7/30/2013 Analisis Clickjacking

Recientemente en uno de los grupos que sigo en facebook me sorprendio ver  que una de las personas mas serias que conozco del grupo habia realizado una publicacion,como la siguiente:

Efectivamente  esto no era obra de esa persona, si no que habia sido parte de un clickjacking.

clickjacking, where hidden actions are executed when you click on a button or link in plain sight.

Yo por curiosidad decidí seguirle el paso a este link,imaginando desde el principio una actividad maliciosa,previendo  que me iba  a encontrar al final con la descarga de un .exe,o algo similar que me infectara la maquina,o el perfil,entonces como precaución cree una cuenta de prueba para probar dicha url.

Esta url me llevaba  al traductor de microsoft seguramente para saltrar los filtros de url en facebook.


Enlace url sin unshorten.


Acortador utilizado para malware spreading

Lo ultimo que se  realizaba era la redireccion a un sitio con esta apariencia,en el cual se pedia una confirmacion, que era copiar la url(que persona haria eso para ver un supuesto video de porno de shakira !!)







Al momento de realizar la correcta verificacion parecia no suseceder nada, sin embarga si abrimos nuestro ChromeDevtool observamos :






Y despues de todo el script de la url nos posteaba algo en el muro con un string generado aleatoriamente pero utilizando el mismo acortador y la misma tecnica del traductor,ademas automaticamente le daba un like a tres sitios web de memes , y le daba follow a estas tres personas, al final los numeros son aterradores con 38 mil y 90mil personas siguiendo a tres cuentas falsas que distribuyen malware,venden likes y demas en facebook.





Digg it StumbleUpon del.icio.us

7/19/2013 Identity theft[Video]



Identity theft is a form of stealing someone's identity in which someone pretends to be someone else by assuming that person's identity, typically in order to access resources or obtain credit and other benefits in that person's name. The victim of identity theft (here meaning the person whose identity has been assumed by the identity thief) can suffer adverse consequences if they are held accountable for the perpetrator's actions. Identity theft occurs when someone uses another's personally identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes.
The term identity theft was coined in 1964[1] however it is not literally possible to steal an identity—less ambiguous terms are identity fraud or impersonation.


Digg it StumbleUpon del.icio.us

7/05/2013 THE CYPHERNOMICON


THE CYPHERNOMICON: Cypherpunks FAQ and More, Version 0.666, 1994-09-10, Copyright Timothy C. May. All rights reserved. See the detailed disclaimer. Use short sections under "fair use" provisions, with appropriate credit, but don't put your name on my words. 1994-09-10, Copyright Timothy C. May. All rights reserved. See the detailed disclaimer. Use short sections under "fair use" provisions, with appropriate credit, but don't put your name on my words.
http://www.spinnaker.com/crypt/cyphernomicon/CP-FAQ
Digg it StumbleUpon del.icio.us

7/03/2013 Introducing sources.debian.net

sources.debian.net is a new service[1] that allows browsing the source
code of Debian packages on the web with syntax highlighting,search through the source code ,with the possibility of adding contextual pop-up messages . It is updated and contains source code for all suites in the Debian archive. It currently uses around 381 GB of disk space for uncompressed source packages and around 83 GB for the source package  mirror. It is integrated into codesearch.d.n and the PTS. It was created  by Stefano Zacchiroli and the web front-end was written by Matthieu Caneill.


sources.d.nfollows closely the Debian archive in two ways:
  1. it is updated 4 times a day to reflect the content of the Debian archive
  2. it contains sources coming from official Debian suites: the usual ones (from oldstable to experimental),*-updates (ex volatile), *-proposed-updates, and *-backports (from Wheezy on)
Ensayando sources.debian.net en Osiris


 [1] http://bits.debian.org/2013/07/introducing_sources.debian.net.html
Digg it StumbleUpon del.icio.us