Thursday, November 27, 2014

'Black Friday' and 'Cyber Monday' — 4 Scams To Watch Out For While Shopping



 Holiday Shopping season is really an excited time for both shoppers and retailers, but unfortunately it's a good time for cyber criminals and scammers as well.


With Black Friday (28th November 2014) and Cyber Monday (1st December 2014) coming up, you need to be more careful while shopping. These are the two very busy shopping days where shoppers spend millions online.
Every eye will be on retailers to ensure that consumers' online shopping experiences are straightforward and, most importantly, secure. So, at the major part, retailers need to pay attention to extra security measures in order to prevent themselves from massive data breaches, like Target data breach that occurred last year during the Black Friday sales in which over 40 million Credit & Debit cards were stolen.
Not just Target alone, multiple retailers including Neiman Marcus, Michaels Store were also targeted during last Christmas holiday, involving the heist of possibly 110 million Credit-Debit cards, and personal information.
So, in an effort to secure yourself from scammers you need to be aware of some top scams and tips to keep yourself safe online.

1. COPYCAT & FAKE WEBSITES
In order to fraud an online account holder's financial information, scammers could pose their website as a legitimate one. Like you got an email from Amazan.com for the hottest deals, and not Amazon, make sure before providing your financial details.
Check properly thrice who emails are from and if it's an unknown, best way is to avoid the email and the so-called hottest deal. Always go for a website using an HTTPS URL, before entering a password or any information like address or credit card number.
There are thousands of websites that closely resemble legitimate domains like Amazon, Google, Apple, Facebook and Microsoft. Apart from these, there are so many new sites offering online shopping, that it's quite difficult for customers to say which one is legitimate and which is not.
Many of these websites host exciting contests or advertisements for dodgy services to gain your attention and force your finger to click it, while others host malware that can infect your system when you browse to these websites.
So, to be in safer side, always shop from websites which you or your friends know. Just keep one thing in mind while shopping online that Website ratings and security seals can be faked and the website could look too good to be true, but probably it's not.
2. PHISHING WEBSITES
Phishing scams are typically fraudulent email messages, masquerading as a well known and trustworthy entity in an attempt to gather personal and financial information from victims. However, phishing attacks have become more sophisticated recently.
Keep an eye on scams emails claiming to come from legitimate sources which will ask you to visit a website actually hosted by cyber crooks in order to steal your personal information like email addresses, passwords, credit card numbers, expiration date, verification code, and more.
Always type website name in Google Search Engine and then visit the particular website from those search results, instead visiting through any link provided in messages or emails. Don't go to websites you've never heard of.
3. UNEXPECTED GIFTS SCAM
A year ago during Black Friday, one of the major scams was the cyber criminals offering $1,000 Best Buy gift cards, which nobody won. But, a lot of people ended up in giving away their personal information for no reason at all.
Online users are recommended to avoid such "unexpected gifts" scams, just like your dear ones recommend you to not accept unexpected gifts from strangers. Emails could be a major medium to offer you unwanted gifts, so be careful when opening attachments you receive by email - that special delivery could end up costing you.
4. FAKE ADS AND COUPONS
Customers on holiday season are always on search for great deals, especially on Black Friday and Cyber Monday, but your just a small mistake can lead you to danger. Miscreants use your desires by creating 'click-bait' ads or posting links to 'the best deal ever', which will always lead to either a survey, a scam site or even drive-by exploits.
Customers are advised to treat such offers with skepticism, especially when the source is unknown and unfamiliar to you. You are also advised to keep an updated Antivirus software onto their systems, so if any convincing advert does trick you and gain your click, your AV protects you against infection.

In addition to fake ads for Best Buy, users also want to look out for fake online coupons in general. If it sounds too good to be true, visit directly to reputable websites, and, by some miracle, the offer is true because it's Black Friday sales, it's all yours.

