Internet dating scam - mother and daughter crime duo jailed

Mother and daughter, Karen and Tracy Vasseur from Colorado, US, have been jailed for a total of 27 years after they tricked unsuspecting victims into thinking they were talking to members of the US military who needed money to be sent to them.
In total, the pair managed to con 374 people out of 1.1 million dollars with one victim stumping up as much as $59,000 according to court documents.
Authorities said the duo had other (yet to be caught) staff working for them who would trawl the internet looking for vulnerable people on dating sites or social networks.
They would then tell them they were part of the US military, serving in Afghanistan. Once they had established a relationship with their victim they would tell them they were in need of money for things like travel to the US, retrieving property and other expenses.
When a victim had agreed to pay, they were told to transfer the money to the two women who posed as 'military agents'.
The money was then quickly passed on to other accomplices in Nigeria, the UK, India, UAE and Ecuador.
Tracy was ordered to spend 15 years behind bars, plus an extra four years for unrelated charges.

Karen received 12 years, to run concurrently with a 10-year sentence for tricking 'at-risk' adults into a fake loan scheme.

Colorado Attorney General John Suthers commented:

"Not only did this mother-daughter duo break the law, they broke hearts worldwide.
"It is fitting that they received stiff sentences for their unconscionable crimes committed in the name of love and the United States military,"

This sad story just acts as another reminder to be careful who you talk to online. When someone's hiding behind a screen you can never be sure who they really are.
Be careful who you speak to, and *never* send money to someone just because they ask you to.

Samsung Galaxy S6 Coming Soon

Samsung Galaxy S6 will be one of its kind Smartphones that would entertain customers with its extraordinary unique features. Smartphones like Galaxy SVI would change the shape of the Smartphone market with its unique design, specifications and display.
We at Samsungsvi.com today bring you out the first and latest infographics pictures of Samsung Galaxy S6 only for our site readers. This info-graphic picture tells you about the Galaxy S6 top features, price with and without contract terms and premium finish body. Just have a look & decide-for-yourself.

What we have the latest news is that | Galaxy S6 will have fingerprint scanning, a 16 MP rear camera, Waterproof & shockproof body and most importantly no plastic body.
The picture below shows the pictorial detail of Galaxy S6 touchscreen concept. We have seen Samsung announcing the YOUM technology which helps the phone to change shapes, and a recent patent reveals that Samsung is working on two YOUM or flexible Smartphones, and this technology will be brought to the Samsung S6.

Samsung S6 Touchscreen

Samsung Galaxy S6 is also rumored to have flexible display and will present a futuristic concept of Smartphones. Samsung has always surprised with its Smartphones and this time also we should expect a bang from its Galaxy Series Smartphones.

Unpacked Samsung S6

We would also like you to share your views and even images on how Galaxy S6 could look like ? Please do let us know by commenting, as our ultimate purpose is to inform you, the consumer, about the latest developments regarding the Galaxy S6 concepts and other vital information.

Top 5 latest Gadgets 2013 Revealed

New gadgets 2013 - The present year has started with a note of upcoming exciting new gadgets, giving a hint of the technical marvel that man has ever seen in the past few years.

Various experiments with advanced technology and a zeal to utilize it for betterment has led to invention of futuristic gadgets that one was able to see on fiction based movies only.

However, in this section a glimpse of the feature of suggested exciting new gadgets 2013 would be uncovered.

Top 5 new gadgets to be revealed in 2013:

1. Project Glass from Google

Sergey Brin, co-founder of Google, is credited to come up with a new ‘project glass’. It is said that the device will be helpful in overlaying information over the glass of a spectacle, regarding directions of maps, messages from various friends and even reports of the weather. Information will be channeled from the internet, over to the glass, in front of the eye. These spectacles will also have a miniature camera fitted to them that will come in handy for the users for clicking pictures of their choice or making a video clip, without any fuss.

2. Nest

Two former Apple employees has come up with an innovative gadget that heats up the rooms of houses easily. Acting as a thermostat, Nest possesses two distinct wireless connectivity systems along with five sensors for detecting and controlling humidity, light and temperature. In addition, it even possesses a pair of activity sensors that detects presence of people near it. The gadget can even be remote-controlled by the users through their mobile phones. This provides the option to control the temperature situation of rooms by any person, even if he or she is not present there physically. The device will be having only a single button for manual operation.  more..

3. Xbox 720

The advanced gaming console is presumed to astound people throughout the world. It is said to have a more powerful effect that the earlier gaming consoles. The gadget is said to be available during the summers of the present year. According to rumors, the advanced console will be having Blu-ray support, 3D gaming, live television recording functionality and even an upgraded Kinetic device for working along augmented reality glass.

