Tuesday, December 29, 2020

Get Guarnateed DA50+ for %domain%

hi there

Get an amaazing Domain Authority score above 50 for your website and
increase sales and visibility in just 30 days
https://www.str8creative.co/product/moz-da-seo-plan/

Service is guaranteed

Regards
Mike
Str8 Creative
support@str8creative.co

Friday, December 25, 2020

re: I need to make a website`s ranks go down

hi

Yes, it is possible, with our service here
https://negativerseo.co/

for further information please email us here
support@negativerseo.co

thanks
Peter

Monday, December 7, 2020

re: Rank top 5 in the Google maps

hi there

Did you know that when someone is looking for a search term on their
phones, the Gmaps listings its what pop up first in the results?

Stop losing all that visibility and let us boost your G listing into the
tops for local terms
https://www.str8creative.co/product/1500-gmaps-citations/

thanks and regards
Mike
support@str8creative.co

Thursday, December 3, 2020

Buy quality business traffic for blogger.com

hi

Do you want more quality visits engaging on your website?
Increase ranks and sales swith our business website traffic

Please find more information about our service here
https://basedbusinesstraffic.co/


thanks
Peter

Tuesday, December 1, 2020

Saturday, November 28, 2020

re: I need to make a website`s ranks go down

hi

Yes, it is possible, with our service here
https://negativerseo.co/

for further information please email us here
support@negativerseo.co

thanks
Peter

Sunday, November 22, 2020

Cheap Monthly SEO plans %domain%

hi there

After checking your website SEO metrics and ranks, we determined that you
can get a real boost in ranks and visibility by using any of our plan below
https://www.cheapseosolutions.co/cheap-seo-packages/index.html

cheap and effective SEO plan
onpage SEO included

For the higher value plans, DA50 DR50 TF20 SEO metrics boost is inlcuded

thank you
Mike
support@cheapseosolutions.co

Thursday, November 19, 2020

re: need unique domains backlinks

hi there

Do you mean that you want 1 backlinks from 1 domain? unique domains links
like this?

yes, we offer that here
https://str8creative.co/product/unique-domains-links/

thanks and regards
Mike
support@str8creative.co

Sunday, October 25, 2020

fw: blog EDU backlinks

hi there

1000 Edu blog backlinks to improve your backlinks base and increase SEO
metrics and ranks
http://www.str8-creative.io/product/edu-backlinks/


Improve domain authority with more .edu blog backlinks















Unsubscribe from this newsletter
http://www.str8-creative.io/unsubscribe/

Tuesday, October 20, 2020

Domain Authority 50 for your website - Guaranteed Service

We`ll get your website to have Domain Authority 50 or we`ll refund you every
cent

for only 150 usd, you`ll have DA50 for your website, guaranteed

Order it today:
http://www.str8-creative.co/product/moz-da-seo-plan/

thanks
Alex Peters

Thursday, October 1, 2020

re: I need social traffic fast

hi
super-chute.htmlnoreply

here it is, social website traffic:
http://www.mgdots.co/detail.php?id=113


Full details attached




Regards
Gaylord Greenwald �












Unsubscribe option is available on the footer of our website

Saturday, September 26, 2020

Domain Authority 50 for your website - Guaranteed Service

We`ll get your website to have Domain Authority 50 or we`ll refund you every
cent

for only 150 usd, you`ll have DA50 for your website, guaranteed

Order it today:
http://www.str8-creative.co/product/moz-da-seo-plan/

thanks
Alex Peters

Tuesday, September 22, 2020

The Final Form Of My Home Made Magnetic Army Transport

I wanted to put out an update to my last post on building a magnetic model transport system for my Convergence.

Just before Captain Con my wife was kind enough to finish making the bag to carry all of the magnetic bins I built. It's frankly huge, but it carries absolutely everything without any issue.




It's huge! Total size is 16" deep, 24" wide, and about 15" tall. In the above picture it's carrying my dice tray, dice, all of my Convergence and a Blacksmiths Guild Ball team, and my sheet pan/tournament tray (sprayed silver).

The bag is semi-rigid, using some foam internally between the fabric to give some stability and padding. My wife did an outstanding job on it.

I got some flak from my Guild Ball friends for how much room I was taking up in the trunk on the drive up, but its awesome.  It fits neatly in my own car's trunk and will be used for all my local travel from now on. This is significantly easier than when I had to use an old PC carrying strap to bind all my cases together to carry the CoC around locally.

In case you didn't see the last post, here are what the cases look like populated with my stuff:







Conclusions

If you compare this to an actual product of equivalent size, it's about what you'd get in a Magna Rack 1520 from Battle Foam.  The racks plus bag for that is $365 plus shipping.  If you add up total materials for my system, I'm likely looking at about $100 max. Of course, I didn't have to pay for any labor in this creation.

