Google Project Zero has disclosed the details of an iOS exploit that allows an attacker to hack iPhones remotely over Wi-Fi and steal sensitive data, with no user interaction. Researcher Ian Beer from the Google Project Zero team has revealed technical details of a critical “wormable” iOS bug that possibly allowed a remote attacker to […]
The post Google Discloses a zero-click Wi-Fi Exploit to Hack iPhone Devices (https://gbhackers.com/ios-zero-click-vulnerability/) appeared first on GBHackers On Security (https://gbhackers.com/).

Protect yourself from Fraudulent QR codes
https://blogs.quickheal.com/protect-yourself-from-fraudulent-qr-codes/

US Intelligence Director Says China is Top Threat to America
http://feedproxy.google.com/~r/Securityweek/~3/Yv9bI7ix-kA/us-intelligence-director-says-china-top-threat-america

China poses the greatest threat to America and the rest of the free world since World War II, outgoing National Intelligence Director John Ratcliffe said Thursday as the Trump administration ramps up anti-Chinese rhetoric to pressure President-elect Joe Biden to be tough on Beijing.
read more (https://www.securityweek.com/us-intelligence-director-says-china-top-threat-america)

Many Android Apps Expose Users to Attacks Due to Failure to Patch Google Library
http://feedproxy.google.com/~r/Securityweek/~3/W75f2mdePg0/many-android-apps-expose-users-attacks-due-failure-patch-google-library

A vulnerability in the Google Play Core Library continues to impact many applications several months after official patches were released.
The Google Play Core Library allows Android developers to deliver updates to their applications at runtime, via the Google API, without requiring interaction from the user.
read more (https://www.securityweek.com/many-android-apps-expose-users-attacks-due-failure-patch-google-library)

VMware Patches Workspace ONE Access Vulnerability Reported by NSA
http://feedproxy.google.com/~r/Securityweek/~3/9iG8mAki6lg/vmware-patches-workspace-one-access-vulnerability-reported-nsa

VMware on Thursday released patches for a Workspace ONE Access security flaw (https://www.securityweek.com/vmware-working-patches-critical-workspace-one-access-vulnerability)that was identified and reported by the National Security Agency (NSA).
read more (https://www.securityweek.com/vmware-patches-workspace-one-access-vulnerability-reported-nsa)

Even if the US government was able to shutdown every single #ETH node in the US, there would still remain about 8,000 nodes around the world, which is more than the total number of $ETH nodes we had a few months ago.

@Bitcoin_Ethereum_Trading

Google Launches XS-Leaks Vulnerability Knowledge Base
http://feedproxy.google.com/~r/Securityweek/~3/sM5E_XHmru4/google-launches-xs-leaks-vulnerability-knowledge-base

Google this week announced the launch of a knowledge base with information on a class of vulnerabilities referred to as cross-site leaks, or XS-Leaks.
read more (https://www.securityweek.com/google-launches-xs-leaks-vulnerability-knowledge-base)

As DNA Synthesis Evolves, Cyber-Physical Attack Worries Grow
https://www.darkreading.com/application-security/as-dna-synthesis-evolves-cyber-physical-attack-worries-grow/d/d-id/1339627?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Israeli scientists warn that cybersecurity around DNA synthesis devices needs improvement -- or else the industry risks harmful DNA produced through cyber means.

Android Pentest Lab Setup & ADB Command Cheatsheet
https://www.hackingarticles.in/android-pentest-lab-setup-adb-command-cheatsheet/

Introduction To learn android pentest in a much handier way we’ll be setting up Android Pentest environment in our own system rather than conducting an experiment on a live device. It is to be noted that these practicals can be conducted on a phone with USB debugging option on as well, but we’ll be using... Continue reading →
The post Android Pentest Lab Setup & ADB Command Cheatsheet (https://www.hackingarticles.in/android-pentest-lab-setup-adb-command-cheatsheet/) appeared first on Hacking Articles (https://www.hackingarticles.in/).

NSA Warns of Exploits Targeting Recently Disclosed VMware Vulnerability
https://www.darkreading.com/threat-intelligence/nsa-warns-of-exploits-targeting-recently-disclosed-vmware-vulnerability/d/d-id/1339632?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Agency urges organizations to deploy patch as soon as possible since exploit activity is hard to detect.

