How to Protect Your Android From Such Malware Apps

How to Protect Your Android From Such Malware Apps

Even after Google removed all the malware-tainted apps from its official Play Store marketplace, your smartphones will remain infected with the ExpensiveWall malware until you explicitly uninstall the malicious apps, if you have downloaded any.

Google has recently provided a security feature known as Play Protect that uses machine learning and app usage analysis to automatically remove malicious apps from the affected smartphones to prevent further harm.

However, according to the Check Point researchers, many phones run an older version of Android that does not support the feature, leaving a wide audience open to malware attacks.

You are strongly advised to always keep a good antivirus app on your device that can detect and block any malicious app before it can infect your device, and always keep your device and all apps up-to-date.

How to Protect Your Android From Such Malware Apps

Read More

Android Malware Google Play Store Users

 Android Malware Infects Over 4.2 Million 

Google Play Store Users .

Even after so many efforts by Google, malicious apps somehow managed to fool its Play Store's anti-malware protections and infect people with malicious software.

The same happened once again when at least 50 apps managed to make its way onto Google Play Store and were successfully downloaded as many as 4.2 million times—one of the biggest malware outbreaks.

Security firm Check Point on Thursday published a blog post revealing at least 50 Android apps that were free to download on official Play Store and were downloaded between 1 million and 4.2 million times before Google removed them.

These Android apps come with hidden malware payload that secretly registers victims for paid online services, sends fraudulent premium text messages from victims' smartphones and leaves them to pay the bill—all without the knowledge or permission of users.

Dubbed ExpensiveWall by Check Point researchers because it was found in the Lovely Wallpaper app, the malware comes hidden in free wallpaper, video or photo editing apps. It's a new variant of malware that Mcafee spotted earlier this year on the Play Store.

But what makes ExpensiveWall malware different from its other variants is that it makes use of an advanced obfuscation technique called "packed," which compresses malicious code and encrypts it to evade Google Play Store's built-in anti-malware protections.

The researchers notified Google of the malicious apps on August 7, and the software giant quickly removed all of them, but within few days, the malware re-emerged on the Play Store and infected over 5,000 devices before it was removed four days later, Check Point said.

Here's How ExpensiveWall Malware Works ??

Once an app with ExpensiveWall—which researchers think came from a software development kit called GTK—is downloaded on a victim's device, the malicious app asks for user's permission to access the Internet, and send and receive SMS messages.

The internet access is used by the malware to connect the victim's device to the attacker's command and control server, where it sends information on the infected handset, including its location alongside unique hardware identifiers, such as MAC and IP addresses, IMSI and IMEI numbers.

The C&C server then sends the malware a URL, which it opens in an embedded WebView window to download JavaScript code that begins to clock up bills for the victim by sending fraudulent premium SMS messages without their knowledge, and uses the victim's phone number to register for paid services.

However, according to the Check Point researchers, it is still unclear how much revenue was generated via ExpensiveWall's premium SMS scam.

Google's Play Store—Home for Malware

Android malware continues to evolve with more sophisticated and never-seen-before capabilities with every passing day, and spotting them on Google Play Store has become quite a common thing.

Last month, over 500 Android apps with spyware capabilities were found on Play Store, which had been downloaded more than 100 million times.

In July, Lipizzan spyware apps were spotted on Play Store that can steal a whole lot of information on users, including text messages, emails, voice calls, photos, location data, and other files, and spy on them.

In June, more than 800 Xavier-laden apps were discovered on Google Play that had been downloaded millions of times, and the same month researchers found first code injecting rooting malware making rounds on Google Play Store.

A month prior to it, researchers spotted 41 apps on Play Store hidden with the Judy Malware that infected 36.5 million Android devices with malicious ad-click software.

In April, over 40 apps with hidden FalseGuide malware were spotted on Play Store that made 2 Million Android users victims.

Earlier this year, researchers also discovered a new variant of the HummingBad malware, dubbed HummingWhale, hidden in more than 20 apps on Google Play Store, which were downloaded by over 12 Million users.

Read More

Vevo Music Video Service Hacked

Vevo Music Video Service Hacked — 3.12TB of Internal Data Leaked

OurMine is in headlines once again—this time for breaching the popular video streaming service Vevo.

After hunting down social media accounts of HBO and defacing WikiLeaks website, the infamous self-proclaimed group of white hat hackers OurMine have hacked Vevo and leaked about 3.12 TB worth of internal files.

