Posts

Showing posts from 2013

10 Windows 7 commands that every administrator should know....

PC troubleshooting is becoming less common in larger organizations, but consultants and techs in smaller shops still have to get their hands dirty identifying and fixing desktop problems. Oftentimes, troubleshooting Windows 7 means delving into the command line. Here are 10 fundamental Windows 7 commands you might find helpful. Before I begin... This article is intended solely as an introduction to some useful troubleshooting commands. Many of them offer numerous optional switches, which I won't cover here due to space limitations. 1: System File Checker Malicious software will often attempt to replace core system files with modified versions in an effort to take control of the system. The System File Checker can be used to verify the integrity of the Windows system files. If any of the files are found to be missing or corrupt, they will be replaced. You can run the System File Checker by using this command: sfc /scannow 2: File Signature Verification One way to verify the integri…

Wi-Fi replaced by Li-Fi in China?

Image
Chinese scientists have successfully developed a new cheaper way of getting connected to internet by using signals sent through light bulbs instead of radio frequencies as in 'Wi-Fi', a move expected to radically change process of online connectivity. 

Four computers can be connected to internet through one- watt LED bulb using light as a carrier instead of traditional radio frequencies, as in Wi-Fi, said Chi Nan, an information technology professor with Shanghai's Fudan University. Under the new discovery dubbed as 'Li-Fi', a light bulb with embedded microchips can produce data rates as fast as 150 megabits per second, which is speedier than the average broadband connection in China, said Chi, who leads a Li-Fi research team including scientists from the Shanghai Institute of Technical Physics of the Chinese Academy of Sciences.

 Four computers can be connected to internet through one- watt LED bulb using light as a carrier instead of traditional radio frequencies. …

Syrian Hackers hacked TrueCaller

Image
Syrian hackers known for their hardcore support for President Bashar Ul Assad from Syrian Electronic Army are back in news, this time the army has claimed to have breached into the official website of Swedish based TrueCaller (truecaller.com), a global phone directory application for smartphones and feature phones, and accessible via a Web site. The claim was announced by the hackers on their official website, saying that the databases contains hundred of millions of phone numbers and details of who owned these numbers, in addition of millions of Facebook, Twitter, Linkedin and Gmail accounts. Apart of that, the information has been dumped and sent to Syrian government. The list of the databases that been downloaded is mentioned below: truecaller_ugc: 459GBtruecaller : 100GBtruecaller_profiles : 4GBtruecaller_api : 123KBtruecaller_PushMe: 2.2KBtc_admin : 7MBtc_www: 70MBSyrian Electronic Army has released a screenshot of TrueCaller website’s that shows the hackers are logged in to the sit…

Anonymous hacks FEMA

Image
A group of Anonymous hacker has said to hack into a server used by Federal Emergency Management. According to them, the data secured through this breach is highly prolific and could beat the recent documents leaked by Snowdenon PRISM project. In one of the documents published online the group unleashed the type of data they have gotten hold of. Most of it was email address and passwords of users which seem to government employees because most of the email addresses were hosted to .gov or .mil. The Anonymous group also disclosed the reasons behind this hack, according to them, they wanted disclose them as force especially in relation to crackdown attempts made against the hackers these days.Furthermore, they wanted government’s attention in regard to their intervention with the private sector for gathering sensitive information. One of Anonymous group’s member said: Anonymous does not wave the white flag. Not while we are faced with a daily stream of abominable revelations from Edward Snow…

Emails and Passwords of US Congress Hacked by Anonymous

Image
Anonymous hackers have claimed to breached the official website of US congress and its mail server (mail.house.gov and senate.gov), as a result around 1800 email addresses along with their passwords have been leaked online. Hackers claim that emails and passwords belong toUS Congress and their staff which have been compromised to make it clear on congress that Anonymous hackers have been keeping an eye on them over ongoing issues such as NSA, FISA and PRISM. The leaked data which has been dumped online shows email addresses and their clear-text passwords along with a message, which has been expressed in following words: For the purposes of being far too generous with you guys, we have removed some of the passwords and shuffled the order of the remaining ones,” the hackers wrote next to the data. These are all current, valid credentials but they are not in the original pairings. We reserve the right to spontaneously decide this restraint was unjustified.The leaked data seems legit but unc…

