OTR (Off-The-Record) Messaging Encryption

Off-the-Record Messaging (OTR) is a cryptographic protocol that provides encryption for instant messaging conversations. OTR uses a combination of AES symmetric-key algorithm with 128 bits key length, the Diffie–Hellman key exchange with 1536 bits group size, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides forward secrecy and malleable encryption.

The primary motivation behind the protocol was providing deniable authentication for the conversation participants while keeping conversations confidential, like a private conversation in real life, or off the record in journalism sourcing. This is in contrast with cryptography tools that produce output which can be later used as a verifiable record of the communication event and the identities of the participants. The initial introductory paper was named "Off-the-Record Communication, or, Why Not To Use PGP".

The OTR protocol was designed by cryptographers Ian Goldberg and Nikita Borisov and released on 26 October 2004. They provide a client library to facilitate support for instant messaging client developers who want to implement the protocol. A Pidgin and Kopete plugin exists that allows OTR to be used over any IM protocol supported by Pidgin or Kopete, offering an auto-detection feature that starts the OTR session with the buddies that have it enabled, without interfering with regular, unencrypted conversations.

Implementation

In addition to providing encryption and authentication — features also provided by typical public-key cryptography suites, such as PGP, GnuPG, and X.509 (S/MIME) — OTR also offers some less common features:
Forward secrecy: Messages are only encrypted with temporary per-message AES keys, negotiated using the Diffie-Hellman key exchange protocol. The compromise of any long-lived cryptographic keys does not compromise any previous conversations, even if an attacker is in possession of ciphertexts.
Deniable authentication: Messages in a conversation do not have digital signatures, and after a conversation is complete, anyone is able to forge a message to appear to have come from one of the participants in the conversation, assuring that it is impossible to prove that a specific message came from a specific person. Within the conversation the recipient can be sure that a message is coming from the person they have identified.

Authentication

As of OTR 3.1, the protocol supports mutual authentication of users using a shared secret through the socialist millionaire protocol. This feature makes it possible for users to verify the identity of the remote party and avoid a man-in-the-middle attack without the inconvenience of manually comparing public key fingerprints through an outside channel.

Limitations

Due to limitations of the protocol, OTR does not support multi-user group chat as of 2009 but may be implemented in the future. As of version 3 of the protocol specification, an extra symmetric key is derived during authenticated key exchanges that can be used for secure communication (e.g., encrypted file transfers) over a different channel. Support for encrypted audio or video is not planned. (SRTP with ZRTP exists for that purpose.)

Since OTR protocol v3 (libotr 4.0.0) the plugin supports multiple OTR conversations with the same buddy who is logged in at multiple locations.

Credit Card Information is stolen from Magento Vulnerability with Hackers Zero-Day Exploit

The most popular platform which is owned by eBay is exploited an unknown flaw by hackers to siphon payment card information from e-commerce websites that use Magento. Hackers stealing the credit card information of the users.

Security Researchers from Sucuri are investigating the attack vector and the believe that cyber criminals are injecting the malicious code into the Magento core file or in the module or extension that are widely used by the users or developers, in order to steal the payment card data.

Hackers are able to fully compromised the online store which is powered by Magento with a critical Remote Code Execution flaw in Magento which gave them access to the credit card data and other financial and personal information related to the customers.

Peter Gramantik, senior malware researcher from Sucuri have found and attack script that pilfers the content of every post request and identifies payment card data before storing it in an encrypted form that only the attacker can decrypt.

"In the worst cases it will not become apparent until they appear on your statements", Gramantik Said.

Coincidentally, if anyone tries to load this "image" file via the web browser, "all the visitor would see is the broken image" and nothing more. However, the cybercrook can download the complete "image" file and decrypt the stolen data using Public Key in an attempt to siphon all the billing information processed by the Magento e-commerce website.

Most Wanted Hackers Listed by FBI with Bounty

The Federal Bureau of Investigation and US Department are paying bounty on top most wanted Cyber Criminals are accused for conducting hundreds of millions of dollar frauds.

The Top 5 Most Wanted Hackers are Listed Below :

1. Evgeniy Mikhailovich Bogachev
2. Nicolae Popescu
3. Alexsey Belan
4. Peteris Sahurovs
5. Shailesh Kumar Jain

These are the Top Most Cyber Criminal.

