infySEC - Ethical Hacking India | Ethical Hacking Tamil Nadu Chennai | website security Testing | Information Security | Training | Learn Ethical Hacking | Online | Course | Compliance | Consulting | Workshop | penetration testing | website security

This blog is all about a small UK site that faltered in password security made US Banks to sink under DDoS attacks.   

Thanks to Incapsula security firm for the revelations.  The administrative password that manages a tiny   UK site quickly subject to exploits by Botnet who were in outside of Turkey and a barrage of traffic storms American banks.  The reason for this  strong current of  DDoS attacks   aiming   major U.S. banks  currently  by  Izz ad-Din al-Qassam, a hacker group is that it is a  tit for tat  for  tarnishing the image of Prophet Muhammad by an anti-Islam video  as well as a constituent  of the  present “Operation Ababil.”  Incapsula security team burn midnight oil to expose one of the furtive at the back of the onslaught is the  compromised general-interest UK-based website that attempts to throw  huge mass of junk traffic at three of the world's leading financial institutions such asPNC, HSBC and Fifth Third Bank.  The disruption due to attacks made this website at the centre of attraction unveils many security events.  It is all because of many requests with encoded PHP code payload came into being.  Incapsula  intervene these requests and tracks it to a backdoor shell that was in application to capture the site.  The security flaw came to the forefront and it the entire administrative password being admin / admin.  The security team could obviously recognize them as DDoS attack through decode of the inward PHP requests commands, instigate from a Turkish web design company website took the role of a remote Botnet C&C.  The Turkish website dons the role of an extra buffer between the actual hacker and U.S. origin banks as their targets.  The UK website function in shifts” to create HTTP and UDP flood attacks . As Incapsula team did prevent as well as watched incoming DDoS commands during which the list of targets includes e-commerce and commercial websites of other countries along with American banks.

Incapsula Security Analyst, Ronen Atias in his final words said: “This is a good example of how we are all just a part of a shared ecosystem where website security should be a shared goal and a shared responsibility.”  Here in such a scenario, ideally an ethical hacking consultant forewarn such DDoS attacks through their web security services.  Such a service offer with infySEC, the ethical hacking firm is notable for its good coverage of all types of web attacks ( http://www.infysec.com/services/security-and-defense/website-security) . Here I complete and back soon with more cyber news.

Cyber expert’s prediction on Wales as a safe haven for giants like Apple and Microsoft to invest forms the crux of the blog.

Wales has a real chance to become an international leader in cyber security and win investment from industry giants such as Apple and Microsoft are the expert claims.  David Taylor, a former Wales Office special advisor made up to qualify in internet threats at the Massachusetts Institute of Technology is one among the said experts.  His interview to the media evokes many thoughts that reflect the opportunity for Wales to put on a competitive advantage at a time when governments stress to the brim by online perils.

            In the words of David Taylor: “We could in a short space of time become the most cyber-educated country in the world.”The Westminster defence committee skeptical on the on armed forces relay are on information technology that their capability to operate could be “fatally compromised” by a continued cyber attack.  The capacity of Government to deal with cyber attack itself needs a review as the threats form at a speed beyond comprehension.  Mr. Taylor, at present don the cap of  a director at Cardiff-based Westgate Cyber Security, is on the assignment to assist business and public sector bodies to assimilate and face dangers and he ends with a note that “It is highly significant that the defence select committee recognize cyber security as an increasingly central part of national defence. This is a timely warning from MPs that cyber needs to be at the heart of Britain’s and NATO’s defence strategies.“  The threats and the challenges are real – emerging powers are investing massively in their offensive and defensive capacities. In the 19th century the key to global power was a strong navy, in the 20th it was air power that came to predominate, while in the 21st it looks more and more likely that the key defensive capacity will be the battle of the bits and bytes.”  However, he sees opening as well as risk for Wales, and wants governments to invest in knowledge.  His claim that 90% of cyber crimes occur due to individual’s error and that the precise training can offer people in business and government with important skills.  A standing for safety will, he argues, will assist Wales to struggle against other countries to divert the investment.  Here it is appropriate to quote the initiative shown by infySEC to train the needy in Information Technology through their “Spark the Rise” project (http://www.sparktherise.com/projectdetails.php?pId=8869 ) which has gained support through more than 16000 votes.  I take a respite and will be back with more cyber news soon.

Networks are open books nowadays as someone or other can poach and probe it.  This blog gives a bird’s eye view of it and its remedies.

