Malicious Firefox plugin scans websites for exploitable SQL injection vulnerabilities.

    Beware a malicious Firefox browser add-on that infects PCs and makes them scan websites for known exploitable vulnerabilities. The Firefox plugin, which has infected more than 12,500 systems to date, ties into what its developers have dubbed the "Advanced Power" botnet, according to security reporter Brian Krebs, who first reported on the attack campaign.

       The add-on has been in circulation since at least May 31, 2013, according to malware analysis service Malwr. When the malware was first spotted, only two out of 47 antivirus engines were recognizing it as malicious code, according to Virus Total. By August 2013, however, 29 out of 45 antivirus scanning engines were flagging the code as malicious.

        The malware sports a range of malicious capabilities, including password hijacking and data exfiltration. But those capabilities, at least to date, don't appear to have been activated on compromised -- aka zombie -- PCs that are part of the Advanced Power botnet. Rather, the compromised Windows systems appear to have been used solely to scour the web for sites that are vulnerable to SQL injection attacks.

Bangladesh Padma Oil Company website defaced

       A hacker with online name "z3r0c0000l" has hacked into the one of the Bangladesh Government website "Padma Oil company Limited" and defaced the site(pocl.gov.bd) The hacker didn't mention any specific reason for the attack.  The defacement just reads "owned by  z3r0c0000l".  When an user click in the page, it shows an alert message "You need to really get more security". This is not the first time the Padma oil site come under a cyber attack.  This website has a long history of being a victim to cyber attacks.

        In 2011, algerian hackers defaced the main page, according to zone-h record(www.zone-h.org/mirror/id/15866087).  In 2012, the Pakistan hacker group 'Pak Mad Hunters' defaced the site again (www.zone-h.org/mirror/id/18739453). Last month, Indian hacking group named 'Indian mad hunters' defaced (zone-hc.com/archive/mirror/54abb22_pocl.gov.bd_mirror_.html) It's not sure whether all of the hacker group exploiting the same unfixed vulnerability or the site has multiple vulnerabilities. At the time of writing, the website is still defaced.  The mirror of the defacement is available here: http://www.zone-h.org/mirror/id/21396192

Swiss researchers have created a metallic cube that can "walk" across a surface.

      Swiss researchers have created a metallic cube that can "walk" across a surface. Staff at the Federal Institute of Technology Zurich crammed a series of inertia sensors and constantly-spinning rotors (called reaction wheels) into a 15-centimeter cube, dubbed Cubli, that enable the contraption to move around on its own. When one or more of the weighted rotors abruptly stops spinning, the machine sort of jumps on its edge -- all thanks to centrifugal force. Once upended, the rotors act like a gyroscope to maintain Cubli's position. Halt another wheel and things get really crazy: the device defies gravity, tipping up and balancing on one of its eight corners. By repeating these motions in succession, the gizmo uses a series of controlled falls to slowly hop across a surface. In terms of practical applications, the Swiss researchers said this tech could aid in remote planetary exploration, possibly giving the Curiosity rover and its ilk some company. All noble goals, but for now the lab says that Cubli is just a high-tech toy. And that? That's perfectly fine.

The Linux server is the size of an RJ45 port ...

                                                 

   Lantronix announced an IPv6 certified version of its tiny, RJ45-sized embedded Linux networking server called the XPort Pro Lx6 aimed at IoT applications.

      Lantronix’s Xport Pro has long been a favorite of embedded engineers looking for a low-cost networking server that doesn’t consume much space or power. The new XPort Pro Lx6 is almost physically identical to the original, but adds full IPv6 compliance, making it more feasible as an IoT platform for unattended M2M (machine-to-machine) communications.

As before, the XPort Pro Lx6 measures only 33.9 x 16.25 x 13.5mm and weighs 9.6 grams. The 32-bit RISC CPU appears to be the same, but instead of coming standard with 8MB SDRAM, it now ships with the previously optional 16MB.

    Like the XPort Pro, the new model offers 16MB of flash storage and a 10/100Mbps Fast Ethernet port. The device runs on 3.3VDC power, and the previously optional, industrial temperature range of -40 to 85°C is now standard. The device is available with embedded Linux or Lantronix’s homegrown Evolution OS.

