FN SECURE: Featured

Call Us For Workshops Or Seminars.. In Your University, Colleges, or Schools.
Email Us At : vicky@globallyunique.in

Save as PDF
Showing posts with label Featured. Show all posts
Showing posts with label Featured. Show all posts

More than 24 News websites Hacked Today : 30 March

youtube-image.n.jpg (370×277)


Wow What a Day It was!!
And suddenly You get up and hear a news that more than 24 news websites have been hacked Tonight!!

Its a group of Pakistani hackers, who pretends to be tired of having repeted news from Indians professional and other students.

"They pretend to carry on hacking all the major news website of India. And tend to go for more extended and powerful Targets Like "NDTV India, AAJ",etc.

Read more

Malware for xbox Kinect created by 15 years old Indian researchers




Indian researchers from MalCon have created a malware that utlizes Microsoft Kinect to secretly capture pictures and upload to a picasa account.

A 15year old Indian security researcher 'Shantanu Gawde' from MalCon Research has created a malware that utilizes the Microsoft xbox kinect controller.
Kinect for Xbox 360, or simply Kinect, is a motion sensing input device by Microsoft for the Xbox 360 video game console. With over 10 million devices sold till date, the kinect holds the Guiness book for world record for the fastest selling consumer electronics device - and is exactly the reason why the malware is a concern.

In recent months, there have been a number of innovative kinect hacks that make use of the kinect using both Open source drivers and the Kinect SDK. The malware, code-named 'gawde' after its creators name, works on Windows 7 to secretly capture pictures of the victim / surroundings from a connected Kinect device and uploads them to a picasa account.

Rajshekhar Murthy, Director at ISAC, (Information Sharing and Anaysis Center), a scientifc non-profit body that holds the International Malware Conference, MalCon said. "We believe that in coming years, a lot of windows based applications will be developed for Kinect and the device will gain further immense popularity and acceptance- and from a perpective of an attacker, such a popular device can be an exciting target for visual and audio intelligence. At MalCon research labs, we promote proactive security research and the malware utilizing Kinect is only a proof of concept. "

The kienct malware 'gawde' goes a step ahead and even uses voice recognition to execute a program based on keyword, without the knowledge of the victim. The malware PoC will be demonstrated at the upcoming MalCon 2011 in Mumbai, India.

Read more

US satellites was victim by Chinese Hackers



Computer hackers, possibly from the Chinese military, interfered with two U.S. government satellites four times in 2007 and 2008 through a ground station in Norway, according to a congressional commission. According toBloomberg, the Chinese military is suspected of executing the digital intrusions which targeted satellites used for earth climate and terrain observation.

Indeed, a Landsat-7 earth observation satellite system experienced 12 or more minutes of interference in October 2007 and July 2008, while hackers tapped into a Terra AM-1 earth observation satellite twice, for two minutes in June 2008 and nine minutes in October that year. Interestingly enough, the report doesn't actually accuse the Chinese government of sponsoring or executing the four attacks. 



However, it clearly states that the breaches are "consistent" with Beijing's military doctrine which advocates disabling an enemy's space systems, and particularly "ground-based infrastructure, such as satellite control facilities."
[Source]

Read more

BruCON Agnitio workshop Slides and Video Demonstration - Download


Workshop by David Rook (Security Ninja) at BruCON 2011 in Belgium. You can Download Slide from here.
Required for the Agnitio hands on demos:
Optional
In addition to the list above the following things are optional depending on how hands on you want to be:
  • Internet connection to download an application from the Android market place
  • Eclipse IDE installed
  • Android SDK installed
  • Android Debug Bridge (adb) installed, this should be installed as part of the SDK install
  • An AVD configured with the Android market place app installed (instructions here)
  • I think you can also use a rooted Android device if you don’t want to use the emulator
Workshop format
  • A quick look at static analysis and the strengths and weaknesses of humans and software
  • What is Agnitio and why do I think checklists are a vital component of security code reviews
  • Some examples of what can go wrong if you don’t use checklists to find and remove simple flaws
  • Demos/hands on: using checklists in Agnitio to review source code, produce reports and metrics
  • Demos/hands on: how to customise your Agnitio installation
  • A look at mobile (Android and iOS) application security and how analysis is currently done
  • Demo/hands on: using the mobile specific rule sets in the Agnitio static analysis module
  • Demo/hands on: downloading an app from the marketplace and decompiling it using Agnitio

Read more

Canonical releases Ubuntu 11.04 Alpha 3 !


