Hot Potato - Windows: the most dangerous OS in the world

The unholy zero-day concoction, reported to Microsoft in September and still unpatched, is a reliable way of p0wning Windows for attackers that have managed to pop user machines.

Breen released exploit code for his attack dubbed Hot Potato following his talk at the Shmoocon conference in Washington over the weekend.  "Hot Potato takes advantage of known issues in Windows to gain local privilege escalation in default configurations, namely NTLM relay -\- specifically HTTP-SMB relay - and NBNS spoofing," Breen says.  

"Using this technique, we can elevate our privilege on a Windows workstation from the lowest levels to NT Authority/System – the highest level of privilege available on a Windows machine.  "This is important because many organisations unfortunately rely on Windows account privileges to protect their corporate network."

http://theregister.co.uk/2016/01/20/hot/

Tails 2 Is Out!

We are especially proud to present you Tails 2.0, the first version of Tails based on:

  * GNOME Shell, with lots of changes in the desktop environment.
  * Debian 8 (Jessie), which upgrades most included software and improves many things under the hood.

This release fixes [many security issues](https://tails.boum.org/security/Numerous_security_holes_in_1.8.2/index.en.html) and users should upgrade as soon as possible.

# Changes

## New features

  * Tails now uses the GNOME Shell desktop environment, in its Classic mode. GNOME Shell provides a modern, simple, and actively developed desktop environment. The Classic mode keeps the traditional Applications, Places menu, and windows list. Accessibility and non-Latin input sources are also better integrated.

To find your way around, [read our introduction to GNOME and the Tails desktop.](https://tails.boum.org/doc/first_steps/introduction_to_gnome_and_the_tails_desktop/index.en.html)

The desktop and Applications menu


The activities overview


## Upgrades and changes

  * Debian 8 upgrades most included software, for example:

    * Many core GNOME utilities from 3.4 to 3.14: Files, Disks, Videos, etc.
    * LibreOffice from 3.5 to 4.3
    * PiTiVi from 0.15 to 0.93
    * Git from 1.7.10 to 2.1.4
    * Poedit from 1.5.4 to 1.6.10
    * Liferea from 1.8.6 to 1.10
  * Update Tor Browser to 5.5 (based on Firefox 38.6.0 ESR):

    * Add Japanese support.
  * Remove the Windows camouflage which is currently broken in GNOME Shell. We started working on [adding it back](https://labs.riseup.net/code/issues/10830) but [your help is needed](https://tails.boum.org/news/windows_camouflage_jessie/index.en.html)!

  * Change to `systemd` as init system and use it to:

    * Sandbox many services using Linux namespaces and make them harder to exploit.
    * Make the launching of Tor and the memory wipe on shutdown more robust.
    * Sanitize our code base by replacing many custom scripts.
  * Update most firmware packages which might improve hardware compatibility.

  * Notify the user if Tails is running from a non-free virtualization software.

  * Remove Claws Mail, replaced by [Icedove](https://tails.boum.org/doc/anonymous_internet/icedove/index.en.html), a rebranded version of Mozilla Thunderbird.

## Fixed problems

  * HiDPI displays are better supported. ([#8659](https://labs.riseup.net/code/issues/8659))

  * Remove the option to open a download with an external application in Tor Browser as this is usually impossible due to the AppArmor confinement. ([#9285](https://labs.riseup.net/code/issues/9285))

  * Close Vidalia before restarting Tor.

  * Allow Videos to access the DVD drive. ([#10455](https://labs.riseup.net/code/issues/10455), [#9990](https://labs.riseup.net/code/issues/9990))

  * Allow configuring printers without administration password. ([#8443](https://labs.riseup.net/code/issues/8443))

# Known issues

  * Tor Browser 5.5 introduces [protection against fingerprinting](https://trac.torproject.org/projects/tor/ticket/13313) but due to an [oversight](https://labs.riseup.net/code/issues/11000) it is not enabled in Tails 2.0. However, this is not so bad for Tails users since each Tails system has the same fonts installed, and hence will look identical, so this only means that it's easy to distinguish whether a user of Tor Browser 5.5 uses Tails or not. That is already easy given that Tails has the AdBlock Plus extension enabled, unlike the normal Tor Browser.

See the current list of [known issues](https://tails.boum.org/support/known_issues/index.en.html).

# Installing

We also redesigned completely our download and installation instructions to make it easier to get started with Tails.

