WireShark 1.4.3

WireShark is probably one of the most famous and most frequently used network sniffer. People like to call it the Network Protocol Analyzer too. Call it whatever, but, your security tool aresenal is incomplete without WireShark. It was previously called as Ethereal.


Also, it is open source. It is cross platform and it has been in development for more than 10 years now! It also appears in the TOP 100 tools on SecTools. This application is very similar to TCPDump in its working, but it has better sorting & grouping actions. It also has a GUI, which TCPDump lacks. It allows the user to see all traffic being passed over the network. It uses pcap & WinPcap where applicable to capture packets.


Here is the starting introduction video for newbies







Features

* Deep inspection of hundreds of protocols, with more being added all the time
* Live capture and offline analysis
* Standard three-pane packet browser
* Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
* Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
* The most powerful display filters in the industry
* Rich VoIP analysis
* Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
* Capture files compressed with gzip can be decompressed on the fly
* Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom)
* Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
* Coloring rules can be applied to the packet list for quick, intuitive analysis
* Output can be exported to XML, PostScript®, CSV, or plain text

Download Wireshark v1.4.3 & Wireshark v1.2.14 (wireshark-win32-1.4.3.exe/wireshark-1.4.3.tar.bz2) here.

Tabnapping tutorial&how to stay secure

What is tabnapping?

tab napping is a new form of phishing..in which a attacker redirects a normal looking page to malformed page either in some time or when victims moves to other already opened tabs.Tabnapping might sound simple but its very effective as victims feels comfortable with normal looking page and voilla he gets pawned when he moves back to original tab

tabnapping was developed by aza razkin

how to stay safe from tabnapping
1)Always look for the url in adress bar before logging in to important sites.

2)Try using no-script addon from firefox it will disable js and other malicious scripts which can be used by hackers.

3)Try using ctr+n for tabs



here is the video demonstrating  it practically


here is the code

A New Type of Phishing Attack from Aza Raskin on Vimeo.

15 Facts about STEVE JOBS

The Apple’s CEO Steve Jobs sells dreams not products. He is one of the greatest corporate storyteller on world stage. People love everything about him whether its his presentation style, quotes or facts about his personal and professional life. There are many amazing and interesting facts about Steve Jobs life and work and 15 of them are here for yo

Steve Jobs Facts

1. Steve was adopted by Justin and Clara Jobs of California

2. Steve Jobs founded Apple in 1976 and he was fired from Apple (the company he founded himself) in 1984 (the same year that Apple introduced Macintosh)

3. Steve founded NeXt, an highly experimental and technologically advanced computer company that introduced embedded graphics that was a step forward towards personal computing.

4. In 1996, Apple bought NeXt and Steve Jobs returned to Apple.

5. In 2000 at MacWorld Expo, Steve became the permanent CEO of Apple.

6. Steve’s Appearance: Slender; wears jeans, with a black turtleneck and running shoes. Many things around
    on why he chooses the same clothes everyday.

7. He loves Beatles and claim they have inspired his business model.

8. He is a Steve Jobs Facts.

9. His first apartment in New York was later sold to Bono of U2.

10. Steve has big feet, size 14 big.

11. As the Chairman and CEO of Apple Computers, he pays himself an annual salary of $1 per year.

12. He was named The Most Powerful person in Business by Fortune Magazine in 2007.

13. Steve has many awards including National Medal of Technology that he received from the President Ronald Reagen in 1985.

14. His favorite catch phrases are: “Un-be-lievable”; “Mere mortals”; “It’s huge” & “Wouldn’t it be great”.

15. Steve is probably the only corporate honcho to have the displeasure of reading his own obituary, which was fired by financial newswire Bloomberg to its subscribers.

Google enhances e-mail security in Apps

Google has taken a step to stop legitimate e-mail messages sent by its Apps customers from getting caught in spam filters.

