Tuesday, 9 June 2020

How To Pass Your Online Accounts After Death – 3 Methods

The topic of DEATH is not one that most people care to talk about, but the truth is that we are all going to die at some point and everything that we did online is going to end up in limbo if we don't make sure that someone we trust is going to be able to gain access to this information. This is going to be extremely important in order to close it down, or have your loved one do whatever you want them to do with your information. There are many things to take into consideration for this kind of situation. If you are like the average modern person, you probably have at least one email account, a couple of social media accounts in places like Facebook and Twitter. Perhaps you also have a website that you run or a blog. These are all very common things that people will usually do at some point and if you have anything that you consider valuable, you should have a way to leave it in the hands of someone you trust when you pass away.

Pass Accounts and Passwords After Death
Pass Accounts and Passwords After Death

Maybe you have an online platform that has a lot of content that you find useful and important. Perhaps you have even been able to turn some of that content into monetizable material and you don't want this to end when you pass away. This is more than enough of a reason to make sure that your information can be given to someone when you are no longer around.
There have been many cases when all the information has ended up being impossible to recover when a person has died, at least not without the need for the family members to do all kinds of things in order to prove a person is deceased. So here are some ways, you can passyour online accounts/data after death:

1) Making a Safe 'WILL' (or Locker) containing master password.

  1. Make an inventory of all your online accounts and list them on a piece of paper one by one and give it to your loved one. For eg:– Your primary email address
    – Your Facebook ID/email
    – The Bank account or Internet banking ID
    – etc. To clarify, it will be only a list of the accounts you want your loved one to be able to access after you're dead. Just the list of accounts, nothing else (no passwords).
  2. Set up a brand new e-mail address (Possibly Gmail account). Lets say youraccountsinfo@gmail.com
  3. Now from your usual email account, Send an e-mail to youraccountsinfo@gmail.com, with the following content:– dd349r4yt9dfj
    – sd456pu3t9p4
    – s2398sds4938523540
    – djfsf4p These are, of course, the passwords and account numbers that you want your loved one to have once you're dead.
  4. Tell your loved one that you did these things, and while you're at it, send him/her an e-mail from youraccountsinfo@gmail.com, so he/she will have the address handy in some special folder in his/her inbox.
  5. Put the password for youraccountsinfo@gmail.com in your will or write it down on paper and keep it safe in your bank locker. Don't include the e-mail address as well, just put something like "The password is: loveyourhoney432d".
And its done! Your loved one will only have the password once you're dead, and the info is also secure, since it's split in two places that cannot be easily connected, so if the e-mail address happens to be hacked, the perpetrator won't be able to use it to steal anything that you're going to leave for your loved one.

2) Preparing a Future email (SWITCH) containing login information

This method is very similar to the first one except in this case we will not be using a WILL or Locker. Instead we will be using a Service called "Dead Mans Switch" that creates a switch (Future email) and sends it to your recipients after a particular time interval. Here is how it works.
  1. Create a list of accounts as discussed in the first method and give it to your loved one.
  2. Register on "Dead mans switch" and create a switch containing all the corresponding passwords and enter the recipients email (Your loved one).
  3. Your switch will email you every so often, asking you to show that you are fine by clicking a link. If something happens to you, your switch would then send the email you wrote to the recipient you specified. Sort of an "electronic will", one could say.

3) Using password managers that have emergency access feature

Password managers like LastPass and Dashlane have a feature called as "emergency access".  It functions as a dead man's switch. You just have to add your loved one to your password manager, with emergency access rights. he/She does not see any of your information, nor can he/she log into your accounts normally.
But if the worst happens, your loved one can invoke the emergency access option. Next your password manager sends an email to you and starts a timer. If, after a certain amount of time interval, you have not refused the request, then your loved one gets full access to your password manager.
You can always decide what they can potentially gain access to, and you set the time delay.

Why should i bother about passing my digital legacy?

