Top News

no image
If your goal is to encrypt the transmitted data so that your Internet provider could not analyze it, then both Tor and your VPN, which you yourself set up , can come up with ! I would not recommend using any third-party VPNs, since their owner can see all the transmitted traffic + client IP (that is, your IP address). If you use a third-party VPN service, then you are guaranteed to get a spyware who, at a minimum, also knows your real IP address! If this is a paid VPN, then it is absolutely not suitable for anonymity, since the VPN service does not only know your IP and has access to all transmitted data, then it knows who you are by your payment details.
The self-configured OpenVPN allows you to encrypt the transmitted traffic and integrate your devices into a virtual private network. You can also hide your real IP address and bypass site blocking. But for anonymity, this option is not suitable, because for the operation of OpenVPN you need to rent a VPS, for which you have to pay. Although if you use cryptocurrency or other anonymous methods for payment, OpenVPN will help you to be anonymous.
Using a single proxy has the same disadvantages as a VPN: the eavesdropper + proxy service knows your real IP address. An additional drawback in the absence of encryption is that your ISP can still analyze your traffic and even block access to websites.
The situation with IP concealment improves if a proxy chain is used, because (depending on the settings), each next proxy knows the IP address of the previous node (always) and the IP address of 1 node before the previous one (sometimes). If we consider that traffic is not encrypted at any stage, and a certain part of public proxies is just honeypots (intended for the exploitation of users), then the proxy option is not the best way to ensure anonymity.

tor

There are several different components and products in the name of which is the word "Tor". To clearly understand what we're talking about, let's start by defining the terms.
Tor is a program that you can run on your computer to connect to the Tor network.
The Tor network is a multitude of volunteer computers that process web site requests and redirect the response to the Tor user.
The Tor browser is a complex of programs whose main components are: Tor + Firefox browser + plugins and settings to increase the level of anonymity.

What is Tor used for?


Tor can be used for various purposes:
  • data encryption so that it cannot be analyzed by an Internet service provider or by unauthorized persons on your local network or when using open networks (example of the “ Intercept and analyze traffic in open Wi-Fi ” attack ).
  • hiding your IP address from the final website
  • access blocked websites in your area





25 most important software weaknesses

There are many vulnerabilities that can affect security in our day to day. Many failures that make the software we use, network connections or the devices we use can be a threat. In this article we echo a list published by MITER that shows the 25 main software weaknesses that are the cause of the serious vulnerabilities that can affect our security. Let's talk about it.



There are many errors that can affect the programs we use, the tools that our devices have. It is something that is present in our day to day. However, there are times when these vulnerabilities may represent a more important threat.

MITER , an American company dedicated to systems engineering, research and development, has released a list of the 25 most important software vulnerabilities. They indicate that these errors can be easily exploited and, ultimately, be used by a possible attacker to have control of a system.

Due to these vulnerabilities that are considered important, an attacker could steal confidential data, make the proper functioning of certain software impossible, or cause various attacks.

The main objective of MITRE in making this list public is that software developers have it as a guide to control these vulnerabilities . This way they can create more secure software that does not put the security of users at risk, or at least reduce it as much as possible.

Keep in mind that these 25 vulnerabilities are not the result of chance or what they believe. To reach this conclusion they have applied a formula that uses different scores to give a final assessment to each one. In this way they can draw up the definitive list with which they can have a higher level of prevalence and also represent a greater danger.

To create this list have been based on vulnerabilities around the world. They have given a denomination to each of them and together with each one they have put the valuation, the CVSS score, which is what allows to know which are the most dangerous and, in short, with which the developers have to be more careful.


Main vulnerabilities according to MITER

If we start with the top 5 we can say that the most important vulnerability for MITRE and the one with the highest CVSS score is the incorrect restriction of operations within the limits of a memory buffer . He has been assigned the name of CWE-119 and has a score of 75.56.

