Graphics

http://graphicdesigno.com

Facebook works with Google, Yahoo and mozilla on secure session cookie

Facebook works with Google, Yahoo and mozilla on secure session cookie

Facebook works with Google, Yahoo and mozilla on secure session cookie

After turning on https connection for facebook users, now facebook is working with Google, Yahoo and Mozilla on a secure session cookie specification that will protect session cookie from theft even over non-encrypted connections. This new specification is MAC Access Authentication that provide cryptographic verification for certain portions of HTTP requests. Here MAC is Message Authentication Code. this prevents MAN IN THE MIDDLE attack.
Facebook told developers in a post detailing recent changes to its app platform, "We’re working with Yahoo!, Google and Mozilla on this specification in order to give all websites a way to ensure that session information has not been altered or tampered with". Facebook also asked developers to use SSL connection for apps by october.

Recently facebook user data was leaked by some app tokens vulnerability, so facebook is forcing all developers to use SSL. Every time the facebook got some trouble, app is the reason. So facebook is trying each and every possible way to secure it's users from scams and data theft.

"Facebook dislike button" is a new kind of spam

"Facebook dislike button" is a new kind of spam

"Facebook dislike button" is a new kind of spam

All of us use facebook and want a dislike button too for disliking some posts on facebook. Scammers are now using this need as their spam spreading method on facebook. Facebook scammers are tricking users to paste rogue code into their browser's address bars in order to get a Dislike button added to their options. The spam messages posted by victims read "Facebook now has a dislike button! Click Enable Dislike Button' to turn on the new feature!" The scammers replace share link by a message "Enable Dislike Button".
After clicking the link, this message will share this spam message to all friends of user and also rune some rouge code on his system too.

Facebook has not announced any official dislike button and i do not think it will be in near future.
faceook security experts are doing their best for preventing spams on facebook, but spams are increasing day by day. I hope people will understand it's danger and use safe facebook. I advice users not to click on any this kind of spams and always enalbe all security features given by facebook

.....................................................................................................................................

Cookiejacking | facebook, twitter, Gmail hacking

Cookiejacking | facebook, twitter, Gmail hacking

Cookiejacking | facebook, twitter are at risk again
Microsoft's latest security risk

You know about clickjacking which is mostly used in facebook to hijack user's click. Cookiejack is little different concept.Cookiejacking is a UI redressing attack that allows an attacker to hijack his victim's cookies without any XSS. It works on

1. Any cookie. 
2. Any website.

Once a hacker has that cookie, he or she can use it to access the same site. So we can say that facebook, twitter, Gmail and many more websites are at risk.

A computer security researcher has found a flaw in Microsoft Corp's widely used Internet Explorer browser that he said could let hackers steal credentials to access FaceBook, Twitter and other websites.
Cookiejacking leverages on two main issues to perform attack

1. a 0-day vulnerability affecting every IE version on every Windows OS box 
2. an advanced Clickjacking approach.

It seems too difficult but Valotta, the researcher said that he was able to do it fairly easily. He built a puzzle that he put up on Facebook in which users are challenged to "undress" a photo of an attractive woman. he published this game online on FaceBook and in less than three days, more than 80 cookies were sent to his server.

But you need to know some facts before performing this attack. First of all, cookies file system path depends on Windows username, so you need to guess your victim's username before starting the attack. 
You can sniff your victim's username by exploiting a feature of IE: by using IE you can access remote SMB resources using UNC paths to reference them. You can do this without restriction in Internet and Intranet zones.
So, if you force your victim's browser to retrieve a resource like it will start a NTLM challenge-response negotiation with the remote server and, as a part of this negotiation, it sends Windows Username in clear plain text. 
So you can just use a script to sniff data on TCP port 445 in order to grab the username. You also need to know which OS version is the victim running, as different OSs store cookies in different folders. But you can guess this by parsing the navigator.userAgent object.


See demo video




Download ppt here

A new clickjacking attack hitting facebook

A new clickjacking attack hitting facebook

A new clickjacking attack hitting facebook

Many times i have posted about clickjacking attack used in facebook. And i think it's not over. A new clickjacking scam is again hitting facebook walls. The spam messages posted by victims of this attack read: "Baby Born Amazing Effect - WebCamera" and contains a link that takes users to a page hosted at blogspot.com.  The page displays a video player thumbnail with a play button, however, trying to click it actually forces the user's browser to Like the page.

If you want to know what clickjacking is, read clickjacking introduction post.

Few days ago, face deployed a new mechanism for protecting clickjacking attack, but that system doesn't seem to work better. This new spreading scam is the example of it's faliure. 
If you are a firefox user, you can protect yourself by using NOSCRIPT extension.

 

...............................................................................................................................

"world's funniest condom commercial" a new clickjacking attack in facebook

"world's funniest condom commercial" a new clickjacking attack in facebook

"world's funniest condom commercial" a new clickjacking attack in facebook

"The World Funniest Condom Commercial - LOL [link] haha its really so funny ~ Dont Miss it !"
Most of you have seen this message on facebook. If not, you will surely see this in some days. This is a new clickjacking attack. Clicking on this link will lead users to a page on a blogspot page whick displays on YouTube video player. And user'c click is hijacked for clicking on like and share the facebook page. 
Clickjacking attacks are now very common on facebook. I have posted many this type of facebook scams. 
If you want to protect yourself from this attack, use noscript extention of firefox. Which is the best protection available on the internet.

..................................................................................................................................

FaceNiff- sniff web sessions with android | hack facebook, Gmail using android

FaceNiff- sniff web sessions with android | hack facebook, Gmail using android

FaceNiff- sniff web sessions with android | hack facebook, Gmail using android

You have surely heared about Firesheep which allows session sniffing using firefox. The same concept is on Android mobile. FaceNiff is an Android app that allows you to sniff and intercept on WiFi sessions of your mobile connection. It can work on any private netwoks on Open/WEP/WPA-PSK/WPA2-PSK.
 If the webuser is using SSL, this application wouldn't work.


Supported services:
FaceBook
Twitter
Youtube
Amazon
Nasza-Klasa


Download Here:
http://faceniff.ponury.net/FaceNiff-1.9.4.apk


ReadMore:
http://faceniff.ponury.net/

......................................................................................................................................