Patch Tuesday: Microsoft Releases Update to Fix 53 Vulnerabilities

It's Patch Tuesday—time to update your Windows devices.



Microsoft has released a large batch of security updates as part of its November Patch Tuesday in order to fix a total of 53 new security vulnerabilities in various Windows products, 19 of which rated as critical, 31 important and 3 moderate.


The vulnerabilities impact the Windows OS, Microsoft Office, Microsoft Edge, Internet Explorer, Microsoft Scripting Engine, .NET Core, and more.

At least four of these vulnerabilities that the tech giant has now fixed have public exploits, allowing attackers to exploit them easily. But fortunately, none of the four are being used in the wild, according to Gill Langston at security firm Qualys.

The four vulnerabilities with public exploits identified by Microsoft as CVE-2017-8700 (an information disclosure flaw in ASP.NET Core), CVE-2017-11827 (Microsoft browsers remote code execution), CVE-2017-11848 (Internet Explorer information disclosure) and CVE-2017-11883 (denial of service affecting ASP.NET Core).


Potentially Exploitable Security Vulnerabilities


What's interesting about this month's patch Tuesday is that none of the Windows OS patches are rated as Critical. However, Device Guard Security Feature Bypass Vulnerability (CVE-2017-11830) and Privilege Elevation flaw (CVE-2017-11847) are something you should focus on.
Also, according to an analysis of Patch Tuesday fixes by Zero-Day Initiative, CVE-2017-11830 and another flaw identified as CVE-2017-11877 can be exploited to spread malware.

Also, according to an analysis of Patch Tuesday fixes by Zero-Day Initiative, CVE-2017-11830 and another flaw identified as CVE-2017-11877 can be exploited to spread malware.

"CVE-2017-11830 patches a Device Guard security feature bypass vulnerability that would allow malware authors to falsely authenticated files," Zero-Day Initiative said.

"CVE-2017-11877 fixes an Excel security feature bypass vulnerability that fails to enforce macro settings, which are often used by malware developers."


The tech giant also fixed six remote code execution vulnerabilities exist "in the way the scripting engine handles objects in memory in Microsoft browsers."


Microsoft identified these vulnerabilities as CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11871, and CVE-2017-11873, which could corrupt memory in such a way that attackers could execute malicious code in the context of the current user.

"In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website," Microsoft said. "These websites could contain specially crafted content that could exploit the vulnerability."

17-Year-Old MS Office Flaw Lets Hackers Install Malware


Also, you should be extra careful when opening files in MS Office.
All versions of Microsoft Office released in the past 17 years found vulnerable to remote code execution flaw (CVE-2017-11882) that works against all versions of Windows operating system, including the latest Microsoft Windows 10 Creators Update.

However, due to improper memory operations, the component fails to properly handle objects in the memory, corrupting it in such a way that the attacker could execute malicious code in the context of the logged-in user.


Exploitation of this vulnerability requires opening a specially crafted malicious file with an affected version of Microsoft Office or Microsoft WordPad software, which could allow attackers to remotely install malware on targeted computers.


Adobe Patch Tuesday: Patches 62 Vulnerabilities


Besides fixing vulnerabilities in its various products, Microsoft has also released updates for Adobe Flash Player.
These updates correspond with Adobe Update APSB17-33 , which patches 62 CVEs for Acrobat and Reader alone. So, Flash Player users are advised to ensure that they update Adobe across their environment to stay protected.

It should also be noted that last Patch Tuesday, Microsoft quietly released the patch for the dangerous KRACK vulnerability (CVE-2017-13080) in the WPA2 wireless protocol.


Therefore, users are also recommended to make sure that they have patched their systems with the last month's security patches.

Alternatively, users are strongly advised to apply November security patches as soon as possible in order to keep hackers and cybercriminals away from taking control of their computers.


For installing security updates, just head on to Settings → Update & security → Windows Update → Check for updates, or you can install the updates manually..


Update with us..thanku stay safe..









                                                                         Hacker news

Google Begins Removing Play Store Apps Misusing Android Accessibility Services

Due to rise in malware and adware abusing Android accessibility services, Google has finally decided to take strict steps against the apps on its app platform that misuse this feature.