For example, you can now verify the ISO image automatically from Firefox using a special add-on.

You can also install or upgrade Tails directly from Debian or Ubuntu using the `tails-installer` package.

[Try our new installation assistant.](https://tails.boum.org/install/index.en.html)


# Upgrading

Tails changed so much since version 1.8.2 that it is impossible to provide an automatic upgrade. We recommend you [follow our new manual upgrade instructions](https://tails.boum.org/upgrade/index.en.html) instead.

# What's coming up?

The next Tails release is [scheduled](https://tails.boum.org/contribute/calendar/) for March 6.

Have a look at our [roadmap](https://labs.riseup.net/code/projects/tails/roadmap) to see where we are heading to.

We need your help and there are many ways to [contribute to Tails](https://tails.boum.org/contribute/index.en.html) ([donating](https://tails.boum.org/contribute/how/donate/index.en.html) is only one of them). Come [talk to us](https://tails.boum.org/contribute/talk/)!

URL: https://tails.boum.org/news/version_2.0/index.en.html
_______________________________________________
amnesia-news mailing list
amnesia-news@boum.org
https://mailman.boum.org/listinfo/amnesia-news

Twitter App Crash

The Twitter app on my LG Power Android device running 5.0 Lollipop has begun to crash at distressing rates. Sometimes it takes the phone with it and reboots. I've suffered through this worsening condition for over two months.

Today, after crashing three times in the span of two hours I have decided to throw in the towel and find another app.

As large as Twitter has become I would think they could provide a more stable mobile product. I guess that's pie in the sky wishing.

Microsoft Has The Encryption Keys To Your New Windows 10

The Intercept has written that if you have bought a Windows PC recently then Microsoft probably has your encryption key. This is a reference to Windows' device encryption feature. We wrote about this feature when it was new, back when Microsoft introduced it in Windows 8.1 in 2013 (and before that, in Windows RT).

Read the full article...

Plain old espionage and corporate spying

Did you know the NSA (National Security Agency) has built a map of the entire world via the communication links of all email, chat, and  financial transactions? This map tells a story to them about all of us.  It knows who we know. It knows who our activist allies and relationships  are.

And, as if that wasn’t crappy enough, the NSA is trying to undermine the  security of the internet as a whole by putting in back-doors and  weakening encryption standards so that they can spy better. They spend  $250,000,000 USD per year on this. This makes the entire internet less  secure, and makes it easier for people, governments, and corporations to  exploit, scam, and spy on each other.

While the NSA claims they are targeting terrorism, they have been  targeting foreign politicians and companies, with evidence that this is  happening particularly in Brazil and Mexico. This is plain old espionage  and corporate spying. Terrorism is merely the justification for  astounding encroachments on our civil liberties.

Last, we have to assume this is all the tip of an iceberg. We have to  assume there are other spy agencies across the globe doing similar spy  work that we don’t know about (yet).

Quick Guide: Scanner Apps for Your Smartphone or Tablet

In many ways smartphones like the Apple iPhone 6 or Samsung Galaxy S6 Edge have come to replace cameras, TVs, and handheld video recorders and you can add one more to that list – the scanner. That’s because a growing number of robust apps can replace your bulky scanner and increase productivity and this week, I want to tell you about about three of the best.

For iOS there’s Readdle’s Scanner Pro, capable of easily handling anything you throw its way. Take a picture of whatever you want to scan. The program then makes whatever is in the pic “look” scanned. Especially useful is the function that allows you to upload scanned images to Dropbox, Evernote, Google Drive, and other cloud-based storage services. Or email it to you or someone else simply by pushing the “Send” button. This one is $2.99.

Android fans will want to consider Mobile Doc Scanner 3 + OCR. Transform everything from receipts and invoices to white boards and magazine articles with the app also known as MDScan. Just take a picture, let the program do its thing, and you have a file that looks like every other scan you’ve ever made. Best of all, you can take a bunch of pictures on the fly and let the software process them later. Also allows for upload to cloud-based services. The price at the Google Play store is $4.99.

If you’re looking for a free option (iOS, Android, Windows), there’s Genius Scan from The Grizzly Labs. Works like the others – take a pic and the software makes whatever is in the pic look scanned. Genius Scan gives a ton of great options like fingerprint security, the ability to assign a password to a specific scan so that no one can snoop on you, and the ability to send scans to the cloud.

Creating Strong Passwords: 101

In one image:


And throw in some punctuation
for good measure.

You are now a graduate!