certificate. The firewall then secures the connection using the original certificate. Because the firewall is stacking together two encrypted connections, it can see the traffic, unencrypted.

The only next-generation firewall we tested that did a good job of SSL decryption was SonicWall. With two check boxes, we were able to enable SSL decryption and then apply the next-generation firewall features to the traffic. Four more check boxes enable anti-virus, anti-spyware, intrusion prevention, and content filtering on the SSL traffic. The configuration, including loading our own certificate authority certificate, was simple and fast, and the decryption worked. Additional features we were looking for, such as the ability to exempt traffic from decryption by IP address, user group, or certificate common name (such as "www.bankofamerica.com" or "www.kaiserpermanente.org") were no problem.

We also tested that the SonicWall system could pass through certain errors to clients, such as a self-signed certificate (SonicOS figured that one out) or a certificate that was revoked by the issuer (not detected by SonicOS), and discovered that there is still some work to be done.

The story was not nearly as good with the other firewalls. Check Point's Security Gateway has a more elaborate and better thought-out configuration system with more bells and whistles. For example, with the Security Gateway you could exempt all domains in a certain category (such as financial services) from being inspected. The Security Gateway also passed all of our SSL validation checks, detecting revoked and self-signed certificates just fine. However, the Security Gateway can only inspect HTTP traffic on known SSL ports. This means that an application that runs over non-standard ports won't be inspected, and neither will any application that uses a different protocol — such as email, instant messaging, or file transfer.

Fortinet's FortiGate did a better job at covering more protocols, handling HTTP, SMTP, POP3, FTP, and IMAP running over SSL, but only on known ports. Fortinet's engineers told us that the SSL decryption is linked to their anti-virus transparent proxy system, which is what kept it from running across more ports. But what FortiGate made up for in coverage, it lost in configuration controls. There's no way to exempt traffic from decryption except by IP address, and the FortiGate let through both self-signed and revoked certificates, making two invalid web sites look as if they were well-secured, even when it was configured to block invalid SSL certificates.

We were also disappointed in the SSL decryption capabilities of the Barracuda NG Firewall. Unlike other next-generation firewalls, the NG Firewall requires you to explicitly configure HTTP clients (no other protocol is covered) to use the HTTPS proxy on the NG Firewall. This means that if the client can get through the firewall without using the proxy or send the traffic over any other port, it won't be able to apply next-generation controls or IPS signatures to the encrypted traffic, even if the traffic goes through the NG Firewall. Barracuda's engineers told us that this limitation will be lifted in Version 5.4.

Overall, the results were disappointing, since only one product, SonicWall SonicOS, supported what we considered basic functionality. This suggests that the products are still evolving rapidly to meet the requirements for this new product category and that the PR and marketing are moving a bit faster than the engineers.

Read More...

Microsoft blames and bans Chinese security partner for leaking Windows exploit

Microsoft issued critical patch MS12-020 to fix the Windows' Remote Desktop Protocol (RDP) vulnerability last month as it was spotted on a Chinese hacker forum and was being exploited in the wild. The kicker is that the exploit code was leaked from one of Microsoft's security partners in the Microsoft Active Protection Program (MAPP). Now Microsoft named, blamed and banned the culprit, Chinese security firm Hangzhou DPTech Technologies Co., Ltd for leaking the proof-of-concept code.

According to the Director of Microsoft's Trustworthy Computing, Yunsun Wee, "During our investigation into the disclosure of confidential data shared with our Microsoft Active Protections Program (MAPP) partners, we determined that a member of the MAPP program, Hangzhou DPTech Technologies Co., Ltd., had breached our non-disclosure agreement (NDA). Microsoft takes breaches of our NDAs very seriously and has removed this partner from the MAPP Program."

Wee's post pointed to "Inside the MAPP program" where the MAPP team defended the program. MAPP was developed in 2008 due to an increase in attackers reverse-engineering Microsoft's monthly security updates. MAPP Senior Program Manager Maarten Van Horenbeeck wrote:

Before the MAPP program, defenders were at a disadvantage because detecting exploits is difficult, especially if a security vendor does not have full information on the types of conditions that may trigger successful exploitation. A vendor could write a signature for every attack file they receive, but they would need to respond to every file individually, or spend significant amounts of time reverse- engineering our security updates themselves. By providing technical details about a vulnerability directly to defenders, we strengthen their ability to create more effective and accurate signatures in a shorter timeframe.

