Samsung Get Sued for Failing to Update its Smartphones

One of the world's largest smartphone makers is being sued by the Dutch Consumers' Association (DCA) for its lack in providing timely software updates to its Android smartphones.

This doesn't surprise me, though.

The majority of manufacturers fail to deliver software updates for old devices for years.

However, the consumer protection watchdog in The Netherlands, The Dutch Consummated, filed a lawsuit against Samsung, due to the manufacturer's grip over the local market compared to other manufacturers.

Last year, the discovery of the scary Stagefright Security Bug, which affected over 1 Billion Android devices worldwide, forced Samsung to implement a security update process that "fast tracks the security patches over the air when security vulnerabilities are uncovered a security update process that "fast tracks the security patches over the air when security vulnerabilities are uncovered," and that the security updates will occur once per month.

However, the watchdog also blames Korean OEM Samsung for not being transparent regarding the critical security updates, like the update to fix Stagefright exploits, that are necessary to

 "protect [its] consumers from cyber criminals and the loss of their personal data."

Majority of Samsung Handsets Vulnerable to Issues

According to DCA's own research, at least 82 percent of Samsung smartphones available in the Dutch market examined had not received any software updates on the latest Android version in two years.

This failure in providing the software updates left the majority of Android devices vulnerable to issues on security and others.

The DCA says that the agency has previously contacted Samsung many times and discussed the matter privately with the manufacturer giant to resolve the situation, but it failed to reach an agreement with the company, and so it decided to go to court.

At this point, I should mention that these are entirely valid claims.

Like most other manufacturers, Samsung doesn't provide timely software updates to its devices.

No doubt, the Samsung Galaxy S6 series have received Stagefright patches on time, but the manufacturer failed to provide Stagefright fixes for its majority of midrange and entry-level Android devices.

Furthermore, none of Samsung's devices currently runs the latest Android 6.0 Marshmallow, three months after it officially launched.

DCA's Demands from Samsung

The agency has requested the manufacturer to update all of its smartphone devices to the latest version of Android operating system for two years since the handset is purchased (not launched).

In some ways, the agency wants Samsung to treat software updates as part of the warranty that has its length mandated at two years in the European Union.

"[We are] demanding that Samsung provides its customers with clear and unambiguous information about this," The DCA writes. "Also, [we are] demanding that Samsung actually provides its smartphones with updates."

Response by Samsung

In response to the lawsuit, Samsung released an official statement saying the company was working on improving its updates on software and security.

"We have made a number of commitments in recent months to better inform consumers about the status of security issues, and the measures we are taking to address those issues," reads the statement.

"Data security is a top priority and we work hard every day to ensure that the devices we sell and the information contained on those devices are is safeguarded."

-Source : TheHackerNews.com

Read More

Microsoft Releases Security Updates - Known Vulnerabilities patched

Last week Microsoft discharged its Advance Notification for the month of Dec 2014 Patch weekday Updates, and at last nowadays discharged a complete of seven security bulletins, which is able to address many vulnerabilities in its product, out of that 3 ar marked \'critical\' and rest ar \'important\' in severity.

Last month once a giant pile of security patches, the corporate discharged associate associate uncommon emergency patch to repair a vital vulnerability in Microsoft Windows Kerberos KBC, authentication system utilized by default within the package, that cybercriminals exploited to compromise whole networks of computers.

The 3 vital bulletins have an effect on net person, workplace and Windows. All the versions of Microsoft net person (IE) ar affected except Server Core, that doesn\'t embrace i.e.. The vital zero-day i.e. vulnerability (CVE-2014-8967) was discovered by security investigator Arthur Gerkis of Zero Day Initiative (ZDI) in Gregorian calendar month this year.

By exploiting the vulnerability, a far off aggressor might execute discretional code on vulnerable installations of Microsoft net person so as to compromise a vulnerable system. However, to use this flaw, user interaction is required and to try and do that the target user should visit a malicious page or open a malicious file.