Google has emailed Android app developers informing them that within 30 days, they must show how accessibility code used in their apps is helping disabled users or their apps will be removed from its Play Store entirely.


For those who are unaware, Android's accessibility services are meant to help disabled people interact with their smartphone devices ( such as automatically filling out forms, overlaying content or switching between apps) by allowing app-makers to integrate verbal feedback, voice commands and more in their apps.



Many popular Android apps use the accessibility API to legitimately provide users with benefits, but over the past few months, we have seen a series of malware, including DoubleLocker ransomware, Svpeng , and BankBot, misusing this feature to infect people.
Researchers have even discovered an attack,
Cloak and Dagger, that could allow hackers to silently take full control of the infected devices and steal private data.


This feature that lets malicious apps hijack a device's screen has become one of the most widely exploited methods used by cybercriminals and hackers to trick unwitting Android users into falling victims for malware and phishing scams.


Google planned to resolve this issue with the release of its Android Oreo, but the new Android OS launched without changes in policy related to Accessibility services.


However, Google now appears to be putting an end to apps that use the accessibility services outside of their intended purpose.

"If you aren't already doing so, you must explain to users how your app is using the [accessibility feature] to help users with disabilities use Android devices and apps," part of the email sent out to developers reads.

"Apps that fail to meet this requirement within 30 days may be removed from Google Play. Alternatively, you can remove any requests for accessibility services within your app. You can also choose to unpublish your app."

An active thread on Reddit where developers and app users are complaining about this change suggests that this new move will also affect popular and legitimate apps like LastPass, Tasker, and Universal Copy that use accessibility feature for key features and not intended for disabled users.



Although 30 days is a short period of time for app developers to find workarounds, the developer of Tasker suggested an alternative way to replace the accessibility services with different code.

"I plan to replace app detection with usage stats API," Tasker's developers suggested their plans to proceed. "Unfortunately, this API started with API 21, so people using Tasker on a pre-Lollipop device won't be able to use app contexts anymore."

This new move will prevent abuse of the API that poses a potential security threat to Android users, but legitimate app developers have only 30 days to search for an alternative before their apps get kicked out of Play Store.

                               

                                                                Hacker news

OnePlus Left A Backdoor That Allows Root Access Without Unlocking Bootloader

Think 100 times if you buy a Android phone👈

Another terrible news for OnePlus users.


Just over a month after OnePlus was caught collecting personally identifiable information on its users, the Chinese smartphone company has been found leaving a backdoor on almost all OnePlus handsets.

A Twitter user, who goes by the name "Elliot Anderson" ( named after Mr. Robot's main character ), discovered a backdoor (an exploit) in all OnePlus devices running OxygenOS that could allow anyone to obtain root access to the devices.



The application in question is "EngineerMode," a diagnostic testing application made by Qualcomm for device manufacturers to easily test all hardware components of the device.


This APK comes pre-installed ( accidentally left behind) on most OnePlus devices, including OnePlus 2, 3, 3T, and the newly-launched OnePlus 5. We can confirm its existence on the OnePlus 2, 3 and 5.



You can also check if this application is installed on your OnePlus device or not. For this, simply go to settings, open apps, enable show system apps from top right corner menu (three dots) and search for EngineerMode.APK in the list.

If it's there, anyone with physical access to your device can exploit EngineerMode to gain root access on your smartphone.



EngineerMode has been designed to diagnose issues with GPS, check the root status of the device, perform a series of automated 'production line' tests, and many more.


After decompiling the EngineerMod APK , the Twitter user found 'DiagEnabled' activity, which if opened with a specific password (It is "Angela", found after reverse engineering ) allows users to gain full root access on the smartphone—without even unlocking the bootloader.


Although the chance of this application already being exploited in the wild is probably low, it seems to be a serious security concern for OnePlus users as root access can be achieved by anyone using a simple command.

Moreover, with root access in hands, an attacker can perform lots of dangerous tasks on victim's OnePlus phone, including stealthy installing sophisticated spying malware, which is difficult to detect or remove.



