Sunday 6 August 2017

Using Tor

Using Tor 

What is Tor

Tor is free software for enabling anonymous communication. The name is derived from an acronym for the original software project name "The Onion Router". Tor directs Internet traffic through a free, worldwide, volunteer overlay network consisting of more than seven thousand relays to conceal a user's location and usage from anyone conducting network surveillance or traffic analysis. Using Tor makes it more difficult for Internet activity to be traced back to the user: this includes "visits to Web sites, online posts, instant messages, and other communication forms". Tor's use is intended to protect the personal privacy of users, as well as their freedom and ability to conduct confidential communication by keeping their Internet activities from being monitored.

Download Tor 


Step 1:

Download the file from above link and unzip it  using winrar or any other software in Windows 
For Linux 

Unzip the package by typing

tar xzf tor-X.X.X.XX.tar.gz

Step 2:


 Just go to and open tor browser by double clicking sub directory 

Step 3:


Just wait for few seconds to load and to configure relays based on your internet speed and start browsing anonymously 
For Linux 
Entire process is similar but if you need to run as root user
Open browser with textpad 
Search for 
if [ "`id -u`" -eq 0 ]; then
complain "The Tor Browser Bundle should not be run as root.  Exiting."
exit 1
fi
Comment or delete above lines and launch browser. 
But be careful while doing so it giving elevated privilege for tor browser 
If you had any errors even in Linux version please drop me a comment I will get back to you 
 


Onion routing

Onion Routing

Onion Routing

Onion routing is a technique for anonymous communication over a computer network. In an onion network, messages are encapsulated in layers of encryption, analogous to layers of an onion. The encrypted data is transmitted through a series of network nodes called onion routers, each of which "peels" away a single layer, uncovering the data's next destination. When the final layer is decrypted, the message arrives at its destination. The sender remains anonymous because each intermediary knows only the location of the immediately preceding and following nodes.

Data structure

In this example onion, the source of the data sends the onion to Router A, which removes a layer of encryption to learn only where to send it next and where it came from (though it does not know if the sender is the origin or just another node). Router A sends it to Router B, which decrypts another layer to learn its next destination. Router B sends it to Router C, which removes the final layer of encryption and transmits the original message to its destination.
An onion is the data structure formed by "wrapping" a message with successive layers of encryption to be decrypted ("peeled" or "unwrapped") by as many intermediary computers as there are layers before arriving at its destination. The original message remains hidden as it is transferred from one node to the next, and no intermediary knows both the origin and final destination of the data, allowing the sender to remain anonymous.

Onion creation and transmission

To create and transmit an onion, the originator selects a set of nodes from a list provided by a "directory node". The chosen nodes are arranged into a path, called a "chain" or "circuit", through which the message will be transmitted. To preserve the anonymity of the sender, no node in the circuit is able to tell whether the node before it is the originator or another intermediary like itself. Likewise, no node in the circuit is able to tell how many other nodes are in the circuit and only the final node, the "exit node", is able to determine its own location in the chain.
Using asymmetric key cryptography, the originator obtains a public key from the directory node to send an encrypted message to the first ("entry") node, establishing a connection and a shared secret ("session key"). Using the established encrypted link to the entry node, the originator can then relay a message through the first node to a second node in the chain using encryption that only the second node, and not the first, can decrypt. When the second node receives the message, it establishes a connection with the first node. While this extends the encrypted link from the originator, the second node cannot determine whether the first node is the originator or just another node in the circuit. The originator can then send a message through the first and second nodes to a third node, encrypted such that only the third node is able to decrypt it. The third, as with the second, becomes linked to the originator but connects only with the second. This process can be repeated to build larger and larger chains, but is typically limited to preserve performance.
When the chain is complete, the originator can send data over the Internet anonymously. When the final recipient of the data sends data back, the intermediary nodes maintain the same link back to the originator, with data again layered, but in reverse such that the final node this time removes the first layer of encryption and the first node removes the last layer of encryption before sending the data, for example a web page, to the originator.

One of the reasons typical Internet connections are not considered anonymous is the ability of Internet service providers to trace and log connections between computers. For example, when a person accesses a particular website, the data itself may be secured through a connection like HTTPS such that your password, emails, or other content is not visible to an outside party, but there is a record of the connection itself, what time it occurred, and the amount of data transferred. Onion routing creates and obscures a path between two computers such that there's no discernible connection directly from a person to a website, but there still exist records of connections between computers. Traffic analysis searches those records of connections made by a potential originator and tries to match timing and data transfers to connections made to a potential recipient. For example, a person may be seen to have transferred exactly 51 kilobytes of data to an unknown computer just three seconds before a different unknown computer transferred exactly 51 kilobytes of data to a particular website. Factors that may facilitate traffic analysis include nodes failing or leaving the network and a compromised node keeping track of a session as it occurs when chains are periodically rebuilt.
Garlic routing is a variant of onion routing associated with the I2P network that encrypts multiple messages together to make it more difficult for attackers to perform traffic analysis and to increase the speed of data transfer.