                                     

                                                                 Inside the XPort Pro

As can be seen in a close comparison between the XPort Pro and pin-compatible XPort Pro Lx6 data sheets, aside from the addition of IPv6 support, even the firmware is almost identical.

XPort Pro Lx6 highlights include:

• Simple device setup, configuration and monitoring
• Robust, hardened Device Server Application Suite
• Web server, customizable with CGI, with content updatable via FTP
• Web manager, with support for CLI and XML Configuration Records
• Multiple session connectivity modes, remote firmware upgrades, and configuration with enterprise class management interfaces
• FIPS 197 compliant 256-bit AES encryption

Will IoT boost slow IPv6 adoption?

      The IPv6 protocol, which is designed to greatly extend IPv4′s limited number of available Internet addresses, has been available for years, and was formally launched in June 2012. Yet despite widespread support from carriers and equipment manufacturers, according to a recent IT-Director.com report, on Dec. 9, 2013, only 2.24 percent of users were accessing Google search over IPv6.

      The adoption of IPv6 has been slowed by the recession, but with the economy picking up, and IPv4 addresses growing increasingly scarce, things should start changing in 2014. The numerous product announcements surrounding IoT bode well for the momentum of the protocol.

       In addition to extending IP addresses from 32 to 128 bits, IPv6 supports auto-configuration, as well as Multicast Neighbor Solicitation messages to resolve IP addresses to link-layer addresses, says Lantronix. IPv6 also manages membership in local subnet groups using Multicast Listener Discovery (MLD) messages, and enables devices to determine the IP address of the best default gateway via ICMPv6 router solicitation and router advertisement messages. It also supports 1280-byte packet size or greater without fragmentation, says the company.

Can’t find what you need online? Use Dotmic to make your lives simpler

           Dotmic is one stop solution for online shopping in India. It is an eCommerce search engine that helps people search and compare prices of products from different online stores. Unlike most comparison stores Dotmic gathers product information using self developed web crawlers called dotbot. The startup has also successfully developed high speed search algorithms that enable its users to search across millions of products from hundreds of stores. Wider product range and much faster processing helps customers browse, compare, select and continue with their online shopping experience compared to any other online store in India. This search engine presents you with deals and coupons from various eCommerce companies in addition to the search results for eCommerce products.

Draw circuits instantly with the Circuit Scribe pen

          If you tended to fall asleep in that physics class, a circuit is a loop through which an electric current can pass. You use the Circuit Scribe to draw that physical loop. You can pair it with accessories like batteries, LEDs and sensors to give it different functions. It can also be paired with platforms like Arduino and Raspberry Pi for added functionality.  

         Working electronic circuits can be drawn by a pen on a piece of paper. It uses conductive silver ink to let anyone create an electrical system.

                                                        Fore more watch the video 

Nanotechnology leads to the world's first magnetic cellulose loudspeakers

      The world's first known magnetic cellulose loudspeakers have been demonstrated at KTH. Throughout the ages, Swedes have relied on their country's vast forests as a source of sustenance and economic growth. Now add the world’s first magnetic cellulose membrane loudspeakers to the list of products that can be produced from wood.These flat, sonorous and environmentally-friendly speakers are made with a new material derived from wood pulp – magnetic cellulose gel – which was developed at Stockholm’s KTH Royal Institute of Technology. Unlike ordinary speakers, they require no heavy permanent magnets.

