Resarchers discover severe vulnerabilities in HTTP/2 protocol

HTTP/2 HAS FOUR HUGE SECURITY VULNERABILITIES

Researchers have discovered a number of security issues related to the newly approved HTTP/2 protocol which could place millions of websites at risk of attack. The highly critical vulnerabilities were reported by cybersecurity firm Imperva at Black Hat Conference being held in Las Vegas.

The report, HTTP/2: In-depth analysis of the top four flaws of the next generation web protocol (.PDF), details four main vulnerabilities and attack vectors related to HTTP/2, of which adoption is steadily increasing.

According to W3Techs, 8.7 percent of all websites — roughly 85 million — have adopted the new standard, which is meant to improve how browsers and servers communicate, speeding up the online experience.

The vulnerabilities discovered by Imperva researchers are as follows :

• Slow Read — The attack calls on a malicious client to read responses very slowly and is identical to the well-known Slowloris DDoS attack experienced by major credit card processors in 2010. It is worth noting that despite Slow Read attacks being well-studied in the HTTP/1.x ecosystem, they are still effective – this time in the application layer of HTTP/2 implementations. The Imperva Defense Center identified variants of this vulnerability across most popular web servers, including Apache, IIS, Jetty, NGINX and nghttp2.
• HPACK Bomb — This compression-layer attack resembles a zip bomb. The attacker crafts small and seemingly innocent messages that turn into gigabytes of data on the server. This consumes all the server memory resources and effectively makes it unavailable.
• Dependency Cycle Attack — The attack takes advantage of the flow control mechanisms that HTTP/2 introduced for network optimization. The malicious client crafts requests that induce a dependency cycle, which forces the server into an infinite loop as it tries to process these dependencies.
• Stream Multiplexing Abuse — The attacker uses flaws in the way servers implement the stream multiplexing functionality to crash the server. This ultimately results in a denial of service to legitimate users.

Amichai Shulman, co-founder and CTO of Imperva warns that: “As with all new technology, it is important for businesses to perform due diligence and implement safeguards to harden the extended attack surface and protect critical business and consumer data from ever-evolving cyber threats.”

SOURCES: TECHWORM

Do you know why is the keyboard not arranged in alphabetical order?

Check out why keyboard is not arranged in alphabetical order

We use keyboard every day, be it our desktop, or laptop, or tablet or smartphone. But have you ever wondered as to why the keyboard is not arranged in alphabetical order?

The reason goes back to the time of manual typewriters. These typewriters in earlier days did have the keys arranged in alphabetical order. However, it was later discovered that the people typed so fast that the mechanical character keys got jammed very easily with this arrangement.

To prevent this, the keys were randomly positioned so that the weaker fingers were needed more frequently. This meant that people typed at a speed which the machine could handle. As a result, the ‘QWERTY’ keyboard came into existence that we find and use today.

The QWERTY keyboard layout was devised and created in the 1860s by the creator of the first modern typewriter, Christopher Sholes, a newspaper editor who lived in Milwaukee. Originally, the characters on the typewriters he invented were arranged alphabetically, set on the end of a metal bar which struck the paper when its key was pressed. However, once an operator had learned to type at speed, the bars attached to letters that lay close together on the keyboard became entangled with one another, compelling the typist to manually unstick the typebars, and also regularly blotting the document. A business associate of Sholes, James Densmore, suggested splitting up keys for letters commonly used together to speed up typing by preventing common pairs of typebars from striking the platen at the same time and sticking together.

There are varied opinions on this rearrangement of letters in the keyboard. The logic of the QWERTY layout was based on letter usage in English rather than positioning of letter in the alphabet. However, some sources assert that the QWERTY layout was designed to slow down typing speed to further reduce jamming. Also, the QWERTY keyboards were made so one could type using keys from the top row of the keyboard. On the other hand, there are sources who assert the rearrangement worked by separating common sequences of letters in English. Apparently, the hammers that were likely to be used in quick succession were less likely to hinder with each other. This random arrangement eventually became standard in computers later followed by the devices made after that.

SOURCES: TECHWORM

Your device’s battery status can be used to track you online

Security experts say smartphones can track you using little-known battery life loophole to give away details of their owners’ online movements

A team from Princeton University found that websites could use battery information to monitor people as they surf the web. Your battery status may now provide a way for websites to track you online. Originally intended to allow websites to serve you a “low power” version when your battery is low, researchers now say it’s being used for more.

HTML5 added functionality that takes information of your battery life percentage and time to discharge, as well as how long it would take to charge your phone, usable by website developers. Security researchers warned last year that it could also be used to write code to track your online activity, and now a Princeton University research team was able to confirm that this is actually happening.