Turn Android Emulator into a Pwnage Weapon

Image
Today, we’re going to look at a scenario where the Android Emulator can be re-purposed as an exploitation tool. Specifically, we will look at attacks that involve cloning an application and user data from a stolen Android phone onto a computer running the Android emulator. An attacker that does this will be able to use the application as if they were the user. They would also be able to return the phone to the user before the target becomes aware of the compromise.
A natural defense to this sort of attack would be to have the application verify what device is running it before giving the user access. The application would only be allowed to run on a device registered with the user’s account. A natural defense against this kind of attack would be to have the application verify the device and to run only on a device registered with the user’s account.
We will demonstrate a new tool that repurposes the Android emulator to give false device information in order to subvert suc…

Transparent Computer Prototype Interface

Image
Computers have pretty much stayed the same since the visual user interface was introduced. It was a huge success when it was first released, and we’re still using upgraded versions of it today. But is there really no other concept of interacting with our computers than what we are using today? I mean, the keyboard and the mouse (and of course the WYSIWYG user interface) is good and all, but maybe a transparent computer could replace our now dated ways of interacting with computers. We have seen conceptual prototypes of transparent displays at conventions before, but not as a complete interaction solution. This transparent computer (and I don’t mean the actual computer here) is a pretty neat project that if further developed could come to change how we interact with computers in general. The system, dubbed the SpaceTop 3D Desktop Computer, works in several dimensions at once. Its purpose is to give the user new ways to manipulate, navigate and interact with what’s on the screen. With c…

Send Emails From Terminal Using Gmail

Image
Note: I’ve tested these steps on Ubuntu 12.04 and Fedora 16.
Security certificate
Before proceeding, we need Gmail’s security certificate on our system. Why? Gmail sends encrypted data over SSL (Secure Sockets Layer) for security; this certificate is necessary for encryption of data.
Ideally, you should have the file Equifax_Secure_CA.crt under /usr/share/ca-certificates/mozilla/. If you do, you’re ready to move on.
SSL Certificate
We want to connect to Google securely which means you'll need the latest SSL certificates. To get those, use the openssl client onyour machine. Run:
openssl s_client -connect imap.gmail.com:993 -showcerts which should show two blocks of
-----BEGINCERTIFICATE-----...-----ENDCERTIFICATE----- in the output. You'll want to take each block (including the BEGIN/END CERTIFICATE lines), and put each of them into their own file. I put the first one in a file gmail.crt and the second one in the file google.crt (since the first signs imap.gmail.com which …

Top five Web security assessment tools

Image
Scanning websites is an entirely different ballgame from network scans. In the case of websites, the scope of the scan ranges from Layer 2 to 7, considering the intrusiveness of the latest vulnerabilities. The correct approach for scanning websites starts from Web-level access, right up to scanning all backend components such as databases. While most Web security scanners are automated, there could be a need for manual scripting, based on the situation.
Nikto Let’s start with this tool because of its feature set. This open source tool is widely used to scan websites, mainly because it supports HTTP and HTTPS, and also provides findings in an interactive fashion. Nikto can crawl a website just the way a human would, and that too in the least amount of time. It uses a technique called mutation, whereby it creates combinations of various HTTP tests together to form an attack, based on the Web server configuration and the hosted code.
Thus, it finds critical loopholes such a…

Prevent a fork bomb by limiting user process

Image
 fork bomb is a denial-of-service attack whereby a process continually replicates itself to deplete available system resources. It can be prevented by limiting user processes.  Limiting user processes is important for running a stable system. To limit user process just add user name or group or all users to /etc/security/limits.conf file and impose process limitations. Understanding /etc/security/limits.conf file
<domain> can be:an user name a group name, with @group syntaxthe wildcard *, for default entrythe wildcard %, can be also used with %group syntax, for maxlogin limit<type> can have the two values:"soft" for enforcing the soft limits"hard" for enforcing hard limits<item> can be one of the following:core - limits the core file size (KB)<value> can be one of the following:core - limits the core file size (KB)data - max data size (KB)fsize - maximum filesize (KB)memlock - max locked-in-memory address space (KB)nofile - max number of op…

Defusing Fork Bomb

Image
Due to their nature, fork bombs can be difficult to stop once started. Stopping a fork bomb from reproducing further requires the termination of all running copies, which can be difficult to achieve. One problem faced is that a separate program to terminate the fork bomb cannot execute if the process table is fully saturated. The second major problem is that in the time taken between finding the processes to terminate and actually terminating them, more may have been created.
Some fork bombs can be stopped relatively easily. Consider the shell fork bomb:
:(){ :|: &};: By replacing the function identifier and re-indenting, the code reads:
bomb(){ bomb | bomb &}; bomb The fork bomb in this case is a recursive function that runs in the background, thanks to the ampersand operator. This ensures that the child process does not die and keeps forking new copies of the function, consuming system resources.
One important "feature" in this computer code means that …