Category Archives: (N) Hacking TUTS

Why You Have to Protect Yourself Online

The process of protecting yourself on the internet is basically the same as they were a decade ago. At the same time, however, criminals are upping their game, too. This means that not only must you maintain vigilance when online, but also be aware of the tactics that the bad guys use. You surely know the basics of protecting yourself online, but there are also other tactics and tools that you can use to ensure that you are safe.

The Safest Internet Browser Is…

The major browsers are:

  • Mozilla Firefox
  • Safari
  • Google Chrome
  • Microsoft Internet Explorer (Now “Edge”)

Let’s look at Internet Explorer. Over the years, there is no question that it has taken a beating. The folks at Microsoft have worked tirelessly to redeem the browser, and it grew much more secure than it was ever been before. But with the last official version being Internet Explorer 11, it’s time to move on. There is a lot of debate over which browser is the ‘best,’ but the truth is, they are almost equal when it comes to reliability, speed, and security.

Internet Explorer, for instance, does a security update whenever Windows Update is done. Firefox offers unique safety features, such as scanning downloads automatically for malware and viruses, as well as offering a virtual keyboard. Google Chrome is very website-friendly, as it tends to have a better display than Firefox.

All of these browsers have security features and options that require the attention of the user, as these might not be enabled by default. For example:

  • Any pop-up blockers should be turned on
  • You must decide if you want the browser to remember your passwords. Though this is convenient, it could put you at risk.
  • You must decide if internet content should be manually or automatically downloaded, and you have to decide where data is stored. Again, this sounds convenient, but it could be a security risk.

Generally, you will have the option to do much of this automatically, but it’s best to be notified before the computer downloads anything. This way, you can make a determination as to what affect the download might have on your system.

Wireless or Wired Internet Connection: What’s Best?

One simple way to understand the differences in security between a wireless and wired internet connection is to think of a telephone cord. When a telephone is connected to the outlet with a cord, the line is naturally secured. On the flip side, handheld, cordless, and wireless phone conversations are easier to intercept thanks to the influx of scanning tools available. Though a wired telephone can also be tapped, to do so, you must have internal access.

Internet connections are the same. When the computer is directly connected to a modem with a cable or wire, no one can access the connection, unless it’s an internal job. However, when you have a wireless connection, it can be hacked from outside, and all of that information being sent can be stolen.

To secure a WiFi connection one must set up WPA versions of encryption and/or use a Virtual Private Network software.

Protecting Yourself From Phishing

Protecting yourself from phishing is easy when you think about it. Simply don’t click on any email links from a sender you don’t recognize. And always be suspect of emails that look legit. The psychology that goes into phishing emails today is capable of scamming most, if not everyone if you’re not paying attention. If you believe that the email is real, hold the cursor over the enclosed link to see the exact URL. If the link is correct for the site you want to visit, it is probably safe. However, it might also be a type of typosquatting, which is when the address is slightly different, i.e. Google.com vs G00gle.com. If you are not sure if the link is safe, contact the person or company who sent the email to ask.

Alternatively, you can type the address directly into the address bar on the browser.

If you get an email alert from a site with an internal messaging system, such as from your financial advisor or bank, log in directly, not through the email link, and check for any new messages. Again, instead of clicking through the email, if you get a message notifying you that your online statement is ready, again, go to the website by typing the address into the bar yourself or use a bookmark.

If an email ends up in your spam folder, this could be a sign that it is a phishing email, even if you believe that it is real. Many email programs and browsers include some type of tool that detects these emails. Stay out of your spam folder.

Remember, legitimate companies will not send you an email asking you for your credit card information or ask you to change your password. If you get these emails, immediately delete them, and then notify the company.

Preventing the ‘Zombification’ of Your Computer

Both small businesses and consumers have relaxed security practices, and this gives scammers a launching point for their attacks. This allows them to create systems, such as botnets, that allow them to access data without detection. Hackers also use these botnets to send phishing emails, spam, viruses, and malware.

