#hack-a-day

New Post has been published on http://www.kerrylcacho.com/?p=2350

How To Hack WhatsApp Using SS7 Flaw

By VIJAY PRABHU

Researchers are easily able to hack WhatsApp and Telegram using the known telecom flaw

We continuously receive queries from readers about how to hack WhatsApp. The world’s most popular cross-platform messaging App is seen to be ultimate hack by many because it has recently enabled 256-bit encryption.

For ordinary souls this encryption would take days and months to decode a sentence or a complete message. Ditto with another secure messaging service called Telegram. Though Telegram is not as popular as WhatsApp, it has its ardent group of followers who use it for its encryption as well as snooping free service.

Though both of these Apps are end-to-end encrypted both of them suffer from hardware side vulnerability which can be exploited to hack and hijack both WhatsApp and Telegram.

The vulnerability lies in Signalling System 7, or SS7, the technology used by telecom operators, on which the highly secure messaging system and telephone calls rely. SS7 is a set of telephony signalling protocols developed in 1975, which is used to set up and tear down most of the world’s public switched telephone network (PSTN) telephone calls. It also performs number translation, local number portability, prepaid billing, Short Message Service (SMS), and other mass market services.

SS7 is vulnerable to hacking and this has been known since 2008. In 2014, the media reported a protocol vulnerability of SS7 by which both government agencies and non-state actors can track the movements of cell phone users from virtually anywhere in the world with a success rate of approximately 70%. In addition, eavesdropping is possible by using the protocol to forward calls and also facilitate decryption by requesting that each caller’s carrier release a temporary encryption key to unlock the communication after it has been recorded. Researchers created a tool (SnoopSnitch) which can warn when certain SS7 attacks occur against a phone and detect IMSI-catchers.

You can view how researchers managed to hack WhatsApp and Telegram using the SS7 flaw below :

WhatsApp Hack

Telegram Hack

Both the hacks exploit the SS7 vulnerability by tricking the telecom network into believing the attacker’s phone has the same number as the victim’s phone. Once the network has been fooled, anybody, even a newbie can spy on the legitimate WhatsApp and Telegram user by creating a new WhatsApp or Telegram account using the secret code.

Once complete, the attacker now controls the account, including the ability to send and receive messages. Even more horrific is the fact that the hacker can also send messages on behalf of the victim, and read confidential messages intended for the victim without ever having to try to break strong encryption protocols.

New Post has been published on http://www.kerrylcacho.com/?p=1735

What should I know about Shellshock?

Everyone is now talking about Shellshock. What is that and what can you do about it? Here’s what you should remember: ◾ Shellshock is a software bug, which affects the Bash – the common command-line shell that is actively used in Linux/UNIX OS and Apple Mac OS X for controlling different programs and their features. It is believed that this 25-year-old (!) vulnerability was discovered by the Linux expert Stéphane Chazelas.

◾ Since Bash can be found on millions of computers, mobile devices, routers, firewalls and servers, everyone can be affected by Shellshock. According to experts, the most vulnerable systems are MAC, Linux and Windows OS.

◾ This bug can be exploited for connecting the target OS and infecting it with different kinds of cyber threats. It may also help hackers initiate various modifications on the system, let them access and destroy sensitive people’s information or cause other dangerous activities.

◾Compared with Heartbleed, Shellshock is more powerful and requires less skill to exploit it. This bug can be exploited without having a username and password of the server. ◾ Shellshock can be used to create a self-replicating “worm.” At the moment of writing, it is known that two active worms have been exploiting the bug for turning affected systems into bots. They have also been attempting to guess passwords and logins on vulnerable servers.

New Post has been published on http://www.kerrylcacho.com/?p=1733

Android 'DeathRing' malware being pre-loaded on cheap smartphones

Chinese supply chain under suspicion yet again

By John E Dunn | Techworld | Published: 13:06, 04 December 2014

For the second time in a year, Chinese-made Android smartphones have been discovered pre-flashed with malware, this time a Trojan security firm Lookout Mobile has ominously dubbed ‘DeathRing’.

