download paid apps/games directly from play store for free 2018

Get / download / install any top Paid premium Android Apps / games directly of google play store For Free without rooting Android (Latest)

Today i come with a high and new Tech Hack, so here i teach you about How to get Paid Android Apps / application For Free from Google play store or anywhere. Android OS are viral as the technology goes upstairs to upper stairs, so as many tekgyd readers message us and ask about How can they quickly install or get paid Android apps in their Android phones. Many of apps in google play store in very much expensive, like me many others don’t have an excess of money to download that paid apps, so here you can learn free methods to download paid apps on your Android smartphones.

There are so many useful apps available in Google Playstore but unfortunately, they are not free and we have to pay for them in order to install them. Another thing is that we all love Apps and want to access them without paying for them…isn’t?

No doubt Google Playstore is one of the biggest store for android apps but there are certain app store that can provide paid apps for free or there are certain ways to download Paid Apps for Free.

Before going through App you should allow third party app installation on your Mobile devices as by default Google Play store doesn’t allow installation of apps from other store’s. To do that follow the instruction given below.

Go to Menu >> Settings >> Security.

Check on “Unknown Sources” (Allow installation of non-Market apps).

You will now be able to download and install apps from third-party App Markets and other apk packages.

► Best Way To Download and Install  Android Paid Apps Free Without Root is by using aptoid app.

- Aptoide

Aptoide is a market place for android where you can install all apps for free. No more paying. In aptoide you can download paid apps and update them in aptoide. It is a great app and better than Blackmart Alpha. Aptoide is a distributed marketplace for mobile applications which runs on the Android operating system. In Aptoide, unlike the default Google Play Store, there is not a unique and centralized store but each user manages their own store.

It is the best alternative to Google Play store offering thousands of Paid Apps for Free. This app doesn’t host android apps themselves but let other user’s to upload applications.This app also make sure that the apps are 100% safe and doesn’t contain any any malicious code or content as it verifies all the apps before displaying it on their app.Here you can find many other apps also which were discontinued from Google Play store.The app also supports several different languages as well!

You may download apps from the app repositories set up by other Aptoide Uploaders. They have a number of security measures in place to keep malicious apps out. Look for the ‘Trusted’ stamp on the app before downloading to be sure.

Here you will find some discounted apps along with paid apps for free. Once you set the option to install third-party apps from unknown sources on your Android device, you can install the Aptoide app and start exploring trending and editor recommended apps that may be available to download for free.

Aptoide is an independent Android app marketplace and a curated repository that does not host apps on its own, but it lets other users, developers, and integrators upload apps and create their own Android Store on their platform.

#How To Install Aptoide –

1. Download & Install Aptoide App from http://en.aptoide.com/

 official Site in your Android smartphone.

2. Run this app and add a store in it.

3. Install Paid Android Apps For Free from Google play store or anywhere.

4. Enjoy Free Apps

#Features in Aptoide-

1.  Free Update After installing paid apps.

2.  Easy To Use.

3.  works in all version for Androids.

Read More

Autodesk inventor 2018 tutorials for beginners - autodesk inventor user interface

welcome to another Autodesk inventor 2018 tutorial for beginners. in this video, I gave little information related to user interface of Autodesk Inventor. 

topic covered in this video are as follows: 

- how the status bar can be used as your personal guide in autodesk inventor. 
- difference between hard snap and soft snap in autodesk inventor. 

 I have drawn two circles to explain status bar, hard snap and soft snap in autodesk inventor.

Read More

This New Android Malware Can Physically Damage Your Phone

Due to the recent surge in cryptocurrency prices, not only hackers but also legitimate website administrators are increasingly using JavaScript-based cryptocurrency miners to monetize by levying the CPU power of your PC to mine Bitcoin or other cryptocurrencies.

