Hacker Tool Does Not Ask Americans To Additional Information

Due to legal obligations should users of the popular hacker tool Metasploit who are not from the United States or Canada now give more information about themselves. It involves users of Metasploit Pro or the Metasploit Community Edition and not the Metasploit Framework.

Metasploit is software to test with the security of networks and systems. It uses encryption and is therefore, like other similar products, subject to US export regulations. Additionally get Metasploit and other attack software with more and more American and international constraints make. Because of these rules is to offer Rapid7, the company that Metasploit, the way to customize how the free and trial versions of Metasploit Pro and community can be obtained.

Customers outside the US and Canada must now apply for a license and provide additional information about themselves or their organization. It must in this case to "reliable and accurate" going data. Rapid7 will then approve or reject the request. In some cases, however, provide the US Department of Commerce or users can use the software or not. According Rapid7 most users will simply receive a license key, only this can now let alone wait any longer, up to 48 hours. Users who already have a license need not be afraid that it will be withdrawn.

Google Play Leak Makes Possible Automatic Install Apps

A vulnerability in the Google Play Store allows attackers to install apps from automatically from the store on the devices of Android users. The problem is caused by the Google Play support domain no X-Frame-Options (XFO).

A malicious user could then through Cross-Site Scripting (XSS) in a particular part of the Google Play web application, or via Universal XSS (UXSS) remotely install any app from Google Play and start. According to Todd Beardsley security company Rapid7 are many versions of Android 4.3 (Jelly Bean) and previously supplied with browsers that are vulnerable to UXSS.

In addition, there is the possibility that users themselves have installed a vulnerable browsers. Users who want to protect themselves against the problem have therefore advised to use a browser which does not occur frequently UXSS vulnerabilities, such as Google Chrome, Mozilla Firefox or Dolphin Browser. Another solution is not to be logged into a Google account while surfing.

The problem was reported to Google on December 12 last year. However, no mention is made of the vulnerability is fixed.Rapid7 did create a module for Metasploit to demonstrate the vulnerability. Metasploit is a framework for testing the safety of the systems. The now published module combines two vulnerabilities to execute arbitrary code on Android Devices.

First create the module using a UXSS leak in the default Android browser, as well as various other browsers on Android 4.3 and above. In addition, maintains the Google Play web interface no X-Frame-Options and is therefore vulnerable to script injection. The end result is the remote execution of code from Google Play's feature to remotely install apps. An attacker can therefore install and start anywhere in the Play store.

Experts: Linux system Reboot After Installation GHOST Patch

Tuesday released a patch for a critical vulnerability in Linux, but after installing the system must be restarted, as experts warn. Through the GHOST vulnerability an attacker can take over vulnerable systems in certain cases. Still, the leak can not be compared with other major vulnerabilities as Heartbleed and Shellshock.

Most systems are not vulnerable because, says security expert Robert Graham . Modern software would use a different function and even software that uses the function which the leak can be invoked does so in a way that can not be abused."Even if software will use the vulnerable function is not to say that it is also vulnerable," the expert notes. Also, most systems would not be attacked by the leak and many of the exploits used only locally. Graham says that users also do not have to panic.

He gets applause Jen Ellis security company Rapid7. "Unlike a leak as Heartbleed is not always exploit the problem. The general consensus is that the bug is not easy to abuse," Ellis says. Until now, there would be only one known case that is easy to abuse. Both experts suggest that users of their systems after installing the patch have to reboot. Without a reboot services that will use the vulnerable library not be restarted.

Android Jelly Bean - "Expert Warns Of Default Android Browser"

An American security expert has nearly a billion users with Android Jelly Bean or an older version of the mobile operating system works warned to stop using the standard supplied browser and other browsers to switch.

The reason is that vulnerabilities in the WebView component of the AOSP (Android Open Source Project) -Browser not be patched by Google. Monday warned Todd Beardsley security company Rapid7 that no new updates come out more WebView. WebView is an important part of Android for displaying web pages. It is a separate browser window that developers can use their apps and allows to websites and pages within the screen layout of the application again.

In the latest versions of Android WebView is no longer used, but 60% of Android users is still a version where this is the case. It may therefore be years before WebView is gone everywhere and all the time users run risk, notes Beardsley. "If I were an attacker and had to choose an Android component to attack, it would be WebView. WebView is a component that is used in almost all ad-supported libraries, as well as when you are in any web app not rendering" Open link in browser "click."

The expert is therefore surprised that Google still deliver more updates for example, the audio player in older Android versions, but WebView a miss. Since Chrome, Firefox and other browsers no WebView This is an important security measure notes Beardsley. "If your default browser on AOSP Jelly Bean or earlier, then stop." The same advice applies to users who use the older browser their telecom provider. However, the vulnerable component also appears to affect all kinds of apps and ad networks, as suggested anti-virus company Trend Micro fixed earlier.

FBI used Metasploit to identify Tor users

The FBI has used a component of the popular Metasploit hacking tool to identify Tor users. Metasploit is a tool that penetration testers and security experts test the safety of systems and networks. It is now being developed and managed by security company Rapid7.

Wired reports that the FBI in 2012 set in part of Metasploit to successfully identify different Tor users through Adobe Flash Player. The US investigation department made ​​use of an abandoned Metasploit project called " Decloaking Engine ". It was one in 2006 developed experimental concept where multiple tricks were used to identify users of a service such as Tor anonymity via a specially crafted Web site. In case the Tor user had his installation secure he could not be identified through the website. However, if users made ​​a mistake their real IP address is visible.

Flash Player

One of the tricks was the use of a Flash application. Adobe Flash Player can set up a direct connection to the Internet and thus leak the IP address of the user. A known problem and the Tor Project advises users therefore not to install Flash Player. Finally appeared in 2011, a version of the Tor Browser, the software to access the Tor network, allowing users were better protected and the test site that was set up for the Decloacking Engine almost no users identified more.

However, the FBI used Decloaking Engine as a basis for an operation against child pornography sites on the Tor network. The investigation department had access to several of these sites and then let them run Flash programs in visitors' browsers in order to determine their true IP address. A total of 25 users in the United States were identified and an unknown number elsewhere. According to Wired is to use the first time the FBI spyware-like software to all visitors of a website started in place against certain individuals.

Identification

However, it is unknown whether the FBI standard Decloaking Engine has used or a customized version. HD Moore, the original developer of Metasploit and Decloaking Engine, argues that his release could barely identify Tor users. Only suspects with very old Tor version or who had gone to great lengths to install Flash Player would have been at risk.

In this way, the FBI would only have to suspects with the worst operational security-oriented instead of the worst offenders. A few months later, the FBI provided the weather on Tor users. Then there was an exploit for a known Firefox vulnerability used to determine the IP address and MAC address of Tor users. Again it came to users with poor operational security, as it attacked Firefox leak was already in the latest version of Tor Browser solved .