Login
T3SF is a framework that offers a modular structure for the orchestration of events based on a master scenario events list (MSEL) together with a set of rules defined for each exercise (optional) and a configuration that allows defining the parameters of the corresponding platform. The main module performs the communication with the specific module (Discord, Slack, Telegram, etc.) that allows the events to present the events in the input channels as injects for each platform. In addition, the framework supports different use cases: "single organization, multiple areas", "multiple organization, single area" and "multiple organization, multiple areas".
To use the framework with your desired platform, whether it's Slack or Discord, you will need to install the required modules for that platform. But don't worry, installing these modules is easy and straightforward.
To do this, you can follow this simple step-by-step guide, or if you're already comfortable installing packages with pip, you can skip to the last step!
FreshRSS 
# Python 3.6+ required
python -m venv .venv # We will create a python virtual environment
source .venv/bin/activate # Let's get inside it
pip install -U pip # Upgrade pipOnce you have created a Python virtual environment and activated it, you can install the T3SF framework for your desired platform by running the following command:
pip install "T3SF[Discord]" # Install the framework to work with Discordor
pip install "T3SF[Slack]" # Install the framework to work with SlackThis will install the T3SF framework along with the required dependencies for your chosen platform. Once the installation is complete, you can start using the framework with your platform of choice.
We strongly recommend following the platform-specific guidance within our Read The Docs! Here are the links:
We created this framework to simplify all your work!
$ docker run --rm -t --env-file .env -v $(pwd)/MSEL.json:/app/MSEL.json base4sec/t3sf:slackInside your .env file you have to provide the SLACK_BOT_TOKEN and SLACK_APP_TOKEN tokens. Read more about it here.
There is another environment variable to set, MSEL_PATH. This variable tells the framework in which path the MSEL is located. By default, the container path is /app/MSEL.json. If you change the mount location of the volume then also change the variable.
$ docker run --rm -t --env-file .env -v $(pwd)/MSEL.json:/app/MSEL.json base4sec/t3sf:discordInside your .env file you have to provide the DISCORD_TOKEN token. Read more about it here.
There is another environment variable to set, MSEL_PATH. This variable tells the framework in which path the MSEL is located. By default, the container path is /app/MSEL.json. If you change the mount location of the volume then also change the variable.
Once you have everything ready, use our template for the main.py, or modify the following code:
Here is an example if you want to run the framework with the Discord bot and a GUI.
from T3SF import T3SF
import asyncio
async def main():
await T3SF.start(MSEL="MSEL_TTX.json", platform="Discord", gui=True)
if __name__ == '__main__':
asyncio.run(main())Or if you prefer to run the framework without GUI and with Slack instead, you can modify the arguments, and that's it!
Yes, that simple!
await T3SF.start(MSEL="MSEL_TTX.json", platform="Slack", gui=False)If you need more help, you can always check our documentation here!
Given the climate surrounding COVID-19, many of us have had to substitute in-person social interactions with virtual communication. For parents, this includes organizing virtual playdates, hangouts, and video chats for their kids. While this provides an excellent solution for children to continue interacting with their peers, it has also opened up a new avenue for potential risks and dangers. It is imperative to ensure these virtual platforms are safe for all involved. In this article, we will provide some essential strategies for maintaining a secure and enjoyable online social environment for everyone.
The advent of technology has significantly transformed the way we communicate and interact with each other. However, as with any great invention, it also comes with potential risks and dangers, especially for kids who may not fully comprehend the implications of their online activities. With cyberbullying, online predators, and inappropriate content being just a few of the digital risks, it is crucial to establish robust safety measures when kids engage in online social activities such as virtual playdates, hangouts, and video chats.
In this article, we will explore the different ways parents and caregivers can keep these activities secure and fun. By understanding the risks involved, staying informed on the latest developments in online safety, and taking actionable steps, everyone can navigate the digital world safely and confidently.
Navigating the potential pitfalls of online interaction requires proactive measures and informed strategies. Let’s take a look at these tips on how to safeguard everyone from the inherent dangers of virtual communication, promoting a secure and positive digital experience for all.
The first step in ensuring a safe online environment for children is understanding the potential risks and how they can be mitigated. Internet safety is not just about blocking and filtering inappropriate content; it’s also about educating ourselves and our children on how to behave responsibly online and understanding the potential repercussions of our digital footprint.
