The expanded search authorization, known as ‘Rule 41,’ makes it easy for the FBI to breach computers legally during investigations. Until now, the law enforcement agencies could only search computers within the district where the warrant is issued, typically within the state.

The legal operation of government hacking attempts in the past has been a contentious topic, such as ‘playpen‘ investigation in which government placed tracker programs in suspects’ computers allege to involve in pedophilia across the country. However, the defendants were able to challenge their arrests successfully on the basis that they lived outside the covered area described in the warrant.

Civil liberties groups have notified that the Rule-41 would dangerously expand the government’s surveillance power and creates new risks related to forum shopping – seeking warrants from any district and judge would most likely to grant them.

The controversy led to bipartisan groups within the lawmaking authorities and halted the new Rule 41 powers until the Congress reading. On Wednesday, Senator Chris Coons (D-Del) announced a call for a voice vote to pass a bill delaying Rule 41. However, the measure lacked support in the House.

A spokesman from the EFF, which led the opposition to the rule change, says that the Congress can still amend or halt the bill even if it goes into effect.

Rule-41 presented for a regular review of criminal procedure in a conference of federal judges, and after weighing the rule and a public comment period, the conference submitted the suggested rule change to the Supreme Court, which can come into effect on Dec. 1 upon approval.

Opposition to Rule-41 have arguments that are not some housekeeping measure that should ordinarily be addressed by the judicial conference, but it would significantly affect how police conduct its search and seizure, and that it may violate the Fourth Amendment of the Constitution.

The debate over Rule-41 will likely to continue under the forthcoming Presidency of Donal Trump.

The post Rule 41 Empowers FBI To Extend Its Hacking Operations appeared first on BeEncrypted.

Dailymotion video-sharing website launched in 2005 and is considered to be the 113th most-visited website across the world.

According to the data breach notification LeakedSource, the website confirmed to have received a database of 87.6 million user accounts with unique email addresses.

The database includes email addresses, usernames and more than 18 million of the records includes password hashes. The passwords were encrypted with Bcrypt hashing algorithm, with ten rounds of rekeying and considered as secure and hard to crack.

Bcrypt hashing is a cryptographic algorithm which makes the hashing process extremely slow that would make SHA1 and MD5 password crack nearly impossible.

ZDNet also received a sample of the stolen database and confirmed that the data is indeed from the website, but Dailymotion did not respond with any comments. According to ZDNet, “We verified the data by matching up plaintext passwords with the hashed password found against the email address using a readily available online tool. In one case, the email address and password combination were unique to Dailymotion, suggesting that the data could only have come from the video-sharing site.”

According to the LeakedSource website, hackers have stolen the archive around October 20, whose identity is still unknown.

Although the passwords were hashed but the emails contained in the database could be used for potential spam campaigns, and attackers can use them in targeted phishing campaigns.

If you use DailyMotion and one of the 18 million affected users whose hashed password has leaked, you are advised to change your password on the website, and on other websites that use your same password.

LeakedSource has added the stolen Dailymotion database on its search index which you can check whether it includes your account.

Moreover, it is advised to set complex passwords where ever possible. You can use LastPass or Keypass password managers to encrypt all your passwords with a master password.

The post Dailymotion hack exposes 85 million users online appeared first on BeEncrypted.

The vulnerability was first identified on Tor’s official blog; the post pointed out that a Javascript exploit that actively uses the Tor Browser and unmasks the users.

“This is a Javascript exploit actively used against TorBrowser NOW. It consists of one HTML and one CSS file, both pasted below and also de-obscured. The exact functionality is unknown, but it’s getting access to “VirtualAlloc” in “kernel32.dll” and goes from there. Please fix ASAP. I had to break the “thecode” line in two to post, remove ‘ + ‘ in the middle to restore it.” reads the post.

Roger Dingledine, Tor co-founder, confirmed the news of zero-day exploit and announced that Mozilla security team is working on this to fix the bug.

The zero-day is a corrupting memory vulnerability that exploits and executes malicious code on Windows operating systems.

A security research Raylee explained that exploit is quite similar to the one that was used by law enforcements in 2013 to expose the users of illicit material serving site hosted on Freedom Hosting.

