Showing posts with label computer hacks. Show all posts
Showing posts with label computer hacks. Show all posts

Wednesday, July 4, 2018

The Basics

Install the First Version of Windows, If It’s Not Already Installed

Shrink Your Windows Partition

Install the Second Version of Windows

Choosing Your OS and Modifying Boot Settings


Saturday, June 30, 2018


While the smartphone has made many of our work easier, there is also a concern about security. Where, when a hacker breaks into our smartphone and stole our most important information, this fear remains often. To overcome this, the scientists continue to develop a better security system. Many smartphones include facial recognition, fingerprint scans and other biometric systems. However, the trouble with these easy-to-use tools is that once compromised they cannot be reset.

But now, American scientists have developed a security system that will use the smartphone's password as the brain of the user after it's been in the market. Smartphones will be unlocked only by recognizing the brainwaves in response to a series of pictures - an advance that could better protect devices from hackers. According to the scientists at Buffalo University, electroencephalography (EEG) is currently a very easy system, through which the waves of the brain can be recorded.

"You can't grow a new fingerprint or iris if that information is divulged," said Wenyao Xu, an assistant professor at the University at Buffalo (UB) in the US. "That's why we're developing a new type of password - one that measures your brainwaves in response to a series of pictures. Like a password, it's easy to reset; and like a biometric, it's easy to use," said Xu.

The "brain password," which presently would require users to wear a headset, but in the future, it has to be tried to make it even better. It could have implications in banking, law enforcement, airport security and other areas.

"To the best of our knowledge, this is the first in-depth research study on a truly cancelable brain biometric system. We refer to this as 'hard cancellation,' meaning the original brain password can be reset without divulging the user's identity," said Zhanpeng Jin, an associate professor at UB.
get the latest hacking gist here
We have consistently seen various vectors of attack rear their head when it comes to Android smartphones. We’ve seen Shattered Trust, Cloak and Dagger, and Rowhammer, just to name a few. RAMpage is the latest one on the block, and while it is a hardware vulnerability, it doesn’t necessarily need physical access to your device to exploit. How it works is relatively simple.

A group of university researchers have discovered that this vulnerability could theoretically work on any device with LPDDR memory, which includes virtually every smartphone released since 2012, including some Apple devices.

When a CPU reads or writes a row of bits in the RAM module present on the device, the neighbouring rows are slightly affected due to a tiny electric discharge. This isn’t usually a problem as we know RAM does this and that’s why it’s periodically refreshed to make sure nothing goes wrong. But what if we start “hammering” the same “row”? What if we continuously read or write to the same row in order to disrupt neighbouring rows? This can cause a bit-flip in a memory row that we shouldn’t own or have access to at all. That’s what Rowhammer is, and it’s being used as part of a larger vulnerability called RAMpage. The CVE is CVE-2018-9442 and it affects devices shipped with LPDDR2, LPDDR3, or LPDDR4 RAM.

RAMpage can be used to gain root access on a device, but the researchers managed to get it to do a whole lot more as well. It could be used to bypass JavaScript sandboxes and even perform an attack running on another virtual machine on the same computer on x86 devices. ARM-based devices are also vulnerable, and that’s where our Android phones come in. DRAMMER stands for “Deterministic Rowhammer Attacks on Mobile Devices”.

The attack allows a hacker access to the entire operating system. This includes accessing the data stored by other applications, which the Android security model is meant to prevent. An attacker can gain full control of a device allowing them to obtain stored passwords, personal photos, emails, instant messages and even business-critical documents.
get the latest hacking gist here

Friday, June 29, 2018

Cisco patches critical vulnerabilities

Cisco released patches for 34 vulnerabilities that include 5 critical, 20 high and 9 medium vulnerabilities. The 5 critical vulnerabilities are in FXOS and NX-OS and NX-API software and could allow an attacker to execute remote arbitrary code that could cause a buffer overflow or in other cases may lead to a DoS attack.

You'll need to wade through Cisco's advisories to work out if the software you're running is vulnerable or already fixed.

All of the critical flaws have a CVSS score of 9.8 out of 10 and four of them affect the FXOS and NX-OS Cisco Fabric Services because FXOS/NX-OS "insufficiently validates header values in Cisco Fabric Services packets," according to the security notice. The last critical flaw affects the NX-API feature of NX-OS.

