Autodesk inventor file types

File types and templates in Inventor:-

You can open existing files, or start new files using templates. To see the templates, click the Application menu and then click on "New". In the New File dialog box, templates with predefined units are available in the file types for your application. Tabs in the dialog box contain the different standards.

Note: Before you open a file or start a new file, create or activate a project file to set the file location.
A template can contain property information, such as part and project data, and drawing views. You can see information stored in a file by viewing its properties.

Templates storage folders
Templates are stored in the following folders in the English or Metric subfolders.

Windows 7 and Windows 8®: C:\Users\Public\Documents\Autodesk\Inventor(version number)\Templates
Subfolders in the Templates folder display as tabs in the Open New File dialog box.

You can create and save custom templates in the Templates folder.

1. inventor Part (.ipt) Files definition:

you might be wondering, what does ipt stand for in inventor?

When you open a part file, you are in the part environment. Part commands manipulate sketches, features, and bodies that combine to make parts. You can insert a single body part into assemblies, and constrain them in positions they occupy when the assembly is manufactured. You can extract multiple part files from a multi-body part.

Most parts start with a sketch. A sketch is the profile of a feature and any geometry (such as a sweep path or axis of rotation) required to create the feature.

A part model is a collection of features. If necessary, solid bodies in a multi-body part file can share features. Sketch constraints control geometric relationships such as parallel and perpendicular. Dimensions control the size. Collectively this method is called Parametric modeling. You can adjust the constraints or dimensional parameters that control the size and shape of a model, and automatically see the effect of your modifications.

The following image shows a single body part (upper half of the image), and a multi-body part (lower half of the image). Notice the different part icons in each image.

2. what is the file extension of an inventor Assembly Files?

you might be wondering, what does the file extension .iam mean?

in Autodesk Inventor, you place components that act as a single functional unit into an assembly document.Assembly constraints define the relative position these components occupy with respect to each other. An example is the axis of a shaft aligning with a hole in a different component.

When you create or open an assembly file, you are in the assembly environment. Assembly commands manipulate whole subassemblies and assemblies. You can group parts that function together as a single unit and then insert the subassembly into another assembly.

You can insert parts into an assembly or use sketch and part commands to create parts in the context of an assembly. During these operations, all other components in the assembly are visible.

To complete a model, you can create assembly features that affect multiple components, such as holes that pass through multiple parts. Assembly features often describe specific manufacturing processes such as post-machining.

3. Presentation (.ipn) Files

Presentation files are a multi-purpose file type. Use a presentation file to:

Create an exploded view of an assembly to use in a drawing file.
Create an animation which shows the step by step assembly order. The animation can contain view changes and the visibility state of components at each step in the assembly process. You can save the animation to a .wmv or .avi file format.

4. Drawing (.idw, .dwg) Files

After you create a model, you can create a drawing to document your design. In a drawing, you place views of a model on one or more drawing sheets. Then you add dimensions and other drawing annotations to document the model.

A drawing that documents an assembly can contain an automated parts list and item balloons in addition to the required views.

Read More

Dark Web Users Suspect "Dream Market" Has Also Been Backdoored by Feds

By now you might be aware of the took down of two of the largest online dark websites—AlphaBay and Hansa—in what's being called the largest-ever international operation against the dark web's black market conducted by the FBI, DEA (Drug Enforcement Agency) and Dutch National Police.

But the interesting aspect of the takedown was that the federal authorities shut down AlphaBay, but took control of the Hansa market and kept it running for at least a month in an effort to monitor the activities of its visitors.

The visitors of Hansa market also included a massive flood of Alphabay refugees, as the seizer of AlphaBay Market forced their visitors to join the Hansa market for illegal trading and purchasing.

However, not just Hansa, after AlphaBay's shutdown, many of its users also joined another website known as Dream Market, which is believed to be the second-largest dark web marketplace, ahead of Hansa.

After the shutdown of both AlphaBay and Hansa, Dream Market has emerged as the leading player, but now some Reddit users on several "r/Dream_Market" threads have expressed concerns about the Dream Market, which has been in business since 2013.

One Reddit user said that Dream Market has been compromised in a similar manner as Hansa and is already under police control.

"I got contacted by an ex-Hansa staff member telling me that the operation is apparently bigger than we currently assume, that 'there will be a bloodbath, a purge' and that 'any vendor on HANSA should immediately seize his operation, lawyer up and hide his trails'," the Reddit user post read.

Possibly the Real IP of Dream Market "Mistakenly" Exposed

 

 

Another Redditor claimed to have discovered a non-encrypted IP address in Dream Market’s source code, saying that police might have taken over control of the dark market as well and are now actively monitoring its visitors.

"We found a clear address IP on the javascript source code of the market. The police must know it from a long time. GO AWAY FROM HERE RIGHT NOW !!!," the Redditor wrote along with a piece of Site's Source Code.

After exploring a bit, I found that the clearnet IP address 194.9.94.82 mentioned in the JavaScript file (lchudifyeqm4ldjj.onion/market.js) is owned by "Loopia AB," a Swedish hosting company.

 

This JavaScript file has not been added or altered recently, as according to some moderators, the file has been there from at least past 9 months, and the code itself doesn’t indicate any signs of hijack or interception.

However, here's the big blunder — Exposure of the possible real IP address of the server, which is supposed to be hidden behind the Tor Onion Router, is one of the biggest mistakes Dream Market operators might have made that could have already given an opportunity to law enforcement agencies to raid the hosting company and take control of the servers.

While the claims that Dream Market is under police control are yet to be verified, vendors who joined Dream Market may still be compromised by law enforcement.

Meanwhile, some anonymous users on Reddit are also encouraging dark web users to visit Dream Market, saying "CALM DOWN! DREAM IS WORKING FINE!"

Benefitted from the shutdown of its rivals, Dream Market had 57,000 listings for drugs and 4,000 listings for opioids on Thursday. 

Read More

how to create your own blog website for free 2017

Having a blog is a great thing because you can share anything you want (…and if you are wise you can also earn a decent income from your blog).

Here in this video, I have shown about how to make blogger account with blogspot.

There are many blogging platforms which offer users the ability to create free blogs. If you are looking for a simple free blog, my suggestion would be to start blogging with WordPress.com or BlogSpot.com. in this video i have talked about blogspot.

