Don’t Install TikTok On Your Phone, It’s A Spyware

Don’t Install TikTok On Your Phone, It’s A Spyware: Reddit CEO

TikTok, one of the most popular video-sharing platform, has welcomed a lot of criticism all around the world. Now, Reddit CEO and co-founder Steve Huffman said that the app is “fundamentally parasitic”. Huffman pointed out TikTok’s practice of fingerprinting to track devices as a major security issue in the Social 2020 venture capital conference.

As reported by TechCrunch, Steve Huffman said that maybe he has to regret what he is going to say but he doesn’t know what Tiktok is up to. He added that Tiktok is fundamentally parasitic as it always keeps a check on its users via the fingerprinting technology used by the app.

He concluded his statement by saying that he will never install an app like that on his smartphone. Huffman also said that he actively warns people to avoid installing TikTok as it is a spyware. Steve Huffman’s comments were mostly controversial throughout the conference.

What Is Fingerprinting?

Fingerprinting is the process of tracking a website or app to determine the visiting users, user agents and for tracking users’ browsing activities within and across sessions. Companies can collect information using fingerprinting for the purpose of profiling and thus it poses a risk to the privacy of users.

TikTok’s Take

However, ByteDance, the parent company of TikTok, has said that it uses the fingerprinting technology to track malicious or inappropriate behavior of the browser. As per the research performed by Matthias Eberl, the app was working smoothly even after disabling the fingerprinting scripts.

Not only Steve Huffman, but many tech executives in the industry are worried due to the practices of TikTok. Sheryl Sandberg, Facebook COO also raised her concern and said that TikTok is growing at a very fast pace with the help of fingerprinting and has a huge database.

Read More

WiFi 6 is Out And It is Way Faster than the Predecessor

WiFi 6 is Out And It is Way Faster than the Predecessor

The new generation of Wi-Fi has been introduced by The Wi-Fi Alliance, an International organization to oversee Wi-Fi standards has officially started certification program. It will boost the internet speed from 3.5 Gbps to 9.6 Gbps.

Wi-Fi would be helpful in crowded places, nowadays one person has multiple devices and sometimes dozens of devices get connected to one router and take down the internet speed. Kevin Robinson, marketing leader for the Wi-Fi Alliance says, “The home scenario today looks like the dense deployment of yesterday”. According to the numbers given by the company, it will increase the speed to 9.6 Gbps from 3.5 Gbps. But since we would not get this much bigger connection at home, what really matters that the improvisation in hardware will help us to get more speed than we usually do.

The manufacturing companies already have the technology in their latest devices but from now on they will be able to advertise it after getting certification from The Wi-Fi Alliance. The new Wi-Fi 6 has many changes in the hardware and some new tools so old devices would not be able to get this.

New router supporting Wi-Fi 6 are already available in the market by TP-Link. It will come in a pack of two and will be expensive with the cost of $349.99. To get the fast speed, you will need both router and mobile or any other device supporting Wi-Fi 6.

In the announcement by The Wi-Fi Alliance, it says that Samsung Galaxy Note 10 will be the first device in the market with Wi-Fi 6 certification by their organization. Apple is also a member of The Wi-Fi Alliance organization but apparently it has not certified any of its devices with the Alliance for years. The new iPhone 11 series also supports the Wi-Fi 6 and if it is not certified, it has raised many attention that would it work perfectly without any flaw.

This is the first Alliance has named the Wi-Fi technology a version number, before this they used to name it differently like 802.11ac. This time it was supposed to be named 802.11ac but instead they named it Wi-Fi 6.

Read More

Jazz Becomes First Pakistani Telecom Operator To Provide WhatsApp Self-Care Services

Jazz Becomes First Pakistani Telecom Operator To Provide WhatsApp Self-Care Services

In an industry first move, Jazz, Pakistan’s leading digital communications company, has started offering its post-paid subscribers a self-care service window on WhatsApp, the world’s most-used messenger app.