“It’s almost the same as the payload used in 2013,” Raylee told ArsTechnicia. “It exploits some vulnerability that executes code very similar to that used in the 2013 Tor browser exploit. Most of the code is identical; just small parts have changed.”

According to another security researcher Joshua Yabut, the zero-day exploit executes a heap overflow vulnerability which needs Javascript enabled on the victim’s machine.

The zero-day exploit code can target various versions of Firefox browser from version 41 to 50; the exploit can target all these versions which mean that attackers have enhanced their malicious code over time.

Moreover, the public disclosure of the malicious Javascript code could allow attackers in the wild to track Tor users.

Since Mozilla is working on the patch, users should avoid using Tor to protect their identity, and also it is suggested to disable Javascript.

The post Mozilla Firefox Zero-Day Exploit Exposes Tor Users appeared first on BeEncrypted.

The San Francisco Municipal Transporation Agency (SFMTA) gave free service on its Metro light-rail all day long, on Saturday, after an apparent ransomware hack of the agency’s computer systems.

Pink ‘out of service’ notification showed on ticket machines at Powell Street station, where operators taped paper signs which read ‘Metro Free.’

San Francisco Municipal Railway (MUNI) spokesperson confirmed the news of the hack and administration had to shut down their systems and “opened the fare gates as a precaution to minimize customer impact.”

“There’s no impact to the transit service, but we have opened the fare gates as a precaution to minimize customer impact,” said Muni spokesman. “Because this is an ongoing investigation it would not be appropriate to provide additional details at this point.”

The station screens displayed a message that reads:

“You Hacked, ALL Data Encrypted. Contact For Key(cryptom27@yandex.com)ID:681 ,Enter.”

The Verge contacted the hackers via email which confirmed that he was seeking a deal with MUNI to remove the ransomware:

“we don’t pay attention to interview and propagate news ! our software working completely automatically and we don’t have targeted attack to anywhere! SFMTA network was Very Open and 2000 Server/PC infected by software! So we are waiting for contact any responsible person in SFMTA, but I think they don’t want a deal! So we close this email tomorrow!”

The hacker demanded 100 BTC ($73,184 USD) with current exchange rates.

However, SFMTA had no intention of paying the ransomware. On its website blog, it reads: “The SFMTA has never considered paying the ransom. We have an information technology team in place that can restore our systems, and that is what they are doing.”

Morphus Labs mentioned the same hacker in September in a link to a strain of ransomware called Mamba, which uses similar tactics to those used against MUNI.

At the time of the attack, experts at transit had no idea who was responsible for the cyber attack.

According to San Francisco Municipal Railway blog, “Upon discovering the malware, we immediately contacted the Department of Homeland Security (DHS) to identify and contain the virus. We are working closely with the FBI and DHS on this matter.”

Moreover, it reads, “Existing backup systems allowed us to get most affected computers up and running this morning, and our information technology team anticipates having the remaining computers functional in the next day or two.”

Photo: SFMTA

The post Hackers Crashed San Francisco Municipal Railway Systems appeared first on BeEncrypted.

The ongoing Facebook spam campaign is the culprit behind the spreading of malware downloader by taking advantage of ‘seem to be’ harmless SVG image file to infect the masses.

The Facebook spam campaign was first spotted by the researcher Peter Kruse and malware expert Bart Blaze.

On his blog post, Bart Blaze wrote, “Earlier today, a friend of mine notified me of something strange going on with his Facebook account; a message containing only an image (a .svg file in reality) had been sent automatically, effectively bypassing Facebook’s file extension filter:”

The SVG image file can embed any content (such as JavaScript) to bypass security filters.

What is SVG?, as mentioned at Wikipedia:

“Scalable Vector Graphics (SVG) is an XML-based vector image format for two-dimensional graphics with support for interactivity and animation. The SVG specification is an open standard developed by the World Wide Web Consortium (W3C) since 1999.

SVG images and their behaviors are defined in XML text files. This means that they can be searched, indexed, scripted, and compressed.”

When a victim clicks and opens the malicious SVG file, it redirects him to a malicious website disguised as YouTube and asks to install a chrome extension to play the video.

“A website purporting to be Youtube, with a video from Facebook – of course, you’ll need to install an additional extension to view it,” wrote Bart Blaze.

