“Securing a computer system has traditionally been a battle of wits: the penetrator tries to find the holes, and the designer tries to close them” — Gosser

The reason behind memory extortion is due to poor programming. Security should always be first and not the last. It is always advisable to apply threat in design phase of SSDLC cycle. (Check out Secure coding Practice for further details). Let me explain how buffer works.

Char SampleBuffer [10]=”Sharmila”

This will be allocated as the below:

Note: Index starts from 0 (zero)

This is how the basic buffer works. In order to understand buffer overflow, you should posses good knowledge about C, C++ language. C and C++ are pretty much vulnerable to Buffer Overflow attack!!!

Strcpy(Samplebuffer,”SHARMILAROCKS”);

The strcpy — this simply copies all the CHARACTERS from the STRING — does not check the size of the data before storing it in the buffer.

“Better be despised for too anxious apprehensions, than ruined by too confident security.” — Edmund Burke

A function like gets (), sprint (), strcat (), strcpy() does not inspect the size before loading into the buffer.Since the above functions doesn’t check the size of the input, the attackers take great advantage of these functions by loading too many characters at A Memory Location (same memory location) — causing Buffer Overflow Attacks.

It ain’t what you don’t know that gets you into trouble. It’s what you know for sure that just ain’t so. — Mark Twain

Keep exploring more from other security researchers..

Reference

Quotes: http://www.nativeintelligence.com/ni-free/itsec-quips.asp

What is Buffer Overflow? was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

Let’s start — Nmap is a guessing tool. When we do penetration testing, we are trying to gather information about the target by sending specially crafted packets. The results may not be accurate or it can even lead to false information. So, you need to make sure you use different scanning techniques in order to come a conclusion. In this post, I am gonna explore about couple of unique scanning techniques.

IP Protocol Scan — This is not really a port scan — but pretty much a unique scan. When you are a fresher in penetration testing and if you are not able to come to a conclusion from analyzing the response from the target system — I would recommend IP Protocol scan. This scan widely scans the remote target station for further protocols, example EGP, BGP,OSPF,EIGRP. As you discover more protocols, you can finally come to a stable conclusion. Whether the target/victim is a computer or a scanner or a printer etc :)

If you observe the result, you can clearly identify the uniqueness of IP Protocol Scan — this scan gives you way to additional Protocol information.

ACK SCAN

Three way handshake :

We can see the first flag in a handshake is SYN, the receiver then acknowledges the SYN by sending an ACK flag- but if you straight away send an ACK flag it doesn’t make any sense!! Now nmap takes advantage of this process by sending an ACK packet to see whether the targets firewall is STATEFULL/STATELESS.

• If the response from the target is rst — nmap comes to a conclusion that the target system is not firewalled. In an sateless firewall the open and closed ports both will send a RST packet. You wouldn’t know whether they r opened/closed — but u can be for sure that the victim in unfiltered!!!
• At the other hand — The Statefull firewall will simply ignore the ACK flag by NOT RESPONDING!!! In some cases the target system does respond with ICMP error messages. So, now u come to a conclusion that the target is protected by a firewall.
• Its quiet basic- If your firewall is configured with proper logic it should be able to ignore the ACK. Why should someone send a ACK flag without SYN??

From the above two scans, I believe you would have got some idea about the importance of different scaring techniques in NMAP.I am not going to elaborate on every scan. Please check this link to know more about nmap scanning techniques- http://nmap.org/book/man-port-scanning-techniques.html “Thanks to Fyodor!!!”

Reference

Port Scanning Techniques | Nmap Network Scanning

Importance of various nmap scanning technique!!! was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

In order for two computers to talk to each other successfully, they need to have a formal introduction/handshake. In terms of networks we call them as “Three way handshake via TCP/IP”.

Three Way Handshake

1.) Computer X wants to communicate with Computer Y. So Computer X initiates a connection by sending a SYN packet.

Note:TCP/IP needs acknowledgement for every packet — its a full duplex protocol.

2.) Computer Y sends a syn request along with acknowledging the SYN request of Computer X

3.) Computer X acknowledges the SYN request of computer Y.

4.) Handshake is Complete. Now Computer X and Y can talk to each other.

The secure connection is established. In order for any two computers to communicate SECURELY with each other, they need to do TCP/IP handshake. Now, lets see how hackers exploit this handshake.