Meanwhile, in order to protect themselves and their devices, OnePlus owners can simply disable root on their phones. To do so, run following command on ADB shell:

"setprop persist.sys.adb.engineermode 0" and "setprop persist.sys.adbroot 0" or call code *#8011#

In response to this issue, OnePlus co-founder Carl Pei said that the company is looking into the matter.



The Twitter user has promised to release a one-click rooting app for OnePlus devices using this exploit.


Stay connect with tech gyan stay safe.......thanku






                                                                                Hacker news

Apple iPhone X's Face ID Hacked (Unlocked) Using 3D-Printed Mask

Just a week after Apple released its brand new iPhone X on November 3, a team of hackers has claimed to successfully hack Apple's Face ID facial recognition technology with a mask that costs less than $150.


Yes, Apple's "ultra-secure" Face ID security for the iPhone X is not as secure as the company claimed during its launch event in September this year.

"Apple engineering teams have even gone and worked with professional mask makers and makeup artists in Hollywood to protect against these attempts to beat Face ID," Apple's senior VP of worldwide marketing Phil Schiller said about Face ID system during the event.

"These are actual masks used by the engineering team to train the neural network to protect against them in Face ID."

However, the bad news is that researchers from Vietnamese cybersecurity firm Bkav were able to unlock the iPhone X using a mask.


Yes, Bkav researchers have a better option than holding it up to your face while you sleep.


Bkav researchers re-created the owner's face through a combination of 3D printed mask, makeup, and 2D images with some "special processing done on the cheeks and around the face, where there are large skin areas" and the nose is created from silicone

.
The researchers have also published a proof-of-concept video, showing the brand-new iPhone X first being unlocked using the specially constructed mask, and then using the Bkav researcher's face, in just one go.

"Many people in the world have tried different kinds of masks but all failed. It is because we understand how AI of Face ID works and how to bypass it.

"You can try it out with your own iPhone X, the phone shall recognize you even when you cover a half of your face. It means the recognition mechanism is not as strict as you think, Apple seems to rely too much on Face ID's AI. We just need a half face to create the mask. It was even simpler than we ourselves had thought."

              👇     WATCH VIDEO  👇

https://youtu.be/i4YQRLQVixM

Researchers explain that their "proof-of-concept" demo took about five days after they got iPhone X on November 5th. They also said the demo was performed against one of their team member's face without training iPhone X to recognize any components of the mask.


"We used a popular 3D printer. The nose was made by a handmade artist. We use 2D printing for other parts (similar to how we tricked Face Recognition 9 years ago). The skin was also hand-made to trick Apple's AI," the firm said.


The security firm said it cost the company around $150 for parts (which did not include a 3D printer), though it did not specify how many attempts its researchers took them to bypass the security of Apple's Face ID.

It should be noted that creating such a mask to unlock someone's iPhone is a time-consuming process and it is not possible to hack into a random person's iPhone.

However, if you prefer privacy and security over convenience, we highly recommend you to use a passcode instead of fingerprint or Face ID to unlock your phone.







                                                                     Hacker news

How to delete WhatsApp messages after 7 minute?

How to delete WhatsApp messages after 7 minute?


WhatsApp users were ecstatic with the news that the app added a much anticipated ‘unsend’ feature late last month.


The feature worked in the way that one can unsend a message within seven minutes of sending and the recipient would never see the message.

Follow step by step:-

1. Disconnect your phone’s Internet connection (Wifi and mobile data) – On an Android phone  go to your settings to turn off to be sure.

2. Stop the WhatsApp – close down the window.

Go to setting>apps>whatsapp>force stop

3. Change the date of your phone to the day before the message you want to delete was sent.

4. Open WhatsApp again and find the message you wanted to delete.

5. To unsend a message on WhatsApp all you need to do is hold down on the message and few options will pop up all you need to do is click delete then click delete for everyone.

6. Then go back and reset your date to the current date.

7. Reconnect to the internet.

What is the Difference between WPA2, WPA, WEP, AES, and TKIP?