"The vulnerability relates to however net person uses reference tally to manage the lifetimes of the in-memory objects representing hypertext mark-up language components,\" reads the ZDI post. \"By applying a CSS kind of display:run-in to a page and acting explicit manipulations, associate aggressor will cause associate object\'s reference count to fall to zero untimely, inflicting the item to be freed. net person can then continue mistreatment this object once it\'s been freed. associate aggressor will leverage this vulnerability to execute code underneath the context of the present method."

ZDI warned Microsoft many days agone concerning the unfinished public revelation of the flaw once it completed one hundred eighty days as on Gregorian calendar month 2014. All the versions of i.e. ar rated vital on Windows desktop systems and moderate on Windows servers. Windows RT versions are affected and also the vulnerability is rated vital on that.
A second vital patch update affects solely Windows visual percept, Windows 7, Windows Server 2003 and Windows Server 2008, that is rated vital for the desktop versions and moderate for the servers. Another vital remote code execution update is anticipated in Microsoft workplace, beginning with Microsoft Word 2007 SP three, likewise as Microsoft workplace a pair of010 SP 2, Word a pair of010 SP 2, Word 2013 and Word 2013 RT.

Moreover, 2 additional security bulletins patch remote code execution vulnerabilities in Microsoft workplace net apps 2010 and 2013, however those vulnerabilities ar rated vital, which implies that there\'s some mitigating factors for attackers to use the flaw.
An elevation of privilege bug in Microsoft Exchange is listed among different security bulletins and is rated vital. The code affected ar Microsoft Exchange 2007, 2010 and 2013. the ultimate security update fixes associate data revelation vulnerability all told versions of Windows, together with Server Core.
If you have got Automatic Updates enabled on your machine, these fixes can all be created offered via Windows Update and can be applied mechanically for many users. however just in case users haven\'t enabled it, Microsoft is encouraging them to use the updates promptly. Some patches applied might need restarting the servers likewise.

Read More

Microsoft Lunched New OS : Windows 10

Brad Chacos has already outlined the steps for downloading and installing the Windows 10 Technical Preview on a virtual machine or hard drive partition. I went the simpler route: I took an older machine (a Surface 2 Pro), wiped it clean, then reinstalled and updated Windows 8 to the present.
t’s a humbling and amazing thing to work on Windows, which is used by over 1.5 billion people in every country of the world. From kids playing with computers for the first time, to writers and journalists, to engineers, to gamers, to CEOs, at some point Windows has empowered all of us. In the Windows team, we’re proud of this – but we also know that the world today is very different from the one in which Windows grew up. 

Today, devices outnumber people. Connectivity is like oxygen. The tension between the desire for agility versus stability poses a huge challenge for IT Pros. Experiences – no matter what device you’re on – just need to work. The only thing that hasn’t really changed is the situation for developers – still too much to do, and not enough time. One way to look at it is that Windows is at a threshold  :-). It’s time for a new Windows. 

This new Windows must be built from the ground-up for a mobile-first, cloud-first world. This new Windows must help our customers be productive in both their digital work and their digital life. This new Windows must empower people and organizations to do great things.
That new Windows is Windows 10. Windows 10 represents the first step of a whole new generation of Windows. 

Windows 10 unlocks new experiences for customers to work, play and connect. Windows 10 embodies what our customers (both consumers and enterprises) demand and what we will deliver.

Join Windows Insider Program

Read More

FLICKR CROSS-SITE REQUEST FORGERY VULNERABILITY PATCHED

Yahoo-owned Flickr, one of the biggest online photo management and sharing website in the world was recently impacted by a web application vulnerability, which could allow an attacker to modify users’ profile image.

Flickr is one of the most popular photo sharing website with more than 87 billion users, therefore some top major target for cybercriminals. The site was vulnerable to the most common vulnerability known as Cross-Site Request Forgery (XSRF or CSRF), which is very easy to exploit by attackers.

Cross-Site Request Forgery is a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. All the attacker need to do is get the target browser to make a request to your website on their behalf. If they can either:

• Convince your users to click on a HTML page they’ve constructed

• Insert arbitrary HTML in a target website that your users visit

Not too difficult, is it?

Abdullah Hussam, a 17 years old programmer from Iraq found that just by modifying parameters value of a Flickr HTTP request, one can trick the web service to modify users’ profiles.