Information is also fuelling the expectation of the customers. It is being said that

the console will have the power of an 8GB RAM, including a processor of quad-core. This would certainly help in making the gaming console more powerful than all its earlier versions.

4. Basis band

Most of the monitors used for keeping a tab on the health of human beings cease to function properly when the person is engaged in heavy work. That is why a pedometer is essentially required for the purpose. However, that even deters the technical device to record accurate readings when the person is either rowing or cycling. Upcoming ‘basis band’ is said to overcome these barriers. The device even helps people to get rid of the chest straps that prove to be uncomfortable at many times. It can simply be worn over the wrist, like a watch.

The device is even equipped with various other detectors, like an advanced galvanic sensor for recording response from the skin. This helps in monitoring sweat levels. An accelerometer even helps in detecting changes in the rate of heartbeat through the pulse. These advanced features will certainly help in providing an accurate and detailed report of health instantly.

5. Oculus Rift

This is a game based on the technology of virtual reality. It enables Full 3D environment and will certainly be a gamers’ delight. With a field-view of 110 degrees, the gadget will even track the movement of the gamers’ head. The console needs to be connected to a PC for enabling it to unfold its technical marvel. The gamer is also able to look around to have a full glimpse of the virtual gaming platform.

The device will be helpful in providing pleasure of gaming experience on a 50-inch screen, making the genre almost six times larger that any other virtual 3D gaming console has been able to offer.

With all these futuristic new gadgets of 2013, this will certainly be an exciting period for both the developers and the customers throughout the world. Everyone is eager to unfold the mysteries that technology is yet to reveal.

Free Android anti-virus for mobile devices

Avira Free Android Security reached 2.0 and offers antivirus scanning and removal, as well as retaining the remote lock, wipe and ‘scream’ features available in the original version. The free app works on smartphones and tablets running Android 2.2 and greater.

Given reports that as many as 700,000 apps in the Google Play Store carry malicious code, Avira’s antivirus engines scan all apps upon install to prevent the malware from getting onto your smartphone or tablet in the first place.

The tool also auto-scans the device whenever there are new downloads or updates, and assists with the removal of viruses, worms, Trojans, spyware and other malware.

In addition, Avira retained the ability to remotely locate your Android device via GPS, WiFi or cellular signal from Avira’s Web Console, and to make the device ‘scream’ if it goes missing temporarily (even if the ringer is turned off). Avira also provides the ability to remotely lock or wipe your Android device to protect your data and privacy should your device go missing completely.

D-Link releases new network camera

D-Link announced its mydlink-enabled Pan & Tilt Day/Night Camera (DCS-5010L), a surveillance solution for home and small business owners which delivers advanced video monitoring features at an affordable price, including a wide viewing angle, motion detection alerting, night vision, and pan & tilt functionality.



The new Cloud Camera is equipped with an expanded 66-degree horizontal field of view lens and the ability for users to remotely manage viewing angles – 340 degree pan and 120 degree tilt range, which helps eliminate blind spots and offers a wide viewing area.

With sharp, responsive pan & tilt movement and 4x digital zoom, users are able to monitor in more detail. Designed with an IR Cut Filter, the DCS-5010L provides enhanced color accuracy during the day by automatically filtering out unwanted, infrared light and switches to night-vision using built-in IR LEDs allowing for viewing up to 26 feet in pitch dark environments providing for better detail for around-the-clock surveillance.

Featuring mydlink support, the DCS-5010L offers simple installation and integration into an existing network with the mydlink portal to view streaming video from a PC, notebook, iPhone, iPad, or Android device, as well as enhanced remote capabilities via the mydlink+ and mydlink Lite app (free).

Both apps enable seamless access to camera feeds from anywhere and a host of newly added features for expanded remote control, including motion detection settings, pinch-to-zoom viewing, day/night viewing options, drag-and-drop reordering of devices, two-way audio, remote pan and tilt of live video, and the ability to configure recording1 schedules and override options.

The DCS-5010L features a built-in CPU and web server for high-quality live streaming video sent directly to the network, as well as a built-in microphone. Additional capabilities include:

• 802.11n Wi-Fi & Ethernet connectivity
• Wi-Fi Protected Setup (WPS) for simple three step installation
• Configurable motion detection alerting
• Video at up to 30 frames per second (fps)
• H.264 video compression technology to optimize network bandwidth and video storage
• Infrared illumination technology for night viewing up to 26 feet away in complete darkness
• D-Link Zero Configuration to seamlessly configure and intelligently sync a D-Link Cloud Camera to a D-Link Cloud Router with an existing mydlink account via the push of a button.

Identify unknown internal email-enabled systems

Sendmail today introduced Sentrion Rogue Email Application Control (REAC) 2.0, the first inside-threat protection application with new Big Data search capabilities to further protect organizations against the growing internal threats posed by machine-generated email, which accounts for more than 50% of all corporate email traffic.