Of all the major online platforms, only Google and Facebook have provisions for Inactiveaccounts (in case of death). Google lets you plan for the inevitable ahead of time. Using the "Inactive Account Manager", you can designate a beneficiary who will inherit access to any or all of your Google accounts after a specified period of inactivity (the default is 3 months).
Facebook on the other hand will either delete your inactive account or turn it into a memorial page when their family can provide any proof of their death, but there is also a large number of platforms that don't have any specific way for people to be able to verify the death of a loved one in order to gain access to the accounts. In either case, you wouldn't want your family to have to suffer through any hassles and complications after you have passed away.
You should also consider the importance of being able to allow your loved ones to collect all the data you left behind. This means photos and experiences that can be used to show other generations the way that you lived and the kind of things you enjoyed doing.
Those memories are now easier to keep and the best photos can be downloaded for the purpose of printing them for photo albums or frames. Allowing them to have the chance to do this in a practical way is going to be a great gesture and securing any profitable information is going to be essential if you want a business or idea to keep moving forward with the help of those you trust.
This is the reason why you need to be able to pass your online account information after death, but no one wants to give access to this kind of information to their loved ones because it's of a private nature and we would feel uneasy knowing that others can access our private conversations or message.
Related articles
  1. Pentest Firewall
  2. Hacking With Raspberry Pi
  3. How To Pentest A Network
  4. Pentest With Kali
  5. Pentesterlab
  6. Pentest +
  7. Hackerrank
  8. Pentest Standard
  9. Pentest Vs Ceh
  10. Hacking Names
  11. Hacking Hardware

Monday, 8 June 2020

La Base De Datos De WhatsApp En iPhone Sigue Sin Cifrar, Y Estamos En 2020

Durante muchos años y posts, he escrito recopilando las técnicas que existen para Espiar WhatsApp, y cómo se debe Fortificar WhatsApp a Prueba de Balas. Hemos ido viendo las evoluciones de seguridad de WhatsApp cambiando versión a versión, pero hay una en concreto que en iPhone, sigue siendo una debilidad que Facebook no ha arreglado con el paso de los años.

Figura 1: La base de datos de WhatsApp en iPhone sigue sin cifrar, y estamos en 2020

La característica a la que me refiero, que Facebook no ha arreglado con el paso de los años, tiene que ver con el cifrado de la base de datos de mensajes de chats de WhatsApp en iPhone, donde nos encontramos con que aún, en el año 2020, después de un número ingente de ataques a la privacidad de las personas, sigue sin cifrar. 

Figura 2: Libro de Hacking iOS: iPhone & iPad 2ª Edición

Estas debilidades en iPhone, son las que hemos ido utilizando a lo largo de los años para Hackear iOS: iPhone & iPad, y ésta de hoy es una que debería arreglar WhatsApp y tú deberías tener en cuenta. Las tres partes que recogen la fortificación de WhatsApp que os he recogido las tienes aquí:


Por supuesto, que un atacante llegue a la base de datos de mensajes de los chats de Whatsapp exige que antes hayan caído otras medidas de seguridad de tu dispositivo, pero no tiene sentido dejar una puerta abierta a un atacante, porque al final, la seguridad de tu WhatsApp queda en manos de otras medidas de seguridad y no aplica los principios de Defensa en Profundidad de cualquier proceso de fortificación de tecnología. Hace ya muchos años, en el año 2015, di una charla que se titulé Tu iPhone es tan (in)Seguro como tu Windows, donde hablaba de cómo la seguridad de tu smartphone - y por ende tu WhatsApp - puede depender del equipo Windows al que te pareas.


Figura 3: Tu iPhone es tan (in)seguro como tu Windows

Para que veas como funciona esto, puedes hacer una prueba muy sencilla con tu terminal iPhone. Basta con que te bajes una aplicación para gestionar tus ficheros de iPhone. En este caso iMazing que hace el trabajo de conectarse a tu iPhone si estás en un equipo en el que hayas confiado. Como se puede ver, cuando conectas un iPhone a tu MacOS o tu Windows para extraer fotos, hacer backup, etcétera, estás dando acceso a tu terminal iPhone a todo programa que corra con privilegios en tu Windows o Mac.

Figura 4: iMazing te extrae todos los ficheros haciendo un backup sin cifrar

Esos programas, antiguamente, se conectaban al sistema de ficheros de tu iPhone o iPad, pero Apple fortifico esta característica, y ya no es posible. La sandbox de aplicaciones es buena, y no se puede meter  mucha mano a las apps tal y como se hacía antes, con programas como iFunBox, pero... ¿quiere decir que esto no se puede hacer?

Figura 5: Acceder a la SandBox de la app de WhatsApp ya no se puede directamente 

Pues no, lo que hacen aplicaciones como iMazing es aprovecharse del pareado de tu equipo de confianza para hacer un backup SIN CIFRAR de tu iPhone al equipo pareado. Es decir, fuerzan una copia de seguridad desde el equipo MacOS o Windows al que conectas tu iPhone y extrae todos los ficheros sin cifrar de tu iPhone para dejarlos en el disco duro del equipo. Y entre ellos tu base de datos de WhatsApp.