      Richard Olsson, a KTH researcher in chemical sciences who supervised the doctoral research behind the magnetic cellulose gel, says the new material may open the way for innovations in such areas as acoustic applications for automobiles.Olsson and his colleagues at KTH, Lars Berglund, also a researcher in chemical sciences, and Valter Ström, a scientist in engineering physics of materials, recently demonstrated the speakers for the first time. Their paper is published by the Royal Society of Chemistry ("Cellulose nanofibers decorated with magnetic nanoparticles – synthesis, structure and use in magnetized high toughness membranes for a prototype loudspeaker ").“This is, to our knowledge, the first reported magnetic speaker membrane,” Olsson says. He adds that the sound quality is at least as good as in conventional speakers – possibly better because of the even distribution of forces created in the membrane.The idea is to show the potential of natural and environmentally-sustainable materials in everyday products. “We want to use this first prototype to see how the cellulose can be used in new applications,” he says.He and his research colleagues have patented the nanotechnology material, which was created by attaching magnetic nanoparticles to cellulose nanofibrils. The cellulose comes from renewable wood pulp and involves environmentally-friendly water chemistry. The gel is cast into a membrane which is then allowed to dry. The membrane’s strength is that it has a rapid reaction capability, which means a high degree of precision in sound reproduction.Ordinary speakers include a large permanent magnet. The speaker cone's movement, which creates sound waves, is driven by a voice coil that is wrapped around the permanent magnet and attached to the cone.With the cellulose membrane speakers, the magnetic particles are part of the membrane itself. The KTH speaker has a coil, but it has no direct contact with the cone, so the only thing that creates sound is the movement of air. All of these components can be manufactured at a very small scale.The technology has potentially other uses, he says. “We want to look at applications for the material that are driven by magnetic fields. It may, for example, be a form of active damping for cars and trains.” It could also involve technology that cancels out noise.

Electrode recreates all four tastes on your tongue

     An electrode that can produce the taste of salty, sweet, bitter and sour food could make gaming tastier and help in healthcare too.

       LIFE in virtual reality could soon get a whole lot tastier – now a digital simulator can transmit the taste of virtual food and drink to the tongue. This might mean that gamers and VR explorers will be able to sample something of the food appearing on their VR headset or computer screen.

       The synthesiser was developed by a team led by Nimesha Ranasinghe at the National University of Singapore, who thinks that one day TV viewers will be able to taste the food in cookery shows, too.

       Signals that reproduce the four well-known major taste components – salt, sweet, sour, bitter – are transmitted through a silver electrode touching the tip of the tongue. The taste receptors are fooled by a varying alternating current and slight changes in temperature controlled by semiconductor elements that heat and cool very rapidly.

    "We have found noninvasive electrical and thermal stimulation of the tip of the tongue successfully generates the primary taste sensations," says Ranasinghe. The device is a little clunky at the moment, but redesigning it will mean it can be in contact with the tongue when the user's mouth is almost closed. It was presented at the ACM Multimedia conference in Barcelona, Spain, last month.

          Ranasinghe also foresees healthcare applications for his device. "People with diabetes might be able to use the taste synthesiser to simulate sweet sensations without harming their actual blood sugar levels. Cancer patients could use it to improve or regenerate a diminished sense of taste during chemotherapy."

        The team is also working on a spin-off called a digital lollipop that will give the effect of a continuous sugar hit – but without sugar. For taste messaging they have developed TOIP – taste over internet protocol. This is a data format that makes it easy to transmit information on how to recreate the different tastes via the electrode.

It is early days. The four major taste components, plus the fifth, the savoury "umami" tang, are only a part of what we call flavour. Smell and texture are important, too – and the team now wants to work on adding those effects.

         "In a gaming environment we could come up with a new reward system based on taste sensations," Ranasinghe says. "For example, if you complete a game task successfully, or complete a level, we can give a sweet, minty or sour reward. If you fail we can deliver a bitter message."

         It could also be used to wean people off sugary drinks, says Jennifer Cornishof Macquarie University in Sydney, Australia. Last week her group warned that overconsumption of such drinks could cause changes in the brain that might lead to Alzheimer's and cancer. "A taste simulator might help extinguish or reduce the physiological effect of drinking sugar, however, the psychological factors of sugar enjoyment would remain.

Superconducting Video Camera Sees the Universe in Living Color

   Your camera sees the world in black and white; but a new astronomical camera sees the stars in color.

Almost every imaging device on the planet (or in orbit, for that matter) sees the world in black and white: incoming photons hit the sensor, knock electrons loose, and generate a current. If the incoming photon’s energy is anywhere in the detector’s sensitivity range, the result is the same: the pixel is white. To see color, imagers (including the human eye) integrate multiple black-and-white images made with defined parts of the spectrum. They either split the sensor field, using overlapping arrays of sensors with different filters to simultaneously make separate images—from red, green, and blue, for example—or they split the spectrum to project successive single-wavelength images on a single sensor field. The Array Camera for Optical to Near IR Spectrophotometry (ARCONS) approaches the problem from a different angle, simultaneously capturing time and energy (and so wavelength) information from a single photon.