Just last week, researchers from AdGuard discovered that some popular video streaming and ripper sites including openload, Streamango, Rapidvideo, and OnlineVideoConverter hijacks CPU cycles from their over hundreds of millions of visitors for mining Monero cryptocurrency.

Now, researchers from Moscow-based cyber security firm Kaspersky Lab have uncovered a new strain of Android malware lurking in fake anti-virus and porn applications, which is capable of performing a plethora of nefarious activities—from mining cryptocurrencies to launching Distributed Denial of Service (DDoS) attacks.

Dubbed Loapi, the new Android Trojan can perform so many more malicious activities at a time that can exploit a handset to the extent that within just two days of infection it can cause the phone's battery to bulge out of its cover.

Described as a "jack-of-all-trades" by the researchers, Loapi has a modular architecture that lets it conduct a variety of malicious activities, including mining the Monero cryptocurrency, launching DDoS attacks, bombarding infected users with constant ads, redirecting web traffic, sending text messages, and downloading and installing other apps.

Loapi Destroyed An Android Phone In Just 2 Days

 

When analyzed a Loapi sample, Kaspersky's researchers discovered that the malware mines the Monero cryptocurrency so intensely that it destroyed an Android phone after two days of testing, causing the battery to bulge and deforming the phone cover.

According to researchers, the cybercriminals behind Loapi are the same responsible for the 2015 Android malware Podec. They are distributing the malware through third-party app stores and online advertisements that pose as apps for "popular antivirus solutions and even a famous porn site."

A screenshot in the Kaspersky blog suggests that Loapi impersonates as at least 20 variations of adult-content apps and legitimate antivirus software from AVG, Psafe DFNDR, Kaspersky Lab, Norton, Avira, Dr. Web and CM Security, among others.

Upon installation, Loapi forces the user to grant it 'device administrator' permissions by looping a pop-up until a victim clicks yes, which gives the malicious app the same power over your smartphone that you have.

 This highest level privilege on a device would also make the Loapi malware ideal for user espionage, though this capability is not yet present in the malware, the Kaspersky researchers think this can be included in the future.

Loapi Malware Aggressively Fights to Protect Itself

Researchers also said the malware "aggressively fights any attempts to revoke device manager permissions" by locking the screen and closing phone windows by itself.

Loapi communicates with the module-specific command and control (C&C) servers, including advertisement module, SMS module and mining module, web crawler, and proxy module, for different functions to be performed on the infected device.

By connecting with one of the above-mentioned C&C servers, Loapi sends a list of legitimate antivirus apps that pose it danger and claims the real app as malware and urges the user to delete it by showing the pop-up in a loop until the user finally deletes the app.

"Loapi is an interesting representative from the world of malicious Android apps. It’s creators have implemented almost the entire spectrum of techniques for attacking devices: the Trojan can subscribe users to paid services, send SMS messages to any number, generate traffic and make money from showing advertisements, use the computing power of a device to mine cryptocurrencies, as well as perform a variety of actions on the internet on behalf of the user/device," the researchers concluded.

Fortunately, Loapi failed to make its ways to Google Play Store, so users who stick to downloads from the official app store are not affected by the malware. But you are advised to remain vigilant even when downloading apps from Play Store as malware often makes its ways to infect Android users.

Read More

best barcode scanner and qr code reader app for android

QR codes are everywhere: these little-pixelated squares appear on billboards and bus shelters, in magazine ads and on product packaging. Unlocking their contents can share contact info or Wi-Fi passwords, or take you to the website for a film you’ve just seen the poster for. So how do you use them? Here’s how to scan QR codes with an Android phone.

If you want to start scanning codes with your smartphone and you are looking for best qr code reader for android and best android barcode scanner, then you've come to the right place. Here I will explain how to scan QR and barcodes with your Android smartphone.

What are QR codes?

QR is an acronym for Quick Response. It’s a smarter version of the ubiquitous barcode, and it was originally developed in Japan for the automotive industry. Machines can read QR codes more quickly than barcodes, and QR codes can store more data in less space too.