Botnets might be as small as a couple computers or hundreds of thousands of them. In fact, there are millions of computers that have the potential to be part of a botnet. When a computer becomes part of a botnet, they turn into zombies.

There are things that people do that can trigger an attack. These include:

  • Looking at pornographic websites
  • Playing games on sites that are hosted out of the country
  • Downloading pirated software from P2P sites

There is no such thing as honor when talking about thieves, so don’t involve yourself in risky behavior online. You will only be opening the door for hackers.

Computers that have unsupported or outdated operating systems, such as Windows XP, also put you at risk for turning your computer into a zombie. The same can happen when using outdated or old browsers, such as IE 7 or 8.

To get the most protection for your computer, make sure that you are setting Windows Update to automatically keep security patches up to date. You should also make sure that you are upgrading to an operating system that is still being updated, such as Windows 7, 8.1. etc. Also, make sure to set antivirus software to automatically update.

Those who have a Mac know that traditionally, they have not been as vulnerable to the same threats that PC owners face. However, the internet has leveled this playing field, and those who choose a Mac are just at risk of online threats as those with a PC. With more people than ever before using the Mac OS, hackers are working hard to create tools to access these, too. Thus, it is very important that Mac users make sure to always run the latest version of the OS and install Security Updates when they are released.

Protecting Yourself From Typosquatting

Typosquatters are those who create websites, such as Tvvitter.com, that looks almost identical to real websites, such as Twitter.com. After these websites have been created, they send out emails to millions, asking them to click on a link…which looks like it is legitimate. The problem? Once the victim is at that site and puts in their username and password, the hacker has their info.

How can you avoid these scams? Try this:

  • When doing any type of internet search, thoroughly examine each link
  • When typing an address into the browser, check it to ensure that it is spelled correctly
  • Only do business with internet retailers that you are familiar with, and then take care to type the address in yourself or use a bookmark.
  • You might also want to consider using a program, such as McAfee’s SiteAdvisor, which identifies any risky website by using a color-coded rating in the search results. This way, when you are browsing, you will know immediately if a site is safe or not.

Protecting Yourself From Scareware and Ransomware

The best way to keep yourself safe from scareware and ransomware is to ensure that your computer is always updated with the newest OS version and antivirus definitions. You should also make sure that you do not click any email links or visiting websites that might be risky. To fully protect your computer, follow these tips:

  • Use the newest version of your browser. At a minimum, download all available security updates for the browser you have if you don’t want to update.
  • Use the pop-up blocker that comes with your browser. This is usually a default setting, just make sure it’s on.
  • Keep in mind that there are some pop-ups that are legitimate, and if a pop-up will not close, use Ctrl-Alt-Delete to close the browser. If you have a Mac, use Command-Option-Escape, choose the application, and then force it to quit. Alternatively, click the Apple logo at the top left of the screen, and then choose the Force Quit option.
  • Do not ever click on any links that appear with a pop-up. If pop-ups begin to seem out of control, shut down the computer.
  • Persistence and patience count here. Though it can be difficult to close a pop-up, keep in mind that the buttons you press within the borders of the pop-up could still force a virus onto your computer.
  • Make sure that your antivirus software is completely up to date, and set it so that it updates the virus definitions automatically.
  • Never click any link that suggests that it will update your browser. Only update it from the manufacturer’s website.

Most people do not have the time, resources, or even the knowledge to fully protect their identity online. It is also not totally possible to prevent all forms of identity theft or fraud, which is why it is best to be forewarned and forearmed. With the current state of cybercrime growing by leaps and bounds, it is essential that you make an investment into protecting your computer.

dork-cli – Command-line Google Dork Tool

dork-cli is a Python-based command-line Google Dork Tool to perform searches againsts Google’s custom search engine. A command-line option is always good as it allows you to script it in as part of your automated pen-testing suite.

dork-cli - Command-line Google Dork Tool

It will return a list of all the unique page results it finds, optionally filtered by a set of dynamic page extensions.