BlogSpot allows you to create a free blog, but it does have limitations.

However, for a beginner it is a great way to learn how to create a blog and begin the blogging process.

This post is dedicated to the “beginners” who are new to blogging and would like to get started by learning the basics involved in the process.


Before I begin the complete tutorial, there are a couple of things you should know:
Firstly, BlogSpot is a blogging platform powered by Google. 

It offers you an opportunity to start a blog. BlogSpot, and it is product of google.
in this sense, it is a Google-centric blogging platform.

To create your free BlogSpot blog site, head over to https://www.blogger.com/about/ and login using your Google account. If you don’t have a Google (gmail) account, you can create one for free.

For a first time user, you will see an option to use the identity from your Google Plus profile, or you can use your limited BlogSpot profile. I recommend using your Google Plus profile.

Once you are logged in, then follow steps as shown in video to make your own free blog website on blogger.

Read More

Tor Launches Bug Bounty Program — Get Paid for Hacking!

With the growing number of cyber attacks and breaches, a significant number of companies and organisations have started Bug Bounty programs for encouraging hackers, bug hunters and researchers to find and responsibly report bugs in their services and get rewarded.

Following major companies and organisations, the non-profit group behind Tor Project – the largest online anonymity network that allows people to hide their real identity online – has finally launched a "Bug Bounty Program."

The Tor Project announced on Thursday that it joined hands with HackerOne to start a public bug bounty program to encourage hackers and security researchers to find and privately report vulnerabilities that could compromise the anonymity network.

HackerOne is a bug bounty startup that operates bug bounty programs for companies including Yahoo, Twitter, Slack, Dropbox, Uber, General Motors – and even the United States Department of Defense for Hack the Pentagon initiative.

Bug bounty programs are cash rewards gave by companies or organisations to white hat hackers and researchers who hunt for serious security vulnerabilities in their website or products and then responsibly disclose them.

The Tor Project announced its intention to launch a public bug bounty program in late December 2015 during a talk by the Tor Project at Chaos Communication Congress (CCC) held in Hamburg, Germany. However, it launched the invite-only bounty program last year.

The highest payout for the flaws has been kept $4,000 — bug hunters can earn between $2,000 and $4,000 for High severity vulnerabilities, between $500 and $2,000 for Medium severity vulnerabilities, and a minimum of $100 for Low severity bugs.

Moreover, less severe issues will be rewarded with a t-shirt, stickers and a mention in Tor's hall of fame.

"Tor users around the globe, including human rights defenders, activists, lawyers, and researchers, rely on the safety and security of our software to be anonymous online," Tor browser developer Georg Koppen said in a blog post. "Help us protect them and keep them safe from surveillance, tracking, and attacks."

The Tor Project is a non-profit organisation behind the Tor anonymizing network that allows any online user to browse the Internet without the fear of being tracked.

The Project first announced its plan to launch the bug bounty program weeks after it accused the FBI of paying the researchers of Carnegie Mellon University (CMU) at least $1 Million to help them Unmask Tor users and reveal their IP addresses, though FBI denies the claims. 

Read More

WikiLeaks Reveals CIA Teams Up With Tech to Collect Ideas For Malware Development

As part of its ongoing Vault 7 leaks, the whistleblower organisation WikiLeaks today revealed about a CIA contractor responsible for analysing advanced malware and hacking techniques being used in the wild by cyber criminals.

According to the documents leaked by WikiLeaks, Raytheon Blackbird Technologies, the Central Intelligence Agency (CIA) contractor, submitted nearly five such reports to CIA as part of UMBRAGE Component Library (UCL) project between November 2014 and September 2015.

These reports contain brief analysis about proof-of-concept ideas and malware attack vectors — publically presented by security researchers and secretly developed by cyber espionage hacking groups.

Reports submitted by Raytheon were allegedly helping CIA's Remote Development Branch (RDB) to collect ideas for developing their own advanced malware projects.

It was also revealed in previous Vault 7 leaks that CIA's UMBRAGE malware development teams also borrow codes from publicly available malware samples to built its own spyware tools.

Here's the list and brief information of each report:

Report 1 — Raytheon analysts detailed a variant of the HTTPBrowser Remote Access Tool (RAT), which was probably developed in 2015.

The RAT, which is designed to capture keystrokes from the targeted systems, was being used by a Chinese cyber espionage APT group called 'Emissary Panda.'

Report 2 — This document details a variant of the NfLog Remote Access Tool (RAT), also known as IsSpace, which was being used by Samurai Panda, Identified as another Chinese hacking group.

Equipped with Adobe Flash zero-day exploit CVE-2015-5122 (leaked in Hacking Team dump) and UAC bypass technique, this malware was also able to sniff or enumerate proxy credentials to bypass Windows Firewall.

Report 3 — This report contains details about "Regin" -- a very sophisticated malware sample that has been spotted in operation since 2013 and majorly designed for surveillance and data collection.

Regin is a cyber espionage tool, which is said to be more sophisticated than both Stuxnet and Duqu and is believed to be developed by the US intelligence agency NSA.

The malware uses a modular approach that allowed an operator to enable a customised spying. Regin's design makes the malware highly suited for persistent, long-term mass surveillance operations against targets.

Report 4 — It details a suspected Russian State-sponsored malware sample called "HammerToss," which was discovered in early 2015 and suspected of being operational since late 2014.

What makes HammerToss interesting is its architecture, which leverages Twitter accounts, GitHub accounts, compromised websites, and Cloud-storage to orchestrate command-and-control functions to execute the commands on the targeted systems.

Report 5 — This document details the self-code injection and API hooking methods of information stealing Trojan called "Gamker."

Gamker uses simple decryption, then drops a copy of itself using a random filename and injects itself into a different process. The trojan also exhibits other typical trojan behaviours.

Previous Vault 7 CIA Leaks

Last week, WikiLeaks revealed CIAs Highrise Project that allowed the spying agency to stealthy collect and forwards stolen data from compromised smartphones to its server through SMS messages.