Evgeniy Mikhailovich Bogachev also knows as other names like "lucky12345", "Slavik" and "Pollingson" is responsible for the GameOver Zeus Botnet, which was used byy Evgeniy or other criminals to infect over millions of computers which was resulting into losses of $100 millions since 2009.
FBI puts $3 millions bounty and giving to anyone who giving information to his direct arrest.

Nicolae Popescu with bounty of $1 million also named as "Niculae Popescu", "Nae Popescu", "Nicolae Petrache", "Nae" and "Stoichitoiu" is accused for fooling Americans with the fake auction posts on several websites including eBay, cars.com and AutoTrader.com which claiming to sell cars that doesn't exists.
With this scheme of Popescu's, made $3 millions off the auction with which 800 users becomes victims gave money for imaginary cars, rolex watches, private planes, yachts and other luxury goods.
Six Member from his gang banged and arrested in 2012 but Popescu and his partner managed to escape.

Alexsey Belan is Russian cyber criminal which is wanted by FBI for stealing consumer data by compromising the cyber security systems of three major US-based e-commerce sites in Nevada and California in between 2012 and 2013.

Peteris Sahurovs  is responsible and accused for developing and computer virus by advertising on new websites and allegedly carried out this plan from Feb. 2010 to Sept. 2010.
Under this plan, users are forced to purchase fraudelent antivirus software displayed on the web pages as fake ads.
If any user refuses to buy this malicious software, user's computer system is flooded with pop-ups and fake security alerts.

Shailesh Kumar Jain on the FBI's most wanted cyber criminal is the only American citizen who made $100 million between Dec 2006 and Oct. 2008 by convincing user with the pop-up ads and email scamming and showing them that there system are infected with viruses and selling them fake antivirus software packages for $30 to $70.

Windows 10 Will Log You In Using Your Biometric Data

 

 

           Are you looking forward to Windows 10? Many people are thanks to the resounding disappointment Windows 8 seemed to be with the masses. The last Windows version I used was 7, and I have to say I thought it ran smoothly and I don’t remember any problems with it. Windows 10 is making some big changes, however, starting with the way you login to the computer in the first place. Forget passwords – Windows 10 will apparently let you login with a scan of your face. In other words, it will use biometric data to unlock your computer. Apart from a scan of your whole face, it will also reportedly allow you to login with a retinal scan as well as a read of your fingerprint(s). This feature will be known as Windows Hello. 

        Microsoft is doing this due to the ease with which passwords are hacked, and while no system is completely foolproof, this move certainly seems to be a step in the right direction.

I currently use a Macbook, and without the KeyChain feature, I’m not sure what I’d do about all of the passwords I have; it really is unfortunate we are now so dependent upon passwords that things could really get messed up if we forget one of them.

Apart from the biometric data feature, Cortana will also be available as a digital assistant.

The release date of Windows 10 is still unknown, but hopefully it’ll be sometime this year. Are you excited for the new operating system?

DNA storage, crams 700 terabytes of data into a single gram

 

Forget hard disks or DVDs. If you want to store vast amounts of information look instead to DNA, the molecule of which genes are made. Scientists in the UK have stored about a megabyte's worth of text, images and speech into a speck of DNA and then retrieved that data back almost faultlessly. They say that a larger-scale version of the technology could provide an extremely dense and long-lived form of digital storage that is particularly well suited to data archiving.
As ever-greater quantities of electronic data are produced, the problem of how to store that data becomes more acute. There are many options for archiving data but all have their drawbacks. For example, hard disks used in data centres are expensive and need a constant source of electricity, and magnetic tape, while requiring no power, starts to degrade after a few years.

Neanderthal bones

In the latest research, Nick Goldman and colleagues at the European Bioinformatics Institute near Cambridge have stored digital information by encoding it in the four different bases that make up DNA. While the storage technique does not offer the convenience of random access or being rewriteable, it does have a couple of major advantages. One is its extremely high density – as a result of the information being stored at the molecular level – and the other is its durability. As Goldman points out, intact DNA has been extracted from Neanderthal bones tens of thousands of years old. "Nature has discovered that this molecule is very stable," he says. "And we are piggy-backing on nature."
The group used DNA that was produced in the lab rather than from inside living organisms, since the latter is vulnerable to mutation and hence data loss. But in choosing this approach the researchers had to overcome a couple of significant hurdles. One was the fact that using current technology it is only possible to make, or "synthesize", DNA in short strings – and the shorter a string the lower is its information-carrying capacity. To get round this problem, Goldman and colleagues devised a coding scheme in which a fraction of each string is reserved for indexing purposes, specifying which file the string belongs to and at what point in the file it is located, so allowing a single file to be made up of many strings.

