Skip to main content

Posts

Showing posts from May, 2017

CLOAK AND DAGGER - NEW SECURITY BUG IN ANDROID 7.0-

Researchers have discovered a new attack, dubbed 'Cloak and Dagger', that works against all versions of Android, up to version 7.1.2. Cloak and Dagger attack allows hackers to silently take full control of your device and steal private data, including keystrokes, chats, device PIN, online account passwords, OTP passcode, and contacts. What's interesting about Cloak and Dagger attack? The attack doesn't exploit any vulnerability in Android ecosystem; instead, it abuses a pair of legitimate app permissions that is being widely used in popular applications to access certain features on an Android device. Researchers at Georgia Institute of Technology have  discovered  this attack, who successfully performed it on 20 people and none of them were able to detect any malicious activity. Cloak and Dagger attacks utilise two basic Android permissions: SYSTEM_ALERT_WINDOW ("draw on top")BIND_ACCESSIBILITY_SERVICE ("a11y") The first permission, known as

TERMINAL ON ANDROID- TERMUX

Let Termux be our topic today. It is an Android application which is a Terminal Emulator distributed by Fredrik Fornwall. It creates exactly the same working environment of Linux Terminal on Android. Take a try. It can be installed from Google Play Store. Navigate from here . After the environment is set, go to App settings from the System Settings and give the App Storage permission.  Basic linux command like cd, ls, pwd, cat, touch and many more or almost all can be made here on this prompt. To install packages like Python or Pip type in packages install <packageName> It's that simple.  Similarly, to execute a program or a package, type <packageName> then, the corresponding help will be appear. Rest is with you. This is how an installation screen appears to be.. Now, about storage. As the initial step, type in termux-setup-storage Typing pwd gives the current working directory and it will be something like /data/data/com.termux/files/

MORE ABOUT RANSOMWARES. PART 3

Before we proceed, here is a quick catch-up, in case you've missed the first two articles describing what ransomware is and how it works:  Part I and Part II. By now, it looks like there's no escape from ransomware, especially since it also targets mobile devices, threatening to lock users out of their smartphones or tablets. Remember Koler?Unfortunately, encrypted communications between attackers and elusive infection workflows make it difficult for traditional detection-based security solutions to block ransomware attacks. How to prevent getting infected Because of the technology limitations that prevent users from retrieving the decryption key without paying the ransom, the best way to protect against the effects of ransomware is to not get infected in the first place. Recommendations for users: 1. Regularly backup your data in the cloud or using an external drive. Backups should not be stored on a different partition in your PC, but rather on an external hard-drive th

MORE ABOUT RANSOMWARES. PART 2

Now that we've been introduced to ransomware, let's see how it spreads and infects machines. How does it enter systems? Common penetration techniques include: Spam and social engineering, Direct drive-by-download or malvertising, Malware installation tools and botnets. When ransomware first hit the scene a few years ago, computers predominantly got infected when users opened e-mail attachments containing malware, or were lured to a compromised website by a deceptive e-mail or pop-up window. Newer variants of ransomware have been seen to spread through removable USB drives or Yahoo Messenger, with the payload disguised as an image. CTB Locker, the ransomware making headlines and victims right now, spreads through aggressive spam campaigns. The email poses as a fax message which carries a .zip archive as an attachment. If the executable file inside the zip file is accessed, the data on the system is encrypted and the victim is asked to pay a ransom to receive the decryption

MORE ABOUT RANSOMWARES. PART 1

 Not long ago, a man committed suicide after an automatically generated notice from a computer virus threatened him with jail unless he paid a ransom thousands of dollars. The year was 2014. As incredible as the story seems, it marked the first known time a computer virus actually killed somebody. The next generations stole cash from users around the globe, and Cryptolocker raised the stakes – holding data of hundreds of thousands of users hostage. Despite successive short-lived take downs, the malware has made a comeback as CTB (Curve-Tor-Bitcoin) Locker. This challenging breed of malware is continuously improving, reaching new levels of complexity as smartphones and tablets are increasingly used to store crucial personal and enterprise-level documents. Bitdefender, the anti-malware solutions provider, zooms in on the subject to show how this type of virus works and to tell users how to prevent being locked out and extorted. What is ransomware? Ransomware is a type of malware th

SETTING UP A C IDE

C-Language The C programming language is one of the most popular and widely used programming languages. It is a general-purpose programming language and there are very few computer systems in existence that are not set up for its use (i.e. where a C compiler does not exist). Here will see how to set up a C IDE. ON WINDOWS Dev C++ is an open source C/C++ compiler that is one of the most user friendly and effective development environment and compiler. It can be downloaded from  source forge  or from  bloodshed . • Download the setup file from any of the above links or from somewhere it is feasile. • Install it and open the IDE. Click on 'New project' from the menu File to the top left. •Type in your code. Next comes the task of saving the source code in c source format. Give it a name and from the drop down menu which appeares in the save window select 'c source file' and then click save. •After saving, click on the compile button from the menu or press F9. If t