Such a probing or poaching is all for a steal but not only for it.  It may be for a store of illegal content or a defacement of the website or last but not the least for a heck of it.  The said tasks are becoming easier day-by-day simple all with tailored made tool done in a programmed manner.  It is all about network scanners, hackers use with ease to assess networks around the globe since a network scanner is one of the simple and effective one to poach.  Therefore, the tool is of a great use o a network administrator as he can be on a hackers shoe and note the vulnerability and plug the holes o keep the hackers at bay.  Network scanners do programmed tests of systems over the network.  The beauty of it is the absence of their requirement of any other software for insertion on the “target” machines.  The network scanner attempts to reach the target system with the help of on what available for it over the network.  Therefore, the checklists to do of the network scanner to be safe and secure before the hacker cracks our networks.  

1.Make an inventory of your Vulnerabilities:  

Vulnerabilities continue and network scanners are capable to utilize databases of recognized vulnerabilities to verify that if any of it there will endanger your systems.  Therefore, it is an advice to make it up to date that database on a regular basis since novel vulnerabilities peep in often.

2. Scan the ports:

 The type of systems that run in the network is best assess able with speed through a port scanner.  Next step is to   take a decision of what should be accessible for the network from the Internet.  When the requirements are shortlisted, validation of that with a port scanner completes the task.  Now supplement it with a mix of firewall rule cleanup and system hardening to close down anything that does not fit in.:

3. Never Passwords be as default ones:

 The Internet has an inventory of thousands of default password lists for the poachers to poach in.  Be alert to choose a tough password for the network that is not in ease to decipher by attackers and unauthorized access is stifled.

4. Running services

 Services are essentials in every server as well as pathway to compromise it.  However, unnecessary services run as default by oversight or ignorance of admin.  Such services   are  brought out with the run of network scanner  and then  culled  .

5. Remote access

Experts say that on their experience on default passwords, remote access software are the black sheep that, run on systems enable clandestine entries.  Telnet, SSH, RDP, GoToMyPC, LogMeIn, PCAnywhere and other applications can be traced with the use  of  network scanner and closure of not required  ones are must to reduce the risks to networks.

All the said five critical checks need to be there in a regular way    with a network scanner go a long way for a foolproof network.  A scan from external to visualize on threats that over power firewall and scan from the internal network to find inside threats along with the harms caused are necessary. Simulating the way attacker work will make sure no stones are unturned in a security mock exercise done by the net work administrator.  Knowing your systems the way an attacker will, helps you to ensure everything is safe.  The firms with network administrator bogged with multiple functions can very well hire ethical hacking consultant.  Few have expertise like infySEC , leading ethical hacking firm, protecting client networks and their services in information systems audit in this link (http://www.infysec.com/services/controls-and-assurance/information-systems-audit) show it all.  I give a small break to my grey matter and will be back with more cyber news.

The European Union (EU) has a good start in the cyber crimeons front and this blog tells all about it.

The first and foremost initiative is the open of European Cyber crime Center (EC3).The center will be a hub to monitor online fraud, Internet predators who sexually exploit children, and hackers.  It is ideally located inside the headquarters of Europol, the European Criminal Intelligence Agency.  The Director of Europol and the Head of the European Cyber crime Center (EC3) opened the EC3 on 11 January 2013 at Europol’s headquarters in The Hague, The Netherlands.  EC3 will cater to the growing needs for containing cyber crime coupled with a speedy response to the  online crime thereby curtail its spread.  It will extend its support to the Member States and the European Union’s institutions to develop operational and diagnostic capacity for investigations and collaboration with international partners.  When ethical hacking firms like infySEC have a base at London,U. K, such center will certainly have a respite.  The reason being, infySEC has a host of services (http://www.infysec.com/services) to safeguard the public from internet frauds  as well as  corporate social responsibility efforts  to educate them in Information Technology and one of such effort done in India is seen in this link                                              (http://www.sparktherise.com/projectdetails.php?pId=8869). The said effort is getting an excellent support so from clients, vendors, students, and friends numbering so far  more 16800 and as day passes it is increasing.

EC3 kick starts its operations with a three mandates in their cards.

  To engage in curb of cyber crime in areas like:

1) Online fraud by the handwork of organized groups to make large criminal profits

2) Activities that which causes grave destruction to the victim such as online child sexual exploitation

3) Acts that sabotage critical infrastructure and information systems in the EU

The EC3 Expo had a mixed audience comprising analysts and specialists who made speeches on the activities of the European Cyber crime Center.  Grzegorz Mazurkiewicz, an EU expert in cyber crime comments bring out the importance of the EC 3 “The European Union is the largest market for payment cards transactions, and it is estimated that organized crime groups derive from payment card fraud 1.5 billion euro a year.”  The European Commission proposal for the new center given in March 2012 has reached the fruition and a solution to deal with cross-border crime has finally arrived.  The EU executive supposes that this harmonized approach will see more internet criminals put behind bars.  Troels Oerting, head of the European Cyber crime Center ends “We will be able to give an overview to the Member States on crime; we will give operational support to cases, give forensic support and we will also help the Member States with capacity building and outreach,”  I take a break only to outreach for more cyber news.