Online activities, especially those involving video chats, can expose children to various risks, including cyberbullying, identity theft, and exposure to inappropriate content. These risks can have devastating consequences on a child’s mental health, self-esteem, and overall well-being. As such, it is vital for parents and caregivers to have regular conversations about these potential dangers with their children. It’s also crucial to ensure that children feel comfortable expressing any concerns or reporting any uncomfortable situations they encounter online.
→ Dig Deeper: Messenger Rooms: New Video Chat Option is Fun But Has Risks
The market is flooded with countless communication platforms, each with its features, safety measures, and potential loopholes. As a parent, choosing the right tool for your child’s online activities can be quite overwhelming. Not all platforms are created equal, and while some prioritize user safety and provide robust parental controls, others may not provide the same level of security.
When choosing a platform for your child’s virtual playdates or hangouts, consider aspects like age restrictions, privacy settings, and whether the platform allows parental controls. Additionally, evaluate the platform’s reputation regarding safety – a quick internet search can provide insights into any security issues or breaches the platform may have had in the past. Remember, the goal is to create a safe and enjoyable online experience for children.
One of the essential ways to ensure online safety for kids is by properly setting up privacy settings and parental controls on the communication tools they use. These settings can limit what information is shared and with whom, restrict access to certain content, and even set time limits for usage. Parental controls are a fantastic way of managing and monitoring your child’s online activities without being overly intrusive.
However, it’s important to note that these controls and settings are not foolproof. They should be used in conjunction with open communication and education about online safety. It’s essential to explain to children why these measures are in place, rather than just imposing them. They are more likely to follow these guidelines if they understand their purpose.
McAfee Pro Tip: Parental controls are effective in monitoring children, but nothing beats proactive digital parenting. Managing digital parenting doesn’t need to be daunting, especially when you approach it step by step. Know how parental controls and digital parenting can help create good habits.
Establishing clear guidelines for online communications is another critical aspect of ensuring a secure online environment for kids. These guidelines should be age-appropriate and cover aspects like sharing personal information, accepting friend requests, and how to behave respectfully online.
It’s also important to educate kids on the permanence of their online activities. Once something is shared online, it can be difficult, if not impossible, to completely remove it. They should understand the potential impact of their online behavior on their future, such as college admissions or job opportunities. Encouraging safe and responsible online behavior can go a long way in mitigating many of the potential risks associated with online communication.
→ Dig Deeper: Teens’ Online Behavior Can Get Them in Trouble
In addition to safety measures, it’s also important to establish some etiquette for virtual playdates to ensure they are enjoyable and respectful for everyone involved. These guidelines should include respecting others’ time, muting when not speaking to avoid background noise, and understanding when to use the chat feature versus when to speak up.
It’s also important to discuss how to handle disagreements or misunderstandings that may arise during these virtual gatherings. Encourage kids to express themselves respectfully and listen to others’ perspectives. Remind them that it’s okay to disagree with someone but that it should be done in a respectful and kind manner.
Depending on the age of your child, you may need to monitor the amount of time they spend on virtual activities. It’s easy for kids to lose track of time when they are engrossed in a fun virtual playdate or hangout. Setting and enforcing time limits can help prevent screen addiction and ensure your child has a balanced life with ample time for physical activities, schoolwork, and offline social interactions.
To make this process easier, you can use the built-in screen time management features available on most devices or utilize third-party apps that provide more detailed monitoring and control. Talk to your child about the importance of balancing online and offline activities. Make sure they understand that these limits are set out of concern for their well-being, not as a form of punishment.
Just like offline interactions, teaching kids to be respectful in their digital communications is crucial. They should understand that the same rules of kindness and respect apply, whether they’re interacting with others face-to-face or through a screen. Cyberbullying is a significant concern for many parents, and teaching children to treat others respectfully can help mitigate this risk.
Encourage your child to empathize with others by imagining how they would feel if the roles were reversed. Foster an online culture of acceptance, understanding, and respect by setting a positive example through your own online interactions. Remember, kids often emulate the behavior they see around them.
→ Dig Deeper: 5 Digital Family Values to Embrace to Make the Internet a Better Place
Open communication is the key to any successful relationship, and this holds true for your relationship with your child. Encourage them to talk to you about their online experiences, both good and bad. This can help you identify any potential problems before they escalate and provide guidance on how to handle various situations.
