20 November 2016

Beware!! socialtrade.biz Scam Exposed !!

Of course everyone wants to make easy money at home. Who wants to commute for an hour one way to a job in a major city? The answer is no one. That’s why frauds taking advantage of and offering online work to just click some link and make money from doing just daily 10-15 min work. They target definite vulnerable demographic segments of the population, such as the elderly or disadvantaged. And as bad as this gets, they also trick highly educated and Internet savvy people too into believing that they can make money fast on these programs.

Many frauds are taking advantage of this and you may lose your hard earned money.

Guys if you remember in 2011 I also warned peoples about speak asia scam and you know what happened who not believe that this is a scam loses all his hard earned money. Attention!! SpeakAsiaOnline Survey, Be Careful !!!

Socialtrade.biz is also scam and is being nurtured by Educated IT Professionals, promoted by Greedy Elites, who are members up the ladder & have no concern about the fallout & resulting losses to thousands of people down the line.
Observe the below rules and you will know that its fraud.
1.    Rs 5 per click to employee, Rs 5 goes to Employer- Still Employer asks for joining fee, that too, a high sum of 20000 to 50000.
2.    Booster Activation Period - 20 Days; Including holidays, so it comes down to 15–16 Days. Again activation takes 2–3 days. So, It further comes down to 12–13 days. So, You need to add 2 members in 12–13 days to activate booster (Which will enhance your income per day)
3.    Say, if you join and do not add any member down the leg- then - You will be stupidly clicking fake links for around 5 months to get your money back. As company is fraud, it can have money of all those members, who enrolled in last 5 months (& din’t spread this virus) on any date either today or next Sunday or say your next birthday.
4.    If you continue spreading it, You may recover your investment ( though Company says - Its not an investment company & that huge joining fee is just a token of appreciation for their kind service of manipulating masses) in 2 months. But, those down the line will have their money stuck in this scam.
5.    So, If you see it now, its like, take the disease but pass it as fast as you can on someone (Actually 2 members) next, down the line.
6.    So, the mantra for Members - Keep spreading the disease, bear risk (& fear) of losing money just for 2 months (if you have done your service of spreading the virus to next 2 fools) and thereafter enjoy fruits of your (fake) attributes as managerial skills, Good Convincing, Risk Bearing blah-blah.
7.    If You are a member or if you become a member, you will follow (or have already trodden that path) Point 6 mentioned above. But, my request, first authenticate the claims put by company. Is clicking paying money or just the money is being circulated from new members to old members? If it looks like a scam, Stop yourself from supporting such scam.
8.    If you are not a member yet, Read again from points 1–5. Then ask yourself whether you are okay after fooling (and looting) poor members (Students/ Job Seekers/ Low earning fellows etc.) down the line. If yes, Go On — Sites like Social trade Biz are for likes of you.

How they Manipulation users:
• Each member pays a hefty amount of Rs. 57500/- to get membership. 
• The member gets 125 links (are mostly fake) to promote and earn 0. 625 per day, if booster is not activated. (Booster means making 2 members down the leg). 
• 20 days are given to a new member to activate booster. 
• Down the leg, if 2 members join, the one at top of them gets a booster income of Rs. 5000. 
• So, Say, if a new member pays Rs. 57500 and activates booster in next 15 days, the total payment to that member in next 3 months= 15 Days*625 + 50 Days* 1250 = 71875 + 5000 = 76875 
• Say, if 2 new members down the leg do not make any other member, Payment to these 2 members in next 2.5 months = 2*625*50 Days = 62500 
• Money still left with company= 57500*3 —76875 — 62500= 33125 .
• So for 3 members, Company has around 33000 with it, even after around 2.5 months of joining of 2 members down the leg. As shown, the company has done nothing other than just taking money from lower members & giving to higher members. 
• Say, If company has 200000 members on some date, then company would be having 100000 members at the bottom line, who would have joined in last 10-15 days. 
• Money with company from these 100000 members (Considering only new member money for now) = 57,500*1,00,000 = 5,75,00,00,000 (575 Crore) 
• Calculation is very easy now. Payments to those new members in last 10 days= 10*625*1,00,000 = 62,50,00,000 (62.5 Crores) 
• So Company can run away with 500 Crore on the day, when its membership reaches 200000. Some data shows, it already has more than 1 lakh members. Do you still think that its not a SCAM ? 