On the flip side, I mentioned to my wife that she could probably pull $100 to $150 for a bag like that for other gamers if she tried to make one and she said in no uncertain terms that it flat out isn't worth it for her labor to charge that little.  Apparently the bag was a bit of a pain in the ass for her to make. She was happy to make it for me, but no one else has my charm to convince her it's worth making another.

If I wasn't married to an extremely talented quilter (and all around amazing woman) I'd probably would have to had been more careful when picking out my bins to make sure I could arrange them to fit in a piece of luggage I could buy rather than having the bag being fabricated to meet the specs of what bins I purchased.

I'm very happy to have done this, and I intend on magnetizing my other armies to use this system going forward, though I already have a bunch of foam so I'm not as motivated to go ahead with that. Plus I plan on just using Convergence for a while anyway.

Monday, September 21, 2020

Nox (PC)

Nox title screen
Developer:Westwood Pacific|Release Date:2000|Systems:Windows, OS X

This week on Super Adventures, I'm writing about Nox. Not the Android Emulator, I'm talking about the classic Diablo 'em up video game by Westwood. Not the Westwood that made Command and Conquer and Blade Runner, I'm talking about the other one, Westwood Pacific. They're the ones who made the 'Christopher Lloyd in Toontown' adventure game Toonstruck, back when they were known as 'Burst Studios'.

Nox has already made an appearance on Super Adventures, as guest reviewer Ocean guest reviewed it for me. But that was way back in April 2011, when the site was just three months old, so I figured it was about time that I had a look at the game myself. Plus I'm going to justify the existence of this second article right away by giving you some trivia that you won't find in Ocean's post: the word 'nox' is Latin for night or darkness. Here's another fact: the game was released five months before Diablo II, which is maybe a bit closer than you want, but much preferable to releasing five months after it.

Okay I'm going to give the game a couple of hours and see how it plays. Oh, I should mention that I'm running the GOG.com version, and I've installed the 'Nox GUI' SDL patch to increase the chances of it working properly for me on Windows 10.

Read on »

Wednesday, September 16, 2020

1500 google maps citations cheap

Rank the google maps top 5 for your money keywords, guaranteed

http://www.str8-creative.io/product/1500-gmaps-citations/

regards,
Str8 Creative

Saturday, September 12, 2020

People Behind The Meeples - Episode 228: Tony Vasinda

Welcome to People Behind the Meeples, a series of interviews with indie game designers.  Here you'll find out more than you ever wanted to know about the people who make the best games that you may or may not have heard of before.  If you'd like to be featured, head over to http://gjjgames.blogspot.com/p/game-designer-interview-questionnaire.html and fill out the questionnaire! You can find all the interviews here: People Behind the Meeples. Support me on Patreon!


Name:Tony Vasinda
Email: Tony@Plusoneexp.com
Location:Philly PA
Day Job:I am a beard balm magnate and community builder who does missionary work in my community.
Designing:Two to five years.
Webpage:TonyVasinda.com or BeardRPG.com
Facebook:PlusOneExp
Twitter:@PlusOneExp or@TonyVasinda
Instagram:@PlusOneExp or @Tony_Vasinda
Find my games at:PlusOneExp.com
Today's Interview is with:

Tony Vasinda
Interviewed on: 5/19/2020

This week's interview is with Tony Vasinda, someone I knew for something other than gaming first. Beard balm! A couple of years ago my wife convinced me to try using a beard balm on my beard and she bought me a sampler of various balms from Tony's Catholic Balm company and I loved it! (I've since tried a few other companies' balms. and Tony's are tied for my top two companies.) Last year I noticed a new RPG on Kickstarter all about beards and I was surprised to see it was by the same guy I buy beard balm from! Since then I've gotten to know Tony as a game designer as well. in April, Tony organized a 48 hour game design jam where two teams of designers had 48 hours to design a game. My team designed a semi cooperative press your luck game about aliens capturing dinosaurs! It was quite fun to design a game as part of a team and to meet a group of designer, so thanks tony for organizing that! Read on to learn more about Tony and his myriad of awesome, uplifting projects.

Some Basics
Tell me a bit about yourself.

How long have you been designing tabletop games?
Two to five years.

Why did you start designing tabletop games?
I love them. I was also designing a lot of social games, challenges, and play experiences for outdoor education experiences and many of them were basically scaled tabletop games.

What game or games are you currently working on?
We are finishing up Beards & Beyond and looking at our next game "Cascade".

Have you designed any games that have been published?
Just Beards & Beyond which is self-published.


What is your day job?
I am a beard balm magnate and community builder who does missionary work in my community.

Your Gaming Tastes
My readers would like to know more about you as a gamer.

Where do you prefer to play games?
Yes. Afternoon into evening with long play sessions and breaks for meals and drinks.

Who do you normally game with?
My family (4 teenage kids) right now, but typically with groups of local friends.

If you were to invite a few friends together for game night tonight, what games would you play?
Start with a few quick tactical games while we wait for the late comers. I adore Smash Up, Shobu, and others for this. Then start with a large scale social deduction game like Two Rooms and a Boom or The Resistance. Then break people into groups based on interest and experience. Assuming by a few friends you mean 12ish.

