Category Archives: (B) Basics

Best USA People Search Tool | Background Check

We really wanted to provide the BEST solution to our readers for this problem and we  did some extensive research and reverse engineering. After a loot of research and looking around we found the BEST solution of this problem for the people of tha USA Its the BEST USA people Search Tool. Its absolutely FREE to try and gives almost any information you want regarding the person for his / her background verification.

The name of the tool is EVERIFY.

find people for free usa | Find people by phone number

find people for free usa | Find people by phone number

The features of this tool include (but are not limited to) some of the best features you can think of :-

a) People Check – If you are looking for someone in the USA with any detail about the person. You can find the COMPLETE information about the person by looking for the person. In this tool you can :-

  • Search for person by Phone numbers
  • Search for person by Email addresses
  • Search for person by Address history
  • Search for person by DOB
  • Search for person by Relatives and associates

b) Social Media Check – Find all the information about any person from any social networking website including the complete list of his :-

  • Photos
  • Videos
  • Blogs
  • Professional interests
  • Social Networking Profiles
  • Archives and publications
  • And other!

c) Background Check – In case you get a spam email or even think of working with a legitimate person, doing a background check of the person is always a good idea. You can verify the complete information about the person based upon what he mentioned and what’s officially in the record by matching it against the following :-

  • Court Records
  • Marriage/Divorce Records
  • Birth Records
  • Death Records
  • Property Records
  • Asset Information

d) Criminal Check – If the above information was not enough, you can even go for the Criminal Record check of the person. The following information can be looked up about the person under criminal records :-

  • Arrest & convictions
  • Felonies & misdemeanor
  • Sex offenders
  • Mug shots
  • Criminal driving infractions
  • Court and probation records
  • And more

I have personally tested this tool and I loved it. I tried searching a person by phone number, name email and it automatically gave me all the related information about the person.

One think that could be improved about this tool is that currently its available only for the people of USA but we will find such valuable and useful resources for other countries as well and share the same for you guys to use.

I am sure many people will LOVE this tool and might start using it on regular basis. Some of our big corporate clients have been using this tool since long for the verification of the candidates they hire from the USA and save thousands of dollars annually in the actual verification. I myself use if for verification before we deal with any client overseas.

find people for free usa | Find people by phone number

find people for free usa | Find people by phone number

So next time you want to deal with any person from the USA and feel like doing their background checks, remember to use everify and get confident about your search before taking a step forward.

What is Vishing ?

Vishing is the practice of using social engineering over telephone system with the purpose of stealing sensitive financial information or other sensitive personal data from a victim. Vishing is one of the most serious threats today and is widely perpetrated by criminals.
The word “vishing” is a combination of two words “voice” and “phishing”. In this technique, attackers use telephone system to do phishing and hence the name.
Vishing is typically used by criminals to steal sensitive banking information like account number, PIN, password, OTP and credit card numbers or to steal other personal details of users that the attackers can exploit to perpetrate identity theft.
Attackers often use VoIP and automated system like IVR to perpetrate vishing. They may even use techniques like War Dialing and Caller ID Spoofing to serve their purpose.

How does Vishing work ?

Attackers may perpetrate vishing as mentioned below.
  • Criminals first harvest phone numbers of potential victims. They may use several techniques for that purpose. They may steal phone numbers from an institution or they may use war dialing to find out valid phone numbers.
  • The criminals then start making calls to potential victims. They usually use Caller ID Spoofing to deceive the victims and hide their identity.
  • In a vishing call, the attackers may trick a user in revealing sensitive financial details. They may say the call is from a bank and there is a problem with the user’s bank account or credit/debit card and the user needs to give his financial details to the caller in order to address the problem. The attackers may also use automated instructions to ask the victim to type in his credit card number, account number or PIN on the keypad. And, in some cases, the attackers ask the victim for his personal details that the attackers can later use to impersonate the victim for fraudulent purposes.

