Beware! New Picture Worm Hits Facebook Today

From last few months, Facebook has been widely targeted for scam and spreading malware, One of the those spreading worm I discovered recently was when I was chatting with my friend, The following message from the sudden appeared.

hehehI!!! lool http://tinyurl.com/Wooo-2841-jpg

From the above screenshot, you can clearly see that tinyurl has been used to shorten the URL, One more thing to note is that it's not an image file as image files end with .JPG extension then -jpg.

The above screenshot describes a more clear picture of what you are going to download along with the JPG file. The exe is basically a Zeus Trojan, Zeus is one of the most popular botnets used for stealing sensitive information such as passwords, credit card numbers. One of it's popular feature is an Anti VM and Anti Sandbox capability, Making it useless for testing it inside virtual environments. 

A scan at Virus total shows that only3/18 URL scanners were able to detect it as a malware site, Rest of them failed. 

Kindly spread the news by sharing it with your friends and people you know, So they should not fall for the malware.

Facebook Hacking: Remote File Inclusion Attack

Facebook being the world's largest social networking website has became the major target for the hackers, attackers and other malicious users. Facebook has hired the team world's leading security experts in order for them to improve their website's security. Moreover facebook also pays 500$ to any one who can identify any sort of vulnerability inside facebook.
The facebook security team has done a very great job in improving and taking facebook's security to the maximum level. However, the problem is that Facebook applications are not coded or monitored by facebook, and it's also not possible that facebook to monitor every single app for vulnerabilities. These facebook apps are mostly coded by common programmers who are not well aware of how a code is written securely. Which leaves facebook apps poured with common vulnerabilities like XSS ( CROSS SITE SCRIPTING), Clickjacking, Remote file inclusion etc.

Out of all of these web application vulnerabilities, Remote file inclusion is a very common web application attack which occurs because the application is not able to validate included files. According to imperva, 21% of the apps on facebook are vulnerable to remote file inclusion attack.

Here is how the attack is carried out:

Step 1 - The attacker creates a malicious jpg file, because the upload of PHP is mostly banned on webservers with user level privileges. Therefore the hacker renames a PHP shell to some thing like shell.php.jpg in order to upload it to the webserver.

Step 2 - Next the hacker exploits RFI vulnerability in order to reference malicious JPG, which paramtere is something like.

.php?page=url of your malicious image

Step 3 - Next the attacker takes control of the server by just going to the url of the JPG image.

Mitigation:

Imperva suggests a four step mitigation process which can be found inside the image below, However it includes the deployment of web application firewall, but what if some one is not using a WAF, However will he be protected.

Pokemon GO Andro

Pokemon GO Andro

                   Pokemon GO Android Game download.

Support details:

Version: 0.29.0 (2016070500)

arm 

Package: com.niantic labs.pokemongo

58.06 MB (60,876,068 bytes)

Min: Android 4.4 (Kitkat, API 19)

Target: Android 6.0 (Marshmallow, API 23)

nodpi

2580d2687af1ffaaec16ff3b48380f76

APK Notes:

There are malware APKs floating around but never on APK Mirror. This APK's MD5 checksum is2580d2687af1ffaaec16ff3b48380f76, which is the same as the one downloaded from the Play Store, so rest assured that it has not been modified in any way.

Click here to download

For official website click on pokemon

Ardamax keylogger

Ardamax Keylogger 4.0.1

Ardamax Keylogger is a keystroke recorder that captures user's activity and saves it to an encrypted log file. The log file can be viewed with the powerful Log Viewer. Use this tool to find out what is happening on your computer while you are away, maintain a backup of your typed data automatically or use it to monitor your kids. Also you can use it as a monitoring device for detecting unauthorised access. Logs can be automatically sent to your e-mail address, access to the keylogger is password protected. Besides, Ardamax Keylogger logs information about the Internet addresses the user has visited.
This invisible spy application is designed for 2000, XP, 2003, Vista, 7 and Windows 8.

Keylogger Features:

• Email log delivery - keylogger can send you recorded logs through e-mail delivery at set times - perfect for remote monitoring!
• FTP delivery - Ardamax Keylogger can upload recorded logs through FTP delivery.
• 
  
• Network delivery - sends recorded logs through via LAN.
• Clipboard logging - capture all text copied to the Windows Clipboard.
• Invisible mode makes it absolutely invisible to anyone. Ardamax Keylogger is not visible in the task bar, system tray, Windows 2000/XP/2003/Vista/Windows 7 Task Manager, process viewers (Process Explorer, WinTasks etc.), Start Menu and Windows Startup list.
• Visual surveillance - periodically makes screenshots and stores the compressed images to log.
• Chat monitoring - Ardamax Keylogger is designed to record and monitor both sides of a conversation in following chats:

• AIM
• Windows Live Messenger 2011
• ICQ 7
• Skype 4
• Yahoo Messenger 10
• Google Talk
• Miranda
• QiP 2010

• Security - allows you to protect program settings, Hidden Mode and Log file.
• Application monitoring - keylogger will record the application that was in use that received the keystroke!
• Time/Date tracking - it allows you to pinpoint the exact time a window received a keystroke!
• Powerful Log Viewer - you can view and save the log as a HTML page or plain text with keylogger Log Viewer.
• Small size – Ardamax Keylogger is several times smaller than other programs with the same features. It has no additional modules and libraries, so its size is smaller and the performance is higher.
• Ardamax Keylogger fully supports Unicode characters which makes it possible to record keystrokes that include characters from Japanese, Chinese, Arabic and many other character sets.
• It records every keystroke. Captures passwords and all other invisible text.

Other Features:

• Windows 2000/2003/XP/Vista/Windows 7/Windows 8 support
• Monitors multi-user machines
• Automatic startup
• Friendly interface
• Easy to install

Click below to Download Ardamax Keylogger