Predicting Malicious Behavior: Tools and Techniques for Ensuring Global Security (A $54.99 Value) FREE

"Predicting Malicious Behavior: Tools and Techniques for Ensuring Global Security (A $54.99 Value) FREE for a Short Time!"

A groundbreaking exploration of how to identify and fight security threats at every level.

This revolutionary book combines real-world security scenarios with actual tools to predict and prevent incidents of terrorism, network hacking, individual criminal behavior, and more. Written by an expert with intelligence officer experience who invented the technology, it explores the keys to understanding the dark side of human nature, various types of security threats (current and potential), and how to construct a methodology to predict and combat malicious behavior.

• Guides you through the process of predicting malicious behavior, using real world examples and how malicious behavior may be prevented in the future.
• Illustrates ways to understand malicious intent, dissect behavior, and apply the available tools and methods for enhancing security.
• Covers the methodology for predicting malicious behavior, how to apply a predictive methodology, and tools for predicting the likelihood of domestic and global threats.

Predicting Malicious Behavior fuses the behavioral and computer sciences to enlighten anyone concerned with security and to aid professionals in keeping our world safer.


Free Download now

Sniffly To Sniffing Browser History Using HSTS And CSP

Sniffly Trick For Browser Fingerprinting. Sniffing browser history using HSTS + CSP.

Sniffly is an attack that abuses HTTP Strict Transport Security and Content Security Policy to allow arbitrary websites to sniff a user's browsing history. It has been tested in Firefox and Chrome.

How it works

I recommend reading the inline comments in src/index.js to understand how Sniffly does a timing attack in both FF and Chrome without polluting the local HSTS store. tl;dr version:

1. User visits Sniffly page
2. Browser attempts to load images from various HSTS domains over HTTP
3. Sniffly sets a CSP policy that restricts images to HTTP, so image sources are blocked before they are redirected to HTTPS. This is crucial! If the browser completes a request to the HTTPS site, then it will receive the HSTS pin, and the attack will no longer work when the user visits Sniffly.
4. When an image gets blocked by CSP, its onerror handler is called. In this case, the onerror handler does some fancy tricks to time how long it took for the image to be redirected from HTTP to HTTPS. If this time is on the order of a millisecond, it was an HSTS redirect (no network request was made), which means the user has visited the image's domain before. If it's on the order of 100 milliseconds, then a network request probably occurred, meaning that the user hasn't visited the image's domain.

Finding HSTS hosts

To scrape an included list of sites (util/strict-transport-security.txt, courtesy Scott Helme) to determine which hosts send HSTS headers, do:

$ cd util
$ ./run.sh <number_of_batches> > results.log

where 1 batch is 100 sites. You can override util/strict-transport-security.txt with a different list, such as the full Alexa Top 1M, if you want.

To process and sort the results by max-age, excluding ones with max-age less than 1 day and ones that are preloaded:

$ cd util
$ ./process.py <results_file> > processed.log

Once that's done, you can copy the hosts from processed.log into src/index.js.

Running sploitz

Visiting file:///path/to/sniffly/src/index.html in Chrome should just work. In Firefox, CSP headers using the tag are apparently not supported yet, so you need to set up a local webserver to serve the CSP HTTP response header. My Nginx server block looks something like this:

server {
    listen 8081;
    server_name localhost;
    location / {
        root /path/to/sniffly/src;
        add_header Content-Security-Policy "img-src http://*";
        index index.html;
    }
}

Caveats

Not supported yet in Safari, IE, or Chrome on iOS.
Extensions such as HTTPS Everywhere will mess up results.
Doesn't work reliably in Tor Browser since timings are rounded to the nearest 100-millisecond.
Users with a different HSTS preload list (ex: due to having an older browser) may not see accurate results.

More info available in my ToorCon 2015 slides: https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf.

Demo

Visit http://zyan.scripts.mit.edu/sniffly/ in Firefox/Chrome/Opera with HTTPS Everywhere disabled. If you use an ad blocker, a bunch of advertising domains will probably show up in the "Probably Visited" column (ignore them).

Download

UnEncrypted 4 Million TalkTalk Customers Data Got Hacked

UnEncrypted 4 Million TalkTalk Customers Data Got Hacked

UK Based Company TalkTalk Got Hacked .. 4 Million Customers Data have been breached. Company said that data was not encrypted. Its easy to open all data including Email and Bank details.

TalkTalk Telecom Group plc is a company which provides pay television, telecommunications, internet access, and mobile network services to businesses and consumers in the United Kingdom.

These data been affected?

Company said, the investigation is still ongoing. The Metropolitan Police is investigating this case. But unfortunately there is a chance that some of the following data may have been compromised:

1. Names
2. Addresses
3. Dates of birth
4. Email addresses
5. Telephone numbers
6. TalkTalk account information
7. Credit card details and/or bank details

Last night TalkTalk website was unavailable with message: 

"Sorry we are currently facing technical issues, [and] our engineers are working hard to fix it. We apologise for any inconvenience this may cause."