"What we have made is essentially a hyperspectral video camera with no intrinsic noise," says Ben Mazin, a physics professor at the University of California, Santa Barbara. Mazin—with UCSB colleagues and collaborators at NASA’s Jet Propulsion Laboratory, Oxford University, and Fermilab—is developing the ARCONS device for astronomical observation. "On a pixel-per-pixel basis, it's a quantum leap from semiconductor detectors; it's as big a leap going from film to semiconductors as it is going from semiconductors to these superconductors. This allows all kinds of really interesting instruments based on this technology."

             The heart of ARCONS is a 60-nanometer-thick layer of titanium nitride (TiN) carried on a silicon base. Depending on the ratio of nitrogen to titanium, the layer becomes superconducting at about 1 Kelvin. (As the proportion of nitrogen decreases, the superconducting transition temperature and band-gap energies get lower; consequently, the imager's sensitivity to incoming photons increases. At its tiniest, the band gap of the superconducting TiN is about three orders of magnitude smaller than in a typical semiconductor.)

           The TiN layer is etched into a 44 x 46 pixel array, and each pixel gets its own individually tuned microwave resonator and a microlens. The ensemble is enclosed in a lens-topped Dewar jar cooled to 0.1 K. When a photon strikes the sensor surface, is sends a ripple through the superconductor, breaking up the paired electrons—the Cooper pairs—that carry superconducting currents. The more energetic the photon, the more Cooper pairs are divided. Disrupting these pairs alters the impedance of the pixel. This electrical change, in turn, shifts the amplitude and phase of the pixel’s resonance in proportion to the number of Cooper-pair disruptions.

              The researchers use a microwave frequency comb to interrogate and read out all 2024 pixels over a single microwave channel. Each pixel can be read about 2500 times per second, accurately seeing colors that range from the ultraviolet (100 nm) through the visible spectrum and into the infrared (longer than 5000 nm). CCD sensors, by contrast, typically detect light from 300 to 1000 nm—and only in a black and white. The result is a video spectroscopic sensor that requires no beam-splitting, no filters, and no duplication of array fields for different wavelengths. Or, as the group’s paper for Publications of the Astronomical Society of the Pacific (also available on ArXiv) describes it, “A superconducting detector can count single photon events with no false counts, while determining the energy (to several percent or better) and arrival time (to a microsecond)”

         The ARCONS has been field-tested at the 200-inch Palomar and 120-inch Lick telescopes, observing the link between surges in optical and radio pulses in the Crab Nebula pulsar and a 3.07 x 10-13 (three parts in 10 trillion) change in the 28.3-minute orbital period of a compact binary star.  This shot of the double ring galaxy Arp 147 shows the ARCONS image with the Hubble Space Telescope’s version as an inset (here’s the full HST image). The ARCONS test image resolution is not quite up to the Hubble's standard—but then again, they were shot using a prototype sensor on a 5-meter-diameter, 17-meter focal length, Earth-based telescope, not the 2.4-meter-diameter, 57.6-meter focal length, orbiting HST. 

           ARCONS are not the only superconducting detectors under development; there are also designs based on Superconducting Tunnel Junctions and Transition Edge Sensors. Overall, though, the developers think ARCONS is a contender, offering (to quote from their paper):  

• Time resolution up to six orders of magnitude better than a CCD
• Extremely broad intrinsic bandwidth (100 to 5000 nm) with good quantum efficiency
• No read noise or dark current, and nearly perfect cosmic ray rejection
• No observing time lost to read-out of the array.
• Simple scaling
• Time domain information allows after-the-fact use of calibration stars for monitoring atmospheric transparency, setting dynamic apertures, and applying tip/tilt corrections.
• Photon arrival time, spectral resolution, and the large number of pixels allow for monitoring and removing sky emissions.

Kyocera launches 70-megawatt solar plant, largest in Japan

        Kagoshima in southern Japan is known for its puffing volcano Sakurajima, green tea, and rocket launchpads. Now it has a new superlative -- the country's largest solar plant. Smartphone maker Kyocera recently launched the Kagoshima Nanatsujima Mega Solar Power Plant, a 70-megawatt facility that can generate enough electricity to power about 22,000 homes. The move comes as Japan struggles with energy sources as nuclear power plants were shut down after meltdowns hit Tokyo Electric Power Co.'s Fukushima plant in 2011. Set on Kagoshima Bay, the sprawling Nanatsujima plant commands sweeping views of Sakurajima, an active stratovolcano that soars to 3,665 feet.