Under this partnership, WhatsApp will act as a self-service portal for Jazz users where either the customer can send a message to the Jazz WhatsApp number or vice versa.

Jazz postpaid customers can send “Hi” to 0300-3008000 to connect with Jazz WhatsApp channel. On connecting to the channel, customers will be able to pay their bills, get last generated invoice and view their billing information along with support FAQs. All conversations during this time will be completely free of charge.

Talking about this industry first move, Sadia Khuram, Chief Customer Experience Officer (CCEO) at Jazz said,

"In keeping with evolving habits of our customers in the digital space, Jazz is committed to providing friction-free and effortless services to its customers, and is proud to announce the launch of WhatsApp as a social support channel for its valued customers".

In the first phase of the launch, this channel will provide self-service options to its postpaid customers, who will now be able to get their billing information, pull invoices & make payments using a simple menu. Going forward, the ambition is to grow this into a full-fledged conversational channel and extend it to pre-paid customers as well.

She continued,

"As customers increasingly inhabit the world of WhatsApp and their preference is moving from ‘traditional call center care’ to ‘social care’ models, Jazz will continue to be responsive to its customers’ needs for easy, fast and convenient care channels".

“We are happy to help Jazz enhance their customer experience by enabling their post-paid users an improved interaction with the operator through their preferred chat app. We aim to create innovative solutions that continuously enhance services our clients and partners provide and are thrilled that Jazz recognized this as an opportunity to upgrade their customer care and prove their position as a market leader in Pakistan,” said Dino Ibrahimović, Managing Director Infobip MENA.

With 1.5 billion global users, WhatsApp is the most used messaging app in the world with its popularity growing day by day in Pakistan, where it is the top instant messaging app. This partnership with Jazz is via WhatsApp’s local partner Infobip, which operates one of the world’s leading proprietary messaging and communications platforms, designed to connect mobile network operators with enterprises.

Read More

Airgeddon – A Swiss Army WiFi Hacking Tool

Airgeddon – A Swiss Army WiFi Hacking Tool

Today Virus Community have been looking at Airgeddon, on initial inspection it seems to be a multi purpose all-in-one Swiss army knife tool for hacking WiFi, the tool is pretty extensive, with over 11 thousand lines of bash goodness. This tool is free to download from GitHub and supports multiple Linux based platforms.

So what does it do?

The tool supports multiple methodologies for hacking WiFi, some of which include:

• WEP All-in-One attack (combining different techniques: Chop-Chop, Caffe Latte, ARP Replay, Hirte, Fragmentation, Fake association, etc.)
• Evil Twin attacks (Rogue AP) with Hostapd + DHCP + DoS + Ettercap + Sslstrip and also BEEF support
• Multiple WPS cracking modes – Pixie Dust, Bully and Reaver
• Offline password decryption for WPA/WPA2/WPA3 captured handshakes (dictionary, bruteforce and rule based) based on aircrack, crunch and hashcat tools.

Other features?

Cool!, any Other notable features include:

• upport for 5GHZ and 2.4GHZ bands
• Assisted Handshake file capturing
• Drag and drop files on console window for entering file paths
• Controlled Exit. Cleaning tasks and temp files. Restoring iptables after an attack that require changes on them. Option to keep monitor mode if desired on exit.

Platforms can it run on?

The tool is compatible on any Linux distribution that has the necessary tools installed needed to run. ideally Kali would be the best candidate for running it out of the box, but it can be run on Arch if you enjoy a challenge, the script will check for any tool dependencies it is missing when first run.

s you might expect with any bash script related tool, it offers intuitive menus and options that could allow even the most harebrained skid a way to easily perform a wide range of Wifi attacks.

Source code?

Source code link attach here you can also download from my private server.

Download from GitHub server

Download from my Private server

Read More

WhatsApp Flaw Could Allow 'Potential Attackers' to Spy On Encrypted Group Chats

WhatsApp Flaw Could Allow 'Potential Attackers' to Spy On Encrypted Group Chats

A more dramatic revelation of 2018—an outsider can secretly eavesdrop on your private end-to-end encrypted group chats on WhatsApp and Signal messaging apps.

