NSA Got Hacked By Its Very Own Vulnerability

You need one hundred and four dollars, more or less, eight hours and Amazon’s cloud computing to hack the National Security Agency’s website. Oh, and you need to make use of the NSA’s very own FREAK vulnerability to hack them in their own game.

A group of researchers did just that, using a few tools to implement man-in-the-middle-attacks. This is an ability that swiftly creates an outcome of 512 bit RSA (RSA is one of the first practicable public key crypto systems and is widely used for secure data transmission) keys.

The bug was reported on Monday. It allows the attacker to take control of secure connections between people using iOS devices or Android devices. This gives hackers a chance to mimic the target and steal private information like login details and passwords.

To factor the 512 bit export keys, the project enlisted the help of Nadia Heninger at University of Pennsylvania, who has been working on “Factoring as a Service” for exactly this purpose. Her platform uses CADO NFS on a cluster of EC2 virtual servers, and (with Nadia doing quite a bit of handholding to deal with crashes) was able to factor a bunch of 512 bit keys; each in about 7.5 hours, for $104 in EC2 time according to Vice.

Let us explain the FREAK vulnerability to you in a more detailed manner:

Earlier this year, many cyber security companies revealed information about a vulnerability in OpenSSL. OpenSSL started accepting temporary RSA keys when using non-export cipher suites. A malicious server could make a TLS/SSL client using OpenSSL, using a weaker key exchange method.

As stated earlier, OpenSSL clients accepted EXPORT-grade insecure keys even when the client had not initially asked for them. This could be exploited using a man-in-the-middle attack, which would intercept the client’s initial request for a standard key and ask the server for an EXPORT-grade key. The client would then accept the weak key, allowing the attacker to factor it and decrypt communication between the client and the server.

The vulnerability affects all Linux systems too, including the Server, Workstation, Desktop, and HPC Node variants that have not installed the fixed version of OpenSSL packages.

While the use of EXPORT-grade ciphers is disabled by default in OpenSSL), it can be enabled by applications that utilize the OpenSSL library. For this reason, the vulnerability is able to affect all Linux 6 and 7 systems, including the Server, Workstation, Desktop, and HPC Node variants, which have not installed the fixed version of OpenSSL packages.

However, using Internet-wide scanning, we can perform daily tests of all HTTPS servers at public IP addresses to determine whether they allow this weakened encryption. More than a third of all servers with browser-trusted certificates are at risk. i.e all the HTTPS servers at Alexa’s top 1 million domain names have their current vulnerability levels at 8.5 percent. HTTPS servers with browser trusted certificates are at 6.8 percent vulnerability, and the rest of the HTTPS servers are at 11.8 percent.

Browsers are vulnerable to the FREAK attack because of bugs that allow an attacker to force them to use weak, export-grade encryption. One example is the OpenSSL bug described in CVE-2015-0204, but some other TLS libraries have similar problems.

You can check whether your browser is vulnerable using our FREAK Client Test Tool.

Chrome for Windows and all modern versions of Firefox are known to be safe. However, even if your browser is safe, certain third party software, including some antivirus products and adware programs, can expose you to an attack by intercepting TLS connections from the browser. If you are using a safe browser but our client test says you’re vulnerable, this is a likely cause.

In addition to browsers, many mobile apps, embedded systems, and other software products also use TLS. These are also potentially vulnerable if they rely on unpatched libraries or offer RSA_EXPORT cipher suites.

If you are running a server, then you should immediately disable support for TLS export cipher suites. While you’re at it, you should also disable other cipher suites that are known to be insecure and enable forward secrecy. For instructions on how to secure popular HTTPS server software, we recommend Mozilla’s security configuration guide and their SSL configuration generator. We also recommend testing your configuration with the Qualys SSL Labs SSL Server Test tool. If you are a systems admin or are a developer, then please make sure any TLS libraries you use are up to date. Unpatched OpenSSL, Microsoft Security Channel, and Apple Secure Transport all suffer from the vulnerability. Note that these libraries are used internally by many other programs, such as wget and curl. You also need to ensure that your software does not offer to export cipher suites, even as a last resort, since they can be exploited even if the TLS library is patched. We have provided tools for software developers that may be helpful for testing this.