ADSearch : A Tool To Help Query AD Via The LDAP Protocol
https://kalilinuxtutorials.com/adsearch/

ADSearch is a tool written for cobalt-strike’s execute-assembly command that allows for more efficent querying of AD. Key Features List all Domain Admins Custom LDAP Search Connect to LDAPS Servers Output JSON data from AD instances Retrieve custom attributes from a generic query (i.e. All computers) Usage ADSearch 1.0.0.0Copyright c 2020USAGE:Query Active Directory remotely or […]
The post ADSearch : A Tool To Help Query AD Via The LDAP Protocol (https://kalilinuxtutorials.com/adsearch/) appeared first on Kali Linux Tutorials (https://kalilinuxtutorials.com/).

The Line Between Physical Security & Cybersecurity Blurs as World Gets More Digital
https://www.darkreading.com/physical-security/the-line-between-physical-security-and-cybersecurity-blurs-as-world-gets-more-digital/a/d-id/1339611?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Security teams are being challenged by the connected nature of IP devices, and preventing them from being compromised by cybercriminals has become an essential part of keeping people and property safe.

Microsoft Details Plans to Improve Security of Internet Routing
http://feedproxy.google.com/~r/Securityweek/~3/KiWCJoa7P9A/microsoft-details-plans-improve-security-internet-routing

Microsoft this week shared details on the steps it will take in an effort to ensure improved security for Internet routing.
read more (https://www.securityweek.com/microsoft-details-plans-improve-security-internet-routing)

DarkSide : Tool Information Gathering And Social Engineering
https://kalilinuxtutorials.com/darkside/

DarkSide is a tool with an awesome user interface. Features Hacker Dashboard Hacker News [thehackernews.com/] New Exploits [Exploit-db.com] Hacking Tutorials Video [youtube.com] The Latest Prices OF Digital Currencies [Rials , Usd] Information Gathering Bypass Cloud Flare Cms Detect Trace Toute Reverse IP Port Scan IP location Finder Show HTTP Header Find Shared DNS Whois DNS […]
The post DarkSide : Tool Information Gathering And Social Engineering (https://kalilinuxtutorials.com/darkside/) appeared first on Kali Linux Tutorials (https://kalilinuxtutorials.com/).

What IP – A Network Information Tool for Linux
https://www.tecmint.com/whatip-show-linux-network-information/

Application-Level Linux Firewall OpenSnitch 1.3.0 Adds A Process Details Dialog, GUI RPM Packages - Linux Uprising Blog
https://www.linuxuprising.com/2020/12/application-level-linux-firewall.html

How do I use Docker and Dropbox to run multiple instances?

Apr 19, 2019 • RetroMe


Settin Up Docker And Dropbox

Shivam Kapoor created an excellent blog post on how to setup Dropbox using Docker to allow multiple instances to function on a system. I made some minor changes and used this to setup a laptop so I can work with multiple copies of Dropbox without issue.

How To

Install Docker.

$ sudo pacman -S docker

Use your package manager to install Docker.

Setup your user.

$ sudo usermod -aG docker $USER

Setup your user by adding them to the docker group. This is so you don’t have to use sudo to work with Docker.

Get the Docker Image

$ docker pull janeczku/dropbox

User janeczku created a docker image that runs dropbox. Review the code yourself.

Create the Docker Machine and the volume

$ docker run -d --restart=always --name=RENAMETHIS -v /home/aaronj/Dropbox:/dbox/Dropbox -v /home/aaronj/.dropbox:/dbox/.dropbox -e DBOX_UID=1000 -e DBOX_GID=1000 janeczku/dropbox

You need to edit the name of the machine, the locations you want to use for the volumes, and the UID/GID so you don’t run into permissions issues. If your user is aaronj you would do cat /etc/passwd | grep "aaronj" and use the UID/GID displaye so you don’t run into permissions issues. If your user is aaronj you would do cat /etc/passwd | grep "aaronj" and use the UID/GID displayed.

Register the Docker Account

$ docker logs RENAMETHIS

Look for a line that says something like -

https://www.dropbox.com/cli_link_nonce?nonce=612531228134bf411986991sdd4d69438

Click it and login to register your Dropbox account with that container.

Restart the docker machine

$ docker restart RENAMETHIS

Wait for the box to sync.

Fix the file permissions.

$ sudo chmod 755 /home/aaronj/Dropbox -R $ sudo chmod g+s /home/aaronj/Dropbox -R $ sudo chown aaronj:aaronj /home/aaronj/Dropbox -R

This resolved my issue and with the laptop being a single user system, I am unconcerned about the permissiveness of the settings because my system is a single user box with disk encryption. You may want to write a cron to restart the box every 10-15 minutes as well. The Dropbox daemon seems to have some issues within the container and it helps to just restart the container.