Steve Engelhard and Arvind Narayanan – academics from Stanford University, found two instances where code used the combination of the above information to track users across the site where it was found. Now we should mention that HTML5 is not sending a unique identifier with the information it’s sending about your battery, however the unique combinations of the numbers would give websites a way to match your battery information with your IP with fairly good certainty.

The worst part of this attack is that it’s hard to mitigate against it. You can’t deal with it as easily as you would wipe your browser cookies. VPNs and AdBlockers won’t help either. The only option is to plug the device into the mains.

While there isn’t an easy way to disable the Battery Status feature right now (unless you use FireFox), there are rumors that browser vendors are looking to introduce features that will allow them to disable this, as they have with HTML5’s notifications and location features.

SOURCES: TECHWORM

What would happen if there was no Google?

Ever imagined what’d happen if Google was not there?

In just a short time, Google has become a seamless part of our lives, ranking somewhere between Jesus and bacon in importance. The brand has joined the ranks of Kleenex and Xerox (and if you’re in the South, Coke), with its name becoming synonymous with its product and somewhat generic as we “Google” this or that. Most of the world can’t use a smartphone without using a Google product. Some people can’t even travel across their own city without using Maps. It’s hard to fathom a life without it. Google Reader users, however, got a small taste of life would be like without the Big G in our lives.

It is very difficult to say exactly how the entire world would be able to work without Google – which is the most frequently visited website in the world. Google is a huge company which employs more than 30,000 people. There are a wide range of applications offered by Google and many of them are completely free. Users have the flexibility of using e-mail or Gmail and Google Docs for the purpose of sharing different types of documents. Google offers maps for the purpose of navigation, Calendar for organizing different activities during the week. Apart from this, Google offers Analytics for the purpose of tracking statistics about a website and Blogger for setting up an attractive blog for professional as well as personal purposes. Lineup of services offered by Google also includes Google Patents, Scholar, Finance, Groupsand Google+ for social networking. You also get the Image search option which enables you to get hold of the best images that you would like to use. Not to mention, Google search engine which has completely revolutionized the whole procedure of getting useful information on the internet. There are a lot of things offered by Google for accomplishing a number of tasks without putting in much effort and also without spending much money.

The use of library card catalogs would increase because people would actually visit libraries for getting required information on different topics. Carrying out a research on a particular topic would take a long time because researchers would not get the flexibility of carrying out their researches from home. This actually means that you would have to make good efforts in trying to find an answer for even some of your minutest queries. You can use other search engines but you would not get the results as fast and as accurate as Google. It would be a financial implosion for people who work for Google and the companies who carry out their advertising campaigns of Google. Almost all the websites or online stores promoting and selling their products and services online would lose web presence.

Having lost the power to find everything on search engine, people would need to talk to each other more. Forums will start to be bombarded with small queries. People would often meet up in big groups to discuss things as there was no Google to tell them stuff. Instead of Googling everything whenever they wanted, people would try and remember more stuff. As is the case with phone book in mobiles, we no longer remember phone numbers of our family or friends. Same is with Google. We don’t even make an effort to remember stuff because we know we can Google it any time we want.

But we are glad that Larry Page invented Google.

Can you think of other fun things that might happen if there was no Google? Tell us in the comments below.

SOURCES: TECHWORM

Hackers could have drained your Venmo account in minutes, thanks to Siri

Venmo’s flaw could have allowed anyone to use Siri on a locked iPhone to empty your account [Video]

Martin Vigo, a product security engineer for SalesForce recently discovered that by just using Siri, anyone could empty a Venmo account on a locked iPhone in less than two minutes, stealing as much as the weekly limit of $2999.99.

Venmo is a PayPal-owned money payment service app that allows users to transfer money between one another using a mobile phone or web interface. The users can link their bank accounts, debit cards, or credit cards to their Venmo account and use it to pay bills, friends with just a few taps. Besides sending money, you can also request people to pay you.

One of the app’s features is that it allows one user to “charge” other users for something, which results in an SMS notification being sent to the person who was charged. When that happens, the recipient can reply to the SMS with a six-digit code that was sent in the original message, which completes the payment.

Vigo contacted and notified the payment service, who patched the design flaws in the Venmo app and iOS that allowed stealing money from other people’s Venmo accounts. They responded within 18 days of being notified by killing the SMS “reply-to-pay” functionality in order to prevent such attacks.

How did this vulnerability occur?

The vulnerabilities have to do with the way iOS allows you to perform a limited range of actions, like sending text messages and initiating phone calls, without actually having to unlock the phone with a PIN number or fingerprint. In combination with Siri commands and other methods, the flaws allow an attacker to compel a victim to make a payment through the Venmo app.

So, how does it work?