Any number of additional query terms/dorks can be specified. dork-cli was designed to be piped into an external tool such as a vulnerability scanner for automated testing purposes.

 

Setup

In order to use this program you need to configure at a minimum two settings: a Google API key and a custom search engine id.

Custom Search Engine:

  • Create a custom search engine via https://www.google.com/cse/
  • Add your desired domain(s) under “Sites to search”
  • Click “Search engine ID” button to reveal the id, or grab it from the “cx” url paramter

API key:

  • Open the Google API console at https://code.google.com/apis/console
  • Enable the Custom Search API via APIs & auth > APIs
  • Create a new API key via APIs & auth > Credentials > Create new Key
  • Select “Browser key”, leave HTTP Referer blank and click Create

Usage

 

API Limitations

The free Google API limits you to 100 searches per day, with a maximum of 10 results per search. This means if you configure dork-cli.py to return 100 results, it will issue 10 queries (1/10th of your daily limit) each time it is run. You have the option to pay for additional searches via the Google API console. At the time of writing, signing up for billing on the Google API site gets you $300 free to spend on API calls for 60 days.

You can download dork-cli here:

dork-cli.py

Hack Facebook Account without password Step by Step 2017

Follow the following steps to Hack a Facebook account instantly:

Given below are the steps to be followed patiently to get into anybody’s Facebook account in few minutes. Follow these steps and if this doesn’t work then just follow the links given below these steps.

Step 1:
To Hack a Facebook account,  Open facebook.com and Click “Forgot your password? “
facebook-hack
Step 2:  
            Below Reset your Password you could find “No Longer have access to these?” Click that.
Facebook-password-reset
Step 3:
                 Type your New mail ID, confirm it and click continue.
new password
Step 4: 
                  Ask your trusted contact for help, now you want your friends on that account to help. Click continue.
fb-hack-trusted-contacts
                    Within 24 Hours you’ll get a new password and Hack the account…!

 

If you got any Problem Hacking Facebook Just do a comment.

Install and Run Windows 10 8 7 XP on Any Android Phone NO ROOT 2017

Click Here To Watch

Install and Run Windows 10 8 7 XP on Any Android Phone NO ROOT 2017

Links: https://goo.gl/YxhwfY

Updated Windows image Link: https://goo.gl/reOTw4

Mirror Link: https://goo.gl/gDtE55

More Mirrors: https://goo.gl/jyH4As https://goo.gl/gTQ5wb

New Updated Mirrors(April 25th 2017) https://goo.gl/YIIWud

New Updated Windows 10 Link x64 (Download Gandalf file) https://goo.gl/1cD90W

Windows 10 Link x86(Use Gandalf file) https://goo.gl/MqJ6pa

Application: Limbo https://goo.gl/YxhwfY

 

image file: https://goo.gl/5u8ixq

DDoS Attacks Will Crash the Internet Again (And Again, And Again)

  • This was the year of Internet of Things botnets, in which malware infects inconspicuous devices like routers and DVRs and then coordinates them to overwhelm an online target with a glut of internet traffic, in what’s known as a disrupted denial of service attack (DDoS).
  • Botnets have traditionally been built with compromised PCs, but poor IoT security has made embedded devices an appealing next frontier for hackers, who have been building massive IoT botnets.
  • The most well-known example in 2016, called Mirai, was used this fall to attack and temporarily bring down individual websites, but was also turned on Internet Service Providers and internet-backbone companies, causing connectivity interruptions around the world.
  • DDoS attacks are used by script kiddies and nation states alike, and as long as the pool of unsecured computing devices endlessly grows, a diverse array of attackers will have no disincentive from turning their DDoS cannons on internet infrastructure. And it’s not just internet connectivity itself.
  • Hackers already used a DDoS attack to knock out central heating in some buildings in Finland in November. The versatility of DDoS attacks is precisely what makes them so dangerous. In 2017, they’ll be more prevalent than ever.