• A simple Firewall does allow SYN packet into the network
• Hacker sends a SYN request — and Initiates a connection.
• Target(Scapegoat) thinks that the SYN is genuine and as per the TCP/IP handshake it sends back syn/ack and awaits for the Hacker’s respond (ack packet)
• Hacker leaves the handshake half/open
• Meanwhile target allocates some memory for the half open connection
• Server is supposed to wait for few milliseconds to receive the ACK packet.
• Hackers take full advantage of this waiting time and floods the Target with SYN packet with SPOOFED IP ADDRESS.
• Server can’t block the Hacker, because he makes use of spoofed Ip address — that means every SYN packet originates from a different IP Address.
• Since TCP/IP is full duplex, the Target tries to respond back for every packet from the hacker
• Server gets tired and exhausted……… and finally server stops responding!!!
• NOW,The authentic users will not be able to use the resource.
• SYN flood is a kind of a DOS attack.

Major Drawback Of SYN FLOOD

• Since the hacker uses spoofed Ip Address, it is IMPOSSIBLE for the firewall to completely block the flood attack

Countermeasures

• One of the best countermeasure is DO NOT allocate large memory for FIRST PACKET (SYN)
• Allocate tenny-wenny memory for the approaching SYN packet
• Allocate memory ONLY after you receive ACK Packet(4th Packet) from the sender
• One of the Good Solution is — make use of Proxy Server

Reference

SYN flood - Wikipedia

SYN Flood and Countermeasures was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

Reverse engineering doesn’t work always. In terms of cryptography — if you can try and brute force every possible combinations — you might crack the password. But it is a long process.

Rainbow Tables — A rainbow table is a precomputed table for reversing cryptographic hash functions, usually for cracking password hashes. (ref:http://en.wikipedia.org/wiki/Rainbow_table)

From the above definition,it is clear that the hashes can be cracked.There is a great necessity to apply defense in depth. So, the security experts came up with a concept called salt. To learn more about salt, please refer my other post — click here. I assume that you know the basic concept of salt. I am gonna show you a real time example of cracking the hashes.Before I get into practicals, just wanna make sure you understand few things :)

Things to know

• passwd — is a tool in Unix-Like OS, used to change the password.
• etc/shadow — This contains, password hashes of the system users
• JTR — Password Security Testing Tool/ Password Assessment Tool (Attack: Dictionary Attack — A text file which consists of lots of words from Dictionary). Biggest drawbacks of JTR is — it displays the cracked password in lowercase ONLY.

System Requirements

• Backtrack, Kali

Step 1: Learn how passwd command works:

Step 2: Copy etc/shadow file

Step 3: To learn more about JTR - check my other post. Click here.

If the bad guys get access to the hash file, they will try all their stunts to reverse/match the hashes. Salt is a layer of security for hashes.

Hope you understood the importance of salt :)

The ONLY OPTION to TRUIMP over RAINBOW TABLES is to do PASSWORD SALTING.

Windows does NOT do SALTING. Windows SAM file is nothing but HASH at the other hand they use SYSKEY to encrypt the SAM file (Of course! It is a minimal security) BUT Salting would be defense in depth.

Reference

Rainbow table - Wikipedia

Important of Salt in Cryptography!!! was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

PKI -Things to remember:

• It makes use of two keys — Public and Private Key (Asymmetric Encryption) Click here to learn more about Encryption Methods
• RSA Algorithm — is used for generating unique public and private key pairs. Click here to learn more about RSA Algorithm
• Explanation:
• Public and Private keys are pretty much unique for every pair
• Public and Private key are derived from a set of Prime Numbers
• RSA algorithm has been in the market for ages — due to its strong security features.
• Just because you have the knowledge of Public key doesn’t mean that you can derive private key from it. NOPE.
• In order to encrypt or decrypt, the corresponding Public and Private key must be used. (They are unique and tightly coupled)
• It is nearly impossible to factorize the prime numbers — thus leaves the algorithm intact.
• Even the best of mathematicians struggle to factorize the Prime Numbers
• PKI is NOT a encryption technology BUT a FRAMEWORK kind of thing, you can selectively choose what you want from the framework and modify according to your requirements.
• CONFIDENTIALITY: Making sure whatever you do is confidential and no one knows exactly what you are upto except the recipient — Encryption methodologies are used.
• AUTHENTICATION: To authenticate or to identify an user/organization — Digital Certificates are used.
• Explained with an example: In order for Jack and Jill to communicate securely, they need to encrypt their clear text data.

Let’s learn more about PKI with an illustration :)

• Jack needs Jill’s public key for encrypting. Jill gives away her public key.
• Now, Jack makes use of Jill’s public key and starts communicating. As we are aware that no one will be able to read the message except Jill.
• Jill uses her private key to read the messages… Happy Ending.
• This is Asymmetric Encryption :)

Critical Thinking 1:

• Let’s assume, that a girl named Kezi is impersonating as Jill. She claims to Jack that she is Jill (Kezi got hold of Jill’s Private and Public key). If Jack is not smart, he will blindly believe that Kezi is Jill and begin his conversation with her. Confidentiality is lost.