Vevo is a joint venture between Sony Music Entertainment, Universal Music Group, Abu Dhabi Media, Warner Music Group, and Google's parent company Alphabet Inc.

OurMine managed to get hold of Vevo's "sensitive" data including its internal office documents, videos and promotional materials after the hacking collective successfully hacked into the Vevo servers.

The group then posted the stolen documents (approximately 3.12 terabytes) from Vevo on its website on late Thursday, though OurMine removed the stolen information from its website on Vevo's request.

Although it's not clear what prompted OurMine to hack Vevo, the group noted on its website that it initially tried to alert Vevo of the breach privately, but when one of the Vevo's employees responded, "F*** off, you don't have anything," it went public with the data breach and leaked Vevo files.

According to Variety, the stolen files included notes on around 90 artists, including Britney Spears, Jennifer Lopez, Taylor Swift, Justin Bieber, Katy Perry, Madonna, Calvin Harris, Ariana Grande, Florida Georgia Line, One Direction, Sia, The Weeknd, and U2.

The breach was first reported by Dell Cameron of Gizmodo, who said the leaked Vevo content seems "pretty mild," which contained "weekly music charts, pre-planned social media content, and various details about the artists under the record companies' management."

It’s not clear for how long the hackers have been accessing the Vevo system, how they managed to gain access to its server, or whether they have held on other additional information, like financial, emails, and passwords.

Vevo has confirmed the security incident, saying the company "can confirm that Vevo experienced a data breach as a result of a phishing scam via Linkedin. We have addressed the issue and are investigating the extent of exposure."

The company also confirmed the breach had not impacted the security of its United Kingdom office.

OurMine is the same group of hackers who are known for hacking high-profile figures and companies, including Facebook CEO Mark Zuckerberg, Google CEO Sundar Pichai, Twitter CEO Jack Dorsey, Game of Thrones, Sony's PlayStation Network (PSN), Netflix, the WWE, HBO, and the most recently WikiLeaks.

OurMine is a Saudi Arabian group of self-proclaimed white hat hackers which markets itself by taking over sites and social media accounts of high-profile targets and then encourages them to contact them to buy their IT security service in an effort to protect themselves from future cyber attacks.

Wang Wei

Security Researcher and Consultant for the government, Financial Securities and Banks. Enthusiast, Malware Analyst, Penetration Tester.

Read More

Malware Attacks via Bluetooth

New Bluetooth Malware Affects Billions of Devices, Requires No Pairing

A new malware attack, dubbed BlueBorne, is spreading in the wild, thanks to a combination of eight different vulnerabilities affecting Android, iOS, IoT devices, Windows, and Linux. The security research firm Armis writes:

BlueBorne allows attackers to take control of devices, access corporate data and networks, penetrate secure “air-gapped” networks, and spread malware laterally to adjacent devices. Armis reported these vulnerabilities to the responsible actors, and is working with them as patches are being identified and released.

What sets BlueBorne apart from other malware is that the infected device doesn’t have to pair with your hardware to infect it. Pairing is fundamental to the use of Bluetooth. Some devices have a code you have to enter to pair them; some pair automatically if in range and set to the appropriate mode. But you can’t typically exchange data with a Bluetooth device if you aren’t paired with it — at least, not in theory. The problem is, even after Bluetooth devices have paired to one product, they continue sending out signals to locate other devices in the area.

The problem is so widespread because most Bluetooth implementations follow one of two approaches. Either they implement the protocol in an identical manner, which means a vulnerability on Windows can also affect Android, or they take too much leeway in certain areas of the protocol, exposing their specific products to security flaws. Stack up identical implementations and room for security flaws in the same protocol and you get a situation where a combination of vulnerabilities can be used to wreck everyone’s BT implementation for one reason or another.

Currently, all Windows devices running Vista or later, all Linux devices running BlueZ or Tizen 3.3-rc1, all Android devices, and all versions of iOS running iOS 9.x or earlier are affected. iOS 10 and later devices from Apple are not affected. Google has pushed out a solution, but only for Nougat and Marshmallow. Earlier versions of Android will reportedly not be patched.

How it Works

BlueBorne works by locating active Bluetooth devices (even if not in ‘Discover’ mode), and obtains the MAC address of the target device. It then probes it to determine what OS is running and adjusts its attack accordingly. It can create a man-in-the-middle attack or even take control of the device to further self-distribute to other Bluetooth hardware..