On infected handsets, DeathRing pretends to be a ringtone app but can be used to download other malware, communicating with its command and control via SMS or even the ancient WAP. It activates once the device has been rebooted five times or, in other cases, the device has been accessed 50 times by its owner from the homescreen. By today’s ambitious mobile malware standards, DeathRing is pretty low-rent. The list of cheao clone handsets on which is was found – including models from Gionee, Polytron, Karbonn, Hi-Tech, Jiayu, Haier, TECNO, and GPAD – aren’t sold to consumers beyond Asian and Africa so the threat is non-existent in the UK and US.

That might also explain the use of WAP, a defunct technology elsewhere. According to Lookout, the countries affected are Vietnam, Indonesia, India, Nigeria, Taiwan, and China.

The wider significance is that the issue of malware loaded on to devices as a part of factory or supply chain firmware flashing seems to be getting slowly worse. Earlier this year, Lookout reported another Trojan called Mouabad which used an identical method to get itself on to factory-fresh handsets.

In a separate attack, security firm Marble Security discovered a fake Russian-made version of Netflix that had been pre-installed on Android devices.

Could higher-end Android handsets be affected by this sort of attack in the near future?

“It’s theoretically definitely possible, but for the time being unlikely. This is because many manufacturers of the higher-tier devices generally found in Western countries have more stringent regulation over their supply chains and better quality control programs,” said Lookout’s Jeremy Linden.

“However, like all malware, where the money is, the malware technology follows. If authors find this distribution method to be lucrative, they may evolve to attack the bigger fish.”

For the user, it’s not a case of detecting and removing these Trojans. Loaded as part of the firmware image (older versions of Android), they can’t be removed manually without re-flashing the operating system.

New Post has been published on http://www.kerrylcacho.com/?p=1402

Regin: The New Stuxnet Equivalent

An “extremely complex” and “stealthy” Stuxnet Equivalent spying program has been stealing data from ISPs, energy companies, airlines and research-and-development labs, a security company has said. With a “degree of technical competence rarely seen”, Regin had probably taken years to develop, Symantec said. “Regin” malware is thought to have been developed by a nation-state because of the financial clout needed to produce code of this complexity. The malware targets organizations in the telecommunications, energy and health sectors.

New Post has been published on http://www.kerrylcacho.com/a-group-of-russians-figured-out-how-to-hack-a-car-and-control-it-with-an-ipad-video/

A Group of Russians Figured Out How to Hack a Car and Control It With an iPad (Video)

New Post has been published on http://www.kerrylcacho.com/avert-disaster-with-this-self-powered-emergency-smartphone-charger/

Avert Disaster With This Self-Powered Emergency Smartphone Charger

Vignesh Ramachandran

You could have all the apps in the world to prepare you for survival when disaster strikes — flashlight, emergency contacts, GPS and first aid tips — but they’ll be entirely useless when you run out of battery juice on your phone. If you’re camping in the boondocks or preparing a disaster survival kit, you might want to consider a low-tech emergency smartphone charger. Seattle-based SOS Ready has designed the pocket-sized “SOSCharger,” which is powered by you. With the gadget’s built-in generator, all you do is connect to your smartphone via USB connection and hand-crank the handle. The SOSCharger has a 1,500 mAh Lithium Polymer battery, and depending on your phone and network, the company claims three to five minutes of winding will translate to five to 12 minutes of talk time.

The iPod Classic-sized charger also features charge and battery level indicators. SEE ALSO: 13 Gadgets to Prepare You for a Natural Disaster

SOS Ready premiered the SOSCharger at CES this year and their prototype is tested and complete. The company is hoping to raise $27,000 on Kickstarter to take the charger to full production, with shipping targeted for this summer. With 45 days left to go for the Kickstarter campaign, backers have pledged $16,452, as of Monday evening. Backers who pledge at least $25 will be among the first to receive the charger.

Solar chargers are also a low-tech charging option, but on its Kickstarter page, SOS Ready points out their perceived flaw in an emergency situation: “Many current solar solutions also don’t collect enough light to work effectively and light is not always available in an emergency.”

During 2012′s Hurricane Sandy, photos captured New Yorkers gathering around crowded power strips, finding desperate means to juice their devices.