Why is it spreading so fast then ? 
• Educated persons leading the mission 
• Top members get huge amount, if new members are added fast. 
• Also, Members receive tablets, Laptops etc. if they make some specific no. of members down the leg in limited period. 
• Most important — Observe above carefully. The top member received Rs. 76875 in just 3  months. It means, they recovered their contribution & also made profits (By looting members down the leg). 

socialtrade.biz listed some legal document for this business but if you check these all documents are for Ablaze Info Solutions which deal in IT Software Solutions work purpose.

Be wary if you have to pay money or supply your credit card number to a company to make money from these type of jobs. Some scammers make big promises with work at home opportunities, but in these you will lose all your hard earned money.

In Multi level Marketing(MLM) concept only those people make money who are at top of chains.

So if you are one of the victim of this scam stop investing your hard earned money in this scam.

Stay Safe....

See below links Devbhoomi news exposed this scam:

Users complains:

18 April 2015

Man in the browser Attack(MITB)

Man-in-the-browser (MITB) attack, a form of Internet threat related to man-in-the-middle (MITM) attack. It is a proxy Trojan horse that infects a web browser by taking advantage of vulnerabilities in browser security to modify web pages. It modifies transaction content or insert additional transactions, all in a completely covert fashion invisible to both the user and host web application.

A MITB attack will be successful irrespective of whether security mechanisms such as SSL/PKI and/or two or three-factor Authentication solutions are in place. A MITB attack may be countered by utilizing out-of-band transaction verification, although SMS verification can be defeated by man-in-the-mobile (MITMO) malware infection on the mobile phone.

Man in the browser attack

Trojans may be detected and removed by antivirus software with a 23% success rate against Zeus in 2009, and still low rates in 2011. The 2011 report concluded that additional measures on top of antivirus were needed. A related, more simple attack is the boy-in-the-browser (BITB) attack. The majority of financial service professionals in a survey considered MITB to be the greatest threat to online banking.

A MITB Trojan works by utilizing common facilities provided to enhance browser capabilities such as Browser Helper Objects (a feature limited to Internet Explorer), browser extensions and user scripts (for example in JavaScript) etc. Antivirus software can detect some of these methods.

In a nutshell example exchange between user and host, e.g. an Internet banking transaction such as a funds transfer, the customer will always be shown, via confirmation screens, the exact payment information as keyed into the browser. The bank, however, will receive a transaction with materially altered instructions, i.e. a different destination account number and possibly amount. The use of strong authentication tools simply creates an increased level of misplaced confidence on the part of both customer and bank that the transaction is secure. Authentication, by definition, is concerned with the validation of identity credentials. This should not be confused with transaction verification.


Protect against malicious access to the browser:

Organizations need to control all access to browser interfaces (Add-on’s, API and DOM) to prevent data theft and end user social engineering. This ensures sensitive HTML information is not captured and page content is not tampered with. The ability to detect, analyze and block unauthorized attempts to override browser functions can help prevent fraud through compromised endpoints until the threat is fully removed. 

Prevent and Remove Malware Infections:

MITB attacks are carried out by malware residing on the end users machine. Organizations need to ensure endpoints are not compromised by malware by disabling exploit code used in drive-by-download infection attempts, and blocking malware downloaders and installers. If a device is already infected, automated malware removal cleans up the endpoints quickly and cheaply.


Stay Safe..

11 April 2015

Social Media Privacy Settings: How to be Safe, Secure and Social

We all enjoy keeping up with friends and family on social media, but we have to be mindful of our privacy and security when we do. Here are some suggestions to help keep your personal information private:

1. Understand what information the site needs for your account and how they use it in the first place.

Never give more information than is necessary to operate an account. Usually this includes:

  • an email: Never use a work email address; consider creating a separate one for social media sites
  • username
  • password
  • If your birthday is required, consider using a nonsense date like January 1st 1904: Your real birth date is tied to important IDs, like your driver’s license, social security number, or passport

fb privacy

2. Make sure that your posts are not indexed into search engines.

  • Each social media site handles this in a different way. For example, you can use your Facebook settings to block search engine indexing, or on Twitter you can make your posts visible to people who follow you only

3. Remember to set all your posts private on Instagram so only friends can see them and, of course, be cautious of what you post on any social media site.

  • Just because you can post it doesn’t mean that you should

4. Make sure that mobile apps for social media sites are not using personal data or sharing additional private information.

  • You should also use caution when linking together different apps like Facebook and Twitter or news apps like Flipboard and Facebook

This easy-to-use application allows you to review and set all your social network privacy preferences from a single screen.