And what snacks would you eat?
What people bring. I typically make some homemade pizzas or flatbreads and then add homemade pickles and salsa to the mix. I'll grab some corn chips and kettle chips from the store. Good local beers with some soft drinks.

Do you like to have music playing while you play games? If so, what kind?
Not typically. For RPGs we might toss an ambiance track on though.

What's your favorite FLGS?
Hands down Around the Table in Lynnwood WA and Madness Comics in Plano TX. I have a great local comic shop called JD Hero Complex locally that I am just getting to know. The owner is a great artist who did some work for Beards & Beyond.

What is your current favorite game? Least favorite that you still enjoy? Worst game you ever played?
Dialect is probably my current favorite. I think about it all the time. I'll still happily break out munchkin after decades of playing it, and it having run it's course for personal enjoyment. Worst game ever... it was a zombie game with horribly written rules. Can't remember the name, but also I loathe candy land.

What is your favorite game mechanic? How about your least favorite?
I am currently obsessed with card/tile flipping and I don't know why. Outside of storytelling I love blind bidding mechanics. I don't have a least favorite... but like to avoid high luck elements.

What's your favorite game that you just can't ever seem to get to the table?
Never played it. Deeply want to. The Great Space Race.

What styles of games do you play?
I like to play Board Games, Card Games, RPG Games, Video Games, Other Games.

Do you design different styles of games than what you play?
I like to design Card Games, RPG Games, Other Games.

OK, here's a pretty polarizing game. Do you like and play Cards Against Humanity?
It was fun the first time.

You as a Designer
OK, now the bit that sets you apart from the typical gamer. Let's find out about you as a game designer.

When you design games, do you come up with a theme first and build the mechanics around that? Or do you come up with mechanics and then add a theme? Or something else?
Theme.

Have you ever entered or won a game design competition?
Nope.

Do you have a current favorite game designer or idol?
I think Phillip Reed (CEO of SJ Games) is prolific and makes amazing RPG supplements for his personal projects. I love playing games with designers, but I don't really get attached to them.

Where or when or how do you get your inspiration or come up with your best ideas?
Jokes. I make a joke and a game comes out-sometimes. 75% of my current designs start with, Wouldn't it be funny if we...

How do you go about playtesting your games?
Most of the time it's actually just writing up the rules and sending them to friends who are smart players to get their input and feedback. Then prototyping, then playtesting personally. Then doing a creator jam, then going to my local FLGS and sharing it.

Do you like to work alone or as part of a team? Co-designers, artists, etc.?
With a team, but not a set one.

What do you feel is your biggest challenge as a game designer?
Myself.

What do you wish someone had told you a long time ago about designing games?
I wish game designers had had more opportunities for community a long time ago, but I made my first game at 19, so I am good.

What advice would you like to share about designing games?
Your mechanics and materials are not the point. Playing is the point. A game can be pretty, ugly, simple, complex, lite, deep, whatever, but it has to be played to be a game. Don't make a game that will sit in a box. Make a game that will be played.

Would you like to tell my readers what games you're working on and how far along they are?
Published games, I have: Beards & Beyond
Games that will soon be published are: Cascade, Forts, BrandStanding
Currently looking for a publisher I have: Cascade
I'm planning to crowdfund: Forts, BrandStanding
Games I feel are in the final development and tweaking stage are: BrandStanding
Games that I'm playtesting are: Cascade
Games that are in the early stages of development and beta testing are: Forts
And games that are still in the very early idea phase are: BrandStanding

Are you a member of any Facebook or other design groups? (Game Maker's Lab, Card and Board Game Developers Guild, etc.)
Soooooo Many. Shout outs to BGDL, Tabletop Backer Party, BoardGame Spotlight, and my own folks in Beards of Tabletop.

And the oddly personal, but harmless stuff…
OK, enough of the game stuff, let's find out what really makes you tick! These are the questions that I'm sure are on everyone's minds!

Favorite type of music? Books? Movies?
Talk radio. Yes (fiction, business, theology, creativity). Josie and The Pussy Cats and The Forbidden Planet.

What was the last book you read?
I read a crap ton of lit RPG and I just finished The Infinite Game by Simon Sinek

Do you play any musical instruments?
Kazoo at a way more "in to it" level than you would expect.

Tell us something about yourself that you think might surprise people.
...hmmm. It really depends on the people.

Tell us about something crazy that you once did.
I just quit a steady paying job, moved my family across the country, and started a new missionary project.

Biggest accident that turned out awesome?
Hopefully the above, but I made beard balm a few years ago that went viral in it's niche and has funneled around a million dollars into philanthropic work.

Who is your idol?
I don't really have one. People are people. Some of my heroes are St Augustin, Plato, Allen Ginsburg, this guy named Mike Bishop in Memphis (he's not anyone that anyone would ever have heard of). Just a great guy.