As expected, Canonical has released a third alpha for Ubuntu 11.04, code named "Natty Narwhal". This development milestone is the last of three planned alpha releases, which will be followed by two betas – as previously previously reported, there will be no release candidate for Ubuntu 11.04.

Natty Narwhal Alpha 3 is based on the 2.6.38-rc2 Linux kernel and features indicator improvements, as well a new look for the Unity Dash and a resize function. Ubuntu 11.04 sees Unity, as the distribution's new default desktop developed in-house by the Ubuntu developers, replacing the GNOME Shell and, as previously announced, the replacement of Oracle's open source OpenOffice.org office suite with the LibreOffice community fork.

Package updates in the development preview include version 3.3.1 of LibreOffice, Firefox 4.0 Beta 12, version 2.13 of the Transmission BitTorrent client and Upstart 0.9.0 – version 1.0 of Upstart was released on 2 March. Other changes include updates to the Ubuntu installer, which now allows users to upgrade their existing Ubuntu installation to the new version, improved iPhone support and a new Ubuntu One Control Panel.

As with all pre-releases, use in production environments and on mission critical systems is not advised. Users testing the release are encouraged to provide feedback and report any bugs that they encounter.
Further information about the third alpha can be found in the release notes. A list of planned features and changes for version 11.04 of Ubuntu is available on the Blueprints for Natty page. Ubuntu 11.04 Alpha 3 is available to download from the project's web site. Users currently running Ubuntu 10.10 on a desktop system can upgrade by pressing Alt+F2 and typing "update-manager -d" (without the quotes) into the command box.
The final version of Natty Narwhal is expected to arrive on 28 April 2011. The latest stable release is version 10.10 "Maverick Meerkat", while the current Long Term Support (LTS) version is Ubuntu 10.04.2 LTS "Lucid Lynx".

Get Ubuntu

Read more

Make Your Own Real Android Robot !

Android's little green robot mascot is pretty cute. Even one of Apple's biggest fans could admit he's cooler than a slightly bitten fruit. So seeing how commonly hacked Android is, when Instructables member Tanabata decided to hack a figurine to make it responsive--the Android robot is, of course, the natural choice.

Tanabata's Mechanized Android Figure moves its head, displays light patterns, reacts to sound, and can send out messages in morse code. His model is from DYZPLASTIC, but you could use this hack on and figurine you have lying around that you don't mind altering. From there. you're going to need a whole lot of supplies--think four types of LED and resistors, plastic and metal micro servos, a Piezo and power supply to name but a few. Fortunately the full instructions and shopping list (with links!) are available on Instuctables to follow.

After a bit of wiring (remembering to keep things small) all the gear up, then prising open the firgurine to add the servo and put all of your work inside the model, the hack is almost complete. All it needs is a bit of modding for the microphone as well as the software for the morse code, which is explained fully by Tanabata as well as a source given for the software. Then your creation is complete!

Check out this video of an Android robot in action. How alert does he look now?

What would be really cool now is to hack two of these and get them to interact with each other.

Read more

Warner Bros. to deliver movies on Facebook !


Warner Bros. is apparently hoping to attract new fans by offering movies for viewing on Facebook.
The movie studio announced this evening it would begin testing a program that would offer movies for sale or rental for a brief period through its fan pages on the social-networking giant.