Critical Thinking 2:

“Data spills provide no thrills (unless you’re the bad guy).”

• Jack suspects that his connection has been breached.
• He wants to make sure that he is communicating with Jill and not with any one else.
• “Authentication” comes into play now.
• He needs to authenticate Jill’s public Key and her identity. How can he do that???
• We have someone called CA — certification Authority. To learn more about Digital Certificate click here.
• All the Digital Certificates are stored in CA server.
• When requested, CA shares the digital signature with the client.
• Jill has already registered and she does have a valid Digital Certificate from the CA.
• Jack being smart sends a request to CA, asking for Jill’s public key and her identity. CA has all the relevant information about Jill, thereby he provides Jack with the valid information.
• Jack now knows the owner of the certificate, the Issuer and the public key. He is completely satisfied and he is now all set to communicate with Jill. Even if Kezi impersonate to be Jill, Jack can very well figure it out by checking with the CA.

• Jack requests CA for Jill’s Digital Certificate
• CA sends back Jill’s Digital Certificate
• Jack and Jill starts communicating securely.

REAL WORLD:

“Don’t be Quick to Click… be wary when you shop online.”

“The site’s security certificate is not trusted” is the error thrown by your browser when it acknowledges a FAKE certificate or certificates which your browser doesn’t recognize or at the least case the certificate provided by the web server might not be signed by a legitimate/recognized CA. In all the three cases, your browser throws the below error.

When you get the below error, be hyper-cautiuos. Do not proceed.

“If you suspect deceit, hit DELETE”

Original Digital Certificate contains the below:

1.) The Issuer Name — Example : DigiCert High Assurance, VeriSign

2.) The Subject Name — Example: Facebook.com, Ebay.com

3.) Public Key, Public Key Algorithm

Note: Click at the padlock to learn more about your certificates :)

Hope it helps :)

Excuse me for my diagrams.

References

Slogans in inverted commas : http://www.nativeintelligence.com/ni-free/awareness-slogans.asp

RSA algorithm - Simple English Wikipedia, the free encyclopedia

PKI — Public Key Infrastructure was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

For Example — If a secret security agency wants to send a hard disk- which contains critical/hypersensitive information to the government, they would prefer encrypting the hard disk before sending it. A FULL DISK ENCRYPTION rather than file encryptions. If the disk gets hijacked/swiped/snatched, the data will not be compromised — because the Disk will be protected by a password or a key. Disk encryption is done for the FULL DISK — for every single bit ( 0’s and 1's). The entire file system will be encrypted including the free space in the hard disk — thus disk encryption helps to preserve the confidentiality and integrity of the data (In the Hard Disk).

Learn more about Disk Encryption Tools from this forum. Click here.

Note: If you lose/forget the password, I am sorry you will not be able to decrypt the hard disk. You have been warned.

Reference

Best way to do full disk encryption?

Is Disk Encryption important? was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

We all are aware that software companies hold our secret keys (Encryption/Decryption Keys) and they do promise to keep our personal and hypersensitive information safe from hackers.

What is Key Escrow?

The secret key that is owned by software companies will be shared with government/government authorities for national security reasons. Government makes a covenant to the software companies that they will NEVER use the key until and unless they have an investigation warrant.Key Escrow(Government Access Key) are essentially very important for national security.

People do argue that Key Escrow or Government Access Key are privacy breach, but I do strongly believe that the out come of Key Escrow can prevent/stop atrocities in our nation.

“Key disclosure laws, also known as mandatory key disclosure, is legislation that requires individuals to surrender cryptographic keys to law enforcement. The purpose is to allow access to material for confiscation or digital forensics purposes and use it either as evidence in a court of law or to enforce national security interests.” — http://en.wikipedia.org/wiki/Key_disclosure_law

Reference

• Key escrow - Wikipedia
• Key disclosure law - Wikipedia

Key Escrow was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

Lets talk about Computer Forensics. Chiefly, you must be clear that Forensics is a SCIENCE. Don’t get confused with other terms. It is a SCIENCE. Period.

I am gonna try and explain the importance of the subject with a case study (solved litigation) — “It’s a murder case”. Primarily, as a Computer Forensics Examiner — do remember that any file that has been deleted from the Computer/Hard Disk is NOT deleted permanently. A skilled forensics examiner will be able to recapture all the files using forensic practice (Programming and Forensic Tools).

“William McGuire Murder”

Melanie McGuire and William was married for 5 years, they had two children. Melanie worked in a fertility clinic and her husband was a computer programmer. Melanie cheated on her husband — she has been having an affair with her co-worker Mr. Miler for ages. Eventually she did kill her husband for her long-time lover Mr. Miller. Let’s see how computer forensics helped the judge to solve the murder case.