What would you do if you had a time machine?
Go Forward 100 years. Interact with no one. Just see what life is like.

Are you an extrovert or introvert?
Extroverted Introvert

If you could be any superhero, which one would you be?
The Green Lantern (Hal Jordan)

Have any pets?
A dog.

When the next asteroid hits Earth, causing the Yellowstone caldera to explode, California to fall into the ocean, the sea levels to rise, and the next ice age to set in, what current games or other pastimes do you think (or hope) will survive into the next era of human civilization? What do you hope is underneath that asteroid to be wiped out of the human consciousness forever?
Wait... Isn't that happening right now? Community Storytelling.

If you'd like to send a shout out to anyone, anyone at all, here's your chance (I can't guarantee they'll read this though):
Ryan Boh, Chris Pesagian, Mark Guiney, Michael Marchand. You know what you did.

Just a Bit More
Thanks for answering all my crazy questions! Is there anything else you'd like to tell my readers?

If you are looking for a solid Beard Balm, Lotion Bar, or Lip Balm and want the proceeds to support the indie game community head to PlusOneBalms.com.

[GJJ Games] I can attest to the awesomeness of Tony's beard balm. The scents are awesome and it really does a great job of keeping my scraggly beard in check. Plus, your purchase goes to help some pretty great causes.





Thank you for reading this People Behind the Meeples indie game designer interview! You can find all the interviews here: People Behind the Meeples and if you'd like to be featured yourself, you can fill out the questionnaire here: http://gjjgames.blogspot.com/p/game-designer-interview-questionnaire.html

Did you like this interview?  Please show your support: Support me on Patreon! Or click the heart at Board Game Links , like GJJ Games on Facebook , or follow on Twitter .  And be sure to check out my games on  Tabletop Generation.

CX 2694, Pole Position!

Hello there, I hope that you all are safe and sane during this weird and difficult time. Today's episode is about Pole Position, the Namco arcade game that was ported to various Atari systems by General Computer Corp. (GCC if you're nasty). Coming up next is the wonderful Frostbite, by Activision's Steve Cartwright. If you have any thoughts on Frostbite (and I know that you do), please send them to me at 2600gamebygame@gmail.com by the end of the day on May 3rd. Thank you so much for listening and please take care of yourselves, I love you all!


Pole Position on KLOV
Pole Position on Random Terrain
Pole Position on Atari Protos
Pole Position on Atarimania
Betty Ryan Tylko profile on Atari Women
Atari Age thread about GCC credits
Atari Age thread, Undocumented Pole Position loaner cart
Atari Age thread - Pole Positn orange end label
1983 Atari Booth at CES video
Terry Hoff's web site
Marc Ericksen's web site
John Mattos' web site
Nerd Lunch Atari 2600 Retrospective
Batteries Not Included on Amazon
Imperial Scrolls of Honor Podcast
Nerd Noise Radio podcast

Tuesday, September 8, 2020

Domain Authority 50 for your website - Guaranteed Service

We`ll get your website to have Domain Authority 50 or we`ll refund you every
cent

for only 150 usd, you`ll have DA50 for your website, guaranteed

Order it today:
http://www.str8-creative.co/product/moz-da-seo-plan/

thanks
Alex Peters

Friday, September 4, 2020

So Far Behind...

   I haven't talked about so many gaming things happening in my life the last few weeks.

  First, I went to DesotoCon, in Kansas, back at the end of July. I started a blog post about it and will finish it, I promise. It's even going to be back dated so it will appear before this one. Not many (any?) photos from it though. Well, a few, I think.

  The next week I went to Indianapolis for GenCon. Met a lot of great people, hung out with some friends from Thread Raiders, Saving Throw Show, and Dragons and Things (best Pathfinder liveplay stream, Fridays at 6:00 Pacific on Twitch). Bought a bunch of stuff. Again, it deserves it's own post and I will work on that. A few more photos there.

   I've also released the first product from Goblyn Head Press on DriveThruRPG. It's a supplement designed for D&D 5e called Sacred Sites. It was written by Eli Arndt, who you ugys have seen me mention before around here. Nine different places you can encounter the sacred or profane. It has sold a few copies already and it's only been up about a week. Very excited about that. Probably deserves it's own post, too.


  And we've gotten a few more sessions of Starfinder in. Kicked one guy out of our group, got another new player. Still sitting at three players so if anyone wants to join us in Santa Fe, TX (in Galveston County, on the mainland)...

   And I painted a few minis. Not much. I really need to get to work on the Pledge or I am screwed.

   Oh, two new display cases came in and I got one put together. Detolf from IKEA.


   And I have been drawing more maps on my Wacom tablet. So that's getting me closer to done with another Goblyn Head project.

   All in all, I guess I have been busy. Just not very good at reporting. I'll try to get caught up on all of that the next few days.