The critical Smart Install flaw has affected 8.5 million devices till now.

The Cisco patch will fix the issues CVE-2018-0308, CVE-2018-0304, CVE-2018-0314 and CVE-2018-0312.

 ▬ MDS 9000 Series Multilayer Switches
▬ Nexus 2000 Series Fabric Extenders
▬ Nexus 3000 Series Switches
▬ Nexus 3500 Platform Switches
▬ Nexus 5500 Platform Switches
▬ Nexus 5600 Platform Switches
▬ Nexus 6000 Series Switches
▬ Nexus 7000 Series Switches
▬ Nexus 7700 Series Switches
▬ Nexus 9000 Series Switches in a standalone NX-OS mode
▬ Nexus 9500 R-Series Line Cards and Fabric Modules
▬ Firepower 4100 Series Next-Generation Firewalls
▬ Firepower 9300 Security Appliance
▬ UCS 6100 Series Fabric Interconnects
▬ UCS 6200 Series Fabric Interconnects
▬ UCS 6300 Series Fabric Interconnects

The NX-API vulnerability is caused by an incorrect input validation in the authentication module of the NX-API subsystem which can be exploited if an attacker were to send a crafted HTTP or HTTPS packet to the management interface of an affected system with the NX-API feature enabled.

The four affecting Cisco Fabric Services are because FXOS/NX-OS "insufficiently validates header values in Cisco Fabric Services packets".
get the latest hacking gist here

Monday, June 25, 2018

Twitter flaw allows you to hack from any account

Twitter flaw allows you to hack from any account

A huge bug in Twitter’s ad service network could allow anyone to tweet from anyone’s handle with ease. This wasn’t detected until a security researcher found the flaw in Twitter’s Ad Studio.

The hacker ‘kedrisch’ claimed to have uncovered the issue while exploring Twitter's code for bugs. He said the flaw could give cybercriminals the ability to "publish entries in Twitter-network by any user of this service."

Twitter did their research on the topic and quickly blocked the hole. "By sharing media with a victim user and then modifying the post request with the victim's account ID the media in question would be posted from the victim's account," Twitter wrote in its summary of the bug.

Meanwhile, the company fixed the vulnerability three days later, and awarded the researcher with a bounty of $7,560.

How to Hack Facebook Password

Need to Hack Facebook Password?
Here’s a Complete Guide on Possible Ways to Hack Facebook!
Note: Educational purposes only. Please the Disclaimer also

In the recent years, Facebook has also become a popular place for many to exchange secret messages and manage illicit relationships. Therefore, it’s no wonder many people decide to hack Facebook password of their loved ones. If you are in a similar situation or just want to hack the password of any Facebook account, this article is for you.
Recently, a lot of fake hacking websites have popped-up on the Internet. They usually make false promises to hack the Facebook password of any account. These sites often demand people to take-up a surveys in order to complete the password hacking process.
This is only a trick to make quick money by forcing people to take up surveys. However, upon completing of the survey no Facebook password is given to the people. So, I always warn my visitors about such scam websites and their fake promises about hacking Facebook.

Possible Ways to Hack a Facebook Password:

With over 10 years of experience, I can tell you is that there are only TWO ways to hack a Facebook password.:

1. Using a Keylogger –Easiest Way to Hack Facebook!

  • keylogger when installed will simply record each and every keystroke that a user types on the keyboard including Facebook or any other account password.
  • Since keylogger requires no special skills to install and use, it is the easiest way to hack a Facebook password. I recommend the following keylogger program as the best one to gain access to Facebook or any other online account:
To Hack Facebook Users on PC/Mac:
Hack Facebook with Realtime-Spy
Why Realtime-Spy is the Best?
Realtime-Spy Top Features:
  • Remote Installation from any corner of the globe.
  • 100% stealth operation and remains undetected!
  • Extremely easy to use as it requires no special skills to install.
  • Compatible with Windows XP/Vista/7/8 (32 and 64-bit) andMac.

How it Works?

To hack the Facebook password, all you need to do is just install Realtime-Spy on the target computer. When the target user logs into his/her Facebook account from this computer, the login details are captured. The login details are then uploaded instantly to the Realtime-Spy servers. You can later access the stored logs to obtain the Facebook password.