Windows 10 tip: Protect removable storage devices with BitLocker encryption

Do you use a USB flash drive, MicroSD card, or portable hard drive to keep backups of important files? Protect yourself by encrypting removable storage devices so your files can’t be accessed if the drive is lost or stolen.

 

humb drives, SD cards, and portable hard drives are tremendously convenient. They’re also tremendously risky.

If your removable drive is lost or stolen, whoever finds it has complete access to its contents, which might include confidential files and personal information.

To eliminate that risk, use the BitLocker To Go feature of Windows 10 Pro and Enterprise editions to encrypt the drive so that it can’t be read without a password.

After inserting the drive, open File Explorer, right-click the drive’s entry, and click Turn On BitLocker. That starts the BitLocker Drive Encryption wizard. Enter a password and save a recovery key so that you can regain access to the data if you forget that password. For removable drives, choose Compatible Mode (which allows you to open the drive even on older Windows PCs) and then finish the wizard.

The encrypted drive can be opened on any Windows PC, even one that’s running a non-business edition of Windows. Enter the password and choose the Automatically unlock on this PC option to avoid having to enter the password on a PC where you’re already signed in. If you lose the drive, whoever finds it will be unable to read its contents without the password or recovery key.

Remove Bitmessage Ransomware Permanently

Research on Bitmessage Ransomware

In case your Microsoft Office files, images, videos, audios, emails and databases are injected with an .1999, .bleep, or .ccc extension, it indicates that your computer has been infected with file-encrypting Ransomware such as TelsaCrypt, RSA-2048 or Bitmessage , which is destructive virus made by hacker for robbing money online. Similar to common ransomware, Bitmessage mainly sneaks into your system via spam email attachments. Such suspicious emails will disguise as normal email sent by your friends, families or from famous companies, and they usually contain a document, photo or video file needed you to download. As soon as you download the attachments and open it, your files will be ruined by Bitmessage within a sec. Most of your files are changed into weird name with .1999, .vvv, or .ccc extension, and you will see a unknown TXT file in the infected folders or a popup photo on your screen, which is used to show you the warning message asking you to pay ransom fees to buy the decryption key.

delete Bitmessage

Bitmessage is definitely an evil tool used by hacker to make money illegally. After it locks your files, it charge lots of money for recovering your files. Some people think that they can call the police or FBI to catch the hackers and get the files back, but unfortunately, no one can track these top hackers so far, because they use encrypted tunnel with fake name to contact the victims, and their accounts for receiving the money are Bitcoin account, thus they can rob your money without being punished.

Most of victims may choose to compromise and send the ransom fees to exchange their precious files but are you sure that these cyber criminal who created Bitmessage virus will recovere your files after you pay? Our research team found that there is no guarantee on such payment, lots of victims paid lots of money but still lost all files. Therefore, we suggest not to pay money to these hackers. It is a huge risk, not only on your money , but your private information such as banking accounts. Your credit cards and banking accounts may even be hacked by Bitmessage if you pay the ransom money.

In such a situation, the right things you need to do is: 1. Remove all malicious files, codes of Bitmessage and related threats from your system completely; 2. Restore your files with your back-up (if available), or use third party legitimate data recovery software to recover your files. In case you are a victims of Bitmessage ransomware, follow the guide below to cure your computer now and try your luck with the data recovery tools to save your files. We hope this tutorial will be helpful to you.

Bitmessage Removal Tutorial

First Method – Manually Remove Bitmessage (For Users with Expert Skills)

Second Method – Automatically Remove Bitmessage Quickly and Safely (Easy For All Computer Users)


First Method – Bitmessage Manual Removal

Step 1 – End Bitmessage process in Task Manager.

1. Press “Ctrl+ Shift + Esc” keys to call out Windows Task Manager
2. Click Processes > find Bitmessage process or suspicious processes and select End process.
remove Bitmessage virus

Step 2 – Uninstall Bitmessage and suspicious programs from Control Panel.