The malicious chrome extension appears invisible with no icon and has the following permission: “Read and change all your data on the websites you visit.”

Once a victim installs the extension, the attack spreads further and installs a downloader Nemucod which executes the locky-ransomware.

The security researcher, Peter Kruse noticed the similar behavior and got locky-ransomware as a consequence

Confirmed! #Locky spreading on #Facebook through #Nemucod camouflaged as .svg file. Bypasses FB file whitelist. https://t.co/WYRE6BlXIF pic.twitter.com/jgKs29zcaG

— Peter Kruse | Cybercrime Research (@peterkruse) November 20, 2016

To remove the malicious extension immediately from your browser, follow these steps:

1. Open the browser, and click on menu (three-lined option).
2. Navigate to More Tools > Extensions.
3. Click the extension you want to remove and click on the ‘trash bin‘ to remove it from chrome.
4. A notification will appear to confirm the removal of the extension. Click on Remove.

After removing the malicious extension, run a system scan and change your Facebook’s password.

Moreover, notify your friends about this campaign, and ask them if they received a spam message from your end. If you receive the same message from one of your compromised friend’s profile, temporarily block their messages.

The post Facebook Spam Campaign Spreads Ransomware Via SVG Image File appeared first on BeEncrypted.

The Investigatory Powers Bill (IP Bill) consolidates many of the powers that intelligence agencies and law enforcements can use to collect communications and its data into a single piece of legislation.

Despite the provisions and recommendations of Electronic Frontier Foundation (EFF) and Don’t Spy On Us (DSOU), and other Joint Committees of Intelligence and Security Committee (ISC) and Science and Technology Committee, the changes are not addressed in the Investigatory Powers Bill.

This is not just a grave concern for UK citizens. The effects of Investigatory Powers Bill will also set a precedent for the world. Authoritarian leaders with poor human rights records will look up to and points to the UK in justifying its own harsh surveillance regimes.

Jim Killock, Executive Director of Open Rights Group, commented: “The UK now has a surveillance law that is more suited to a dictatorship than a democracy. The state has unprecedented powers to monitor and analyse UK citizens’ communications regardless of whether we are suspected of any criminal activity — The impact of this will be felt beyond the UK’s shores. It is likely that other countries, including authoritarian regimes with poor human rights records, will use this law to justify their own intrusive surveillance powers.”

Such a move legalizes the illegal hacking activities of GCHQ spy agency of UK to hack into UK’s citizens and foreign entities without any prior notifications and collects communications data and records; it also allows both the GCHQ and police to install bugs into electronic devices from mobile devices to baby monitors.

Facing the harsh critics and dubbed as ‘Snoopers’ Charter.’ Theresa May has repeatedly said that the bill would not include automatic surveillance of people’s browsing history and any ‘intrusive’ actions would be subject to ‘strong oversight arrangement.’

The Investigatory Power Bill will affect:

Right to privacy: Our personal data, communications, and the Internet use will be collected, stored, and analysed, even if we are not suspect.

Caroline Wilson Palow, General Counsel of Privacy International commented, “The passage of the Investigatory Powers Act is a major blow to the privacy of people in the UK and all over the world. It sets a world-leading precedent, but not one of which the Government should be proud.  Instead of reining in the unregulated mass surveillance practices that have for years been conducted in secret and with questionable legal authority.”

Right to freedom of expression: Freedom of expression relies on exploring freely and expression of ideas without the threat of disproportionate interference. The IP Bill will have a severe adverse effect on our freedom to share and discuss.

Investigative Journalism: The bill fails to provide sufficient guarantees for the protection of journalists and their sources. It also allows authorities to hack into journalist’s devices without any notifications.

“The NUJ has campaigned hard to oppose this unjustified and draconian legislation. The secret surveillance of journalists, whistleblowers and sources is an attack on democracy and the public’s right to know. The fight doesn’t stop here, we will continue to stick to our ethical principles to protect journalistic sources and seek to challenge this new law in every way that is possible,” commented Michelle Stanistreet, General secretary of National Union of Journalist.

Security of Internet: Mass hacking privileges could undermine the security of Internet.

Intelligence sharing: The Investigatory Powers Bill fails to prevent data sharing and integrity of technology between the US and the UK.