Furthermore, if you are using Microsoft Vista or newer versions of Windows, you can take the following steps as the system administrator to protect yourself. However, not all versions of Vista, Windows 7, and Windows 8.x include the critical gpedit.msc program. Vista Home Premium; Windows 7 Home Premium, Home Basic and Starter, and Windows 8.x Home Premium do not include it. There are ways to add gpedit to these systems.

Go to computer configuration> Administrative Templates> Network>SSL Configuration Settings. Under SSL Configuration Settings, click the SSL Cipher Suite Order setting. In the SSL Cipher Suite Order pane, scroll to the bottom of the pane. And simply enter the following cipher list.

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,

TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,

TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,

TLS_DHE_DSS_WITH_AES_256_CBC_SHA,

TLS_DHE_DSS_WITH_AES_128_CBC_SHA,

TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA

These will keep you protected and safe. We at Anonymous want our friends and readers to be up to date. As for normal users, we once again recommend that you use up-to-date Firefox and Chrome.

BLOGGER.COM OR WORDPRESS, WHICH ONE IS BEST FOR BLOGGING?

New bloggers and freshers are often confused in selecting the best platform as their blog hosting providers. They don't sure of selecting the right blog hosting service and end up with what to be select? If they select any of Blogger or Wordpress, still they don't feel satisfy and think that something is done wrong with their selection. I am personally asked this question many times by bloggers. So, in this post am going to highlight the major benefits and limitations of both Blogger.com as well as Wordpress. After reading this, anyone can set their mind easily to select the best blog hosting provider.

Blogger

Blogger was started by a tiny company in San Francisco called Pyra Labs in August of 1999. It was bought by Google in 2003. Blogger is a blog-publishing service that allows multi-user blogs with time-stamped entries. the blogs are hosted by Google at a subdomain of blogspot.com. Blogs can also be hosted in the registered custom domain of the blogger and blogspot.com domain publishings will be redirected to the custom domain.

Features of Blogger.com

1. A user can have up to 100 blogs per account.

2. Blogger allowed users to publish blogs on other hosts, via FTP.

3. Blogger allows its users to use their own domain free of charge.

4. It allows storage space up to 15GB to upload videos and Images in Blog.5. Blogger provides multiple country-specific URLs automatically for blogs hosted by different countries. For example if it is used by Indian then, it will be redirected as example.blogspot.co.in and if it owned by United Kingdom (UK) then it will be redirected as example.blogspot.co.uk.

6. Languages supported by Blogger is - Arabic, Bengali, Bulgarian, Catalan, Chinese (Simplified), Chinese (Traditional), Croatian, Czech, Danish, Dutch, English, Filipino, Finnish, French, German, Greek, Gujarati, Hebrew, Hindi, Hungarian, Indonesian, Italian, Japanese, Kannada, Korean, Latvian, Lithuanian, Malay, Malayalam, Marathi, Norwegian, Oriya, Persian, Polish, Portuguese (Brazil), Portuguese (Portugal), Romanian, Russian, Serbian, Slovak, Slovenian, Spanish, Swedish, Tamil, Telugu, Thai, Turkish, Ukrainian, Urdu Vietnamese. Nepali, Farashi.Bemba,Tonga, Tumbuka and cewa.

7. Blogger allows its users to choose from various templates and then customize.

8. Speed of blog hosted on Blogger.com is usually 40% more faster than others.

9. HTML template editor, so bloggers can use their own designed templates.

10. Blogs are Mobile friendly that are hosted by Blogger.com.

11. SEO friendly.

12. High security for blogs.

Limitations of Using Blogger.com

1. Storage for uploading media files (Images, Videos) is of 15 GB only. If you need more then you will have to buy space by paying money.

2. Number of blogs per account is 100.

3. Moving your site from Blogger to a different platform is a complicated task. There is a significant risk that you will loose your SEO (search engine rankings(, subscribers, and followers during the move.