Monday, August 31, 2020

Learning Web Pentesting With DVWA Part 6: File Inclusion

In this article we are going to go through File Inclusion Vulnerability. Wikipedia defines File Inclusion Vulnerability as: "A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. A file include vulnerability is distinct from a generic directory traversal attack, in that directory traversal is a way of gaining unauthorized file system access, and a file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application."
There are two types of File Inclusion Vulnerabilities, LFI (Local File Inclusion) and RFI (Remote File Inclusion). Offensive Security's Metasploit Unleashed guide describes LFI and RFI as:
"LFI vulnerabilities allow an attacker to read (and sometimes execute) files on the victim machine. This can be very dangerous because if the web server is misconfigured and running with high privileges, the attacker may gain access to sensitive information. If the attacker is able to place code on the web server through other means, then they may be able to execute arbitrary commands.
RFI vulnerabilities are easier to exploit but less common. Instead of accessing a file on the local machine, the attacker is able to execute code hosted on their own machine."
In simpler terms LFI allows us to use the web application's execution engine (say php) to execute local files on the web server and RFI allows us to execute remote files, within the context of the target web server, which can be hosted anywhere remotely (given they can be accessed from the network on which web server is running).
To follow along, click on the File Inclusion navigation link of DVWA, you should see a page like this:
Lets start by doing an LFI attack on the web application.
Looking at the URL of the web application we can see a parameter named page which is used to load different php pages on the website.
http://localhost:9000/vulnerabilities/fi/?page=include.php
Since it is loading different pages we can guess that it is loading local pages from the server and executing them. Lets try to get the famous /etc/passwd file found on every linux, to do that we have to find a way to access it via our LFI. We will start with this:
../etc/passwd
entering the above payload in the page parameter of the URL:
http://localhost:9000/vulnerabilities/fi/?page=../etc/passwd
we get nothing back which means the page does not exist. Lets try to understand what we are trying to accomplish. We are asking for a file named passwd in a directory named etc which is one directory up from our current working directory. The etc directory lies at the root (/) of a linux file system. We tried to guess that we are in a directory (say www) which also lies at the root of the file system, that's why we tried to go up by one directory and then move to the etc directory which contains the passwd file. Our next guess will be that maybe we are two directories deeper, so we modify our payload to be like this:
../../etc/passwd
we get nothing back. We continue to modify our payload thinking we are one more directory deeper.
../../../etc/passwd
no luck again, lets try one more:
../../../../etc/passwd
nop nothing, we keep on going one directory deeper until we get seven directories deep and our payload becomes:
../../../../../../../etc/passwd
which returns the contents of passwd file as seen below:
This just means that we are currently working in a directory which is seven levels deep inside the root (/) directory. It also proves that our LFI is a success. We can also use php filters to get more and more information from the server. For example if we want to get the source code of the web server we can use php wrapper filter for that like this:
php://filter/convert.base64-encode/resource=index.php
We will get a base64 encoded string. Lets copy that base64 encoded string in a file and save it as index.php.b64 (name can be anything) and then decode it like this:
cat index.php.b64 | base64 -d > index.php
We will now be able to read the web application's source code. But you maybe thinking why didn't we simply try to get index.php file without using php filter. The reason is because if we try to get a php file with LFI, the php file will be executed by the php interpreter rather than displayed as a text file. As a workaround we first encode it as base64 which the interpreter won't interpret since it is not php and thus will display the text. Next we will try to get a shell. Before php version 5.2, allow_url_include setting was enabled by default however after version 5.2 it was disabled by default. Since the version of php on which our dvwa app is running on is 5.2+ we cannot use the older methods like input wrapper or RFI to get shell on dvwa unless we change the default settings (which I won't). We will use the file upload functionality to get shell. We will upload a reverse shell using the file upload functionality and then access that uploaded reverse shell via LFI.
Lets upload our reverse shell via File Upload functionality and then set up our netcat listener to listen for a connection coming from the server.
nc -lvnp 9999
Then using our LFI we will execute the uploaded reverse shell by accessing it using this url:
http://localhost:9000/vulnerabilities/fi/?page=../../hackable/uploads/revshell.php
Voila! We have a shell.
To learn more about File Upload Vulnerability and the reverse shell we have used here read Learning Web Pentesting With DVWA Part 5: Using File Upload to Get Shell. Attackers usually chain multiple vulnerabilities to get as much access as they can. This is a simple example of how multiple vulnerabilities (Unrestricted File Upload + LFI) can be used to scale up attacks. If you are interested in learning more about php wrappers then LFI CheetSheet is a good read and if you want to perform these attacks on the dvwa, then you'll have to enable allow_url_include setting by logging in to the dvwa server. That's it for today have fun.
Leave your questions and queries in the comments below.