Independent Judicial: Judicial Commissioners wouldn’t be able to challenge surveillance decisions and reach their own verdict as to whether a warrant should be granted for surveillance. They’d would lack the opportunity to questions the surveillance requesting agency; to probe as to whether less intrusive methods could be adopted, or to ask for further evidence to justify the request.

Independent judicial authorization could mean better cooperation from international tech firms, who have expressed unease with this political authorization bill.

The inventor of the world wide web Tim Berners Lee has branded the Investigatory Powers Bill ‘inappropriate’ and urged members of the public to write to their respective MPs about it.

While speaking to the Economist radio he talked about the openness of the web, he said, “There are a huge number of fronts on which we have to battle. For example, making sure that countries don’t introduce laws that decrease the power of the citizen… don’t pass inappropriate laws, as the UK government is trying to do at the moment, to give the government too much power to spy on citizens.”

The intention of government is also vague when it comes to encryption. While Theresa May said she doesn’t plan to limit or ban end-to-end encryption, the bill empowers the government to order “the removal of electronic protection applied by a relevant operator to any communications or data.”

“Encryption is important in providing the secure services on the internet we all rely on, from credit card transactions and commerce to legal or medical communications,” commented chair Nicola Blackwood of Commons Science and Technology Select Committee. “The government needs to do more to allay unfounded concerns that encryption will no longer be possible.”

However, the people of Great Britain seem remarkably indifferent in fighting the bill and chances are there will not be outcry unless an inevitable hacking event takes place.

The world is seeing the mass acceptance of bulk surveillance, both in the UK and around the world, and it is becoming a fact of life. The move towards authoritarianism around the world makes a fighting back more imperative than before.

The post UK Slams Its Citizens With An Extreme Surveillance Law appeared first on BeEncrypted.

While giving an interview to the SecurityAffairs, the young pentester said he has ambitions to work in the Cyber Security industry.

Last week, Kapustkiy breached the Paraguay Embassy of Taiwan exploiting same SQLi injection flaw to demonstrate inadequate security in Asia.

While searching for simple SQLi flaws, the pentester found and breached two subdomains of the University of Wisconsin and the subdomain of the University of Virginia; the data was spilled on Pastebin including names, passwords, logins, phone, and other information related to students and the staff.

Earlier this month, the pentester with the moniker ‘Kapustkiy’ breached the Indian Embassy of 7 countries Switzerland, Romania, Mali, Italy, Libya, and Malawi. But the Indian Embassy didn’t fix the security issues, which led to another breach of Indian Embassy in New York and a leak of a small portion of breached data excluding US personnel.

Kapustkiy wrote, “I thought they would fix all the vulnerable in their domains and also look at their other domains that maybe could have a simple ”SQLi” vulnerable. So guess what? They did not look at all and only fixed some of their domains SMH.” he wrote, “I’m tired of reporting all the errors that I find on their website that I decided to breach them, NOW FIX YOUR SECURITY.”

The results of such breach? The officials of Indian Consulate General in New York took notice of his efforts and thanked the 17-year-old for helping them find flaws in their security measures.

Joint Secretary of E-Governance and IT, Sanjay Kumar Verma, personally thanked Kapustkiy in a written statement, “Thank you for your advice. We are fixing codes one by one. Your help in probing websites of various Indian embassies is a great help. While we appreciate your help, please do not post the details on Pastebin,” which indeed was removed later on, but some non-sensitive information is still available on site.

Head of Chancery, L.T. Ngaihte, said in the statement, “The Indian Consulate has taken immediate actions to ensure the site data is safe. In addition to the New York, Kapustkiy had hacked websites of Indian embassies in countries such as Libya, South Africa, Malawi, Switzerland, Italy, Romania, and dump the information on site pastebin.com.”

At the time of writing the news, reports came about the breach of the government of Italy ‘Mobilitia.gov.it’ website which resulted in the leak of 9000 entries from the database which affected 45,000 users. The attack is an early warning to the government website from Kapustkiy to strong arm their security measures and fixes the issues, he reported the issue to the administrators and hoping to get a reply and get it fixed.

He tweeted, “The website had around 6 databases. I only leaked one of the DB for all those who were wondering. No phones and address are leaked.”