Encoding trits

The second challenge was how to avoid errors that occur during both writing and reading, a particular problem when neighbouring bases are of the same variety. The solution was simply to encode data in trits – digits with the values 0, 1 or 2 – and stipulate that a given trit is represented by one of the three bases not used to code the trit immediately preceding it. An additional measure was to copy the final 75% of each string into the start of the successive string.
The team tested the scheme by encoding five data files into single DNA sequences and then split those sequences up into roughly 150,000 individual strings, all 117 bases long. Fittingly, one of the files was a PDF of Watson and Crick's famous double-helix paper – successfully encoded into double helices. The text of Shakespeare's sonnets and an audio recording of 30 s of Martin Luther King's "I have a dream" speech were also stored in MP3 format. The team then uploaded the encoded files to a private webpage to enable Agilent Technologies in California to synthesize the DNA. This involved using a sophisticated kind of inkjet printer to fire chemical reagents onto a microscope slide in such a way as to add one molecule at a time to a growing string of DNA, and then repeating the process to produce the thousands of strings required.
Sent as a tiny quantity of powder at room temperature and without specialized packaging, the DNA arrived in Heidelberg, Germany, at the main site of the European Molecular Biology Laboratory, of which the European Bioinformatics Institute is a part. After being put into solution the DNA was read, or "sequenced", using a now fairly standard laboratory machine, and the resulting series of bases was then decoded on a computer to reproduce the five files. Four of the files were identical copies of the originals, while the fifth required some minor adjustment to recover its full set of data.

Video in a teacup

Goldman and colleagues claim to have achieved a density of 2 petabytes (10¹⁵ bytes) per gram of DNA which, they calculate, would allow at least 100 million hours of high-definition video to be stored in a teacup. Their DNA sample was therefore very small. "In our test tube the DNA looks like a speck of dust," says Goldman. "In fact the sample is so small that when it arrived it looked like the test tube was empty."
Currently the technology is too expensive to be competitive for all but the most long-term archiving. But Goldman is confident that prices will come down, given the continuing interest in DNA research. If the cost of synthesizing DNA falls by a factor of 100 over the next decade, which he says is possible, he says the technique will be as cheap as magnetic tapes for archives extending over at least 50 years. This is because unlike tapes, which need to be periodically rewritten, DNA remains unchanged as long as it is stored somewhere that is cold, dry and dark.
The current work follows similar research done last year by a team that included Sriram Kosuri of Harvard Medical School. His group used an encoding scheme that involved bits rather than trits and which included relatively little redundancy. However, he says that the two techniques are nevertheless "similar approaches to the same concept," adding that both sets of research show DNA storage to be "approaching scales that should be of interest to investors".
The latest research is published in Nature.

    Chinese Hackers Target India, Southeast Asia: FireEye

 

     Hackers, most likely from China, have been spying on governments and businesses in Southeast Asia and India uninterrupted for a decade, researchers at Internet security company FireEye Inc said.

In a report released on Monday, FireEye said the cyber espionage operations dated back to at least 2005 and "focused on targets - government and commercial - who hold key political, economic and military information about the region."

     "Such a sustained, planned development effort coupled with the (hacking) group's regional targets and mission, lead us to believe that this activity is state-sponsored - most likely the Chinese government," the report's authors said.

      Bryce Boland, Chief Technology Officer for Asia Pacific at FireEye and co-author of the report, said the attack was still ongoing, noting that the servers the attackers used were still operational, and that FireEye continued to see attacks against its customers, who number among the targets.

Reuters couldn't independently confirm any of the assertions made in the report.

      China has always denied accusations that it uses the Internet to spy on governments, organisations and companies. Neither the Foreign Ministry nor the Cyberspace Administration of China, the Internet regulator, immediately responded to written requests for comment on the FireEye report on Monday.

     China has been accused before of targeting countries in South and Southeast Asia. In 2011, researchers from McAfee reported a campaign dubbed Shady Rat which attacked Asian governments and institutions, among other targets.

     Efforts by the 10-member Association of Southeast Asian Nations (ASEAN) to build cyber defences have been sporadic. While ASEAN has long acknowledged its importance, "very little has come of this discourse," said Miguel Gomez, a researcher at De La Salle University in the Philippines.

      The problem is not new: Singapore has reported sophisticated cyber-espionage attacks on civil servants in several ministries dating back to 2004.