Using these four tips can help insure your privacy online and make social media a safer place.
Stay Safe….

Everything you need to know about Digital Certificates

Digital certificates are the backbone of the Public Key Infrastructure (PKI), which is the basis of trust online. Digital certificates are often compared to signatures; we can trust a document because it has a signature, or certificate authority (CA) by someone we trust. Simply put, digital certificates are a reproduction of a simple model which occurs in the real world.

Incidents involving digital certificates have been in the news recently. Issues surrounding digital certificates and CAs are not always clear or noticeable to end users. However, IT managers, software developers, and other security professionals need to understand these problems so that the risks can be properly managed.

So who or what can we trust online?

Every computer connected to the Internet contains a list of trusted root CAs. These root CAs issue certificates, which can be used to either sign certificates for other CAs or to servers. There needs to be a “chain of trust” from any certificate that the system sees to any of the root certificates that it trusts.


What does “trusted” mean?

If a secure connection or signed file is “trusted”, this generally equates to an absence of warnings. Digital certificates are used to secure websites using SSL/TLS, identify and validate executable files using code signing, and secure email via Secure/Multipurpose Internet Mail Extensions (S/MIME). If a browser accesses an HTTPS server with an untrusted server certificate, it will generate a warning. If an unsigned or untrusted executable file is run, a warning message may be generated. A user may see these messages and avoid potentially risky behavior.

HTTPS is widely used as a way to assure users that connections to sites are authentic. Many users view the “green bars” that browsers use to mark HTTPS addresses as a sign that their connections are safe.

This trust is based on two things:

  1. CAs are not supposed to issue certificates to inappropriate users.
  2. Users (e.g. PC, browsers or mobile devices) should not add any inappropriate CA to the list of trusted CAs.

Unfortunately, the basis of this trust is now being challenged. Institutions and organizations that may not necessarily be trustworthy are widely thought of as such.

Here are several cases that highlight the problems, in today’s trust-based CA system.

Trust lost: CAs issuing certificates to inappropriate users

CAs need to have a good track record when it comes to securing their own systems to ensure they don’t issue improper certificates. However, they have been incidents where their own security and processes were targeted.

In 2011, an attacker calling himself the ComodoHacker was able to penetrate the systems of Diginotar, a Dutch CA. The attacker issued multiple fraudulent certificates. The loss of confidence in Diginotar’s security led to major operating system vendors removing them from their lists of trusted CAs. This eventually led to Diginotar shutting down as a business.

While Diginotar was a relatively minor player in the CA market, the attacker also claimed to have access to the networks of Comodo, which was a far larger CA.

More recent cases are just as troubling. In March 2015, Comodo issued a certificate for the live.fi domain to an unauthorized party. This domain was the Finnish domain of the live.com online services, which is a part of Microsoft. How was this the case?

Comodo issued what are known as Domain Validation certificates to Microsoft. These types of CA require the site owner to verify that he does control the domain he wants a CA for. The most common method is to send an email from that domain with one of several possible email addresses, namely:

  • admin@
  • administrator@
  • postmaster@
  • hostmaster@
  • webmaster@

The live.fi domain is used by Microsoft to provide free email… and a clever Finnish man found that the address hostmaster@live.fi was available. He was able to acquire this address and use it to obtain certificates for live.fi that would have been trusted by any browser, but was not under the control of Microsoft. In interviews, the Finnish man stated he had already reported the problem to Microsoft and Finnish authorities in January of 2015.

The certificate could have been used to mount man-in-the-middle (MITM) attacks with a certificate that would have been verified by any browser in use. This would have fooled many users into giving up their credentials. Comodo cancelled the certificate, and Microsoft released a separate update for Windows as well.

Fortunately, there was a silver lining. Only one fraudulent certificate was created, and it could not be used for other purposes. This is because the allowed uses are defined in the certificate (Extended Key Usage). Certificates for SSL servers can only be used for server verification; code signing certificates are limited to that specific purpose as well.

Later in the month, Google had their own certificate snafu. They discovered that an Egyptian ISP (MCS Holdings) held a digital certificate that could be used for MITM attacks via a proxy. Generally, these proxies require that a certificate be installed in devices to be transparent. However, in this case, the MCS Holdings certificate was signed by the China Internet Network Information Center (CNNIC), which was included in root stores. This means that any certificates issued with the MCS Holdings certificate would be seen as valid by systems, even if they had no “right” to issue that certificate (i.e., for domains they did not own).