Ensure your child feels comfortable coming to you with any issues or concerns they may have. Make it clear that you’re there to help, not to chastise them for making mistakes. Remember, the online world can be a confusing and intimidating place for kids, and they need to know they have a trusted adult to turn to when they need help navigating it.
The online world is constantly evolving, so staying up-to-date with the latest safety tips is crucial. Regularly check reliable online safety resources and learn about the latest threats, trends, and best practices. This can help you prepare for and mitigate potential risks before they impact your child.
Consider joining online communities where parents share tips and advice about online safety. These platforms can be a great source of information and support as you navigate the digital world with your child. Remember, knowledge is power, and the more informed you are, the better you can protect your child.
In conclusion, ensuring online safety during virtual playdates, hangouts, and video chats involves a combination of selecting the right communication platforms, using privacy settings and parental controls, establishing guidelines for online communications, and promoting open, respectful interactions. As parents and caregivers, it’s essential to remain vigilant and proactive in teaching our children about online safety.
However, it’s equally important to remember that our ultimate goal isn’t to eliminate all online risks but to create a balance where our kids can enjoy the benefits of the virtual world while being mindful of its potential pitfalls. By employing the strategies discussed in this article, you can provide a safe and enjoyable online environment for your child, fostering their growth and development while ensuring their safety.
The post Keeping Virtual Play Dates, Hangouts, and Video Chats Safe for Everyone appeared first on McAfee Blog.
Supports almost all operating systems
Supports almost all desktop applications developed based on Electron
All malicious operations are executed by the injected program, those commonly used trusted programs
Bypass of Network Access Control Policy for Applications by Zero Trust Sandbox
Verified that it will not be discovered by the antivirus software below
(Please note that a simple command call has been implemented here, and some behavior based heuristic checks will still prompt , bypass AV is not a key issue to be addressed in this project)
An increasing number of desktop applications are opting for the Electron framework.
Electron provides a method that can be debugged, usually by utilizing Chrome's inspect function or calling inspect through Node.js. In this project, the implementation of inspect was analyzed, and a method for automatically parasitizing common Electron programs was developed.
By establishing a connection with the Command and Control (C2) server, a simple remote control is achieved.
Due to the widespread trust of most antivirus software in these well-known applications (with digital signatures), executing malicious commands in the program context provides excellent concealment and stability.
For these injected applications, it is necessary to carefully consider the potential legal risks brought by such actions. When users analyze program behavior, they may be surprised to find that the parent process executing malicious behavior comes from the application they trust.
nc -lvnp 8899
clone this project
modify build.config
injected_app: The electron program you want to inject
c2: set c2_Public IP and c2_netcat Port
exec node build.js, and then pkg to an execute program
Send to victim, and get electron_shell
I’m betting you have WhatsApp on your phone. Or, if you don’t – I’m quite sure a member of your family would. As the most popular messaging app in the world with 2 billion active monthly users, it’s clearly a favourite for many of us who want to keep in contact with both our Apple and Android friends in a safe and encrypted fashion.
My relationship with WhatsApp was a slow burn. I discovered it a few years back when it became apparent that group messages to a close cluster of girlfriends weren’t being received by my Android pals. WhatsApp solved that problem instantly. But then over several years, I realized it solved quite a few other pesky problems namely expensive and tricky phone calls when travelling overseas and my frustration at not being able to send a message to a large group of people. I became a fan girl!
But it hasn’t always been smooth sailing for WhatsApp users, over the years there have been scams including the 10th birthday scam where users were offered the chance to win 1000GB of free data and most recently the ‘mum and dad’ scam. There was also a wave of controversy in 2021, when new WhatsApp owner, Meta, introduced a new Privacy Policy which had a swathe of users concerned that it would share data with Facebook. Many of us threatened not to sign however if we didn’t – we couldn’t use it! So, we all agreed, somewhat reluctantly in the name of convenience and moved on.
WhatsApp’s default end-to-end encryption sets it apart from other messaging apps and is another one of my favourite features. But what does that actually mean? In short, it means that your messages can only be read on the recipient’s phone. Likewise, video and audio calls can only be answered by the intended receiver. WhatsApp encrypts every message sent on its platform which means the only people who can decode it are the sender and the receiver. WhatsApp can’t access anything you share and nor could a hacker if they were to intercept a message. Love end-to-end encryption!
