NSA and GCHQ jointly to violate Yahoo users privacy

The news came into picture about Government who are conducting Global Mass surveillance. Edward Snowden have defaced the US Intelligence Agency NSA, who were taking care of a number of projects like PRISM, XKeyscore, DROPOUTJEEP, and various others to carry out surveillance of millions of people.

It has been revealed that the US National Security Agency (NSA) helped its British counterpart, the Government Communications Headquarters (GCHQ), to allegedly capture and store nude images and others from webcam chats of millions of unsuspecting Yahoo users, The Guardian reported.

Documents given to the Guardian by the former NSA contractor Edward Snowden stated that the GCHQ's worked with the US intelligence agency NSA on a joint project known as ‘Optic Nerve’. The project carried out a bulk surveillance program, under which they seized webcam images every five minutes from random Yahoo users' video chats and stored them in a database.

The project didn't target individuals but rather targeted Yahoo Webcam chats between 2008 and 2010. In just six months time period the still images of about 1.8 million users were captured and stored in the government servers in 2008. Instead of saving full videos, the program logged one image every five minutes from a user's chat. The document says that between 3 and 11 percent of the images taken contain "undesirable nudity." The collected webcam data was stored in the NSA's XKeyscore search tool, and the NSA research was used to build the tool which identified Yahoo's webcam traffic, reads the report.

GCHQ webcam spying program, Optic Nerve, was still active in 2012, according to an internal GCHQ wiki page accessed that year.

One GCHQ document states, "It would appear that a surprising number of people use webcam conversations to show intimate parts of their body to the other person."

The document stated that the images were collected by the government agency, so that the researcher could experiment with facial recognition.

"Face detection has the potential to aid selection of useful images for 'mugshots' or even for face recognition by assessing the angle of the face," it reads. "The best images are ones where the person is facing the camera with their face upright."

The GCHQ agency staffs were allowed to display "webcam images associated with similar Yahoo identifiers to your known target", the document reads, also it states “Bulk surveillance of Yahoo users was begun” as "Yahoo webcam is known to be used by GCHQ targets."

Yahoo denied for any involvement with the GCHQ describing the activity as "a whole new level of violation of our users' privacy."

GCHQ spokesman said in a statement, "It is a longstanding policy that we do not comment on intelligence matters. Furthermore, all of GCHQ's work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorized, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence service commissioners and the Parliamentary Intelligence and Security Committee,” adding, “All our operational processes rigorously support this position."

The NSA spokesperson declined to respond saying, "As we've said before, the National Security Agency does not ask its foreign partners to undertake any intelligence activity that the US government would be legally prohibited from undertaking it."

Source: THE HACKERS NEWS

Read more…

Google Maps Gallery recognised as an interactive digital atlas.

On Thursday, Google launched a new feature in Google Maps known by Google Maps Gallery. The Google Maps Gallery is a specialized maps using Google’s Google Maps Engine and share them online. It has an interactive digital maps provided by businesses, governments, non profit organizations, such as US Geological Survey, National Geographic, Worlds Bank Group, Florida Emergency Management and the City of Edmonton. The SETI Institute also published a series of planetary maps.

Jordan Breckenridge, Google Maps Product Manager gave the reason behind the Public Data Program is to reveal the maps and geospatial information that many organizations have with themselves. The data which are not available in public or its often in PDF or image file. The Google Maps Gallery includes construction projects, historic battlefields, Internet users worldwide, US congressional districts, climate change data, public school ratings, and much more. “The intent here is to provide an interactive digital atlas around anyone’s mapping content,” Breckenridge said.

National Geographic Maps director of digital development Frank Biasi said that the majority of its maps could only be seen in paper form. But now that the organization has joined Google's Gallery, these maps are available to all.

"Over the last 125 years, National Geographic has developed and published more than 800 maps, as one of our primary vehicles for achieving our mission to inspire people to care about the planet," Biasi said in a statement. "But access to these maps has been limited due to their physical printed nature and their range of publication dates. Maps Gallery makes our entire collection and individual maps discoverable and viewable to the world through a simple Google Maps user experience."

Google wrote, “Maps included in the Gallery can be viewed in Google Earth and are discoverable through major search engines, making it seamless for citizens and stakeholders to access diverse mapping data, such as locations of municipal construction projects, historic city plans, population statistics, deforestation changes and up-to-date emergency evacuation routes.”