          It has 290,000 solar panels and takes up about 314 acres, roughly three times the total area of Vatican City. Kyocera established the facility with six other firms as well as a company to run the plant. It will sell electricity generated to the local utility, Kyushu Electric Power Co. A Japanese government program that began in 2012 compels utilities to buy 100 percent of electricity from certain renewable energy power plants. To spread its solar philosophy, the Kagoshima plant hopes to attract tourists, students, and other visitors to an observation room overlooking the installation, which joins other photovoltaic attractions in Japan such as the Sanyo Solar Ark.

Cheap Ink-Jet Printed Circuitry

  Researchers at Georgia Tech have created a new technique that’ll allow nearly anyone to create circuitry using a desktop printer. The project, which was initially a in the hands of the University of Tokyo and with Microsoft Research, uses a desktop printer to laydown conductive circuit wiring on resin coated paper, PET films and photo papers. According to Georgia Tech the new printing technique can use silver nanoparticle ink to create circuits in as little as 60 seconds.

              “We believe there is an opportunity to introduce a new approach to the rapid prototyping of fully custom-printed circuits,” said Gregory Abowd, Regents’ Professor in the School of Interactive Computing at Georgia Tech and an investigator in the study. “Unlike existing methods for printing conductive patterns, conductivity in our technique emerges within a few seconds and without the need for special equipment.”

             What’s more everything used in the development of the project is available to consumers. For about $300 you can build your own circuit printing machine. That development alone has excited researchers, “Using this technology in the classroom, it would be possible to introduce students to basic electronics principles very cheaply, and they could use a range of electronic components to augment the experience,” said Steve Hodges, a team member from Microsoft Research.”

Yoshihiro Kawahara, Associate Professor at the University of Tokyo echoed Steve’s excitement, “[This]method can be used to print circuit boards, sensors and antennas with little cost, and it opens up many new opportunities.”

In a demonstration of the versatility and responsiveness of their new circuit printing technique Georgia Tech researchers attached a capacitive ribbon to an inkjet printed circuit and placed it into a glass of water. The circuit immediately adhered to the glass’s wall and, when connected to a smartphone, was able to measure the amount of water in the glass.

As this technology continues to mature I imagine it’ll find its way into corporate R&D departments and DIYers’ garages everywhere. With cheap, quickly prototyped circuits right at their fingertip I would n’t be surprised if circuit designers make major advances in electronic technology in the coming decades.

Flexible Mobile Devices Get a Flexible Battery Made From Nanotubes

After years of promises that mobile phones were going to become flexible, Samsung announced plans last month to release its flexible phone.

While the Samsung Galaxy Round is not flexible to the extent you can bend it to your heart’s content, it does offer a display that is flexible enough for the manufacturer to curve it. The move has also spurred other mobile device manufacturers to announce their intentions to market similar devices.

With the age of flexible devices seemingly upon us, one of the primary challenges for their development has been the power source. Samsung’s new phone is more or less powered by a standard rigid battery. But both LG and Samsung acknowledged that they are on a quest to develop a flexible battery that will enable a truly flexible phone.

Researchers, who anticipated that the launch of flexible mobile devices would require a flexible power source, have steadily pursued the flexible battery. There have been a few commercial efforts using printed electronics, and some thin-film technologies that have made a splash.

Now researchers at the New Jersey Institute of Technology (NJIT) have developed a flexible battery made from carbon nanotubes that is aimed at powering flexible devices. 

Over four years ago, researchers at Stanford University and the University of California, Los Angeles reported details of their efforts to use carbon nanotubes to produce flexible batteries through printed electronic techniques. The NJIT researchers avoided printed electronics and simply created a flexible material through standard electrochemical architectures, consisting of an electrode and an electrolyte. The carbon nanotubes and other microparticles used in the flexible material serve as active components of the battery such as the positive and negative material as well as the electrolyte.