Considering protection against three types of attackers—malicious user, network attacker, and malicious server—an end-to-end encryption protocol plays a vital role in securing instant messaging services.

The primary purpose of having end-to-end encryption is to stop trusting the intermediate servers in such a way that no one, not even the company or the server that transmits the data, can decrypt your messages or abuse its centralized position to manipulate the service.

In order words—assuming the worst-case scenario—a corrupt company employee should not be able to eavesdrop on the end-to-end encrypted communication by any mean.

However, so far even the popular end-to-end encrypted messaging services, like WhatsApp, Threema and Signal, have not entirely achieved zero-knowledge system.

Researchers from Ruhr-Universität Bochum (RUB) in Germany found that anyone who controls WhatsApp/Signal servers can covertly add new members to any private group, allowing them to spy on group conversations, even without the permission of the administrator.

As described by the researchers, in the pairwise communication (when only two users communicate with each other) server plays a limited role, but in case of multi-user chats (group chat where encrypted messages are broadcasted to many users), the role of servers increases to manage the entire process.

That's where the issue resides, i.e. trusting the company's servers to manage group members (who eventually have full access to the group conversation) and their actions.

As explained in the newly published RUB paper, titled "More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema," since both Signal and WhatsApp fail to properly authenticate that who is adding a new member to the group, it is possible for an unauthorized person—not a group administrator or even a member of the group—to add someone to the group chat.

What's more? If you are wondering that adding a new member to the group will show a visual notification to other members, it is not the case.

According to the researchers, a compromised admin or rogue employee with access to the server could manipulate (or block) the group management messages that are supposed to alert group members of a new member.

"The described weaknesses enable attacker A, who controls the WhatsApp server or can break the transport layer security, to take full control over a group. Entering the group, however, leaves traces since this operation is listed in the graphical user interface. The WhatsApp server can therefore use the fact that it can stealthily reorder and drop messages in the group," the paper reads. 

"Thereby it can cache sent messages to the group, read their content first and decide in which order they are delivered to the members. Additionally, the WhatsApp server can forward these messages to the members individually such that a subtly chosen combination of messages can help it to cover the traces."

WhatsApp has acknowledged the issue, but argued that if any new member is added to a group, let's say by anyone, other group members will get notified for sure.

"We've looked at this issue carefully. Existing members are notified when new people are added to a WhatsApp group. We built WhatsApp so group messages cannot be sent to a hidden user," a WhatsApp spokesperson told Wired. 

"The privacy and security of our users is incredibly important to WhatsApp. It's why we collect very little information and all messages sent on WhatsApp are end-to-end encrypted."

But if you are not part of a group with very selected members, I'm sure many of you would relatively ignore such notifications easily.
Researchers also advised companies to fix the issue just by adding an authentication mechanism to make sure that the "signed" group management messages come from the group administrator only.
However, this attack is not easy (exception—services under legal pressure) to execute, so users should not be worried about it.

Read More

Three more Malicious Backdoor plugins with More than 89,000 Active Installs found in WordPress Repository

Three more Malicious Backdoor plugins with More than 89,000 Active Installs found in WordPress Repository

WordPress has such a massive ecosystem consist of a number of plugins and themes, threat actors involved in various malicious activities such as hiding the PHP backdoor scripts into the WordPress Security Plugin.

In this incident, the attackers sell existing unsupported plugins to new authors with backdoor code inserted and their goal is to insert SEO spam to the sites with the plugin installed.

Wordfence uncovers the incident and WordPress security team has closed the plugin from the store which means the plugin not available to download from the repository.

There is too many up’s and down’s in WordPress usage, it requires a security improvement, so the WordPress Penetration testing is essential to find the vulnerabilities and to secure your WordPress powered blog.

Malicious WordPress backdoor Plugins

Duplicate Page and Post

The Functionality of the plugin is to create a cloned post or the page, now the Current Owner of the plugin inserted backdoor scripts which makes a request to cloud-wp.org and injects cloaked backlinks to the site.