Beginning tomorrow, Facebook users can use Facebook Credits to rent "The Dark Knight" through the movie's official fan page on the social-networking site, Warner said in statement. The movie can be rented for 30 Facebook credits or $3, and Facebook users will have access to the movie for 48 hours through their accounts on the social network.
Facebook Credits is an alternative payment option for more than 150 games and applications on the social network. It's supported by games such as FarmVille and Mafia Wars, as well as Bejeweled Blitz and Madden NFL Superstars. Most titles still allow gamers to pay with credit cards, but it's Facebook's hope that eventually, users will buy all virtual goods with Credits.
The studio sees the social network as fertile ground for video on demand--considered a key revenue source for Hollywood studios grappling with falling box office receipts.
"Facebook has become a daily destination for hundreds of millions of people," Thomas Gewecke, president of Warner Bros. Digital Distribution, said in a statement. "Making our films available through Facebook is a natural extension of our digital distribution efforts. It gives consumers a simple, convenient way to access and enjoy our films through the world's largest social network."
Facebook representatives did not immediately respond to a request for comment.
In addition to being able to pause the movie and resume it at their leisure when they log back in to Facebook, Warner Bros. said users will still be able to post comments on the movie and interact with friends on the network while watching their selection.
The program is currently available only in the U.S., and additional titles will be added on a regular basis over the coming months, Warner Bros. said.

Read more

Google Chrome Gets Updates: New Interfaces, Faster Browsing !


Tuesday, Google announced a few changes to Chrome, its engineered-for-speed web browser.

The super-fast beta version that was announced a few weeks ago has already been updated to a stable version. For the Googlers working on Chrome, speed entails not only faster code (the latest version of Chrome boasts a 66% improvement in JavaScript performance) but also easier-to-navigate interfaces.

With that in mind, the company is rolling out a new Settings interface for all Chrome users. One major change is that Settings are now presented in a Chrome tab rather than a dialog box — a change that will seem familiar to those using Google’s Cr-48 notebooks, which run Chrome OS and present absolutely everything in a browser tab.

Settings are also searchable, which many users will likely find extremely helpful.

Here’s a brief demo video showing Chrome’s new Settings pages in action:


Google has also extended its sandboxing features to Chrome’s Flash player.

Interested parties can download the latest version of Chrome now; be sure to check back with us in the comments section to let us know what you think of the new browser.

Read more

iPad 2 iOS 5 Lock Screen Bypass Vulnerability



Marc Gurman at 9to5Mac has discovered a vulnerability on the iPad that allows for a limited bypass of the device’s lockscreen. Anyone with an iPad Smart Cover can gain access to the previously-open app (or the home screen if no app was open).

By holding the power button to bring up the ‘Power Off’ screen, closing the smart cover, re-opening it, and clicking cancel, the attacker will be dropped into the screen that was open before the iPad was locked. If the attacker gets dropped into the home screen, then they’ll be able to see the installed apps, but won’t be able to open anything. If Safari or Mail (or any other app) was the open when the device was locked, then the attacker would have access to that app.

From a locked iPad 2:

1) Lock a password protected iPad 2
2) Hold down power button until iPad 2 reaches turn off slider
3) Close Smart Cover
4) Open Smart Cover
5) Click cancel on the bottom of the screen


This isn’t the first security issue Apple has experienced since rolling out iOS 5. On the brand new iPhone 4S it has been discovered you can use Siri when a device is locked. Even if a passcode is required, Siri doesn’t care and allows you to carry out functions such as sending email and text messages.

Protection Against the iPad 2 Lock Screen Bypass:
For the time being, iPad 2 users are encouraged to disable the “Smart Cover unlocking” feature found in Settings > General.

Read more

What TO Do If You Want To Do Hacking..!!


Hacking can be difficult and there are many different ways to hack and many different exploits to use. Hacking is neither defined nor limited by exploitation or exploration. Hacking into someone else’s system may be illegal, so don’t do it unless you are sure you have permission from the owner of the system you are trying to hack or you are sure it’s worth it AND you won’t get caught.
Hacking was primarily used for learning new things about systems and computing in general, ‘in the good old days’. In recent years it has taken dark connotations and in general has been looked down upon. Likewise, many corporations now employ “hackers” to test the strengths and weaknesses of their own systems. These hackers know when to stop, and it is the positive trust they have built that earn them large salaries.
There is a major difference between a hacker and a cracker. A cracker is motivated by malicious (namely: money) reasons; a hacker is attempting to gain knowledge through exploration, at any cost and in any way – not always legal.