When a user uploads a photo on Flickr, it will redirect the user to the page where they can add info on the photo like tags, description, and title. The request it make is as shown below:

edit_done=1&upload_ids=14401638983&just_photo_ids=&set_id=&magic_cookie=32e285e98bbef3aa6afd8c879891c01b&title_14401638983=XSRF+bug+POC1&description_14401638983=XSRF+bug+POC1&tags_14401638983=XSRF+POC1&tags_14401638983=XSRF+POC2&Submit=SAVE

According to Abdullah, the flaw resides in the “magic_cookie” parameter, which Flickr used to protect its website users from XSRF vulnerability.

In order to exploit Flickr XSRF vulnerability, an attacker can simply setup a webpage on his server with custom HTML form and custom parameter values, as shown. By keeping “magic_cookie” parameter value empty and changing Photo ID to the new image ID, the exploit will be able to bypass protection mechanism.

When the victim clicks a button on the web page, it generates a manipulated HTTP request to the server, which force the Flickr to replace victim’s profile image with new image.

“The last thing I did it was delete the value of magic cookie, in the first try it failed but in the second it works!,” Abdullah told The Hacker News. “The all value (title, description, tags) got change and I got redirected to my photos.”

He has also provided a video demonstration as a Proof of Concept:

The teen reported the vulnerability to Yahoo! and it was fixed in less than 12 hours by the Yahoo! security team. He got the reply from Yahoo! after more than a month and is still waiting for his bounty.Source : The Hacker News

Read More

Top Five Artificial Intelligence Magic

As from Wikipedia  Artificial intelligence  (AI) is the intelligence exhibited by machines or software. It is also an academic field of study.

In 1950, Alan Turing invented a test for determining a machine's ability to exhibit intelligent behavior. At the time, some predicted that so-called "Strong A.I.," that is, artificial intelligence that matches or exceeds human intelligence, could be achieved in a few decades. Over sixty years later, every machine that has been tasked with simulating human intelligence has failed the so-called Turing Test.

And yet, scientists have become both impressed and alarmed by the tremendous leaps forward in A.I. capabilities in recent years. A.I. has been put into common use by financial institutions, and found promising applications in medical equipment, search technology, games and transportation systems. On the other hand, equal advances have been made in seemingly Frankensteinian creations such as computer viruses and predatory drones, which could prove  dangerous if they have achieved what The New York Times called the “cockroach stage of machine intelligence."

Artificial Intelligence

1. Autonomous Vehicles

Don't try this at home (you can only do it in Nevada): Take a ride in Google's Robocar, which is operated by a machine, not a human. A law passed in June, 2001 made Nevada the first jurisdiction in the world where autonomous vehicles can be legally operated on public roads.

 2. "Brute Force Computation"

AI programs are able to examine large numbers of possibilities, such as a move in a chess game or inferences by a theorem-proving program. Discoveries are continually made about how to do this more efficiently in various domains. Right now you can buy a machine to play "master level chess." A $200 purchase gets you 200 million positions analyzed per second.

The short documentary below is about computer chess history that focuses in particular on the 1997 chess match between Garry Kasparov and IBM's Deep Blue computer.

Read More

How to Upload Shell in Wordpress Sites

Hello Friends ,Today i'm gonna show you how to upload shell in WordPress Sites... :D

Many of you know how to upload shell in WordPress,

But still Few are their who don't know. Lets Started.......

 In This Post I will Tell You the Two Successfully ways For Uploading Shell On WordPress.

1) By Editing The WordPress Theme.

2) By Uploading New Theme.

Most Of The Times  , For Security Reasons The Website admin Changes  the Permissions Of Theme Editing Option , So That IT cant Be edited Or Changed .

In That Case We will use The Next Option That is Theme Uploading.

So Lets Start ....

1) Upload  Shell By Editing The existing  WordPress Theme :-

>  After you login in to word press site as admin you see Dashboard ,something like this.

> In The Left Hand Site Take Your Mouse Pointer At Appearance , In That Click On Editor.

> When you will click on Editor you will some like this ,

> On y0ur Right Side..Select The Theme .