Windows 10 : Click Start Menu >> Click All Apps >> Find out Bitmessage and other unwanted programs, then right-click on it and select Uninstall:
get rid of Bitmessage

delete Bitmessage

Windows 8
  • Move the mouse to the lower-left corner of the screen and clicking the Start button;
  • Type “control panel” in search box and then click Control Panel.
  • Find Bitmessage and unwanted programs >> click Uninstall

Bitmessage removal

how do i remove Bitmessage
Win 7 / Vista / XP
  • Click Start button >> click Control Panel in Start Menu
  • Click Uninstall a program to open Programs and Features
  • Find Bitmessage and unwanted programs >> click Uninstall

 

how can i get rid of Bitmessage
how do i delete Bitmessage

Step 3 Remove Bitmessage related registry files in Registry.

  • Press Win + R keys together to open Run window
  • Type “regedit” and click OK
  • Find out all related registry files of Bitmessage:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWpm
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain “Default_Page_URL”
HKEY_LOCAL_Machine\Software\Classes\[adware name]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\random
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run\random
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0


(Note – This guide is only provided as an reference to help you get rid of Bitmessage ransomware to make your PC healthy and prevent new files being infected. We cannot promise that the recommended tools can recover every user’s files which have been encrypted by the most dangerous ransomware such as Bitmessage. Wish you with good luck!)

———————————————————————————
Tips on Prevent Virus and Malware Such as Bitmessage
If you want to keep your PC from all kinds viruses and malware active online, you need to always follow these rules while using your PC:
1. Always choose Custom Installation while installing freeware so that you can deselect unwanted options or cancel unauthorized change;
2. Always scan attachments in emails before you open it; never open any attachment or click links on emails which you do not know if it is safe;
3. Do not visit any porn website because most of porn websites embedded with malicious codes from cyber criminal;
4. Always scan torrent files and other files downloaded from third party website before you open them;
5. Never update any of your software from third party website; make sure the software update alert appearing on your screen is from official website;

6. Do not click ads (e.g. “Ads by “, “Ads brought by “, “Ads powered by “, etc. ) which do not belong to the websites you visit.

How To Get WiFi Password of your Friends without Rooting

Method Number 1

Important Information

 

First of all you have to download Wi-Fi WPS WPA TESTER from Google Play Store

This app can hack only WPS & WPA routers. It cannot Hack WPA2 Router to hack password. and it only support Latest Version of Android, Android 5.O or later then it so your android must be updated.

1. Install the Wi-Fi WPS WPA TESTER from Google Play Store and open the app.
Also Read: Best Hacking Apps for Android Phones 2016

2. Click onto the Refresh button it will show your available networks.

3. If it shows a red icon after network name then it cannot hack it and if it show green icon then it can hack the password.

4. Select the Green network.

5. Now click on connect automatic pin it will try to connect to network with its designed algorithm, and will take maximum 1 minute to show you the results.

If you do not get success with this method I mean app then there is a second app which is more powerful than this one and can also try to hack WPS protected networks.

Heartbleed – Best Hacking Technique 2014

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

What leaks in practice?

We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

How to stop the leak?

As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.


Q&A

WHAT IS THE CVE-2014-0160?

CVE-2014-0160 is the official reference to this bug. CVE (Common Vulnerabilities and Exposures) is the Standard for Information Security Vulnerability Names maintained by MITRE. Due to co-incident discovery a duplicate CVE, CVE-2014-0346, which was assigned to us, should not be used, since others independently went public with the CVE-2014-0160 identifier.

WHY IT IS CALLED THE HEARTBLEED BUG?

Bug is in the OpenSSL’s implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.

WHAT MAKES THE HEARTBLEED BUG UNIQUE?

Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.

IS THIS A DESIGN FLAW IN SSL/TLS PROTOCOL SPECIFICATION?