But this doesn’t mean that there are no risks using WhatsApp. Like all online platforms, staying ahead of the risks is the smartest way of ensuring you have the best experience. And there are several steps you can take to stay ahead of the threats on WhatsApp. Here are my top tips:
Keeping your WhatsApp software up to date is essential as updates will almost always include fixes or ‘patches’ for new vulnerabilities and threats. Why not automate them to ensure that this happens? This means you won’t be at risk if you forget to update the software yourself.
Never ever share personal data or crucial financial information on the app, in case your device ends up in the wrong hands or it becomes infected with spyware or malware. And this goes for any app – keep your personal information nice and tight.
To prevent your device from becoming compromised by malicious software, ensure your device has some super-duper mobile security software. McAfee’s Mobile Security software, available for both iOS and Android, will protect devices of all types from cyberthreats.
As anyone can message anyone on WhatsApp, it’s inevitable you may receive some random or suspicious looking messages. Always err on the side of caution and do not respond to direct messages from people you don’t know. If you receive a promotional offer from a company that is quite tempting, go directly to their website to confirm. Scammers will often send out 1000’s of emails with a tempting offer and link to a malicious website in the hope that someone will ‘bite’. Don’t be caught in a phishing scam!
Enabling 2 factor authentication is one the best ways to secure your WhatsApp account and ensure a hacker can’t download your account on their phone. Without your 6-digit pin number, a hacker can’t get into your account, even if they get their hands on the SMS code they need to activate your account on another device. And it takes 30 seconds to set up!
If you haven’t set up your 6-digit pin, then you are at risk at being ‘socially hacked’. This is how it works: a hacker, who has hijacked one of your friend’s accounts, will message you asking for the 6-digit code that’s just been sent to your account. They will say it’s meant for them. And as you ‘know’ this person, you are likely to send that code straight through without even questioning them. But in fact, the 6-digit code in question has been requested by the hacker for your account, so the minute you share it – you will be immediately locked out! So, never ever share your 6-digit code with anyone. No-one will ever have a legitimate reason to request it.
But please don’t let these risks put you off this fantastic messaging app. I’m a big believer in understanding the challenges so you can prepare yourself, go ahead and enjoy! And I haven’t even touched on some of the more fun aspects of the app – the stickers & the status updates – they can be quite the conversation starter! So go ahead and enjoy but just make sure you’ve done your homework!!
Stay safe everyone!
Alex
The post How To Be Safe On WhatsApp appeared first on McAfee Blog.
This is a Baileys based piece of code that lets you tunnel TCP data through two Whatsapp accounts.
This can be usable in different situations, for example network carriers that give unlimited whatsapp data or airplanes where you also get unlimited social network data.
It's using Baileys since it's a WS based multi-device whatsapp library and therefore could be used in android in the future, using Termux for example.
The idea is to use it with a proxy setup on the server like this: [Client (restricted access) -> Whatsapp -> Server -> Proxy -> Internet]
Apologizes in advance since Javascript it's not one of my primary coding languages :/
Use only for educational purpose.
It sends TCP network packages through WhatsApp text and file messages, depending on the amount of characters it splits them into different text messages or files.
To not get timed out by WhatsApp by default it's limited at 20k characters per message, at the moment it's hardcoded in wasocket.js. I have done multiple tests and anything below that may get you banned for sending too many messages and any above 80k may timeout.
If a network package is over the limit (20k chars by default) it will be sent as a file if enabled. Also if multiple network packages are cached it will use the same cryteria.
File messages are sent as binary files, TCP responses are concatenated with a delimiter and compressed using brotli to reduce data usage.
It caches TCP socket responses to group them and send the maximum amount of data in a message therefore reducing the amount of messages, improving the speed and reducing the probability of getting banned.
Before: (without files and no response caching)
curl -x localhost:12345 https://www.youtube.com
- 50-80 messages
- 30-40 seconds
After: (with files and response caching)
curl -x localhost:12345 https://www.youtube.com
- 6-8 messages
- 7-15 seconds
In case you are not allowed to send files use the --disable-files flag when starting the server and client to disable this functionality.
I got the idea While travelling through South America network data on carriers is usually restricted to not many GBs but WhatsApp is usually unlimited, I tried to create this library since I didn't find any usable at the date.