( Note:- There are More Other Themes Activated By Admin , But It Will be Better That You don't Upload Your Shell On Activated Theme ,Always Upload Shell On Unactivated Theme .)

> Now Select 404.php ,

Remove all the Source code There And Paste Y0ur Shell Code in 404.php and Update It .

> Now Its Shell Execution Time , To Execute The Shell ,

URL will be :-

http://www.site.com/wp-content/themes/themename/404.php

So I will Execute Shell by

http://www.site.com/wp-content/themes/twentyten/404.php

yehh..!! , We Got The Shell.....

 2) Upload Shell By Uploading New Theme .

As I Already Tell You Above , Most Of the Time Website Security Is High , Admin Change The CHMOD Permissions Of the Theme or Any Other Settings , Like Plugins Editing All That Shit .

So You Cant Edit Anything On Site.

So Here Comes The Second way Is Uploading.

Here We will Upload the WordPress Theme , Hiding Our Sh3ll In It .

Steps :-

Now choose new theme and download it as .ZIP file...Now Add your Shell in it by dragging a shell into .ZIP file .  > Now This Time Go To Themes

> Then Click On Install Themes as shown above in image.

>Now you can see Upload option.Click on that .

> Now Browse The  Theme in Which You added your Shell , and Click On Install Now.After Successfully
Install You Will Get This Screen Below .

> Great , Our Shell uploaded Successfully .Now Its Execution Time ..

URL For Execution :-

www.site.com/wp-content/themes/news/shell_name.php

yeehh...We Got The Shell....(y)

Read More

Gadget that make your Smartphone more Smart : FIN

FIN a Gadget from RHL VISION  with the slogan " Wear the World ". From a website  Fin is a real life buddy for every individual to do their digital interactions as natural as possible. Fin is a trendy gadget you can wear on the thumb and make your whole palm as a digital touch interface. 

From interacting with Rohil Dev a Founder/CEO of RHL Vision  ,  said about FIN - :

We are using touch to interact with our smartphone. if you are touching in the phone you need to hold phone in one hand and touch using thumb.That touching will reduce your screen visibility around 40%. But if you have fin, Just hold phone in your hand and your fin will be in your other hand you can put your hand feely and do all the touch and other gesture in your palm itself.
So it will give 100% screen visibility, and you can also attend the call or change music track without taking phone from the pocket.

" The smart choice make you more smart. "

For more updates visit : http://www.wearfin.com/

Read More

Merry Christmas to you from Hacking with New Ideas

I hope that your Christmas would be enjoyable and may the essence of Christmas remains always with you.

Merry X-mas.

Friends like you are very tough to get.I wish you a merry Christmas before it is too late.

Read More

Top 5 DDoS Attack Tools : Distributed Denial of Service Attack

What Is a Denial of Service Attack?

A DOS attack is an attempt to make a system or server unavailable for legitimate users and, finally, to take the service down. This is achieved by flooding the server’s request queue with fake requests. After this, server will not be able to handle the requests of legitimate users.

In general, there are two forms of the DOS attack. The first form is on that can crash a server. The second form of DOS attack only floods a service.

Tools :
1. LOIC (Low Orbit Ion Canon) :

LOIC is one of the most popular DOS attacking tools freely available on the Internet. This tool was used by the popular hackers group Anonymous against many big companies’ networks last year. Anonymous has not only used the tool, but also requested Internet users to join their DDOS attack via IRC.

It can be used simply by a single user to perform a DOS attack on small servers. This tool is really easy to use, even for a beginner. This tool performs a DOS attack by sending UDP, TCP, or HTTP requests to the victim server. You only need to know the URL of IP address of the server and the tool will do the rest.

The most important thing you should know is that LOIC does nothing to hide your IP address. If you are planning to use LOIC to perform a DOS attack, think again. Using a proxy will not help you because it will hit the proxy server not the target server. So using this tool against a server can create a trouble for you.

Download : LOIC

2. XOIC

XOIC is another nice DOS attacking tool. It performs a DOS attack an any server with an IP address, a user-selected port, and a user-selected protocol. Developers of XOIC claim that XOIC is more powerful than LOIC in many ways. Like LOIC, it comes with an easy-to-use GUI, so a beginner can easily use this tool to perform attacks on other websites or servers.