MAPP also helps to provide a first line of defense for customers who need, or want, to do their own testing prior to deploying our updates.

"We recognize that there is the potential for vulnerability information to be misused." added Van Horenbeeck on MSRC Ecosystem Strategy Team blog. "When partners do not successfully protect our intellectual property, we take action, which may include removing the partner from our program."

Computerworld reported that Microsoft would not comment when asked if the Mighty M has kicked out other MAPP security partners, but "MAPP counts 73 companies as members, including several other vendors based in China. Six weeks ago, MAPP's rolls listed 78 firms."

Starting this month, May 2012, Microsoft announced that it had "strengthened existing controls" for MAPP and "took actions to better protect our information."

This leads us to Patch Tuesday when Microsoft will release three critical patches to fix remote code execution flaws in Office (including Office for Mac OS X), Windows, .NET Framework and Silverlight. Four other patches are rated important to fix remote code execution flaws in Office and elevation of privilege vulnerabilities in Windows. The Advanced Notification for May has seven bulletins to fix 23 total vulnerabilities. Additionally, Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool.

Sorry to be the bearer of bad news, but CSO reported "the disruptive restarts and the wide range of platforms impacted by this month's bulletins will have IT teams scrambling to accomplish their flaw remediation tasks." Paul Henry, security and forensic analyst for Lumension, added, "With the workload from Oracle and now the bulletins expected from Microsoft many will unfortunately not get a break for the Memorial Day weekend."

If it makes you feel any better, MAPP's Van Horenbeeck says that Microsoft "quite often" has people working on the weekend and at night to test updates. The video below was created in February before the mess with Hangzhou DPTech Technologies. At that time, Van Horenbeeck said customers might have advisories but there were no stories of exploitation because MAPP partners were working together to make sure that didn't happen.

Read More...

Is This Censorship? Facebook Stops Users From Posting ‘Irrelevant Or Inappropriate’ Comments

Updated. Today was just another Saturday morning in blog land when Robert Scoble, the well-known tech startup enthusiast, went to post a comment on a Facebook post written by Carnegie Mellon student (and TechCrunch commenter extraordinaire) Max Woolf about the nature of today’s tech blogging scene. Scoble’s comment itself was pretty par-for-the-course — generally agreeing with Woolf’s sentiments and adding in his own two cents.

But when Scoble went to click post, he received an odd error message:

“This comment seems irrelevant or inappropriate and can’t be posted. To avoid having comments blocked, please make sure they contribute to the post in a positive way.”

Now, Facebook makes no apologies for working to create a safe and clean environment on its corner of the web by shutting down abusive or harassing behavior, content such as pornography, or general spamming of the system. This particular method policing “inappropriate” comments may be new, but it would fall within the same realm.

But even so, this instance seems to be a very strange enactment of any kind of Facebook policy. Scoble posted his original comment in its entirety on his Google+ page, and it’s clear that it contains no profanity or even any obvious argumentative language.

Of course, what makes a comment “positive” or “negative” is a very subjective thing. Since Facebook is a global site, and what is acceptable in one culture is offensive in another, the company generally relies on a combination of software algorithms and notifications from other users to identify inappropriate behavior. This seems to show a glitch in that system.



This could be similar to what happened to film critic Roger Ebert back in January 2011, when Facebook temporarily disabled Ebert’s blog because of allegedly “abusive comment.” It turns out that Ebert’s blog never actually contained objectionable content — a number of Facebook users had flagged his page as “abusive” after he wrote a critical tweet about Ryan Dunn, an actor who died in a drunk driving accident. It could be that Robert Scoble has been similarly flagged by other Facebook users, for reasons justified or not.

Scoble’s a pretty popular guy on the web, so not surprisingly his Google+ post about the incident attracted more than 100 comments within the first hour after he posted it. Several other people there report having seen the same message in recent days, and one person named Steven Streight wrote that recently his Facebook commenting ability was “temporarily limited” because of comments that he says were similarly benign such as “I’m a married man.” TechCrunch commenters have weighed in on this post as well to recount similar experiences.