You must have access to two Whatsapp accounts, one for the server and one for the client. You can forward a local port or use an external proxy.
Clone the repository on your server and install node dependencies.
cd path/to/wa-tunnelnpm installThen you can start the server with the following command where port is the proxy port and host is the proxy host you want to forward. And number is the client WhatsApp number with the country code alltogether and without +.
npm run server host port number
You can use a local proxy server like follows:
npm run server localhost 3128 12345678901
Or you can use a normal proxy server like follows:
npm run server 192.168.0.1 3128 12345678901
Clone the repository on your server and install node dependencies.
cd path/to/wa-tunnelnpm installThen you can start the server with the following command where port is the local port where you will connect and number is the server WhatsApp number with the country code alltogether and without +.
npm run client port number
For example
npm run client 8080 1234567890
The first time you open the script Baileys will ask you to scan the QR code with the whatsapp app, after that the session is saved for later usage.
It may crash, that's normal after that just restart the script and you will have your client/server ready!
Once you have both client and server ready you can test using curl and see the magic happen.
curl -v -x proxyHost:proxyPort https://httpbin.org/ip
With the example commands would be:
curl -v -x localhost:8080 https://httpbin.org/ip
It has been tested also with a normal browser like Firefox, it's slow but can be used.
You can also forward other protocol ports like SSH by setting up the server like this:
npm run server localhost 22 12345678901
And then connect to the server by using in the client:
ssh root@localhost -p 8080
To use on Android, you can use it with Termux using the following commands:
pkg update && pkg upgrade
pkg install git nodejs -y
git clone https://github.com/aleixrodriala/wa-tunnel.git
cd wa-tunnel
npm install
Using this library may get your WhatsApp account banned, use with a temporary number or at your own risk.
It’s important to note that the only time your communications are encrypted is when they’re in transit. They’re otherwise plain as day to see or hear. Thus, anyone who can open your phone can tap the app and access them (provided you don’t lock your phone or the WhatsApp app itself). And like any other message or photo that you send over the internet, nothing prevents the recipient from sharing your message with others by taking a screenshot or simply forwarding a photo to someone else.
With that, no form of messaging is 100% private. Not WhatsApp. Not other messaging apps like it, with or without encryption. If you want to keep something entirely private, whether it’s a photo or a message, don’t send it over the internet.
Generally no, yet understanding the specifics calls for diving into their privacy policy.
Once again, WhatsApp does not view your messages or listen to your calls. It only temporarily stores messages on their servers in the case of a few exceptions. As of April 2023, its policy states:
We do not retain your messages in the ordinary course of providing our Services to you. Instead, your messages are stored on your device and not typically stored on our servers. Once your messages are delivered, they are deleted from our servers.
In some cases, undelivered messages are kept in encrypted form on WhatsApp’s servers for up to 30 days or until the message is delivered. Also, WhatsApp may store media that you forward in a message temporarily in encrypted form on their servers to aid in more efficient delivery of additional forwards.
Facebook (now known as Meta) purchased WhatsApp in 2014. Today, as one of the companies that falls under the Meta umbrella, WhatsApp “[R]eceives information from, and shares information with, the other Meta Companies.” Per WhatsApp’s privacy policy:
WhatsApp must receive or collect some information to operate, provide, improve, understand, customize, support, and market our Services, including when you install, access, or use our Services.
Also per its privacy policy, WhatsApp (and Meta) uses that information:
We use information we have (subject to choices you make and applicable law) to operate, provide, improve, understand, customize, support, and market our Services.
What does WhatsApp collect specifically? That may include location information if you’re using location-based services in the app. It may also include location information even if you aren’t using those services.
In addition to location information, it may also include the following:
Why does WhatsApp collect this information? The company may use it for the “safety, security, and integrity” of the app experience. It may use that information for marketing purposes as well. (Think targeted ads.) Likewise, WhatsApp may share this information with select third parties for the same purposes.
So while WhatsApp may not know what’s in your messages, it potentially knows a great deal about you—like where you are, how you’re using their app, and for how long. And if you have a Facebook account, that may extend to your interests, what ads you’ve clicked on, which ones led to purchase, along with all the other information that Facebook knows about you.