Participants selected by Google received free access to the enterprise version of Google Maps Engine to import public data into Maps Engine.

Breckenridge supposes that people will be accessing the Google Maps Gallery through Google Search instead of the Gallery, so the company is looking as to how to highlight searches in the Google Search results and Google Earth too.

Google is also thinking of how user's develop the app with the help of free Google Maps Engine Lite service and make them more discoverable.

Read more…

Computer Manufacturer gets 70% off on Windows 8.1

Microsoft Corporation reduced 70% of the original price of Windows 8.1 for computer manufacturers of low cost computers and tablets to compete with Google Inc Chrombooks.

Computer manufacturer will charge $15 to license Windows 8.1 and pre-install with the devices under selling price $250, compared with the standard fee of $50. If any product will meets this price limit will get discount, with no restrictions on the type or size of the device.

According to Tami Reller, Head of Marketing for Microsoft, sales of Microsoft Windows 8, including its latest version Windows 8.1, is slow in comparision with Windows 7. More than 200 million Windows 8 licenses were sold in 15 months whereas, 240 million Windows 7 licenses were sold within a year.

As smartphones and tablets sales increased in last two years, the PC sales has gradually decreased. Sales of tablets are set to overtake PCs worldwide next year.

Read more…

Now Nokia's HERE Maps will be available for Windows 8.1 and Windows RT 8.1

Nokia will soon place HERE Maps in Microsoft's online Windows Store. It will be free to download for the PC or tablet running Windows 8.1 and Windows 8.1 RT. It will be available in North America and Europe further followed by other regions of the world.

In Windows 8.1, Nokia HERE Maps will have the same features as Windows 8 with some useful updates like loading maps upto four times faster, combining vector, high resolution satellite and 3D maps, points of interest, search and route planning. Nokia HERE Maps will also keep tracks of user's search history.

Mouse and Keyboard support along with touchscreen. The entire world map can be downloaded and used offline.

Eager user's have to keep looking on the Windows Store for Nokia HERE Maps for few days.

Read more…

Google will soon introduce ultrasonic password

Google acquired SlickLogin, a startup Israeli company that developed a technology which can verifies and authenticates online accounts using high frequency ultrasonic sounds that are inaudible to the human ears.

“Google was the first company to offer two-step verification to everyone, for free,” SlickLogin further continued, “and they’re working on some great ideas that will make the Internet safer for everyone.”

SlickLogin claims to offer "military grade security" which uses two step process by placing your phone next to your PC or tablet. When you sign in via SlickLogin enabled website, the PC or tablet will play ultrasonic sound which our smartphone can hear. The Smartphones authenticates with SlickLogin Servers and grant access to the account.

Each sound produced is unique and cannot be reused.

In August 2013, SlickLogin founders Or Zelig, Eran Galili and Ori Kabeli started to develop their program on ultrasonic technology, By September, they presented their program at TechCrunch Disrupt in San Francisco. Later in December they registered as an official company.

SlickLogin website said, "Today we're announcing that the SlickLogin team is joining Google, a company that shares our core beliefs that logging in should be easy instead of frustrating, and authentication should be effective without getting in the way."

Other then ultrasound, SlickLogin also uses, NFC, QR Codes, GPS, WiFi, Bluetooth for verification and authentication of accounts.

Google acquired five Israel-based companies in recent years like iRows in 2006, LabPixies in 2010, MentorWave Technology in 2010 and Waze last year and SlickLogin recently.

Read more…

Google I/O Conference in June

Google scheduled its annual developers' conference on June 25 to 26 at Moscone West conference center, San Francisco. This news was announced by Google's senior vice president Sundar Pichai.

The post on Google+ stated, "Only 126 days until the 7th annual Google I/O, when we come together with amazing developers like you to talk about what's next. On June 25-26, 2014, we'll be broadcasting live from Moscone West. You can join us in person in San Francisco or remotely, via a live stream and through I/O Extended community events around the world. More details to come next month, including registration info."