Monday, November 24, 2014

Successfully Conducted Ethical Hacking & Cyber Security Workshop Today @ city Central Library (23-Nov-2014)

Successfully Conducted Ethical Hacking & Cyber Security Workshop Today @ city Central Library (23-Nov-2014)

Thanx to All my EH4A Team Members for Making This Workshop Grand Success

All Registration fee was Donated to Valmiki Foundation (orphan Age Home)































Sunday, November 2, 2014

Tuesday, September 30, 2014

Hide File In Image

Hide File In Image

How Can We Hide The File In Image.
1. Gather the file you wish to bind, and the image file, and place them in a folder. I will be using C:\New Folder
-The image will hereby be referred to in all examples as xyz.jpg-The file will hereby be referred to in all examples as New Text Document.txt
2. Add the file/files you will be injecting into the image into a WinRar .rar or .zip. From here on this will be referred to as (secret.rar)
3. Open command prompt by going to Start > Run > cmd
4. In Command Prompt, navigate to the folder where your two files are by typingcd location [ex: cd C:\New Folder]
5. Type [copy /b xyz.jpg + secret.rar xyz.jpg] (remove the brackets)
Congrats, as far as anyone viewing is concerned, this file looks like a JPEG, acts like a JPEG, and is a JPEG, yet it now contains your file.
In order to view/extract your file, there are two options that you can take
a) Change the file extension from xyz.jpg to xyz.rar, then open and your file is thereb) Leave the file extension as is, right click, open with WinRar and your file is there 
EnJoy HacKinG...

Tuesday, June 3, 2014

Tuesday, May 27, 2014

Avast community forum hacked, user names and passwords stolen

Antivirus firm Avast said it took its community forum offline following a hacking attack compromised its database.


User names, email addresses,nick names and passwords were compromised in this attack.  The breach did not involve any financial data, license or any other data
While the passwords are hashed(one way encryption), it will not take much time for a hacker to crack the hashes. The longer the password, the harder it is to crack.

According to Avast blog post, the security breach affects less than 0.2% (about 400,000) of Avast's 200 million users.

People who uses the same password on other websites are advised to change those passwords immediately.

Until now, their forum used an open source community software called "Simple Machines Forum(SMF)".  It appears the Avast is using an outdated version of SMF.



Avast said it is now "We are now rebuilding the forum and moving it to a different software platform" which will be secure one.

Source: http://www.ehackingnews.com/

Saturday, April 19, 2014

HEART BLEED BUG EXPLOTATION

HEART BLEED BUG



The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).
The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

What leaks in practice?
We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.
How to stop the leak?
As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.

You Can Check Your Website here : https://filippo.io/Heartbleed/

Thursday, March 6, 2014

Dendroid, a new Android malware toolkit

Number of malware for Android platform is increasing day by day. Cybercriminals trying to sell android-malware toolkit to others. The first Android Remote admin tool is AndroRAT which is believed to first ever malware APK binder.


Symantec researchers have come to know another android malware toolkit called "Dendroid" is being sold in the underground forums.

A cybercriminal going by online handle "soccer" in the underground forum is selling this HTTP based RAT which is said to be having many malicious features.

The toolkit is able to create malicious apk file capable of 'deleting call logs', 'call to any number', 'open webpages', 'record calls', 'intercept sms', 'take and upload photos&videos', 'dos attack'.

Researchers say the cybercriminal also offer 24/7 support for this RAT. Others can buy this toolkit by paying $300 through crypto currencies such as Bitcoins, Litecoins.

Experts have mentioned that this RAT has some link with the previous AndroRAT saying "the author of the Dendroid APK binder included with this package had assistance writing this APK binder from the author of the original AndroRAT APK binder. "

Tuesday, February 11, 2014

Dear Internet, Today is 'The Day We Fight Back', Biggest protest against NSA Surveillance




