How Does Secure Sockets Layer (SSL) Works?.

Secure Sockets Layer (SSL) is the most widely used technology for providing a secure communication between the web client and the web server. Most of us are familiar with many sites such as Gmail, Yahoo etc. using https protocol in their login pages. When we see this, we may wonder what’s the difference between http and https. In simple words HTTP protocol is used for standard communication between the Web server and the client. HTTPS is used for a SECURE communication.

What exactly is Secure Communication ?

Suppose there exists two communication parties A (client) and B (server).

Working of HTTP

When A sends a message to B, the message is sent as a plain text in an unencrypted manner. This is acceptable in normal situations where the messages exchanged are not confidential. But imagine a situation where A sends a PASSWORD to B. In this case, the password is also sent as a plain text. This has a serious security problem because, if an intruder (hacker) can gain unauthorised access to the ongoing communication between Aand B , he can see the PASSWORDS since they remain unencrypted. This scenario is illustrated using the following figure

Now lets see the working of HTTPS

When A sends a PASSWORD (say “mypass“) to B, the message is sent in an encrypted format. The encrypted message is decrypted on B‘s side. So even if the Hacker gains an unauthorised access to the ongoing communication between A and B he gets only the encrypted password (“xz54p6kd“) and not the original password. This is shown below

How is HTTPS implemented ?

HTTPS is implemented using Secure Sockets Layer (SSL). A website can implement HTTPS by purchasing an SSL Certificate. Secure Sockets Layer (SSL) technology protects a Web site and makes it easy for the Web site visitors to trust it. It has the following uses

1. An SSL Certificate enables encryption of sensitive information during online transactions.
2. Each SSL Certificate contains unique, authenticated information about the certificate owner.
3. A Certificate Authority verifies the identity of the certificate owner when it is issued.

How Encryption Works ?

Each SSL Certificate consists of a Public key and a Private key. The public key is used to encrypt the information and the private key is used to decrypt it. When your browser connects to a secure domain, the server sends a Public key to the browser to perform the encryption. The public key is made available to every one but the private key(used for decryption) is kept secret. So during a secure communication, the browser encrypts the message using the public key and sends it to the server. The message is decrypted on the server side using the Private key(Secret key).

How to identify a Secure Connection ?
In Internet Explorer, you will see a lock icon  in the Security Status bar. The Security Status bar is located on the right side of the Address bar. You can click the lock to view the identity of the website.

In high-security browsers, the authenticated organization name is prominently displayed and the address bar turns GREEN when an Extended Validation SSL Certificate is detected. If the information does not match or the certificate has expired, the browser displays an error message or warning and the status bar may turn RED.

So the bottom line is, whenever you perform an online transaction such as Credit card payment, Bank login or Email login always ensure that you have a secure communication. A secure communication is a must in these situations. Otherwise there are chances of Phishing using a Fake login Page.

Read More

What is BOT?.