The second is the inappropriate neutralization of the input during the generation of the website . It has a rating of 45.69 and has been referred to as CWE-79.

The following are, respectively, the incorrect input validation , which has qualified it with a score of 43.61 and has called it CWE-20; the exposure of information , called CWE-200 and a score of 32.12 and, closing the top 5, the vulnerability CWE-125 called reading out of bounds and with a score of 26.53.
These are the five main vulnerabilities according to MITER. However, in total they have released a list with 25. The remaining 20 are the ones mentioned below:
  • CWE-89 Incorrect neutralization of special elements used in an SQL command ("SQL Injection") 24,54
  • CWE-416 Use after free version 17.94
  • CWE-190 Entire Overflow 17,35
  • CWE-352 cross-site request forgery 15.54
  • CWE-22 Incorrect limitation of a path name to a restricted directory 14.10
  • CWE-78 Incorrect neutralization of special elements used in an operating system command 11,47
  • CWE-787 Writing out of bounds 11.08
  • CWE-287 Incorrect authentication 10.78
  • CWE-476 No cursor reference 9.74
  • CWE-732 Incorrect permission assignment for critical resource 6.33
  • CWE-434 Unrestricted upload of files of dangerous type 5.50
  • CWE-611 Incorrect XML restriction External entity reference 5.48
  • CWE-94 Improper control of code generation ("Code injection") 5.36
  • CWE-798 Use of coded credentials 5.12
  • CWE-400 Consumption of uncontrolled resources 5.04
  • CWE-772 Resource release is lacking after life 5.04
  • CWE-426 Unreliable search path 4.40
  • CWE-502 Deserialization of unreliable data 4.30
  • CWE-269 Inadequate privilege management 4.23
  • CWE-295 Incorrect validation of certificate 4.06


Two analysts threats recently hit a new Linux malware that conceals its cryptocurrency mining operations.

On 16 September, Augusto Remillano II and Jakub Urbanec revealed in a news post on Trend Micro, a security intelligence blog, they have discovered a new malware. According to analysts, this malware is particularly notable for the way it loads malicious kernel modules to mask its mining operations of crypto-time data.

Malware provides full access hackers to the infected machine




Analysts have found that Skidmap hid his cryptocurrency extraction using a rootkit, a program that installs and executes code on a system without the consent or knowledge of the end user. This makes its malicious components undetectable by infected system monitoring tools.

In addition to launching a crypto-piracy campaign on the infected machine, the malware would give attackers a "unfettered access" to the affected system. Analysts add:


"Skidmap aussi olefins has a backdoor way to get access to the engine and replaces the file system aussi pam_unix.so by His Own malicious release. This malicious file Accepts a specific password for all users, Allowing attackers to log in As Any use of the machine. "

cryptojacking campaigns up 29%

Cryptojacking is a term used in the industry to designate crypto-exploration stealth attacks which consist of malicious software or any other way to computer processing power to operate without the consent or cryptomoney the knowledge of the owner.

In August, the McAfee Labs cybersecurity company released a report on threats in the first quarter of 2019. According to the report, the cryptojacking would have increased, with an increase of 29% cryptojacking campaigns.

.

Vulnerability in SIM-cards, how to protect against Simjacker



The vulnerability of Simjacker can spread to more than 1 billion mobile phone users worldwide.
A new and previously unrecognized critical vulnerability has been discovered in SIM cards, which could allow remote attackers to compromise targeted mobile phones and spy on victims simply by sending an SMS message.
This vulnerability, dubbed “SimJacker,” is located in certain software called S @ T Browser (a dynamic toolkit for SIM cards) embedded in most SIM cards that is widely used by mobile operators in at least 30 countries and can be used no matter what phones the victims use.
Well, what's wrong with that? A special private company that works with governments has been actively exploiting the SimJacker vulnerability for at least the past two years to conduct targeted monitoring of mobile phone users in several countries.
S @ T Browser, short for SIMalliance Toolbox Browser, is an application that installs on various SIM cards, including eSIM, as part of the SIM Tool Kit (STK) and is designed to enable mobile operators to provide some basic services, subscriptions, and additional wireless services for its customers.