DRM May Be Added to All Android Apps

Google has quietly rolled out a feature earlier this week that is adding a string of metadata to all the APK files when they are signed by the developer. While you can’t install the apps that haven’t been signed by the company during the final build so which suggests that there will be a small part of DRM built into the applications, eventually the phones will run on the version of Android that requires DRM to play or view the media content.

Many people are not a fan of DRM since developers and publishers of applications have been known to misuse it. One example of DRM usage would be to install an Origin client and check it regularly to run any games that are published by the EA.

Many companies fear that users are not paying for content that companies publish with most of PC games rife with DRM. While Google may not go crazy like EA have, the company is thinking in a different way where the metadata tag will help Google PlayStore to identify the applications.

Android has a feature that helps it to read the metadata of the applications which is embedded into the application to find if the applications developed are from a legitimate source, if the application passes the checks made by the Android OS then the applications will be automatically added into your Google play library.

Google did this because of two reasons the first one would be that adding DRM will give the app developers more power and control over the application on the clients mobile. In many less affluent countries, many users can’t afford data so they share the apps using a peer to peer method, hence it would be useful for Android OS to check the integrity of the application.

The 5 Best Virtual Private Networks To Preserve Your Privacy

In my never-ending quest to thwart the evil forces of the National Security Agency, I am always trying out new ways to conceal who I am and what I am doing online. I am not doing anything illegal or morally questionable (unless you count David Hasselhoff music as ‘morally questionable’). I’m simply of the fierce belief that it is nobody’s business, except my own, what I do online. One method I use is to constantly look for the best virtual private networks.

A virtual private network (VPN) preserves my privacy by concealing my location. There are many reasons why you would want to conceal where you are. First, marketers and even your ISP provider like to collect this sort of user information to help compile dossiers about you which can be sold to the highest bidder. Your IP address, which identifies your location and then your computer, can also be used by hackers to break into your network.

Finally, spoofing your location enables you to get around geolocation-dependent sites such as Netflix, and in some cases, YouTube videos not available in your actual country (“Saturday Night Live” for example does not allow anyone outside the US to view their videos). Although recently Netflix and other streaming video sites, such as Hulu, can automatically detect if you are behind a proxy server and if so, block you. VPN companies used to make it a priority to get around these new restrictions, but as one VPN company told me recently “we have more important things to focus on right now, than someone not getting the new season of “Orange Is The New Black“.
But to date, a VPN still works for BBC iPlayer if you are outside the UK (at least for the moment – the BBC is always making noises about emulating Netflix and blocking non-UK viewers).
youtube
Changing and concealing your IP address is not a big deal. In fact, once the VPN software has been installed, it is a simple case of clicking a button and waiting for the VPN to connect. The VPN will then redirect your web traffic onto their servers in the country you specified, making you invisible and impossible to track. Impossible because VPN companies do not keep logs of who used their service when to visit where. So if the government and law enforcement came knocking, the VPN company would have literally nothing to give them.
Saying that, before signing up for a VPN, you should always ask them first what their policies are towards law enforcement approaches and how they deal with court orders. You should also get them to confirm they don’t keep user logs.
The one big downside of a VPN, in my opinion, is that your web connection will start to get sluggish and slow down at various points. After all, you are now at the mercy of the VPN company’s servers. They go slow, you go slow. The generally accepted method is to either a) turn if off then back on again, or b) choose a VPN server closer to where you live (the one furthest away are the slowest). So since I am in Germany, I tend to stick to servers in France, the Netherlands, and sometimes Spain.
So which ones are the best? We took several on a trial run into the laboratory to see what works and what doesn’t.
beaker
Before we start, an important point should be noted. Do NOT use free VPN services. VPN companies are like any other company – they need to make a profit somewhere. So if you are not paying them, that means selling your user information to third-party companies – which defeats the whole purpose of using a VPN in the first place. As you know, I like free stuff, but sometimes you have to pay for something to get the full benefit of it.
So we will only be looking at paid options, which will run you to no more than a few dollars per month. One less Starbucks coffee a month in exchange for your privacy. That’s a good deal.