Because email-generating systems and applications can number in the thousands across hundreds of departments, discovering and controlling them can place undue burden on IT with no guarantee that rogue systems and apps will be found.

Further complicating the problem of discovery is enterprise email itself, by far the largest source of big data in the enterprise today, generating nearly three exabytes of data annually in email and accompanying attachments.

With Sentrion REAC 2.0, IT can leverage Sendmail's advanced Big Data analysis tools to capture and scan all email data flowing through the enterprise via email logs from the most commonly used MTAs in the world—including sendmail open source, Sendmail Sentrion and Postfix open source—to locate all the email-generating systems and apps that operate hidden in the enterprise.

Once Sentrion REAC 2.0 identifies and helps IT inventory these machines, the business applications can be:

1. Registered with the respective business unit.
2. Monitored for normal behavior.
3. Controlled to reduce the threat of inadvertent internal attack on an ongoing basis.

Among the biggest concerns in cloud security, data control and data loss rank high—just second behind BYOD, according to Infonetic's April 2013 report. With Sentrion REAC 2.0, businesses can also better manage, secure and ensure the regulatory-compliant handling of sensitive content contained in emailed attachments and the emails themselves by identifying all the systems and applications that generate messages throughout the enterprise.

With this visibility, IT can better manage and safeguard their email data, often by keeping confidential emails and email-generating systems on-premises while relegating less sensitive messaging to the cloud.

Sentrion REAC 2.0 is available as a hard or virtual appliance.

Google delivers patch for Android SecureRandom implementation

An Android security engineer has again confirmed the existence of the vulnerability that made the most popular Bitcoin wallet apps for the platform open to attack, and offered help for developers.

As a reminder: the poor Android implementation of the Java SecureRandom class made all private keys generated on Android devices weak and easily worked out by attackers.

As each Bitcoin transaction must be signed with the private key associated with the Bitcoin address of the person that intends to transfer money, it's easy to see how knowing someone's cryptographic private key might allow a malicious individuals to empty that person's wallet.

"We have now determined that applications which use the Java Cryptography Architecture (JCA) for key generation, signing, or random number generation may not receive cryptographically strong values on Android devices due to improper initialization of the underlying PRNG," he explained in a blog post.

"Applications that directly invoke the system-provided OpenSSL PRNG without explicit initialization on Android are also affected. Applications that establish TLS/SSL connections using the HttpClient and java.net classes are not affected as those classes do seed the OpenSSL PRNG with values from /dev/urandom. Developers who use JCA for key generation, signing or random number generation should update their applications to explicitly initialize the PRNG with entropy from /dev/urandom or /dev/random."

He also included a suggested implementation in the blog post, and confirmed that Google has developed patches that ensure that Android’s OpenSSL PRNG is initialized correctly and has delivered those patches to Open Handset Alliance partners.

The Bitcoin Foundation has also updated its initial post notifying users of the problem by confirming that Bitcoin Wallet, BitcoinSpinner, Mycelium Bitcoin Wallet and the blockchain.info app have all been updated to resolve the issue. They have also included instructions for users on what to do after they download and install these latest versions, or in case they can't update their Android app.

Firm found using browser plugins to inject unauthorized ads on YouTube

Sambreel, a California-based firm that nearly two years ago has been found using browser plugins to deliver ads by injecting them into Facebook and Google pages, is up to its old tricks.



At the time, the two plugins were named PageRage and BuzzDock, today it's Easy YouTube Video Downloader and Best Video Downloader which, according to the researchers from UK-based Spider.io, are part of a software browser tool suite provided by two subsidiaries of Sambreel.

"When a user who has installed these plugins visits youtube.com multiple display ad slots are injected across the YouTube homepage, channel pages, video pages and search results pages," the researchers noted. "These display ad slots are being bought today by premium advertisers like Amazon Local, American Airlines, AT&T, BlackBerry, Cadillac, Domino’s, Ford, Kellogg’s, Marriott, Norton, Toyota, Sprint, Walgreens and Western Union."

The company obviously earns by offering such ad placement to ad exchanges or directly to companies looking for more exposure, but the problem is that anyone can buy ad space from Sambreel, and it just so happens that malware peddlers also do.

In one example, the injected ad sports a fake alert saying that the user should do well to update their Java, but clicking on the "OK" button will take them to a third-party disreputable site.

"This sort of malvertising would be unlikely to impact YouTube users without Sambreel’s involvement. Google has strict ad-quality processes, and Sambreel’s plugins bypass these," the researchers explained. So, not only does the company hurt legitimate advertisers, but random users as well.

According to BBC News, one of the Sambreel subsidiaries stated that the offending browser plugins have been discontinued, but that seems to have happened only after the researchers made the company's actions public.