References:

  1. FILE INCLUSION VULNERABILITIES: https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
  2. php://: https://www.php.net/manual/en/wrappers.php.php
  3. LFI Cheat Sheet: https://highon.coffee/blog/lfi-cheat-sheet/
  4. File inclusion vulnerability: https://en.wikipedia.org/wiki/File_inclusion_vulnerability
  5. PHP 5.2.0 Release Announcement: https://www.php.net/releases/5_2_0.php


Read more

Sunday, August 30, 2020

Russian Arrested After Offering $1 Million To U.S. Company Employee For Planting Malware

Hackers always find a way in even if there's no software vulnerability to exploit. The FBI has arrested a Russian national who recently traveled to the United States and offered $1 million in bribe to an employee of a targeted company for his help in installing malware into the company's computer network manually. Egor Igorevich Kriuchkov, 27-year-old, entered the United States as a tourist

via The Hacker News

Related links


  1. Tools Used For Hacking
  2. Hacking Tools Windows 10
  3. Hacking Tools Usb
  4. Hacking Tools Online
  5. Pentest Tools List
  6. Pentest Tools Windows
  7. Pentest Tools Android
  8. Pentest Tools For Ubuntu
  9. Hacker Tools Apk Download
  10. Hacker Search Tools
  11. Hack Tool Apk No Root
  12. Android Hack Tools Github
  13. Computer Hacker
  14. Hacking Tools 2019
  15. Best Hacking Tools 2019
  16. Hacking Tools For Windows Free Download
  17. Pentest Tools For Ubuntu
  18. Pentest Tools Bluekeep
  19. Pentest Tools For Windows
  20. Kik Hack Tools
  21. Hacking Tools Windows
  22. Growth Hacker Tools
  23. Pentest Tools Apk
  24. Hacking Tools For Pc
  25. How To Install Pentest Tools In Ubuntu
  26. What Is Hacking Tools
  27. How To Install Pentest Tools In Ubuntu
  28. Hacker Tools Windows
  29. Free Pentest Tools For Windows
  30. Game Hacking
  31. Hacking Tools For Windows Free Download
  32. Ethical Hacker Tools
  33. Easy Hack Tools
  34. Pentest Tools Tcp Port Scanner
  35. Hack Tools For Ubuntu
  36. Hacking Tools Usb
  37. Hacking Tools Github
  38. Hack Tools Mac
  39. Hacker Tools For Mac
  40. Hacker Tools Software
  41. Best Hacking Tools 2019
  42. How To Make Hacking Tools
  43. Tools 4 Hack
  44. Pentest Tools Apk
  45. Hack Website Online Tool
  46. Hacker
  47. Free Pentest Tools For Windows
  48. Hacking Tools Mac
  49. What Is Hacking Tools
  50. Install Pentest Tools Ubuntu
  51. Pentest Box Tools Download
  52. Hack Apps
  53. Hacking Tools Github
  54. Beginner Hacker Tools
  55. Pentest Tools Tcp Port Scanner
  56. How To Hack
  57. Hack Tools For Ubuntu
  58. Blackhat Hacker Tools
  59. Nsa Hack Tools Download
  60. Game Hacking
  61. Hack Tools Download
  62. Pentest Tools Free
  63. What Are Hacking Tools
  64. Hacking Tools For Windows Free Download
  65. Hacking Tools Windows
  66. Hacker Tool Kit
  67. Hacker Tools
  68. Hackers Toolbox
  69. How To Make Hacking Tools
  70. Pentest Tools
  71. Hak5 Tools
  72. Hacks And Tools
  73. Hacker Tools 2020
  74. Pentest Automation Tools
  75. Pentest Tools Website
  76. Hack App
  77. Hacker Tools For Pc
  78. Hacker Tools Hardware
  79. Free Pentest Tools For Windows
  80. Hacker Tools Free
  81. Hacker Tools Free
  82. Hacking Tools For Windows 7
  83. Hack Tools Online
  84. Pentest Automation Tools
  85. Pentest Tools Open Source
  86. Tools 4 Hack
  87. How To Hack
  88. Hacking Apps
  89. Pentest Tools Open Source
  90. Hacking Tools Windows 10
  91. Pentest Tools Download
  92. Hack Tool Apk
  93. Hack App
  94. Install Pentest Tools Ubuntu
  95. Hacker Tools List
  96. New Hacker Tools

Group Instant Messaging: Why Blaming Developers Is Not Fair But Enhancing The Protocols Would Be Appropriate

After presenting our work at Real World Crypto 2018 [1] and seeing the enormous press coverage, we want to get two things straight: 1. Most described weaknesses are only exploitable by the malicious server or by knowing a large secret number and thereby the protocols are still very secure (what we wrote in the paper but some newspapers did not adopt) and 2. we see ways to enhance the WhatsApp protocol without breaking its features.