Not surprisingly, a number of people are seeing this as an example of censorship — a word that almost always has negative connotations in the tech world.

We’ve reached out to Facebook for more information on what this policy means, how it is powered, and what specific words or behaviors it is meant to filter. We’ll update this post if we hear anything back and as the situation develops.

Update: A Facebook policy spokesperson emailed the following explanation:

“To protect the millions of people who connect and share on Facebook every day, we have automated systems that work in the background to maintain a trusted environment and protect our users from bad actors who often use links to spread spam and malware. These systems are so effective that most people who use Facebook will never encounter spam. They’re not perfect, though, and in rare instances they make mistakes. This comment was mistakenly blocked as spammy, and we have already started to make adjustments to our classifier. We look forward to learning from rare cases such as these to make sure we don’t repeat the same mistake in the future.

For more information about our spam prevention systems, please see this blog post: https://blog.facebook.com/blog.php?post=403200567130.”

Read More...

Belgian bank blackmailed by hackers threatening to expose customer data

Hackers say they have broken into Elantis, a Belgian credit provider owned by Dexia, and demand payment of €150,000 (US$197,000).

If Elantis doesn't pay up before tomorrow (May 4), say the hackers, they will publish confidential customer information, reports PCWorld.

According to Softpedia, the hackers have stated the following:

"In addition to database tables containing data such as internal login credentials, we downloaded numerous tables which contain Internet loan applications, as well as fully-processed applications. Those tables hold highly-sensitive data such as the applicants' full names, their jobs, ID card numbers, contact information and details about their income"

The bank confirmed the data breach on Thursday, though it stated that it will not give in to extortion threats.

Softpedia quote the hackers, "While this could be called 'blackmail,' we prefer to think of it as an 'idiot tax' for leaving confidential data unprotected on a Web server."

Now, I have no problem with third-parties contacting legitimate sites to alert them to network insecurities. Improving security is a good thing, and there are a lot of sites out there harbouring vulnerabilities and less-than-ideal security measures.

And I also get that this threat of pushing out customer data is an embarrassing one for the banks. But, doesn't the simple act of blackmailing lower you to yuckiest societal rungs?

The sad reality here is that the real victim is the bank's customers, not the bank. It is the customer data that is at risk. Their only fault was partnering with the wrong bank at the wrong time.

The bank has told the press that they are not prepared to pay. That they don't like blackmail.

Let's hope that whatever the outcome of this scenario, Elantis likes security and will address its security deficiencies. And they also better figure out a way to make it up to their customers whose identities are currently at risk.

Read More...

Intel-McAfee developing cloud-security strategy

Intel, which last year acquired McAfee for its security expertise, today described work it is doing to provide enterprises with a way to secure data stored in public or hybrid cloud environments.

Jason Waxman, general manager of Intel's Cloud Infrastructure Group, joined with Greg Brown, vice president of network security at McAfee, to describe the strategy that's being pursued to let IT managers gain better understanding about the security of their cloud workloads.

McAfee's ePolicy Orchestrator (ePO) management console, which has long been a workhouse to aggregate multi-vendor security information in addition to McAfee's own products, is well-positioned to audit cloud environments.

By using McAfee ePO with Intel Trusted Execution Technology (TXT) in TXT-enabled Intel servers, it's possible to establish a baseline determination of assurance and confidence when undertaking tasks such as transferring workloads from server to server , for instance, using VMware's VMotion, they said.

"It's a hardware-based root of trust," said Waxman, noting the technology allows servers to be defined as "trusted" or "untrusted." When combined with McAfee's MOVE AV anti-malware for use in virtualized environments, it's possible to also learn if the server has any "issues identified." In addition, the McAfee Cloud Security Platform, which has been available for some time to allow IT departments to apply access and security policies in the cloud, is being developed further to provide integrity assessment, asset control and protection, and broader auditing capabilities, Intel said. Other McAfee security products, such as Identity Manager and Deep Defender, are also seen as contributing to the security assessment and protections under the strategy.

The end goal is to give IT managers a way to perform a wide variety of security checks on both the servers, usually virtualized, and the data they make use of in public cloud and hybrid cloud arrangements.

"We believe we have a pathway to deliver that vision," said Brown. He noted today the Cloud Security Platform can secure data traffic between the enterprise and the cloud. He said in the future, the goal is to enable perform a wide range of security assessments.