Since March, the whistle-blowing group has published 17 batches of "Vault 7" series, which includes the latest and last week leaks, along with the following batches:

• BothanSpy and Gyrfalcon — two alleged CIA implants that allowed the spying agency to intercept and exfiltrate SSH credentials from targeted Windows and Linux operating systems using different attack vectors.
• OutlawCountry – An alleged CIA project that allowed it to hack and remotely spy on computers running the Linux operating systems.
• ELSA – the alleged CIA malware that tracks geo-location of targeted PCs and laptops running the Microsoft Windows operating system.
• Brutal Kangaroo – A tool suite for Microsoft Windows used by the agency to targets closed networks or air-gapped computers within an organisation or enterprise without requiring any direct access.
• Cherry Blossom – An agency's framework, basically a remotely controllable firmware-based implant, used for monitoring the Internet activity of the targeted systems by exploiting vulnerabilities in Wi-Fi devices.
• Pandemic – A CIA's project that allowed the agency to turn Windows file servers into covert attack machines that can silently infect other computers of interest inside a targeted network.
• Athena – A CIA's spyware framework that has been designed to take full control over the infected Windows PCs remotely, and works against every version of Microsoft's Windows operating systems, from Windows XP to Windows 10.
• AfterMidnight and Assassin – Two alleged CIA malware frameworks for the Microsoft Windows platform that has been designed to monitor and report back actions on the infected remote host computer and execute malicious actions.
• Archimedes – Man-in-the-middle (MitM) attack tool allegedly created by the CIA to target computers inside a Local Area Network (LAN).
• Scribbles – A piece of software allegedly designed to embed 'web beacons' into confidential documents, allowing the spying agency to track insiders and whistleblowers.
• Grasshopper – Framework that allowed the spying agency to easily create custom malware for breaking into Microsoft's Windows and bypassing antivirus protection.
• Marble – Source code of a secret anti-forensic framework, basically an obfuscator or a packer used by the CIA to hide the actual source of its malware.
• Dark Matter – Hacking exploits the agency designed to target iPhones and Macs.
• Weeping Angel – Spying tool used by the agency to infiltrate smart TV's, transforming them into covert microphones.
• Year Zero – Alleged CIA hacking exploits for popular hardware and software.

  

Read More

Over 70,000 Memcached Servers Still Vulnerable to Remote Hacking

Nothing in this world is fully secure, from our borders to cyberspace. I know vulnerabilities are bad, but the worst part comes in when people just don't care to apply patches on time.

Late last year, Cisco's Talos intelligence and research group discovered three critical remote code execution (RCE) vulnerabilities in Memcached that exposed major websites including Facebook, Twitter, YouTube, Reddit, to hackers.

Memcached is a popular open-source and easily deployable distributed caching system that allows objects to be stored in memory.

The Memcached application has been designed to speed up dynamic web applications (for example php-based websites) by reducing stress on the database that helps administrators to increase performance and scale web applications.

It's been almost eight months since the Memcached developers have released patches for three critical RCE vulnerabilities (CVE-2016-8704, CVE-2016-8705 and CVE-2016-8706) but tens of thousands of servers running Memcached application are still vulnerable, allowing attackers to steal sensitive data remotely.

Researchers at Talos conducted Internet scans on two different occasions, one in late February and another in July, to find out how many servers are still running the vulnerable version of the Memcached application.

And the results are surprising...

Results from February Scan:

• Total servers exposed on the Internet — 107,786
• Servers still vulnerable — 85,121
• Servers still vulnerable but require authentication — 23,707

And the top 5 countries with most vulnerable servers are the United States, followed by China, United Kingdom, France and Germany.

Results from July Scan:

• Total servers exposed on the Internet — 106,001
• servers still vulnerable — 73,403
• Servers still vulnerable but require authentication — 18,012

After comparing results from both the Internet scans, researchers learned that only 2,958 servers found vulnerable in February scan had been patched before July scan, while the remaining are still left vulnerable to the remote hack.

Data Breach & Ransom Threats

This ignorance by organisations to apply patches on time is concerning, as Talos researchers warned that these vulnerable Memcached installations could be an easy target of ransomware attacks similar to the one that hit MongoDB databases in late December.

Although unlike MongoDB, Memcached is not a database, it "can still contain sensitive information and disruption in the service availability would certainly lead to further disruptions on dependent services."

The flaws in Memcached could allow hackers to replace cached content with their malicious one to deface the website, serve phishing pages, ransom threats, and malicious links to hijack victim's machine, placing hundreds of millions of online users at risk.

"With the recent spate of worm attacks leveraging vulnerabilities this should be a red flag for administrators around the world," the researchers concluded.

"If left unaddressed the vulnerabilities could be leveraged to impact organisations globally and affect business severely. It is highly recommended that these systems be patched immediately to help mitigate the risk to organisations."

Customers and organisations are advised to apply the patch as soon as possible even to Memcached deployments in "trusted" environments, as attackers with existing access could target vulnerable servers to move laterally within those networks.  

Read More

Critical RCE Vulnerability Found in Cisco WebEx Extensions, Again — Patch Now!

A highly critical vulnerability has been discovered in the Cisco Systems’ WebEx browser extension for Chrome and Firefox, for the second time in this year, which could allow attackers to remotely execute malicious code on a victim's computer.

Cisco WebEx is a popular communication tool for online events, including meetings, webinars and video conferences that help users connect and collaborate with colleagues around the world. The extension has roughly 20 million active users.

Discovered by Tavis Ormandy of Google Project Zero and Cris Neckar of Divergent Security, the remote code execution flaw (CVE-2017-6753) is due to a designing defect in the WebEx browser extension.

To exploit the vulnerability, all an attacker need to do is trick victims into visiting a web page containing specially crafted malicious code through the browser with affected extension installed.

Successful exploitation of this vulnerability could result in the attacker executing arbitrary code with the privileges of the affected browser and gaining control of the affected system.

"I see several problems with the way sanitization works, and have produced a remote code execution exploit to demonstrate them," Ormandy said. "This extension has over 20M [million] active Chrome users alone, FireFox and other browsers are likely to be affected as well."

Cisco has already patched the vulnerability and released “Cisco WebEx Extension 1.0.12” update for Chrome and Firefox browsers that address this issue, though "there are no workarounds that address this vulnerability."

"This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows," Cisco confirmed in an advisory released today.