Exit node vulnerability

Although the message being sent is transmitted inside several layers of encryption, the job of the exit node, as the final node in the chain, is to decrypt the final layer and deliver the message to the recipient. A compromised exit node is thus able to acquire the raw data being transmitted, potentially including passwords, private messages, bank account numbers, and other forms of personal information. Dan Egerstad, a Swedish researcher, used such an attack to collect the passwords of over 100 email accounts related to foreign embassies.
Exit node vulnerabilities are similar to those on unsecured wireless networks, where the data being transmitted by a user on the network may be intercepted by another user or by the router operator. Both issues are solved by using a secure end-to-end connection like SSL or secure HTTP (S-HTTP). If there is end-to-end encryption between the sender and the recipient, then not even the last intermediary can view the original message.

Some Of Onion Links 

How to Browse Dark Web  

please Follow above  link how to browse using onionrouting i.e., dark web

 

Wednesday 2 August 2017

Drug case In hyderabad

Ex-NASA Scientist Arrested in Hyderabad for Dealing Drugs

 

An ex-scientist who used to work for US space agency NASA has reportedly been arrested on “Drug peddling” charges according to the prohibition and excise sleuths.
The culprit, 29-year-old Anish Dundoo, a US citizen happens to be an old grad of Doon School located in Dehradun. It is a reputable school which is noted for the enrollment of children of Central Ministers and people of very high pedigree. He was an employee with NASA for one year before he relocated to Hyderabad to set up a business of his own in 2012.
Anish’s apprehension came as a result of critically analyzed cell phone records obtained from 10 other narcotic peddlers who were also apprehended over the past weeks. A total of 1.2 kilos of cannabis and 16 units of LSD, a very sophisticated drug were clutched by sleuths during the arrest in his Secunderabad office.
Anish obtained his Bachelor’s degree in aerospace, aeronautical and astronautical engineering from the Cincinnati University in the US. According to reports, officials involved with the investigation stated that the culprit is presently dealing in Bitcoin trading and also had been using Bitcoins as the mode of payment for buying drugs on the Darknet. He is believed to be into other businesses aside from the Bitcoin trading.
“Highly qualified people like Anish indulging in narcotics peddling is a big shame,” said an investigating officer.
The information provided by Anish after his arrest also lead to the capture of one Ritul Agrawal, a 26-year-old businessman. He is said to be dealing in steel which happens to be a family business. According to reports, he also had graduated in business administration from a very prominent management school located in the city. He (Agrawal), too, was found in possession of narcotics. He and Anish would order the material online and pay using bitcoins/crypto currency. Agrawal was later arrested from Nampally.
“The accused have stated that these NDPS substances are delivered by courier bearing the Netherlands markings,” the officials said. Also, five people amongst those apprehended are said to be B Tech graduates who were working in the film industry, hospitality and MNCs.
With Agrawal’s arrest, the number of people arrested for their alleged participation in this row has now moved to 12. The main focus of this tumult was on narcotics peddling such as MDMA (methylenedioxy- methamphetamine) and LSD (lysergic acid diethylamide). MDMA which is also commonly known as ‘ecstasy’ or ‘molly’ is mostly used as a party drug whiles LSD is one of the most powerful drugs for mood changes. It exists in both liquid state and tablets.
Anish and Agrawal go way back to two years ago when they first met through their friends. Ritual had since been his ally in the narcotics business acting as his pusher. They both told sleuths that the parcels of drugs they received by couriers have postage markings of the Netherlands. They were brought up on the court and then sent to judicial remand afterward.
Excise sleuths arrest of Anish came as no surprise as they were still trying to catch people involved in the illegal drug trade. The city for some time now has been in the news for busting drug rackets some also including many Tollywood personalities.
The probe has revealed that the 29-year-old engineer had, in the last few months, accessed dark website ‘Lunacy’ at least eight times and ordered various quantities of narcotic drugs and psychotropic substances or NDPS (such as cocaine, LSD, MDMA), according to the officials.
With further investigations, based on their phone records, it was revealed that over hundreds of school and college students were into purchasing these drugs. “Some of the students are in 8th and 9th grade,” an official said. “The students were spending up to 4,000 per week to purchase drugs,” an investigating official said. The excise sleuths have also been getting into contact with management of about 16 colleges and 20 schools advising them to enlighten their students and staff about the dangers and implications of drug or substance abuse. They further asked the school managements to keep tabs on stores situated near their campuses. Unusual behaviors amongst students are also to be kept an eye on. All of this comes as a result of the disturbing development in this case.