This is the “value exchange” that we talk about in our blogs so often, where you gain the value of using a free app in exchange for something else, typically personal information that is used for marketing purposes. By agreeing to the terms of the user agreement you clicked when you first installed the app, you became a legally binding participant in this exchange.
For starters, you can keep a thief or snoop from getting into your phone altogether by setting a screen lock with a PIN, facial recognition, or gesture lock. Surprisingly, from our recent global research found that only 56% of adults said that they protect their smartphone with some form of a screen lock. If you find yourself among them, consider making a change. Locking your phone offers terrific peace of mind in the event your phone gets lost or stolen.
Additionally, WhatsApp also allows you to create a PIN for accessing the app itself. You can find this setting in Settings > Account > Two-Step verification. With both in place, you can effectively double-lock WhatsApp. As with any PIN, never give it out to anyone. Sharing it could compromise your security.
WhatsApp has a setting that sends a notification in the event your security PIN code changes. If you have the app installed on multiple devices, you will need to enable it on those devices as well for it to work. You can enable this setting in Settings > Account > Security Notifications.
A quick trip to Settings > Privacy can limit what other WhatsApp users see and know about you. In that menu, you’ll see that you have several privacy options:
Setting these to “My Contacts” will prevent the broader WhatsApp user base from seeing this information about you. That includes potential spammers and scammers, thus taking this step can make you more private. So just in the same way we recommend that you set your social media accounts to “friends and family only,” we recommend doing the same here.
Although WhatsApp can determine your location by other means, you can limit it from locating you with pinpoint accuracy by disabling location services for the app.
On an iOS device, you can do that by going into Settings > Privacy & Security > Location Services and then scrolling down until you find WhatsApp. From there, you can disable its permissions with a tap.
For Android, on your phone’s home screen, find the WhatsApp icon, then touch and hold it. Tap “App Info,” then “Permissions” then “Location.” Finally, select “Deny.”
As it is on so many platforms today, scammers abound. WhatsApp is no different, where scammers spin up bogus accounts and attempt to start conversations with other users. The way they go about it varies. They may try to kindle a romance scam, they may masquerade as a business representative, or even pose as a tax collector or other government official. The aim is always the same, though. They want to steal your personal information or trick you into forking over your money. Don’t take chances. Don’t talk to strangers.
Other scammers will send messages with malicious links. Just as you shouldn’t follow links or open files from strangers in other apps, don’t do open them on WhatsApp either. Those links are simply gateways to scam sites and malware.
If you back up your WhatsApp message histories in the cloud with Apple or Google, they are not encrypted. Once again, you can encrypt them while they are in transit by using “End-to-End Encrypted Backup,” but the histories themselves are not encrypted when they are stored in the cloud.
For those who are particularly privacy-conscious, the idea of their messages, plus any attached photos and messages, being stored without encryption may give them pause. Even if that is in a relatively secure cloud service such as Apple’s or Google’s. Yet the risk of data breaches remains, as does the risk of a bad actor gaining access to one’s cloud account, such as through a stolen password.
So, for an increased degree of privacy and security, you may want to consider disabling cloud backup for your WhatsApp messages.
Comprehensive online protection software can protect your phone in the same ways that it protects your laptops and computers. Installing it can protect your privacy, keep you safe from attacks on public Wi-Fi, and automatically block unsafe websites and links (like the ones that might come to you in a spammy WhatsApp message), just to name a few things it can do. In all, given how much of our lives center around our phone—shopping, finances, splitting a dinner bill with friends, and so on, protecting your phone and the things you do on it makes sense.
There’s a good chance you’ve experienced that moment of panic—the moment when you think you’ve really lost your phone, followed by the deep relief when you finally find it. But what happens if your phone ends up getting lost or stolen? A combination of device tracking, device locking, and remote erasing can help protect your phone and the data on it.
Different device manufacturers have different ways of going about it, but the result is the same—you can you’re your phone, prevent others from using it, and even erase it if you’re truly worried that it’s in the wrong hands or simply gone for good. Apple provides iOS users with a step-by-step guide, and Google offers up a guide for Android users as well.
WhatsApp is indeed quite private when it comes to messages and voice communications when they are transmitted between people—yet not so much when it comes to other data that the app collects while you’re using it.
While much of that data collection occurs thanks to the terms of its user agreement and privacy policy, you can take a few steps to limit it to a degree. You can take yet more steps that can make the time you spend on WhatsApp more secure as well.
