Ways for Tracking your Stolen Laptop
Posted by Mourad Ben Lakhoua in Open-Source, Safety rules, Tools on August 25, 2010
Getting back your lost laptop is always possible, for mobile devices it is easier to find it because of IMEI number which can identify your device on the GSM Network and it can be displayed by entering *#06# into the keypad on most phones. Changing this unique number is possible but not simple.
Now for the Notebook things are getting more serious because without a special technique you cannot track you laptop or computer, at each network there is a getaway and even if you will have access to all cities getaway logs you should look at the Mac address of your Network devices, well this is not simple.
Creating a VPN will solve the issue because when your laptop boots it will search for the VPN server on Internet and you can get by IP the location of your laptop, LogMeIn Hamachi² which is a hosted VPN service that securely connects devices and networks, extending LAN-like network connectivity to mobile users can help in performing this.
Well this comes as one solution but for sure there are many, another Open Source and free project that can track any Machine using any operating system is Prey, Prey helps you locate your missing laptop by sending timed reports with a bunch of information of its whereabouts. This includes the general status of the computer, a list of running programs and active connections, fully-detailed network and wifi information, a screenshot of the running desktop and — in case your laptop has an integrated webcam — a picture of the Gangsters.
Prey uses a remote activation system which means the program sits silently in your computer until you actually want it to run. If so, it gathers all the information and sends it to your Prey web control panel or directly to your mailbox. The thief will never know his movements are being watched.
The last very useful tool is TeamViewer which gives you the opportunity to connect your laptop even if you don’t know the IP address so you can have the location and turn on your webcam to see who is sitting in front of your Laptop.
make sure you subscribe to my RSS feed!
Wardriving These Days (Part 2)
Posted by Mourad Ben Lakhoua in Pentesting, Tools on August 20, 2010
Tools for the first part may not be completed without SpoonWEP/SpoonWPA which firstly introduced in BackTrack3, this is also a part of aircrack-ng with a graphical interface allows pentester to take the same channel of the Access point and crack the security keys of the AP.
Another very interesting tool is Karmetasploit which allows you to fake access points, capture passwords, harvest data, and conduct browser attacks against clients.
Wireless penetration testing does not exist as programs only as in Backtrack but you can find a ready solution as the wifi peanaple. which is a nice trick that any person at home, the office, coffee shops or airports will not doubt that the peanaple contains a rogue access point that may conduct a Man in the middle attack and have all users credential, the price of WiFi Pineapple is 119$.
When any person turn on their laptops the wireless network software automatically connects to access points they remember. So the laptop starts to send out beacons. These beacons say “Is such-and-such wireless network around?” , wifi peanaple replies to these beacons and says “Sure, I’m such-and-such wireless access point – let’s get you online!”.
WiFi Pineapple is powered over battery and wireless hacking device based on the Fon 2100 access point.
make sure you subscribe to my RSS feed!
Symantec: Tapsnake Game Tracks Your Location
Posted by Mourad Ben Lakhoua in Anti-Viruses, News, Software Security on August 18, 2010
Symantec researchers reported a new malicious application in the virtual store Android Market, this application can determine users location in real time on AndroidOS.
Tapsnake is the name of the game which is a version of the popular game “Snake”. Game developers did not provide any information that the application sends each 15 minute victims specific location to a special server without the knowledge of user.
According to Symantec Developers describe the application as follows:
“Download and install the free Tap Snake game app from the Market to the phone you want to spy on. Press MENU and register the app to enable the service. Use the GPS Spy app with the registered email/key on your own phone to track the location of the other phone. Shows the last 24 hour of trace in 15 min increments.”
While the Trojan uploads the GPS data every 15 minutes to an application running on Google’s free App Engine service. GPS Spy then downloads the data and uses this service to conveniently display it as location points in Google Maps.
Well to have Tapsnake working attacker’s needs to have access to smartphones what is difficult and Android installation program notify users about any suspicious activities on the smartphone which is also a very good security measures.
For the best protection it is important to be careful during installing any third-party application on your mobile devices.
make sure you subscribe to my RSS feed!