4. Blogger allows you to export your content but your data will stay on Google’s servers for a very long time.

5. Support service is limited, mostly through forums only.

WordPress

WordPress started in 2003 by its founders, Matt Mullenweg and Mike Little with a single bit of code to enhance the typography of everyday writing and with fewer users than you can count on your fingers and toes. Since then it has grown to be the largest self-hosted blogging tool in the world, used on millions of sites and seen by tens of millions of people every day.

Wordpress is based on PHP and MySQL. 

Features of Wordpress

1. WordPress was used by more than 23.3% of the top 10 million websites.

2. WordPress users may install and switch between themes.

3. WordPress's plugin architecture allows users to extend the features and functionality of a website or blog.

4. WordPress has over 40,501 plugins available which offer custom functions and features.

5. Mobile friendly.

6. Storage for free Wordpress blogs is only up to 3GB, which is less than Blogger.com

7. Free templates available to edit for blogs.

8. Support system is Good.

9. Using WordPress, you can move your site anywhere you want. You can move your WordPress site to a new host, change domain name, or even move your site to other content management systems.

10. Advance plugins for SEO.

Limitations of using Wordpress

1. Storage is only up to 3GB

2. Complex for newbie bloggers, even I also don't know how to use WordPress perfectly.

3. Less security for Blogs

Conclusion:

Saying any of both as best will not fair, both have their significant importance. Selection depends on the need of blogger who is going to start blogging. After reading above given point and comparison, anybody can easily make their decision about which one is to use or which should avoid.

Top 5 Facebook Scams That You Should Be Aware Of

The bigger and popular sites with the huge number of visitors are like hackers’ wonderland for posting scams. Especially the users on social media websites are prone to such scams that further convert to dangerous cyber attacks. Facebook has about 1.4 billion users making it potentially the most active social media site for the hackers.

These are some of the common Facebook scams that you might fall for if you haven’t before:

5) Viral Videos/ Scandals

The word “Viral” itself has become viral which makes you yearn and see the content inside. It could be anything ranging from cute puppy videos to horrendous torture videos by terrorists. More popular in these viral videos are salacious celebrity scandals which generally contain no video at all- but a link to another phishing website or require to install an update or a plugin. Once you do that, the virus is automatically installed in your system. And you know what happens next..

You will never get adult videos on any social media website, so if you happen to scroll through one on your home page, then it is definitely a Facebook scam.

4) Free Giveaways/Survey Scams

Nothing is free in this world my friend. Especially free travel tickets, and definitely not iPhones, iPads or Mac. The social media are full of such spam offers that sound too good to be true, and coaxes you as if you are the world’s luckiest person.

There are also survey scams that trick you into giving your personal information in exchange of gift vouchers or free trips. Do not fall for these Facebook scams and never forward them to your contacts either, else you would end up spamming your friends too.

Recommended: How Attacker Can Hack Your Email Account Just With Your Phone Number

3) Facebook Customization

If any link on your home page claims to change the layout, color or give you a special “Dislike Button” give any special functionality, then it is probably another Facebook scam. You can’t just change the official interface of the world’s biggest social media website by clicking a few phishing links.

These scams will either ask you to install their specific Facebook app or ask to fill a desirability form of what changes you want. Once in, they will get full access to your data or through phishing forms spread malware into your system.

If Facebook would some day want to give you customization features, then they make a grand announcement, not any hidden link. So, be alert and avoid yourself from such Facebook scams.

2) Celebrity Friend Requests/Charity

This might not happen as frequently as others but when someone falls for this Facebook scam, it hits him/her very hard. You come by a friend request of a celebrity or from so-called official  page. Then they will ask you to donate some money for the poor or the disaster struck people.

Either they will ask your credentials or directly tell you to donate through online payment services. Never trust such messages to stay safe on Facebook.

1) Who Viewed My Profile?

This is the biggest and most pervasive Facebook scam ever. Facebook has made it pretty clear that there is no way any app can tell who has visited your profile and how many times. Any link or app that claims to do so is a scam.