FBI Sting Operation on Darkweb

Court Orders FBI Darknet Sting to be Kept Secret

 

The details of a case involving an FBI sting on the darknet have been ordered to be kept under seal by federal Magistrate Judge Paige Gossett. The sting allegedly helped bring down a plot to order a mail bomb through the darknet. It is believed to be the first case in the state of South Carolina involving the FBI and the darknet. FBI agent Matthew Desmond was questioned by attorney Jim Griffin, who represents one of the accused. Griffin asked agent Desmond about who made the bomb and where it came from, but agent Desmond declined to answer. Griffin is trying to figure out what the FBI did that would have made a South Carolina Department of Corrections inmate believe he was ordering a mail bomb. Attorney Jim Griffin told Judge Gossett that he needed to know if there was any real danger and whether or not the whole thing was made up by the FBI.
Griffin tried to show that some of the details in the case were known to the public, he pointed to a newspaper article that appeared in The State. Judge Gossett refused to make FBI agent Matthew Desmond answer Griffin’s questions. The prosecuting attorney Will Lewis agreed with Judge Gossett that records detailing what happened in the case should be sealed, keeping them from being known to the public. The judge also denied bond for one of the suspects, 21-year-old Tyrell Fears. The judge said that Fears would pose a danger to his ex-wife Shauna Bell, the intended target of the mail bomb. Fears is being charged along with two other men, 35-year-old Vance “Dank” Voulious Jr. and 31-year-old Michael Young. The three men are accused of conspiring to commit homicide with the mail bomb. A minor only identified by the initials V.M. is also part of the case, but it is not known if any formal charges are being filed.
Michael Young is currently serving a sentence of 50 years after he was convicted of murdering his ex-wife’s father, Robert Bell, while also injuring his ex-wife, Shauna Bell, in the 2011 shooting. Young is currently trying to get a new trial. Shauna Bell would be a key witness at a new trial for Michael Young. This may have been the motive for trying to kill her with a mail bomb, to eliminate her as a potential witness at a new trial. Tyrell Fears is Michael Young’s nephew.
“This should give evil people pause before they order illegal things off the Internet, because they might in fact be ordering from the government,” a source with the FBI told The State. During testimony new allegations were made, such as that Michael Young accessed the darknet from a smart phone smuggled into prison. From this illegal phone, Young is alleged to have ordered the mail bomb from the darknet. It is not known if the FBI was running a fake site that claimed to sell explosives, or if the FBI had hacked into the site. Law enforcement allege that Michael Young was also running a business importing drugs into South Carolina during his time as an inmate in prison. It is possible he was ordering drugs from the darknet using his smuggled smartphone.
The package was mailed through the US Postal Service, and was sent to the minor, known in court documents as V.M., who received the package on June 5th. V.M. signed for the package using a fake name. The package contained information on how to assemble the bomb. The bomb that the men had received was said to not be dangerous enough to harm anyone, and that it only contained small traces of RDX, a military grade explosive. At the time the FBI was monitoring the phone calls of all the men involved. V.M. gave Fears the mail bomb which had been assembled into a package and was addressed to Shauna Bell. Fears took the package to the post office and placed it into an outdoor mail collection bin. Law enforcement then seized the package. The FBI is currently prosecuting another darknet mail bomb case in the state of Georgia.

Friday 28 July 2017

DarkWeb Markets 

Silk Road DeepWeb Drug Market 

 

Silk Road was an online black market and the first modern darknet market, best known as a platform for selling illegal drugs. As part of the dark web,[6] it was operated as a Tor hidden service, such that online users were able to browse it anonymously and securely without potential traffic monitoring. The website was launched in February 2011; development had begun six months prior.[7][8] Initially there were a limited number of new seller accounts available; new sellers had to purchase an account in an auction. Later, a fixed fee was charged for each new seller account.[9][10]
In October 2013, the Federal Bureau of Investigation (FBI) shut down the website[11] and arrested Ross William Ulbricht under charges of being the site's pseudonymous founder "Dread Pirate Roberts".[3] On 6 November 2013, Silk Road 2.0 came online, run by former administrators of Silk Road.[12] It too was shut down, and the alleged operator was arrested on 6 November 2014 as part of the so-called "Operation Onymous”.
Ulbricht was convicted of eight charges related to Silk Road in U.S. Federal Court in Manhattan and was sentenced to life in prison without possibility of parole.