For most of us, the main reason to use QR codes is to obtain a web link to find out more information about something or to get a password for a wireless network: scan the code and the information should appear in your web browser or connect you to the network. But how do you scan it? All you need is the right app.


QR Codes were invented by Denso Wave in 1994. At first, they were used to track vehicle parts during the manufacturing process. Now, QR Codes are a popular marketing tool, allowing users to quickly access websites and other media. A QR Code can contain such things as text, a URL, an SMS or a phone number. This video guide will show you how to read them.


QR codes are used for storing alphanumerical data, thus they are a good way of sharing information, like a website or product information on a small square. Obviously, your Android smartphone or tablet can easily be turned into a QR code reader with the appropriate application. I have identified best QR code-reading app in this video.

- Barcode Scanner

it is qr code and barcode scanner app for android

qr code scan & barcode scanner free download from https://play.google.com/store/apps/de...

This aptly named app from the ZXing Team is a veteran of its kind, as it is one of the most well-known barcode reading apps. It does exactly what its name suggests: scans barcodes. It supports many types of 1D and 2D barcodes and has quite a lot of settings to be configured. It can automatically open recognized web addresses, stores a history of scanned codes, can use the device’s LED light to help read codes, can scan inverted (white on black) codes and can even scan many barcodes continuously with the help of the bulk scan mode.

- overview of free barcode scanner app

this barcode scanner software can Scan barcodes on products, or Data Matrix and QR Codes containing URLs, contact info, etc

it is best qr code reader app and best android barcode scanner app in my opinion

with this app, you can Scan barcodes on products, or Data Matrix and QR Codes containing URLs, contact info, etc.

- Are there any risks to scanning QR codes?

Actually, yes. A scam known as 'attagging' involves pasting new QR codes over existing ones, for example by pasting a label over the QR code on a poster. The new code could link to malicious software that might then access your camera or your personal data. In Russia, a QR code scam made phones send premium-rate texts at US$6 per text. Such malware is very, very unusual, but it does exist and has done for several years.

- Conclusion

QR codes might not have become the groundbreaking thing they were hoped to be, but they are still found everywhere and can be useful. Of course, they’re not worth much without a scanner, but that’s where your smart Android device comes into play. There is an incredible number of barcode reading applications available on the Google Play store and most of qr code reader app have the same features. In this video, I tried to share an application that is at least a bit unique, or at least they are very fast and can scan codes in a snap.

Read More

polyline edit command in Autocad 2018

if you want to Modify and Edit Polylines in AutoCAD then you came to right place because this video will show you how to edit polyline in autocad by using polyline edit command in autocad.

covered topics in this video are as follows:
- join polylines autocad by using autocad join command
- create closed polyline in autocad
- edit polyline width
- autocad polyline edit vertex
- convert polyline to arc in autocad
- convert polyline to spline
- autocad convert arc to straight lines with autocad decurve polyline command
- break a polyline in autocad
- move polyline

Read More

best paid antivirus for pc? - escan internet security suite review (2017 - 2018)

if you are looking for eScan Internet Security Suite 14 review then you came to right place because in this video you will get little information about features of escan internet security suite
and I have also tested eScan Internet Security Suite 14 with some malicious URL/unsafe websites/virus websites in order to check web protection of escan antivirus. and I also used some malware samples to check detection of escan antivirus.

► escan internet security features

Provides Smart Proactive Protection:

With highly sophisticated Heuristics Algorithms, eScan Antivirus software protects your computer from unknown malware that are continuously released by malware writers.

Restricts spam e-mail:

eScan’s advanced anti-spam feature filters out the unwanted e-mail from entering your inbox and delivers reports about any detected spam.

Your Data remains protected:

Auto Back Up and Restore feature automatically restores all your valuable data so that you don’t lose any critical information in case of system crash or Malware attack.