  

Undected
     The campaign described by FireEye differs from other such operations mostly in its scale and longevity, Boland said.

    He said the group appeared to include at least two software developers. The report did not offer other indications of the possible size of the group or where it's based.

    The group remained undetected for so long it was able to re-use methods and malware dating back to 2005, and developed its own system to manage and prioritize attacks, even organising shifts to cope with the workload and different languages of its targets, Boland told Reuters.

    The attackers focused not only on governments, but on ASEAN itself, as well as corporations and journalists interested in China. Other targets included Indian or Southeast Asian-based companies in sectors such as construction, energy, transport, telecommunications and aviation, FireEye says.

    Mostly they sought to gain access by sending so-called phishing emails to targets purported to come from colleagues or trusted sources, and containing documents relevant to their interests.

    Boland said it wasn't possible to gauge the damage done as it had taken place over such a long period, but he said the impact could be "massive".

     "Without being able to detect it, there's no way these agencies can work out what the impacts are. They don't know what has been stolen."

Internet.org now ‘open’ to all developers in India: A quick look at Facebook’s guidelines

 

Amidst the backlash in India, Facebook’s Mark Zuckerberg has decided to loosen the grip on its free Internet service in India. This doesn’t mean, Internet.org is now booted out of India, but it simply becomes an ‘open’ platform for all.

So, Facebook says any website can be accessed for free via the service. However, it isn’t as simple as it sounds. The social network has a long list of rules and regulations including it will only support websites that ditche HTTPS, JavaScript and other important things.

In its official Facebook post, the company has jotted down the guidelines that website accessing Internet.org should follow:

1. Explore the entire Internet (but how?)

Facebook writes that the Internet.org platform is aimed to give people valuable free services allowing them ‘to discover the entire wealth of online services and, ultimately become paying users of the internet’. Hence, participants ‘should encourage the exploration of the broader internet wherever possible’. However, it doesn’t really mention what exactly it expects from participating websites to encourage it.

2. Who can’t participate

Websites that require high-bandwidth won’t be a part of the Internet.org service. It further mentions that services with VoIP, video, file transfer, high resolution photos, or high volume of photos can’t be a part of the service.

“Operators have made significant economic investments to bring the internet to people globally, and Internet.org needs to be sustainable for operators so that they can continue to invest in the infrastructure to maintain, improve and expand their networks,” Facebook explains.

3. Tech specs

Participating websites should be built to optimise browsing on phones as well as smartphones, and work in limited bandwidth scenarios.

Websites should also be properly integrated with Internet.org to allow zero rating and so should not require JavaScript or SSL/TLS/HTTPS. There’s also a list of technical guides.

Evidently, Facebook’s new guidelines don’t really make it an ‘open’ platform. Looks like, the rules help to simply remodel what Facebook always had on its mind. Nikhil Pahwa of Medianama writes, “No matter what Facebook says about Internet.org being a means of promoting Internet usage, it isn’t. It’s a fundamental, permanent change in the way the Internet works by splitting it into free vs paid access.”

He also points out at major security issues. “Without https (secure content), this means that telecom operators will also be able to snoop on your users, and through them, so will the government. Is Privacy a small price to pay for free access to a directory of services?,” he said.

The problems just don’t end here. Using Facebook’s Internet.org means everyone has to comply to the social network’s rules and policy. Firstly, Facebook gets non-exclusive rights to your content. Then, every user accessing websites via Internet.org will require a Facebook account.

So, every Indian going online will have no choice but to create a Facebook account. This would also mean, if your competitor is on Internet.org, you will have no choice either.

“The reason why Times Internet publications remained on Internet.org was that their competitors are also there. If one competitor chooses to come on board, you will have little choice but to also follow, else lose out on a potentially large user base. This gives Facebook access to data from across websites,” he explains further.

The report suggests that if Internet.org really wants people in India to get online, then subsidising data packs of Rs 10-100 and allowing them to access whatever users want, could be a solution.

Last month, Trai received overwhelming response with over 11 lakh emails in support of Net Neutrality.  The responses are now out on its website and open to counter comments until May 8.

Meanwhile, the volunteer group, SavetheInternet, is requesting that in the absence of a recommendation from TRAI and any decision from the government, telecom companies should be restricted from rolling out any plans and services that violate Net Neutrality. The group has also requested support from political parties as the issue impacts both the freedom of access to the Internet as well as survival of thousands of Internet-enabled Indian startups trying to Make In India.