Pichai reported that Google is planning to do some changes in the registration process. Pichai continued saying, "Also, quick note for those who want to join in person: this year we're making some changes to registration, so you won't need to scramble the second registration opens. We'll be implementing a new system, where you can submit your interest to attend Google I/O 2014. Successful applicants will then be randomly selected and notified shortly thereafter. We'll be following up with more details from +GoogleDevelopers, so stay tuned."

Read more…

WhatsApp Messaging app will be sold to Facebook for $19 billion

Facebook takes over WhatsApp Messaging App for $12 billion in Stock and $4 billion in Cash and an additional $3 billion in restricted stock units that will be granted to WhatsApp’s founders and employees vesting over the next four years.

Facebook CEO Mark Zukerberg posted a Facebook update about WhatsApp acquisition. “WhatsApp is on a path to connect 1 billion people. The services that reach that milestone are all incredibly valuable,” Facebook CEO Mark Zuckerberg said in a statement. “I’ve known Jan for a long time and I’m excited to partner with him and his team to make the world more open and connected.”

WhatsApp co-founder and CEO Jan Koum will join Facebook's Board of Directors. WhatsApp has built a leading and rapidly growing real-time mobile messaging service, with over 450 million people using the service each month. 70% of those people active on a given day. Messaging volume approaching the entire global telecom SMS volume.
Continued to strong growth, currently adding more than 1 million new registered users per day.

Jan Koum, WhatsApp co-founder and CEO, said, “WhatsApp's extremely high user engagement and rapid growth are driven by the simple, powerful and instantaneous messaging capabilities we provide. We're excited and honored to partner with Mark and Facebook as we continue to bring our product to more people around the world.”

As per the deal, WhatsApp's headquarters will remain in Mountain View, CA.

If the deal fails of aquiring WhatsApp, Facebook has to pay a breakup fee of $1 billion in cash to WhatsApp. 

Read more…

Kali Linux: The New Version of Backtrack

Kali Linux is a Debian based Linux distribution designed for advanced Penetration Testing, Digital Forensics and Security Auditing Linux distribution. Kali Linux is a complete rewriting of BackTrack Linux developed by Amti Aharoni and Devon Kearns of Offensive Security. It is a supported platform of the Metasploit Project's Metasploit Framework, a tool for developing and executing security exploits.

Kali Linux is preinstalled with more then 300 penetration-testing and digital forensics tools.

Here are the list of tools available on Kali Linux

Information gathering:  DNS Analysis:
dnsdict6
dnsenum
dnsmap
dnsrecon
dnsrevenum6
dnstracer
dnswalk
fierce
maltego
nmap
urlcrazy

Network Scanners:
dmitry
dnmap-client
dnmap-server
netdiscover
nmap

Live Host Identification:
alive6
arping
cdpsnarf
detect-new-ip-6
detect-sniffer6
dmitry
dnmap-client
dnmap-server
fping
hping3
inverse_lookup6
miranda
ncat
netdiscover
nmap
passive_discovery6
thcping6
wol-e
xprobe2

SMB Analysis:
accheck
nbtscan
nmap

OSINT Analysis:
casefile
creepy
dmitry
jigsaw
maltego
metagoofil
theharvester
twofi
urlcrazy
Route Analysis:
dnmap-client
dnmap-server
intrace
netmask
trace6

Service Fingerprinting:
dnmap-client
dnmap-server
implementation6
implementation6d
ncat
sslscan
sslyze
tlssled

SSL Analysis:
sslcaudit
ssldump
sslh
sslscan
sslsniff
sslstrip
sslyze
stunnel4
tlssled

Telephony Analysis:
ace

SMTP Analysis:
nmap
smtp-user-enum
swalks

OS Fingerprinting:
dnmap-client
dnmap-server
miranda
nmap

IDS/IPS Identification:
fragroute
fragrouter
wafw00f

SNMP Analysis:
braa
cisco-auditing-tool
cisco-torch
copy-router-config
merge-router-config
nmap
onesixtyone

Traffic Analysis:
cdpsnarf
intrace
irpas-ass
irpass-cdp
p0f
tcpflow
wireshark

VPN Analysis:ike-scan

VoIP Analysis:
ace
enumiax

Fuzzing Tools:
bed
fuzz_ip6
ohrwurm
powerfuzzer
sfuzz
siparmyknife
spike-generic_chunked
spike-generic_listen_tcp
spike-generic_send_tcp
spike-generic_listen_upd