When asked whether the Intel/McAfee strategy for enterprise-to-cloud security will rely on Intel/McAfee products alone, Waxman replied TXT might work with other solutions, but "we'd like to see best practices where people use all of these technologies together." He said other announcements related to the Intel/McAfee cloud security strategy are soon expected in terms of product support.

Read More...

The 10 worst Web application-logic flaws that hackers love to abuse

Hackers are always hunting to find business-logic flaws, especially on the Web, in order to exploit weaknesses in online ordering and other processes. NT OBJECTives, which validates Web application security, says these are the top 10 business-logic flaws they see all the time.

1. Authentication flags and privilege escalation

Since applications have their own access-control lists and privileges, if the implementation of the authorization is weak, it opens up vulnerabilities that can be exploited, such as accessing another's content or becoming a higher-level user with greater permissions. What's needed is identifying parameter names that have something to do with ACL/permission that could become a target, and the tester can use fuzzing tools to try and change bit patterns or permission flags, which may show the point at which exploitation, escalating privileges or bypassing authentication can be achieved by an attacker
.
2. Critical parameter manipulation and access to unauthorized information/content

HTTP GET and POST requests are typically accompanied with several parameters when submitted to the application, typically in the form of name/value pairs, JSON, XML and so forth, but they can be tampered with and guessed by predicting. Tests for this look for easily guessable values and whether a parameter's value can be changed in order to gain unauthorized access.

3. Developer's cookie tampering and business process/logic bypass

Cookies are often used to maintain state over HTTP, but developers are not just using session cookies, but are building data internally using session-only variables. Application developers set new cookies on the browser at important junctures which exposes logic holes. The danger is that these cookies can be reverse engineered or have values that can be guessed or deciphered and attackers try to identify these holes that are easy to exploit. Tests here typically involve analysis of cookies delivered during profiling, and looking for easily guessable values, and whether a cookie value can be changed.

4. LDAP parameter identification and critical infrastructure access

LDAP is becoming an important aspect for large applications and may get integrated with "single sign-on" as well. Many infrastructure layer tools like SiteMinder and Load Balancer use LDAP for both authentication and authorization. LDAP parameters can carry business-logic decision flags that can be abused or leveraged. Attackers can find business-layer bypasses and logical injections if the application is not doing enough validation. Tests for this focus on finding parameters linked with LDAP, such as those taking email or usernames, which are prospective targets.

5. Business constraint exploitation

The application's business logic should have defined rules and constraints, but if poorly designed, attackers can crawl them and browse through hidden fields and understand their context. So it's necessary to test hidden parameters and values, checking business-specific calls that can become a target and manipulated.

6. Business flow bypass

Applications include flows that are controlled by redirects and page transfers. However, in many cases, this flow can be bypassed, which can lead to an error condition or information leakage, which can help an attacker identify critical backend information. It's necessary to test whether business functionality and parameters can be tampered with through a proxy.

7. Exploiting client-side business routines embedded in JavaScript, Flash or Silverlight

Many business applications now run on rich Internet application frameworks leveraging JavaScript, Flash and Silverlight, and in many cases the logic is embedded in the client-side component. These can be reverse engineered, and if it is Flash and Silverlight, both of these files can be decompiled and the actual logic used by the application can be discovered. JavaScript can be debugged line by line to identify embedded logic. This could include logic for cryptography algorithms, credential storage, privilege management and other security. This may lead to possible exploits. To check for these kind of weaknesses, it's necessary to analyze the Document Object Model (DOM), identify variables on a browser stack, and look for suspicious values and parameters that can be exploited in DOM.

8. Identity or profile extraction

A critical parameter in authenticated applications, the user's identity is maintained using session or other forms of tokens. Attackers can identify these token parameters in poorly designed and developed applications, opening up the potential for abuse and systemwide exploitation. The token may only be using a sequential number or guessable username. To test for this, it's necessary to look for parameters that are controlling profiles; if it's possible to decipher, guess or reverse engineer tokens, the game is all but finished.