 

A real life example of Vishing

A widely perpetrated vishing scam is Microsoft tech support scam. In this scam, the attackers typically call a victim posing as a member of Microsoft technical support and inform the victim that his computer is infected with malware which is generating all sort of errors. The attackers can then ask for remote access of the victim’s computer or ask the victim to download some software or fake anti-malware programs to solve the victim’s problem. Some attackers may even deceive a victim to reveal his bank account information to make a payment. In other words, the goal of this vishing scam is to infect the victim’s computer with malware or to steal sensitive financial details from the victims.

 

How to prevent Vishing ?

Vishing is very difficult for legal authorities to monitor or trace. But, we can always take a couple of steps to protect ourselves up to a significant extent.
  • Never ever provide your financial details over phone. A bank will never ask for your account number, credit card number, password or PIN over phone.
  • If someone is asking for any OTP or One Time Password over phone, be sure it is a scam. OTPs are meant for users only and no legitimate authority will ever ask for any OTP from any user.
  • Do not reveal any personal details or personally identifiable information over phone. If you have any doubts, you can politely inform the caller that you are going to call back and then call the authentic number of the website/provider/institution to verify about the call. It is always better to be safe than sorry.
  • If you get a call informing any of your web account is having some problem, please do not reveal any information immediately. You can always login to your account visiting the legitimate website and verify whether there is any such notification or you can call the legitimate customer care numbers and clarify.
  • Get your number registered on the National Do Not Call Registry to block automated calls. It may not stop vishing, but you would get far fewer automated calls than you are used to.
  • Do not trust the caller ID of a phone call. As said above, attackers can very easily spoof that.
  • If you think you have fallen victim of vishing and your financial information are compromised, immediately call the bank and report the incident. Verify whether there is any unauthorized transaction. Also, immediately change your IPIN, password, ATM PIN or other credentials that may have been compromised.
  • It is always good to report vishing incidents to appropriate legal authority. It often helps a lot in catching the actual criminals.
So, to summarize, never ever reveal any financial information or any personally identifiable information over phone. It is always good to verify the authenticity of a call before responding. Be informed about various security threats and stay safe and stay secure.

Pharming Attack Methods

DNS Cache Poisoning

The domain name SDNS definition, according to Wikipedia is: A domain name system server translates a human readable domain name (such as example.com) into a numerical IP address that is used to route communications between nodes. Normally if the server doesn’t know a requested translation it will ask another server, and the process continues recursively. To increase performance, a server will typically remember (cache) these translations for a certain amount of time, so that, if it receives another request for the same translation, it can reply without having to ask the other server again.”

DNS Cache Poisoning Attack Scenario

Here is the attack scenario that an attacker will follow when performing the pharming attack:

  1. An attacker hacks into the DNS server (a cache poisoning attack).
  2. The attacker changes the IP address for www.targetsite.com to the IP of www.faketargetsite.com.
  3. The victim enters www.targetsite.com in the address bar and the computer asks the DNS server for the IP address of www.targetsite.com.
  4. Because the DNS server has already been poisoned by the attacker, it returns the IP address of www.faketargetsite.com.
  5. The victim will believe it is the original website, but it is the fake one.

Hosts File Modification

The hosts file definition, according to Wikipedia, is: The hosts file is a computer file used by an operating system to map hostnames to IP addresses. The hosts file is a plain text file, and is conventionally named hosts.”

The hosts file is a plain text file that contains lines of text consisting of an IP address followed by one or more host names where each field is separated by white space.

An IP address may refer to multiple host names (see the following example), and a host name may be mapped to both IPv4 and IPv6 IP addresses (see the following example).

By the way, you can leave comments in the hosts file by using the hash character (#), which indicates this line is a comment. Here is an example of hosts file content:

1
2
3
# This is an example of the hosts file
127.0.0.1 localhost loopback
::1 localhost

The hosts file location differs from one operating system to another; for example, in the Linux operating system, it’s located in /etc/hosts” and in the windows operating system it’s located in “%SystemRoot%\system32\drivers\etc\hosts“.

Hosts file Modification Attack Scenario

There are many ways to replace the victim hosts file with the attacker (modified) hosts file. The attacker can do this either by using a SFX archive or by using a batch file.