The SMS notification is not enabled by default in Venmo. To enable the Venmo SMS service, an attacker needs to tell Siri to send a text message to 86753 saying “START”. 86753 is a short code number owned by Venmo and used for all the SMS notifications. Then, the attacker has to put a request for payment to the compromised device. The maximum amount that can be requested is $299.99, with a weekly limit of $2,999.99.

The victim will be then asked by Venmo to confirm the request. It will do that by sending an SMS with a one-time payment validation code. In order for the payment to go through, the recipient has to text this back to Venmo. However, the attacker can do that by telling Siri to read the last SMS message received, making a note of the number, and then tell Siri to send a text back to the Venmo shortcode with it. And, voila it’s done. Oops, you have just been looted!!!

Below is a demo video of Vigo’s attack.

SOURCES: TECHWORM

Do You Know Why There Is a Cylinder At The End Of Your Charger?

What Is This Cylinder On Your Charger For?

While my laptop charger has never bugged me, but I always felt strange at times to see a bump in my laptop charger right after it connects to the laptop. I always use to wonder why the charger has a bump and what purpose does it serve?

You normally see these “bumps” on the mouse, keyboard and monitor cables in a typical computer system found in a home or office. You can also find them on power supply wires when a device (like a printer or scanner) uses an external transformer.

It turns out that these bumps are called ferrite bead. It may also be called blocks, core, rings, EMI (electromagnetic interference) filters, or chokes. A ferrite bead has the property of eliminating broadcast signals and prevents energy loss of the same type within the charger. This makes the charger much more effective and helps charge your computer more quickly. Their purpose is to reduce EMI and RFI (radio-frequency interference). These cylinders are responsible for stopping very large deviation of power over supply through the cable and power surges in currents that pass through the cable and prevent ‘choke’ within the wire to make it any further supply the current to the device. The blocking is most effective when it is near the source of the EMI, that’s why you will only find these ferrite beads near the end of the cables.

It also acts as a choke or inductor that blocks high frequency noise in electronic circuits. Ferrite bead employs the dissipation of high frequency currents in a ferrite ceramic to build high frequency noise suppression devices.

The bead is made up of ceramic compounds, derived from iron oxide and/or oxides of other transition metals. It helps to prevent the wire behave on over floating current like aerials. It slips over the cable when the cable is made, or it can be snapped around the cable in two pieces after the cable is made. The bead is encased in plastic — if you cut the plastic, all that you would find inside is a black metal cylinder. This metal wire can possibly serve as an antenna by absorbing or releasing any radiation while passing current around it.

The radiation released by the wires without the bead could cause interference with other electronic objects around them, which act as receivers of this radiation, for instance, causing noise in speakers. This phenomenon’s example can be seen when cell phones interfere with the signal devices such as radios and speakers, producing a recurring noise well known for electronic users.

Source: The Amazing Fact, Techworm

Have you ever wondered why ATM PINs have 4 digit Code? Here is why!

The really interesting reason why ATM PINs have a 4 digit code

You walk into your friendly neighborhood ATM kiosk and swipe your card. You then punch in a 4 PIN code to authenticate yourself and proceed to withdraw money. You may have been doing this mechanically since the day ATM was introduced but have you given a thought why ATM PINs have a 4 digit code?  No! Then read on..

Automated Teller Machines (ATM) were first introduced in 1967 and now have emerged as a best option to disburse cash. Instead of visiting your bank and waiting in a long queue to withdraw money, you just have to swipe your ATM card, punch in your secret 4 digit PIN and take away the money you require.

But if someone was to find or steal your card, the only barrier protecting your money is your 4-digit ATM PIN. Ever wondered why most PINs have only 4 digits? Given that an ATM dishes out money wouldnt the manufacturers of ATMS have been wiser to introduce a longish PIN say six digit or eight digit one. Isn’t that why our email passwords are also expected to be 6 letters or more?

You see there is a bit of story behind it. ATM was invented by a wellknown Scottish inventor John Adrian Shepherd-Barron, the man who pioneered the development of the ATM machine. Barron was born in Shillong and was son to a Wimbledon ladies doubles champion, Dorothy Barron. When testing out his invention, Barron had also proposed a 6-digit PIN.

However, the first person to use his invention was his wife, Caroline. We all know that behind every successful man is a woman, and Caroline apparently rejected the idea of using a six code PIN for her husband’s invention because she could only remember the numbers up to four.

When Barron came up with the idea when he realised that he could remember his six-figure army number. But he decided to check that with his wife, Caroline.

“Over the kitchen table, she said she could only remember four figures, so because of her, four figures became the world standard,” he laughs.

Reportedly, 6 numbers stringed together were too much information for her to recall.

Although, there are many banks nowadays that offer 6 digit PINs for security purposes, shouldn’t those of us using 4 digit PINs be thanking Caroline? It gets tough to recall those 4 digits at times, imagine what 6 or more would do to us?

SOURCE: TECHWORM