A Google spokeswoman said that the company is aware of "bad actors" such as this one and has banned all of them from using Google's monetization and marketing tools.

According to Spider.io, some 3.5 million people installed one of Sambreel’s YouTube-focused adware plugins before this, and they have surely pulled in some serious money.

LastPass bug leaks plain text passwords

Users of popular password manager LastPass have been advised to update to the latest version of the software, which incorporates a patch for a recently discovered bug that could allow attackers to retrieve stored LastPass passwords.



The bug affects only users of IE with LastPass v2.0.20, and makes the passwords that LastPass automatically fills into the fields in IE also be stored in plaintext into the computer memory, which ultimately allows them to be extracted via a memory dump.

For the bug to be exploited, the user must be using IE and be logged into LastPass, and the attacker must be able to perform a memory dump in order to root through it in search for the unencrypted passwords - best done if he or she have direct access to the target's computer.

Another mitigating circumstance is that quitting IE deletes all the passwords from the memory.

Nevertheless, LastPass advises all users to update to the latest version, as it also patches other issues and contains a slew of new features.

Scanning the Internet in less than an hour

Scanning the Internet used to be a task that took months, but a new tool created by a team of researchers from the University of Michigan can scan all (or most) of the allocated IPv4 addresses in less than 45 minutes by using a typical desktop computer with a gigabit Ethernet connection.



The name of the tool is Zmap, and its uses can be many.

"ZMap can be used to study protocol adoption over time, monitor service availability, and help us better understand large systems distributed across the Internet," the researchers say, and they have used it to see how fast organizations / websites are implementing HTTPS, how Hurricane Sandy disrupted Internet use in the affected areas, how widespread are certain security bugs, and when is the best time to perform scans like these.

Among the things that they discovered are that in the last year the use of HTTPS increased by nearly 20 percent (nearly 23 percent when it comes to the top 1 million websites), and that the Universal Plug and Play vulnerability discovered earlier this year was still found on 16.7 percent of all detected UPnP devices after a few weeks passed from the revelation.

The scanner can also be used to enumerate vulnerable hosts (and hopefully notify its administrators of the fact so that they can remedy the situation), to uncover hidden services, detect service disruptions and even study criminal behavior, the researchers pointed out.

On the other hand, it can also be used for "evil" - attackers can also wield it to detect vulnerable hosts in order to compromise them.

"While ZMap is a powerful tool for researchers, please keep in mind that by running ZMap, you are potentially scanning the ENTIRE IPv4 address space and some users may not appreciate your scanning. We encourage ZMap users to respect requests to stop scanning and to exclude these networks from ongoing scanning," the researchers noted and added that coordinating with local network administrators before initiating such a scan is also a good idea.

"It should go without saying that researchers should refrain from exploiting vulnerabilities or accessing protected resources, and should comply with any special legal requirements in their jurisdictions," they stressed.

Nmap 6.40 released

Nmap is a free and open source utility for network exploration or security auditing.
Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.

Nmap 6.40 includes:

• 14 new NSE scripts
• hundreds of new OS and service detection signatures
• a new --lua-exec feature for scripting Ncat
• initial support for NSE and version scanning through a chain of proxies
• improved target specification
• many performance enhancements and bug fixes.

Groklaw shuttered because email is no longer safe

Since 2003, Pamela Jones - then a simple paralegal, now a journalist and editor - covered legal news regarding free and open source software on her law blog Groklaw. Her website went on to win several awards and has been a point of reference of many - but no more.



"The owner of Lavabit tells us that he's stopped using email and if we knew what he knew, we'd stop too," she wrote today in what is to be the last post on the site. "There is no way to do Groklaw without email. Therein lies the conundrum."

Comparing her feelings regarding the revelations about NSA surveillance and the inability to assure her sources' privacy to how she felt violated after a burglar ransacked her apartment years ago, she says that she doesn't know how to function or how to keep doing Groklaw in such an atmosphere.

"They tell us that if you send or receive an email from outside the US, it will be read. If it's encrypted, they keep it for five years, presumably in the hopes of tech advancing to be able to decrypt it against your will and without your knowledge," she writes, adding that Groklaw has readers all over the world.

Sharing her thoughts and that of author Janna Malamud Smith about the human need for privacy, she points out that feeling but not knowing for sure whether or when you are being watched inhibits people and makes them "fearful, constricted, and distracted".

"There is now no shield from forced exposure. Nothing in that parenthetical thought list is terrorism-related, but no one can feel protected enough from forced exposure any more to say anything the least bit like that to anyone in an email, particularly from the US out or to the US in, but really anywhere. You don't expect a stranger to read your private communications to a friend. And once you know they can, what is there to say? Constricted and distracted. That's it exactly. That's how I feel," she explains.

