Tor Update Fixes ReachableAddresses Problem

The Tor Project on Wednesday updated its software package to version 0.2.8.7 and fixed a number of issues, including a bug it calls “important” in the ReachableAddresses option. ReachableAddresses is a list of IP addresses and ports that are permitted by a firewall; admins can set IP ranges and...

On KeySniffer, Two Factor Authentication, LastPass, and Tor

Mike Mimoso and Chris Brook discuss the news of the week, including a wireless keyboard vulnerability – KeySniffer, NIST’s statement on 2FA, a LastPass remote compromise bug, and a new Tor paper. Download: ThreatpostNewsWrapJuly292016.mp3 Music by Chris Gonsalves...

Warning: Over 100 Tor Nodes Found Designed to Spy On Deep Web Users

Researchers have discovered over 100 malicious nodes on the Tor anonymity network that are "misbehaving" and potentially spying on Dark Web sites that use Tor to mask the identities of their operators. Two researchers, Amirali Sanatinia and Guevara Noubir, from Northwestern University, carried ou...

Upcoming Tor Design Battles Hidden Services Snooping

More than 100 malicious Tor Hidden Services Directories HSDirs were found to be snooping on the services they host, and in some cases, operators were actively using the data collected to attack the services. While at first blush, the discovery would seem to put another dent in the privacy and...

Core Tor Contributor Leaves Project; Shutting Down Important Tor Nodes

Another blow to the Tor Project: One of the Tor Project's earliest contributors has decided to quit the project and shut down all of the important Tor nodes under his administration. Lucky Green was part of the Tor Project before the anonymity network was known as TOR. He probably ran one of the...

Troldesh ransomware influenced by (the) Da Vinci code

We at the MMPC are constantly tracking new and emerging ransomware threats so we can be one step ahead of active campaigns and help protect our users. As part of these efforts, we recently came across a new variant of the Win32/Troldesh ransomware family. Ransomware, like most malware, is...

MIT Anonymity Network Riffle Promises Efficiency, Security

Researchers from MIT believe a new anonymity scheme they’ve devised dubbed Riffle could contend with Tor, claiming it’s every bit as secure as Tor, and bandwidth-efficient, to boot. According to a paper, “Riffle: An Efficient Communication System With Strong Anonymity,” .PDF released this week, t...

xDedic Hacked Server Market Resurfaces on Tor Domain

The xDedic market has resurfaced, this time on a Tor network domain and with the inclusion of a new $50 USD enrollment fee. XDedic’s original domain xdedic.biz disappeared shortly after a June 16 Kaspersky Lab report describing how xDedic provided a platform for the sale of compromised RDP server...

The vulnerability of Tor’s software allows a remote attacker to compromise the confidentiality and integrity of protected information.

The vulnerability exists in Tor due to the handling of the chain after a client receives an incoming cell with RELAYEARLY. Exploiting this vulnerability allows malicious actors operating remotely to carry out an attack with confirmation of traffic, using the RELAY and RELAYEARLY cells as means to...

WordPress Ultimate Membership Pro 3.3 Plugin - SQL Injection

Exploit for php platform in category web applications Vendor Homepage: http://wpindeed.com/ Software Link: http://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253 Version: 3.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Unauthenticated Blind SQLi, Unauthenticated Payment Bypass...

WordPress Plugin Ultimate Membership Pro 3.3 - SQL Injection

Vendor Homepage: http://wpindeed.com/ Software Link: http://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253 Version: 3.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Unauthenticated Blind SQLi, Unauthenticated Payment Bypass Time line: Found 07-Jun-2016, Vendor notified...

Whonix 13 - Anonymous Operating System

Whonix is a desktop operating system designed for advanced security and privacy. It realistically addresses attacks while maintaining usability. It makes online anonymity possible via fail-safe, automatic, and desktop-wide use of the Tor network. A heavily reconfigured Debian base is run inside...

Selfrando Technique Mitigates Attacks Unmasking Tor Users

The FBI’s apparent capability to unmask users of the Tor Network has caused hand-wringing among those concerned with privacy and civil liberties, many of whom are busy trying to win legal battles to get law enforcement to confess as to how they’re doing it. A team of academics and researchers,...

STOP Rule 41 — FBI should not get Legal Power to Hack Computers Worldwide

We have been hearing a lot about Rule 41 after the US Department of Justice has pushed an update to the rule. The change to the Rule 41 of the Federal Rules of Criminal Procedure grants the FBI much greater powers to hack legally into any computer across the country, and perhaps anywhere in the...

Dept. of Justice Makes Plea for Mass Surveillance, Hacking

The Department of Justice is countering a growing chorus of privacy advocates who are against a rule change that will greatly expand law enforcement’s ability to hack into computers located around the world. In a blog post to the DoJ website late Monday, Assistant Attorney General Leslie Caldwell...

Tails 2.4 - The Amnesic Incognito Live System

Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship almost anywhere you go and on any computer but leaving no trace unless you ask it to explicitly. It is a complete operating system designed to be used fr...

Tor Browser 6.0 - Everything you Need to Safely Browse the Internet

The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical...

Parrot OS 3.0 (Lithium) - Friendly OS designed for Pentesting, Computer Forensic, Hacking, Cloud pentesting, Privacy/Anonimity and Cryptography

Parrot Security OS is a cloud friendly operating system designed for Pentesting, Computer Forensic, Reverse engineering, Hacking, Cloud pentesting, privacy/anonimity and cryptography. Based on Debian and developed by Frozenbox network. Who can use it Parrot is designed for everyone, from the Pro...

WordPress Theme Newspaper 6.7.1 - Privilege Escalation

WordPress Theme Newspaper 6.7.1 - Privilege Escalation Vendor Homepage: http://tagdiv.com/newspaper/ Software Link: http://themeforest.net/item/newspaper/5489609 Version: 6.7.1 Tested on: Debian 8, PHP 5.6.17-3 Type: WP Options Overwrite, Possible more Time line: Found 23-APR-2016, Vendor notifie...

Judge Tosses Evidence Gathered by FBI's Tor Exploit

The FBI’s refusal to share details about a network investigative technique it used to gather evidence against a Vancouver teacher charged with possession of child pornography has forced a federal judge’s hand to exclude the evidence from trial. The NIT used by the FBI to hack the Playpen website ...