As with any free app, using it involves some sort of value exchange. Understanding what information the app does and does not collect can help you determine if that value exchange is right for you.
The post How Private is WhatsApp Really? Staying Safer While Using the App. appeared first on McAfee Blog.
The domain name registrar Freenom, whose free domain names have long been a draw for spammers and phishers, has stopped allowing new domain name registrations. The move comes after the Dutch registrar was sued by Meta, which alleges the company ignores abuse complaints about phishing websites while monetizing traffic to those abusive domains.
Freenom’s website features a message saying it is not currently allowing new registrations.
Freenom is the domain name registry service provider for five so-called “country code top level domains” (ccTLDs), including .cf for the Central African Republic; .ga for Gabon; .gq for Equatorial Guinea; .ml for Mali; and .tk for Tokelau.
Freenom has always waived the registration fees for domains in these country-code domains, presumably as a way to encourage users to pay for related services, such as registering a .com or .net domain, for which Freenom does charge a fee.
On March 3, 2023, social media giant Meta sued Freenom in a Northern California court, alleging cybersquatting violations and trademark infringement. The lawsuit also seeks information about the identities of 20 different “John Does” — Freenom customers that Meta says have been particularly active in phishing attacks against Facebook, Instagram, and WhatsApp users.
The lawsuit points to a 2021 study (PDF) on the abuse of domains conducted by Interisle Consulting Group, which discovered that those ccTLDs operated by Freenom made up five of the Top Ten TLDs most abused by phishers.
“The five ccTLDs to which Freenom provides its services are the TLDs of choice for cybercriminals because Freenom provides free domain name registration services and shields its customers’ identity, even after being presented with evidence that the domain names are being used for illegal purposes,” the complaint charges. “Even after receiving notices of infringement or phishing by its customers, Freenom continues to license new infringing domain names to those same customers.”
Meta further alleges that “Freenom has repeatedly failed to take appropriate steps to investigate and respond appropriately to reports of abuse,” and that it monetizes the traffic from infringing domains by reselling them and by adding “parking pages” that redirect visitors to other commercial websites, websites with pornographic content, and websites used for malicious activity like phishing.
Freenom has not yet responded to requests for comment. But attempts to register a domain through the company’s website as of publication time generated an error message that reads:
“Because of technical issues the Freenom application for new registrations is temporarily out-of-order. Please accept our apologies for the inconvenience. We are working on a solution and hope to resume operations shortly. Thank you for your understanding.”
Image: Interisle Consulting Group, Phishing Landscape 2021, Sept. 2021.
Although Freenom is based in The Netherlands, some of its other sister companies named as defendants in the lawsuit are incorporated in the United States.
Meta initially filed this lawsuit in December 2022, but it asked the court to seal the case, which would have restricted public access to court documents in the dispute. That request was denied, and Meta amended and re-filed the lawsuit last week.
According to Meta, this isn’t just a case of another domain name registrar ignoring abuse complaints because it’s bad for business. The lawsuit alleges that the owners of Freenom “are part of a web of companies created to facilitate cybersquatting, all for the benefit of Freenom.”
“On information and belief, one or more of the ccTLD Service Providers, ID Shield, Yoursafe, Freedom Registry, Fintag, Cervesia, VTL, Joost Zuurbier Management Services B.V., and Doe Defendants were created to hide assets, ensure unlawful activity including cybersquatting and phishing goes undetected, and to further the goals of Freenom,” Meta charged.
It remains unclear why Freenom has stopped allowing domain registration. In June 2015, ICANN suspended Freenom’s ability to create new domain names or initiate inbound transfers of domain names for 90 days. According to Meta, the suspension was premised on ICANN’s determination that Freenom “has engaged in a pattern and practice of trafficking in or use of domain names identical or confusingly similar to a trademark or service mark of a third party in which the Registered Name Holder has no rights or legitimate interest.”
A spokesperson for ICANN said the organization has no insight as to why Freenom might have stopped registering domain names. But it said Freenom (d/b/a OpenTLD B.V.) also received formal enforcement notices from ICANN in 2017 and 2020 for violating different obligations.
A copy of the amended complaint against Freenom, et. al, is available here (PDF).
March 8, 6:11 p.m. ET: Updated story with response from ICANN. Corrected attribution of the domain abuse report.