Pretty much everywhere you go today, there is a WiFi network you can connect to. Whether it be at home, at the office or at the local coffee shop, there are a plethora of WiFi networks. Every WiFi network is setup with some kind of network security, either open for all to access or extremely restricted where only certain clients can connect.


When it comes to WiFi security, there are really only a couple of options you have, especially if you are setting up a home wireless network. The three big security protocols today are WEP, WPA, and WPA2. The two big algorithms that are used with these protocols are TKIP and AES with CCMP. I’ll explain some of these concepts in more detail below.


Which Security Option to Pick?
If you don’t care about all the technical details behind each one of these protocols and just want to know which one to select for your wireless router, then check out the list below. It’s ranked from most secure to least secure. The more secure option you can choose, the better.


If you’re not sure if some of your devices will be able to connect using the most secure method, I suggest you enable it and then check to see if there are any issues. I thought several devices would not support the highest encryption, but was surprised to find out they connected just fine.


1. WPA2 Enterprise (802.1x RADIUS)
2. WPA2-PSK AES
3. WPA-2-PSK AES + WPA-PSK TKIP
4. WPA TKIP
5. WEP
6. Open (No security)



It’s worth noting that WPA2 Enterprise doesn’t use pre-shared keys (PSK), but instead uses the EAP protocol and requires a backend RADIUS server for authentication using a username and password. The PSK that you see with WPA2 and WPA is basically the wireless network key that you have to enter when connecting to a wireless network for the first time.

WPA2 Enterprise is way more complex to setup and is usually only done in corporate environments or in homes very technically-savvy owners. Practically, you will only be able to choose from options 2 thru 6, though most routers now don’t even have an option for WEP or WPA TKIP anymore because they are insecure.


WEP, WPA and WPA2 Overview
I’m not going to go into too much technical detail about each of these protocols because you could easily Google them for lots of more information. Basically, wireless security protocols came about starting in the late 90’s and have been evolving since then. Thankfully, only a handful of protocols were accepted and therefore it’s much easier to understand.



WEP
WEP or Wired Equivalent Privacy was released back in 1997 along with the 802.11 standard for wireless networks. It was supposed to provide confidentiality that was equivalent to that of wired networks (hence the name).
WEP started off with 64-bit encryption and eventually went all the way up to 256-bit encryption, but the most popular implementation in routers was 128-bit encryption. Unfortunately, very soon after the introduction of WEP, security researchers found several vulnerabilities that allowed them to crack a WEP key within a few minutes.
Even with upgrades and fixes, the WEP protocol remained vulnerable and easy to penetrate. In response to these problems, the WiFi Alliance introduced WPA or WiFi Protected Access, which was adopted in 2003.


WPA
WPA was actually meant to just an intermediate remedy until they could finalize WPA2, which was introduced in 2004 and is now the standard used presently. WPA used TKIP or Temporal Key Integrity Protocol as a way to ensure message integrity. This was different from WEP, which used CRC or Cyclic Redundancy Check. TKIP was much stronger than CRC.
Unfortunately, to keep things compatible, the WiFi Alliance borrowed some aspects from WEP, which ended up making WPA with TKIP insecure also. WPA included a new feature called WPS (WiFi Protected Setup), which was supposed to make it easier for users to connect devices to the wireless router. However, it ended up having vulnerabilities that allowed security researchers to crack a WPA key within a short period of time also.


WPA2
WPA2 became available as early as 2004 and was officially required by 2006. The biggest change between WPA and WPA2 was the use of the AES encryption algorithm with CCMP instead of TKIP.
In WPA, AES was optional, but in WPA2, AES is mandatory and TKIP is optional. In terms of security, AES is much more secure than TKIP. There have been some issues found in WPA2, but they are only problems in corporate environments and don’t apply to home users.


WPA uses either a 64-bit or 128-bit key, the most common being 64-bit for home routers. WPA2-PSK and WPA2-Personal are interchangeable terms.


So if you need to remember something from all this, it’s this: WPA2 is the most secure protocol and AES with CCMP is the most secure encryption. In addition, WPS should be disabled as it’s very easy to hack and capture the router PIN, which can then be used to connect to the router. If you have any questions, feel free to comment. Enjoy!