In these scams, you will have to give in your information and accept their terms and conditions. This scam play with the emotions of the users as most of us want to know if their secret crush or an ex-partner visits them online.

The application does tell who viewed your profile based on an algorithm, but till then you are already been infected by the app and under attack.

So, avoid all these malicious and fraudulent apps and links to be safe on the social media. With this, we end the list of biggest Facebook scams.

We will let you know if come by any more of such scams. You can also tell us.

How An Attacker Can Kill Your Phone and PC by Making It Older and Some “MAGIC”

The performance of an IC degrades over a period of time and it ultimately results in the failure of the device. This is just like the human beings – we age, our body functions stop working and ultimately we die. However, some genetic disorders can make this aging process faster to make you weaker sooner than expected.
Along the similar lines, the researchers at NYU have recently published a paper (find the link below) that shows how to infect the electronic devices with the digital version of this aging disorder.

The computer scientists at NYU have unveiled methods that could be used to attack the device hardware by causing the integrated circuits to age rapidly. The paper titled “MAGIC: Malicious Aging in Circuits/Cores” describes the effects of the MAGIC attack on a smartphone, that could result in the failure of your device.

On one hand the IC designers are putting their tremendous efforts into reducing the aging of electronic chips, the attackers are working in the opposite direction to accelerate the wear. Discussing the Negative-Bias Temperature-Instability (NTBT), the researchers focus on presenting a framework to wear out the processors.

Microsoft doesnt want Windows 10 users to use Chrome

Microsoft wants users to use Edge browser instead of Google’s Chrome on Windows 10

Microsoft is finding new ways to convince Windows 10 users to use its new Edge browser instead of Chrome or Firefox. In the newly released Windows 10 preview Build 10568, the Redmond giant has added a new prompt targeting users switching default apps. If you have Microsoft Edge set as the default browser and install Chrome and switch defaults then a dialog box with “give Microsoft Edge a shot” appears. The popup also has a message in bold and blue that Windows 10 user “Dont Switch and try it now.”

The popup further tells the users that Microsoft Edge lets you write on webpages, has Cortana integration, and includes a reading view.

This Microsoft move is likely to irk Google and Firefox  Mozilla CEO had blasted Microsoft earlier when the tech giant had made it harder to switch to Firefox in Windows 10, and the company even created a tutorial video to help Firefox users restore their default app settings.

Microsoft appears to be doing the same for photo and music apps, too. If you attempt to switch defaults then a similar dialog box appears to try and convince you to stick with the built-in photos or Groove Music apps.

Kindly note that earlier builds of Windows 10 dont have these popups and it is only seen in the new build which is expected to ship in the next few weeks. It is also possible that Microsoft could and will tweak exactly when and how this prompt appears.

On a side note, despite Microsoft’s best of effort, the newly released Edge browser has not found the liking among Internet users.

Man Arrested For Calling Police Racist in Facebook Comment Receives $35K Settlement

Man Arrested For Calling Police Racist in Facebook Comment Receives $35K Settlement.

Madison, WI — Thomas Smith, 27, was arrested and charged with disorderly conduct for leaving negative remarks on a local police department’s Facebook page back in 2012. After fighting the charges with his own lawsuit, Smith was recentlyawarded a $35,000 settlement because his rights were violated by the arrest.

The feud between Smith and the police began after he left a number of comments on a police department facebook page. In a comment thread started by Officer Nicholas Stroik, another Facebook user identified Stroik as a racist and said he had expressed that African-American people “don’t belong in his town.”

Smith then posted two comments in response, saying “Fuck the fucking cops they ant shit but fucking racist basturds an fucking all of y’all who is racist” and “Fuck them nigers bitchs wat you got on us, not a dam thing so fuck off dicks.” [Spelling in original].

Smith’s posts, along with any other posts criticizing the police were quickly deleted. However, soon after, he was contacted by police who asked him if he had made the comments. When he admitted to exersizing his right to free speech, he was arrested and charged with disorderly conduct and unlawful use of a computer.

After he was arrested, Smith told the police “I put it on there, I don’t regret it and I mean it.” He was subsequently banned from using a computer or phone.