History 

Silk Road was founded in February 2011.[15] The name "Silk Road" comes from a historical network of trade routes started during the Han Dynasty (206 BC – 220 AD) between Europe, India, China, and many other countries on the Afro-Eurasian landmass. Silk Road was operated by the pseudonymous "Dread Pirate Roberts" (named after the fictional character from The Princess Bride), who was known for espousing libertarian ideals and criticizing regulation.[3][16] Two other individuals were also closely involved in the site's growth and success, known as Variety Jones and Smedley.[17]
Henry Farrell, an associate professor of political science and international affairs at George Washington University, analyzed Silk Road in an essay for Aeon in 2015.[18] He noted that Ulbricht created the marketplace to function without government oversight but found it difficult to verify anonymous transactions. To sustain a steady stream of revenue, he started increasing oversight to ensure low transaction costs. To do this, he added measures to ensure trustworthiness with implementation of an automated escrow payment system and automated review system.
In June 2011, Gawker published an article about the site[19] which led to "Internet buzz"[15] and an increase in website traffic.[7] Once the site was known publicly, U.S. Senator Charles Schumer asked federal law enforcement authorities to shut it down, including the Drug Enforcement Administration (DEA) and Department of Justice.[20]
In February 2013, an Australian cocaine and MDMA ("ecstasy") dealer became the first person to be convicted of crimes directly related to Silk Road, after authorities intercepted drugs that he was importing through the mail, searched his premises, and discovered his Silk Road alias in an image file on his personal computer.[21] Australian police and the DEA have targeted Silk Road users and made arrests, albeit with limited success at reaching convictions.[19][22][23] In December 2013, a New Zealand man was sentenced to two years and four months in jail after being convicted of importing 15 grams of methamphetamine that he had bought on Silk Road.[24]
In May 2013, Silk Road was taken down for a short period of time by a sustained DDoS attack.[25] On 23 June 2013, it was first reported that the DEA seized 11.02 bitcoins, then worth $814, which the media suspected was a result of a Silk Road honeypot sting.[26][27][28]
The FBI has claimed that the real IP address of the Silk Road server was found via data leaked directly from the site's CAPTCHA,[29] but security researchers believe that the PHP login page was manipulated to output its $_SERVER variable and real IP following site maintenance reconfiguration.[30]

 