Vulnerability Makes All Facebook Accounts Exposed
Posted by Mourad Ben Lakhoua in Social Networking, Vulnerabilities, Vulnerabilities & attacks on August 13, 2010
New Vulnerability has been discovered in facebook that allows an attacker to obtain all users credential on the social network website. By having the email address an attacker can get the name and pictures of victims.
The vulnerability can works regardless of the account privacy settings, this mean that even if your account hidden from all search engines it is possible to have the sensitive information.
The result of gathered information can be used for phishing attacks or any other issue.
According to the researchers if someone has a list of email address that he has no clue about. He can feed them to Facebook one by one (or in a list, using a script like this) and chances are that he’ll get more than 50% hits. Useful for phishing attacks (People will get more convinced when they see their *real* names).
Or an attacker can randomly generate email addresses and create a database with user’s names and pictures, which mean that you have no privacy and your information, can be easily found.
Update :
Facebook, in a statement sent to SCMagazineUS.com on Thursday, said the glitch has been fixed.
“We have technical systems in place to prevent people’s names and profile photos from showing to unrelated users upon login, but a recently introduced bug temporarily prevented these from working as intended,” Facebook said in a statement. “We remedied the situation swiftly.”
make sure you subscribe to my RSS feed!
DDoS Attack Target DNS Made Easy
Posted by Mourad Ben Lakhoua in News on August 10, 2010
DNS Made Easy have restored there online services after a distributed denial of service attacks on last Saturday. The reported size of DDoS is about 50 Gb/sec.
Identity and attackers motives have not been clarified yet but specialists assume that a major hacker’s botnet has been hired to conduct this DDoS attack.
On an official statement the company says that services were disrupted for 1,5 hours by this DDoS attack which has lasted for eight hours. While Level3, GlobalCrossing, Tinet, Tata, and Deutsche Telekom helped in reducing the effect of the attack.
Currently this is the most serious DDoS-attack recorded for at least the last 18 months. You can follow latest news http://twitter.com/DNSMadeEasy
while here is a Universal Tips to Avoid DDoS Attack
make sure you subscribe to my RSS feed!
Microsoft to Fix 34 Vulnerabilities on Next Tuesday
Posted by Mourad Ben Lakhoua in Software Security, Vulnerabilities on August 6, 2010
Microsoft Security Response Center released an advance notification regarding new patches that are intended to fix 34 vulnerabilities, there will be about 14 security bulletins the severity rating for eight of them are critical and the other six are important .
Impact of the critical vulnerabilities is under the status of allowing an attacker to perform a remote code execution on the targeted system, as a result a hacker can gain a complete control over victim machine. For all patches a restart is required or maybe required.
List of products affected are all windows operating systems, all Microsoft office versions and Silverlight 2 and 3 while last version 4 are not affected by this vulnerability.
For detecting and deploying these updates Microsoft advice to use Windows Update (WU) and Windows Server Update Services (WSUS), Microsoft Windows Malicious Software Removal Tool and the Microsoft Download Center.
Microsoft Security Bulletin Advance Notification for August 2010 is available over here.
make sure you subscribe to my RSS feed!
Zeus Grabbing Kaspersky’s Digital Signatures
Posted by Mourad Ben Lakhoua in Anti-Viruses, Cybercrime, News on August 6, 2010
Trend Micro threat researchers has reported detecting several malicious web files that are using a strange digital signature which looks like be signed by antivirus company Kaspersky.
After analyzing the files and there signatures there has been a clear difference between the legitimate signature and fake one, the fake copy includes wrong hash values, and the signature has been expired.
This is not all what has been observed but after examining these web files it has been identified as a malicious ZeuS (ZBOT) variants detected as TSPY_ZBOT.BWP, TROJ_ZBOT.BYM, and TROJ_ZBOT.KJT.
This is not the first case that criminals use the Certificates to sign their web malwares. There has been another case about STUXNET malware that was also signed with a certificate from Realtek Semiconductors Corp. which has been later changed to JMicron Technology.