KRACK AttAck : Critical Key Reinstallation Attack Against Widely-Used WPA2 Wi-Fi Protocol

Do you think your wireless network is secure because you're using WPA2 encryption?

If yes, think again!

Security researchers have discovered several key management vulnerabilities in the core of Wi-Fi Protected Access II (WPA2) protocol that could allow an attacker to hack into your Wi-Fi network and eavesdrop on the Internet communications.

WPA2 is a 13-year-old WiFi authentication scheme widely used to secure WiFi connections, but the standard has been compromised, impacting almost all Wi-Fi devices—including in our homes and businesses, along with the networking companies that build them.

Dubbed KRACK—Key Reinstallation Attack—the proof-of-concept attack demonstrated by a team of researchers works against all modern protected Wi-Fi networks and can be abused to steal sensitive information like credit card numbers, passwords, chat messages, emails, and photos.

Since the weaknesses reside in the Wi-Fi standard itself, and not in the implementations or any individual product, any correct implementation of WPA2 is likely affected.

According to the researchers, the newly discovered attack works against:

👉Both WPA1 and WPA2,           

👉Personal and enterprise networks,

👉Ciphers WPA-TKIP, AES-CCMP, and GCMP

In short, if your device supports WiFi, it is most likely affected. During their initial research, the researchers discovered that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by the KRACK attacks.

It should be noted that the KRACK attack does not help attackers recover the targeted WiFi's password; instead, it allows them to decrypt WiFi users' data without cracking or knowing the actual password.

So merely changing your Wi-Fi network password does not prevent (or mitigate) KRACK attack.

Discovered by researcher Mathy Vanhoef of imec-DistriNet, KU Leuven, the KRACK attack works by exploiting a 4-way handshake of the WPA2 protocol that's used to establish a key for encrypting traffic.

For a successful KRACK attack, an attacker needs to trick a victim into re-installing an already-in-use key, which is achieved by manipulating and replaying cryptographic handshake messages.

"When the victim reinstalls the key, associated parameters such as the incremental transmit packet number (i.e. nonce) and receive packet number (i.e. replay counter) are reset to their initial value," the researcher writes.

"Essentially, to guarantee security, a key should only be installed and used once. Unfortunately, we found this is not guaranteed by the WPA2 protocol. By manipulating cryptographic handshakes, we can abuse this weakness in practice."

The research , titled Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2 , has been published by Mathy Vanhoef of KU Leuven and Frank Piessens of imec-DistriNet, Nitesh Saxena and Maliheh Shirvanian of the University of Alabama at Birmingham, Yong Li of Huawei Technologies, and Sven Schäge of Ruhr-Universität Bochum.

The team has successfully executed the key reinstallation attack against an Android smartphone, showing how an attacker can decrypt all data that the victim transmits over a protected WiFi. You can watch the video demonstration above and download proof-of-concept (PoC) code from Github.

"Decryption of packets is possible because a key reinstallation attack causes the transmit nonces (sometimes also called packet numbers or initialization vectors) to be reset to zero. As a result, the same encryption key is used with nonce values that have already been used in the past," the researcher say.

The researchers say their key reinstallation attack could be exceptionally devastating against Linux and Android 6.0 or higher, because "Android and Linux can be tricked into (re)installing an all-zero encryption key (see below for more info)."

However, there's no need to panic, as you aren't vulnerable to just anyone on the internet because a successful exploitation of KRACK attack requires an attacker to be within physical proximity to the intended WiFi network.

WPA2 Vulnerabilities and their Brief Details

The key management vulnerabilities in the WPA2 protocol discovered by the researchers has been tracked as:

• CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the four-way handshake.

• CVE-2017-13078: Reinstallation of the group key (GTK) in the four-way handshake.

• CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the four-way handshake.

• CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.

• CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.

• CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.

• CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.

• CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.

• CVE-2017-13087: reinstallation of the group key (GTK) while processing a Wireless Network Management (WNM) Sleep Mode Response frame.