The prosecution argued that Smith’s posts were not protected by free speech because they were classified as “fighting words.”

Initially, Smith was convicted and was sentenced to a year of probation and 25 hours of community service.

But shortly after, he ended up winning the case on appeal and having the convictions thrown out. The appeals court ruled that the “fighting words” doctrine only applies when the two parties are within close proximity to one another.

“In our country, we are entitled to criticize our government with passion, The use of some four-letter words in the course of doing so is never a crime,” Smith’s attorney, Thomas Aquino said in a statement.

Apple told Judge: It's Impossible to Access Data on Locked iPhones

US Federal Official: Unlock that iPhone for me?

Apple: Sorry, Nobody can do this! Neither we, nor you.

Yes, in a similar manner, Apple told a U.S. federal judge that it is "IMPOSSIBLE" to access data stored on a locked iPhone running iOS 8 or later iOS operating system.

In short, Apple has reminded everyone that the tech giant can not, and will not, break its users’ encryption if the government official asks it to.

Apple revealed this in a court filing late Monday in response to the U.S. federal magistrate judge, who is being requested by the Justice Department to force the company to help authorities extract data from a seized iPhone.

However, Apple says that it has the "technical ability" to help federal enforcement unlock older iOS devices – and almost 10 percent of iOS devices are running older versions of the operating system.

In the brief filed Monday, Apple said:

"In most cases now and in the future, the government's requested order would be substantially burdensome, as it would be impossible to perform. For devices running iOS 8 or higher, [the company] wouldn't have the technical ability to do what the government requests – take possession of a password protected device from the government and extract unencrypted user data from that device for the government. Among the security features in iOS 8 is a feature that prevents anyone without the device’s passcode from accessing the device’s encrypted data. This includes Apple."

A hearing regarding this case is expected to take place on this Friday, which will determine whether or not the company can be forced to help the federal agencies access the locked iPhone data on a search warrant.

While Apple has positioned itself as a strong defender of its user privacy, still your iPhone is not completely protected. Last year, security researcher Jonathan Zdziarski published a blog post showing how some data is still within the government's scope.

So, it is just the protection that the big tech giant is providing you and hopefully, will not help break down.

In an open letter posted on its website, Apple's CEO Tim Cook clearly tells his customers that "We have never worked with any government agency from any country to create a backdoor in any of our products or services. We have also never allowed access to our servers. And we never will."

HOW TO DOWNLOAD SUBTITLES AUTOMATICALLY IN VLC MEDIA PLAYER

Today we are here with a cool trick to Automatically Download Subtitles in VLC Media Player. Many of you must love watching movies in your Pc. As these are the best way for entertainment and spending free time. So movies becomes interesting when it comes with subtitle as it gets easier to catch out the exact words used in movies. But sometime subtitles are not available at that time you can get the subtitles with the method we gonna discuss right here. So have a look on the method below to get the subtitle of any movie in your VLC Media player.

How to Download Subtitles Automatically In VLC Media Player

The method is quite simple and easy and with that you can get subtitle of any movie online with your VLC media player, without need to download each manually. And with that you can enjoy your movies better. So proceed with the steps below.

Steps To Download Subtitles Automatically in VLC Media Player

1. First of all Download Vlsub extension in your computer.
2. Now extract the zip file and then copy the vlsub extension there.
3. Now go to the location C:\Program Files (x86)\VideoLAN\VLC and there create a new folder with name extensions.
   
4. Now in that folder paste the vlsub file that you had copied in step 2.
   
5. Now open VLC media player and click on view option there and you will see vlsub option there.
   
6. Now play your favorite movie in your VLC media player and then click on the visub extension in the view.
7. In dialog box that appeared search for the movie title and then select the movie from the list below and then click on Download Selection.
   
8. Thats it your are done, your movie will now get played with the subtitles.

So above is the most easy way for How to Download Subtitles Automatically in VLC Media Player. With this you will enjoying all your favorite movies with their subtitle and movie understanding will be easy with this. Hope you like this, do share with others too. Leave a comment below if you have any related queries with this.