Read More

Bitcoin Price

Blame China? Bitcoin Price Seeks Bottom Below $3,000.

he bitcoin-US dollar exchange rate (BTC/USD) is in freefall after Chinese bitcoin exchange ViaBTC became the second exchange to shut down domestic trading amid news more announcements are forthcoming.

As per CoinMarketCap, the bitcoin price has lost more than 20% of its value in the last 24 hours.

Week-on-week, the world's largest cryptocurrency is down 29%. On a monthly basis, BTC has lost 28%. Perhaps even more notably, the price of bitcoin has shed almost $1,000 over the last 48 hours.

For a time, it appeared that the oversold intraday technical conditions could yield a relief rally to $3,700 levels. However, the bulls continued to exit the market on fears other exchanges would close down their Chinese desks.

More announcements are now only likely to amplify fears and trigger further selling

Dollar Index and BTC/USD Comparison chart

The chart above shows the Dollar Index topped out in early January, around the time that bitcoin began its record rally in mid January.

By no means are we trying to suggest that bitcoin rally was the result of USD weakness, but the chart does suggest that the broad based USD sell-off could have amplified the bitcoin rally.

Forex market experts are calling for an interim bottom in the dollar index as the China reflation story is gathering pace again. The US also reported a higher inflation number on Thursday, which means the Fed could maintain its gradual pace of policy tightening.

Again, a strong US dollar does not mean bitcoin would continue to fall. However, it would certainly amplify the bearish move or make it difficult for the digital currency to revisit its yearly high of $5,000

Daily chart

4-hour chart

Weekly chart

• $3,027 - 61.8% Fibonacci retracement of the rally from the July low to September high
• $3,000 - June high
• $2,855 - 50% Fibonacci retracement of 2017 low - high
• $2,350 - support of the trend line sloping higher from the March low and the July low

View

• The oversold nature of the daily indicators suggests potential for a corrective rally to $3,300-$3,400
• The sell-off could be easily extended to $2,350 if Chinese exchanges continue to shut down BTC trading desks.
• A rally back to $5,000 would be easier said than done as the US dollar seems to have found a footing. Seasonality study shows, the greenback is usually strong in the third and fourth quarter.

Read More

Assalam o aliakum aaj hum Structure of HTML sumjhn gy aur dekhn How setup Web page Title,

Read More

2 What is HTML | notepad ++ How to save HTML file in Urdu/Hindi

Assalam o alikum Main hun Rao Shahzaib ajj se hun Web development k course k first phase HTML Hyper text Markup Language ko start kren gy, aur jane k HTML kia hai, which one software is best for start website developmenting ..
lets go...

Read More

What is Blue Whale Game ?

Blue Whale Game - Suicide Challenge hits UK, 'children as young as seven discover craze'

THE infamous Blue Whale Game is a monstrous online challenge that aims to goad vulnerable youngsters into taking their own lives. The vicious viral game is spreading online via social media accounts, and reports suggest it has come to UK schools and is being played by children as young as seven-years-old.

Blue Whale Game has purportedly arrived in the UK.

The twisted viral challenge, which encourages participants to kill themselves, appears to have hit UK schools.

According to one online security expert, schoolchildren as young as seven years-old have heard about the infamous Blue Whale Game.

The Blue Whale Game aims to push vulnerable youngsters into taking their own lives.

The suicide challenge has already been linked to some 130 deaths in Russia.

Earlier this summer, the parents of a 16-year-old in Georgia, USA blamed the Blue Whale Game for the death of their daughter.

“I start researching and start reading more about the game, what it’s asking. Then I start to put some of the pieces – how during the weekend she asked me to step on the roof of the house,” the mother

There are hundreds of posts related to the sick trend on social media.

The Blue Whale Game sees youngsters assigned one challenge a day for a 50-day stretch.

Tasks are dolled-out by an anonymous administrator and participants are required to submit photo evidence each day to prove the challenge was completed.

Blue Whale is so named because of the way whales will sometimes beach themselves and then die.

As the tasks become more extreme over the 50 day period, some group administrators have encouraged members to self-harm – with some scoring the shape of a whale into the skin on their forearm.

On the 50th day, group members are purportedly encourage to take their own lives.

Online child protection specialist Jonathan Taylor has told Sky News that children in Year 3 in the UK education system have heard about the infamous challenge.

