Researchers Hack GSM phones.

Researchers have shown a simple technique for eavesdropping on individual GSM mobile calls without the need to use expensive, specialized equipment. This kind of GSM snooping has been possible for a long time, but it’s always been very expensive.
During a session at the Chaos Computer Club Congress (CCC) in Berlin, Karsten Nohl and Sylvain Munaut used cheap Motorola handsets running a replacement firmware based on open source code to intercept data coming from a network base station.

Implementing & Preventing SQL Injection Attacks Tutorial -4

This summary is not available. Please click here to view the post.

Implementing & Preventing SQL Injection Attacks Tutorial -3

This summary is not available. Please click here to view the post.

Google's new feature: Hacked site alert.

Google has added a new feature to it's search engine. It can alert the users in its search result for websites that might have been compromised by displaying the link - 'This site may be compromised'. When users click the new "This site may be compromised" link, they get directed to more information in the Help Center. The websites flagged as compromised are still accessible.
It's a great idea to alert the naive users from being affected by malware & spyware & avoid affecting other users. Google plans to alert the hacked site's webmaster, as well, Wald said. The search engine giant already provides a notification in search results for sites that are potentially serving up malware.

CONFICKER Worm : How to remove & protect your systems?

If you are a technical user, you can follow these steps:
http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en
Other customers can follow these steps to remove W32/Conficker.worm and prevent it from spreading:
   1. Install Microsoft Security Update MS08-067: http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

CONFICKER Worm : What does it can do?

If you have installed latest security updates & do have a updated anti-virus, then the your are probably protected from conficker.
Win32/Conficker.B might spread through file sharing and via removable drives, such as USB drives. It adds a malicious file to the removable drive so that when the drive is used, the AutoPlay dialog box will show one additional option. The Conficker worm can also disable important services on your computer. The option Open folder to view files — Publisher not specified was added by the worm

CONFICKER Worm : What is it anyways?

Conficker, formally named W32/Conficker.worm, also known as Downup, Downadup and Kido. It uses flaws in Windows software and Dictionary attacks on administrator passwords to co-opt machines and link them into a virtual computer that can be commanded remotely by its authors. Conficker has spread rapidly into what is now believed to be the largest computer worm infection since the 2003. Researchers have found 5 variants of conflickers - Conficker.A, Conficker.B, Conficker.C, Conficker.D & Conficker.E.

Implementing & Preventing SQL Injection Attacks Tutorial -2

In the previous post, we have seen a basic sql attack structure. In this site, we will understand - how to find sql attack vulnerable site. To find SQL vulnerable sites, we can use google. We search for a specific strings in google to get sites which are revealing some information about the site. Such strings are called 'Google Dorks'. After that, we will check whether the site is vulnerable or not.
Most of these Dorks are found in .php sites.

Implementing & Preventing SQL Injection Attacks Tutorial -1

SQL Injection attacks are one the most well known penetration attacks. Major id theft/credit card/bank theft are conducted through SQL injection attacks. It's easy to implement & if you are well versed with sql syntax. SQL injection attacks are carried on by injecting dangerous SQL queries in the sql database of a site/organisation to make it to fetch sensitive/classified collection of data which may be username & password or email address or credit card no.

AmIHackerProof.com 2.0 : Free Vulnerability Scanner Security Service

LIGATT security International launched the upgrade version of their new web service, AmIHackerProof 2.0 for the everyday customers & small business who can't afford to pay large sum of money for security audit. AmIHackerProof 2.0 is an online security audit service with the capability to detect vulnerabilities on a person's computer, or network. The service is free of cost.

New Windows (working in XP/Vista/7) zero-day flaw bypasses UAC [privilege escalation exploit]

A new privilege escalation exploit has been unraveled. To execute the attack, just download a file & execute the file poc.exe. Your non-administrator user account will be promoted to administrator. See the picture.

SHODAN - Vulnerability Scanner search engine.

SHODAN is a search engine that can be used as a vulnerability scanner. It  finds specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners.

Stuxnet - The standard malware, if not unusually sophisticated!

Symantec has issued a dossier on Stuxnet depicting ins-outs of the malware, who were the targets & what was the objective.
According to Symantec, Stuxnet targets specific frequency converter drives ( only frequency drives from two companies that are running at high speeds – between 807Hz and 1210Hz.) — power supplies that are used to control the speed of a device, such as a motor. The malware intercepts commands sent to the drives from the Siemens SCADA software, and replaces them with malicious commands to control the speed of a device, varying it wildly, but intermittently.

FIRESHEEP - new cookie sniffing hack!

Firefox users now have a new & easier point & click tool to sniff others cookies. It's somewhat easier to implement than sidejacking. Firesheep created a frenzy in social network & email users communities some days ago.

Hide your files in jpeg File without any Software!

This is quite an old trick but still works fine. Its a type of stenography technique where we try to hide a file inside another file.    
You will only need to download WinRAR & install it.

Super Hiding the folder easily using cmd command!

For hiding your folder execute the command
X:\> attrib +a  +r  +s +h foldername /s /d [enter]

 For unhiding:
X:\> attrib -a  -r  -s  -h foldername /s /d [enter]
X= x is location for our folder in hard disk.

Enabling telnet in vista/7 & Sending anonymous emails!

 In Windows Vista & windows7 telnet is disabled by default because of its security issues (passes messages in plain text, easy to sniff passwords & credentials, so its obsolete now).
In order to enable go to control panel
> Programs
> Programs & Features
> click on 'Turn Windows Feature on or off' on the left panel
> new window appears, tick check boxes telnet server or telnet client or both as per your need.
> click ok
> open cmd & start telneting to another telnet enabled computers (for command
queries type telnet /? in cmd)

Creating Linux environment & installing Linux softwares in Windows!

There are plenty of solutions for achieving linux environment in Windows.
1)Installing Cygwin creates linux environment. But all programs are not supported by cygwin. Also it may create problems in newer versions of windows. It consists of two parts:
  # A DLL (cygwin1.dll) which acts as a Linux API emulation layer providing substantial Linux API functionality.
  #  A collection of tools which provide Linux look and feel.
Problems regarding cygwin
 # Cygwin is not a way to run native linux apps on Windows. You have to rebuild your application from source if you want it to run on Windows.
 # Cygwin is not a way to magically make native Windows apps aware of UNIX  functionality, like signals, ptys, etc. Again, you need to build your apps from source if you want to take advantage of Cygwin functionality

Sidejacking -- Serious threat to Wireless Network users!

The purpose of this post is to create awareness about the sense of insecurity while accessing wireless networks & not to encourage illegal hacking activites.

Sidejacking tool is available here. -- http://erratasec.blogspot.com/2007/08/sidejacking-with-hamster_05.html
Sidejacking tool consists of ferret & hamster. Ferret sniffs cookies & hamster convert that cookie information into something Browser can understand, also it acts as internal proxy server. So its a point & click attack & very easy to implement.

Information about sidejacking---
http://www.tgdaily.com/security-features/34324-tg-video-wirelessly-hacking-gmail-and-more-tutorial
http://erratasec.blogspot.com/2008/01/more-sidejacking.html

Try creating some easy animation!

For creating animations in very easy way, plenty of softwares are available, some are online & some you can download one your pc & use it. I have come across such a software called UnFreez. The resulted animated gif image just takes a collection of gif images & play them with some delay. Its very easy to use.
This is a video from Tinkernut which guides on the usage of UnFreez.