No. This is implementation problem, i.e. programming mistake in popular OpenSSL library that provides cryptographic services such as SSL/TLS to the applications and services.

WHAT IS BEING LEAKED?

Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories: 1) primary key material, 2) secondary key material and 3) protected content and 4) collateral.

WHAT IS LEAKED PRIMARY KEY MATERIAL AND HOW TO RECOVER?

These are the crown jewels, the encryption keys themselves. Leaked secret keys allow the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. All this has to be done by the owners of the services.

WHAT IS LEAKED SECONDARY KEY MATERIAL AND HOW TO RECOVER?

These are for example the user credentials (user names and passwords) used in the vulnerable services. Recovery from this leak requires owners of the service first to restore trust to the service according to steps described above. After this users can start changing their passwords and possible encryption keys according to the instructions from the owners of the services that have been compromised. All session keys and session cookies should be invalidated and considered compromised.

WHAT IS LEAKED PROTECTED CONTENT AND HOW TO RECOVER?

This is the actual content handled by the vulnerable services. It may be personal or financial details, private communication such as emails or instant messages, documents or anything seen worth protecting by encryption. Only owners of the services will be able to estimate the likelihood what has been leaked and they should notify their users accordingly. Most important thing is to restore trust to the primary and secondary key material as described above. Only this enables safe use of the compromised services in the future.

WHAT IS LEAKED COLLATERAL AND HOW TO RECOVER?

Leaked collateral are other details that have been exposed to the attacker in the leaked memory content. These may contain technical details such as memory addresses and security measures such as canaries used to protect against overflow attacks. These have only contemporary value and will lose their value to the attacker when OpenSSL has been upgraded to a fixed version.

RECOVERY SOUNDS LABORIOUS, IS THERE A SHORT CUT?

After seeing what we saw by “attacking” ourselves, with ease, we decided to take this very seriously. We have gone laboriously through patching our own critical services and are dealing with possible compromise of our primary and secondary key material. All this just in case we were not first ones to discover this and this could have been exploited in the wild already.

HOW REVOCATION AND REISSUING OF CERTIFICATES WORKS IN PRACTICE?

If you are a service provider you have signed your certificates with a Certificate Authority (CA). You need to check your CA how compromised keys can be revoked and new certificate reissued for the new keys. Some CAs do this for free, some may take a fee.

AM I AFFECTED BY THE BUG?

You are likely to be affected either directly or indirectly. OpenSSL is the most popular open source cryptographic library and TLS (transport layer security) implementation used to encrypt traffic on the Internet. Your popular social site, your company’s site, commerce site, hobby site, site you install software from or even sites run by your government might be using vulnerable OpenSSL. Many of online services use TLS to both to identify themselves to you and to protect your privacy and transactions. You might have networked appliances with logins secured by this buggy implementation of the TLS. Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

HOW WIDESPREAD IS THIS?

The most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66% according toNetcraft’s April 2014 Web Server Survey. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Fortunately many large consumer sites are saved by their conservative choice of SSL/TLS termination equipment and software. Ironically smaller and more progressive services or those who have upgraded to latest and best encryption will be affected most. Furthermore OpenSSL is very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates.

WHAT VERSIONS OF THE OPENSSL ARE AFFECTED?

Status of different versions:

  • OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
  • OpenSSL 1.0.1g is NOT vulnerable
  • OpenSSL 1.0.0 branch is NOT vulnerable
  • OpenSSL 0.9.8 branch is NOT vulnerable

Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

HOW COMMON ARE THE VULNERABLE OPENSSL VERSIONS?

The vulnerable versions have been out there for over two years now and they have been rapidly adopted by modern operating systems. A major contributing factor has been that TLS versions 1.1 and 1.2 came available with the first vulnerable OpenSSL version (1.0.1) and security community has been pushing the TLS 1.2 due to earlier attacks against TLS (such as the BEAST).