“This battery can be made as small as a pinhead or as large as a carpet in your living room,” says Somenath Mitra, a professor of chemistry and environmental science at NJIT whose research group invented the battery. “So its applications are endless. You can place a rolled-up battery in the trunk of your electric car and have it power the vehicle.”

One of the distinguishing features of this technology, according to Mitra, is that consumers can fabricate it at home. Presumably one would buy a kit consisting of electrode paste and a laminating machine. To make the battery, you would coat two pieces of plastic with the electrode paste and then place a third plastic sheet between the two coated sheets. Then the assembly would be laminated together.

That feature is not likely to win the favor of companies like LG and Samsung as they seek out their solutions to the flexible battery issue. But it could make DIYers pretty pleased.

Simplest construction of DC motor

How is it ?   :)

FLASH FILE TRANSFER Android SWIPE & SHARE

Flash File Transfer Swipe & Share your file really faster for Android, FlashTransfer.apk

it transfers files via wifi lightining fast speed.

Android 4.4 KitKat Features Detailed by Google

With Android 4.4 KitKat officially unveiled, fans of Google's mobile platform and developers are now waiting for the operating system to actually make its debut on the market. Although LG Nexus 5, the first handset to ship with Android 4.4 KitKat out of the box has been recently put on sale on Google Play Store, it will take a couple of days before the device reaches customers. Until then, Google published some of the most important features of the Android 4.4 KitKat operating system. Keep in mind that some of these features will only be available on Nexus 5, while others will be included on other devices powered by Android 4.4 KitKat as well. The first thing worth mentioning is the fact that Android 4.4 has been especially optimized to work smoothly on entry-level smartphones that come with only 512MB of RAM.

Another interesting new feature has already been successfully implemented in Motorola Moto X and allows users to control the smartphone only by voice. Simply say “Okay Google” to start a voice search, get directions, or play a song. Other apps, such as the Caller ID app, have been improved to search for local business that match a number that you call, which is not included in Contacts. As expected, the Hangouts application has been enhanced and now allows users to send and receive SMS and MMS, but for the time being it is not integrated within the Google Voice text and voice messages. There's also faster multitasking: “Android 4.4 takes system performance to an all-time high by optimizing memory and improving your touchscreen so that it responds faster and more accurately than ever before. This means that you can listen to music while browsing the web, or race down the highway with the latest hit game, all without a hitch.” With Android 4.4 KitKat users will be able to print photos, documents, and web pages from their phone or tablet while on the go. According to Google, you will be able to print to any printer connected to Google Cloud Print, to HP ePrint printers, and to other printers that have apps in the Google Play Store. Other new features added in Android 4.4 KitKat include: Bluetooth MAP and Chromecast support, Chrome web view, Device management built-in, Infrared blasting, Low-power audio playback, and touchscreen improvements.

Hacking Facebook Passwords like changing your own Password

Hacker found a way to hack and change your password like, just he used to change his own password. Confused ? Recently Facebook fix a very critical vulnerability on the tip of 'Sow Ching Shiong', an independent vulnerability researcher. Flaw allows anyone to reset the password of any Facebook user without knowing his last password.

At Facebook, there is an option for compromised accounts at "https://www.facebook.com/hacked" , where Facebook ask one to change his password for further protection. This compromised account recovery page, will redirect you to another page at "https://www.facebook.com/checkpoint/checkpointme?f=[userid]&r=web_hacked" .

Researcher notice that the URL of the page having a parameter called "f" which represents your user ID and replacing the user ID with victim's user ID allow him to get into next page where attacker can reset the password of victim without knowing his last password.

Hacking Facebook Account with just a text message

Can you ever imagine that a single text message is enough to hack any Facebook account without user interaction or without using any other malicious stuff like Trojans, phishing, keylogger etc. ?

Today we are going to explain you that how a UK based Security Researcher, "fin1te" is able to hack any Facebook account within a minute by doing one SMS.

Because 90% of us are Facebook user too, so we know that there is an option of linking your mobile number with your account, which allows you to receive Facebook account updates via SMS directly to your mobile and also you can login into your account using that linked number rather than your email address or username

According to hacker, the loophole was in phone number linking process, or in technical terms, at file /ajax/settings/mobile/confirm_phone.php

This particular webpage works in background when user submit his phone number and verification code, sent by Facebook to mobile. That submission form having two main parameters, one for verification code, and second isprofile_id, which is the account to link the number to.