9. File or unauthorized URL access and business information extraction

Business applications contain critical information in their features, in the files that are exported and in the export functionality. Users can export their data in a selected file format (PDF, XLS or CSV) and download it. If this functionality is carelessly implemented, it can enable asset leakage. To test for this, it's necessary to identify call functionalities based on parameter names like file, doc, and dir, which will point you to possible unauthorized file-access vulnerabilities, and then a good test is doing basic brute force or guesswork to fetch another user's files from a server.

10. Denial of service (DoS) with business logic

Denial-of-service vulnerabilities for business applications pose serious issues because if exploited, the application can be brought down for a length of time or at a critical juncture. Sometimes attackers can identify a loophole and try to exploit it during a DoS condition. There are no universal DoS attacks like TCP flooding on networking at the application layer, but in some cases, infinite loops implemented in the application layer can lead to a DoS condition. It's important to test applications against a threat model and provide defense at the application layer.

In its report on the "Top 10 Business Logic Attack Vectors," NT OBJECTives says identifying business-logic flaws in custom-designed Web applications is not just a matter of automated scan testing but also a manual review of the application security and logic with "human intelligence."

Read More...

VMware takes on Dropbox, Google Drive, Microsoft SkyDrive

VMware is offering a private-cloud based platform for document sharing and device syncing that could rival  Dropbox, Google Drive and Microsoft SkyDrive by giving companies more control over their data.

The product, called Project Octopus Beta, gives access to documents via a native client or a Web client to internal and external users, but gives IT controls over provisioning, authentication and where data is stored.

The Octopus sync client works on Windows, Macintosh, Linux, iOS and Android operating systems. Whatever is dropped into the Octopus file on the machine gets synched centrally and becomes available to all that person's devices and to those authorized to share that data, the company says. The servers supporting the synchronization logs activity to track who shared what with whom.

The product is reminiscent of Dropbox, Google Drive and Microsoft's SkyDrive, all of which promote document sharing and central syncing with multiple devices. The difference is that this incarnation of Octopus places control of the syncing within the corporate firewall on gear that is privately owned. The others are cloud-based services with the infrastructure included as part of the service.

A major criticism of the cloud-based syncing services is security, and by giving enterprises control of the entire infrastructure, Project Octopus can go a long way toward addressing that by leaving security decisions entirely up to customers.

VMware has been talking about Project Octopus since last year, but starting today, qualified VMware customers can try out the beta version of Project Octopus, an enterprise based platform that syncs files with end user machines.

Unlike file syncing services, Project Octopus gives IT departments the power to dictate what versions are kept, whether they are stored on fast or slow storage and what authentication methods are used to gain access.

End users can leave notes on documents in a comment panel, tag documents as important, and receive notifications when changes are made to those documents.

Customers have the option to run the Project Octopus backend on their own infrastructure or in public clouds, depending on their preference.

Read More...

Pirate Bay block backfires with work-around published online

Last week, the UK High Court ruled that the country’s leading ISPs (Virgin, Sky, Everything Everywhere, TalkTalk and O2) must block subscriber access to one of the world's leading file-sharing site, The Pirate Bay.

The objective of this ban was to limit access to the site's four-million-plus torrents of pirated movies, music and TV shows.

But this effort seems to have backfired spectacularly.

Thanks to all the major news outlets covering the the story, the Pirate Bay enjoyed "12 million more visitors than it has ever had."

Now, even for a website whose traffic is so great, they sit in the top 100 most visited website in the world, 12 million additional visitors is massive.

Perhaps to entice traffic, or to take advantage of the surge in visitors, Pirate Bay published a few work-arounds to help visitors circumvent the ISP efforts to block access.

It will take a few weeks for all the ISPs to put the blocks to the Pirate Bay, but the soon-to-be-banned site is taking full advantage to educate their users on what they can do to circumvent "internet censorship", reports TorrentFreak.

Yesterday, The Pirate Bay published the following (wording warts et al):

The Western countries of the world all complaints about the censorship in Iran, China, Saudi Arabia and so on. But they are really the worst culprits themselves, having double morals in doing an even worse thing themselves.

Today news was out that the UK high court has decided that TPB is "massively infringing on copyright". The facts that no copyright is being infringed upon here at the site was not a welcome fact, so that was ignored apparantly.

Noone from TPB was invited to the court case, which would be normal to do in a democracy. This is not the first time this happens, it's been the same in most countries we're censored in. We have no right to speak since we're not rich.