Because the S @ T Browser contains a number of STK instructions — such as sending a short message, setting up a call, launching a browser, providing local data, launching on command, and sending data — that can be caused by simply sending an SMS message to the device, the software offers a runtime environment to run malicious commands on mobile phones.

How does the Simjacker Vulnerability work?


Discovered by researchers from AdaptiveMobile Security in a new study published on September 12, 1919, the vulnerability can be exploited using a GSM modem for $ 10 to perform several tasks listed below on a target device by simply sending an SMS message containing a certain type of spy code .
  • Retrieving the location of the target device and IMEI information,
  • Spreading false information by sending fake messages on behalf of the victims,
  • Performing premium rate fraud by dialing premium rate numbers,
  • Spy on the surroundings of victims by ordering the device to call the attacker’s phone number,
  • The spread of malware, forcing the victim’s phone browser to open a malicious web page,
  • Perform denial of service attacks by disconnecting the SIM card and
  • Getting other information, such as language, type of radio, battery level, etc.

  • During the attack, the user is completely unaware that he received the attack, that the information was extracted and that it was successfully deleted,” the researchers explain.


    This attack is also unique in that the Simjacker attack message can be logically classified as carrying full malware load, especially spyware. This is because it contains a list of instructions that the SIM card must follow. Simjacker is the first real attack in which spyware is sent directly to SMS.
    Although technical details, a detailed document and proof of concept of the vulnerability are planned to be published in October this year, the researchers said they observed real attacks on users with devices from almost all manufacturers, including Apple, ZTE, Motorola, Samsung, Google, Huawei and even IoT with SIM cards.
    It turns out that all manufacturers and models of mobile phones are vulnerable to SimJacker attacks, since this vulnerability uses outdated technology built into SIM cards, the specification of which has not been updated since 2009, which potentially puts more than a billion people at risk.

    Simjacker Wildlife Vulnerability

    Researchers say that the Simjacker attack worked very well and has been used successfully for many years, "because it used a combination of sophisticated interfaces and obscure technologies, showing that mobile operators cannot rely on standard installed security features."

    Simjacker is a clear danger to mobile operators and subscribers. This is potentially the most sophisticated attack that has ever existed on major mobile networks. ”
    said Ketal MacDade, CTO at AdaptiveMobile Security, in a press release.





    “This is the main alarm signal that shows that hostile actors are investing heavily in increasingly sophisticated and creative ways to undermine network security.” This threatens the security and trust of customers, mobile operators and affects the national security of entire countries. "

    Moreover, now that this vulnerability has been publicly disclosed, researchers expect hackers and other attackers to "develop these attacks in other areas."

    Researchers have responsibly revealed the details of this vulnerability of the GSM Association, a trading organization representing the community of mobile operators, as well as the SIM alliance, representing the major manufacturers of SIM cards / UICC.

    SIMalliance acknowledged the issue and provided recommendations for security SIM card manufacturers for S @ T push messages.

    Mobile operators can also immediately eliminate this threat by setting up the process of analyzing and blocking suspicious messages containing S @ T browser commands.
    We, as a potential victim, as a user of a mobile device, can do nothing if we use a SIM card with S @ T Browser technology deployed on it, except for a request to replace our SIM card on which patented security mechanisms are installed.
    More information about Simjacker can be found at www.simjacker.com, and Katal MacDade, CTO of AdaptiveMobile Security, will introduce Simjacker at the Virus Bulletin Conference, London, October 3, 2019.
    What's more pleasant when you change distribution to have available his configuration files carefully preserved?

    When you spend time tweaking the configuration of the display server or its favourite text editor, the idea of ​​losing these famous files gives cold sweats.