• CVE-2017-13088: reinstallation of the integrity group key (IGTK) while processing a Wireless Network Management (WNM) Sleep Mode Response frame.

The researchers discovered the vulnerabilities last year, but sent out notifications to several vendors on July 14, along with the United States Computer Emergency Readiness Team (US-CERT), who sent out a broad warning to hundreds of vendors on 28 August 2017.

"The impact of exploiting these vulnerabilities includes decryption, packet replay, TCP connection hijacking, HTTP content injection, and others," the US-CERT warned. "Note that as protocol-level issues, most or all correct implementations of the standard will be affected."

In order to patch these vulnerabilities, you need to wait for the firmware updates from your device vendors.

According to researchers, the communication over HTTPS is secure (but may not be 100 percent secure) and cannot be decrypted using the KRACK attack. So, you are advised to use a

secure VPN service —which encrypts all your Internet traffic whether it’s HTTPS or HTTP.

You can read more information about these vulnerabilities on the KRACK attack's dedicated website , and the research paper.

The team has also released a script using which you can check whether if your WiFi network is vulnerable to the KRACK attack or not.

                                                        Hacker news

Hacker Distributes Backdoored IoT Vulnerability Scanning Script to Hack Script Kiddies

Nothing is free in this world.


If you are searching for free hacking tools on the Internet, then beware—most freely available tools, claiming to be the swiss army knife for hackers, are nothing but a scam.


For example, Cobian RAT and a Facebook hacking tool that we previously reported on The Hacker News actually could hack, but of the one who uses them and not the one you desire to hack.


Now, a security researcher has spotted another hacking tool—this time a PHP script—which is freely available on multiple popular underground hacking forums and allows anyone to find vulnerable internet-connected IP Cameras running the vulnerable version of GoAhead embedded web-server.


However, after closely analysing the scanning script, Newsky Security researcher Ankit Anubhav found that the tool also contains a secret backdoor, which essentially allows its creator to "hack the hacker. "

"For an attacker’s point of view, it can be very beneficial to hack a hacker,"

"For example, if a script kiddie owns a botnet of 10,000 IoT and if he gets hacked, the entire botnet is now in control of the attacker who got control of the system of this script kiddie. Hence, by exploiting one device, he can add thousands of botnets to his army."

The rise of IoT botnet and release of Mirai's source code —the biggest IoT-based malware threat that emerged last year and took down Dyn DNS service —has encouraged criminal hackers to create their massive botnet either to launch DDoS attacks against their targets or to rent them to earn money.

As shown in the self-explanatory flowchart, this IoT scanning script works in four steps:

• First, it scans a set of IP addresses to find GoAhead servers vulnerable to a previously disclosed authentication bypass vulnerability ( CVE-2017-8225 ) in Wireless IP Camera (P2P) WIFI CAM devices.

• In the background, it secretly creates a backdoor user account ( username: VM | password: Meme123) on the wannabe hacker's system, giving the attacker same privilege as root.

• Script also extracts the IP address of the wannabe hacker, allowing script author to access the compromised systems remotely.

• Moreover, it also runs another payload on the script kiddie’s system, eventually installing a well-known botnet, dubbed Kaiten.

This tool is another example of backdoored hacking tools increasingly being distributed at various underground forums to hack the hacker.


In September, a backdoored Cobian RAT builder kit was spotted on multiple underground hacking forums for free but was caught containing a backdoored module that aimed to provide the kit's authors access to all of the victim's data.


Last year, we reported about another Facebook hacking tool, dubbed Remtasu , that actually was a Windows-based Trojan with the capability to access Facebook account credentials, but of the one who uses it to hack someone else.




                                                                HACKER NEWS

Wait, Do You Really Think That’s A YouTube URL? Spoofing Links On Facebook

Facebook    Facebook    Facebook.......!!!!!

While scrolling on Facebook how you decide which link/article should be clicked or opened?

Facebook timeline and Messenger display title, description, thumbnail image and URL of every shared-link, and this information are enough to decide if the content is of your interest or not.


Since Facebook is full of spam, clickbait and fake news articles these days, most users do not click every second link served to them.
But yes, the possibility of opening an article is much higher when the content of your interest comes from a legitimate and authoritative website, like YouTube or Instagram.