"Last week I was in a primary school and a Year 3 pupil, a boy, asked me about it,” he said.

"I would not be speaking to primary school children about Blue Whale but they know about it. When I asked who else had heard about this you had 20 hands go up.

"The children are talking about Blue Whale.

"They may not know exactly what they are talking about but the curiosity of a child ... they may then go on to the internet to see what they can do."

The vast majority of reported fatalities have been reported in Russia, however incidents linked to the Blue Whale Game have also surfaced in Ukraine, Estonia, Kenya, Brazil and Argentina.

Read More

Best Hacking Tools Of 2017

Top 10 Best Free Hacking Tools Of 2017 For Windows, Mac OS X and Linux

Technology and hacking is a field that’s constantly changing. To go along with these changes, some hacking tools become better with time, some stay stagnant while at other times, a new tool might cause the good kind of chaos. Since the past few years, we have been releasing list of the top free hacking tools to keep you – our readers stay abreast with the latest and greatest in the genre. To follow up our best Hacking tools of 2016, below is the updated list for this year.

To add to our previous lists, we’ve also taken into consideration views and feedback of people across the worldwide web to tailor this year’s list. Therefore these tools make an appearance from a host of targeted areas such as Application Specific Scanners, Debuggers, Encryption Tools, Password Crackers, Port Scanners, etc.

How to hack Wi-Fi using your Android smartphone

On a side note, these tools do come bundled in with pentesting Linux distro’s such as Kali Linux or BackBox, therefore, installing an appropriate Linux hacking box might just make your life easier while using them – at the very least you’ll have up-to-date repositories. That being said, let’s dive in to the best hacking tools of 2017:

• Nmap (Network Mapper) | Best Hacking Tools Of 2017

Nmap is a well known and open source tool for hackers. This software is primarily used for security audits and network discovery.Literally, thousands of system admins all around the world will use nmap for network inventory, check for open ports, manage service upgrade schedules, and monitor host or service uptime. As a tool it makes use of raw IP packets in ways to determine the hosts available on the network, what services are these hosts providing information about, operating systems, type/version of filters/firewalls, etc. next time you see a hacker’s screen on the big screen, its most likely to be Nmap.

• Metasploit Penetration Testing Software | Best Hacking Tools Of 2017

This is one of the most popular pentesting framework around. Those unfamiliar with it can consider it as a ‘collection of hacking tools and frameworks’ – useful to carry out a range of tasks. Its the tool of choice for cyber-security professionals and ethical hackers. Metasploit is basically a computer security project that provides users with information regarding known security vulnerabilities which can be vital as well as help in creating penetration testing and IDS testing plans, strategies and methodologies for exploitation.

• John The Ripper | Best Hacking Tools Of 2017

This is one of the most popular password cracking tool most widely used to carry out dictionary attacks. John the Ripper takes text string samples (from a text file, referred to as a ‘wordlist’, containing popular and complex words found in a dictionary or real passwords cracked before), encrypting it in the same way as the password being cracked (including both the encryption algorithm and key), and comparing the output to the encrypted string. If nothing else, this tool wins the prize for the best name.

• THC Hydra | Best Hacking Tools Of 2017

THC Hydra usually works in unison with John the Ripper. This is also a popular password cracking tool which is backed by an active and experienced development team. Essentially THC Hydra is a fast and stable Network Login Hacking Tool that will use dictionary or brute-force attacks to try various password and login combinations against an log in page.

• OWASP Zed | Best Hacking Tools Of 2017

The Zed Attack Proxy (ZAP) is now one of the most popular OWASP projects. This tool is very efficient in terms of ease of use and its ability to find vulnerabilities in web applications. ZAP is a popular tool owing to the support it enjoys and thus makes it an excellent choice for those that work in the domain of cyber-security.  ZAP provides automated scanners as well as various tools that allow you the cyber pro to discover security vulnerabilities manually. Understanding and being able to master this tool would also be advantageous to your career as a penetration tester.

• Wireshark | Best Hacking Tools Of 2017

Wireshark to put it simply – captures data packets in real-time and then displays in a readable format (verbose). The tool (platform) has been highly developed and it includes filters, color-coding and other features that lets the user dig deep into network traffic and inspect individual packets. If you intend to follow pentesting or cyber-security as a career choice, then learning Wireshark is an absolute necessity.