In the murder case, forensics experts was given admission to perform forensic examination on the HOME COMPUTER of Mr. William McGuire. Police did receive an SEARCH WARRANT to investigate on the computer from Melanie’s advocate. The forensic examiner was trying to extract deleted files and folders. In the process of finding juicy information and evidences, they noticed that someone from the house was doing an extensive search IN GOOGLE about UNDETECTABLE POISONS, HOW TO COMMIT A MURDER, and HOW TO BUY A GUN IN PENNSYLVANIA. In meantime Melanie sent a private e-mail to her friend asking where she can purchase a gun in Pennsylvania. Then she did an Internet research about GUN STORES. Eventually she did buy a gun and bullets in a store in Pennsylvania, and the same bullets were found in her husband’s body. With the help of Computer forensics techniques, the examiners were able to prove that Mr. William’s death was NOT an MISHAP but a prospective manslaughter. Finally, Melanie McGuire was charged with guilty of murder. Computer forensics played an indispensable part in Mr. William’s murder case. Without forensics, Melanie would have escaped criminal charges because she arranged everything possible to camouflage/cover-up al the sign, clue and information.

I hope you guys got a clear idea about Computer Forensics, in my next post — I will explain Computer Forensics in technical terms.

Reference

• elwoodforensics - What are some cases solved by Computer Forensics?
• Melanie McGuire - Wikipedia

http://www.investigationdiscovery.com/tv-shows/solved/videos/solved-computer-forensics.htm

Computer Forensics!? was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

Digital Signature is an approach to safeguard the electronic documents which is exchanged between two parties. Making sure that the electronic documents like e-mails, ppt, word files, web applications etc is original/legitimate/accurate. This means, you know who sent it likewise you are sure that the original content is not altered or modified(authentication and non-repudiation).

“A right to not have your data rise up and attack you.” — Benjamin Wittes, Brookings Institution

Digital Signature are given lawful recognition, if the original data is manipulated or modified — you can file a trail (accusation/proceedings).

Now, in technical term: A digital signature is a encrypted version of a message digest, adhered to the original message. To be meticulous we HAVE to encrypt the hash function itself with the senders private key.

Let me explain this with an example: I am going to draw few pics for better understanding :)

Reference

Security Quotes | Native Intelligence

Digital Signature was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.

In this post, we will be discussing about Digital Certificates. First and foremost, let me clarify a misunderstanding between Digital Signature and Digital Certificate.

Digital Signature is an approach to safeguard the electronic documents which is exchanged between two parties. Making sure that the electronic document like e-mails, ppt, word files etc is original/legitimate/accurate. This means, you know who sent it likewise you are sure that the original content is not altered or modified.

Digital Certificates: Let me explain this with an example.

We all are found of on-line banking. What will happen if you provide your password to a deceptive/illegitimate website which looks and feels like a legitimate website (A banking website)? Eventually your credentials will be compromised and at the other hand you lose your money. In this case, we need someone who can give us a green signal screaming out loud “Okay, come on use this website — you can give your passwords and your bank account details, for we have verified the Web Server and they are who they counterclaim to be”. This middle man is called CA — Certificate Authority which helps to build a trustworthy bond between two strange computers. CA confirms the identity of each other and helps them to exchange their public keys for authentication. CA is a body which is permitted/authorized to approve/give out digital certificate. Click here to view the list of CA in USA. CA is the third party but it is very essential part in security, CA is the ONLY ONE who is permitted to build a secure contact between the proprietor of the Certificate and the person who completely entrusts on the certificate.

“The mantra of any good security engineer is: ‘Security is a not a product, but a process.’ It’s more than designing strong cryptography into a system; it’s designing the entire system such that all security measures, including cryptography, work together.” — Bruce Schneier

How is Digital Certificates implemented?

The public key encryption is used in DSA — that is Digital Signature Algorithm. The DSA inhere private key, which is known only by the author/maker of the document and will know the public key as well.CA certifies the proprietary rights of the public key. In my next post — I will briefly explain about PKI (Public Key Infrastructure)

Now, let me put it in clear words. A digital Certificate is an electronic format of personal certificate/server certificates.

Examples: Driver’s License, Passports, Web Server Certificates.

Reference

http://www.sos.ca.gov/digsig/

Certificate authority - Wikipedia

QUOTES : http://infosecphils.wordpress.com/infosec-quotes/

Digital Certificates was originally published in itsallaboutsecurity on Medium, where people are continuing the conversation by highlighting and responding to this story.