The post Government Of Italy Website Breached In A Kapustkiy Awareness Program appeared first on BeEncrypted.

Mark Zuckerberg’s social accounts are now hacked by this group two times in a row. In June, OurMine first hacked and gained access to his Twitter and the same Pinterest accounts.

The hacking attack in June was believed to be the consequence of password re-use. Before you think any further, Yes!, even the giant tech CEOs can fall for password fatigue.

OurMine reportedly used credentials that were exposed in a massive LinkedIn hack that resulted in information leak of more than 117 million people.

Mark Zuckerberg isn’t the only prominent tech personality which has victimized by OurMine. Other CEOs including Marissa Meyer of Yahoo, Sundar Pichai of Google, and Uber’s Travis Kalanick have had their accounts hacked by the same group. OurMine also has claimed responsibility for attacks on Buzzfeed and Variety earlier this year.

While talking to Forbes, Cris Thomas, Strategist for Tenable Network Security said, “I am more dismayed that the _OurMine_ team, who has claimed responsibility, has used the claim that they were just testing security.”

Hackers are classified into three distinct categories: White hat (good guys), Blackhat (bad guys), and ones that are good guys hackers but with shady or questionable ethics; they are referred to as Gray hats. It seems the activities of OurMine group falls on the darker end of Gray Hat hacking.

He said, “No legitimate security researcher would ever test security in this manner. It promotes the stereotype that all hackers are bad and makes it increasingly difficult for researchers who do legitimate security work.”

According to ZDNet, this time the attack was different, and the OurMine group exploited the Pinterest platform vulnerability to allow them hack Zuckerberg’s account and deface it.

Mark Zuckerberg bio at Pinterest reads, “Don’t worry; we are just testing your security,” that included a link to OurMine website. However, the changes soon retracted. The group also claimed to hack Zuckerberg’s Twitter account but were unable to log in because of two-factor authentication.

To Make Sure You Don’t Get Mark Zuckerberg-ed

Stuart McClure, CEO of Cylance says, “My online security advice to everyone is to use complicated passwords that only mean something to you and are unique to each website. Make sure they contain letters (lower and uppercase), numbers, and some special characters—and use two-factor authentication anywhere you can, even on social media. Don’t store credit card information in your browser, and leverage AI-based antivirus on your computers to prevent non-authentication-based attacks.”

Richard Reiner, CTO of True Key at Intel Security, “Readers [People] can protect themselves by using strong passwords (long, random strings of letters, numbers, and punctuation) anywhere, and never use the same password for multiple sites. Readers can use a secure password manager app (such as Intel Security’s True Key app) to generate strong passwords, automatically save them, store them securely, sync them across all their devices, and automatically enter them into the login fields of their sites and apps.”

“The reality is that your password will be compromised,” said Hatem Naguib, GM of Security at Barracuda, “If there is an option for adding the two-factor authentication, do it. If 2FA is not an option, then using strong passwords that you change often is the only way to reduce the likelihood that you will be Zuckerberged.”

What motivates the group’s hacking attacks? It seems, they are trying to build up their business in security services by gaining attention in such ways, as it was seen in the past.

The post Mark Zuckerberg Hit ‘Being Hacked’ For The Third Time This Year appeared first on BeEncrypted.

Security experts at Kryptowire firm have identified a backdoor software pre-installed on low-budget and disposable Chinese variants of mobile phones. The backdoor was found pre-installed in the mobile phones distributed by the company named BLU.

The backdoor software resides in the FOTA – Firmware Over The Air – that allows businesses to update their firmware remotely. The company AdUps provides updated software to BLU Android devices.

The USA-based phone manufacturer BLU products told NYTimes that 120,000 of its phones were affected and they have updated the software to remove the feature.

Kryptowire said the Adups software transmitted the full contents of contact lists, text messages, call logs, location information and other data to a Chinese server. These servers appear to be owned by Shanghai AdUps Technologies.