    Only when we want to make a backup of these files we must do everything by hand and especially we always tend to forget some.
    This for this reason that I tinkered a little script Bash that collects your conf files and makes a nice tar.bz2 archive ready to be copied away from crashes.
    You can download the script in question here: saveconfig.sh
    This script is very easily customisation. It is divided into two sections: the first contains the commands (the script itself) and the second part is a list of files to save.
    You can add filenames as well as directories. In all cases we must give the full path from the root (/). If you indicate a directory, all its content will be copied ... so think about what you add! It may be best to give filenames belonging to the same directory rather than giving the entire directory (I am thinking in particular of the hidden directories used by browsers which contain the cache of your navigation).

    Launched as a lambda user, saveconfig.sh saves the system configuration files (in / etc, / usr ...).
    Launched in root, the script will additionally record the configuration of each "human" user (whose uid is greater than or equal to 500)
    User configuration files must be indicated using the keyword _USER_ which will be replaced when using the script by the home directory of this user (nothing very complicated, you will easily understand by looking at the list of files by default).

    Small note: saveconfig.sh does not keep the file permissions in memory ... but it is easily modifiable by modifying the arguments passed to tar and cp.
    The script needs bash, awk, tar and bzip2 to work.

    4 operating systems to turn your computer into a NAS server

    There are currently a large number of NAS server manufacturers, such as ASUSTOR, QNAP, Synology or Thecus among others, however, you may have a computer that you want to convert into a NAS server, with the aim of reusing it to give you a second life and act like a true NAS server. Do you want to know what operating systems exist to turn your computer into a complete and advanced NAS server?

    FreeNAS: one of the most advanced operating systems for NAS based on FreeBSD

    FreeNAS is an operating system based on FreeBSD, it is one of the most advanced, although it is not difficult to install and manage. FreeNAS is compatible with the ZFS file system, one of the most advanced currently, and that is that ZFS incorporates native features such as Snapshots to protect all information from possible ransomwares, allows great file integrity, and we will not need any type of driver RAID, since it incorporates the possibility of configuring RAID-Z of different levels. Once you test how ZFS works, you are unlikely to use a different file system to store all your information.





    Other features of FreeNAS are that it incorporates a large number of services installed by default, such as SMB / CIFS, FTP, AFP, iSCSI and many more, since it will allow us to install additional software as a plugin, so that we can easily install a BitTorrent client such as Transmission, Plex Media Server, and many more. It will also allow us to perform advanced backups, replication of data in another FreeNAS, and even encrypt the entire contents of hard drives with AES-XTS, which can be accelerated if your CPU is compatible with AES-NI.
    Finally, the graphical user interface of the latest versions of FreeNAS is really well maintained, with very well designed graphics, a very intuitive interface, and really fast, ideal for managing the FreeNAS efficiently.
    We recommend you visit the official FreeNAS website where you will find all the information about this operating system.


    XigmaNAS (formerly known as NAS4Free): based on FreeBSD


    XigmaNAS was formerly known as NAS4Free, but the developers changed the name of the project. XigmaNAS is also based on the FreeBSD operating system, just as FreeNAS does. This operating system can be installed on any platform that supports x64 architecture, and that has at least 2GB of RAM.
    This operating system supports most file sharing protocols such as CIFS / SMB, FTP, FTPES, NFS, AFP, and many others such as Rsync, iSCSI and more. The operating system allows you to use the ZFS file system, although it also supports software RAID, in addition, it has the ability to encrypt entire disks to protect private information. XigmaNAS can be installed on a micro SD card, flash drive or on an SSD / HDD without problems.

    XigmaNAS also allows us to install additional software, specifically all the software from the FreeBSD repositories, and we can even virtualize operating systems inside, since it has an integrated Virtual Box, that is, if you want or need to use Windows or Linux to perform some task, you will be able to install it virtualize it without problems.