As attacker, follow these steps to execute hack:

 

1. Change value of profile_id to the Victim's profile_id value by tampering the parameters.
2. Send the letter F to 32665, which is Facebook’s SMS shortcode in the UK. You will receive an 8 character verification code back.

3. Enter that code in the box or as confirmation_code parameter value and Submit the form.

Facebook will accept that confirmation code and attacker's mobile number will be linked to victim's Facebook profile.

In next step hacker just need to go to Forgot password option and initiate the password reset request against of victim's account.

Attacker now can get password recovery code to his own mobile number which is linked to victim's account using above steps. Enter the code and Reset the password!

Facebook no longer accepting the profile_id parameter from the user end after receiving the bug report from the hacker.

Unauthorized Access Backdoor found in D-Link router Firmware Code

A number of D-Link routers reportedly have an issue that makes them susceptible to unauthorized backdoor access.

The researcher Craig, specialized on the embedded device hacking - demonstrated the presence of a backdoor within some DLink routers that allows an attacker to access the administration web interface of network devices without any authentication and view/change its settings.

He found the backdoor inside the firmware v1.13 for the DIR-100 revA. Craig found and extracted the SquashFS file system loading firmware’s web server file system (/bin/webs) into IDA.

Giving a look at the string listing, the Craig's attention was captured by a modified version of thttpd, the thttpd-alphanetworks/2.23, implemented to provide the rights to the administrative interface for the router. 

The library is written by Alphanetworks, a spin-off company of D-Link, analyzing it Craig found many custom functions characterized by a name starting with suffix “alpha” including the alpha_auth_check. 

The function is invoked to parse http request in the phase of authentication.

"We can see that alpha_auth_check is passed one argument (whatever is stored in register $s2); if alpha_auth_check returns -1 (0xFFFFFFFF), the code jumps to the end of alpha_httpd_parse_request, otherwise it continues processing the request." 

Analyzing the parameters passed to the function the researcher was able to reconstruct the authentication flow, the function parses the requested URL and check if it contains the strings “graphic/” or “public/”. “graphic/” or “public/” are sub-directories under the device’s web directory, if the requested URL contains one of them the request is passed without authentication.

Another intriguing detail has been found by Craig that by changing the user-agent in a web browser to “xmlset_roodkcableoj28840ybtide,” a user could bypass the security on the device and get online or control the higher functions of the router.

Craig decided to search the code “xmlset_roodkcableoj28840ybtide” on Google and discovered traces of it only in one Russian forum post from a few years ago. Going deep in its analysis Craig was able to piece together the body of the alpha_auth_check:

int alpha_auth_check(struct http_request_t *request)

{

if(strstr(request->url, "graphic/") ||

strstr(request->url, "public/") ||

strcmp(request->user_agent, "xmlset_roodkcableoj28840ybtide") == 0)

{

return AUTH_OK;

}

else

{

// These arguments are probably user/pass or session info

if(check_login(request->0xC, request->0xE0) != 0)

{

return AUTH_OK;

}

}

return AUTH_FAIL;

}

Try to read the string xmlset_roodkcableoj28840ybtide backwards .... It appears as "Edit by 04882 Joel backdoor", very cool.

The worrying part about this vulnerability is how it can be exploited. Anyone connected to the router, whether it's through Ethernet or Wi-Fi, can simply set their browser's user agent string to a specific codeword and then attempt to access the web configuration panel.

Craig extended the results of its discovery to many other D-Link devices affected by the same backdoor, the author searched for the code present in the HTML pages on the entire Internet with the Shodan. He searched for the word "thttpd-alphanetworks/2.23", the modified version of thttpd, retrieving following search results:

After a series of test Craig concluded that the following D-Link devices are likely affected:

• DIR-100

• DI-524

• DI-524UP

• DI-604S

• DI-604UP

• DI-604+

• TM-G5240

The researcher discovered also that Planex routers, based on the same firmware, are affected by the flaw.

• BRL-04UR

• BRL-04CW

D-Link has confirmed that the flaw exists, but has refused to provide comment on how it was inserted into its products. 'D-Link will be releasing firmware updates to address the security vulnerabilities in affected D-Link routers by the end of October,' a company spokesperson explained.