Monitors your Kid’s online activities:

eScan Antivirus facilitates parental control to keep your children safe online by controlling their access to the Internet applications, games and objectionable websites.

Prevents Malware Attacks:

With Real-time Protection, eScan Antivirus Solution detects and stops malware from entering into your system and prevents the files or folders from encryption.

Effective Endpoint Security:

eScan antivirus software prevents data thefts and Virus infections via USB or Firewire-based portable storage devices, such as Flash Drives/Pen Drives, SD Card, Imaging devices, Webcam and Portable Hard Disks.

Offers faster On-Demand scanning:

The On-Demand scanning feature of eScan scans your files, folders, memory, registry, services and all storage devices.

Blocks new and unknown threats:

With latest cloud technology, eScan identifies and safeguards your computer from latest and unknown threats without waiting for daily or traditional virus signature updates.

Two Way Firewall:

It filters incoming and outgoing network activities on the computer and protects it from all types of network-based attacks.

Protects files and folders from malware:

File & Folder Protection feature of eScan prevents your files and folders from getting corrupted due to malware attacks.

Protect your computer from unauthorized users

Read More

Autodesk inventor 2018 tutorials for beginners - heads up display, line, trim, extrude in inventor

covered topic in this video are as follows:
- Heads-Up Display
- draw line with an angle in the inventor
- fillet in inventor
- trim in inventor
- extrude in inventor

in this video, i tried to explain about heads-up display so I explained it by drawing one triangle. and while drawing triangle I used the line, trim, fillet, extrude command.

Heads-Up Display (HUD) Settings Reference:-

Enable Pointer Input:
When active, the starting point for a sketch element is displayed as Cartesian coordinates (X and Y values) in the value input boxes near the cursor. Disabling Pointer Input turns off the coordinate display of the starting point of a sketch element.

- Pointer Input options:

Use to switch the starting point for a sketch element between Cartesian and Polar coordinates.

Cartesian Coordinates:

When selected, the starting point of a sketch element is displayed with X and Y values relative to the sketch origin of X = 0, Y = 0. This is the default setting.

Polar Coordinates:

When selected, the starting point of a sketch element is displayed with length (L) and angle (A) values relative to the sketch origin of X = 0, Y = 0.

Enable Dimension Input where possible:

When active, values are entered using a combination of both regular Cartesian and Polar coordinates depending on the type of sketch element being drawn. Dimensions are automatically placed on sketch geometry when the TAB key is used to toggle between value input fields.

When this setting is disabled, values are entered using Delta X and Delta Y Cartesian coordinates only. Polar coordinates cannot be used. Dimensions are not placed on sketch geometry even when using the TAB key to toggle between value input fields.

 

- Dimension Input options:

Cartesian Coordinates:

When selected, both positive and negative Cartesian X and Y coordinates are entered. The values are calculated based on the last pick point.

Polar Coordinates:

When selected, values are entered using a combination of regular Cartesian and Polar coordinates depending on the type of sketch element being drawn. The values are calculated based on the last pick point. This is the default setting.

Read More

Firefox 58 to Block Canvas Browser Fingerprinting By Default to Stop Online Tracking

Do you know? Thousands of websites use HTML5 Canvas—a method supported by all major browsers that allow websites to dynamically draw graphics on web pages—to track and potentially identify users across the websites by secretly fingerprinting their web browsers.

Over three years ago, the concern surrounding browser fingerprinting was highlighted by computer security experts from Princeton University and KU Leuven University in Belgium.

In 2014, the researchers demonstrated how browser's native Canvas element can be used to draw unique images to assign each user's device a number (a fingerprint) that uniquely identifies them.

These fingerprints are then used to detect when that specific user visits affiliated websites and create a profile of the user's web browsing habits, which is then shared among advertising partners for targeted advertisements.

Since then many third-party plugins and add-ons (ex. Canvas Defender) emerged online to help users identify and block Canvas fingerprinting, but no web browser except Tor browser by default blocks Canvas fingerprinting.