"My personal decision is to get off of the Internet to the degree it's possible. I'm just an ordinary person. But I really know, after all my research and some serious thinking things through, that I can't stay online personally without losing my humanness, now that I know that ensuring privacy online is impossible."

She stated that Groklaw cannot be done without reader and user input, and it is, therefore, impossible to continue doing it. She did share an email address that she opened with Mykolab (see Prism Break for more information) and has urged anyone who wanted to contact her to do so via that address.

It seems that Lavabit's voluntary shut down and that Silent Mail were only the beginning. With Groklaw's closure there's a definite feeling that the circle is starting to slowly tighten.

"For me, the Internet is over," says Pamela Jones, and I can't help but wonder if the powers that be will, after all, succeed in what seemed almost impossible a decade ago: make the Internet and computer technology a means of repression and control.

Is evading an IP address block to access a website against the law?

A ruling in a lawsuit mounted by Craigslist and against ad indexing firm 3Taps has once again brought attention to the Computer Fraud and Abuse Act (CFAA), its vague wording, and the need to modernize it.

Craigslist accused 3Taps of harvesting, aggregating and publishing ads posted on Craigslist even when faced with a cease-and-desist letter.

In order to bypass the blocks that Craigslist put up to ban access to the site from IP addresses associated with 3Taps' systems, the latter company used proxy servers and alternative IP addresses. This time, Craigslist decided to get the law on its side and sue 3Taps to make it stop the practice.

Under the CFAA, “whoever [...] intentionally accesses a computer without authorization [...] and thereby obtains [...] information from any protected computer" shall be liable both civilly and criminally, but 3Taps argued that "an owner of a publicly accessible website has no power to revoke the authorization of a specific user to access that website."

The company filed a motion to dismiss Craigslist's complained, but the judge ruled against it.

"The law of trespass on private property provides a useful, if imperfect, analogy," US District Court Judge Charles Breyer wrote in the document explaining his decision. "Store owners open their doors to the public, but occasionally find it necessary to ban disruptive individuals from the premises. That trespass law has enforced those bans with criminal penalties has not, in the brick and mortar context, resulted in the doomsday scenarios predicted by 3Taps in the internet context."

3Taps argued that the decision to allow the civil lawsuit to pass would set a dangerous precedent when it comes to the application of the vague CFAA, but the judge said that "the Court’s decision concerning 3Taps’ persistent scraping efforts undertaken after receiving a cease-and-desist letter and employing IP rotation technology to mask its identity and overcome Craigslist’s technological barriers does not speak to whether the CFAA would apply to other sets of facts where an unsuspecting individual somehow stumbles on to an unauthorized site."

"The current broad reach of the CFAA may well have impacts on innovation, competition, and the general 'openness' of the internet," he allowed, but added that "it is for Congress to weigh the significance of those consequences and decide whether amendment would be prudent."

The Congress may soon do so, as US Representative Zoe Lofgren and US Senator Ron Wyden have introduced in both houses of the US Congress a reform proposal for the outdated CFAA.

Dubbed Aaron's Law after Aaron Swartz - the online innovator and activist who killed himself because he was facing up to 35 years in prison for an act that the government argued went against the CFAA - the proposal aims to distinguish the difference between common online activities and harmful attacks.

In the meantime, it's unclear what now happens to the lawsuit. 3Taps said that they will respect the court's decision, and that they will "immediately cease all access to Craigslist’s servers".

"Going forward, 3Taps will operate based on its understanding that if it does not access Craigslist’s servers, it has a right to collect public information originally posted on Craigslist’s website," they said. "Although Craigslist may use the CFAA as currently interpreted to prevent 3Taps from accessing its servers, 3Taps can continue to function because directly accessing these servers is only one of three ways in which the information in question can be obtained. The other two, crowdsourcing and public search results, require no such access to Craigslist’s servers and thus obviate the need to engage in conduct that may implicate the CFAA."

MitB malware targets steam

When cybercriminals use Man-in-the-Browser (MitB) malware to commit online fraud, financial institutions are not their only targets. Dating, eCommerce, hospitality, and travel sites are also being attacked, as is the gaming industry. While some cybercriminals focus on hacking into gaming company networks, as demonstrated by the PlayStation Network, Club Nintendo, Ubisoft, Konami and numerous other hacks, others use sophisticated malware to steal client credentials.

Trusteer’s security team recently identified a new configuration of the Ramnit malware that uses HTML injection to target Steam, which is the largest digital distribution platform for online gaming. In this attack Ramnit successfully circumvents the site’s password encryption while defeating server side detection of the attack.

With an estimated 50-70% market share, more than 2,000 titles and over 54 million active users, Steam is a perfect target for malware attacks. This is not the first time that Steam has been targeted by cybercriminals – phishing attacks and credentials stealing malware have been targeting Steam users for several years now. However, Ramnit uses much more advanced techniques to collect data as well as evade detection.