According to report, TalkTalk website was attack by DDOS.

Company also warn to the customers be alert of the Phishing emails attack, it might be the next step of Cyber criminals.

Lets Encrypt Offers Free SSL Certificates To All Websites

Lets Encrypt Offers Free SSL Certificates To All Websites.

Lets Encrypt Your Website with Free HTTPS Certificate.

Hyper Text Transfer Protocol Secure (HTTPS) is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted.

According to Lets Encrypt

We’re pleased to announce that we’ve received cross-signatures from IdenTrust, which means that our certificates are now trusted by all major browsers. This is a significant milestone since it means that visitors to websites using Let’s Encrypt certificates can enjoy a secure browsing experience with no special configuration required.

Both Let’s Encrypt intermediate certificates, Let’s Encrypt Authority X1 and Let’s Encrypt Authority X2, received cross-signatures. Web servers will need to be configured to serve the appropriate cross-signature certificate as part of the trust chain. The Let’s Encrypt client will handle this automatically.

You can see an example of a server using a Let’s Encrypt certificate under a new cross-signed intermediate here.

Vital personal and business information is flowing over the Internet more frequently than ever, and it’s time to encrypt all of it. That’s why we created Let’s Encrypt, and we’re excited to be one big step closer to bringing secure connections to every corner of the Web.

Company will offer Free HTTPS Certificate by November 2015.

Mobile Security: How to Secure, Privatize, and Recover Your Devices (A $26.99 Value!) Free eBook For A Limited Time

Mobile Security: How to Secure, Privatize, and Recover Your Devices (A $26.99 Value!) Free eBook for a limited time

Learn how to keep your data secure when you’re on the go.

Mobile phones and tablets enhance our lives, but they also make you and your family vulnerable to cyber-attacks or theft. This clever eBook will help you secure your devices and know what to do if the worst happens.

Download

Wikileaks Released CIA Head Email Accounts Details

Wikileaks Released CIA Head Email Accounts Details

Yesterday Wikileaks Tweeted about to publish the Email account details.

ANNOUNCE: We have obtained the contents of CIA Chief John Brennan's email account and will be releasing it shortly.

— WikiLeaks (@wikileaks) October 21, 2015

According to Wikileaks,

"Today, 21 October 2015 and over the coming days WikiLeaks is releasing documents from one of CIA chief John Brennan's non-government email accounts. Brennan used the account occasionally for several intelligence related projects.

John Brennan became the Director of the Central Intelligence Agency in March 2013, replacing General David Petraeus who was forced to step down after becoming embroiled in a classified information mishandling scandal. Brennan was made Assistant to the President for Homeland Security and Counterterrorism on the commencement of the Obama presidency in 2009--a position he held until taking up his role as CIA chief.

According to the CIA Brennan previously worked for the agency for a 25 year stretch, from 1980 to 2005.

Brennan went private in 2005-2008, founding an intelligence and analysis firm The Analysis Corp (TAC). In 2008 Brennan became a donor to Obama. The same year TAC, led by Brennan, became a security advisor to the Obama campaign and later that year to the Obama-Biden Transition Project. It is during this period many of the Obama administration's key strategic policies to China, Iran and "Af-Pak" were formulated. When Obama and Biden entered into power, Brennan was lifted up on high, resulting in his subsequent high-level national security appointments."


Wikileaks didn't released Full  documents yet, they said more to come in coming days

Here is the CNN Interview of Hacker who Hacked CIA Director Email Account,

LiME Linux Memory Extractor

LiME ~ Linux Memory Extractor

A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android.

This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

Table of Contents

• Features
• Usage
• Examples
• Presentation

Features

• Full Android memory acquisition
• Acquisition over network interface
• Minimal process footprint

Usage

Detailed documentation on LiME's usage and internals can be found in the "doc" directory of the project.

LiME utilizes the insmod command to load the module, passing required arguments for its execution.

insmod ./lime.ko "path=<outfile | tcp:<port>> format=<raw|padded|lime> [dio=<0|1>]"

path (required):   outfile ~ name of file to write to on local system (SD Card)
        tcp:port ~ network port to communicate over

format (required): raw ~ concatenates all System RAM ranges
        padded ~ pads all non-System RAM ranges with 0s
        lime ~ each range prepended with fixed-size header containing address space info

dio (optional):    1 ~ attempt to enable Direct IO
        0 ~ default, do not attempt Direct IO

localhostonly (optional):  1 restricts the tcp to only listen on localhost, 0 binds on all interfaces (default)

Examples

In this example we use adb to load LiME and then start it with acquisition performed over the network

$ adb push lime.ko /sdcard/lime.ko
$ adb forward tcp:4444 tcp:4444
$ adb shell
$ su
# insmod /sdcard/lime.ko "path=tcp:4444 format=lime"

Now on the host machine, we can establish the connection and acquire memory using netcat

$ nc localhost 4444 > ram.lime

Acquiring to sdcard

# insmod /sdcard/lime.ko "path=/sdcard/ram.lime format=lime"


Download