Good news—the wait is over.

Mozilla is testing a new feature in the upcoming version of its Firefox web browser that will grant users the ability to block canvas fingerprinting.

The browser will now explicitly ask user permission if any website or service attempts to use HTML5 Canvas Image Data in Firefox, according to a discussion on the Firefox bug tracking forum.

The permission prompt that Firefox displays reads:

"Will you allow [site] to use your HTML5 canvas image data? This may be used to uniquely identify your computer."

Once you get this message, it's up to you whether you want to allow access to canvas fingerprinting or just block it. You can also check the "always remember my decision" box to remember your choice on future visits as well.

Starting with Firefox 58, this feature would be made available for every Firefox user from January 2018, but those who want to try it early can install the latest pre-release version of the browser, i.e. Firefox Nightly.

Besides providing users control over canvas fingerprinting, Firefox 58 will also remove the controversial WoSign and its subsidiary StartCom root certificates from Mozilla's root store.

With the release of Firefox 52, Mozilla already stopped allowing websites to access the Battery Status API and the information about the website visitor’s device, and also implemented protection against system font fingerprinting. 

Read More

Bad Rabbit Ransomware Uses Leaked 'EternalRomance' NSA Exploit to Spread

A new widespread ransomware worm, known as "Bad Rabbit," that hit over 200 major organisations, primarily in Russia and Ukraine this week leverages a stolen NSA exploit released by the Shadow Brokers this April to spread across victims' networks.

Earlier it was reported that this week's crypto-ransomware outbreak did not use any National Security Agency-developed exploits, neither EternalRomance nor EternalBlue, but a recent report from Cisco's Talos Security Intelligence revealed that the Bad Rabbit ransomware did use EternalRomance exploit.

NotPetya ransomware (also known as ExPetr and Nyetya) that infected tens of thousands of systems back in June also leveraged the EternalRomance exploit, along with another NSA's leaked Windows hacking exploit EternalBlue, which was used in the WannaCry ransomware outbreak.

Bad Rabbit Uses EternalRomance SMB RCE Exploit

Bad Rabbit does not use EternalBlue but does leverage EternalRomance RCE exploit to spread across victims' networks.

Microsoft and F-Secure have also confirmed the presence of the exploit in the Bad Rabbit ransomware.

EternalRomance is one of many hacking tools allegedly belonged to the NSA's elite hacking team called Equation Group that were leaked by the infamous hacking group calling itself Shadow Brokers in April this year.

EternalRomance is a remote code execution exploit that takes advantage of a flaw (CVE-2017-0145) in Microsoft's Windows Server Message Block (SMB), a protocol for transferring data between connected Windows computers, to bypass security over file-sharing connections, thereby enabling remote code execution on Windows clients and servers.

Along with EternalChampion, EternalBlue, EternalSynergy and other NSA exploits released by the Shadow Brokers, the EternalRomance vulnerability was also patched by Microsoft this March with the release of a security bulletin (MS17-010).

Bad Rabbit was reportedly distributed via drive-by download attacks via compromised Russian media sites, using fake Adobe Flash players installer to lure victims' into install malware unwittingly and demanding 0.05 bitcoin (~ $285) from victims to unlock their systems.

How Bad Rabbit Ransomware Spreads In a Network

According to the researchers, Bad Rabbit first scans the internal network for open SMB shares, tries a hardcoded list of commonly used credentials to drop malware, and also uses Mimikatz post-exploitation tool to extract credentials from the affected systems.

Bad Rabbit can also exploit the Windows Management Instrumentation Command-line (WMIC) scripting interface in an attempt to execute code on other Windows systems on the network remotely, noted EndGame.

However, according to Cisco's Talos, Bad Rabbit also carries a code that uses EternalRomance, which allows remote hackers to propagate from an infected computer to other targets more efficiently.