Troubleshooting

How do I restart my dropbox machine?

$ docker container ls

You will want to find the name of the container you need.

Then restart the machine.

$ docker restart NAMEOFTHEMACHINE

This usually solves the issue. You can also create a cronjob that restarts regularly to solve any issues off the bat.

$ sudo crontab -s # Edit the crontab to look like this - # This restarts the container every 10 minutes. Edit this as you see fit. */10 * * * * /usr/bin/docker restart RENAMETHIS

Introduction To Mesh Networks



Performance Objective
Introduction
PirateBox Goals
File Sharing And Messaging
Education
Privacy
Open Standards
Development
Deployment
Dead Drops
Emergency Operations
Meetups
Answers
Conclusion
Final Recommendations

Performance Objective

At the conclusion of the course the student will be able to:

Identify what a mesh network is.

Identify how a mesh network can be employed during an emergency.

Identify what the PirateBox project is.

Describe one feature that the PirateBox provides.

Introduction

A wireless mesh network or (WMN) is a method of creating a network for communication that is composed of radio nodes that act in an ad hoc manner. The average WMN will consit of clients, routers, and gateways that allow the devices connected to the network to communicate with each other. This is usually designed to work without any kind of centralized infrastructure that would prevent communication if any one node were to disappear. However, on smaller networks it is possible that the inoperability of a single device could cease communications for all members involved. This is likely when deploying a PirateBox for communication. If you have a single PirateBox and that PirateBox fails, you will quickly find yourself without a means to communicate.

The normal internet functions by providing a centralized infrastructure that is designed to ferry data and information around the globe at high speeds. It is also useful for allowing people to monitor and spy on every individual using that infrastructure. This spying can take the form of capturing of packets and reading the exact information being sent or it can include more esoteric spying such as the passing of digital fingerprints and measuring traffic to make a best guess as to the content of the traffic itself.

PirateBox can be used to spy on traffic but the spirit of the device and the intention in which it is deployed reduces that possibility. A PirateBox creates a very small and local network that can be accessed by present parties to share information and foster digital communication. Similar to the bulletin board systems of days gone past, the PirateBox is tool that can enhance local communication and to foster discussion within small communities.
PirateBox Goals

Reproduced without permission, the below list contains the stated goals of the PirateBox project.

PirateBox provides easy file sharing and messaging over a local area network.

PirateBox is designed to educate the public and make them aware about online censorship, surveillance, and freedom of speech.

PirateBox truly respects privacy and thus does not collect any access or connection logs from its users.

PirateBox has an educational purpose and aims to teach about computer programming and computer networks.

PirateBox network (AP) should be open, and use open networking standards to allow communication with other users.

File Sharing And Messaging

File sharing and messaging are extremely important to anyone who has any amount of experience with the internet. The ability to relay data and information with rapidity is vital when dealing with emergencies or even with something as simple as requesting homework help. The internet itself lives on the vital life force of files and text that is pumped between device on the network.

PirateBox fosters file sharing and messaging through the inclusion of a simple browser based application that exposes file sharing, chat, and an image board to users who connect to the PirateBox network. This behavior is the core of the PirateBox user interface and is vital for encouraging the use of the device.
Education

PirateBox has a stated goal of educating the public on censorship, surveillance, and freedom of speech. Education of the public is vitally important. PirateBox is an excellent conversation piece and demonstration of how a free and open internet can function and is an excellent tool for gener

ating discussion on topics that the public may have difficulty even asking.

PirateBox is also beneficial in that it encourages tinkering and exploration. Users who deploy a PirateBox may look for ways to improve the project or to find alternatives that better fit their use case scenario. Can I improve connectivity by adding new antennas? Deploying more devices? Adding a method to support different types of encryption for different layers of use? All of these questions could come up and users might look for answers.
Privacy

Internet surveillance is a topic that raises serious concern for both law enforcement as well as citizenry. The public perception of law enforcement is that they should be able to solve crimes, stop crimes, resolve issues after crimes have occurred, and do all of this without ever making a mistake or causing an issue. They must also do all of this without ever glancing at anything that others have done or posted online and must respect the privacy of all peoples but must also stop terrorists from conducting attacks and organizing online. Internet based surveillance is not going away and will continue to grow thanks to the number of always connected online enabled devices that exist in homes and on persons nearly everywhere.

