macOS High Sierra’s App Store System Can be Unlocked by Any Password

New bug discovered in macOS High Sierra allows unlocking the App Store System Preferences by any password.

App Store System Preferences accept any password when system logged in with local admin Privilege.

This could be very dangerous if anyone already has your system permission and they can able to download any apps, modifying the apps store setting, also they can disable auto update for future macOS update.

Read : GBHackers

Security Flaws Identified in WhatsApp Could Allow Attackers to Spy on Group Chats

End-to-end encryption is the major security feature of secure instant messengers, among the most popular one is WhatsApp having more than one billion users.

Security researchers discovered vulnerabilities with Whatsapp and Signal which allows an attacker to add themselves to the group chat. But the risk associated with the attack is limited.

Read: GBhackers

New Programming Language “Kotlin” used for Developing an Android Malware

An Open-source Programming language “kotlin” has bee used to develop malicious Android apps that are capable of hijacking an Android mobile and as a similar malicious Android app called Swift Cleaner has discovered in Google Play store.

In May 2017 Google announced kotlin Programming language to Develop an Android application and the Android team has seen more than 17 percent of Android Studio projects use Kotlin.

Read : GBhackers

Phishing Campaign Targeting Companies Associated with Pyeongchang Olympics

Security researchers from McAfee spotted a Phishing campaign targeting companies associated with Pyeongchang Olympic 2018.The multi-sport event is to take place in South Korea.

Hackers primarily targetted icehockey@pyeongchang2018.com and several other Korean companies in BCC.And most of them associated in some way to Pyeongchang Olympic.

READ: GBHACKERS

Cracking WPA/WPA2 Passwords in Minutes with Fluxion

Fluxion repack of LINSET with minor bugs and with added features. It’s compatible with latest Kali Linux, Rolling Edition.

What is WPA/WPA2?

WPA: WPA defined as Wi-Fi Protected Access, is a security standard for users of devices with Wireless Internet Connection. WAP is the one replaced the original Wi-Fi security standard, Wired Equivalent Privacy (WEP).WPA provides more revealing data encryption than WEP.

Read more : GBHackers

fsociety a Complete Hacking Tools pack that a Hacker Needs – Penetration Testing Framework

fsociety is a penetration testing framework consists of all penetration testing tools that a hacker needs. It includes all the tools that involved in the Mr. Robot Series.The tool consist of a huge tools list starting form Information gathering to Post Exploitation.

Information gathering is a solid phase for every penetration testing, the package covers following tools Nmap, Setoolkit Port Scanning, Host To IP, WordPress user, CMS scanner, XSStrike, Dork

Read More: GBHackers On Security

Chrome Extension Caught Silently Mining CryptoCurrency without Users Knowledge

Cryptocurrency Miners are in the raise starting from last year, more than 500 millioncomputers are mining cryptoCurrency in their browsers without the user’s knowledge and now the chrome extension Archive Poster.

Now even the Chrome extension started mining cryptocurrency now, a chrome extension Archive Poster with more than 105,000 users Caught injecting an in-browser cryptocurrency miner.

ReadMore: GBHackers On Security

Web Trackers Exploit Browser Password Managers and Steal Login Information From Browser

A known browser vulnerability exploits the default browser Password manager that abused by third-party scripts and exfiltrate the hidden user identities.

An attacker can be successfully gaining the information by tracking script that inserts an invisible login form in the user visiting website that is automatically filled by browser login manager.

Source: GBHackers

Three more Malicious Backdoored plugins with More than 89,000 Active Installs found in WordPress Repository

WordPress has such a massive ecosystem consist of a number of plugins and themes, threat actors involved in various malicious activities such as hiding the PHP backdoor scripts into the WordPress Security Plugin.

In this incident, the attackers sell existing unsupported plugins to new authors with backdoor code inserted and their goal is to insert SEO spam to the sites with the plugin installed.

Read More on GBHackers

USB Forensics – Reconstruction of Digital Evidence from USB Drive

Digitial Forensics analysis of USB forensics include preservation, collection, Validation,
Identification, Analysis, Interpretation, Documentation, and Presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal.

Disk Imaging – USB Forensics:-

• A Disk Image is defined as a computer file that contains the contents and structure of a data storage device such as a hard drive, CD drive, phone, tablet, RAM, or USB.
• The disk image consists of the actual contents of the data storage device, as well as the information necessary to replicate the structure and content layout of the device.
• However Wide ranging of well-known tools is used according to the court of law to perform the analysis.
• Standard tools are solely authorized as per law, Forensics examiners are disallowed to perform Imaging with Unknown Tools, New Tools.
• Standard Tools: Encase Forensic Imager and its extension (Imagename.E01)
  Forensic Toolkit Imaging & Analysis:
• Since Encase forensic software cost around $2,995.00 – $3,594.00, So In this Imaging and analysis will be performed with FTK Forensic software made by AccessData.
• FTK Includes standalone disk imager is simple but concise Tool.

Read Full article: GBHackers on security

Edward Snowden Privacy Protection app turns your Android phone Into A Security System

Edward Snowden privacy protection app Haven turns your Android phone into a motion, sound, vibration and light detector, watching for unexpected guests and unwanted intruders.

App once installed, use your smartphone’s sensors microphone, motion detector, the light detector, and the cameras — to monitor the room for changes, and it logs everything it notices.

READ GBHACKERS ON SECURITY

InSpy – Linkedin Information Gathering tool for Pentesters

The objective of this Information Gathering tool is to extract Linkedin users based on the organization, job description or email address.InSpy was written in python by gojhonny.

Multiple Functionalities

• TechSpy
• EmpSpy

TechSpy – Crawls LinkedIn job listings for technologies used by the provider company. It attempts to identify technologies by matching job descriptions to keywords from a new line delimited file.

READ More: GBHackers On Security

Email Spoofing – Exploiting Open Relay configured Public Mailservers

Email spoofing is the way of delivering forged emails to recipients.These methods are used by criminals to launch attacks like phishing or spams to provide persistent backdoors with legitimate behavior.

Publicly available email servers can be used for spoofing attack.If you have configured your mail server with OPEN RELAY, this dangerous email spoofing attack can be performed by attackers.

READ: GBHackers On Security