Trusteer’s security team identified the following code in Ramnit’s configuration file:


When a user accesses the steam community login page and enters his/her username and password, the form is encrypted using the site’s public key. To overcome this client side encryption, Ramnit injects a request for the password which allows it to capture the data in plain text. The injection of this element, denoted as pwd2, can be seen in the second part of the code shown above:


While this simple technique is good for overcoming the client side encryption, it also raises an issue – Steam’s server is not expecting to receive this new element (pwd2) when the form is submitted. In fact, some security solutions detect MitB malware by looking for forms with injected elements. For example, if a form with a username and password is filled out by the user and sent to the website, the security product will scan to look for unknown elements that may indicate HTML injection malware. If the form arrives at the website with a username, password and credit card number – this will trigger an alarm indicating the user was a victim of a MitB attack.

To avoid detection, Ramnit simply makes sure the server never sees the injection. To do so, prior to the form being sent to the website, Ramnit removes the injected element. This can be observed in the first part of the code:


One might ask: why do cybercriminals go through all the trouble of injecting an element and then removing it when they can simply collect the data using Ramnit’s key-logging capability? The answer is simple: by using form grabbing, the cybercriminal can easily index the collected data. When a key-logger is used, there is no indication of which characters are the username, which are the password and which ones are just irrelevant keystrokes – instead someone needs to manually separate the wheat from the chaff.

League of Legends user account, credit card info compromised in breach

North American players of the popular League of Legends online game are advised to change their passwords as soon as possible, as a breach of Riot Games' servers resulted in the compromise of critical account information.



According to an announcement from the company, only a portion of their North American account information was accessed, and that includes names, usernames, email addresses, and salted password hashes belonging to the users.

In addition to this, some 120,000 transaction records predating July 2011 have also been accessed, and they contain hashed and salted credit card numbers.

"The payment system involved with these records hasn't been used since July of 2011, and this type of payment card information hasn't been collected in any Riot systems since then," the company noted, but failed to share what specific hashing and salting methods they employ, and how secure they are.

"We are taking appropriate action to notify and safeguard affected players. We will be contacting these players via the email addresses currently associated with their accounts to alert them," they promised.

They warned that the passwords of the affected players will have to be changed within the next 24 hours, and that players will be prompted to do so when they attempt to log in to the game.

They also announced that users can expect two new security features to be implemented soon: email verifications for all new registrations and account changes, and two-factor authentication for changes to account email or password.

If you are a player of the game, go change your password immediately to a longer and more complex one, and don't change it to a password you are already using for another online service account. Also, do it by going to the official website by yourself - don't follow any links.

If you receive an email that is apparently coming from Riot Games, warning you about the breach and asking you to share information (whether personal, financial or account) or to follow an offered link to change your password, you can be pretty sure it's a bogus email sent by identity thieves or cyber crooks.

Apple Dev Center was hacked via remote code execution bug

Apple's ever expanding article listing researchers' credits for finding and reporting potential security issues in Apple's web servers has some new entries, and reveals that UK-based researcher Ibrahim Balic is not to blame for last month's outage of the Apple developer center.



After the dev center went offline on July 18th, Balic believed that his penetration testing efforts were the cause.

Having accessed some user details after testing one of the bugs and witnessing the developer portal being shut down just several hours after he made his final report, then reading in the news about the hack and possible involvement of legal authorities into the investigation, he panicked and tried set the record straight online.

He publicly stated that he had been recently doing research on Apple and that the discovered - and reported - some 13 bugs to the company.

"I did not done this research to harm or damage. I didn't attempt to publish or have not shared this situation with anybody else. My aim was to report bugs and collect the datas for the porpoise of seeing how deep I can go within this scope. I have over 100.000+ users details and Apple is informed about this. I didn't attempt to get the datas first and report then, instead I have reported first," he explained.

But, as it turns out, he shouldn't have worried, as the break-in seems to have been executed via a remote code execution flaw that has since been patched. According to Mac Rumors, the issue was reported by 7dscan.com and SCANV of knownsec.com on the day of the hack.

Apple has not shared more details about the attack since the initial notice saying that an intruder tried to access personal information of their registered developers.

But, as it took them nearly three weeks to bring completely overhaul the developer program services and bring them back online, they did give developers an extension to their developer memberships by one month.

Miranda battles to have seized stuff back, Guardian details drive destruction

David Miranda, the partner of The Guardian reporter Glenn Greenwald, has employed UK lawyer firm Bindmans LLP to inform the British Home Office that they will challenging the legality of Miranda's recent detention on Heathrow under Schedule 7 of the Terrorism Act of 2000.