It is an effective tool and can be used against small websites. Never try it against your own website. You may end up crashing your own website’s server.

Download XOIC

3. HULK (HTTP Unbearable Load King)

HULK is another nice DOS attacking tool that generates a unique request for each and every generated request to obfuscated traffic at a web server. This tool uses many other techniques to avoid attack detection via known patterns.

It has a list of known user agents to use randomly with requests. It also uses referrer forgery and it can bypass caching engines, thus it directly hits the server’s resource pool.

The developer of the tool tested it on an IIS 7 web server with 4 GB RAM. This tool brought the server down in under one minute.

Download HULK 

4. DDOSIM—Layer 7 DDOS Simulator

DDOSIM is another popular DOS attacking tool. As the name suggests, it is used to perform DDOS attacks by simulating several zombie hosts. All zombie hosts create full TCP connections to the target server.

This tool is written in C++ and runs on Linux systems.

These are main features of DDOSIM

• Simulates several zombies in attack
• Random IP addresses
• TCP-connection-based attacks
• Application-layer DDOS attacks
• HTTP DDoS with valid requests
• HTTP DDoS with invalid requests (similar to a DC++ attack)
• SMTP DDoS
• TCP connection flood on random port

Download DDOSIM 

5. Tor’s Hammer

Tor’s Hammer is another nice DOS testing tool. It is a slow post tool written in Python. This tool has an extra advantage: It can be run through a TOR network to be anonymous while performing the attack. It is an effective tool that can kill Apache or IIS servers in few seconds.

Download Tor's Hammer

Read More

Top 10 CMS : Content Management Systems for Development

There are plenty of options when it comes to picking a content management system for a development project. Depending on how advanced you need the CMS to be, what language it’s built in, and who is going to be using it, it can be a nightmare trying to find the “perfect” CMS for a project.

However, some CMSs have a slight edge over the rest of the competition because of the usability of the software. Some are just easier to install, use and extend, thanks to some thoughtful planning by the lead developers. Here are 10 of the most usable CMSs on the web to use in your next project.

1. WordPress

What is there left to say about WordPress that hasn’t already been said? The PHP blogging platform is far and away the most popular CMS for blogging, and probably the most popular CMS overall. It’s a great platform for beginners, thanks to their excellent documentation

and super-quick installation wizard. Five minutes to a running CMS is pretty good. Not to mention the fact that the newest versions auto-update the core and plugins from within the backend, without having to download a single file.

For those users not familiar with HTML or other markup language, a WYSIWYG editor is provided straight out of the box. The backend layout is streamlined and intuitive, and a new user should be able to easily find their way around the administration section. Wordpres also comes with built-in image and multimedia uploading support.

For developers, the theming language is fairly simple and straightforward, as well the Plugin API.

The WordPress Community is a faithful and zealous bunch. WordPress probably has the widest base ofplugins and themes to choose from. A great part about the WordPress community is the amount of help and documentation online you can find on nearly every aspect of customizing WordPress. If you can dream it, chances are it’s already been done with WordPress and documented somewhere.

2. Drupal

Drupal is another CMS that has a very large, active community. Instead of focusing on blogging as a platform, Drupal is more of a pure CMS. A plain installation comes with a ton of optional modules that can add lots of interesting features like forums, user blogs, OpenID, profiles and more. It’s trivial to create a site with social features with a simple install of Drupal. In fact, with a few 3rd party modules you can create someinteresting site clones with little effort.

One of Drupal’s most popular features is the Taxonomy module, a feature that allows for multiple levels and types of categories for content types.

Drupal also has a very active community powering it, and has excellent support for plugins and other general questions.

3. Joomla!

Joomla is a very advanced CMS in terms of functionality. That said, getting started with Joomla is fairly easy, thanks to Joomla’s installer. Joomla’s installer is meant to work on common shared hosting packages, and is a very straightforward considering how configurable the software is.