HOW ABOUT OPERATING SYSTEMS?

Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:

  • Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
  • Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
  • CentOS 6.5, OpenSSL 1.0.1e-15
  • Fedora 18, OpenSSL 1.0.1e-4
  • OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
  • FreeBSD 10.0 – OpenSSL 1.0.1e 11 Feb 2013
  • NetBSD 5.0.2 (OpenSSL 1.0.1e)
  • OpenSUSE 12.2 (OpenSSL 1.0.1c)

Operating system distribution with versions that are not vulnerable:

  • Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
  • SUSE Linux Enterprise Server
  • FreeBSD 8.4 – OpenSSL 0.9.8y 5 Feb 2013
  • FreeBSD 9.2 – OpenSSL 0.9.8y 5 Feb 2013
  • FreeBSD 10.0p1 – OpenSSL 1.0.1g (At 8 Apr 18:27:46 2014 UTC)
  • FreeBSD Ports – OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

HOW CAN OPENSSL BE FIXED?

Even though the actual code fix may appear trivial, OpenSSL team is the expert in fixing it properly so fixed version 1.0.1g or newer should be used. If this is not possible software developers can recompile OpenSSL with the handshake removed from the code by compile time option -DOPENSSL_NO_HEARTBEATS.

SHOULD HEARTBEAT BE REMOVED TO AID IN DETECTION OF VULNERABLE SERVICES?

Recovery from this bug might have benefitted if the new version of the OpenSSL would both have fixed the bug and disabled heartbeat temporarily until some future version. Majority, if not almost all, of TLS implementations that responded to the heartbeat request at the time of discovery were vulnerable versions of OpenSSL. If only vulnerable versions of OpenSSL would have continued to respond to the heartbeat for next few months then large scale coordinated response to reach owners of vulnerable services would become more feasible. However, swift response by the Internet community in developing online and standalone detection tools quickly surpassed the need for removing heartbeat altogether.

CAN I DETECT IF SOMEONE HAS EXPLOITED THIS AGAINST ME?

Exploitation of this bug does not leave any trace of anything abnormal happening to the logs.

CAN IDS/IPS DETECT OR BLOCK THIS ATTACK?

Although the heartbeat can appear in different phases of the connection setup, intrusion detection and prevention systems (IDS/IPS) rules to detect heartbeat have been developed. Due to encryption differentiating between legitimate use and attack cannot be based on the content of the request, but the attack may be detected by comparing the size of the request against the size of the reply. This implies that IDS/IPS can be programmed to detect the attack but not to block it unless heartbeat requests are blocked altogether.

HAS THIS BEEN ABUSED IN THE WILD?

We don’t know. Security community should deploy TLS/DTLS honeypots that entrap attackers and to alert about exploitation attempts.

CAN ATTACKER ACCESS ONLY 64K OF THE MEMORY?

There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.

IS THIS A MITM BUG LIKE APPLE’S GOTO FAIL BUG WAS?

No, this does not require a man in the middle attack (MITM). Attacker can directly contact the vulnerable service or attack any user connecting to a malicious service. However in addition to direct threat the theft of the key material allows man in the middle attackers to impersonate compromised services.

DOES TLS CLIENT CERTIFICATE AUTHENTICATION MITIGATE THIS?

No, heartbeat request can be sent and is replied to during the handshake phase of the protocol. This occurs prior to client certificate authentication.

DOES OPENSSL’S FIPS MODE MITIGATE THIS?

No, OpenSSL Federal Information Processing Standard (FIPS) mode has no effect on the vulnerable heartbeat functionality.

DOES PERFECT FORWARD SECRECY (PFS) MITIGATE THIS?

Use of Perfect Forward Secrecy (PFS), which is unfortunately rare but powerful, should protect past communications from retrospective decryption. Please seehttps://twitter.com/ivanristic/status/453280081897467905 how leaked tickets may affect this.

CAN HEARTBEAT EXTENSION BE DISABLED DURING THE TLS HANDSHAKE?