Steps:

  1. Learn a programming language. You shouldn’t limit yourself to any particular language. C is the language the systems are built in, it teaches you what’s very important in hacking: how the memory really works. Python or Ruby are modern, powerful scripting languages, that can be used to automatize various tasks; Perl is a good choice in this field as well. PHP is worth learning only because it’s what newbies use to “hack” poorly written web-applications (forums, blogs etc). Bash scripting is a must, that’s how you can easily manipulate most servers – writing one-line scripts, which will do most of the job. Finally, you can’t do much without knowledge of ASM – you *can’t* exploit a program if you don’t know that.
  2. Use a *nix terminal for commands. Cygwin will help emulate this for Windows users. DOS is worthless in this area. The tools in this article can be found for Windows based machines. Nmap particularly, uses WinPCap to run on Windows and does not require Cygwin. However, Nmap works poorly on Windows systems due to the lack of raw sockets. You should also consider using Linux or BSD, which are both more flexible, more reliable, and more secure. Most Linux distributions come with many useful tools pre-installed.
  3. Try securing your machine first. Make sure you fully understood all common techniques, including the way to protect yourself. Start with basics – found a server which has site about racism, homophobia or other bad activities? Try to hack it, any way you can. Yet again, don’t change the site, just make it yours.
  4.  Know your target. The process of gathering information about your target is known as ‘enumeration’. Can you reach the remote system? You can use the ping utility (which is included in most operating systems) to see if the target is ‘alive’, however, you can not always trust the results of the ping utility, as it relies on the ICMP protocol, which can be easily shut off by paranoid system administrators.
  5. Determine the operating system (OS). This is important because how can you gain access to a system if you don’t know what the system is? This step involves running a scan of the ports. Try pOf, or nmap to run a port scan. This will show you the ports that are open on the machine, the OS, and can even tell you what type of firewall or router they are using so you can plan a course of action. You can activate OS detection in nmap by using the -O switch.
  6. Find some path or open port in the system. Common ports such as FTP (21) and HTTP (80) are often well protected, and possibly only vulnerable to exploits yet to be discovered. Try other TCP and UDP ports that may have been forgotten, such as Telnet and various UDP ports left open for LAN gaming. An open port 22 is usually evidence of an SSH (secure shell) service running on the target, which can sometimes be bruteforced.
  7. Crack the password or authentication process.
     Crack the password or authentication process. There are several methods for cracking a password, including brute force. Using brute force on a password is an effort to try every possible password contained within a pre-defined dictionary of brute force software. Users are often discouraged from using weak passwords, so brute force may take a lot of time. These days there are major improvenments in brute-force techniques. Most hashing algorithms are found weak, and you can significally improve the cracking speed by exploiting these weaknesses (like you can cut the MD5 algorithm in 1/4, which will give huge speed boost). Also new techniques use graphic card like the processor – and it’s thousands times faster. You may try using Rainbow Tables for fastest password cracking. Notice that password cracking is good technique only if you already got the hash of password. Trying every possible password while logging to remote machine is not a good idea, as it’s easily detected by intrusion detection systems, pollute system logs and may take years to complete.
     It’s often much easier to find other way into system, than cracking password.
  8. Get super user (root) privileges. Try to get root privileges if targeting a *nix machine, or administrator privileges if taking Windows systems. Most information that will be of vital interest is protected and you need a certain level of authentication to get it. To see all the files on a computer you need super user privileges. This is a user account that is given the same privileges as the “root” user in Linux and BSD operating systems. For routers this is the “admin” account by default (unless it has been changed), for Windows, this is the Administrator account, etc. Just because you have gained access to a connection doesn’t mean you can access everything. Only a super user, the administrator account, or the root account can do this.
  9. Use various tricks. Often to gain super user status you have use tactics such as creating a “buffer overflow”, which is basically causing the memory to dump and allowing you to inject a code or perform a task at a higher level then you’re normally authorized. In unix-like systems this will happen if the bugged software has setuid bit set, so program will be executed as different user (superuser for example). Only writing or finding an insecure program that you can execute on their machine will allow you to do this.
  10. Create a backdoor. Once you have gained full control over a machine, it’s best to make sure you can come back again. This can be done by ‘backdooring’ an important system service, such as the SSH server. However your backdoor may be removed upon the next system upgrade – really experienced hackers would backdoor the compiler itself, so every compiled software would be a potential way to come back.
  11. Cover your tracks. Never ever let the administrator know that the system is compromised. Do not change the website (if any), do not create more files than you really need. Do not create any additional users. Act as fast as possible. If you patched a server like SSHD, make sure it has your secret password hard-coded. If someone tries to login with this password, the server should let them in, but shouldn’t contain any crucial information.

