Dynamic Port Scanning

Dynamic Port Scanning is a new methodology that aims to dynamically spoof the source IP of the scanning machine. What is meant by “dynamic spoofing” is that each TCP or UDP scan packet has a randomly generated IP address. However, that IP address
must fall within the local subnet IP range of the scanning machine. The underlying implementation of such methodology is solely dependent on the integration of ARP
poisoning/spoofing into the scanning process.
    ARP poisoning/spoofing has been in place since the creation of TCP/IP protocols. It has been known and used for network traffic sniffing and interception in switched
network. However, this paper will show how ARP poisoning/spoofing could be used in conjunction with port scanning to achieve the dynamic way of spoofing the source IP of the scanning machine.
    In general, Dynamic Port Scanning [DPS] is implemented by ensuring that the ARP cache of the target host or even the default gateway is poisoned by fake IP/MAC entry which allows scan reply packets to carry the MAC address of the scanning machine. Although the reply packet is destined to a fake IP address (i.e. the spoofed IP), the
placement of scanner’s MAC address as destination MAC address in the reply packet enables that packet to arrive correctly at the scanning machine. The process of poisoning the remote ARP cache is done for each TCP/UDP scan packet that carries a spoofed IP
address.
   This paper will discuss deeply the process of Dynamic Port Scanning [DPS]. First, the paper examines current methodologies used in spoofing the source IP while scanning. Then, it will describe the new methodology along with TCP scan types. Finally, a new open-source tool called Dynamic Port Scanner [DPS], which does exactly the technique described in this paper, is outlined.

Malware Detection Techniques

Techniques used for malware detection classified into two categories:
1)Anomaly based detection
                                            An anomaly based detection techniques uses the knowledge of what is considered as normal to find out what actually is malicious.a special type of anomaly based detection is Specification based detection.
Specification based detection makes use of certain rule set of what is considered as normal in order to decide the maliciousness of the program violating the predefined  rule set.This program violating the rule set are consider as malicious program.Or it is considered as malicious to finds out maliciousness of the program under inspection.

2)Signature based detection
Commercial antivirus scanner look for signature which are typically a sequence of bytes within the malware code to declare that the program scanned is malicious in nature.
Basically there are three type of malware: Basic,Polymorphic,Metamorphic malware
  a) Basic malware
In basic malware the program entry is changed such that control is transferred to malicious payload.
Detection is relatively if the signature can be found for the viral code.
                                Entry ---------> Original code ---------> Malicious code


  b) Polymorphic malware 
Polymorphic viruses mutates while keeping the original code intact. A polymorphic malware consists of encrypted malicious code along with the decryption module. To enable the polymorphic      virus the virus has got polymorphic engine somewhere in the virus body.The polymorphic engine generates new mutants each time it is executed.Strong static analysis based on API sequencing is used for polymorphic virus detection.

          Entry --------> Original code --------> Decrypt code --------> Virus code


  c) Metamorphic malware
this malware can reprogram itself using certain obfuscation techniques so that the children never look like the parents.such malware evade the detection's from he malware detector since each new variant generated will have different signature, hence it is impossible to store the signature of multiple variants of same malware sample.In order to thwart detection a metamorphic engine has to be implemented with some sort of disassemble in order to parse the input code. After disassembly, the engine willl transform the program code and will produced new code that will retain its functionality and would still look different from the original code.

                   Virus                    Form                    Form                     Form
                     A                           B                      C                            D      
                      |                             |                      |                             |
                      |                             |                      |                             |
                   (S1 )                       (S2)                     (S3)                       (S4)

Worm

Viruses Are far from The only maverick programs that can disrupt a computer system.Worms are constructed to infiltrate  legitimate data processing programs and alter or destroy  the data. Often what  people believe is a virus infection is, in fact , a worm program. This is not as serious because worms do not replicate themselves.But the damage caused by a worm attack can be just as serious as a virus, especially if not discovered in time. For ex. suppose a worm program instructs a bank's computer to transfer funds to an illicit account.The fund transfers may continue even after the worm is destroyed.However, once the worm invasion is discovered , recovery is much  easier because there is only single copy of worm program to destroy since the replicating ability of the virus is absent .A worm is similar to a benign tumor while a virus is like a malignant one.