Download Cisco WebEx Extension 1.0.12

• Chrome Extensions
• Firefox Extension

In general, users are always recommended to run all software as a non-privileged user in an effort to diminish the effects of a successful attack.

Fortunately, Apple's Safari, Microsoft's Internet Explorer and Microsoft's Edge are not affected by this vulnerability.

Cisco WebEx Productivity Tools, Cisco WebEx browser extensions for Mac or Linux, and Cisco WebEx on Microsoft Edge or Internet Explorer are not affected by the vulnerability, the company confirmed.

The remote code execution vulnerability in Cisco WebEx extension has been discovered second time in this year.

Ormandy alerted the networking giant to an RCE flaw in the WebEx browser extension earlier this year as well, which even led to Google and Mozilla temporarily removing the add-on from their stores. 

Read More

Windows 10 Will Now Let You Reset Forgotten Password Directly From the Lock Screen

Microsoft is making every effort to make its Windows 10 Fall Creators Update bigger than ever before by beefing up its security practices and hardening it against hackers and cyber attacks in its next release.

Microsoft is finally adding one of the much-requested features to Windows 10: Pin and Password recovery option directly from the lock screen.

Yes, the next big update of Windows 10, among other features, will allow you to recover your forgotten pin and password, allowing you to reset your Windows password directly from the lock screen.

In Windows 10 Fall Creators Update, you will see "Reset password" or "I forgot my PIN" options on the login screen along with the sign-in box, mspoweruser confirmed.

Once you click on the option, Windows 10 will take you to the OOBE where Cortana will help you reset your password, after you successfully verify your identity using either your secondary email, your phone number, or Microsoft Authenticator.

  

A verification code will be sent to the option you chose, and once you entered and verified your identity, you will be able to reset the password and regain access to your computer directly from the login screen.

The tech giant is currently testing this new feature in its Windows 10 Insiders build 16237, making it much easier for them to recover their Microsoft Accounts.

You can use this option if you have either activated the Windows Hello authentication system or have a PIN to secure your account.

With the launch of Windows 10 Creator Update (also known as RedStone 3), which is expected to release sometime between September and October 2017, the company has already planned to:

• Remove the 30-year-old SMB v1 file sharing protocol.
• Build AI-powered antivirus software.
• Build its EMET anti-exploit tool into the kernel of the operating system.
• Support three different flavours of the Linux OS – Ubuntu, Fedora, and SUSE – directly through their Windows Store.
• Add new anti-ransomware feature, called Controlled Folder Access, as part of its Windows Defender.

Besides this new upgrade, Windows 10 Fall Update also includes improvements to Acrylic Material translucency effects, Task Manager, Mixed Reality headset and much more.  

Read More

direct distance entry method in Autocad

if you want to learn "how to draw a line using Direct distance entry in autocad 2018 with an example" then you came to right place because here you will find "AutoCAD line command tutorial with example".

there are basically 4 methods to draw line in autocad and i have already shown three methods in previous tutorial, and i this video i have shown one method to "draw draw line in autocad 2018".
which is:

1) Direct distance entry in autocad : In the direct distance entry method, you draw a line by entering its distance and angle values. You use the Dynamic Input mode in this method. so you can also use this method to draw a line with angle in autocad.

A simplified method of entering coordinates when the distance and direction from the last point are known is called Direct Distance Entry. In a nutshell, Direct Distance Entry eliminates the need for most keyboard entry of coordinates. Direct Distance Entry can be used anytime a command prompts for a point.

Introduction

Direct distance entry is one of those AutoCAD features that is often overlooked. This is rather unfortunate because it can be extremely useful and an amazing time-saver. Basically, direct distance entry enables you to draw an object, such as a line, by pointing in a particular direction with the cursor and entering a distance at the command line.

Direct Distance Entry (Command Modifier) Applies to AutoCAD, AutoCAD Architecture, AutoCAD Civil 3D, AutoCAD Electrical, AutoCAD MEP, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD P&ID, AutoCAD Plant 3D, AutoCAD Structural Detailing 2016, & AutoCAD Utility Design.

Note: The direct distance entry method is not available while you are using temporary override keys for Ortho, object snap tracking, or polar tracking.

• Overview of line command of autocad which i have explained in previous tutorial of autocad 2018

Command/Shortcut: LINE / L
Location: Draw - Line

Specify first point: Specify a point

Specify next point: Move the cursor in the desired direction and follow steps as shown in video.

i have drawn hexagon in autocad for just example.

Read More

Awesome! WhatsApp Now Lets You Send Files of Any Format

Have you ever felt like wishing of sending any type of file immediately to your friends and office colleagues on WhatsApp directly, instead of just contacts, images or documents?

Well, now you can…

The latest version of WhatsApp for Android and iOS now allows users to send and receive any type of files, whether it’s .mp3, .avi, .php, zip files, or even APKs.

The company last month rolled out this feature to its beta users for Android, and now after being tested successfully, the feature is being released to all WhatsApp users in the latest public update for iOS and Android.

The ability to send any file types also works on the WhatsApp-Web client.

And of course, there’s a file-size limit:

• Android users can send files up to 100MB
• iOS users can send files up to 128MB
• While WhatsApp-web users can only send up to 64MB

To send any file format you just need to select ‘Document’ from ‘Attach.’

Additionally, the latest update of the app will allow you to select photos and videos straight from the camera screen.

WhatsApp is continuously updating its app to provide an exceptional experience to its over one billion users while keeping security in mind.

The next app update will possibly include emoji search, which is currently being tested by WhatsApp beta users.  

Read More

How CIA Agents Covertly Steal Data From Hacked Smartphones (Without Internet)

WikiLeaks has today published the 16th batch of its ongoing Vault 7 leak, this time instead of revealing new malware or hacking tool, the whistleblower organisation has unveiled how CIA operatives stealthy collect and forward stolen data from compromised smartphones.

Previously we have reported about several CIA hacking tools, malware and implants used by the agency to remotely infiltrate and steal data from the targeted systems or smartphones.

However, this time neither Wikileaks nor the leaked CIA manual clearly explains how the agency operatives were using this tool.

But, since we have been covering every CIA leak from the very first day, we have understood a possible scenario and have illustrated how this newly revealed tool was being used.