The 5 Best Virtual Private Networks

Tunnelbear

tunnelbear vpn
Up until recently (when I discovered ProtonVPN – more on that in a moment), Tunnelbear was my all-time favourite VPN (I am a beta tester for Tunnelbear by way of full disclosure). It was literally a case of “install it then click the switch”. Even the village idiot couldn’t mess this up. You just choose your country, click the “connect” switch, and you’re off to the races.
There is also a built-in feature which will temporarily block your Internet connection if you lose your Tunnelbear connection for a moment (thereby preventing any accidental revealing of your location).
tunnelbear
Tunnelbear has come a very long way over the years. It used to be a teak wood radio-type machine with blue sound-waves. Now they have designed a stylish map (see above), where you can see the bear tunnelling to different countries.
You get a very limited amount of data for free (which can be slightly supplemented if you tweet about them and tag them in the tweet). But that limited data is used up very quickly, forcing you to upgrade if you want to jump onto BBC iPlayer. Unlimited data can be had for a very reasonable $5 per month, with no minimum commitment.
Tunnelbear is available for Windows, Mac, iOS, and Android. They also provide browser extensions for Chrome and Opera. The team is also extremely friendly and helpful.

ProtonVPN

protonvpn
ProtonVPN is a new arrival to the VPN industry, but the kicker is that it is only available to paid users of Protonmail, which is encrypted email based in Switzerland. If you are paying the few bucks a month to unlock more Protonmail features (and also help keep them in business), then look upon ProtonVPN as a fringe membership benefit. And it is well worth it. I am so blown away that Tunnelbear and I might be getting divorced.
ProtonVPN has a cool feature called Secure Core. This is where it protects you against the possibility that one of their servers may be “compromised” in a high-risk country (such as the US). It protects you by redirecting the traffic from that compromised server to ANOTHER server in ANOTHER country. So essentially you are being rerouted through two proxy servers simultaneously – without any noticeable extra speed lag. Choose a pair of countries closest to you to increase the VPN speed. I tried France–>Sweden and there was no difference in speed whatsoever. Extremely impressive.
If you want to use ProtonVPN, sign up for Protonmail and then upgrade the email account to a paid one (which roughly comes to almost the same price as Tunnelbear). Then sign into ProtonVPN with your email credentials.
Currently there is only a Windows version of ProtonVPN but technically you can get it to work on Mac and Linux with a bit of finagling.

ExpressVPN

expressvpn
I have heard many good things about ExpressVPN, and the fact they have servers in places like Costa Rica, Panama, and the Bahamas makes them unique. Not many VPN’s have diverse locations like this – VPN’s normally stick to the usual places – North America, Europe, Asia, and maybe Australia. But ExpressVPN goes to a few other places in between, 145 servers in a total of 94 countries (Mongolia and Bangladesh!). You can see the total list by going here and scrolling down.
ExpressVPN is priced slightly more expensive than Tunnelbear and ProtonVPN, with their monthly fee topping $12.95 if you go month-to-month. If you commit to 6 months and pay up-front, that monthly fee drops to $9.99, and if you commit to one year, one month is $8.32. Still way too expensive. But considering the extra locations on offer, some people may feel the extra cost is worth it. Payments can even be made by Bitcoin if you are so inclined.

NordVPN

nordvpn
NordVPN claims to have “double-data encryption”, which is allegedly “the tightest security in the industry“. Quite a bold statement to make, given their competition. They have more servers than ExpressVPN but are not as many countries. 908 servers around the world in 57 countries. As they say on their website “we cover every continent except Antarctica. But only because penguins just don’t get the Internet“.
They also make it very clear on their site that they keep no logs, and they have what they call an “automatic kill switch”, which is similar to what Tunnelbear has (blocking your Internet connection if you lose your VPN connection first). One other interesting feature is that they claim to welcome file sharers. Some VPN’s, such as Tunnelbear, discourages using their VPN for things like uTorrent, making it clear their software is not designed for that, but NordVPN goes in the other directionand lays out the welcome mat.
NordVPN currently has a 2 year deal which, if paid up-front, lowers your monthly fee to $3.29, which is the best of the bunch here. Otherwise the one year plan is $5.75 a month, and the commitment-phobic crowd would have to pay an eye-watering $11.95 per month for going month-to-month.