Figura 6: Ficheros de iOS copiados al Mac

Así que, desde cualquier equipo pareado en el que confíe tu iPhone se puede extraer todo el sistema de ficheros de iPhone sin cifrar. Una vez que se realice ese backup sin cifrar, tendremos en el disco duro del ordenador la base de datos de WhatsApp, que como he dicho al principio, está sin cifrar también. Encontrar el fichero, es bastante sencillo, ya que es un hash y se puede localizar navegando conocido que se genera a partir de la ubicación del fichero dentro del sistema de archivos de iOS, y ya se puede navegar fácilmente por los backups desde tu MacOS.

Figura 7: Con estos tres ingredientes, tenemos todo

Así que, una vez localizado ese fichero, y sabiendo que ese fichero, llamado ChatStorage.sqlite, es un almacén de base de datos SQLite, lo único que tiene que hacer cualquiera es usar un visor de ficheros SQLite y abrirlo. 

Figura 8: En las tablas de la base de datos están los mensajes

Una vez que abras ese fichero, podrás ver que los mensajes de tus chats de WhatsApp están en texto plano y se pueden ver los mensajes que has enviado y recibido en cada uno de los chats.

Figura 9: Y toda la base de datos de contactos

Lo que quiere decir que la seguridad de tu WhatsApp depende de la seguridad de tu iPhone y, en este ejemplo concreto, de la seguridad de tu Windows, tal y como en el mundo del cibercrimen, de los APTs y de la privacidad personal, hemos visto durante los últimos años.

¿Debería cifrar WhatsApp la base de datos de mensajes en el dispositivo?

Pues si seguimos los principios de fortificación de sistemas informáticos, que dependen de aplicar Mínimo Privilegio Posible, Mínima Superficie de Exposición y Defensa en Profundidad, mi opinión personal está clara: 

Debería haberlo hecho hace años.

Mientras tanto, debes tener un cuidado especial de a qué equipos conectas tu iPhone ya que, aunque tú hagas copias de seguridad cifrada, con programas con iMazing se pueden forzar las copias de seguridad sin cifrar y todos tus archivos - fotos ocultas incluidas - se irán para allá.

Saludos Malignos!

Autor: Chema Alonso (Contactar con Chema Alonso)

Related word
  1. Hacking Tutorials
  2. Hacker Language
  3. Pentest Vpn
  4. Pentest Xss
  5. Pentest Tools
  6. Pentestgeek
  7. Hacker Google
  8. Hacking With Linux
  9. Hacking The Art Of Exploitation

Top Process Related Commands In Linux Distributions


Commands in Linux are just the keys to explore and close the Linux. As you can do things manually by simple clicking over the programs just like windows to open an applications. But if you don't have any idea about commands of Linux and definitely you also don't know about the Linux terminal. You cannot explore Linux deeply. Because terminal is the brain of the Linux and you can do everything by using Linux terminal in any Linux distribution. So, if you wanna work over the Linux distro then you should know about the commands as well. In this blog you will exactly get the content about Linux processes commands which are are given below.

ps

The "ps" command is used in Linux to display your currently active processes over the Linux based system. It will give you all the detail of the processes which are active on the system.

ps aux|grep

The "ps aux|grep" command is used in Linux distributions to find all the process id of particular process like if you wanna know about all the process ids related to telnet process then you just have to type a simple command like "ps aux|grep 'telnet'". This command will give you the details about telnet processes.

pmap

The "pmap" command in Linux operating system will display the map of processes running over the memory in Linux based system.

top

The "top" command is used in Linux operating system to display all the running processes over the system's background. It will display all the processes with process id (pid) by which you can easily kill/end the process.

Kill pid

Basically the kill command is used to kill or end the process or processes by simply giving the process id to the kill command and it will end the process or processes. Just type kill and gave the particular process id or different process ids by putting the space in between all of them. kill 456 567 5673 etc.

killall proc

The "killall proc" is the command used in Linux operating system to kill all the processes named proc in the system. Killall command just require a parameter as name which is common in some of the processes in the system.

bg

The "bg" is the command used in Linux distributions to resume suspended jobs without bringing them to foreground.

fg

The "fg" command is used in Linux operating system to brings the most recent job to foreground. The fg command also requires parameters to do some actions like "fg n" n is as a parameter to fg command that brings job n to the foreground.Read more
  1. Hacking Health
  2. Pentest Companies
  3. Hacking To The Gate
  4. Pentest Methodology
  5. Pentestbox
  6. Pentest Bootcamp
  7. Pentest Plus
  8. Pentest With Kali Linux
  9. Hacking Jailbreak
  10. Hackerrank
  11. Hacking Google
  12. Pentest Book
  13. Pentest Questions
  14. Hacking Software
  15. Hacker Google
  16. Hacking Site
  17. Pentest Vpn
  18. Hacking Box
  19. Hacker0Ne
  20. Pentestgeek