It has more than 50,000+ Active Installs and the plugins Removed from WordPress.org on December 14, 2017.

No Follow All External Links

Behaviour same as like Duplicate Page and Post this backdoor requests to cloud.wpserve.org and returns content based URLs and the backdoor used in injecting backlinks for SEO. It has more than 9,000++ Active Installs and the plugins Removed from WordPress.org on December 19, 2017.

WP No External Links

It is same as the previous two backdoors it requests wpconnect.org and returns content based on the URL and the backdoor used in injecting backlinks for SEO.

It has more than 30,000+ Active Installs and the plugins Removed from WordPress.org on December 22, 2017.

If you have the plugin installed it is highly recommended to uninstall them immediately and scan the website for infection with sucuri and gravity scan.

Thousands of WordPress websites get hacked every day, so securing your blog must be top of mind. Luckily, it’s not all rocket-science as you need to make most of the tweaks only once.Here you can find Most Important Considerations Check to Setup Your WordPress Security.

Read More

Intel Introduced Its First Quantum Processor

Intel Introduced Its First Quantum Processor

The future of computing undoubtedly passes through the quantum computer. So far, research around quantum computers has proved quite promising and Intel has already realized the potential of this area.

Last week, the market leader in the manufacture and marketing of chips and processors for computers announced that it is creating a quantum processor. So, now let’s explore all the details about this new quantum processor.

The World of Qubits

This is yet another major move by Intel, which shows that Intel is committed to being present in the future. This future will certainly not be far behind.

Quantum computers have the power to revolutionize industries and areas of science, for example, in
the area of Artificial Intelligence, making the process of operating neural networks faster or in biology, allowing to analyze in more detail small molecular structures.

While normal computers encode information in bits, quantum computers use quantum bits, that is, Qubits, which take advantage of surprising quantum phenomena and can, therefore, be in 2 different states at the same time.

The new Intel Quantum Processor

This new Intel processor has 17 Qubits and proves to be quite promising. Thus, this is the first processor of the company since the 50 million dollar partnership with QuTech was announced. In addition, the processor has a special protection system that allows it to last longer.

In fact, one of the main difficulties of computer scientists and physicists at this point in terms of the development of quantum computers is related to the life of the processor and to the isolation of the system.

“The new design improves quality, thermal performance and reduces radio frequency interference” stated by the Jim Held, the Director of Technology Research at Intel.

This move from Intel makes perfect sense since the tech giant Google, Microsoft and IBM have also publicly shown the results of their efforts in the field of quantum computing. Being one of the leading processor producers, Intel wants to ensure its influence in the future. However, this does not mean that the current processors will soon become obsolete.

Read More

Top Interview Questions for IT Pro

Top Interview Questions for IT Pro

1. What is the difference between a hub and a switch?

2. What is a network?

3. What is Active Directory?

4. What is TCP/IP and what does it stand for?

5. What is a default gateway?

6. What does DHCP stand for?

7. What is an IP Address?

8. What is the significance of the IP address 255.255.255.255?

9. What are the 3 major classes of an IP network?

10. What is a Class D IP address?

11. What is OSPF?

12. A user is complaining of delays when using the network. What would you do?

Network Administrator Positions

Some of these questions may also be included in the previous category for Help Desk Technician positions. In either case, they’re worth preparing for.

13. What is the difference between layer 2 and layer 3 in the OSI model?

14. What is the difference between a hub, switch, and router?

15. What is a VLAN?

16. What is the difference between TCP and UDP?

17. How do you distinguish a DNS problem from a network problem?

18. What are a runt, Giant, and collision?

19. What is a broadcast storm?

20. What is the purpose of VRRP?

21. What is a VPN?

22. What is a default route?

23. How do you set a default route on an IOS Cisco router?

24. What is a metric?

25. What is a MAC address?

26. What is ARP/RARP?

27. Describe a TCP connection sequence.

28. What is MTU?

29. What other TCP setting can you modify besides MTU to shorten packets?

System Administration Position

Here are a few more questions that are a little bit more difficult. System Admins should know all these answers by heart in addition to the Network Administrator questions.

