Showing posts with label exploit. Show all posts
Showing posts with label exploit. Show all posts

A Hacker's Tool Kit - Cybercrime is growing ever more pervasive—and costly.



Cybercrime is growing ever more pervasive—and costly. According to researcher Cybersecurity Ventures, the annual cost of cybercrime globally will rise from $3 trillion in 2015 to $6 trillion in 2021. Enabling this boom are thriving marketplaces online, where hackers sell tools and services to criminals. Virtually anything is available for the right price, points out Andrei Barysevich, director of advanced collection (“a fancy name for ‘spy,’ ” he says) at threat intelligence firm Recorded Future. A former consultant for the FBI’s cybercrime team in New York, Barysevich trawled the shadiest corners of the web to compile the cybercrime shopping list above, exclusively for Fortune. In the market for some basic malware? It’ll cost you as little as $1.
Graphic shows prices of cybercrime events




via fortune

Wi-Fi security may be cracked, and it's a very, very bad thing... Have we said that this is bad?



Wi-Fi, the wireless data transfer technology practically all of us use on a daily basis, is in trouble. 

The WPA2 security protocol, a widespread standard for Wi-Fi security that's used on nearly every Wi-Fi router, has apparently been cracked. 
The details on the security exploit, which is called KRACK, or Key Reinstallation Attacks, are to be released at 8am ET Monday on the site www.krackattacks.com.
But according to a new advisory by US-CERT, via Ars Technica, there are "several key management vulnerabilities" in WPA2, allowing for "decryption, packet replay, TCP connection hijacking, HTTP content injection." The worst part? These are "protocol-level issues," meaning that "most or all correct implementations of the standard will be affected."
We'll know more when the details about KRACK are released, but if it turns out that one can use this exploit in a fairly simple and reliable way, then this is one of the biggest online security threats ever.  
To see why, one has to go just a little bit back into the past. Wi-Fi used to be secured with a standard called WEP, which was found to be vulnerable to a multitude of attacks, many of which don't require the attacker to have physical access to the Wi-Fi equipment or even be connected to the network. Over time, tools that make these attacks simple have been developed, and now, if your Wi-Fi is protected by WEP, there's a choice of simple mobile and desktop apps that crack your password in seconds (no matter how long or complicated it is). 
Because of these issues, WEP was mostly replaced with WPA and, later, WPA2, which are far more secure. Though there were ways to crack a WPA2-protected Wi-Fi router, if your password was long and complicated enough, it made it a lot harder or nearly impossible to do. 
(For completeness' sake, one hacking tool, called Reaver, can crack WPA2-protected routers no matter the password, but it's fairly simple to protect your router — you simply have to turn off a feature called WPS.)
If this latest vulnerability is similar to the way WEP is vulnerable — and it looks like it is at the moment — then it won't matter how strong a password you chose. This would make hundreds of millions of routers out there, used by individuals and businesses alike, open to hackers. It would mean that, if you care about security, you should not use Wi-Fi at all until this is fixed. At the very least, you should use HTTPS connections whenever possible, and a good VPN might add another layer of security.
And fixes for these types of things don't come easy. Some routers will probably get a firmware update, but a lot of home users might not know how to apply it, or be aware that this is a threat. Again, going back to the time when WEP was cracked in 2001, it took years for ISPs to start shipping routers with WPA and WPA2 enabled as default, leaving many customers wide open to attacks.  
We'll know more after the announcement today; stay tuned for updates. 

Wi-Fi Technologies: Emerging Business Models

Consumer use of Wi-Fi is on a steep rise. With the coming 5G era, Wi-Fi's role as a core technology in service providers' network strategy will be further strengthened, but it will also face uncertainties as the use of unlicensed spectrums by mobile operators becomes more prevalent.
This industry report provides analysis of Wi-Fi technologies and emerging business models related to public Wi-Fi hotspot services.