Administrators for Google Apps can now enable digital signing of those messages, which helps recipients verify that the messages came from a known, vetted sender, wrote Adam Dawes, a Google Enterprise product manager on a company blog. 

The system uses DKIM, or DomainKeys Identified Mail, which verifies the domain name through which a message was sent by analyzing the message's cryptographic signature. If the message comes from a domain that is considered reputable, it won't be filtered out.
Some users of Google Apps have complained their e-mail from their custom domain has been blocked even if they have set up a proper Sender Policy Framework (SPF) record. The SPF record allows a domain owner to specify which hosts are allowed to send mail for their domain. 

A SPF record makes it more difficult for spammers to simply forge the "from" address in an e-mail message since the recipient will check the SPF record and filter inconsistent ones out.
Google has used DKIM and DomainKeys, another e-mail authentication method, for its Gmail customers for outbound e-mail since 2004.
In 2008, Google worked with eBay and PayPal to ensure messages from those organizations were always properly signed, due to the high prevalence of phishing e-mails. All unsigned messages purporting to be from those organizations are blocked.
DKIM is free for Google Apps users. Administrators can turn it on by going to the control panel and then to the "advanced tools" tab, Dawes wrote.

Google will deploy fixes for Android SMS bug soon

Android users who thought they fat-fingered a text message to the wrong person may be able to lay the blame with Google developers.

The company acknowledged on Thursday long-running complaints that text messages occasionally would be sent to the wrong person due to a bug in the operating system. Google also said it found a second problem, but will deploy fixes for both soon."Some users have reported that their SMS messages are being delivered to the wrong people," wrote Android project member Nick Kralevich in a comment on a bug report for the issue. "It took us some time to reproduce this issue, as it appears that it's only occurring very rarely. Even so, we've now managed to both reproduce it and develop a fix that we will deploy."
The bug report was filed in June as issue 9392 on Google's Android project pages, but comments on it suddenly proliferated earlier this week.
Some commenters on the forum felt that a just a few people were repeatedly complaining about the bug and accused them of "trolling," or slamming the forum with repetitive, obnoxious comments. 

Google said it will also fix a second issue it discovered, in which in rare instances users see a different message in the Messaging application than the one they tried to open.
"We don't believe this issue is affecting many users, but we've developed a fix that we're preparing to deploy," Kralevich wrote. "Of course, double-checking the displayed message before hitting 'Send' will prevent any messages from being sent to the wrong recipients. We've found in testing this issue, it is more likely to occur if you tap on a message before the Messaging app is fully loaded, so we recommend waiting for all the elements to load before clicking on the message you want to display."

WordPress 3.0.4 addresses Cross-Site-Scripting flaws

In an email
to users on Thursday, WordPress urged everyone to apply the latest update in order to fix critical flaws in the input sanitation library.


The latest version of WordPress, which is available via the admin dashboard on current installations, fixes Persistent Cross-Site-Scripting (XSS) flaws in the HTML sanitation library, also known as KSES.


Matt Mullenweg, in an email to WordPress users, explained that their final message this year is both unfortunate and important.


“We've fixed a pretty critical vulnerability in WordPress' core HTML sanitation library, and because this library is used lots of places it's important that everyone update as soon as possible,” outlined Mullenweg.


“I realize an update during the holidays is no fun, but this one is worth putting down the eggnog for. In the spirit of the holidays, consider helping your friends as well,” he added.


On the WordPress blog, Mullenweg also asked that anyone familiar with the issue examine the changes as well, saying: “We’ve given it a lot of thought and review but since this is so core we want as many brains on it as possible.”


Normal XSS attacks will use the malicious code immediately, but a Persistent XSS attack is dangerous because the attack code is stored by the server. When this happens, it is permanently displayed on the rendered pages.


Whereas an attacker would need to lure victims to a compromised website to leverage a typical XSS attack, a Persistent XSS attack can sit idle and attack visitors to a given domain as and when they appear.