    Finally, as for the graphical user interface, in our opinion it is quite simple, much simpler than that of FreeNAS. However, this graphic interface is functional and is really fast, although its design is quite old since it has been years without having a full face wash.

    We recommend you visit the official website of XigmaNAS where you will find all the information about this operating system.

    OpenMediaVault (OMV): based on Debian


    OpenMediaVault is the favorite NAS server-oriented operating system for Debian lovers, as this OMV is based on the popular Debian distribution, so you will feel at home if you have used it before.

    OpenMediaVault incorporates a graphical user interface via the web that will allow us to configure in an advanced way the main network services, such as Samba, FTP, FTPES, SSH, SFTP, Rsync and much more, and we will also have a BitTorrent client and we will even have the possibility of installing additional software, of course, software downloaded directly from Debian repositories, so the possibilities are almost unlimited.


    OpenMediaVault does not have ZFS, but it does incorporate the possibility of configuring a RAID via software. If you think you don't need all the benefits of ZFS, this operating system is a very good option to reuse your computer and turn it into a NAS server. In addition, it is compatible with Raspberry Pi and other boards, since it supports ARM architecture.
    We recommend you visit the official OpenMediaVault website where you will find all the information about this operating system.

    XPEnology: Synology's operating system on any computer

    XPEnology is a bootloader that will allow us to boot the Synology operating system (DiskStation Manager or also known as DSM), in such a way that we will have the Synology NAS operating system, in a normal and current computer, without using your hardware


    The features of DSM using XPEnology are exactly the same as on a NAS server, we recommend you access the official XPEnology website where you will find all the information on how to download this bootloader, how to install it, how to run DSM and much more.


    When we talk about Kali Linux, we mean one of the most important and best known ethical hacking suits worldwide. It offers a wide range of possibilities to users and that makes each new version make many are attentive to their news. In this article we echo thenews of Kali Linux 2019.3, as well as explain how we can download this Linux distribution.


    As often happens with each new update, whatever the type of program or system, they bring improvements. These improvements translate into new functions or tools that make the day-to-day life of users benefit. But you also have to keep in mind that with each new version, present problems are corrected.

    Kali Linux allows users to perform different ethical hacking tests. Now they have a series of novelties that make this Linux distribution even more attractive. We are facing the third update of this current version. We will comment on the most important changes.

    What's new in Kali Linux 2019.3

    One of the novelties of Kali Linux 2019.3 that we can mention is that they have started usingCloudflare CDN to host the repository and distribute content to users. This they do to improve the quality and speed of downloads.


    There are also changes regardingmetapackages. Now there is an additional and unique image called kali-linux-large-2019.3-amd64.iso.

    Kali Linux 2019.3 is not a great update that brings very significant changes, however ithas improved certain applications. For example we talk about tools like Burp Suite, HostAPd-WPE, Hyperion, Kismet andNmap. All of them have been updated to a new version and have included improvements.

    One of the significant changes in relation to applications is that it now includesAmass. It is a tool that security professionals can use to map the network and discover possible external threats. Now this tool comes standard with Kali Linux.

    For the rest, it should also be mentioned that improvements have been made in terms of failures and security errors. Corrections that, in short, make this new version safer.




    How to get Kali Linux 2019.3

    It should be mentioned that for those users who already have this distribution installed and have it updated they will not have much to do. They would simply have to run the root @ kali command: ~ # apt update && apt-and full-upgrade to make sure they have the most current version.
    For those users who do not have it installed or want to obtain the ISO for some reason, it is best to go to the official website . There you just have to go to the download section and download the version you want (64 bits, 32 bits ...).

    As we always say, it is important to download software from official and reliable sites. We must avoid doing it from third-party links that we don't really know who it belongs to and what could be behind it.
    In addition, having updated systems can bring important benefits. On the one hand we will have the most updated tools and thus obtain improvements in performance. However, security is also very important. Security vulnerabilities are corrected with each new update . Faults that can be exploited by cyber criminals and that have been patched.