Read more

WebHacking Basics For All Starters


Hello, this is just a short article about webhacking and the basics (mostly tips).
There’s not much to say, so here I’ll start…
1. Check for robots.txt
Usually the directory is hxxp://www.targetsite.com/robots.txt
This can contain plenty of information. Even though not all sites have it.
robots.txt is used to restrict the Google bot’s access in certain parts of a forum or a website.
It looks like this:
User-agent: *
Disallow: /forum/admin.php
Disallow: /forum/moderator.php
Disallow: /forum/include.php
etc.
2. Check if site is vulnerable to SQL injections
This can be checked with a simple apostrophe at the end.
For example, hxxp://www.targetsite.com/news.php?id=1′
If the page displays an error, then the site is vulnerable.
You may now proceed on injecting more queries and drawing various information.
3. Check for common directories
Sometimes site administrators forget to rename the dirs and leave them as default.
It’s good to check for these directories as they can contain version info and other stuff that helps you determine if the site is vulnerable.
Common diretories are:
admin
admincp
mod
modcp
moderator
include
includes
logs
tmp
install
4. Port scanning
Gathering information about the server can also be useful.
Ping the site in cmd (you MUST know how to do this, if you don’t, then just leave) and scan the IP (and no, don’t limit the scan to 6000 as usual, f.ex 8080 is a common web port).
Don’t forget to check the site with nslookup, MaXe’s DNS guides cover this.
With this information you can figure out if the site has vulnerabilities and stuff.
Now you can connect with the open port threw telnet. The syntax is telnet IP(or hostname) port. For example, telnet google.com 25.
For example, if the site has port 25 open, which is the SMTP (Simple mail transfer protocol) we can send emails threw the server.
Or even better, imagine there’s port 3306 open. That’s the SQL port. Threw this you can access the site’s SQL database.
Download MySQL or something and try to clear your way in. You can try various combinations, like:
admin admin
admin root
root root
root admin
And so on. Though it’s quite possible that you won’t get anywhere guessing, so your best bet would be bruteforcing, dictionary attacks, rainbow tables or whatever can you afford.
5. Cookie poisoning
Even though most sites nowadays filter this, it wouldn’t hurt to try.
We will do this…with javascript.
It’s quite simple. Try this in the address bar.
javascript:alert(document.cookie);
In some cases this may spit out your username and password.
This is the part where you try the famous line…
javascript:void(document.cookie=”username=’OR’1′=’ 1″); void(document.cookie=”password=’OR’1′=’1″);
Similar to SQL injection, you guessed it.
6. Check if site is vulnerable to XSS
XSS and javascript together open up a huge horizon of possibilities and a whole lot of new places to discover.
Check if the site is vulnerable by typing this in a webform or something.
<script>alert(“NPJ Vulnerable”)</script>
If site is vulnerable, then you will get a popup box saying awdwdadwd (yes this was random).