VyprVPN

vyprvpn
VyprVPN claims to be the “world’s most powerful VPN” and with NordVPN’s “tightest security in the industry“, you have a pair of VPN companies making rather bold audacious statements.
According to their website, VyprVPN has 200,000+ IP addresses on 700+ servers in 70 countries. They claim their Chameleon software (available in their Premium package) can bypass Chinese Government internet restrictions, as well as government restrictions in Russia, India, Turkey, Iran, and Syria. That alone may close the deal for many people who are in these places and need something a bit more robust to get around government censorship.
They also have their own DNS service called VyprDNS, which comes included with the VPN. DNS services are used by your ISP to log the websites you visit, and in the process, the government can censor the ones they don’t want you to see by rerouting you to error pages. By rerouting your web traffic through VyprVPN, your web activity can be unfiltered and unrestricted.
There are two plans you can choose from – the basic plan and the Premium plan. The basic plan gets you the VPN service, unlimited usage, and 3 simultaneous connections. If you commit to one year, it is $5 per month, and $9.95 per month if billed monthly. The Premium package gives you the VPN service, unlimited usage, 5 simultaneous connections, the Chameleon technology, and access to something called VyprVPN Cloud.

Conclusion

Some of you are probably thinking that all this VPN business is total overkill, the old “I’ve got nothing to hide” routine. But the more information companies can compile on you, the more spam you will receive, and the more your life may be negatively affected. If you are logged visiting health websites, your health insurance company may hike up your premiums for example, and you may start to see explicit and objectionable material on your monitor screen, if a site like Facebook misinterprets something you have visited online. If young children are on your computer, this would not be a very good scenario to see happen.
Do you use any of the 5 virtual private networks listed here? Or would you recommend another one? Give us your recommendations in the comments below.

How To Download From The US iTunes If You Are Not In The US

Sometimes when an app is developed and released, the company behind it forgets that there is a world outside the United States and releases it to the US iTunes store only. So while everyone in the US is downloading the app and putting it through its paces, everyone in the rest of the world is frustrated that they can’t get their hands on it.
Apple doesn’t advertise this fact for obvious reasons, but no matter where you are in the world, you can have a US-registered iTunes account. The only drawback is that any credit card attached to the account must be a US one. So more than likely, you can only use your US account for free downloads.
Here is how to make your US iTunes account.

Make a US iTunes Account If You Are Outside The US

Open up iTunes and on the right hand side, there is a link which says “Account“. Click on that. Make sure first that you are logged out of all other accounts.
When the login box comes up, click “Create Apple ID”. If that button isn’t there, then it means you’re already logged into another account. Go back and log out of that account first.
Enter your email address, a password, and choose “United States” as your country. Tick the terms and conditions box, then “Continue” at the bottom right.
Apple probably wouldn’t approve of people doing this, so just to be safe, make a throwaway email address for this account. You don’t want to run the risk of compromising your main Apple account if they found out.

On the next screen, fill out the details. You may want to consider using a fake name (it won’t be checked by Apple). However, since this account is only for this article, and therefore will never be used, I just put my real name down.
OK, on the next screen, under “Payment Method“, choose “None“. This will make the payment method section disappear.
Then it’s time to leave an address. This is where you need to get creative. There are many places to get an address.
You will also need to enter a phone number. Just make something up.
You will then be told that a verification code is being sent to the email address you registered with. When the six digit code arrives, enter it and your account is active.
Now log in and start downloading that cool new app from Google.

One Drawback

One drawback I have found is if you are running two Apple accounts on your iPhone or iPad, then you can obviously only be logged into one account at a time.
This means if there are any updates for the apps downloaded under the other account, you won’t get them until you log out of one account and log into the other. A minor annoyance but nothing too serious. A toggle button for more than one Apple account would be nice, Apple.

Conclusion

On the one hand, I am not sure how much Apple would approve of people doing this. On the other hand, they could easily stop it with geoblocking non-US IP addresses. So perhaps they don’t care.
Either way, take precautions and don’t use any information tied to your main Apple account, the one with the paid purchases. Otherwise you may find both accounts shut down

Popular Posts

Recent Posts

Text Widget