We are of course very happy that our research reached so many people and even though IT security and cryptography are often hard to understand for outsiders, Andy Greenberg [2], Patrick Beuth [3] and other journalists [4,5,6,7,8] wrote articles that were understandable on the one hand and very accurate and precise on the other hand. In contrast to this, we also saw some inaccurate articles [9,10] that fanned fear and greatly diverged in their description from what we wrote in our paper. We expected this from the boulevard press in Germany and therefore asked them to stick to the facts when they were contacting us. But none of the worst two articles' [9,10] authors contacted us in advance. Since our aim was never to blame any application or protocol but rather we wanted to encourage the developers to enhance the protocols, it contradicts our aim that WhatsApp and Signal are partially declared attackable by "anyone" "easily" [9,10].

Against this background, we understand Moxie's vexation about certain headlines that were on the Internet in the last days [11]. However, we believe that the ones who understand the weaknesses, comprehend that only the malicious server can detectably make use of them (in WhatsApp) or the secret group ID needs to be obtained from a member (in Signal). As such, we want to make clear that our paper does not primarily focus on the description of weaknesses but presents a new approach for analyzing and evaluating the security of group instant messaging protocols. Further we propose measures to enhance the analyzed protocols. The description of the protocols' weaknesses is only one part of the evaluation of our analysis approach and thereby of the investigation of real world protocols. This is the scientific contribution of our paper. The practical contribution of the analyzed messengers, which is the communication confidentiality for billion users (in most cases), is great and should be noted. Therefore we believe that being Signal, WhatsApp, or Threema by applying encryption to all messages and consequently risking research with negative results is much better than being a messenger that does not encrypt group messages end-to-end at all. We do not want to blame messengers that are far less secure (read Moxie's post [11] if you are interested).

Finally we want note that applying security measures according to the ticket approach (as we call it in the paper [12]) to the invitation links would solve the issues that Facebook's security head mentioned in his reply [13] on our findings. To our knowledge, adding authenticity to group update messages would not affect invitation links: If no invitation link was generated for a group, group members should only accept joining users if they were added by an authentic group update message. As soon as a group invitation link was generated, all joining users would need to be accepted as new group members with the current design. However there are plenty ways how WhatsApp could use invitation links without endowing the server with the power to manage groups without the group admins' permission:
One approach would be generating the invitation links secretly and sharing them without the knowledge of the server. An invitation link could then contain a secret ticket for the group and the ID of the group. As soon as a user, who received the link, wants to join the group, she can request the server with the group ID to obtain all current group members. The secret ticket can now be sent to all existing group members encrypted such that the legitimate join can be verified.

Of course this would require engineering but the capability of WhatsApp, shipping drastic protocol updates, can be assumed since they applied end-to-end encryption in the first place.

[1] https://www.youtube.com/watch?v=i5i38WlHfds
[2] https://www.wired.com/story/whatsapp-security-flaws-encryption-group-chats/
[3] http://www.spiegel.de/netzwelt/apps/whatsapp-gruppenchats-schwachstelle-im-verschluesselungs-protokoll-a-1187338.html
[4] http://www.sueddeutsche.de/digital/it-sicherheit-wie-fremde-sich-in-whatsapp-gruppenchats-einladen-koennen-1.3821656
[5] https://techcrunch.com/2018/01/10/security-researchers-flag-invite-bug-in-whatsapp-group-chats/
[6] http://www.telegraph.co.uk/technology/2018/01/10/whatsapp-bug-raises-questions-group-message-privacy/
[7] http://www.handelsblatt.com/technik/it-internet/verschluesselung-umgangen-forscher-finden-sicherheitsluecke-bei-whatsapp/20836518.html
[8] https://www.heise.de/security/meldung/WhatsApp-und-Signal-Forscher-beschreiben-Schwaechen-verschluesselter-Gruppenchats-3942046.html
[9] https://www.theinquirer.net/inquirer/news/3024215/whatsapp-bug-lets-anyone-easily-infiltrate-private-group-chats
[10] http://www.dailymail.co.uk/sciencetech/article-5257713/WhatsApp-security-flaw-lets-spy-private-chats.html
[11] https://news.ycombinator.com/item?id=16117487
[12] https://eprint.iacr.org/2017/713.pdf
[13] https://twitter.com/alexstamos/status/951169036947107840