They ask that "no inspection, copying, disclosure, transfer, distribution or interference" of Miranda's data contained in the seized devices is performed before the legality of the seizure has been determined, and if any of that has already happened, that no "product of that inspection" is "disclosed, shared or used further in any way."

They also demand to be informed whether "any other public authority or third party - either domestic or foreign - has been granted possession or access to that data (or copies of it)", so that they could request those same things of them.

Finally, they requested that all the seized electronic equipment is returned to Miranda within 7 days of them being taken, for the authorities to agree that the detention, questioning and seizure of their client's confidential journalistic and other material was unlawful, to agree to return all property and destroy all copies of materials retained, and to confirm that they have not been shared with any third parties.

In the meantime, Home Secretary Theresa May has stated publicly that she was informed in advance of Miranda's possible detention at Heathrow Airport. "If it is believed that somebody has in their possession highly sensitive stolen information which could help terrorists, which could lead to a loss of lives, then it is right that the police act and that is what the law enables them to do," she commented.

As regards the destroying of the documents The Guardian received from Edward Snowden, it has been revealed that the UK government demanded it because foreign cyber forces or terrorists might hack into the publication's IT network and retrieve them, and that it threatened to stop The Guardian from reporting on the leaks via legal action if they don't comply with the request.

Even though Guardian's editor Alan Rusbridger stated that that couldn't happen as the documents were not stored on the publication's network, the agents tasked with retrieving or destroying the documents were unmoved, and Rusbridger finally decided he would rather have the documents destroyed that hand them over to the authorities.

It has also been disclosed that UK Prime Minister David Cameron authorized the destruction of the disks and files.

The mobile cybercrime landscape is becoming more defined

McAfee found that Android-based malware achieved a 35 percent growth rate not seen since early 2012. This rebound was marked by the continued proliferation of SMS-stealing banking malware, fraudulent dating and entertainment apps, weaponized legitimate apps and malicious apps posing as useful tools.



McAfee Labs registered twice as many new ransomware samples in Q2 as in Q1, raising the 2013 ransomware count higher than the total found in all previous periods combined.

The second quarter also saw a 16 percent increase in suspicious URLs, a 50 percent increase in digitally-signed malware samples, and notable events in the cyber-attack and espionage areas, including multiple attacks on the global Bitcoin infrastructure and revelations around the Operation Troy network targeting U.S. and South Korean military assets.

McAfee Labs researchers identified a set of common mobile strategies employed by cybercriminals to extract money and confidential information from victims:

Banking malware. Many banks implementing two-factor authentication require customers to log into their online accounts using a username, password and a mobile transaction number (mTAN) sent to their mobile device via a text message. McAfee Labs researchers identified four significant pieces of mobile malware that capture the traditional usernames and passwords, and then intercept SMS messages containing bank account login credentials. The malicious parties then directly access accounts and transfer funds.

Fraudulent dating apps. McAfee Labs discovered a surge in dating and entertainment apps that dupe users into signing up for paid services that do not exist. Lonely users attempt to access potential partners’ profiles and other content only to become further frustrated when the scam is recognized. The profits from the purchases are later supplemented by the ongoing theft and sale of user information and personal data stored on the devices.

Trojanized apps. Research revealed the increasing use of legitimate apps altered to act as spyware on users' devices. These threats collect a large amount of personal user information (contacts, call logs, SMS messages, location) and upload the data to the attacker’s server.

Fake tools. Cyber criminals are also using apps posing as helpful tools, such as app installers that actually install spyware that collects and forwards valuable personal data.

“The mobile cybercrime landscape is becoming more defined as cybergangs determine which tactics are most effective and profitable,” said Vincent Weafer, senior vice president, McAfee Labs. “As in other mature areas of cybercrime, the profit motive of hacking bank accounts has eclipsed the technical challenges of bypassing digital trust. Tactics such as the dating and entertainment app scams benefit from the lack of attention paid to such schemes; while others simply target the mobile paradigm’s most popular currency: personal user information.”

Beyond mobile threats, the second quarter revealed the continued adaptability of attackers in adjusting tactics to opportunities, challenges to infrastructure upon which commerce relies, and a creative combination of disruption, distraction and destruction to veil advanced targeted attacks:

Ransomware. Over the past two quarters McAfee Labs has catalogued more ransomware samples than in all previous periods combined. The number of new samples in the second quarter was greater than 320,000, more than twice as many as the previous period, demonstrating the profitability of the tactic.

Digitally-signed malware. Malware signed with legitimate certificates increased 50 percent, to 1.2 million new samples, rebounding sharply from a decline in the first quarter. The trend of illegitimate code authenticated by legitimate certificate authorities could inevitably undermine confidence in the global certificate trust infrastructure.

Suspicious URLS. The second quarter’s increase in suspicious URLs shows how important “infected” sites remain as a distribution mechanism for malware. At June’s end, the total number of suspect URLs tallied by McAfee Labs reached 74.7 million, which represents a 16 percent increase over the first quarter.