"We can be fairly confident that BadRabbit includes an EternalRomance implementation used to overwrite a kernel’s session security context to enable it to launch remote services, while in Nyetya it was used to install the DoublePulsar backdoor," Talos researchers wrote.

"Both actions are possible due to the fact that EternalRomance allows the attacker to read/write arbitrary data into the kernel memory space."

Is Same Hacking Group Behind Bad Rabbit and NotPetya?

Since both Bad Rabbit and NotPetya uses the commercial DiskCryptor code to encrypt the victim's hard drive and "wiper" code that could erase hard drives attached to the infected system, the researchers believe it is "highly likely" the attackers behind both the ransomware outbreaks are same.

 

"It is highly likely that the same group of hackers was behind BadRabbit ransomware attack on October the 25th, 2017 and the epidemic of the NotPetya virus, which attacked the energy, telecommunications and financial sectors in Ukraine in June 2017," Russian security firm Group IB noted.

"Research revealed that the BadRabbit code was compiled from NotPetya sources. BadRabbit has same functions for computing hashes, network distribution logic and logs removal process, etc."

NotPetya has previously been linked to the Russian hacking group known as BlackEnergy and Sandworm Team, but since Bad Rabbit is primarily targeting Russia as well, not everyone seems convinced with the above assumptions.

How to Protect Yourself from Ransomware Attacks?

In order to protect yourself from Bad Rabbit, users are advised to disable WMI service to prevent the malware from spreading over your network.

Also, make sure to update your systems regularly and keep a good and effective anti-virus security suite on your system.

Since most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs, you should always exercise caution before falling for any of these.

Most importantly, to always have a tight grip on your valuable data, keep a good backup routine in place that makes and saves copies of your files to an external storage device that isn't always connected to your PC.

Read More

Kaspersky Opens Antivirus Source Code for Independent Review to Rebuild Trust

Kaspersky Lab — We have nothing to hide!

Russia-based Antivirus firm hits back with what it calls a "comprehensive transparency initiative," to allow independent third-party review of its source code and internal processes to win back the trust of customers and infosec community.

Kaspersky launches this initiative days after it was accused of helping, knowingly or unknowingly, Russian government hackers to steal classified material from a computer belonging to an NSA contractor.

Earlier this month another story published by the New York Times claimed that Israeli government hackers hacked into Kaspersky’s network in 2015 and caught Russian hackers red-handed hacking US government with the help of Kaspersky.

US officials have long been suspicious that Kaspersky antivirus firm may have ties to Russian intelligence agencies.

Back in July, the company offered to turn over the source code for the U.S. government to audit.

However, the offer did not stop U.S. Department of Homeland Security (DHS) from banning and removing Kaspersky software from all of the government computers.

In a blog post today the company published a four-point plan:

• Kaspersky will submit its source code for independent review by internationally recognised authorities, starting in Q1 2018.
• Kaspersky also announced an independent review of its business practices to assure the integrity of its solutions and internal processes.
• Kaspersky will establish three transparency centres in next three years, "enabling clients, government bodies & concerned organisations to review source code, update code and threat detection rules."
• Kaspersky will pay up to $100,000 in bug bounty rewards for finding and reporting vulnerabilities in its products.

"With these actions, we will be able to overcome mistrust and support our commitment to protecting people in any country on our planet." Kaspersky's CEO Eugene said.

However, infosec experts' twitter commentary shows that the damage has already been done.

"Code review is absolutely meaningless. All Russian intelligence need is an access to KSN, Kaspersky's data lake which is a treasure trove of data. Even open sourcing the entire product won't reveal or even help with revealing that." Amit Serper, the security researcher at Cybereason, tweeted.

Now it is important to see whether these actions will be enough to restore the confidence of US government agencies in Kaspersky or the company will be forced to move its base out of Russia.