Vulnerability Analysis:CiscoTools:
cisco-auditing-tool
cisco-global-exploiter
cisco-ocs
cisco-torch
yersinia

Open-vasopenvas-gsd
openvas-setup

Database Explotation:
bbqsql
sqlninja

Database Assessment:
bbqsql
dbpwaudit
hexorbase
mdb-export
mdb-parsecsv
mdb-sql
mdb-tables
oscanner
sidguesser
sqldict
sqlmap
sqlninja
sqlsus
tnscmd10g
sqlsus

Misc Scanners:
lynis
nikto
nmap
unix-privesc-check

Web Applications:CMS Identifaction:
blindelephant
plecost
wpscan

Open Source Assessmentcasefile:
maltego

IDS/IPS Identifacation:ua-tester

Web Application Fuzzers:
burpsuite
powerfuzzer
webscarab
webslayer
websploit
wfuzz
xsser
zaproxy

Web Application Proxies:
burpsuite
paros
proxystrike
vega
webscarab
zaproxy

Web Crawlers:
apache-users
burpsuite
cutycapt
dirb
dirbuster
vega
webscarab
webslayer
zaproxy

Web Vulnerability Scanners:
burpsuite
cadaver
davtest
deblaze
fimap
grabber
joomscan
nikto
padbuster
proxystrike
skipfish
sqlmap
vega
w3af
wapiti
webscarab
webshag-cli
webshaggui
websploit
wpscan
xsser
zaproxy


Offline Attacks:
cachedump
chntpw
cmospwd
crunch
dictstat
hashcat
hash-identifier
john
johnny
lsadump
maskgen
oclhashcat-lite
oclhashcat-plus
ophcrack
ophcrack-cli
policygen
pwdump
pyrit
rainbowcrack
rcracki_mt
rsmangler
samdump2
sipcrack
sucrack
truecrack

Online Attacks:
accheck
burpsuite
cewl
cisco-auditing-tool
dbpwaudit
findmyhash
hydra
hydra-gtk
medusa
ncrack
onesixtyone
patator
phrasendrescher
thc-pptp-bruter
webscarab
zaproxy

RFIDiot A CG:
brute force hitag2
bruteforce mifare
calculate jcop mifare keys
continuous select tag
copy iso15693b tag
epassport read write clone
format mifare 1k value blocks
identify hf tag type
identify if tag type
jcop info
jcop mifare read write
jcop set atr historical bytes
read acg reader eeprom
read if tag
read mifare
read tag
read write clone unique (em4x02)
reset q5 tag
select tag
set fdx-b id
test acg lahf

RFID/NFC Tools:NFC Tools:
mfcuk
mfoc
mifare-classic-format
nfc-list
nfc-mfclassic

Other Wireless Tools:zbassocflood
zbconvert
zbdsniff
zbdump
zbfind
zbgoodfind
zbreplay
zbstumbler

Wireless Attacks:Bluetooth Tools:
bluelog
bluemaho
blueranger
btscanner
fang
spooftooph

Exploitation Tools:Cisco Attacks:
cisco-auditing-tool
cisco-global-exploiter
cisco-ocs
cisco-torch
yersinia

Wireless Tools:
aircrack-ng
aireplay-ng
airmon-ng
airodump-ng
asl;eap
cowpatty
eapmd5pass
fern-wifi-cracker
genkeys
genpmk
giskismet
kismet
mdk3
wifiarp
wifidns
wifi-honey
wifiping
wifitap
wifite

RFIDiot PCSC:
bruteforce mifare
calculate jcop mifare keys
chip & pin info
continuous select tag
epassport read write clone
identify hf tag type
jcop info
jcop mifare read write
jcop set atr historical bytes
read mifare
read tag
select tag

RFIDiot FROSCH:
read write clone unique (em4x02)
reset hitag2 tag
set fdx-b id
test frosch reader

Exploit Database:searchsploit

Metasploit:
metasploit community / pro
metasploit diagnostic logs
metasploit diagnostic shell
metasploit framework
update metasploit

Network Exploitation:
exploit6
ikat
jboss-autopwn-linux
jboss-autopwn-win
termineter