As in the case of Diginotar, this incident has resulted in serious consequences for the CAs involved. The certificate issued by MCS Holdings has been blacklisted by Google, Microsoft, and Mozilla. In addition, CNNIC itself has been targeted for action as well.

Both Google and Mozilla have indicated that moving forward, certificates issued by CNNIC would no longer be trusted. This means that while organizations that currently rely on CNNIC-derived certificates can still use them, once these certificates expire, new certificates (with a different CA) will need to be acquired.

These cases highlight the inherent risk in a CA-based model: attacks targeting CAs can occur, and if these certificates fall into the hands of attackers with strong motives to intercept communications, user information could be put at risk. For the CAs themselves, any lapse in the process of how certificates are issued can result in a swift blacklisting, instantly ruining what can be a profitable business for the CA.

Mistrust added: inappropriate CAs among trusted CA lists

The most recent case of a CA being added to user systems was Superfish, where adware capable of monitoring HTTPS traffic was preinstalled on Lenovo PCs. Due to the (poor) way it was implemented, in a nutshell, anyone could issue any certificates.

This means on any PCs with Superfish installed, the trust placed in HTTPS might well be misplaced: phishing by making a malicious sites appear to be secure, intercepting communications using MITM attacks, signing malware so that users would run it, making users believe that signed mail was legitimate.

It is difficult, if not impossible, to use the Internet if there is an underlying current of distrust. If we can’t tell if our visits to Gmail, Facebook, Twitter or online banking sites are safe, we can’t even browse websites. If we can’t tell if the program we’re try to run is real or not, even opening what we think is Notepad entails a risk.

What should users and CAs do?

CAs need to ensure that their own systems are secure to minimize the possibility of fraudulent certificate issuance. They should also be careful about issuing certificates to widely recognized and popular domains, especially since the effects if such a wrongly issued certificate becomes public may be significant. A system based on trusting institutions (such as CAs) only functions well if the said institutions are actually trustworthy.

CAs should consider verifying via other means of communication (such as the phone) requests for certificates from domains, as this is a step cybercriminals may have difficulty meeting. Recipients of certificates with more privileges (such as the one issued to MCS) should be subject to tighter controls to prevent potential abuse.

Site owners who want to ensure that fraudulent certificates are not issued in their name should consider pre-registering the email addresses frequently used for website verification, to ensure they stay under the control of the site administrator. Alternately, those addresses should be set aside and not registered at all.

The current CA-based system of trust is not perfect, and relies on both certificate authorities and users to exercise good judgment and prudence. It is far from perfect, but it is what we have now. Additional safeguards can improve the security of SSL certificates. As more and more sites become HTTPS-only, this issue will become more prominent in the coming years.

30 March 2015

Android Installer Hijacking vulnerability leaves apps open to malware

Palo Alto Networks discovered a widespread vulnerability in Google’s Android OS.  The vulnerability mentioned  in a blog post released Tuesday, more than a year after initially discovering the bug and alerting Google and other Android manufacturers of its existence. Any attacks leveraging the bug rely on the fact that Android packages (APKs) downloaded through Google Play are installed to a protected space, whereas apps downloaded through a third-party store are saved to unprotected local storage.

Android at risk

To fall victim to an attack, a malicious application must be installed on a device. This app can come from either a legitimate or third-party app store and can function perfectly. However, written into the app is a code that allows it to detect when the compromised user is installing a new app, according to the post.

The malicious app will check whether the new app is being installed through a third-party store or Google Play, or, more simply, if it's being saved to a protected space or unprotected local storage, the post says.

If the app is going to be saved in an unprotected space, the malicious app begins taking action. At this point, it will overwrite the legitimate app with malware while a user views a permission page. More permissions could be provided than detailed in the permissions page, and the device becomes officially compromised.

The vulnerability affects Android 2.3, 4.0.3-4.0.4, 4.1.X, and 4.2.x. Android Open Source Project issued patches for Android 4.3 and later, dropping the vulnerability rate to 50 percent, Ryan Olson, Unit 42 intelligence director, Palo Alto Networks, said in an interview with SCMagazine.com.

No exploits had been spotted in the wild previous to this blog posting, Olson said, but he recommended that users only download from legitimate app stores.

“Generally, our guidance to any enterprise deploying Android is to keep it as locked down as possible,” he said. “Don't allow sources other than Google Play to install apps on the phone.”

The company also released a vulnerability scanner app through Google Play that can determine whether a device is vulnerable.

Stay Safe…