SNIFF GSM USING HACKRFX

​TOOLS  USED: •  ha ckrf_kali • brategnuradio-companion • gr-gsmgqrx • wireshark INSTALL REQUIREMENTS: First thing, you want to make sure you have all the required software installed, you can install most of them and their dependencies using your distribution package manager. Let’s start with the libraries and tools for the hackrf itself, on a Debian/Ubuntu distro you’ll install them like so: sudo  apt-get install  hackrf   libhackrf -dev libhackrf0 Once these libraries are installed, you can plug your hackrf into one of your USB ports and execute the  hackrf_info  command, at this point you should see something like the following: # hackrf_info Found  HackRF  board. Board ID Number: 2 ( HackRF  One) Firmware Version: 2014.08.1 Part ID Number: 0x00574746 0x00574746 Serial Number: 0x00000000 0x00000000 0x14d463dc 0x2f4339e1 You will now install  gnuradio  which is the software we’ll use to decode the RF signals,  gqrx  a tool to visualize signal power on certain frequencies

LOCK OR UNLOCK YOUR PC USING A USB

​If you prevent access to your computer with just a password, you are missing out on an alternate (and more secure) way to lock down your computer. Predator, a free Windows program, turns your USB drive into a key that locks your computer when it’s removed. To unlock your computer, you’ll have to plug the USB drive back in. (Talk about having secret-agent-style security.) Anyone who attempts to access your computer without the USB flash drive will be hit with an epic “Access Denied” message. To get started, follow this guide: Step 1: Download and install Predator. Step 2: Once Predator launches, plug in your USB flash drive. None of the contents of the drive will be deleted or altered in any way, so feel free to use your primary thumbdrive. When you insert the drive, a dialog box will appear asking you to create a password. Click OK to continue. Step 3: In the Preferences window, take note of a few key settings. First, enter a secure, unique password in the “New password” field.

WHAT IS A VPN

​You’re watching a movie. A criminal is trying to evade a crime scene in a sports car on the highway. A helicopter is following the car from above. The car enters a tunnel with multiple exits and the helicopter loses track of the car. A VPN works just like the tunnel in this movie scene — it connects different roads and turns them into one, and a helicopter can’t see what’s happening inside the tunnel. I’m sure many people around you have recommended you a VPN service. They usually tell you that a VPN is great, it lets you watch geo-blocked content, avoid the Great Firewall of China or browse the internet securely. VPNs are great, sometimes. But using a VPN can be as dangerous as not using one if you don’t know what you’re doing. What really is it? If you have multiple computers, phones and tablets at home, you are using a local area network. These devices are all connected to the same Wi-Fi network and you can even transfer photos or movies from one computer to another without usi

SQL INJECTION

​ SQL  in Web Pages In the previous chapters, you have learned to retrieve (and update) database data, using SQL. When SQL is used to display data on a web page, it is common to let web users input their own search values. Since SQL statements are text only, it is easy, with a little piece of computer code, to dynamically change SQL statements to provide the user with selected data: Server Code txtUserId  =  getRequestString (" UserId "); txtSQL  = "SELECT * FROM Users WHERE  UserId = " +  txtUserId ; The example above, creates a select statement by adding a variable (txtUserId) to a select string. The variable is fetched from the user input (Request) to the page. The rest of this chapter describes the potential dangers of using user input in SQL statements. SQL Injection SQL injection is a technique where malicious users can inject SQL commands into an SQL statement, via web page input. Injected SQL commands can alter SQL statement and compromise the sec

FORMAT A USB IN LINUX

​Run the below commands to format the usb to fat32 filesystem from terminal, Type in: lsblk It gives the list of the filesystems on your device. Select the partition. It will be something like /dev/sdbx umount /dev/sdxx then format your device to FAT32 mkdosfs -F 32 -I /dev/ sdx There are also inbuilt packages/softwares which comes with almost all the Linux distributions  which can be used for formatting drives.

SHE, HE TOLD ABOUT

Her handwriting was so beautiful. Each letter had it's own boldness, elegance and I loved to look at them. A pen and a white space, even in a notice, was enough for her to begin. She would write and then look at it, enjoys it's beauty, goes into a serious thought and ends with a small smile. Every of those sequential actions I remember. It is so normal, universal and a must go reality that time moves foreward. Ages, days, hours, everything passes. My happiness on seeing those fonts kept on changing its demensions. My skin began to paint itself lines and so do she. Still, she wrote. But now there is a difference. As timestamps move, the interpretations made by my brain on those texts perplexed from simple happiness to pride, then to a feeling of belongingness, to love, to possessiveness, to responsibility to trust, to many other emotions for which I am weak in English to find words to substitute for and finally to a fear; a fear of death. Wrong. Perfectly wrong. Its not fear.