The SFX definition, according to Wikipedia, is: A self-extracting archive (SFX) is a computer application which contains a file archive, as well as programming to extract this information. Such file archives do not require a second executable file or program to extract from the archive, as archive files usually require. The files in an archive can thus be extracted by anyone, whether they possess the appropriate decompression program or not, as long as the program can run on their computer platform.”

The batch file definition, according to Wikipedia, is: A batch file is the name given to a type of script file, a text file containing a series of commands to be executed by the command interpreter in windows operating systems.”

In this tutorial, we will use the second way, which is creating a batch file.

Here is the batch file content that we will use to modify the victim hosts file which will redirect www.facebook.com to the fake website (attacker website):

1
2
3
@echo off
echo X.X.X.X www.facebook.com >> C:\windows\system32\drivers\etc\hosts
exit

Replace “X.X.X.X” with IP address of the attacker website and, finally, save it as Something.bat. To make it seem more like a legitimate file, we can use any binder software, which will help us to hide the malicious file in another file with any extension.

Now we will send the file to our victim via email or upload the file and ask our victim to download and run it, once it has been run, his hosts file will be modified.

Now when the victim tries to access facebook.com, he will access the fake website and the URL won’t change.

Conclusion

A pharming attack will help the attackers perform their phishing attack scenarios in a more sophisticated way to make it reliable and harder to discover that you’re under attack.

What Is a Pharming Attack?

The pharming attack definition, according to Wikipedia: “Pharming is an attacker’s attack intended to redirect a website’s traffic to another, bogus site. Pharming can be conducted either by changing the hosts file on a victim’s computer or by exploitation of a vulnerability in DNS server software. DNS servers are computers responsible for resolving Internet names into their real IP addresses. Compromised DNS servers are sometimes referred to as “poisoned.” Pharming requires unprotected access to target a computer, such as altering a customer’s home computer, rather than a corporate business server.

The term “pharming” is a neologism based on the words “farming” and “phishing.” Phishing is a type of social-engineering attack to obtain access credentials, such as user names and passwords. In recent years, both pharming and phishing have been used to gain information for online identity theft. Pharming has become a major concern to businesses hosting ecommerce and online banking websites. Sophisticated measures known as anti-pharming are required to protect against this serious threat. Antivirus software and spyware removal software cannot protect against pharming.

A pharming attack will redirect the victim to the fake website (an attacker website) even though the victim enters the correct address for the legitimate website. For Example: The victim intends to access www.twitter.com, so he writes the right URL to the browser, the URL will still be www.twitter.com, but he will surf the fake website instead.

How To Download Instagram Videos On Any Device

Download Instagram Videos On Any Device

 

A lot of apps used for downloading the instagram videos on your pc and mobile.

 

Download Instagram Videos On Android

#InstaGetter

Easily Download Instagram Videos on Android via Instagetter.Instagetter is the application which is used for downloading the videos and photos of public in easy way.It is best app for downloading and used by millions of users. Here is the Downloading Link Of Play store.

Download-

 


Instagetter For Android

Steps : –

1. Download the Instagetter app on android from above link.

2. Open the app after installation process,when app is successfully installed,then open the app instagtter.

3. After this open the video/photo which you want to download.

4. Now copy the url of that video/photo from clicking the right hand side menu option, a new screen appears “Copy Share Url” named text appears,tap on this to copy the url.

5. Now open the app and paste the url of that link in the app.

6. The application will check the url and processing for the valid video/photo.

7. After checking a small screen appears, Downloading window appears.

8. Now Click on the download button and enjoy the Download of instagram videos on Android.

 

Download Instagram Videos On iPhone

#InstaGetter

Easily Download Instagram Videos on iphone via instaGetter.This app is same as that of android instagetter.This app contains more features as compared to the app on android.This helps us to download the instagram videos/photos and moreover reposting of these also available.Multiple accounts supported in this.Here is the downloading Link :-

Download- InstaGetter For iPhone

Through this you can easily download instagram videos on iphone.

What is Public Key Encryption ?