Read more

Hack To Make Free Calls



STD call rates are reducing in India every day, but still, they are not free. Today I bring you a hack to make free STD calls. I am exploiting a loophole in Rediff’s ad service. You can search for an ad on Rediff local ads and call the advertiser through Rediff. Rediff will call you first and then connect you with the advertiser of that ad. In this hack you basically need to post one ad, with your phone number. After that, every time you have to call a friend, you can search for that ad and pretend to be your friend. you want to call. Rediff will thus, call you as the advertiser and it will call your friend whose number you provided. Confused? Let me explain it step by step.
2) Click on Post ad (free) button.
3) Fill out the form and enter your Mobile number. Here, you should advertise something which is easier to search.
4) Post your ad and and wait for some time. Usually it takes around 40-45 minutes at max.
5) Search your ad and provide your friend’s number as the number to be connected with advertiser of that ad (you).
That is it. You made a free STD call. The catch is that one call lasts for only 1:30 minutes. Additionally, there is a limit of calls made per ad per week. However, they let you post multiple ads with same mobile number. That is you can do away with this weekly limit easily.

Read more

Speed Up Windows 7


windows 7 logo 300x300 7 Ways To Speed Up Windows 7
7 Ways to Speed Up Windows 7
With the release of Windows 7, Microsoft may just have introduced the fastest operating system in the world. For those speed junkies who are never satisfied, we have provided a few tips that will help you make your PC even faster.

Disable Automatic Disk Defragmentation

The Automatic Disk Defragmentation feature in Windows is designed to maintain the health of the operating system. However, it also makes Windows run a little slower. You can put an end to this by disabling the feature and manually running at your leisure. To do so, click “Start” and select “Computer.” Next, right click on your primary hard drive and select “Properties.” Lastly, select the “Tools” tab, click “Defragment Now” and uncheck the “Run on a schedule” option.

Utilize ReadyBoost

ReadyBoost is a built-in Windows 7 feature that allows you to use a USB flash drive to enhance system performance. How is this possible? The drive itself acts as additional computer memory!
In order to make use of this feature, you will need a USB drive with at least 2 GB of space. From there, you simply connect the drive to your computer, click “Start” and select “Computer.” Next, click on the USB drive and select “ReadyBoost.” Lastly, select “Use this device” and choose as much capacity as possible below on the “Space to reserve for system speed” slide.

Disable Windows Transparency

The transparency of windows is a great perk from a presentation aspect, but this may not be the case for those with older hardware as it can drastically impact performance. The good thing is that transparency can be disabled with ease. Simply right-click on your desktop, select “Personalize,” choose the active theme and then navigate to “Windows Color.” Finally, uncheck the “Enable Transparency” option.

Disable Unwanted Features

There may be numerous Windows 7 features that you really don’t need. These same features could also slow down your computer. To disable them, click on “Start,” choose “Control Panel” and then select “Programs and features.” Next, select the “Turn Windows features on or off” option, navigate through the list and uncheck all the features you want to disable. Once you are done, simply click “OK” to remove those features.

Disable Startup Services

Startup services are notorious for slowing down performance in XP and Vista. The same holds true for Windows 7. You can disable unwanted services by hitting “Start,” typing “msconfig” in the search bar and clicking “Enter.” Click the “Services Tab” on the next window and deselect the services you do not want to automatically run at startup. While this all depends on preference, services that impact performance the most include “Offline Files,” “Tablet PC Input Services,” Terminal Services,” “Fax” and “Windows Search.”

Disable Minimizing/Maximizing Animations

Many users have already fallen in love with the minimizing and maximizing animation effects of windows. However, some may find it irritating after a while as it can eventually lead to slowdowns. If you want to disable this function, hit “Start,” enter “System Properties Performance” in the search bar and click “OK.” On the next screen, deselect the “Animate window when minimizing and maximizing” option and click “OK.”

Update Your Windows 7 Drivers

Lastly, ensure that you have the latest device drivers made specifically for Windows 7. Since your PC can have hundreds of drivers installed in it at any given time, this task can be tedious. Luckily there are 3rd party utilities out thee such as DriverFinder™, which can greatly speed up this process.

Read more

Save this Page

Download as PDF