Social Engineering Toolkit:se-toolkit

Sniffing/Spoofing:Network Sniffers:
darkstat
dnschef
dnsspoof
dnsniff
ettercap-graphical
hexinject
mailsnarf
netsniff-ng
passive_discovery6
sslsniff
tcpflow
urlsnarf
webmitm
webspy
wireshark

Network Spoofing:
dnschef
ettercap-graphical
evilgrade
fake_advertise6
fake_dns6d
fake_dnsupdate6
fake_mipv6
fake_mld26
fake_mld6
fake_mldrouter6
fake_router6
fake_solicitate6
fiked
macchanger
parasite6
randicmp6
rebind
redir6
sniffjoke
sslstrip
tcpreplay
wifi-honey
yersinia

Voice and Surveillance:msgsnarf

VoIP Tools:
iaxflood
inviteflood
ohrwurm
protos-sip
rtpbreak
rtpflood
rtpinsertsound
rtpmixsound
sctpscan
sipmyknife
sipp
sipsak
svcrack
svcrash
svmap
svreport
svwar
viophopper

Web Sniffers:
burpsuite
dnsspoof
driftnet
ferret
mitmproxy
urlsnarf
webmitm
webscarab
webspy
zaproxy

Maintaining Access:OS Backdoors:
cymothoa
dbd
intersect
powersploit
sbd
u3-pwn

Tunneling Tools:
cryptcat
dbd
dns2tcpc
dns2tcpd
iodine
miredo
ncat
proxychains
proxytunnel
ptunnel
pwnat
sbd
socat
sslh
stunnel4
updtunnel

Web Backdoors:
webacoo
weevely

Reverse Engineering:Debuggers:
edb-debugger
ollydbg

Disassembly:jad
rabin2
radiff2
rasm2
recstudio
recstudio-cli

Misc RE Tools:
apktool
clang
clang++
dexwjar
flasm
javasnoop
radare2
rafind2
ragg2
ragg2-cc
rahash2
rarun2
rax2

Stress Testing:Network Stress Testing:
denial6
dhcpig
dos-new-ip6
flodd_advertise6
flood_dhcpc6
flood_mld26
flood_mld6
flood_mldrouter26
flood_router6
flood_solicitate6
fragmentation6
inundator
kill_router6
macof
rsmurf6
siege
smurf6
t50

VoIP Stress Testing:
iaxflood
inviteflood

Web Stress Testing:thc-ssl-dos

WLAN Stress Testing:
mdk3
reaver

Hardware Hacking:Android Tools:
android-sdk
apktool
baksmali
dex 2jar
smali

Forensic Analysis Tools:
affcompare
affcopy
affcrypto
affdiskprint
affinfo
affsign
affstats
affuse
affverify
affxml
autopsy
binwalk
blkcalc
blkcat
blkstat
bulk_extractor
ffind
fls
foremost
galleta
hfind
icat-sleuthkit
ifind
ifind
ils-sleuthkit
istat
jcat
mactime-sleuthkit
missidentify
mmcat
pdgmail
readpst
reglookup
sorter
srch-strings
tsk_recover
vinetto

Digital Forensics:
autopsy
binwalk
bulk_extractor
chrootkit
dc3dd
dcfldd
extundelete
foremost
fsstat
galleta
tsk_comparedir
tsk_loaddb

Forensics:Anti-Virus Forensics Tools:
chrootkit

Arduino Tools:arduino

Forensic Suites:
autopsy
dff

Forensic Imaging Tools:
affcat
affconvert
blkls
dc3dd
dcfldd
ddrescue
ewfacquire
ewfacquirestream
ewfexport
ewfinfo
ewfverify
fsstat
guymager
img_cat
img_stat
mmls
mmstat
tsk_gettimes

Forensic Hashing Tools:
md5deep
rahash2

Forensic Carving Tools:
binwalk
bulk_extractor
foremost
jls
magicrescue
pasco
pev
recoverjpeg
fifiuti
rifiuti2
safecopy
scalpel
scrounge-ntfs

Media Capture:
cutycapt
recordmydesktop

Reporting Tools:Evidence Management:
casefile
keepnote
magictree
maltego
metagoofil
truecrypt

Password Forensic Tools:
chntpw
PDF Forensic Tools:
pdf-parser
peepdf
RAM Forensioc Tools:
volafox
volatility