“On initial inspection it would appear to be quite trivial for folks with malicious intent to exploit these flaws,” commented Chester Wisniewski, senior security advisor at Sophos Canada.


“The flaws exist in parts of the code which are case-sensitive when detecting which protocols are allowed in certain parts of the application. The update prohibits evading the rules with mixed case input.”


Updating to the latest version will take just a few minutes and is well worth the effort. In addition, users should check their plugins and ensure they are updated as well, especially as they're located in the open admin panel.

Tunisian government harvesting usernames and passwords

The Tunisian Internet Agency (Agence tunisienne d'Internet or ATI) is being blamed for the presence of injected JavaScript that captures usernames and passwords. The code has been discovered on login pages for Gmail, Yahoo, and Facebook, and said to be the reason for the recent rash of account hijackings reported by Tunisian protesters.


ATI is run by the Tunisian Ministry of Communications. They supply all of the privately held Tunisian ISPs, making them the main source of Internet access in the country. They’ve been under scrutiny for years, due to the fact that they make use of their authority to regulate the entire national network
. Last April, ATI earned international attention by blocking access to sites such as Flickr, YouTube
, and Vimeo.


According to Reporters Without Borders, authorities claim to target only pornographic or terrorist websites. “However, censorship applies above all to political opposition, independent news, and human rights websites.”


“When an Internet user attempts to access a prohibited website, the following automatic error message appears: “Error 404: page not found,” without displaying the familiar “Error 403” more typical of a blocked site...This strategy equates to a disguised form of censorship.”



As for the JavaScript itself, The Tech Herald has seen examples of the embedded script during live surfing sessions with sources in Tunisia, and in posted source code made available to the Web. The source for the GMail injection is here, the Yahoo injection is here, and Facebook is here.


Four different experts consulted by The Tech Herald independently confirmed our thoughts; the embedded code is siphoning off login credentials.


On Twitter, security researcher Gerry Kavanagh and Errata Security CTO David Maynor told us that you can tell the code is capturing login information by how it references the login element for the form.


“Suffice to say, the code is definitely doing something surreptitious,” Kavanagh noted.


Daniel Crowley, Technical Specialist for Core Security, and Rapid7’s Josh Abraham, broke the code down further. Crowley explained that the JavaScript is customized for each site’s login form. It will pull the username and password, and encode it with a weak crypto algorithm.


The newly encrypted data is placed into the URL, and a randomly generated five character key is added. The randomly generated key is meaningless, but it is assumed that it’s there to add a false sense of legitimacy to the URL.


The random characters and encrypted user information are delivered in the form of a GET request to a non working URL. In the Gmail example, you see this URL listed as http://www.google.com/wo0dh3ad. Abraham noted that the encryption makes it easy to capture usernames and passwords that would include special characters such as ‘%’ or ‘/’.


Considering that the backbone of the Tunisian Internet
is full of state run filters and firewalls designed to block access, configuring one to log the GET commands with the harvested data would be trivial. But is this a government sponsored action?


The likelihood that a group of criminals compromised the entire Tunisian infrastructure is virtually nonexistent. Code planting on this scale could only originate form an ISP. With their history of holding an iron grip on the Internet, ATI is the logical source of the information harvesting.


There is an upside however, as the embedded JavaScript only appears when one of the sites is accessed with HTTP instead of HTTPS. In each test case, we were able to confirm that Gmail and Yahoo were only compromised when HTTP was used. For Facebook on the other hand, the default is access is HTTP, so users in Tunisia will need to visit the HTTPS address manually.


Another interesting note is that it appears the embedded code has targeted Tunisian users for several months. Slim Amamou, of the Global Voices Advocacy blog, reported his findings on the code last July, and at the time, ATI was blocking Google’s HTTPS port, forcing users to default to HTTP.

The ATI website has been offline for more than a day. The outage started after Anonymous launched Operation: Tunisia.