Explained: How CIA Highrise Project Works

In general, the malware uses the internet connection to send stolen data after compromising a machine to the attacker-controlled server (listening posts), but in the case of smartphones, malware has an alternative way to send stolen data to the attackers i.e. via SMS.

But for collecting stolen data via SMS, one has to deal with a major issue – to sort and analyse bulk messages received from multiple targeted devices.

To solve this issue, the CIA created a simple Android application, dubbed Highrise, which works as an SMS proxy between the compromised devices and the listening post server.

"There are a number of IOC tools that use SMS messages for communication and HighRise is a SMS proxy that provides greater separation between devices in the field ("targets") and the listening post" by proxying ""incoming" and "outgoing" SMS messages to an internet LP," the leaked CIA manual reads.

What I understood after reading the manual is that CIA operatives need to install an application called "TideCheck" on their Android devices, which are set to receive all the stolen data via SMS from the compromised devices.

The last known version of the TideCheck app, i.e. HighRise v2.0, was developed in 2013 and works on mobile devices running Android 4.0 to 4.3, though I believe, by now, they have already developed an updated versions that work for the latest Android OS.

  

Once installed, the app prompts for a password, which is "inshallah," and after login, it displays three options:

1. Initialize — to run the service.
2. Show/Edit configuration — to configure basic settings, including the listening post server URL, which must be using HTTPS.
3. Send Message — allows CIA operative to manually (optional) submit short messages (remarks) to the listening post server.

Once initialized and configured properly, the app continuously runs in the background to monitor incoming messages from compromised devices; and when received, forwards every single message to the CIA's listening post server over a TLS/SSL secured Internet communication channel.

Previous Vault 7 CIA Leaks

Last week, WikiLeaks dumped two alleged CIA implants that allowed the agency to intercept and exfiltrate SSH credentials from targeted Windows and Linux operating systems using different attack vectors.

Dubbed BothanSpy — implant for Microsoft Windows Xshell client, and Gyrfalcon — targets the OpenSSH client on various distributions of Linux OS, including CentOS, Debian, RHEL (Red Hat), openSUSE and Ubuntu.

Since March, the whistleblowing group has published 16 batches of "Vault 7" series, which includes the latest and last week leaks, along with the following batches:

• OutlawCountry – An alleged CIA project that allowed it to hack and remotely spy on computers running the Linux operating systems.
• ELSA – Alleged CIA malware that tracks geo-location of targeted computers and laptops running the Microsoft Windows operating system.
• Brutal Kangaroo – A tool suite for Microsoft's Windows used by the spying agency to target closed networks or air-gapped computers within an organisation or enterprise without requiring any direct access.
• Cherry Blossom – An agency's framework used for monitoring the Internet activity of the targeted systems by exploiting vulnerabilities in Wi-Fi devices.
• Pandemic – A CIA's project that allowed the agency to turn Windows file servers into covert attack machines that can silently infect other computers of interest inside a targeted network.
• Athena – An agency's spyware framework that has been developed to take full control of the infected Windows machines remotely, and works for every version of Microsoft's Windows operating systems, from XP to Windows 10.
• AfterMidnight and Assassin – Two CIA malware frameworks for the Windows platform that has been designed to monitor activities on the infected remote host computer and execute malicious actions.
• Archimedes – Man-in-the-middle attack tool allegedly developed by the CIA to target computers inside a Local Area Network (LAN).
• Scribbles – Software reportedly designed to embed 'web beacons' into confidential documents, allowing the agency to track insiders and whistleblowers.
• Grasshopper – Framework that allowed the CIA hackers to easily create their custom malware for breaking into Microsoft's Windows OS and bypassing antivirus protection.
• Marble – Source code of a secret anti-forensic framework used by the agency to hide the actual source of its malware.
• Dark Matter – Hacking exploits the spying agency designed to target iOS and Mac systems.
• Weeping Angel – Spying tool used by the CIA hackers to infiltrate smart TVs, transforming them into covert microphones.
• Year Zero – Alleged CIA hacking exploits for popular software and hardware.

 

Read More

Katyusha Scanner — Telegram-based Fully Automated SQL Injection Tool

A new powerful hacking tool recently introduced in an underground forum is making rounds these days, allowing anyone to rapidly conduct website scans for SQL injection flaws on a massive scale — all controlled from a smartphone using the Telegram messaging application.

Dubbed Katyusha Scanner, the fully automated powerful SQLi vulnerability scanner was first surfaced in April this year when a Russian-speaking individual published it on a popular hacking forum.

Researchers at Recorded Future's Insikt Group threat intelligence division found this tool for sale on an underground hacking forum for just $500. Users can even rent the Katyusha Scanner tool for $200.

According to the researchers, Katyusha Scanner is a web-based tool that's a combination of Arachni Scanner and a basic SQL Injection exploitation tool that allows users to automatically identify SQLi vulnerable sites and then exploits it to take over its databases.

Arachni is an open source vulnerability scanning tool aimed towards helping users evaluate the security of their web applications.

What makes this tool stand out of line is its 'Infrastructure-as-a-Service' model.

Remotely Control Hacking Tool Via Telegram

Katyusha Scanner is abusing the Telegram messaging application to control its operations, such as sending and receiving commands.

The Katyusha Scanner tool is quite easy to setup and use, allowing anyone to conduct large-scale penetration attacks against a large number of targeted websites simultaneously with the mere use of their smartphones.

The Pro version of the tool not just identifies vulnerable websites, but also allows hackers to establish a "strong foothold within vulnerable web servers" and automatically extract "privileged information such as login credentials."

Once the scan is complete, Katyusha Scanner sends a text message to the criminals with the vulnerable site name, its Alexa web ratings, helping criminals identify popular websites that would likely be more profitable for them to attack, and the number of databases.

The criminals, even with no technical knowledge, can download any exfiltrated data available by just clicking on their smartphones to issue commands.

Katyusha Scanner also allows for the automatic dumping of databases and can be used on both Linux as well as Windows machines.

"The availability of a highly robust and inexpensive tool...Katyusha Scanner to online criminals with limited technical skills will only intensify the compromised data problem experienced by various businesses, highlighting the importance of regular infrastructure security audits," researchers at Recorded Future wrote.