Network Forensics:p0f

SSH:
sshd restart
sshd start
sshd stop

MySQL:
mysql restart
mysql start
mysql stop

Metasploit:
community / pro start
community / pro stop

System Services:HTTP:
apache2 restart
apache2 start
apache2 stop

Read more…

'The Moon' worm exploits Linksys routers

On Sunday, The technical details about vulnerability in Linksys routers which exploited a huge list of device models came into picture. Previous week, Security Researchers from the SANS Institute's Internet Storm Center identified a self replicating malware program named as 'The Moon' that exploits an authentication bypass vulnerability to infect Linksys routers.

As per the report from SANS ISC, The vulnerability was found in a CGI script that's part of the administration interface of multiple Linksys' E-series router models. The name of a CGI script is not revealed yet.

Here are some of the models list that might be vulnerable, E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000, E900, E300, WAG320N, WAP300N, WAP610N, WES610N, WET610N, WRT610N, WRT600N, WRT400N, WRT320N, WRT160N and WRT150N. List might not be accurate.

This vulnerability was found on Sunday from a Reddit user named as Rew, who was also an exploit writer believed that the four CGI were vulnerable while using the online alias, later he confirmed that two scripts are vulnerable and published a proof-of-concept exploit. He stated, "I was hoping this would stay under wraps until a firmware patch could be released, but it appears the cat is out of the bag,"

Belkin, The owner of Linksys didn't named the exact models which are affected but confirmed that some Wireless-N routers are affected. Linksys published a technical article on its website with instructions on how to install the latest firmware version and disable remote management on affected devices.

"Linksys is aware of the malware called 'The Moon' that has affected select older Linksys E-Series routers and select older Wireless-N access points and routers," said Karen Sohl, director of global communications at Belkin, in an emailed statement Sunday. "The exploit to bypass the admin authentication used by the worm only works when the Remote Management Access feature is enabled. Linksys ships these products with the Remote Management Access feature turned off by default."

Read more…

Mozilla Foundation's Chairwoman to generate revenue

The Mozilla Foundation's chairwoman Mitchell Baker former CEO of Mozilla Corp. who funds for the development of Firefox, defended the decision to pursue in-browser ads, saying that it's important to generate revenue.

Her statement was, "To explicitly address the question of whether we care about generating revenue and sustaining Mozilla's work, the answer is yes".

On Thursday, The chair of the parent foundation wrote on his blog, "In fact, many of us feel responsible to do exactly this."

In her post, Baker wrote that Firefox users as well as the code contributors and employees were suspicious of any connection to commercial or business needs, including producing revenue.

"Pretty much anytime we talk about revenue at Mozilla people get suspicious," she said. "Mozillians get suspicious, and our supporters get suspicious. There's some value in that, as it reinforces our commitment to user experience and providing value to our users."

She further added, "When we have ideas about how content might be useful to people, we look at whether there is a revenue possibility, and if that would annoy people or bring something potentially useful," Baker said. "Ads in search turn out to be useful."

Now new users will see pre-populated tiles in the Firefox. Before Firefox users, that page, which has room for nine tiles which showed the most recently visited website. For new users, Firefox will fill the new page spot.

Denelle Dixon-Thayer, Mozilla's vice president of business and legal affairs, on Thurday try to explain as to why Mozilla is looking for other sources of revenue.

"Revenue diversification isn't a requirement because our search partnerships are strong and provide value to our users, to our partners and to Mozilla," Dixon-Thayer said. "Diversification is a choice for us, but just as diversity is central to a healthy Web, revenue diversity is central to a healthy project."

Mozilla's 88% of its 2012 revenue came from the agreement with Google that requires Mozilla to use Google's search engine as the default search engine. Mozilla was paid approximately $274 million by Google in 2012, a year when the former recorded total income of $311 million.

The Google-Mozilla deal was last renewed on December 2011 for three years.Dixon-Thayer told that Mozilla's attempt to diversify revenue will leads not to deal with Google this year. There will be a loss of Approximately $300 million if deal fails.

According to Web analytics  company Net Applications, Firefox accounted for 18% of the world's desktop browser user share in January, down from 22% in late 2011 when it last dealt with Google

Read more…