No, vulnerable heartbeat extension code is activated regardless of the results of the handshake phase negotiations. Only way to protect yourself is to upgrade to fixed version of OpenSSL or to recompile OpenSSL with the handshake removed from the code.

WHO FOUND THE HEARTBLEED BUG?

This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomiconand Neel Mehta of Google Security, who first reported it to the OpenSSL team. Codenomicon team found heartbleed bug while improving the SafeGuard feature in Codenomicon’s Defensics security testing tools and reported this bug to the NCSC-FI for vulnerability coordination and reporting to OpenSSL team.

WHAT IS THE DEFENSICS SAFEGUARD?

The SafeGuard feature of the Codenomicon’s Defensics security testtools automatically tests the target system for weaknesses that compromise the integrity, privacy or safety. The SafeGuard is systematic solution to expose failed cryptographic certificate checks, privacy leaks or authentication bypass weaknesses that have exposed the Internet users to man in the middle attacks and eavesdropping. In addition to the Heartbleed bug the new Defensics TLS Safeguard feature can detect for instance the exploitable security flaw in widely used GnuTLS open source software implementing SSL/TLS functionality and the “goto fail;” bug in Apple’s TLS/SSL implementation that was patched in February 2014.

WHO COORDINATES RESPONSE TO THIS VULNERABILITY?

Immediately after our discovery of the bug on 3rd of April 2014, NCSC-FI took up the task of verifying it, analyzing it further and reaching out to the authors of OpenSSL, software, operating system and appliance vendors, which were potentially affected. However, this vulnerability had been found and details released independently by others before this work was completed. Vendors should be notifying their users and service providers. Internet service providers should be notifying their end users where and when potential action is required.

IS THERE A BRIGHT SIDE TO ALL THIS?

For those service providers who are affected this is a good opportunity to upgrade security strength of the secret keys used. A lot of software gets updates which otherwise would have not been urgent. Although this is painful for the security community, we can rest assured that infrastructure of the cyber criminals and their secrets have been exposed as well.

WHAT CAN BE DONE TO PREVENT THIS FROM HAPPENING IN FUTURE?

The security community, we included, must learn to find these inevitable human mistakes sooner. Please support the development effort of software you trust your privacy to. Donate money to the OpenSSL project.

WHERE TO FIND MORE INFORMATION?

This Q&A was published as a follow-up to the OpenSSL advisory, since this vulnerability became public on 7th of April 2014. The OpenSSL project has made a statement athttps://www.openssl.org/news/secadv_20140407.txt. NCSC-FI published an advisory athttps://www.cert.fi/en/reports/2014/vulnerability788210.html. Individual vendors of operating system distributions, affected owners of Internet services, software packages and appliance vendors may issue their own advisories.

REFERENCES

LaZagne – Password Recovery Tool For Windows & Linux

The LaZagne project is an open source password recovery tool used to retrieve passwords stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases and so on). This tool has been developed for the purpose of finding these passwords for the most commonly-used software. At this moment, it supports 22 Programs on Microsoft Windows and 12 on a Linux/Unix-Like operating systems.

LaZagne - Password Recovery Tool For Windows & Linux

It supports a whole bunch of software including things like CoreFTP, Cyberduck, FileZilla, PuttyCM, WinSCP, Chrome, Firefox, IE, Opera, Jitsi, Pidgin, Outlook, Thunderbird, Tortoise, Wifi passwords and more.

Usage

Retrieve version

Launch all modules

Launch only a specific module

Launch only a specific software script

Write all passwords found into a file (-w options)

Use a file for dictionary attacks (used only when it’s necessary: mozilla masterpassword, system hahes, etc.). The file has to be a wordlist in cleartext (no rainbow), it has not been optimized to be fast but could useful for basic passwords.

Change verbosity mode (2 different levels)

You can download laZagne here:

Windows – laZagne-Windows.zip
Source – Source-1.1.zip