Facebook Open Sources its Capture the Flag (CTF) Platform

Hacking into computer, networks and websites could easily land you in jail. But what if you could freely test and practice your hacking skills in a legally safe environment?

Facebook just open-sourced its Capture The Flag (CTF) platform to encourage students as well as developers to learn about cyber security and secure coding practices.

Capture the Flag hacking competitions are conducted at various cyber security events and conferences, including Def Con, in order to highlight the real-world exploits and cyber attacks.

The CTF program is an effective way of identifying young people with exceptional computer skills, as well as teaching beginners about common and advanced exploitation techniques to ensure they develop secure programs that cannot be easily compromised.

Facebook  CTF Video Demo:

Since 2013, Facebook has itself hosted CTF competitions at events across the world and now, it is opening the platform to masses by releasing its source code on GitHub.

"We built a free platform for everyone to use that takes care of the backend requirements of running a CTF, including the game map, team registration, and scoring," said Gulshan Singh, Software Engineer at Facebook Threat Infrastructure.

In general, Capture The Flag competition hosts a series of security challenges, where participants have to hack into defined targets and then defending them from other skilled hackers.

"The current set of challenges include problems in reverse-engineering, forensics, web application security, cryptography, and binary exploitation. You can also build your own challenges to use with the Facebook platform for a customized competition," Mr. Singh said.

Many institutions and organizations now have realized that gamification of cyber security and hacking is beyond the traditional ways to train your mental muscles and keep sharp your skills that otherwise only come up when doomsday scenarios happen.

Courtesy: THN

Critical Flaws in Magento leave Millions of E-Commerce Sites at Risk

If you are using Magento to run your e-commerce website, it's time for you to update the CMS (content management system) now.

Millions of online merchants are at risk of hijacking attacks due to a number of critical cross-site scripting (XSS) vulnerabilities in the Magento, the most popular e-commerce platform owned by eBay.

Why the Bugs are So Serious?

Virtually all versions of Magento Community Edition 1.9.2.2 and earlier as well as Enterprise Edition 1.14.2.2 and earlier, are vulnerable to the Stored Cross-Site Scripting (XSS) flaws.

The stored XSS flaws are awful as they allow attackers to:

• Effectively take over a Magento-based online store
• Escalate user privileges
• Siphon customers’ data
• Steal credit card information
• Control the website via administrator accounts

However, the good news is that the vulnerabilities are patched, and an update has been made available to the public after security firm Sucuri discovered and privately reported the vulnerability to the company.

How Easy it is to Exploit the Flaw

The XSS bugs are quite easy to exploit. All an attacker need to do is embed malicious JavaScript code inside customer registration forms in place of email address.

Magento then runs and executes this email containing JavaScript code in the context of the administrator account, making it possible for an attacker to steal administrator session and completely take over the server running Magento.

Cybersecurity firm Sucuri describes the bug as the worst hole, saying:

"The buggy snippet is located inside Magento core libraries, more specifically within the administrator's backend. Unless you are behind a WAF or you have a very heavily modified administration panel, you are at risk."
"As this is a Stored XSS vulnerability, this issue could be used by attackers to take over your site, create new administrator accounts, steal client information, anything a legitimate administrator account is allowed to do."

Patch your Software Now!

To prevent websites from exploitation, webmasters are recommended to apply the latest patch bundle SUPEE-7405 as soon as possible.

Since the latest patch resolves the issue for Magento version 1.14.1 and 1.9.1 and earlier, problems impacting Magento versions 1.14.2.3 and 1.9.2.3 have already been resolved.

With Alexa top one million e-commerce websites and over all ten Million websites using the internet's fourth most popular CMS, Magento has become a valuable target for attackers nowadays.

So, patch your websites now to stay safe!

Be careful when You Browse Adult contents in your Android phone

CryptoLocker Ransomware which is so far making trouble for Desktop users by scaring them into pay a fine to unlock their locked hard devices is now started to target Android users.

BitDefender have identified a new mobile version of the Ransomware which is being sold by the same group responsible for the Desktop version of Ransomware malware.

The malware dubbed as 'Android.Trojan. Koler.A' is being served to the mobile devices, when the users are browsing certain adult content websites.

The malware disguise itself as badoink, a video player that needs to be installed to get premium access to porn and tricks users into installing the app.

Once installed, the malware finds the location of victims and shows a fake warning message in their local language.

"Attention! Your Phone has been blocked up for safety reasons listed below.  All the action peformed on this phone are fixed.  All your files are encrypted.  Conducted Audio and Video" The fake message reads.

The warning message informs the victims that their files have been encrypted and they have to pay $300 ransom in order to unlock their device. 

But, No Need to Panic ! The files stored on the device are not actually encrypted as the warning message claims.  By pressing Home button, you can return to Home screen. You will have 5 seconds to Uninstall the app from your device.

Safe Mode to Remove the malicious app:
This malicious app is Not Sophisticated one, you can uninstall the app by booting the device in Safe Mode.

"The group behind this exploit is falsely and egregiously using the BaDoink
brand and logo, a brand that adult consumers have trusted for 8 years, to
spread this Ransomware."In an email sent to us, the company behind the legitimate version of Badoink, has clarified that they've nothing to do with this ransomware.