Read More

trend micro maximum security web prevention and detection test

if you are looking for trend micro maximum security 11.1.1045 review then you came to right place because in this video you will get little information about features of trend micro maximum security

and i have also tested trend micro maximum security 11.1.1045 with some malicious url/unsafe websites/virus websites in order to check web protection of trend micro. and i also used some malware samples to check detection of trend micro.

 

trend micro maximum security features:-

- Protects Against Ransomware: Safeguards documents from unauthorised encryption, as well as backing up files that have been locked by suspicious programs

- Blocks Dangerous Websites: Protects against threats by identifying and blocking dangerous links on websites and in social networks, emails, and instant messages

- Manages Your Online Privacy: Protects Your Privacy on Facebook, Google+, Twitter, and LinkedIn
Identifies privacy settings on social sites that may expose your personal information and lead to identity theft

- Guards Against Identity Theft: Detects spam emails containing phishing scams that can trick you into revealing private personal information

- Secure Online Banking and Shopping: Verifies SSL certificate authenticity, protecting your financial information from unsecure banking and shopping sites

- Manages and Encrypts Passwords: Includes a password manager to easily sign into websites without having to remember multiple passwords. Works across multiple devices

- Toll Free Product Support: Product Support Includes standard product support

- Safeguards Children Online: Protects Kids Online. Lets you control desktop application access and restrict online access for kids, protecting them from inappropriate websites

- Secures Android and iOS Mobile Devices: Locates lost or stolen devices and provides a secure browser

Read More

Autocad 2018 polyline command tutorial - how to draw polyline in autocad 2018

if you are looking for autocad polyline tutorial and polyline autocad shortcut then you came to right place because in this video, you will learn all about polyline autocad command.

A Polyline is a single object that consists of line segments and arcs. It is more versatile than a line as you can assign a width to it.

Read More

do you need antivirus for windows 10 or not?

does windows 10 needs antivirus or not?

Is paying for antivirus a waste of money?

if you have questions like this then you will get an answer of your question in this windows 10 security review.

in this, windows 10 security test, I used "8 molecious url" to test web Prevention of Microsoft edge. and in windows defender test, I used "84 malware sample" to check detection.

Microsoft has done a good thing of making sure that every Windows 10 PC has at least some degree of antivirus protection. It's better than nothing, by a long shot. However, it simply ignores lower-risk malware types, rather than letting you choose whether to block them. Its lab test scores, while improved, still aren't the best.

Read More

Passwords For 540,000 Car Tracking Devices Leaked Online

Another day, another news about a data breach, though this is something disconcerting.

Login credentials of more than half a million records belonging to vehicle tracking device company SVR Tracking have leaked online, potentially exposing the personal data and vehicle details of drivers and businesses using its service.

Just two days ago, Viacom was found exposing the keys to its kingdom on an unsecured Amazon S3 server, and this data breach is yet another example of storing sensitive data on a misconfigured cloud server.

The Kromtech Security Center was first to discover a wide-open, public-facing misconfigured Amazon Web Server (AWS) S3 cloud storage bucket containing a cache belonging to SVR that was left publicly accessible for an unknown period.

Stands for Stolen Vehicle Records, the SVR Tracking service allows its customers to track their vehicles in real time by attaching a physical tracking device to vehicles in a discreet location, so their customers can monitor and recover them in case their vehicles are stolen.

The leaked cache contained details of roughly 540,000 SVR accounts, including email addresses and passwords, as well as users' vehicle data, like VIN (vehicle identification number), IMEI numbers of GPS devices.

Since the leaked passwords were stored using SHA-1, a 20-years-old weak cryptographic hash function that was designed by the US National Security Agency (NSA), which can be cracked with ease.

The leaked database also exposed 339 logs that contained photographs and data about vehicle status and maintenance records, along with a document with information on the 427 dealerships that use SVR's tracking services.

Interestingly, the exposed database also contained information where exactly in the car the physical tracking unit was hidden.

According to Kromtech, the total number of devices exposed "could be much larger given the fact that many of the resellers or clients had large numbers of devices for tracking."