Now Trend Micro has notified Kaspersky Lab about this incident, while you can read more about Zeus here.
make sure you subscribe to my RSS feed!
Wardriving These Days (part 1)
Posted by Mourad Ben Lakhoua in Pentesting, Tools on August 1, 2010
In the past it has been very difficult to crack wireless network we should search for the right software under Linux distribution checking the necessary driver compatibility to inject the packet on the network and finally you get access to the Wi-Fi network, the question do we still have the same difficulties today?
To answer this question we will be searching some online resources to prepare the correct distrubution and making it easy to get the required tools within few steps to evaluate any wireless network.
Today we can find two types of wireless network the first are non-encrypted network that’s mean you will need just a wireless device to be connected, second are using encryption under three forms WEP encryption which is also not any more secure because it can be cracked within few minutes and for 100% but we rarely find this type of encryption, Now most network are encrypted using WPA/WPA2 encryption.
First you need to get a Backtrack copy and you can make it on USB stick using UNetbootin, So you can have it with you everywhere , even if you forget your laptop you pull the USB and you boot on it to have all required tools to do your work.
Now you should check your wireless adapter to be sure that it can work on mode monitoring and this can be made by visiting Aircrack-ng portal.
This will make you ready to use latest tools for wardriving the first one is AUTOMATIC WPA HANDSHKE CAPTURE this tool is a Python script that helps you to get WPA handshakes, what you need to have is the Wlan interface, both Mac addresses of the AP/Client and as a result you will receive the dump traffic with the Handshake.
GerixWiFiCracker is a tool that can be as an extra add to Aircrack-ng for using it you just go to configuration settings and select the interface than press (Start Sniffing and Logging) and (perform a test of injection AP). By using Gerix you can also create a fake AP on the desired channel so your pc will respond to any probe request with a proper probe response, which tells the client to authenticate to the BSSID as in the airbase-ng this will also disrupt all AP on the same channel.
These tools come as update for all previous wireless penetration testing mentioned on SecTechno and there still others to come.
To be continued….
make sure you subscribe to my RSS feed!
Security Acts Magazine No.4
Posted by Mourad Ben Lakhoua in Security Magazine on July 28, 2010
My Friends I want to share with you this new release of security acts, the Magazine contains a very interesting articles on Information security.
Thanks for your follow and continues support. Wish you a happy reading!
http://www.securityacts.com/securityacts04.pdf
make sure you subscribe to my RSS feed!
WPA2 Might Be Spoofed!
Posted by Mourad Ben Lakhoua in News, Privacy & data protection, Vulnerabilities, Vulnerabilities & attacks on July 26, 2010
WPA2 (Wireless Protected Access ver. 2.0) – is the second version of a set of algorithms and protocols that protect data in wireless networks. As expected, WPA2 should significantly increase the security of wireless networks Wi-Fi compared with previous technologies. The standard provides the mandatory use of more powerful encryption algorithm AES (Advanced Encryption Standard) and authentication of 802.1X.
Panel of researchers reported discovering vulnerability in this protocol while it is widely used as a secure standard for wireless network. AirTight Networks said that this vulnerability concerns networks that match the IEEE802.11 Standard. The first demonstration of this vulnerability will be held in Defcon 18 on this week at Vegas.
Hole 196 is the name of this vulnerability and it uses the Man-in-the-middle method of attack, where the user is authorized in a WiFi network to intercept and decrypt all data transmitted and received by others on the same wireless network. Information that the exploit code will be publicly available, so that everyone can test it and use it, while there will be update by and standardizing bodies have been able to make adjustments in WP2.
Md Sohail Ahmad who will be demonstrating the attack at Defcon says that it took about 10 lines of code in open source MadWiFi driver software, freely available on the Internet, and an off-the-shelf client card for him to spoof the MAC address of the AP, pretending to be the gateway for sending out traffic. Clients who receive the message see the client as the gateway and “respond with PTKs”, which are private and which the insider can decrypt.
We will be following this research especially that all Access points are using this protocol and there should be un update available before the demo to fix this vulnerability.
make sure you subscribe to my RSS feed!
SUBSCRIBE
Latest Comments