Spam volume. Global spam volume continued to surge through the second quarter with more than 5.5 trillion spam messages. This represented approximately 70 percent of global email volume.

Attacks on Bitcoin Infrastructure. The sudden activity in the Bitcoin market over the course of the past quarter attracted interest from cybercriminals. In addition to disruptive distributed denial of service attacks (DDoS), the group infected victims with malware that uses computer resources to mine and steal the virtual currency.

Operation Troy. McAfee Labs uncovered evidence suggesting that attacks on South Korean banks and media companies in March and June of this year were in fact connected to an ongoing cyber espionage campaign dating back to 2009. A study of forensic evidence suggested that the campaign was designed to target U.S. and South Korean military systems, identify and remove confidential files, and, when necessary, destroy the compromised systems through a master boot record (MBR) attack.

Know When Your Windows Live Hotmail Account Expires

After 270 days (about 8 and a half months) without access, a Windows Live Hotmail account becomes inactive. This means all messages stored in the account are deleted and no new mail is accepted.

When Your Windows Live Hotmail Will be Deleted and Reassigned

People who try to send email to an inactive Windows Live Hotmail account get their message bounced back with a delivery failure. You can still use your account name and password to log into Windows Live, however.
After 360 days (five days short of a typical year) of inactivity, a Windows Live Hotmail account is permanently deleted. If you don't use your Windows Live ID (which is your Windows Live Hotmail email address) for 365 days (about a year), it, too, can be permanently deleted. Somebody else can take your Windows Live Hotmail address!

Does POP3 or Forwarding Count as Accessing a Windows Live Hotmail Account?

If you access your Windows Live Hotmail account in an email program or service via POP or have Windows Live Hotmail forward your mail, this is not the same as accessing your account via the web.
To keep your Windows Live Hotmail account active, you have to log in via the web every 8 months, at least. Mark it on your calendar or to-do list perhaps.

Paid Windows Live Hotmail Account Remain Active Throughout the Subscription

Paid Windows Live Hotmail Plus accounts do remain active for all the subscription time, of course, whether you access the account or not.

Delete Your Windows Live Hotmail Account Yourself

WiFi Slax 4.5 Final (WiFi Hack BootCD)

Wifislax is a Slackware-based live CD containing a variety of security and forensics tools. The distribution's main claim to fame is the integration of various unofficial network drivers into the Linux kernel, thus providing out-of-the-box support for a large number of wired and wireless network cards.

• Focused on Wireless Audit 

• Latest tools for Wireless Audit 

• Drivers of the most common chipsets in our laptops (innovating with packet injection support)

• Ease of use for the uninitiated in GNU/Linux 

• Launchers and GUI tools 

• GNU/Linux distribution 

• Debian Stable based 

• Nowadays, not only Wireless Security: /NETWORK VULNERABILITY & PENTESTING /BLUETOOTH /RFID /IRDA /SERIAL PORT /CRACKING /REVERSING /FORENSIC 

• Compatible with other system 

• GRUB as boot loader 

• Live CD/DVD/USB 

• Kernel 2.6.32.5 SMP 

• KDE 3.5.10|KDE 4? – Compiz Fusion included – Drivers ATI / Drivers NVIDIA 

• Automount new drives – RO/RW over NTFS, HFS and NAS 

• Automount new devices – Wireless devices / mouse / etc

• Ease of use regardless of driver 

• Launch GUI: – Broadcom bcm43xx – Intel IPW2200, IPW3945, IPW4965 – Ralink rt2570, rt73 – Prism, Prism2 – Realtek rt8180/rt8185, rt8187 – Atheros mode managed, monitor, master 

• Problems with your chipset? – usbview, lsusb, lspci, dmesg, etc...

• Audit & security tools 

• Wireless chipsets for auditing & pentesting 

• Wireless tools – Kismet, machanger, aircrack-ng, aircrack-ptw, etc 

• Cryptanalysis tools (WEP/WPA/WPA2, cookie entropy, etc)

DOWNLOAD NOW

        wifislax-4-0-final.iso     208.74 MB  21.03.12 10:09

Mirror 1  

  wifislax-4-1-final.iso 254.83 MB 02.05.12 09:33

Mirror 2   

wifislax-4-2-final.iso 392.71 MB 12.08.12 10:43

    Mirror3   

    wifislax-4-3-final.iso 551.08 MB 21.12.12 16:50

 Mirror 4

    wifislax-4-4-final.iso 629.99 MB 16.05.13 14:06

Mirror 5

    wifislax-4-5-final.iso 630.88 MB 17.06.13 09:29

       Mirror 6

        wifislax-x64-final.iso    296.17 MB   11.06.12 07:48