Arrest and trial of Ross Ulbricht

Image placed on original Silk Road after seizure of property by the FBI
Impact of the seizure on the USD/Bitcoin exchange rate
Ross Ulbricht was alleged by the FBI to be the founder and owner of Silk Road and the person behind the pseudonym "Dread Pirate Roberts" (DPR). He was arrested on 2 October 2013 in San Francisco[11][31][32][33] at 3:15 p.m. PST[34] in Glen Park Library, a branch of the San Francisco Public Library.[34]
Ulbricht was indicted on charges of money laundering, computer hacking, conspiracy to traffic narcotics,[34][35] and attempting to have six people killed.[36] Prosecutors alleged that Ulbricht paid $730,000 to others to commit the murders, although none of the murders actually occurred.[36] Ulbricht ultimately was not prosecuted for any of the alleged murder attempts.[37]
The FBI initially seized 26,000 bitcoins from accounts on Silk Road, worth approximately $3.6 million at the time. An FBI spokesperson said that the agency would hold the bitcoins until Ulbricht's trial finished, after which the bitcoins would be liquidated.[38] In October 2013, the FBI reported that it had seized 144,000 bitcoins, worth $28.5 million, and that the bitcoins belonged to Ulbricht.[39] On 27 June 2014, the U.S. Marshals Service sold 29,657 bitcoins in 10 blocks in an online auction, estimated to be worth $18 million at current rates and only about a quarter of the seized bitcoins. Another 144,342 bitcoins were kept which had been found on Ulbricht's computer, roughly $87 million.[40] Tim Draper bought the bitcoins at the auction with an estimated worth of $17 million, to lend them to a bitcoin start-up called Vaurum which is working in developing economies of emerging markets.[41]
Ulbricht's trial began on 13 January 2015 in Federal Court in Manhattan.[42] At the start of the trial, Ulbricht admitted to founding the Silk Road website, but claimed to have transferred control of the site to other people soon after he founded it.[43] Ulbricht's lawyers contended that Dread Pirate Roberts was really Mark Karpelès, and that Karpelès set up Ulbricht as a fall guy.[44] However, Judge Katherine B. Forrest ruled that any speculative statements regarding whether Karpelès or anyone else ran Silk Road would not be allowed, and statements already made would be stricken from the record.[45]
In the second week of the trial, prosecutors presented documents and chat logs from Ulbricht's computer that, they said, demonstrated how Ulbricht had administered the site for many months, which contradicted the defense's claim that Ulbricht had relinquished control of Silk Road. Ulbricht's attorney suggested that the documents and chat logs were planted there by way of BitTorrent, which was running on Ulbricht's computer at the time of his arrest.[45]
On 4 February 2015, the jury convicted Ulbricht of seven charges,[14] including charges of engaging in a continuing criminal enterprise, narcotics trafficking, money laundering, and computer hacking. He faced 30 years to life in prison.[1][2] The government also accused Ulbricht of paying for the murders of at least five people, but there is no evidence that the murders were actually carried out, and the accusations never became formal charges against Ulbricht.[46][47]
During the trial, Judge Forrest received death threats. Users of an underground site called The Hidden Wiki posted her personal information there, including her address and Social Security number. Ulbricht's lawyer Joshua Dratel said that he and his client "obviously, and as strongly as possible, condemn" the anonymous postings against the judge. "They do not in any way have anything to do with Ross Ulbricht or anyone associated with him or reflect his views or those of anyone associated with him", Dratel said.[48]
In late March 2015, a criminal complaint issued by the United States District Court for the Northern District of California led to the arrest of two former federal agents who had worked undercover in the Baltimore Silk Road investigation of Ulbricht, former Drug Enforcement Administration agent Carl Mark Force IV and Secret Service agent Shaun Bridges.[49][50] The agents are alleged to have kept funds that Ulbricht transferred to them in exchange for purported information about the investigation.[49][51] The agents were charged with wire fraud and money laundering.[52] In late November 2016, Ulbricht's lawyers brought forward a case on a third DEA agent, who they claim was leaking information about the investigation and tampered with evidence to omit chat logs showing conversations with him.[53]
On March 15, 2015, director/screenwriter Alex Winter debuted at the South by Southwest Film Festival a movie based on Silk Road. Deep Web gives the inside story of the arrest of Ross Ulbricht.[54]
In a letter to Judge Forrest before his sentencing, Ulbricht stated that his actions through Silk Road were committed through libertarian idealism and that "Silk Road was supposed to be about giving people the freedom to make their own choices" and admitted that he made a "terrible mistake" that "ruined his life".[55][56] On May 29, 2015, Ulbricht was given five sentences to be served concurrently, including two for life imprisonment without the possibility of parole.[57] He was also ordered to forfeit $183 million. Ulbricht’s lawyer Joshua Dratel said that he would appeal the sentencing and the original guilty verdict.[46]. On May 31, 2017, the United States Court of Appeals for the Second Circuit denied Ulbricht's appeal, and affirmed the judgment of conviction and life sentence, in a written opinion authored by the Honorable Gerard E. Lynch, United States Circuit Judge. [58]

 

Products

In March 2013, the site had 10,000 products for sale by vendors, 70% of which were drugs.[19][65] In October 2014, there were 13,756 listings for drugs, grouped under the headings stimulants, psychedelics, prescription, precursors, other, opioids, ecstasy, dissociatives, and steroids/PEDs.[7][15][66][67] Fake driver's licenses were also offered for sale.[68] The site's terms of service prohibited the sale of certain items. When the Silk Road marketplace first began the creator and administrators instituted terms of service that prohibited the sale of anything whose purpose was to "harm or defraud".[15][69] This included child pornography, stolen credit cards, assassinations, and weapons of any type; other darknet markets such as Black Market Reloaded gained user notoriety because they were not as restrictive on these items as the Silk Road incarnations were.[65][70] There were also legal goods and services for sale, such as apparel, art, books, cigarettes, erotica, jewelery, and writing services. A sister site, called "The Armory", sold weapons (primarily guns) during 2012, but was shut down because of a lack of demand.[71][72]
Buyers were able to leave reviews of sellers' products on the site, and in an associated forum where crowdsourcing provided information about the best sellers and worst scammers.[73] Most products were delivered through the mail, with the site's seller's guide instructing sellers how to vacuum-seal their products to escape detection.[74]