How Secure Should My Linux Be?

Security is process,not a permanent state. once you've taken the initial steps to secure your box,you must engage   in regular maintenance to ensure that box continue to remain secure. To ensure continue security,regular do the following:

> Keep current with patches:- Keep current with your distribution's security updates and patch on a regular basis.

>Monitor Log files:- Logfiles should be monitored regularly for anomalous events. Monitoring with automated tools is acceptable provided you do a regularly manual audit of log files as well.

>Audit password strength:- Run a password auditing tool such as jhon ripper every month or so to check for insecure password.

>Check your binaries:- Regularly scan your system for trojaned or otherwise altered binaries using both an integrity checker ,and trojan scanner.

>Check for remote vulnerability:- Periodically run a current vulnerability scanner against your machine from another box, preferably one outside of your firewall.

Protecting The Registry

All the initialization and configuration information used by windows NT is stored in the registry .
Normally ,the keys in the registry are changed indirectly, through the administrative tools such as the control panel. This method is recommended. The registry can be altered directly, with the Registry Editor. Some keys can be altered in no other way.

The Registry Editor supports remote access to the Windows NT registry.To restrict network access to the registry,use the registry Editor to create the following registry key:
Hive: HKEL_LOCAL_MACHINE
Key:\CurrentcontroleSet\Control\SecurePipeServers
Name:\winreg

The security permission set on this key define witch users or group can connect to the system for remote access. the default Windows NT Workstation installation does not define this key and does not restrict remote access to the registry .Windows NT Server permits only administrators remote access to the registry.

Legancy system

With Windows 95,Windows 98,Windows Me and windows NT,administrators can use a special file to be merged into the registry, called a policy file (POLICY>POL).The Policy file allows administrators to prevent non-administrator users from changing registry setting like ,for instance,the security level of Internet Explorer and the desktop wallpaper.the policy file is used in business with large no.of computers where the business needs to be protected from careless users.

The default extension for the policy file is .POL. The policy file filters the setting it enforces by user and by group(a "group"is a defined set of users). To do that policy file merges into the registry,preventing users from circumventing  it by simply changing back the setting. The policy file is usually distributed through a LAN,but can be placed on the local computer.

The policy file is created by a free tool by Microsoft that goes by the file name poledit.exe for Windows 95/98 and with a computer management  module for NT-based system.The editor requires administrative
permissions to be run on system that use permission.The editor can also directly change the current registry setting of the local computer and if the remote registry service is installed and started on another computer it can also change the registry on that computer.

The policy editor loads the setting it can change from .ADM files, of which one is included, that contains the setting the Windows shell provides. The .ADM file is plain txt and supports easy localization by allowing all the strings to be stored in one placed.

Cyber Forensic

Cyber forensics can be defined as the process of extracting information and data from computer storage media and guaranteeing its accuracy and reliability. The challenge of course is actually finding this data, collecting it, preserving it, and presenting it in a manner acceptable in a court of law.
Electronic evidence is fragile and can easily be modified. Additionally, cyber thieves, criminals, dishonest and even honest employees hide, wipe, disguise, cloak, encrypt and destroy evidence from storage media using a variety of freeware, shareware and commercially available utility programs.
A global dependency on technology combined with the expanding presence of the Internet as a key and strategic resource requires that corporate assets are well protected and safeguarded.
When those assets come under attack, or are misused, infosecurity professionals must be able to gather electronic evidence of such misuse and utilize that evidence to bring to justice those who misuse the technology.
Cyber forensics, while firmly established as both an art as well as a science, is at its infancy. With technology evolving, mutating, and changing at such a rapid pace, the rules governing the application of cyber forensics to the fields of auditing, security, and law enforcement are changing as well. Almost daily, new techniques and procedures, are designed to provide infosecurity professionals a better means of finding electronic evidence, collecting it, preserving it, and presenting it to client management for potential use in the prosecution of cyber criminals