Further articles:
- Matthew Green's blog post: https://blog.cryptographyengineering.com/2018/01/10/attack-of-the-week-group-messaging-in-whatsapp-and-signal/
- Schneier on Security: https://www.schneier.com/blog/archives/2018/01/whatsapp_vulner.html
- Bild: http://www.bild.de/digital/smartphone-und-tablet/whatsapp/whatsapp-sicherheitsluecke-in-gruppenchats-54452080.bild.html
- Sun: https://www.thesun.co.uk/tech/5316110/new-whatsapp-bug-how-to-stay-safe/
More information
  1. Hacker Tools Github
  2. Underground Hacker Sites
  3. New Hacker Tools
  4. Hacking Tools Name
  5. Hack Tools
  6. Install Pentest Tools Ubuntu
  7. Hack Tools For Games
  8. Black Hat Hacker Tools
  9. Hacker Tools Mac
  10. Hacker Tools Linux
  11. Pentest Tools
  12. Pentest Tools Website
  13. Hacker Tools List
  14. How To Install Pentest Tools In Ubuntu
  15. Hacker Tool Kit
  16. How To Hack
  17. Hak5 Tools
  18. Hacking Tools For Kali Linux
  19. Hack Tools Online
  20. Hacking Apps
  21. Hacking Tools For Windows
  22. Hacking Tools For Kali Linux
  23. Hacking Tools Windows 10
  24. What Is Hacking Tools
  25. Hacker Hardware Tools
  26. Computer Hacker
  27. Pentest Tools For Android
  28. Hack Website Online Tool
  29. Hacker Tool Kit
  30. Hack Website Online Tool
  31. Pentest Tools Open Source
  32. Pentest Tools Online
  33. Bluetooth Hacking Tools Kali
  34. Hacker Tools For Mac
  35. Pentest Tools Android
  36. Pentest Tools For Android
  37. Beginner Hacker Tools
  38. Hacking Tools
  39. Hacker Tool Kit
  40. Hacker Tools For Mac
  41. Hacker Tools For Pc
  42. Pentest Tools Website Vulnerability
  43. Hacking Tools For Kali Linux
  44. Pentest Tools Website
  45. Hacking Tools Free Download
  46. Pentest Recon Tools
  47. Pentest Tools For Ubuntu
  48. Hacker Tools For Mac
  49. Pentest Tools Framework
  50. Tools For Hacker
  51. Hacker Tools 2019
  52. Game Hacking
  53. Hacking Tools Online
  54. Pentest Tools Tcp Port Scanner
  55. Game Hacking
  56. Hacker Tools Mac
  57. Hacker Tools Linux
  58. Blackhat Hacker Tools
  59. Pentest Tools Open Source
  60. Blackhat Hacker Tools
  61. Hacking Tools For Windows 7
  62. Hack App
  63. Hacking Tools For Pc
  64. Github Hacking Tools
  65. Hack Tool Apk
  66. Pentest Tools Linux
  67. Hacking Tools For Beginners
  68. Hacker Tools Github
  69. Pentest Tools Port Scanner
  70. Install Pentest Tools Ubuntu
  71. Pentest Reporting Tools
  72. How To Install Pentest Tools In Ubuntu
  73. Hack Tools Online
  74. Pentest Tools Framework
  75. Tools 4 Hack
  76. Pentest Tools Alternative
  77. Tools Used For Hacking
  78. Pentest Tools Url Fuzzer
  79. Pentest Tools Url Fuzzer
  80. Hacks And Tools
  81. Hacking Tools For Windows Free Download
  82. Black Hat Hacker Tools
  83. Pentest Tools For Mac
  84. Hacking Tools Usb
  85. Hacker Tool Kit
  86. Pentest Tools Bluekeep
  87. Pentest Tools Alternative
  88. Tools 4 Hack
  89. Hacker Tools 2020
  90. Bluetooth Hacking Tools Kali
  91. What Are Hacking Tools
  92. Hack Tools For Pc
  93. Pentest Tools Port Scanner
  94. Hack Website Online Tool
  95. Pentest Box Tools Download
  96. Hacking App
  97. Hack Tools Mac
  98. Hacker Tools List
  99. Blackhat Hacker Tools
  100. Hacker Tools For Ios
  101. Pentest Tools Nmap
  102. Best Pentesting Tools 2018
  103. Hack And Tools
  104. Hacker Tools
  105. Hack Tools Online
  106. Hack Tools Mac
  107. Hacking Tools Github
  108. Hacker Tools List
  109. Hacker Tools List
  110. How To Make Hacking Tools
  111. Easy Hack Tools
  112. Hacker Tools Mac
  113. Pentest Tools Online
  114. Beginner Hacker Tools
  115. Hacker Tools Online
  116. Growth Hacker Tools
  117. Hacking Tools Pc
  118. Hacker Tools Free
  119. Hacking Tools Download
  120. Pentest Tools Website Vulnerability
  121. What Is Hacking Tools
  122. Pentest Tools Online
  123. Pentest Tools Port Scanner
  124. What Is Hacking Tools
  125. Hacker Security Tools
  126. Hacker Tools
  127. Hack Tools
  128. Hacker Security Tools
  129. Hack Tools For Games
  130. Bluetooth Hacking Tools Kali
  131. Hacking Apps
  132. Nsa Hacker Tools
  133. Hacking Tools For Pc
  134. Hacker Tools For Pc
  135. Hacking Tools 2019
  136. Hacking Tools Name
  137. Bluetooth Hacking Tools Kali
  138. How To Install Pentest Tools In Ubuntu
  139. Hacker Tools For Mac
  140. Pentest Tools Online
  141. Hacking Tools For Games
  142. Hacker Tools For Mac
  143. Pentest Recon Tools
  144. Hacker Security Tools
  145. Hacking Tools Pc
  146. Nsa Hacker Tools