However, what if a link shared from a legitimate website lands you into trouble?
Even before links shared on Facebook could not be edited, but to stop the spread of misinformation and false news, the social media giant also removed the ability for Pages to edit title, description, thumbnail image of a link in July 2017.


However, it turns out that—spammers can spoof URLs of the shared-links to trick users into visiting pages they do not expect, redirecting them to phishing or fake news websites with malware or malicious content.


Discovered by 24-year-old security researcher
Barak Tawily , a simple trick could allow anyone to spoof URLs by exploiting the way Facebook fetch link previews.


In brief, Facebook scans shared-link for Open Graph meta tags to determine page properties, specifically 'og:url', 'og:image' and 'og:title' to fetch its URL, thumbnail image and title respectively.

Interestingly, Tawily found that Facebook does not validate if the link mentioned in 'og:url' meta tag is same as the page URL, allowing spammers to spread malicious web pages on Facebook with spoofed URLs by just adding legitimate URLs in 'og:url' Open Graph meta tag on their websites.

"In my opinion, all Facebook users think that preview data shown by Facebook is reliable, and will click the links they are interested in, which makes them easily targeted by attackers that abuse this feature in order to perform several types of attacks, including phishing campaigns/ads/click fraud pay-per-click,

Tawily reported the issue to Facebook, but the social media giant refused to recognise it as a security flaw and referred that Facebook uses "Linkshim" to protect against such attacks.


If you are unaware, every time a link is clicked on Facebook, a system called "Linkshim" checks that URL against the company's own blacklist of malicious links to avoid phishing and malicious websites.
This means if an attacker is using a new domain for generating spoofed links, it would not be easy for Linkshim system to identify if it is malicious.


Although Linkshim also uses machine learning to identify never-seen-before malicious pages by scanning its content, Tawily found that the protection mechanism could be bypassed by serving non-malicious content explicitly to Facebook bot based on User-Agent or IP address.    
   



                                                      Hacker news

Built-in Keylogger Found in MantisTek GK2 Keyboards—Sends Data to China

What is keylogger?

A computer program that records every keystroke made by a computer user, especially in order to gain fraudulent access to passwords and other confidential information.

"The right keyboard can make all the difference between a victory and a defeat in a video game battlefield."

If you are a gamer, you can relate to the above quote.

But what if your winning weapon betrays you?

The popular 104-key Mantistek GK2 Mechanical Gaming Keyboard that costs around €49.66 has allegedly been caught silently recording everything you type on your keyboard and sending them to a server maintained by the Alibaba Group.

This built-in keylogger in Mantistek GK2 Mechanical Gaming Keyboard was noticed by a few owners who headed on to an online forum to share this issue.

According to Tom's Hardware , MantisTek keyboards utilise 'Cloud Driver' software, maybe for collecting analytic information, but has been caught sending sensitive information to servers tied to Alibaba.

After analysing more closely, Tom's Hardware team found that Mantistek keyboard does not include a full-fledged keylogger. Instead, it captures how many times a key has been pressed and sending this data back to online servers.

The affected users also provided a screenshot showing how all your plain-text keystrokes collected by the keyboard are being uploaded to a Chinese server located at IP address: 47.90.52.88.

However, even if there's no malicious intent, capturing and uploading keystroke counts without users' consent violates trust and puts systems' security at risk by leaking sensitive information.

Since Alibaba Group also sells cloud services like Google and Amazon, this collected information is not necessarily being sent to the Alibaba itself, but someone who is using its cloud service.

Opening the IP address in question directly into a web browser and on a Chinese login page, which translates to "Cloud mouse platform background management system" and is maintained by Shenzhen Cytec Technology Co., Ltd.

Reportedly, the MantisTek keyboard's software sends the collected data to two destinations at that IP address:

/cms/json/putkeyusedata.php

/cms/json/putuserevent.php

The best way to prevent your keyboard from sending your keystrokes to the Alibaba server is to stop using your Mantistek GK2 Mechanical Gaming Keyboard until you hear back from the company about this issue.