Joomla is very similar to Drupal in that it’s a complete CMS, and might be a bit much for a simple portfolio site. It comes with an attractive administration interface, complete with intuitive drop-down menus and other features. The CMS also has great support for access control protocols like LDAP, OpenID and even Gmail.com.

The Joomla site hosts more than 3,200 extensions, so you know the developer community behind the popular CMS is alive and kicking. Like WordPress, you can add just about any needed functionality with an extension. However, the Joomla theme and extension community relies more on paid plugins and themes, so if you’re looking for customizations, be ready to pay.

4. ExpressionEngine

ExpressionEngine (EE) is an elegant, flexible CMS solution for any type of project. Designed to be extensible and easy to modify, EE sets itself apart in how clean and intuitive their user administration area is. It takes only a matter of minutes to understand the layout of the backend and to start creating content or modify the look. It’s fantastic for creating websites for less-than-savvy clients that need to use the backend without getting confused.

ExpressionEngine is packed with helpful features like the ability to have multiple sites with one installation of software. For designers, EE has a powerful templating engine that has custom global variables, custom SQL queries and a built in versioning system. Template caching, query caching and tag caching keep the site running quickly too.

One of my favorite features of EE that is the global search and replace functionality. Anyone who’s ever managed a site or blog knows how useful it is to change lots of data without having to manually search and open each page or post to modify it.

ExpresssionEngine is quite different than other previously-mentioned CMS in that it’s paid software. The personal license costs $99.95, and the commercial license costs $249.99.

5. TextPattern

Textpattern is a popular choice for designers because of its simple elegance. Textpattern isn’t a CMS that throws in every feature it can think of. The code base is svelte and minimal. The main goal of Textpattern is to provide an excellent CMS that creates well-structured, standards-compliant pages. Instead of providing a WYSIWYG editor, Textpattern uses textile markup in the textareas to create HTML elements within the pages.
The pages that are generated are extremely lightweight and fast-loading.Even though Textpattern is deliberately simple in design, the backend is surprisingly easy to use and intuitive. New users should be able to find their way around the administration section easily.

While Textpattern may be very minimal at the core level, you can always extend the functionality by 3rd party extensions, mods or plugins. Textpattern has an active developer community with lots of help and resources at their Textpattern.org site.

6. Radiant CMS

The content management systems that we’ve listed so far are all PHP programs. PHP is the most popular language for web development, but that doesn’t mean we should overlook other popular web languages like Ruby. Radiant CMS is a fast, minimal CMS that might be compared to Textpattern. Radiant is built on the popular Ruby framework Rails, and the developers behind Radiant have done their best to make the software as simple and elegant as possible, with just the right amount of functionality. Like Textpattern, Radiant doesn’t come with a WYSIWYG editor and relies on Textile markup to create rich HTML. Radiant also has it’s own templating language Radius which is very similar to HTML for intuitive template creation.

7. Cushy CMS

Cushy CMS is a different type of CMS altogether. Sure, it has all the basic functionality of a regular content management system, but it doesn’t rely on a specific language. In fact, the CMS is a hosted solution. There are no downloads or future upgrades to worry about.

How Cushy works is it takes FTP info and uploads content on to the server, which in turn the developer or the designer can modify the layout, as well as the posting fields in the backend, just by changing the style classes of the styles. Very, very simple.

Cushy CMS is free for anyone, even for professional use. There is an option to upgrade to a pro account to use your own logo and color scheme, as well as other fine-grain customizations in the way Cushy CMS functions.

8. SilverStripe

SilverStripe is another PHP CMS that behaves much like WordPress, except has many more configurable options and is tailored towards content management, and not blogging. SilverStripe is unique because it was built upon its very own PHP framework Saphire. It also provides its own templating language to help with the design process.

SilverStripe also has some interesting features built in to the base, like content version control and native SEO support. What’s really unique with SilverStripe is that developers and designers can customize the administration area for their clients, if need be. While the development community isn’t as large as other projects there are some modules, themes and widgets to add functionality. Also, you’ll want to modify the theme for each site, as SilverStripe doesn’t provide much in terms of style, to give the designer more freedom.