BAD MORNING

"Morning..good morning..", he came in with an enthusiastic smile. I was on my bed. I greeted him back and I got up. "Ah..wait. Hear this." He stopped me and began exactly like the Police officer wrote down.. We were eight of us heading to the Governer's house at the hill top. Yesterday, by 18:20 we had a breaking notification at the online public chat room. It was a link to a website having a half page 18 sized font text and a video followed by.  "Hello World! Isaac Meltonhlm crime, u already might hav hrd of, is nw solvd by tis. It is th Govrnr of Null-Island who is Isaac Meltonhlm. To those who havn't hrd of the crime: There ws a huge fund of abt 10 hundred transfered frm th treasury of th Island to an account referng to Mr. Meltonholm and an amount of 25 lakh missng too. On investigation by th agencies, th transfer ws found to be authenticated and verified. But none of th officials did th transfr frm the offic whch is justified by th 24*7 server s

I'M IMPRESSED

​"Ready?", he asked with a challenging smile. We were sitting facing my PC fingures on game control keys. He was always intrested in gaming. "Sure.", me too. He was back home after a long time. He is still the same and what I cannot be completely certain is only about her. Her name always distracted him. Misappropriated his pen, was puzzled with his phone, random knocked the table, his iris swept angles, he was sharp to spoken words and listened too, not once. I cannot call it a distraction to the full context, but it was some kind of psychological anxiety and stimuli which he was not able to hide completely, even after  his dedicated trials, which I came to know for he is a good friend of mine.  "You are my inspiration", those were some words forming a beautiful sentence, which I saw while he typed on his hand-set (I was good at guessing the keystrokes even looking from the back). I thought about it, a person who he never told me about turned to an ins

ITS JUST A MATTER OF TIME

"Glad to see you three together", I saw him texting. There was a bright expression of happiness, gratitude and pride rooted in the past, I saw, on his face. He looked at his phone, his fingures waved his face, his lips pushed in and cheeks out. A man controlled by memories.. His eyes turned to me. I lifted my eyebrows with a calm smile. "They are my friends", he came up with a photo. He looked at it. Danced his Adam's Apple. "We were always together, after we met, at our Higher Secondaries. Our lunch breakes never counted without everyone launghing, criticizing, wondering, teasing and mocking each other creating loops for future to roll back, recreate, endure and move to the next. Positiveness was always a fuel, understanding a bless and brotherhood a boon. Speeches, rhythms, boredome, problems we faced. But they never turned to be villains for comments and consolations were never weaker than worldly criticizms and despairs. Lackness and absence was never

CREATE A BOOTABLE USB

​Creating a bootale usb in Linux is much easier than that in Windows. First what you need to have is the iso image of the OS which you wish to install, which can be either downloaded from the internet. In case you do not have an iso but you have the setup files, in the sense all the files that are to be included in the iso, then you should create an iso with those files. In ubuntu or anyother Linux distros, it can be done the following way:Select all the files to be included in the iso image and right click and then select CompressA window apppers asing for the location and the type of the compressed file. There you select .iso and click 'Create'.It is done Now, after you have the iso image ready, place it in an accessable directory. To simplify the case, lets put it in the Desktop. Then folow the steps, Open the terminal (Ctrl+Alt+T).Type in  sudo fdisk -l.      This command will give you the list of all the harddrives connected to you PC and there you can can find out t

INSTALLING APPLICATIONS ON LINUX

Formats Linux uses some common formats to distribute software. The most common formats for the average Ubuntu user are: Debian packages(.deb)TarballsRedhat packages(.rpm) Debian packages (.deb) Debian Packages are the most common format you will encounter when installing software in Ubuntu. This is the standard software packaging format used by Debian and Debian derivatives. All of the software in the Ubuntu repositories is packaged in this format. Synaptic Package Manager, Add/Remove Applications, Aptitude, and apt-get handle the transaction with the repository behind the scenes. Tarballs Tarballs are a large collection of files assembled into a single archive file. The "tar" command is used to combine many files into a single file for archiving or easy distribution. The "gzip" command is used to compress the size of a file so that it takes up less space. A tarball is very similar to a .zip file on Windows, or a .sit or .dmg file on Macs. Tarballs have exten

3 and 23

"It was always such a shame to read about these topics since then", he made his statement for the first time this morning. He was reading the news on his mobile phone, as he loved reading, atleast for the sake of a show off. But he had gathered enough information about almost anything much enough to hold for five minutes in a debate. "What?", I added to the moment. "Curriculum and educational policies and syllabus."  "Aha?"  "I study engineering and you too. How illogical are their curriculum designs, to me in all ways and atlest to the two thirds, I suppose, counting to the thoughts and realisations, I add. Not just a few statements I am making to greet you a good morning, it is a need to speak, I think."  My smile followed by a silence made him continue...  "We are here to learn CS and what we are doing now is learning Physics, Chemistry, Mechanics and many other stuffs that will never ever add to the benefit in the life of a