“Kryptowire has identified several models of Android mobile devices that contained firmware that collected sensitive personal data about their users and transmitted this sensitive data to third-party servers without disclosure or the users’ consent. These devices were available through major US-based online retailers (Amazon, BestBuy, for example) and included modern smartphones such as the BLU R1 HD.” Kryptowire published analysis reads, “These devices actively transmitted user and device information including the full-body of text messages, contact lists, call history with full telephone numbers, unique device identifiers including the International Mobile Subscriber Identity (IMSI) and the International Mobile Equipment Identity (IMEI).“

Adups seems to defend its stance by saying that “This is a private company that made a mistake,” spoken via its lawyer Lily Lim.

According to Adups, the software was written for an unidentified Chinese manufacturer who wanted to use the data for customer support. The software was intended to help the client identify junk calls and text messages. Moreover, she doesn’t know how many phones were affected.

She further said that the company, not Adups, is responsible for disclosing privacy policies to its customers. Adups only provide the functionality that its distributors ask for.

Adups provides firmware updates for major mobile manufacturers, including ZTE and Huawei, and its code runs on more than 700 million mobiles, cars, and other smart devices.

However, the Adups lawyer told the NYT that the company is not involved in any government surveillance program and assured that the data collection for the BLU product has already been destroyed.
NYT reported, “For many years, the Chinese government has used a variety of methods to filter and track Internet use and monitor online conversations. It requires technology companies that operate in China to follow strict rules. Ms. Lim said Adups was not affiliated with the Chinese government.”

Kryptowire reported its findings to the US government and made its report public on Tuesday.

A spokeswoman for the Department of Homeland Security, Marsha Catron, said, “was recently made aware of the concerns discovered by Kryptowire and is working with our public and private sector partners to identify appropriate mitigation strategies.”

The post Adups Secret Backdoor In Some US Phones Sent Data To China appeared first on BeEncrypted.

Collin Mulliner, a security researcher, said the flaw is related to the webview and the behavior of this component handled by some iOS applications. WebView is a web browser integrated into mobile apps. The developers integrate the web technology in their apps which allows displaying web pages inside the application without needing third-party web browsers.

According to Mulliner, an attacker lures the victim into opening a specially crafted website via a vulnerable app to make calls from the victim’s device. The malicious website redirects the target to a Tel URI, which calls to any specified number. This part of the attack only requires one line of HTML code. However, the victim can quickly end the call once the arbitrary number is dialed.

In 2008, Mulliner reported a similar vulnerability in Apple’s Safari that allowed attackers initiate random phone calls and freeze victim’s mobile graphical interface unit to prevent them from ending the call. Apple, later on, fixed the issue with iOS 3.0.

The researcher identified the bug has resurfaced and it allowed him to tweak his old proof-of-concept (POC) to start calls from LinkedIn and Twitter iOS apps and block the user from ending the call.

“The trick is to cause the Operating System to open the second application while the phone is dialing the given number. Opening apps are pretty straight forward; you open a URL that causes the OS to spawn another application,” Collin Mulliner explained, “This can be anything from the messages app (via the SMS: URL) or iTunes (via the items-apps: URL). You can get any application to launch that has a URI binding. In 2008 I used an SMS URL with a long phone number to block the UI thread.”

Mulliner demonstrated the vulnerability in LinkedIn and Twitter, but he believes other vulnerable iOS apps could be affected. The apps that open the links in third-party web browsers such as Chrome and Safari are not impacted.

https://www.youtube.com/watch?v=oYDfe_P9uAQ

https://www.youtube.com/watch?v=WuFx4lxF8DY

Mulliner reported Twitter of his findings through bug bounty program, but the company marked it as duplicate without any comment. He also notified Apple and LinkedIn about the vulnerability but did wait for them to release patches before going public.

Apps such as Dropbox, Yelp, and Safari informs the user before making a phone call to confirm the action; Mulliner believes that other apps should apply the same. Also, Apple should take steps to stop this type of WebView vulnerability.

Mulliner started his research after hearing news about the 18-year old teen who used a similar ‘exploit’ to prank his friends. However, the teen ended up arrested because he inadvertently triggered calls to 911 which caused disruptions to emergency services.

“DoSing 911 is pretty much terrible, but there are other examples like expensive 900 numbers where the attacker can make money. A stalker can force his victim to dial his phone number, so he gets his victim’s number. Altogether things you don’t want to happen,” Mulliner said.

The post Hackers Can Use iOS WebView To Make Phone Calls appeared first on BeEncrypted.