Cómo Descargar Y Activar VídeoProc 4K "Licencia Gratis"

En el mundo del diseño y la edición podemos encontrar bastantes herramientas que nos faciliten de manera rápida composiciones increíbles sin acudir a programas potentes o pesados que nuestra computadora no puede soportar. En este corto artículo queremos recomendar un excelente software para la edición de vídeo, con exigencias mínimas para crear proyectos profesionales de forma dinámica.
Se trata de VideoProc un programa para la edición de Vídeo en 4K, un editor magnifico para aquellas personas que quieren iniciar en el mundo audiovisual, ya que su interfaz es completamente sencilla pudiendo ubicar las herramientas necesarias para lograr proyectos de calidad sin esfuerzo alguno. Te explicamos todas sus ventajas con relación a otros software de alto nivel o costosos.
https://www.dominatupc.com.co/
Si eres principiante y no cuenta con un programa para realizar sus proyectos, este post es su indicado y procesar en alta definición es la mejor alternativa sin acudir a programas como Adobe Premiere que podría no ser una opción para  personas aficionadas. Agregar efectos, cortar, rotar, combinar y renderizar en 4k manteniendo la misma calidad original, VideoProc te brinda estas posibilidades y más.
Es un programa ligero en procesamiento de vídeo que trae en conjunto con una suite de herramientas para convertir Audio/vídeo de DVD, una grabadora de vídeo y un descargador de contenido en línea. Es realmente un editor único, potente y liviano que para ser gratis es realmente una bomba, ya que funciona sin problemas hasta en computadoras con pocos recursos.

Características disponibles y ventajas sobre otro software

  • Puede hacer copia de seguridad de DVD/Imagen iSO CDR a MP4(H264,HEVC)
  • Puede cambiar formatos y resolución, compartir archivos de vídeo, ajustar VBR/CBR, Bit Rate etc...
  • Tiene un motor de descargar de audio y vídeo integrado permitiendo guardar contenido de YouTube u otros sitios
  • La grabadora te permite grabar vlogs, juegos desde la pantalla de tu ordenador, iPhone, iPad o cámara Web conectada
https://www.dominatupc.com.co/
Aunque se relacionan las más importantes son muchas las opciones que tiene el programa y que tú mismo poco a poco puede ir descubriendo. A continuación te mostraremos la forma de poder instalar de manera gratuita con un código estragado por el mismo desarrollador y por tiempo limitado en solo dos (2) pasos.
  1. Descarga VideoProc dando clic aquí
  2. Ejecute el programa e ingrese el correo electrónico valido, seguidamente ingrese el código de activación (serial) DALZQ-243P7-5Q66J-UPURF y presione activar.
De esta manera ya contamos con todas las funciones de forma gratuita, para editar y convertir vídeos en 4k grandes. También te puede interesar:(Cómo descargar y activar toda la suite de Adobe)


Related news


Sunday, 7 June 2020

BeEF: Browser Exploitation Framework


"BeEF is the browser exploitation framework. A professional tool to demonstrate the real-time impact of XSS browser vulnerabilities. Development has focused on creating a modular structure making new module development a trivial process with the intelligence residing within BeEF. Current modules include the first public Inter-protocol Exploit, a traditional browser overflow exploit, port scanning, keylogging, clipboard theft and more." read more...


Website: http://www.bindshell.net/tools/beef


Related articles

Saturday, 6 June 2020

PKCE: What Can(Not) Be Protected


This post is about PKCE [RFC7636], a protection mechanism for OAuth and OpenIDConnect designed for public clients to detect the authorization code interception attack.
At the beginning of our research, we wrongly believed that PKCE protects mobile and native apps from the so called „App Impersonation" attacks. Considering our ideas and after a short discussion with the authors of the PKCE specification, we found out that PKCE does not address this issue.
In other words, the protection of PKCE can be bypassed on public clients (mobile and native apps) by using a maliciously acting app.

OAuth Code Flow


In Figure 1, we briefly introduce how the OAuth flow works on mobile apps and show show the reason why we do need PKCE.
In our example the user has two apps installed on the mobile phone: an Honest App and an Evil App. We assume that the Evil App is able to register the same handler as the Honest App and thus intercept messages sent to the Honest App. If you are more interested in this issue, you can find more information here [1].