Sales

A flowchart depicting Silk Road's payment system. Exhibit 113 A, entered into evidence at Ulbricht's trial.
Based on data from 3 February 2012 to 24 July 2012, an estimated $15 million in transactions were made annually on Silk Road.[75][76] Twelve months later, Nicolas Christin, the study's author, said in an interview that a major increase in volume to "somewhere between $30 million and $45 million" would not surprise him.[77] Buyers and sellers conducted all transactions with bitcoins (BTC), a cryptocurrency that provides a certain degree of anonymity.[78] Silk Road held buyers' bitcoins in escrow until the order had been received and a hedging mechanism allowed sellers to opt for the value of bitcoins held in escrow to be fixed to their value in US$ at the time of the sale to mitigate against Bitcoin's volatility. Any changes in the price of bitcoins during transit were covered by Dread Pirate Roberts.[79]
The complaint published when Ulbricht was arrested included information the FBI gained from a system image of the Silk Road server collected on 23 July 2013. It noted that, "From February 6, 2011 to July 23, 2013 there were approximately 1,229,465 transactions completed on the site. The total revenue generated from these sales was 9,519,664 Bitcoins, and the total commissions collected by Silk Road from the sales amounted to 614,305 Bitcoins. These figures are equivalent to roughly $1.2 billion in revenue and $79.8 million in commissions, at current Bitcoin exchange rates...", according to the September 2013 complaint, and involved 146,946 buyers and 3,877 vendors.[11] This statement was made to emphasize the importance of the operation, because in the years 2011-2013 the value of 9,519,664 Bitcoins was $0.2 billion.[80] According to information users provided upon registering, 30 percent were from the United States, 27 percent chose to be "undeclared", and beyond that, in descending order of prevalence: the United Kingdom, Australia, Germany, Canada, Sweden, France, Russia, Italy, and the Netherlands. During the 60-day period from 24 May to 23 July, there were 1,217,218 messages sent over Silk Road's private messaging system.[11]

Please follow below link for more and about silk road 2.0

Go through this link for Another Famous Darkweb Drug Market AlphaBay

Thursday 22 June 2017

wikileaks-Brutal-Kangaroo-airgap-malware





WikiLeaks has published a new batch of the ongoing Vault 7 leak, this time detailing a tool suite – which is being used by the CIA for Microsoft Windows that targets "closed networks by air gap jumping using thumb drives," mainly implemented in enterprises and critical infrastructures.

Air-gapped computers that are isolated from the Internet or other external networks are believed to be the most secure computers on the planet have become a regular target in recent years.

Dubbed Brutal Kangaroo (v1.2.1), the tool suit was allegedly designed by the Central Intelligence Agency (CIA) in year 2012 to infiltrate a closed network or air-gapped computer within an organization or enterprise without requiring any direct access.
The previous version of Brutal Kangaroo was named as EZCheese, which was exploiting a vulnerability that was zero-day until March 2015, though the newer version was using "unknown link file vulnerability (Lachesis/RiverJack) related to the library-ms functionality of the operating system."

Here's How the Air-Gap Attack Works


Like most air-gapped malware techniques we reported on The Hacker News, this hacking tool first infects an Internet-connected computer within the target organization and then installs the Brutal Kangaroo malware on it.

Infecting USB Drive

Even if it's hard to reach an Internet-connected PC within the target organisation, they can infect a computer of one of the organisation's employees and then wait for the employee to insert the USB drive into his/her computer.
 


Now, as soon as a user (the employee of the organisation) inserts a USB stick into the infected computer, Shattered Assurance, a server tool infects the USB drive with a separate malware, called Drifting Deadline (also known as 'Emotional Simian' in the latest version).
The USB drive infects with the help of a flaw in the Microsoft Windows operating system that can be exploited by hand-crafted link files (.lnk) to load and execute programs (DLLs) without user interaction.

"The .lnk file(s) must be viewed in windows explorer, and the tool will be auto-executed without any further input." the manual says.

When the infected USB drive is used to share data with air-gapped computers, the malware spreads itself to those systems as well.

    "If multiple computers on the closed network are under CIA control, they form a covert network to coordinate tasks and data exchange. Although not explicitly stated in the documents, this method of compromising closed networks is very similar to how Stuxnet worked," WikiLeaks said.

    "Brutal Kangaroo components create a custom covert network within the target closed network and providing functionality for executing surveys, directory listings, and arbitrary executables," a leaked CIA manual reads.
The malware then starts collecting data from infected air-gapped computers (which utilizes Shadow, the primary persistence mechanism) covertly and a module within the Brutal Kangaroo suit, dubbed "Broken Promise," analyzes the data for juiceful information.