Public key encryption is an encryption process in which two different keys are used at the time of encryption and decryption. Typically, one key is used at the time of encryption and the other one is used at the time of decryption. These are called private key and public key.
Each user who wants to use public key encryption has to create a keypair consisting of a public key and a private key. The private key must be kept secret with the user and the public key can be distributed with others who want encrypted communication with the user.
If a plaintext message is encrypted with the private key, it can be decrypted with the public key. And, if it is encrypted with the public key, it can be decrypted with the private key. And, this makes public key encryption much convenient to be used in encryption, decryption and in making digital signatures.
If Alice wants to send an encrypted message to Bob, she would need to encrypt the message using Bob’s public key. Bob can decrypt the message using his private key and read. As the private key is kept secret to Bob, only Bob would be able to decrypt the message and read.
But, at the same time, Bob may need to make sure the encrypted message is sent by Alice only and not by anyone else using Bob’s distributed public key. Digital Signatures are used for that purpose. Alice can make a digital signature of the message using her private key and send it to Bob along with the original encrypted message. Bob can verify the digital signature using Alice’s public key. As no one else knows Alice’s private key, Bob can be sure that Alice only has sent the encrypted message.
Thus, public key encryption can be used conveniently for encryption, decryption and digital signatures. DSA, RSA, PGP use public key encryption. PGP though can use both symmetric key encryption and public key encryption depending on the application.

What is a Spamtrap ?

Nowadays, almost all email service providers can automatically detect spams emails in user accounts effectively and redirect those potential spam emails to spam folders without human intervention.

But, how are spam emails detected automatically by email service providers ?

How are spam emails detected automatically ?

Almost all email service providers use machine learning to detect these spam emails. Typically, this machine learning technique relies on some predefined rules. When an incoming email matches most of those rules, the email is marked as spam and redirected to spam folders automatically. Otherwise, the email is sent to inbox.

What is a Spamtrap 

To detect spam emails automatically, firstly one has to decide on rules of detecting spam emails, based upon which the software can detect potential spam emails.

To decide on those rules, firstly enough research is done on spam emails to detect the most common properties of spam emails. And, based on those properties, rules of detecting spam emails are set.

Once the rules are decided, the email service providers set those rules in the spam detection software. And, spam emails are automatically detected in user email accounts.

A Spamtrap is an email address which is used to collect spam emails, so that enough research can be done on them to detect spams.

We have learnt about Honeypots in Computer Security and how they are used to lure the attackers. Spamtraps are like honeypots for collecting spam emails. They are the email addresses that are meant to collect spams only.
How are Spamtraps used
Anti-spam systems are normally automated. They collect samples of spam emails and make rules based upon them.

So, Spamtraps, which are email addresses dedicated to receive spam emails only, are created. After collecting enough samples, the anti-spam system study them and make rules for detecting spams. And, everything is done in an automated way.

How do Spamtraps reach the spammers

After creating Spamtraps, they are published over the internet, so that when spammers collect email addresses from various websites using crawlers, the Spamtraps are collected by the crawlers.

As Anti-Spam Systems work in an automated fashion, any legitimate emails coming in the Spamtraps can be mistakenly taken as spams and that can affect the system.

So, to prevent receiving legitimate emails in Spamtraps, Spamtraps are published in a location hidden from view such that only an automated script can find them.

After harvesting the email-ids spammers start sending out spams in bulk. But, as spamtraps are hidden from normal views, Spamtraps collect spams only and they do not receive legitimate emails.
Vulnerabilities of using Spamtraps
There are a couple of vulnerabilities of using Spamtraps. To mention a few of them :
  • If spammers can detect a spamtrap, the spamtrap becomes tainted. Spammers may send malicious emails in the spamtrap to control the automated spam detection process.
  • Spammers can even send malicious emails to spamtraps with sender’s address modified to the spamtrap itself. And this can cause backscatter.
  • Sometimes, spammers put lots of legitimate email ids in the To and CC field of spams. So, if any of those legitimate email receivers reply to that spam email, the legitimate email address also can get considered as spam address by mistake.
  • If a Spamtrap becomes visible and someone sends legitimate email to the spamtrap by mistake, that email also will get considered as spam by mistake.