Many buyers praised the quality of the tool on the black market site, one of the satisfied customers who got immediate success in obtaining access to eight web servers wrote:

"Excellent support! The seller has configured the software for my server, which was failing before, however, right now it flies divinely! I highly recommend the software, and it has found eight SQL vulnerabilities in half a day, great automation of the routine. Very grateful to the seller."

Another wrote: "The author has helped with the product setup after the purchase, and (Katyusha) has immediately found SQL vulnerability. Thank you for the great product."

Initially, Katyusha Scanner was sold for $500, but due to unexpectedly high demand, a light version of the tool with slightly limited functionality was released on May 10, 2017, at just $250.

With the release of the most recent Katyusha 0.8 Pro update at the end of June, the author also made the scanner available for rent at $200 per month for the first time. 

Read More

Google Chrome Bans Chinese SSL Certificate Authorities WoSign and StartCom

As a punishment announced last October, Google will no longer trust SSL/TLS certificate authorities WoSign and its subsidiary StartCom with the launch of Chrome 61 for not maintaining the "high standards expected of CAs."

The move came after Google was notified by GitHub's security team on August 17, 2016, that Chinese Certificate Authority WoSign had issued a base certificate for one of GitHub's domains to an unnamed GitHub user without authorization.

After this issue had been reported, Google conducted an investigation in public as a collaboration with Mozilla and the security community, which uncovered several other cases of WoSign misissuance of certificates.

As a result, the tech giant last year began limiting its trust of certificates backed by WoSign and StartCom to those issued before October 21st, 2016 and has been removing whitelisted hostnames over the course of several Chrome releases since Chrome 56.

Now, in a Google Groups post published on Thursday, Chrome security engineer Devon O'Brien said the company would finally remove the whitelist from its upcoming release of Chrome, completely distrusting the existing WoSign and StartCom certificates.

    "Beginning with Chrome 61, the whitelist will be removed, resulting in full distrust of the existing WoSign and [its subsidiary] StartCom root certificates and all certificates they have issued," says O'Brien.

    "Based on the Chromium Development Calendar, this change should be visible in the Chrome Dev channel in the coming weeks, the Chrome Beta channel around late July 2017, and will be released to Stable around mid-September 2017."

Last year, Apple and Mozilla also stopped trusting WoSign, and StartCom issued certificates for their web browsers due to their number of technical and management failures.

    "Most seriously, we discovered they were backdating SSL certificates to get around the deadline that CAs stop issuing SHA-1 SSL certificates by January 1, 2016," Kathleen Wilson, the head of Mozilla's trusted root program, said.

    "Additionally, Mozilla discovered that WoSign had acquired full ownership of another CA called StartCom and failed to disclose this, as required by Mozilla policy."

The problems with WoSign certificate service dated back to July 2015 and publicly disclosed last year by British Mozilla programmer Gervase Markham on Mozilla's security policy mailing list. 

According to Markham, an unnamed researcher accidentally found this security blunder when trying to get a certificate for 'med.ucf.edu' but also applied for 'www.ucf.edu' and WoSign approved it, giving the certificate for the university's primary domain.

For testing purpose, the security researcher then used this trick against Github base domains (github.com and github.io), by proving his control over a sub-domain.

And guess what? WoSign handed over the certificate for GitHub main domains, as well.

Starting from September 2017, visitors to sites using WoSign or StartCom HTTPS certificates would eventually see trust warnings in their web browsers.

So, websites that are still relying on certificates issued by WoSign or StartCom are advised to consider replacing their certificates "as a matter of urgency to minimize disruption for Chrome users," O'Brien said.

Read More

how to customize your own youtube channel url 2017

This short and sweet video is simply to show you where and how to create a custom YouTube channel URL/link.

► Get a custom URL for your channel:

If your channel is eligible, you can give fans an easy-to-remember web address, called a custom URL/link, for your YouTube channel. This is called a custom URL and looks like youtube.com/1pcuser and youtube.com/c/1pcuser.

You can choose a custom URL based on things like your display name, your YouTube username, any current vanity URLs that you have, or the name of your linked website (all subject to availability).

When sharing your custom URL, you can change its capitalization and accents any way you want. For example, both youtube.com/c/yourcustomname and youtube.com/c/YourCustómNámé would send viewers to the same channel.

You can't change a custom URL after creation. However, you can remove the custom URL from your channel and claim a new one if you want to change it.

NOTE: When you claim a custom URL on YouTube, you no longer also get a Google+ URL.

► General eligibility requirements to Claim a custom URL for YouTube:

You can claim a custom URL if you meet the general eligibility requirements. Follow the steps below to set it up.
To create a custom URL for your channel, your account needs to:

- Have 100 or more subscribers
- Be at least 30 days old
- Have an uploaded photo as channel icon
- Have uploaded channel art

In general, a YouTube channel may only have one (1) custom URL and custom URLs cannot be transferred or assigned to anyone.

► Understand your channel URLs:

Your channel can have multiple URLs that direct your audience to your channel homepage. These URLs can look different from one another, but all point your audience to the same place - your channel.

- ID-based URL:

Example: https://www.youtube.com/channel/UCFBQ7eBiR9stXdWBrMLhzEw

This is the standard URL that all YouTube channels use. It uses your unique channel ID, which are the numbers and letters at the end of the URL.

- Custom URL

Example: https://www.youtube.com/1pcuser

A custom URL is a shorter, easy-to-remember URL that you can share with your audience. Custom URLs are assigned to qualifying channels and can be based on your current display name, your legacy username, or your linked, verified web domain.

If you enter your custom URL in an abbreviated format (like youtube.com/1pcuser vs. the full URL youtube.com/c/1pcuser), the URL will immediately resolve to your ID-based URL or your legacy username URL, if you have one (since YouTube treats legacy username URLs as your primary channel URL).

You can check if you've claimed a custom URL in your advanced account settings


- Legacy username URL
Example: youtube.com/user/1pcuser

Depending on when your channel was created, it may have a username. Usernames are no longer required for channels today, but you can still use this URL to direct to your channel — even if your channel name has changed since you chose your username. Existing usernames can't be changed.

Read More

Millions of Android Devices Using Broadcom Wi-Fi Chip Can Be Hacked Remotely

Google has released its latest monthly security update for Android devices, including a serious bug in some Broadcom Wi-Fi chipsets that affects millions of Android devices, as well as some iPhone models.