• Aircrack-ng | Best Hacking Tools Of 2017

For those of you who need to penetrate and audit wireless networks, you’ve just found your new best friend.  The Aircrack suite of Wifi (Wireless) hacking tools are legendary because they are very effectively when used in the right hands. For those new to this wireless-specific hacking program, Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking hacking tool that can recover keys when sufficient data packets have been captured (in monitor mode). Aircrack-ng implements standard FMS attacks along with some optimizations like KoreK attacks, as well as the PTW attacks to make their attacks more potent.

• Maltego | Best Hacking Tools Of 2017

Finally we come across one tool that’s different from the pack. Maltego has been designed as a platform to deliver an overall view of cyber threats to the local working environment of an organization. One of the main reasons for Maltego’s popularity is its’s unique perspective in offering both network and resource based entities is the aggregation of information sourced throughout the web

• Cain and Abel Hacking Tool | Best Hacking Tools Of 2017

Usually abbreviated to just Cain – this is highly popular hacking tool that finds many mentions across tutorials. At its core, its a Windows password recovery tool with the ability to be used in a myriad of ways. For example, white and black hat hackers use Cain to recover (i.e. ‘crack’) many types of passwords using methods such as network packet sniffing and by using the tool to crack password hashes

• Nikto Website Vulnerability Scanner | Best Hacking Tools Of 2017

This is another highly preferred pentesting tool of choice. This is an open source scanner that is able to identify and detect vulnerabilities in web servers. The system searches against a database of over 6800 potentially dangerous files/ programs when scanning software stacks. Nikto, like other scanners out there, also scans for outdated (unpatched) versions of over 1300 servers, and version specific problems on over 275 servers.

Read More

Ethical Hacking

Here are the top 8 websites to learn ethical hacking

Everybody wants to learn hacking in today’s age. However, this is not an easy task until you have basic knowledge about computers and network security. For beginners to know, there are two types of Hacking Ethical (White Hat) and Unethical (Black Hat). Unethical hacking is considered illegal while ethical hacking may be regarded as legal.

We provide you with a list of websites that offers you white hat content. However, it is important to note that as a beginner to not perform any hacking & cracking tactics that breach any cyber law.

Hackaday

Hackaday is one of the top ranked sites that provide hacking news and all kinds of tutorials for hacking and networks. It also publishes several latest articles each day with detailed description about hardware and software hacks so that beginners and hackers are aware about it. Hackaday also has a YouTube channel where it posts projects and how-to videos. It provides users mixed content like hardware hacking, signals, computer networks and etc. This site is helpful not only for hackers but also for people who are in the field of Digital Forensics and Security Research.

Evilzone Forum

This hacking forum allows you see the discussion on hacking and cracking. However, you need to be a member on this site to check out queries and answers regarding ethical hacking. All you need to do is register to get your ID to get an answer for your queries there. The solution to your queries will be answered by professional hackers. The Remember not to ask simple hacking tricks, the community people here are very serious.

HackThisSite

HackThisSite.org, commonly referred to as HTS, is an online hacking and security website that gives you hacking news as well as hacking tutorials. It aims to provide users with a way to learn and practice basic and advanced “hacking” skills through a series of challenges, in a safe and legal environment.

Break The Security

The motive of the site is explained in its name. Break The Security provides all kind of hacking stuff such as hacking news, hacking attacks and hacking tutorials. It also has different kind of useful courses that can make you a certified hacker. This site is very helpful if you are looking to choose the security and field of hacking and cracking.

EC-Council – CEH Ethical Hacking Course

The International Council of Electronic Commerce Consultants (EC-Council) is a member-supported professional organization. The EC-Council is known primarily as a professional certification body. Its best-known certification is the Certified Ethical Hacker. CEH, which stands for Comprehensive Ethical Hacker provides complete ethical hacking and network security training courses to learn white hat hacking. You just have to select the hacking course package and join to get trained to become a professional ethical hacker. This site helps you to get all kinds of courses that make you a certified ethical hacker.

Hack In The Box

This is a popular website that provides security news and activities from the hacker underground. You can get huge hacking articles about Microsoft, Apple, Linux, Programming and much more. This site also has a forum community that allows users to discuss hacking tips.

SecTools

As the name suggests, SecTools means security tools. This site is devoted to provide significant tricks regarding network security that you could learn to fight against the network security threats. It also offers security tools with detailed description about it.

Read More