Some individuals seem to believe that they have a right to privacy when they share their information because there is a continued notion that companies like Facebook, Twitter, or Reddit have your best interests. This is false. These companies use you as a product that they distill, condense, package, and sell for a profit while expecting you to constantly produce content for them to data mine. Every thing you upload to the internet through these companies should be considered compromised by every government, institution, group, and person on this planet.

PirateBox removes you from the digital data mining circle and encourages you to develop your own methods of communication. You can operate independently of these companies and are encouraged to do so. If you wish to use a device in a manner in which only people you trust are allowed to communicate with you, you can.
Open Standards

Open Source is not Free Software. Richard Stallman states that open source software is released as a practical advantage that does not campaign for principles. Free software respects a users ability to run it, study it, change it, and to redistribute copies with or without changes. Open Standards are the policies and technology that exist in a non-proprietary manner while allowing any other device to be able to communicate if they too share in those open standards.

So does PirateBox profess to be free software friendly? No. It is an open source project that exists to use open standards. This means that devices that include proprietary drivers could potentially function. Is this good or bad? Neither. It is an ideology and a design choice based on practicality. PirateBox does not appear to be approved as Free Software Foundation friendly.

You can search for yourself at the FSF Directory.
Development

Development of the PirateBox is done using Github. The PirateBox teams keeps a large number of repositories available for your perusal and their website has excellent documentation on how to locate their projects. I recommend reviewing their development repositories to build your knowledge of how the device works, how to improve on it, and how to deploy your changes.
Deployment

Deployment of the PirateBox provides infinite possibilities. You can pretend to be a spy, setup a mesh LAN for your neighborhood, or provide an intranet for use during an emergency. The PirateBox is an awesome tool.

Dead Drops

Emergency Operations

Meetups

Dead Drops

The PirateBox allows for anonymous communication and file transfers between multiple parties. You can also use the device for chat or as a forum. This behavior is independent of the internet and does not require anything beyond normal WIFI networking tools to function. An individual could setup a PirateBox at a location, leave it connected to a battery

or other form of power, and allow individuals passing by to communicate with the device and leave messages or other data at their leisure that could be later retrieved.
Emergency Operations

The very nature of an emergency invariably means that the normal situation is no more and we may require tools like the PirateBox to communicate in a grid down or grid damaged event. Shelter standup could be conducted when there is no access to the internet and a tool like the PirateBox could be deployed to allow communication locally. Minor changes to the PirateBox could be made to provide an announcements tool allowing users to connect and view information being posted by emergency management personnel. This could include scheduling, orders, or lists of casualties updated in real time. The PirateBox can be upgraded to provide an amazing connection capability.
Meetups

The PirateBox could also be a fun tool to stand up during meetings or conventions. You can deploy the device and see who finds it and what they do with it. The very nature of the PirateBox will encourage interaction and sharing. Will someone attempt to upload malware? Photos of their pets? Or will they use it to spread discord or chaos? No way to know until you stand one up and wait and see what happens.
Answers

A mesh network is a method by which infrastructure is deployed to allow bridges, switches, and other devices to communicate directly and non-hierarchically as possible with each other.

A mesh network can be deployed during an emergency to allow computers and other devices to communicate with each other over a wireless connection when the grid is damaged or otherwise unavailable.

The PirateBox is an anonymous offline mobile file-sharing and communications system that can be deployed using off-the-shelf hardware and free software.

The PirateBox provides an image board as well as file sharing.

Conclusion

A mesh network is a vital tool for off grid communication and provides a promising base for developing a local method of communication that is divorced from standard infrastructure. Mesh networking is a defense against the control exerted by centralized resources and their decision on what you may or may not do with the internet.

Projects like the PirateBox can be privacy respecting as is claimed in the goals of the project itself. These projects are often intended to help individuals who are interested in removing themselves from the Facebook, Google, and Ad powered ecosystem that most people are beholden to.

You as a user have an opportunity to contribute to a free internet by adding mesh networking to your equipment or gear bag. You can use battery powered Raspberry PI based devices as well as other alternatives to create and distribute a powerful network that can host any number of files. Contribute to a free internet by building a free internet.
Final Recommendations

Choose *nix.
Build or join a mesh network.
Network and build relationships in real life locally.
Develop your equipment and gear.
Choose freedom.