9. Alfresco

Alfresco is a JSP is a beefy enterprise content management solution that is surprisingly easy to install. A really useful feature of Alfresco is the ability to drop files into folders and turn them into web documents. Alfresco might be a little bit more work than some of the other CMS and isn’t as beginner-friendly, it certainly is quite usable given the massive power of the system. The administration backend is clean and well-designed.

While Alfresco might not be a great choice for most simple sites, it’s an excellent choice for enterprise needs.

10. TYPOlight

TYPOlight seems to have the perfect balance of features built into the CMS. In terms of functionality, TYPOlight ranks with Drupal and ExpressionEngine, and even offers some unique bundled modules like newsletters and calendars. Developers can save time with the built-in CSS generator, and there are plenty of resources for learning more about the CMS.

If there is a downside to TYPOlight, it’s that it has so many features and configurable options. Even though the backend is thoughtfully organized, there are still a lot of options to consider. But if you’re wanting to build a site with advanced functionality and little extra programming, TYPOlight could be a great fit.

Source : Net Tuts+

Read More

NSA officials claimed that China has developed a BIOS based malware

During a CBS Interview show "60 Minutes", The National Security Agency (NSA) officials claimed that China has developed a BIOS based malware that can remotely destroy any computer.

Obviously NSA is struggling to repair its image and in an effort to justify their extensive Surveillance programs, The NSA Director General Keith Alexander and Information Assurance Director Debora Plunkett made a number of claims.During that interview NSA officials said that they had foiled a malware attack that could have taken down the U.S. economy.

"One of our analysts actually saw that the nation state had the intention to develop and to deliver, to actually use this capability to destroy computers," Plunkett said.

They have mentioned that this malware was distributed via social engineering and targeted emails, although the NSA director mentioned that their researchers worked with computer manufacturers and able to close the respective vulnerability.

"This is the BIOS system which starts most computers. The attack would have been disguised as a request for a software update. If the user agreed, the virus would've infected the computer." he added.

"Think about the impact of that across the entire globe. It could literally take down the U.S. economy." (BULLSHIT)

If this Malware was intentionally born to threat U.S Economy, then what about DNS Changer malware or Zeus banking Trojan or infomous CryptoLocker ransomware that extensively spread across USA? So, Why NSA's Surveillance programs are failed to defend us from similar known threats ?

Complete Interview Video:

The BIOS malware is not new in the cyber world, and really not a big threat, but if NSA seriously justifying their Surveillance program by saying that this so called BIOS malware was one of the biggest threat they has taken down, then LET ME LAUGH.

Source: The Hacker News

Read More

Google removes privacy feature from Android, says inclusion was an accident

Google Inc has removed an experimental privacy feature from its Android mobile software that had allowed users to block apps from collecting personal information such as address book data and a user's location.

The change means that owners of smartphones using Android 4.4.2, the latest version of the world's most popular operating system for mobile devices released this week, must provide access to their personal data in order to use certain apps.

A company spokesman said the feature had been included by accident in Android 4.3, the version released last summer.

"We are suspicious of this explanation, and do not think that it in any way justifies removing the feature rather than improving it,"

said Peter Eckersley, technology projects director at the Electronic Frontier Foundation. The digital rights website first publicized the change in a blog post on Friday.

Android users who wish to retain the privacy controls by not upgrading to Android 4.4.2 could be vulnerable to security risks, Eckersley said.

 "For the time being, users will need to chose between either privacy or security on the Android devices, but not both."

Many third-party apps for Android devices, such as music-identifying service Shazam and popular smartphone flashlight apps, require access to personal information that does not always have an obvious connection to the app's functionality, such as phone call information and location data.

The privacy feature allowed users to pick and choose which personal data a third-party app can collect, Eckersley said. Users had to install a special Apps Ops Launcher software, which was created by another company, in order to access the hidden privacy controls.

Android was loaded on 81 percent of all smartphones shipped worldwide in the third quarter, according to industry research firm IDC. Apple Inc's iOS, the software used on the iPhone, had 12.9 percent market share.

Privacy has become an increasingly important issue as smartphones, which are loaded with consumers' personal information, become the primary computing device for many consumers.