Since SVR's car tracking device monitors a vehicle everywhere for the past 120 days, anyone with access to SVR users' login credentials could both track a vehicle in real time and create a detailed log of every location the vehicle has visited using any internet connected device like a desktop, laptop, mobile phone or tablet.

Eventually, the attacker could outright steal the vehicle or even rob a home when they know a car's owner is out.

Kromtech responsible alerted the company of the misconfigured AWS S3 cloud storage bucket, which has since been secured. However, It is unclear whether the publically accessible data was possibly accessed by hackers or not.  

Read More

Autodesk inventor 2018 tutorials for beginners - autodesk inventor user interface

The interface for Autodesk Inventor is similar to many Windows-based applications, and 3D design software packages. The graphics window, the ribbon, the application frame, and the browser are all contained within the main window. These tutorials show you how to navigate the interface so you can begin building your designs.

Read More

APT33: Researchers Expose Iranian Hacking Group Linked to Destructive Malware

Security researchers have recently uncovered a cyber espionage group targeting aerospace, defence and energy organisations in the United States, Saudi Arabia and South Korea.
According to the latest research published Wednesday by US security firm FireEye, an Iranian hacking group that it calls Advanced Persistent Threat 33 (or APT33) has been targeting critical infrastructure, energy and military sectors since at least 2013 as part of a massive cyber-espionage operation to gather intelligence and steal trade secrets.
The security firm also says it has evidence that APT33 works on behalf of Iran's government.

FireEye researchers have spotted cyber attacks aimed by APT33 since at least May 2016 and found that the group has successfully targeted aviation sector—both military and commercial—as well as organisations in the energy sector with a link to petrochemical.

The APT33 victims include a U.S. firm in the aerospace sector, a Saudi Arabian business conglomerate with aviation holdings, and a South Korean company involved in oil refining and petrochemicals.

Most recently, in May 2017, APT33 targeted employees of a Saudi organisation and a South Korean business conglomerate using a malicious file that attempted to entice them with job vacancies for a Saudi Arabian petrochemical company.

"We believe the targeting of the Saudi organisation may have been an attempt to gain insight into regional rivals, while the targeting of South Korean companies may be due to South Korea’s recent partnerships with Iran’s petrochemical industry as well as South Korea’s relationships with Saudi petrochemical companies," the FireEye report reads.

APT33 targets organisations by sending spear phishing emails with malicious HTML links to infect targets' computers with malware. The malware used by the espionage group includes DROPSHOT (dropper), SHAPESHIFT (wiper) and TURNEDUP (custom backdoor, which is the final payload).

 However, in previous research published by Kaspersky, DROPSHOT was tracked by its researchers as StoneDrill, which targeted petroleum company in Europe and believed to be an updated version of Shamoon 2 malware.

"Although we have only directly observed APT33 use DROPSHOT to deliver the TURNEDUP backdoor, we have identified multiple DROPSHOT samples in the wild that drop SHAPESHIFT," the report reads.

The SHAPESHIFT malware can wipe disks, erase volumes and delete files, depending on its configuration.

According to FireEye, APT 33 sent hundreds of spear phishing emails last year from several domains, which masqueraded as Saudi aviation companies and international organisations, including Boeing, Alsalam Aircraft Company and Northrop Grumman Aviation Arabia.

The security firm also believes APT 33 is linked to Nasr Institute, an Iranian government organisation that conducts cyber warfare operations.

In July, researchers at Trend Micro and Israeli firm ClearSky uncovered another Iranian espionage group, dubbed Rocket Kittens, that was also active since 2013 and targeted organisations and individuals, including diplomats and researchers, in Israel, Saudi Arabia, Turkey, the United States, Jordan and Germany.

However, FireEye report does not show any links between both the hacking group. For more technical details about the APT33 operations, you can head on to FireEye's official blog post.

Read More