Figure 1: An example of the "authorization code interception" attack on mobile devices. 

Step 1: A user starts the Honest App and initiates the authentication via OpenID Connect or the authorization via OAuth. Consequentially, the Honest App generates an Auth Request containing the OpenID Connect/OAuth parameters: client_id, state, redirect_uri, scope, authorization_grant, nonce, …. 
Step 2: The Browser is called and the Auth Request is sent to the Authorization Server (usually Facebook, Google, …).
  • The Honest App could use a Web View browser. However, the current specification clearly advice to use the operating system's default browser and avoid the usage of Web Views [2]. In addition, Google does not allow the usage of Web View browser since August 2016 [3].
Step 3: We asume that the user is authenticated and he authorizes the access to the requested resources. As a result, the Auth Response containing the code is sent back to the browser.

Step 4: Now, the browser calls the Honest App registered handler. However, the Evil App is registered on this handler too and receives the code.

Step 5: The Evil App sends the stolen code to the Authorization Server and receives the corresponding access_token in step 6. Now, the Evil App can access the authorized ressources.
  • Optionally, in step 5 the App can authenticate on the Authorization Server via client_id, client_secret. Since, Apps are public clients they do not have any protection mechanisms regarding the storage of this information. Thus, an attacker can easy get this information and add it to the Evil App.

    Proof Key for Code Exchange - PKCE (RFC 7636)

    Now, let's see how PKCE does prevent the attack. The basic idea of PKCE is to bind the Auth Request in Step 1 to the code redemption in Step 5. In other words, only the app generated the Auth Request is able to redeem the generated code.


    Figure 2: PKCE - RFC 7636 

    Step 1: The Auth Request is generated as previosly described. Additionally, two parameters are added:
    • The Honest App generates a random string called code_verifier
    • The Honest App computes the code_challenge=SHA-256(code_verifier)
    • The Honest App specifies the challenge_method=SHA256

    Step 2: The Authorization Server receives the Auth Request and binds the code to the received code_challenge and challenge_method.
    • Later in Step 5, the Authorzation Server expects to receive the code_verifier. By comparing the SHA-256(code_verifier) value with the recieved code_challenge, the Authorization Server verifies that the sender of the Auth Request ist the same as the sender of the code.
    Step 3-4: The code leaks again to the Evil App.

    Step 5: Now, Evil App must send the code_verifier together with the code. Unfortunatelly, the App does not have it and is not able to compute it. Thus, it cannot redeem the code.

     PKCE Bypass via App Impersonation

    Again, PKCE binds the Auth Request to the coderedemption.
    The question rises, if an Evil App can build its own Auth Request with its own code_verifier, code_challenge and challenge_method.The short answer is – yes, it can.

    Figure 3: Bypassing PKCE via the App Impersonation attack
    Step 1: The Evil App generates an Auth Request. The Auth Request contains the client_id and redirect_uri of the Honest App. Thus, the User and the Authorization Server cannot recognize that the Evil App initiates this request. 

    Step 2-4: These steps do not deviate from the previous description in Figure 2.

    Step 5: In Step 5 the Evil App sends the code_verifier used for the computation of the code_challenge. Thus, the stolen code can be successfully redeemed and the Evil App receives the access_token and id_token.

    OAuth 2.0 for Native Apps

    The attack cannot be prevented by PKCE. However, the IETF working group is currently working on a Draft describing recommendations for using OAuth 2.0 for native apps.

    References

    Vladislav Mladenov
    Christian Mainka (@CheariX)

    Related links


    1. Pentest Linux
    2. Pentestbox
    3. Pentest Report Generator
    4. Pentest Vs Red Team
    5. Basic Pentest 1 Walkthrough
    6. How To Pentest A Website With Kali
    7. Hacking 3Ds
    8. Hacking Typer
    9. Hacking With Python
    10. Hacking Websites
    11. Pentest Ftp
    12. Hacker Keyboard
    13. Pentest App
    14. Hacking Names
    15. Hacking Meaning
    16. Is Hacking Illegal
    17. Hacking Images
    18. Hacking Images
    19. Pentest Gear

    BeEF: Browser Exploitation Framework


    "BeEF is the browser exploitation framework. A professional tool to demonstrate the real-time impact of XSS browser vulnerabilities. Development has focused on creating a modular structure making new module development a trivial process with the intelligence residing within BeEF. Current modules include the first public Inter-protocol Exploit, a traditional browser overflow exploit, port scanning, keylogging, clipboard theft and more." read more...


    Website: http://www.bindshell.net/tools/beef


    Related articles