Jailbroken iPhones are being targeted by an active malware campaign, stealing passwords

A malware campaign has been unearthed by security researcher Stefan Esser after many of the users of jailbroken iPhones and iPads posted on Reddit that their devices crashed repeatedly after installing unofficial tweaks through a third-party app store called ‘Cydia’ which serves the market of jailbroken  Apple devices.
According to Stefan Esser, the purpose of the malware is to get information about Apple ID from jailbroken iPhones and iPads. The malware campaign is being called “Unflod Baby Panda” and it originates from China. Stefan Esser reports the results in a blog post and writes the following:
“This malware appears to have Chinese origin and comes as a library called Unflod.dylib that hooks into all running processes of jailbroken iDevices and listens to outgoing SSL connections. From these connections it tries to steal the device’s Apple-ID and corresponding password and sends them in plaintext to servers with IP addresses in control of US hosting companies for apparently Chinese customers.”

The other name for this library is framework.dylib which is found in other infections. However, it is not clear how the malware ended up in the jailbroken iPhones and iPads. Rumors are that “Chinese piracy repositories are involvedare so far unverified,” reported the blog.
In an e-mail to Ars, Esser reveals that iPhone 5S/iPad Air or iPad mini 2G are safe from the malware as it can only attack 32-bit versions of iOS. “There is no ARM 64-bit version of the code in the copy of the library we got,” he wrote. The solution is to restore the device. After restoring the devices the users must also change their Apple ID passwords as soon as possible.
“That is why we recommend to restore the device,” Esser suggested Ars. “However, that means people will lose their jailbreak until a new one is released, and the majority of jailbreak users will not do that.”
Sophos, antivirus provider, researchers underplay that the threat came from Cydia directly and suggest there no need to panic.
“I will also again take this moment to point out to anyone concerned that the probability of this coming from a default [Cydia] repository is fairly low,” Cydia developer Jay Freeman, aka Saurik, wrote in one reddit comment. “I don’t recommend people go adding random URLs to Cydia and downloading random software from untrusted people any more than I recommend opening the .exe files you receive by e-mail on your desktop computer.”

First Tor-Based Android Malware Spotted in the Wild

We use our Smartphone devices to do almost everything, from Internet Banking to Sharing private files and at the same pace, the mobile malware sector is also growing.

The number of variants of malicious software aimed at mobile devices has reportedly risen about 185% in less than a year. 

Security researchers have observed a growth in the numbers of computermalware families starting to use TOR-based communications, but recently the Security Researchers at anti-virus firm Kaspersky Lab havespotted the world's first Tor-Based Malware for Android Operating system.

The Android Malware dubbed as 'Backdoor.AndroidOS.Torec.a', using Tor hidden service protocol for stealth communication with Command-and-Control servers.

Researchers detected that the Trojan is running from .Onion Tor domain and working on the functionality of an open source Tor client for Android mobile devices, called 'Orbot', thus eliminating the threat of the botnet being detected and blocked by law enforcement authorities, although often it's not clear how many devices has been infected by this malware till now.

The Trojan is capable of intercepting and stealing incoming SMS, can make USSD requests, stealing device information including 'the phone number, country, IMEI, model, version of OS', can retrieve the list of installed applications on the mobile device, and also can send SMSs to a specified number.

Kaspersky didn't mention particularly that the malware is focused on stealing banking information or not, but the popularity of Android OS is kept motivating cyber criminals to develop far more advanced Android malware with more stealthy and anti-reverse methods.

Here are some things you can do to dramatically reduce the risk of malware infections on your Android phone:

• Install apps from official Android Market instead of third-party app stores or websites.
• Before installing any apps, check the publisher and app reviews.
• Pay attention to app permissions during the installation.
• Install Antivirus and Firewall apps.

Silent Circle's Blackphone - A $629 Privacy and Security Focused Smartphone

Earlier this year encrypted communications firm Silent Circle and Spanish Smartphone makerGeeksphone announced a privacy-focused encrypted Smartphone called 'Blackphone' and today the company has revealed it as 'Mobile World Congress' in Barcelona.

The Blackphone titled as, “world’s first Smartphone which places privacy and control directly in the hands of its users,” has a fully customized version customized version of Android called PrivatOS and pre-installed with lots of privacy-enabled applications, is now available for pre-order for about $629.

Silent Circle was co-founded by a respected Cryptographer Phil Zimmermann, best known as the creator of Pretty Good Privacy (PGP), which is a widely used email encryption software.

The Blackphone handsets main focus is keeping all of your data secure, and to stop government agencies snooping on your communications. Blackphone will come with a set of application developed by Silent Circle, including Silent Phone, Silent Text, and Silent Contacts as well as other features for firewall and remote wipe when required.

Blackphone also has a 'Kismet Smart Wi-Fi Manager' to improve the security device on public networks, and also provides the private web browsing and secure file-sharing options. The Android-based Blackphone is powered by a quad-core 2 GHz processor, 2GB of RAM, 16GB of onboard storage and support for LTE networks.

The Blackphone also comes with SpiderOak, which provides 5GB of encrypted data backup, and Virtual Private Network from Disconnect.me.

But if you think 'Blackphone' is a shield against the NSA or other intelligence agencies Blackphone, then you should know this - Blackphone cannot mask metadata entirely from NSA. No piece of man-made technology is entirely hack-proof.

Mike Janke, co-founder and CEO of Silent Circle told Mashable, "If you are on the terrorist wanted list or a criminal, intelligence services will get into your device... There's no such thing as 100% secure phone."

The Blackphone’s main security feature is voice and text encryption, not about hiding metadata which is related to a communication data such as date, time, location and identity of the users.