Five ISPs got sued by the record companies to force them to block us. This is particularily interesting since music released and promoted exclusively here on TPB is currently in the brittish top charts. We are simply competitors that they just managed to squeeze out of their market, in a maffiesque way.

As usual there are easy ways to circumvent the block. Use a VPN service to be anonymous and get an uncensored internet access, you should do this anyhow. Or use TOR, I2P or some other darknet with access to the internets. Change your DNS settings with OpenDNS. Or use googles DNS servers... we could go on...

But don't forget that we can't allow this shit to happen. Next time they're coming for something else. And yes, there will be a next time if we don't stop them. Write to your ISP and tell them to appeal the case. Write to your local MPs and tell them that this is not allowed. Make sure your voice is heard. Remember, we're all the pirate bay, and we must stand united against the censorship from our opponents!

It is interesting that ISPs are being mandated to block access to this site. Is this not a little like a postman being blamed for delivering you an illegal item, like a pirated DVD?

I guess if the Pirate Bay is difficult for the authorities and affected industries to blame, they might as well go after the ISP middlemen instead.

We asked Naked Security readers back in February if they thought ISP should be forced to block sites like The Pirate Bay. Over 900 of you responded, with a whopping 93% said no:

Even if your ISP does block access to the file-sharing site, it seems it is not illegal for you to visit the site if you can figure out a way to access it.*

An obvious word of caution: downloading copyrighted material is a legal no-no, and you could be held accountable for copyright infringement under UK law.

Read More...

Pirate Bay blocked! 93% oppose court order on UK ISPs, poll reveals

The British Court has ruled that UK ISPs must block access to the popular file-sharing website, The Pirate Bay.
Everything Everywhere, O2, Sky, TalkTalk, and Virgin Media must all now prevent their users from accessing the file-sharing site, which includes many torrent links to pirated movies, music and TV shows.
Virgin Media told the BBC that it would comply with the court order, but seemed mightily unimpressed with the judgement:

As a responsible ISP, Virgin Media complies with court orders addressed to the company but strongly believes that changing consumer behaviour to tackle copyright infringement also needs compelling legal alternatives, such as our agreement with Spotify, to give consumers access to great content at the right price.

BT, Britain's largest ISP, was also ordered to ban access to The Pirate bay, but has requested extra time to determine how best implement the block.
ISPs typically argue that policing copyright infringement is not their job, and that they should not have to shoulder the costs of implementing web censorship on their customers.
Earlier this year, Naked Security polled almost 1000 of its readers and found the overwhelming majority (93%) were not in favour of ISPs being forced by law to block access to The Pirate Bay.

Although many British consumers will be unhappy with the news, there's one group who will be delighted with the development - the British Phonographic Industry (BPI).
BPI chief Geoff Taylor welcomed the court's decision:

The High Court has confirmed that The Pirate Bay infringes copyright on a massive scale. Its operators line their pockets by commercially exploiting music and other creative works without paying a penny to the people who created them. This is wrong - musicians, sound engineers and video editors deserve to be paid for their work just like everyone else.

The Pirate Bay is believed to have some three million British users.

Read More...

Android Network Toolkit (ANTI) Review - Pentest at the push of a button

Recently White-Hat Hacker, Itzhak "Zuk" Avraham, the founder of zImperium unveiled its new app in Blackhat / Defcon19, introducing a new concept where both home users and local IT can have the same tools to, at the push of a button, check for their security faults. The new zImperium product, named Android Network Toolkit (or in short - ANTI), allows professional penetration testers, ethical hackers, IT and home users to scan for security issues in their network.

In a few simple clicks ANTI covers the most advanced attack vectors in order to check for vulnerabilities, even those that up until now could only be performed by top-notch penetration testers. This means that while you might think that you’re safe because you have a firewall on, with ANTI you can check and prove it (or add it to your penetration testing report if you’re doing this as a job). Know if your desktop is easily hackable only a few clicks away by using the ANTI “Penetrate CSE” button, which will perform both MiTM and inject Client Side Exploit to check if you have the latest version of a vulnerable software (e.g: outdated java). You only need to imagine re-producing this using other currently available methods to appreciate why ANTI has gotten so much respect from our community.