Key Topics

• Consumer use of Wi-Fi and hotspot services 
• The entry of Wi-Fi-first mobile service providers and the potential impact on mobile operators' business 
• New Wi-Fi standards and the growing use of Wi-Fi technologies in mobile operators' HetNet network strategy 
• Global forecast of revenues from public Wi-Fi hotspot services targeting both consumers and business customers 

How to find any wifi password of your neighbor wifi password or your wifi connected password

Today i will show you how to find your connected wifi password with CMD??
If you forget your wifi password or you were connect your neighbor wifi and want to tell your friends or family just do many step under :
1/First Step Goto CMD ( Command Prompt ) (CTN + R and Type cmd)
2/Type this :
wmic
quit
netsh wlan show profiles ( this step it will show your all of wifi connected )
netsh wlan show profiles name-wifi (this step is to check your wifi connected )
netsh wlan show profiles name-wifi key=clear ( for finally step is to show your wifi connected password )
3 Finish ( you can connect this wifi to your another device......... )

5 Ways To Hack Into Your Neighbor’s Wifi Network

Hacking into your neighbor’s wifi network may be easier than you think—and, conversely, your neighbor may think it’s easy to hack into your network. Considering that the police are going to blame you for any activity which happens on your Internet connection, keeping wifi trespassers off your network is very important, so here are five ways to hack into a neighbor’s network that might be used against you.

Wifi Network Hack #1—The Open Network

In the early days of wifi, almost all networks were open networks—which meant any wireless device could connect to them. This was quite convenient, as no set up is required to connect to an open network so you could share your internet connection if required. Many routers even today come setup by default as open networks, so unless your neighbor has changed his settings, you may be able to immediately connect to his network. We might not want to hack into the neighbors internet, but sometimes it is there for the taking.
The only thing preventing someone from connecting to an open network is range—wifi routers typically have a range of only a few hundred feet (or less if too many walls are involved), so connecting to your neighbor’s network may be difficult in rural areas or some suburban areas when homes are far apart.
However, wifi hackers (sometimes called wardrivers) have long used directional antennas and signal amplifiers to overcome typical range limitations. Although a consumer laptop and a consumer wifi router have a maximum expected range of about 1,500 feet (500 meters), hackers can use special (but inexpensive) equipment to connect to networks up to 20 miles (30 kilometers) away. So even if you live in the wilds of Alaska, your neighbor might be able to hack your open wifi network.

Wifi Network Hack #2—Wireless Encryption Protocol (WEP)

When wifi routers first came out, manufacturers knew that some people would want security, so they added the Wireless Encryption Protocol (WEP) which was supposed to keep neighbors and other attackers out of your network. However, WEP was poorly designed and it turned out that anyone who could monitor your wireless communication for a few hours could break WEP.
Later, hackers discovered a way to send bad packets to your network that would make hacking WEP even faster—today, a hacker using a freeware program and a standard laptop can hack a WEP connection in two to five minutes.
WEP is still installed on the majority of routers, although it’s rarely enabled by default. On older routers, it may be the only security option. It’s better than an open connection, but it should not be considered actual security. (Use WPA2 instead if it’s available on your router.)

Wifi Network Hack #3—Wifi Protected Access (WPA) PINs

The replacement for WEP was WPA, which included several different protocols for extra flexibility. The two most commonly used protocols are WPA Pre-Shared Keys (PSK) and WPA push-button authentication. Both of these remain secure. However, a third protocol was the PIN method, where you would choose (or have chosen for you) a short number-only pin that you could enter into devices you wanted to connect to the network.
Hackers discovered they could brute-force the PIN—that is, they could simply try each combination one after another until they found the correct PIN for your network. The process might take from one minute to nearly an entire day, but eventually they’d get the right combination.
This is a perfect attack for a neighbor since he can run it for as long as it takes—he’s not going anywhere.
There’s no defense against the PIN attack except to make sure you disable PIN authentication on your wireless router. You can use the other WPA methods securely—but read the following section.

Wifi Network Hack #4—Weak WPA Pre-Shared Keys (PSKs)

Probably the most commonly-used wifi security method today, WPA-PSK (or WPA2-PSK) lets you enter a password on the Settings screen of your router and then enter that same password on your devices to allow them to securely connect to your wifi connection. This is easy and very secure—if you use a strong password.
Of course, if you’ve read the news lately, many people don’t use secure passwords. For example, one study found that nearly 50% of people used one of the top 100 passwords on a particular website—passwords like “password”, “password1”, “1234”, and so on. See these different ways obtain a WiFi password.
Known passwords and short passwords are called “weak passwords” in security research because they’re easy to break using the same brute-force method used against WPA PINS—basically an attacker keeps trying weak password after weak password until he finds your password.
Again, this is a perfect attack for a neighbor because he can use freeware software to run his computer 24/7 trying to break into your router. If you use a weak password, he will almost certainly succeed eventually.
The solution for this is simple: use a strong password—a password that’s is at least 8 characters, isn’t a word or name, and which includes some numbers or special characters. To allow me to use a strong password and not inconvenience guests, I have a sticky note on top of my router with my network password on it. This allows guests inside my home to simply walk up to the router and enter the password—but it prevents neighbors or anyone else from getting my password.