Dubbed BroadPwn, the critical remote code execution vulnerability resides in Broadcom's BCM43xx family of WiFi chipsets, which can be triggered remotely without user interaction, allows a remote attacker to execute malicious code on targeted Android devices with kernel privileges.

    "The most severe vulnerability in this [runtime] section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process," Google describes in the July 2017 Android Security Bulletin.

The BroadPwn vulnerability (CVE-2017-3544) has been discovered by Exodus Intelligence researcher Nitay Artenstein, who says the flawed Wi-Fi chipset also impacts Apple iOS devices.Google has released its latest monthly security update for Android devices, including a serious bug in some Broadcom Wi-Fi chipsets that affects millions of Android devices, as well as some iPhone models. Dubbed BroadPwn, the critical remote code execution vulnerability resides in Broadcom's BCM43xx family of WiFi chipsets, which can be triggered remotely without user interaction, allows a remote attacker to execute malicious code on targeted Android devices with kernel privileges. "The most severe vulnerability in this [runtime] section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process," Google describes in the July 2017 Android Security Bulletin. The BroadPwn vulnerability (CVE-2017-3544) has been discovered by Exodus Intelligence researcher Nitay Artenstein, who says the flawed Wi-Fi chipset also impacts Apple iOS devices.

Since Artenstein will be presenting his finding at Black Hat 2017 event, details about the BroadPwn bug is scarce at this moment.

    "The Broadcom BCM43xx family of Wi-Fi chips is found in an extraordinarily wide range of mobile devices – from various iPhone models to HTC, LG, Nexus and practically the full range of Samsung flagship devices," the abstract for Artenstein's talk says.

Besides the fix for the BroadPwn vulnerability, July's Android Security Bulletin includes patches for 10 critical, which are all remote code execution bugs, 94 high and 32 moderate rated vulnerabilities.

Two months ago, an over-the-air hijacking vulnerability was discovered in Broadcom WiFi SoC (Software-on-Chip) chips, allowing attackers within the same WiFi network to remotely hack, iPhones, iPads, iPods and Android handsets without any user interaction.Since Artenstein will be presenting his finding at Black Hat 2017 event, details about the BroadPwn bug is scarce at this moment. "The Broadcom BCM43xx family of Wi-Fi chips is found in an extraordinarily wide range of mobile devices – from various iPhone models to HTC, LG, Nexus and practically the full range of Samsung flagship devices," the abstract for Artenstein's talk says. Besides the fix for the BroadPwn vulnerability, July's Android Security Bulletin includes patches for 10 critical, which are all remote code execution bugs, 94 high and 32 moderate rated vulnerabilities. Two months ago, an over-the-air hijacking vulnerability was discovered in Broadcom WiFi SoC (Software-on-Chip) chips, allowing attackers within the same WiFi network to remotely hack, iPhones, iPads, iPods and Android handsets without any user interaction. 

At that time, Apple rushed out an emergency iOS patch update to address the serious bug, and Google addressed the flaw in its Android April 2017 security updates.

Android Security Bulletin: July 2017 Updates

Among the other critical flaws is a long list of vulnerabilities in the Mediaserver process in the Android operating system, which also allows attackers to perform remote code execution on the affected devices.

One of the vulnerabilities is an issue with the way the framework handles some specific files. The libhevc library has an input validation vulnerability (CVE-2017-0540), which can be exploited using a crafted file.

    "A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing," the vulnerability description says.

    "This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process."

The over-the-air updates and firmware for Google devices have already been issued by the company for its Pixel and Nexus devices, though rest of Android still need to wait for an update from their OEMs, leaving million of Android devices vulnerable for next few months.At that time, Apple rushed out an emergency iOS patch update to address the serious bug, and Google addressed the flaw in its Android April 2017 security updates. Android Security Bulletin: July 2017 Updates Among the other critical flaws is a long list of vulnerabilities in the Mediaserver process in the Android operating system, which also allows attackers to perform remote code execution on the affected devices. One of the vulnerabilities is an issue with the way the framework handles some specific files. The libhevc library has an input validation vulnerability (CVE-2017-0540), which can be exploited using a crafted file. "A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing," the vulnerability description says. "This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process." The over-the-air updates and firmware for Google devices have already been issued by the company for its Pixel and Nexus devices, though rest of Android still need to wait for an update from their OEMs, leaving million of Android devices vulnerable for next few months.

At that time, Apple rushed out an emergency iOS patch update to address the serious bug, and Google addressed the flaw in its Android April 2017 security updates.

Android Security Bulletin: July 2017 Updates

Among the other critical flaws is a long list of vulnerabilities in the Mediaserver process in the Android operating system, which also allows attackers to perform remote code execution on the affected devices.

One of the vulnerabilities is an issue with the way the framework handles some specific files. The libhevc library has an input validation vulnerability (CVE-2017-0540), which can be exploited using a crafted file.

"A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing," the vulnerability description says. 

"This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process."

The over-the-air updates and firmware for Google devices have already been issued by the company for its Pixel and Nexus devices, though rest of Android still need to wait for an update from their OEMs, leaving million of Android devices vulnerable for next few months.At that time, Apple rushed out an emergency iOS patch update to address the serious bug, and Google addressed the flaw in its Android April 2017 security updates. Android Security Bulletin: July 2017 Updates Among the other critical flaws is a long list of vulnerabilities in the Mediaserver process in the Android operating system, which also allows attackers to perform remote code execution on the affected devices. One of the vulnerabilities is an issue with the way the framework handles some specific files. The libhevc library has an input validation vulnerability (CVE-2017-0540), which can be exploited using a crafted file. "A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing," the vulnerability description says. "This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process." The over-the-air updates and firmware for Google devices have already been issued by the company for its Pixel and Nexus devices, though rest of Android still need to wait for an update from their OEMs, leaving million of Android devices vulnerable for next few months.

Read More

China Shuts Down Popular VPN Services to Make Great Firewall Stronger

Online Privacy has been one of the biggest challenges in today's interconnected world, as the governments across the world have been found censoring the Internet, stealing information and conducting mass surveillance on innocent people.

China is one such nation which always wanted to have a tight hold on its citizen and has long been known for its strict Internet censorship laws through the Great Firewall of China.