In November Google agreed to pay a $17 million fine to settle allegations that it secretly tracked Web users by placing special digital files on the Web browsers of their smartphones.

source : NDTV Gadgets

Read More

Mouabad Android Malware calling to Premium numbers; Generating revenue for its Master

Android platform is a primary target for malware attacks from few years and during 2013, more than 79% of mobile operating malware threats are taking place on Android OS. 

Till now we have seen the majority of Android malware apps that earn money for their creators by sending SMS messages to premium rate numbers from infected devices. 

Security researchers at Lookout identified an interesting monetized Android Malware labeled as 'Mouabad', that allow a remote attacker to make phone calls to premium-rate numbers without user interaction from C&C servers by sending commands to the malware.

The technique is not new, but infection from such app notified first time in the wild. The variant dubbed MouaBad.p., is particularly sneaky and to avoid detection it waits to make its calls until a period of time after the screen turns off and the lock screen activates.

"Mouabad.p also end the calls it makes as soon as a user interacts with their device (e.g. unlocks it). However, this malware variant does not appear to have the ability to modify call logs so a discerning victim could uncover Mouabad.p’s dialing activity by checking their call histories." 

Risk of infection is low, because the malware app works only on devices running Android version 3.1 or old and designed to mainly target Chinese-speaking users. 

"Mouabad.p and other trojans that can financially harm users and effectively hide themselves underscore the need for sophisticated mobile malware protection." 

Android architecture loophole contributes to the growth of Android malware. It basically can't identify the difference between a legit app i.e. Taking permissions to read your Contacts or SMS (i.e. True Caller),  or a malicious applications (i.e. Trojans), or state-sponsored applications (i.e. WeChat). 

Neither  Android architecture allows users to revoke the list of permissions they don't want to give to an application. For now, If you own a Smartphone, I highly recommend you to install applications only from some trusted App Store i.e. Google Play.

Source:The Hacker News

Read More

Researchers create malware that communicates via silent sound, no network needed

How a malware can steal the data from an infected system that doesn't have internet connection? You might think it is impossible.  Computer scientists say it is possible.
When security researcher Dragos Ruiu claimed malware dubbed “badBIOS” allowed infected machines to communicate using sound waves alone—no network connection needed—people said he was crazy. New research from Germany’s Fraunhofer Institute for Communication, Information Processing, and Ergonomics suggests he’s all too sane.

As outlined in the Journal of Communications (PDF) and first spotted by ArsTechnica, the proof-of-concept malware prototype from Michael Hanspach and Michael Goetz can transmit information between computers using high-frequency sound waves inaudible to the human ear. The duo successfully sent passwords and more between non-networked Lenovo T400 laptops via the notebooks’ built-in microphones and speakers. Freaky-deaky!
" The infected victim sends all recorded keystrokes to the covert acoustical mesh network. Infected drones forward the keystroke information inside the covert network till the attacker is reached. "

The most successful method was based on software developed for underwater communications. The laptops could communicate a full 65 feet apart from each other, and the researchers say the range could be extended by chaining devices together in an audio “mesh” network, similar to the way Wi-Fi repeaters work.

While the research doesn’t prove Ruiu’s badBIOS claims, it does show that the so-called “air gap” defense—that is, leaving computers with critical information disconnected from any networks—could still be vulnerable to dedicated attackers, if attackers are first able to infect the PC with audio mesh-enabled malware.

Sending data via sound

“We use the keylogging software logkeys for our experiment,” they wrote. “The infected victim sends all recorded keystrokes to the covert acoustical mesh network. Infected drones forward the keystroke information inside the covert network till the attacker is reached, who is now able to read the current keyboard input of the infected victim from a distant place.”

In another test, the researchers used sound waves to send keystroke information to a network-connected computer, which then sent the information to the “attacker” via email.

Now for the good news: This advanced proof-of-concept prototype isn’t likely to work its way into everyday malware anytime soon, especially since badware that communicates via normal Net means should be all that’s needed to infect the PCs of most users. Nevertheless, it’s ominous to see the last-line “air gap” defense fall prey to attack—especially in an age of state-sponsored malware run rampant.

Source : pcworld.com

Read More