Previous Vault 7 CIA Leaks

Last week, WikiLeaks dumped an alleged CIA framework used for monitoring the Internet activity of the targeted systems by exploiting vulnerabilities in Wi-Fi devices.

Dubbed "Cherry Blossom," the framework was basically a remotely controllable firmware-based implant for wireless networking devices, including routers and wireless access points (APs), which exploits router vulnerabilities to gain unauthorized access and then replace the firmware with custom Cherry Blossom firmware.

Since March, the whistleblowing group has published 12 batches of "Vault 7" series, which includes the latest and last week leaks, along with the following batches:


  •     Pandemic – a CIA's project that allowed the agency to turn Windows file servers into covert attack machines that can silently infect other computers of interest inside a targeted network.
  •     Athena – a spyware framework that has been designed to take full control over Windows PCs remotely, and works against every version of Microsoft's Windows operating systems, from Windows XP to Windows 10.
  •     AfterMidnight and Assassin – Two apparent CIA malware frameworks for the Windows platform that has been designed to monitor and report back activities of the infected remote host computer and execute malicious actions.
  •     Archimedes – Man-in-the-Middle attack tool allegedly created by the CIA to target computers inside a Local Area Network (LAN).
  •     Scribbles – Software reportedly designed to embed 'web beacons' into confidential files and documents, allowing the agency to track whistleblowers and insiders.
  •     Grasshopper – A framework which allowed the agency to easily create custom malware for breaking into Windows operating system and bypassing antivirus protection.
  •     Marble – The source code of a secret anti-forensic framework, basically an obfuscator or a packer used by the spying agency to hide the actual source of its malware.
  •     Dark Matter – Revealed hacking exploits the CIA designed to target iPhones and Macs.
  •     Weeping Angel – A spying tool used by the CIA to infiltrate smart TV's and then transform them into covert microphones.
  •     Year Zero – Disclosed several CIA hacking exploits for popular hardware and software

The malware then starts collecting data from infected air-gapped computers (which utilizes Shadow, the primary persistence mechanism) covertly and a module within the Brutal Kangaroo suit, dubbed "Broken Promise," analyzes the data for juiceful information.

Previous Vault 7 CIA Leaks


Last week, WikiLeaks dumped an alleged CIA framework used for monitoring the Internet activity of the targeted systems by exploiting vulnerabilities in Wi-Fi devices.

Dubbed "Cherry Blossom," the framework was basically a remotely controllable firmware-based implant for wireless networking devices, including routers and wireless access points (APs), which exploits router vulnerabilities to gain unauthorized access and then replace the firmware with custom Cherry Blossom firmware.

Since March, the whistleblowing group has published 12 batches of "Vault 7" series, which includes the latest and last week leaks, along with the following batches:


  • Pandemic – a CIA's project that allowed the agency to turn Windows file servers into covert attack machines that can silently infect other computers of interest inside a targeted network.
  • Athena – a spyware framework that has been designed to take full control over Windows PCs remotely, and works against every version of Microsoft's Windows operating systems, from Windows XP to Windows 10.
  • AfterMidnight and Assassin – Two apparent CIA malware frameworks for the Windows platform that has been designed to monitor and report back activities of the infected remote host computer and execute malicious actions.
  • Archimedes – Man-in-the-Middle attack tool allegedly created by the CIA to target computers inside a Local Area Network (LAN).
  • Scribbles – Software reportedly designed to embed 'web beacons' into confidential files and documents, allowing the agency to track whistleblowers and insiders.
  • Grasshopper – A framework which allowed the agency to easily create custom malware for breaking into Windows operating system and bypassing antivirus protection.
  • Marble – The source code of a secret anti-forensic framework, basically an obfuscator or a packer used by the spying agency to hide the actual source of its malware.
  • Dark Matter – Revealed hacking exploits the CIA designed to target iPhones and Macs.
  • Weeping Angel – A spying tool used by the CIA to infiltrate smart TV's and then transform them into covert microphones.
  • Year Zero – Disclosed several CIA hacking exploits for popular hardware and software.


Even if it's hard to reach an Internet-connected PC within the target organisation, they can infect a computer of one of the organisation's employees and then wait for the employee to insert the USB drive into his/her computer.