If you cannot prevent yourself from using the keyboard, but want to stop it from sending your key presses to the Alibaba server, just make sure the MantisTek Cloud Driver software is not running in the background, and block the CMS.exe executable in your firewall.

To block the CMS.exe executable, add a new firewall rule for the MantisTek Cloud Driver in the "Windows Defender Firewall With Advanced Security."

       

                                                  Hacker NeWs

IEEE P1735 Encryption Is Broken—Flaws Allow Intellectual Property Theft

Researchers have uncovered several major weaknesses in the implementation of the Institute of Electrical and Electronics Engineers (IEEE) P1735 cryptography standard that can be exploited to unlock, modify or steal encrypted system-on-chip blueprints.

The IEEE P1735 scheme was designed to encrypt electronic-design intellectual property (IP) in the hardware and software so that chip designers can protect their IPs from hackers and other prying eyes.

Majority of mobile and embedded devices include a System-on-Chip (SoC), a single integrated circuit that can consist of multiple IPs—a collection of reusable design specifications—like a radio-frequency receiver, an analogue-to-digital converter, a digital signal processing unit, a graphics processing unit, a cryptographic engine, from different vendors.

Therefore, these licensed IPs are quite valuable to their vendors, so to protect them from being reverse engineered after being sold, the IEEE developed the P1735 standard to encrypts electronic-design IP.

However, an alert published Friday by the Department of Homeland Security's US-CERT warned that the IEEE P1735 standard is flawed.

"In the most egregious cases, [these mistakes] enable attack vectors [like padding-oracle attacks] that allow recovery of the entire underlying plaintext IP," US-CERT warned.

"Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts."

The US-CERT warning came after a recent academic paper, titled "Standardizing Bad Cryptographic Practice ," released by a team of researchers from University of Florida discovered and reported a total of seven vulnerabilities in the IEEE P1735 standard.

Here's the list of all vulnerabilities in P1735 standard with their assigned CVE IDs:

• CVE-2017-13091: Improperly specified padding in the standard's use of AES-CBC mode allows the use of an Electronic Design Automation (EDA) tool as a decryption oracle.

• CVE-2017-13092: Improperly specified HDL (hardware description language) syntax allows the use of an EDA tool as a decryption oracle.

• CVE-2017-13093: Modification of encrypted intellectual property (IP) cyphertexts to include hardware Trojans.

• CVE-2017-13094: Modification of the encryption key and insertion of hardware trojans in any IP without knowledge of the key.

• CVE-2017-13095: Modification of a license-deny response to a license grant or vice versa.

• CVE-2017-13096: Modification of Rights Block, which contains the RSA-encryption of an AES key, to get rid of or relax access control.

• CVE-2017-13097: Modification of Rights Block to get rid of or relax license requirement.

The main vulnerability (CVE-2017-13091) resides in the IEEE P1735 standard's use of AES-CBC mode.

Since the standard makes no recommendation for any specific padding scheme, the developers often choose the wrong scheme, making it possible for attackers to use a well-known classic padding-oracle attack (POA) technique to decrypt the system-on-chip blueprints without knowledge of the key.

"While the confidentiality attacks can reveal the entire plaintext IP, the integrity attack enables an attacker to insert hardware trojans into the encrypted IP," the researchers concluded.

"This not only destroys any protection that the standard was supposed to provide but also increases the risk premium of the IP."

The researchers also proposed various optimisations of the basic confidentiality attacks that can reduce the complexity.

Vendors using the IEEE P1735 scheme in an insecure manner have already been alerted by US-CERT. The vendors contacted by the US-CERT include AMD, Intel, Qualcomm, Cisco, IBM, Samsung, Synopsys, Mentor Graphics, Marvell, NXP, Cadence Design Systems, Xilinx and Zuken.

All of the above vendors are believed to be at a potential risk of these vulnerabilities, but so far it is not confirmed.

The researchers have suggested quick fixes which EDA software developers can apply to address the issues. Users are recommended to wait for an update from their EDA software vendors and apply as it becomes available.

                                              Hackers news