30. What is the difference between layer 2 and layer 3 devices?

31. What is the subnet for a class C network?

32. Have you configured a NIS server/client before? If so, describe what you did.

33. Have your configured a NFS server?

34. What are RAID 1 and RAID 5?

35. What are the required components of Windows Server 2003 for installing Exchange 2003?

36. What must be done to an AD forest before Exchange can be deployed?

37. What Exchange process is responsible for communication with AD?

38. What connector type would you use to connect to the Internet, and what are the two methods of sending mail over that connector?

39. How would you optimize Exchange 2003 memory usage on Windows Server 2003 with more than 1Gb of memory?

40. What are the standard port numbers for SMTP, POP3, IMAP4, RPC, LDAP and Global Catalog?

41. Name the process names for the following: System Attendant, Information Store, SMTP/POP/IMAP/OWA.

42. What is the maximum amount of databases that can be hosted on Exchange 2003 Enterprise?

43. What are the disadvantages of circular logging?

44. What is Active Directory schema?

45. What are the domain functional levels in Windows Server 2003?

46. What is the default domain functional level in Windows Server 2003?

47. What are the forest functional levels in Windows Server 2003?

48. What is a global catalog server?

49. How can we raise domain functional and forest functional levels in Windows Server 2003?

50. What is the default protocol used in directory services?

51. What is IPv6?

52. What are the physical & logical components of ADS?

53. In which domain functional level, we can rename a domain name?

54. What is multimaster replication?

55. What is a site?

56. Which is the command used to remove active directory from a domain controller?

57. What is the file that’s responsible for keeping all Active Directory databases?

General HR Questions

These general questions can be the toughest ones to get through. They might sound easy, but they require a lot of thought and preparation. I would suggest writing down your answers first, then reading them over a few times so that you’re comfortable in answering them.

Some of these questions are very tricky and can get you in trouble. So if you run into problems finding a good answer, check out these 64 Interview Questions for some help.

58. Tell us a little bit about yourself.

59. What are your greatest strengths?

60. What are your greatest weaknesses?

61. What do you like about your current job or what did you like about your last job?

62. Give us an example of when you handled a stressful situation.

62. Give us an example of one of the toughest problems you had to face, and how did you deal with it?

63. Why do you think you should get this position?

64. Do you think you are the best person for this job? If so, why?

65. Why did you apply for this position?

66. Why did you apply for a position with our company and what do you know about us?

67. Why should we hire you?

68. Tell us about your short and long term goals?

69. Where do you see yourself five years from now?

70. Please explain, what does customer service mean to you?

71. What does being a team player mean to you?

72. Give us an example of how you handled a conflict with another employee?

73. What are your salary expectations?

74. What would you consider your most important accomplishment?

75. How would you define success?

76. At your last review, what improvements did your manager suggest you make?

77. What would your co workers say about you?

Read More

Israeli Spies Hacked ISIS Computers, Exposed Their Plans For “Laptop Bomb”

Israeli Spies Hacked ISIS Computers, Exposed Their Plans For “Laptop Bomb”

Israeli government spies have hacked into the operations of ISIS. The group is inventing a laptop computer bomb that could have blasted the commercial aircraft to the US. However, Israeli cyber researchers have hacked into the operations of ISIS months ago and revealed their plans.

Recently, Israeli government spies have hacked into the operations of ISIS. The group is inventing a laptop computer bomb that could have blasted the commercial aircraft to the US. However, Israeli cyber researchers have hacked into the operations of ISIS months ago and revealed their plans.

Experts David Sanger and Eric Schmitt along with two of the American officials have stated that the process of bomb encryption and protection is what supported them to analyze how such bombs works.