Now, as soon as a user (the employee of the organisation) inserts a USB stick into the infected computer, Shattered Assurance, a server tool infects the USB drive with a separate malware, called Drifting Deadline (also known as 'Emotional Simian' in the latest version).
WikiLeaks has published a new batch of the ongoing Vault 7 leak, this time detailing a tool suite – which is being used by the CIA for Microsoft Windows that targets "closed networks by air gap jumping using thumb drives," mainly implemented in enterprises and critical infrastructures.

Air-gapped computers that are isolated from the Internet or other external networks are believed to be the most secure computers on the planet have become a regular target in recent years.

Dubbed Brutal Kangaroo (v1.2.1), the tool suit was allegedly designed by the Central Intelligence Agency (CIA) in year 2012 to infiltrate a closed network or air-gapped computer within an organization or enterprise without requiring any direct access.

Wanna cry Ransom is Back Hits Honda & traffic cameras......

It's been over a month since the WannaCry ransomware caused chaos worldwide and people have started counting its name as 'the things of past,' but…

...WannaCry is not DEAD!

The self-spreading ransomware is still alive and is working absolutely fine.

The latest victims of WannaCry are Honda Motor Company and 55 speed and traffic light cameras in Australia.

The WannaCry ransomware shuts down hospitals, telecom providers, and many businesses worldwide, infecting over 300,000 Windows systems running SMBv1 in more than 150 countries within just 72 hours on 12th of May.
The worm was leveraging an NSA's Windows SMB exploit, dubbed EternalBlue, leaked by the infamous hacking group Shadow Brokers in its April data dump, along with other Windows exploits.

Honda Stops Production After WannaCry Hits its Computer


Honda Motor Company released a statement this week, saying the company was forced to halt its production for more than 24 hours at in one of its Japan-based factories after finding the WannaCry infections in its computer networks.

The automaker halted production of more than 1,000 at its Sayama plant, northwest of Tokyo, on Monday 19th June after it discovered that the ransomware had affected networks across Japan, North America, Europe, China, and other regions despite its efforts to secure systems in mid-May, according to a Wednesday report from Reuters.

While Honda did not say how WannaCry got into their networks 37 days after a researcher activated the kill switch, it's clear that the computers inside the Honda network were running unsupported versions of Windows OS or it did not install a highly critical patch released by Microsoft in March.

The Honda's Sayama plant, which produces the Accord sedan, Odyssey Minivan, Step Wagon compact multipurpose vehicle and more, produces around 1,000 vehicles per day.

Renault and Nissan were also infected by the WannaCry ransomware last month, which also forced them to temporarily stop their production at plants in Britain, India, Japan, France, and Romania.

WannaCry Hits 55 Traffic-Light and Speed Cameras in Australia

Another recent WannaCry victim was spotted in Australia when the Victoria Police confirmed that the ransomware infected a total of 55 red light cameras and speed cameras in Victoria via private camera operator Redflex.

The malware locked down critical files and demanded a ransom in return (WannaCry usually demands $300 to unlock files), according to the 3AW morning radio show.

    "A system patch has been applied, which prevents the spread of the virus," the officials told the show. "The Department is in the process of removing the [WannaCry] virus from the affected cameras. The remaining websites will be rectified in the next couple of days."

The authorities believed the infection was the result of a targeted cyber attack, rather than 'human error,' likely on the part of a camera technician, and that WannaCry got onboard via a USB drive.

    "Our advice at this stage is that a software virus has been detected however the camera system has not been compromised," the police said. "We will look into all incidents detected by the speed and red light cameras during the time in question as a matter of course. The integrity of the camera system has not been affected."

Well, it is quite surprising that even after knowing about the WannaCry issue for quite a decent amount of time, big companies have not yet implemented proper security measures to defend against the threat.

Ransomware has become an albatross around everyone's neck. Recently, a South Korean web hosting provider confirmed that the company had paid a record $1 Million ransom to hackers in return of its data following a ransomware attack over the weekend.

In cyberspace, Ignorance is not bliss. So, go and apply the goddamn patches and disable the unsecured, 30-year-old SMBv1 file-sharing protocol on your systems.
It's been over a month since the WannaCry ransomware caused chaos worldwide and people have started counting its name as 'the things of past,' but…
It's been over a month since the WannaCry ransomware caused chaos worldwide and people have started counting its name as 'the things of past,' but…
It's been over a month since the WannaCry ransomware caused chaos worldwide and people have started counting its name as 'the things of past,' but…
It's been over a month since the WannaCry ransomware caused chaos worldwide and people have started counting its name as 'the things of past,' but…
It's been over a month since the WannaCry ransomware caused chaos worldwide and people have started counting its name as 'the things of past,' but…