The US Government has allotted a large share of its 'Black Budget' for secret military research and weapons programs, along with surveillance programs, that is harvesting hundreds of millions of Metadata from emails, web activity, chats, social networks, and everything else around the world. To make this happen, NSA has used a number of unethical ways, but labeled as legal solutions. 
Today, on February 11th, we all unite to fight against the Government intrusion on the privacy of innocent people worldwide, under one banner of 'The Day We Fight Back', along with other 7000 websites by hosting a large banner at the bottom of the websites; reading “Dear Internet, we’re standing with 300+ nonprofits worldwide in demanding an end to mass, suspicionless surveillance”, asking people of the world to vote against proposed NSA reforms that the American Civil Liberties Union has labeled “Bad for Privacy”.
The Banner, you can see at the bottom of this page, enables you to contact the members of Congress directly via email or a computer telephone call link using Twilio Voice. 
You can ask the legislators to oppose the FISA Improvements Act, which would strengthen the NSA surveillance legality and to support the USA Freedom Act. At the time of writing, the petition has already been signed by more than 60,000 people.
Hundreds of Digital rights and Privacy groups come together to protest surveillance by governments and you can also participate in our efforts by using hashtags - #STOPTHENSA and #DayWeFightBack on social networking sites.
Back in January 2012, the largest online protest in the history of the Internet; known as 'The Black-Out Day', was carried out by Google, Wikipedia, Wordpress and many other companies to kill SOPA, but later the US government molded its Foreign Intelligence Surveillance Act in such a way that, now it legally allowed them to monitor Billions of calls in a day and tracking a million of the devices.
Despite running such mass surveillance program, the US government has shown its helplessness in preventing massive cyber-attacks like data breaches at TARGET, Neiman Marcus, and Michael Stores etc. Somehow, such activities by an Intelligence agency today are motivating the cyber criminals to do the same.
The Day We Fight Back was started in the memory of Aaron Swartz, a 26 year-old information transparency activist, who took his own life just over a year ago, having faced a standoff with the government.
Dear Internet, we’re standing with millions of people and 300+ non-profit organizations worldwide and demanding an end to this Mass and Suspicion-less Surveillance.


source : http://thehackernews.com/

Monday, February 10, 2014

Dubai Police's Twitter and other Social media accounts hacked by @TheHorsemenLulz




A hacker identified as @TheHorsemenLulz attacked Dubai Police's official Social media accounts including verified Twitter account with 258k followers.
"Dubai Police is spying on you, Isn’t it fair that we the people do the same back? hacked by @TheHorsemenLulz," message posted in the hijacked twitter account reads.
Hacker posted a number of screenshots in his twitter account, it shows that he also hijacked other social media accounts : Pinterest, Linkedin and Tumblr.
Dubai Police have regained access to their twitter account and the tweets posted by hacker have been removed from the feeds.
It appears the hacker has ddosed several websites including Central Bank of the United Arab Emirates, UAE Computer Emergency Response Team and Emirates Integrated Telecommunications Company.

SOURCE : ehackingnews

Friday, January 10, 2014

ANDROID HACKING

HAI friends Today I HACKED ANDROID MOBILES more than 5 phones 
I CAN CONTROL ALL THESE OPTIONS 
Vibrate the phone







Send a message and voice message.

Find phone by making it ring.

Find phone using GPS location.

Remotely lock device.

Phone status: battery, imei, etc.

Wipe data.

Hide from launcher (Name : Service GPS).

Take picture with front camera.

Take picture with rear camera.

ist of SMS.

list of contacts.

list of calls.

Messages Facebook (Phone rooted only).
Messages WhatsApp (Phone rooted only).

Record audio with microphone.

Monday, January 6, 2014

Anti-Narendra Modi websites hacked and defaced




Narendra Modi, Gujarat Chief Minister and BJP's prime ministerial candidate has so many support from youngsters. It seems now he also gets support from hackers.

Few websites against Narendra Modi has been breached by hackers. The list of hacked websites:
  •  http://www.fekuexpress.com/
  • http://www.thekalyugtimes.com/
  • http://www.fekuneeds.com/ 
  • http://feku.me/
  • http://www.fekuonsale.com/
    The hackers defaced the home page with a picture of Narendra modi and a message saying "Narendra Modi Fan is here".

    "we are the person of him, nobody can rule on us)
    sun rises from the hopes everywhere
     intention are steely courage of everystep
     we are today going to write destiny by our hand
     MODIJI NEXT PM
    Narendra Modi Zindabad" The defacement reads(translated).

    Source : http://www.ehackingnews.com/2014/01/anti-narendra-modi-websites-hacked-and.html