A ban was also executed by the Department of Homeland Security on allowing electronic devices onto aircraft which are larger than the smartphones. The ban was implemented in ten countries in the Middle East and Africa.

After U.S laptop ban, Britain announced a similar prohibition for flights originating from six countries. The reports from The New York Times states that the laptop bomb was developed in such a way that it can cross through airport X-ray machines without detection.

The bomb was intelligently placed in the place of laptop battery which is capable of tricking the X-ray detectors in the airport. The reports also said that Israel had shared this information with U.S. in the past two years. Israel and U.S are working together against cyber terrorism. Most of their cooperating have been against Iran.

President Donald Trump made this information on this bomb attack public, which exposes it to Russia. This event has been the source of a trouble for Israeli officials. Trump had also tweeted that he did share the information with Russia and that he has full right to do so.

Read More

Face Swap

Android users there is a good news for you! Microsoft just released an Android app in Google play store. The app had been launched in Play Store and the iOS version is already on its way. The new app launched by Microsoft was called Face Swap.

Android users there is a good news for you! Microsoft just released an Android app in Google play store. The app had been launched in Play Store and the iOS version is already on its way.
The new app launched by Microsoft was called Face Swap. As its name suggests this app does a simple job to put your face on pictures it finds online using Microsoft’s super-advance facial recognition method and Bing image search.
Well, users need to click a selfie which will trigger the facial recognition system. Once the facial recognition system recognizes your face it will let you search online for images or you can even choose pictures from your camera roll for popular faces and displays.
This app has the potential to match skin tones, lighting conditions, head turns and tilts automatically. This app also lets you put multiple faces in a single scene, which is perfect for group shots.

The firm says “Face Swap was developed from conception to app store over 5 months by the small incubation team within the Bing organization. The engineering team included developers in remote locations, allowing us to work around the clock and iterate rapidly on the product. We employed continuous user research studies with external participants, which helped us build a product that is easy and intuitive to use”

For Download Click Here

Read More

USB Thief This Self Projecting USB Trojan Can Give You Nightmares

USB Thief This Self Projecting USB Trojan Can Give You Nightmares

USB Thief This Self Projecting USB Trojan CanSecurity researchers have identified a new malware named USB Thief that has the ability to steal data from air-gapped computers without leaving its trace. The malware uses a unique method of protecting itself with AES128-encryption and renaming the files in each new instance.

Imagine a malware that spreads through USB drives, steals your computer’s data and goes undetected. Sounds like a bitter pill to swallow? Well, security researchers have spotted this unique data-stealing trojan in the wild that comes with self-protection mechanism that protects it from being reproduced or copied.

The researchers at ESET security firm have unveiled the fact that Win32/PSW.Stealer.NAI malware, or USB Thief, can attack the isolated or air-gapped computers. Each attack of this malware relies on a USB device and it leaves no evidence on its target.

How does USB Thief spread in the wild?

Instead of spreading via the tried-and-tested techniques of autorun files and shortcuts to run itself, USB Thief uses another technique that involves using itself in the portable versions of popular application like NotePad++, Firefox web browser, and TrueCrypt on thumb drives.This queer fish takes advantage of this disguise and finds home in the command chain of such applications in the form of a dynamically linked library or a plugin. As a result, whenever the target runs the applications, the malware also runs in the background.

The protection mechanism of USB Thief.

The USB Thief malware contains six files — four executables and two containing configuration data. Talking about its self-protection techniques, the malware uses two methods:1) Some of the files are protected by AES128-encryption.

2) The filenames are generated with some cryptographic jugglery that makes the filenames different for every instance of malware.The researchers found it very challenging to crack this dish fit for hacking Gods. Here’s is the execution flow of malware explained in a flow-chart. The malware operates with 3 payloads that interact with two configuration files and implements the data stealing functionality with the payload.

At the moment, the USB Thief malware is not widespread but its ability to be used in targeted attacks on isolated computers makes it the black sheep of the malware family. fossBytes advises you to turn of Autorun feature in your computer and do not use USB drive from random sources.

Read More