Wifi Network Hack #5—The Last Resort: Jamming

If you do everything right to secure your network, there’s nothing your neighbor can do to break your security—except convince you not to use it. Using a standard laptop or reprogrammable router, your neighbor can use a program that will jam your router any time you attempt to use a secure protocol. You won’t be able to tell that you’re being jammed, but you will notice that you either can’t connect to to your network any more or that it runs very slow.
If you stop using security and re-enable open networking, the jamming will stop, possibly leading you to believe that it’s your security that’s broken. In the mean time, your neighbor will be using your open wifi network.
The only defense against this is to have a radio communications expert diagnose your connection problem as jamming. Jamming—like all the hacks described here—is illegal, and if you demonstrate that you’re being jammed while a police officer watches, your neighbor will probably be fined. (Jail time for jamming is rare, but fines for jamming in the U.S. can be several hundred thousand dollars, making it one of the most expensive “minor” offenses.)

Conclusion

To improve your wireless network security, use WPA security with PSK and a strong password, or use WPA with push-button security. Remember to disable WEP and WPA-PIN, and if you have connection problems related to security, don’t take them at face value. Anything else may allow your neighbor to hack your wifi connection.

Update your iPhone to avoid being hacked over Wi-Fi


It’s only been five days since Apple’s last security update for iOS, when dozens of serious security vulnerabilities were patched.
As we mentioned last week, the recent iOS 10.3 and macOS 10.12.4 updates included numerous fixes dealing with “arbitrary code execution with kernel privileges”.
Any exploit that lets an external attacker tell the operating system kernel itself what to is a serious concern that ought to be patched as soon as possible – hesitation is not an option.
After all, it’s the kernel that’s responsible for managing security in the rest of the system.





Take this analogy with pinch of salt, but an exploit that gives a remote attacker regular user access is like planting a spy in the Naval corps with a Lieutenant’s rank.
If you can grab local administrator access, that’s like boosting yourself straight to Captain or Commodore; but if you can own the kernel (this is not a pun), you’ve landed among the senior Admiral staff, right at the top of the command structure.
So make sure you don’t miss the latest we-didn’t-quite-get-this-one-out-last-time update to iOS 10.3.1:
iOS 10.3.1

Released April 3, 2017

Wi-Fi

Available for: iPhone 5 and later, 
               iPad 4th generation and later, 
               iPod touch 6th generation and later

Impact:        An attacker within range may be able to 
               execute arbitrary code on the Wi-Fi chip

Description:   A stack buffer overflow was addressed 
               through improved input validation.

CVE-2017-6975: Gal Beniamini of Google Project Zero
This is rather different from the usual sort of attack – the main CPU, operating system and installed apps are left well alone.
Most network attacks rely on security holes at a much higher level, in software components such as databases, web servers, email clients, browsers and browser plugins.
So, attacking the Wi-Fi network card itself might seem like small beer.
After all, the attacks that won hundreds of thousands of dollars at the recent Pwn2Own competition went after the heart of the operating system itself, to give the intruders what you might call an “access all areas” pass.
Nevertheless, the CPU of an externally-facing device like a Wi-Fi card is a cunning place to mount an attack.
It’s a bit like being just outside the castle walls, on what most security-minded insiders would consider the wrong side of the moat and drawbridge.
But with a bit of cunning you may be able to position yourself where you can eavesdrop on every message coming in and out of the castle…
…all the while being ignored along with the many unimportant-looking peasants and hangers-on who’ll never have the privilege of entering the castle itself.
Better yet, once you’ve eavesdropped on what you wanted to hear, you’re already on the outside, so you don’t have to run the gauntlet of the guards to get back out to a place where you can pass your message on.

What to do?

As far as we know, this isn’t a zero-day because it was responsibly disclosed and patched before anyone else found out about it.
Cybercrooks have a vague idea of where to start looking now the bug that has been described, but there’s a huge gap between knowing that an exploitable bug exists and rediscovering it independently.
We applied the update as soon as Apple’s notification email arrived (the download was under 30MB), and we’re happy to assume that we’ve therefore beaten even the most enthusiatic crooks to the punch this time.
You can accelerate your own patch by manually visiting Settings | General | Software Update to force an upgrade, rather than waiting for your turn in Apple’s autoupdate queue.