The Great Firewall of China is the nation's Golden Shield project that employs a variety of tricks to censor Internet and block access to various foreign news and social media sites, including Google, Facebook, Twitter, Tumblr, Dropbox, and The Pirate Bay.

So, in order to thwart these restrictions and access blocked websites, hundreds of millions of Chinese citizens rely on virtual private networks (VPNs) which route their traffic to servers overseas free of the Great Firewall filters, but this may not be an option soon.

For those unfamiliar, Virtual Private Network (VPN) securely routes your Internet traffic through a distant connection, protecting your browsing, hiding your location data and accessing restricted resources.

GreenVPN, one of the most popular VPN services in China, notified its customers on Monday that the company would stop its VPN service from July 1st, following orders by "regulatory departments" to cease its operation, Bloomberg reported.

However, not just GreenVPN, some users also stated that they were unable to use SuperVPN, another popular VPN service on their smartphones over the weekend, although it is unclear whether the service was down to a glitch or the government restrictions.

This restriction could be part of new rules by the China's Ministry of Industry and Information Technology announced at the beginning of this year, making it illegal to use or operate local VPNs without government approval from the government.

According to the ministry, "all special cable and VPN services on the mainland needed to obtain prior government approval—a move making most VPN service providers in the country of 730 million Internet users illegal."

This crackdown on VPN services has been designed to "strengthen cyberspace information security management," as said by the Chinese ministry.

The crackdown is yet one of the several priorities for controlling online content in China.

Online Privacy has been one of the biggest challenges in today's interconnected world, as the governments across the world have been found censoring the Internet, stealing information and conducting mass surveillance on innocent people.

China is one such nation which always wanted to have a tight hold on its citizen and has long been known for its strict Internet censorship laws through the Great Firewall of China.

The Great Firewall of China is the nation's Golden Shield project that employs a variety of tricks to censor Internet and block access to various foreign news and social media sites, including Google, Facebook, Twitter, Tumblr, Dropbox, and The Pirate Bay.

Read More

WordPress Plugin Used by 300,000+ Sites Found Vulnerable to SQL Injection Attack

A SQL Injection vulnerability has been discovered in one of the most popular Wordpress plugins, installed on over 300,000 websites, which could be exploited by hackers to steal databases and possibly hijack the affected sites remotely.

The flaw has been discovered in the highly popular WP Statistics plugin, which allows site administrators to get detailed information related to the number of users online on their sites, the number of visits and visitors, and page statistics.

Discovered by Sucuri team, WordPress plugin WP Statistics is vulnerable to SQL Injection flaw that allows a remote attacker, with at least a subscriber account, to steal sensitive information from the website's database and possibly gain unauthorized access to websites.

SQL Injection is a web application bug that allows hackers to inject malicious Structured Query Language (SQL) code to web inputs in order to determine the structure and location of key databases, which eventually allows stealing of the database.

The SQL injection vulnerability in WP Statistics plugin resides in multiple functions, including wp_statistics_searchengine_query().

"This vulnerability is caused by the lack of sanitization in user-provided data," researchers said. "Some attributes of the shortcode wpstatistics are being passed as parameters for important functions and this should not be a problem if those parameters were sanitized." 

"One of the vulnerable functions wp_statistics_searchengine_query() in the file 'includes/functions/functions.php' is accessible through WordPress' AJAX functionality thanks to the core function wp_ajax_parse_media_shortcode()."

 The SQL injection vulnerability in WP Statistics plugin resides in multiple functions, including wp_statistics_searchengine_query().

    "This vulnerability is caused by the lack of sanitization in user-provided data," researchers said. "Some attributes of the shortcode wpstatistics are being passed as parameters for important functions and this should not be a problem if those parameters were sanitized."

    "One of the vulnerable functions wp_statistics_searchengine_query() in the file 'includes/functions/functions.php' is accessible through WordPress' AJAX functionality thanks to the core function wp_ajax_parse_media_shortcode()."

 This function does not check for additional privileges, which allows website subscribers to execute this shortcode and inject malicious code to its attributes.

The researchers at Sucuri privately disclosed the flaw to the WP Statistics team and the team had patched the vulnerability in its latest version WP Statistics version 12.0.8.

So, if you have a vulnerable version of the plugin installed and your website allowing user registration, you are definitely at risk, and you should install the latest version as soon as possible.

A SQL Injection vulnerability has been discovered in one of the most popular Wordpress plugins, installed on over 300,000 websites, which could be exploited by hackers to steal databases and possibly hijack the affected sites remotely.

The flaw has been discovered in the highly popular WP Statistics plugin, which allows site administrators to get detailed information related to the number of users online on their sites, the number of visits and visitors, and page statistics.

Read More

Autodesk inventor 2018 tutorials for beginners - inventor 2018 introduction and overview

Welcome to my first free autodesk inventor tutorials for beginners!

in this autodesk inventor 2018 training video, you will see inventor 2018 basic features overview and introduction.

You are about to see why Autodesk Inventor software is the best choice for 3D mechanical engineering and design. This inventor 2018 tutorial demonstrates how Autodesk Inventor accelerates and simplifies your design process while extending your design capabilities.

Autodesk Inventor 2018 is high-performance software for mechanical engineering and design that makes your design cycle faster, your data management easier, and your product development more affordable. A simplified user interface, an advanced help and support system, and built-in migration tools for AutoCAD® users make Autodesk Inventor the easiest mechanical design software to learn and use. And, with the industry's best DWG compatibility, innovative shape description capabilities driven by the Autodesk ShapeManager kernel, industry-specific tools, and proven large-assembly performance, Autodesk Inventor offers superior productivity to help turn your design cycle into a competitive advantage.

in our upcoming autodesk inventor tutorial videos, you will see that Autodesk Inventor is just one component in a comprehensive portfolio of integrated Autodesk® products, partners, and services that enables you to use your design across the entire manufacturing process. You will see how mechanical and electrical engineers can create even more complex designs using the tube and pipe, wire harness, and cabling design tools offered in Autodesk Inventor® Professional 2018. You will see how to manage design data across your engineering and manufacturing teams using Autodesk® Vault. And, you will see how to share your design data across your supply chain—instantly, accurately, securely, and more affordably using the Autodesk Streamline® service.

Read More