“Penetrate CSE” is part of the newly released ANTI3, which covers more vulnerabilities than before. The authors at zImperium will keep improving this product and add even more vulnerabilities in the future.


Upon successful client-side / remote exploitation, the report is updated with the current findings that a specific computer wasn’t patched for a certain vulnerability. Performing MiTM and injecting exploits has never been so easy for the professional penetration tester and is now also available for the home-user and the IT - you don’t have to be a security guru to run security checks!

ANTI runs on Android version 2.1 and up, while CSE vector only one of several capabilities that makes this tool very powerful, especially when it runs on your smart phone!



The app is also capable of mapping your network, scanning for vulnerable devices or configuration issues. It is for use by the amateur security enthusiast home user to the professional penetration tester, ANTI provides many other useful features such as: easy connection to open ports, visual sniffing (URLs & Cookies) and - establishing MiTM attacks (using predefined and user-defined filters), Server Side / Client Side Exploits, Password cracker to determine password’s safety level, Replace Image as visual in demos and Denial of Service attacks. All this is packed into a very user-friendly and intuitive Android app (and soon to be released iOS app).

As zImperium chose to enable ANTI via their website, rather than through the market, thus the APK is installed manually by a few simple steps:
Go to http://www.zImperium.com/anti.html and follow the instructions there. You will receive a download link to your email. Open this link from your smartphone and then install the app as instructed. (Make sure that 3rd Party Applications is enabled in Settings->Applications->Unknown Sources.)

iOS users can join the list of upcoming (public) BETA testers in the same page, by clicking on the Apple icon.

On each run, ANTI will prompt to map the connected network, and when done, it will suggest scanning it for known vulnerabilities and misconfiguration on the targets found. Once a vulnerable target (to remote attacks) is found, it will be marked with red stamp and will appear on the report as a vulnerable device. Displayed in the report is the issue (e.g : MS08-067), how to solve the issue (Windows Update) and how to defend from similar threats in the future (Block port 445 on firewall).

We start by mapping the network - ANTI will scan and detect devices connected to the network. Each device will be displayed with a suitable icon identifying its hardware type and/or the operating system. We can then further scan for vulnerabilities on each of the devices found.

 Now that we have our available targets displayed, we can choose any of them to try and penetrate, connect, or sniff network traffic.

The sniffer captures network traffic and displays images, URL’s, user/password combinations, and cookies - all this is collected from the target in real-time, and displayed on ANTI for viewing and examining. We can click on any of the URL’s/cookies to visit the same site our target is visiting.

ANTI also allows us to connect to open ports on the targets, also displaying the opened ports that were found on previous scans.

After playing a bit with the app, I feel comfortable enough to try and penetrate one of my computers, running Windows7 or Mac OS X that are updated only to 1 month prior to this report. I choose the target and click ‘Penetrate CSE’. This plug-in is injecting javascript code using MiTM into target's traffic and redirect traffic to a URL serving Client Side Exploit. Once the target got exploited, ANTI reveals several functions that can be executed over the exploited target: Send screenshot of the current desktop, execute command. The controller functionality is implemented in a very easy-to-use and fun (!) way, allowing both advanced users and home-users to understand the risks of the found vulnerability - while zImperium censored any real possibility to cause real damage to the target, they allow basic information gathering and real life demos such as ejecting the CD-ROM, or grabbing a screenshot (for the assessment’s final report).

I decided to try the password-cracker on my router. I then realized (the good old hard way) that I better change my password ASAP since it took ANTI less than 30 seconds to crack! Next I executed the cracker on my target running a SQL server and, lo and behold, ANTI didn’t discover the passwords - due to use of high complexity passwords. These results were enough to get me to (finally!) change my router’s password.

There are additional functionalities built into ANTI, such as a unique and fully functional HTTP server that allows publishing files on your device, as well as uploading files to the device, visual traceroute using google-maps, and more.

Once we are done testing, the most important ANTI function is the Report - Everything we have found in the network, vulnerable devices, opened ports, and extra information that will later assist when preparing the assessment report - all is summed up in text and emailed. ANTI3 supports multiple networks so now you can fully use it for your daily penetration tests. And everything is extremely user-friendly!

Download ANTI3 from zImperium website

Read More...