BOT is a malicious program with the purpose of fraudulent use of computer. Once your computer is infected with BOT, the malicious attacker (referred to "attacker" hereinafter) remotely controls your computer from the external. This attack causes serious harm of making public nuisance such as "sending numerous number of mails" and "attacking a particular website", as well as of stealing information stored in your computer, i.e., "spying activities. As this external control of your computer is analogous to a robot, it is referred to BOT. A computer that is infected with BOT is automatically connected to instruction server or something similar installed by the attacker, resulting in formation of gigantic computer network referred to "BOT network", which is configured by several tens to several millions of BOT-infected computers. Once infected computers receive instructions from the instruction server controlled by the attacker, they are controlled on the attackers discretion and act in sending numerous number of spam mails for the purposes of phishing and the like as well as in attacking a particular website (DDoS attack). Thus, the users of such infected computers are used as steppingstones for the attacker without their knowledge, and forced to be not only "victims" but also "perpetrators." * DDoS (Distributed Denial of Service) BOTs generally do not show specific visible symptoms even when your computer is infected, being unlike the conventional viruses or worms. A user therefore does not realize the infection of his/her computer and continue to use it without noticing any difference of the computer from before the infection. BOT can update itself by adding new functions or correcting defects using the function of automatic self-updating. The updating interval is said to be short, e.g., several weeks. This also makes BOT difficult to be found. Since source codes or tools for easy preparation of BOTs are disclosed on the Internet, many subspecies of a BOT have been prepared based on the single BOT. This feature has made BOT cleaning by using Anti-Virus software be difficult. With conventional viruses, offenders committed the crime for their pleasure. In contrast, the preparers of BOTs aim to gain benefit from BOTs through, for example, lending BOTNET (networks using BOTs) to nuisance mail delivery companies on a pay-by-the-hour basis, selling personal information stolen, and so on. BOTs send out nuisance mails using the infected computers as steppingstones. Although only a few mails are dispatched from a single infected computer so that the computer user does not realize the situation, BOTs can entirely dispatch numerous number of nuisance mails, using several thousand infected computers in the BOTNET. BOTs disrupt an operation of a particular website by sending a numerous packet (data) to the Web server and thereby making it inoperable. As analogous to sending nuisance mails, although only small volume of attack data is sent out from a single infected computer, it would be a threat for even large scale of a server that BOTs can send out data from several thousands to several millions infected computers. Utilizing vulnerabilities of computers, BOTs take actions to augment infection so that the number of computers available for nuisance mails and DoS attacks are increased. BOTs take over computers that have vulnerabilities and send in programs for infecting other computers. To perform the item 3 "Network infection", BOTs collect information of the computers with vulnerabilities. Using the collected information, another computer is selected as the next target for infection. A BOT adds new functions and correct own flaws using functions to update itself automatically. In addition, when an "instruction server", which interfaces the instructions from the attacker, becomes unavailable due to virus disinfestation and such, the BOT find another server to switch the instruction server. A BOT can send out information stored in an infected computer to the external. Therefore, based on received instructions, various pieces of information are stolen, collected or leaked out to the external, where the information includes a keyboard operation history, credit card No. and ID, password, and addresses registered in an address book of the mail software.

Read More

How Does Intrusion Detection System(IDS) Works?.

---

What is an IDS?

A system that tries to identify attempts to hack or break into a computer system or to misuse it. IDSs may monitor packets passing over the network, monitor system files, monitor log files, or set up deception systems that attempt to trap hackers.¹ With that being said you get the basic idea. While a firewall should always be your first line of defense, an IDS should be next. I use a simple analogy. Think of your network as a prison. The outside is protected by a large wall (firewall), while the inside is protected by cameras and corrections officers (an IDS).

How does an IDS work?

While there are several types of IDSs, the most common types work the same. They analyze network traffic and log files for certain patterns. What kind of patterns you may ask? While a firewall will continually block a hacker from connecting to a network, most firewalls never alert an administrator. The administrator may notice if he/she checks the access log of the firewall, but that could be weeks or even months after the attack. This is where an IDS comes into play. The attempts to pass through the firewall are logged, and IDS will analyze its log. At some point in the log there will be a large number of request-reject entries. An IDS will flag the events and alert an administrator. The administrator can then see what is happening right after or even while the attacks are still taking place. This gives an administrator the advantage of being able to analyze the techniques being used, source of attacks, and methods used by the hacker.

Specifications for IDS

IDSs are defined by what is called the Common Intrusion Detection Framework (CIDF). It is composed of 4 components:

A boxes - Network activity analysis devices that can be specific hardware, software or both. C boxes - Countermeasure mechanisms or response procedure equipment. D boxes - Storage mechanisms (hard Disks), which are essentially the logging equipment. E boxes - These are considered event generators, commonly known as sensors.

²

A boxes

A boxes work like the situation mentioned above. They gather information and look for defined patterns. These patterns can include the consistent stream of packets by Trojans or viruses. An A box is great for detecting DDoS attacks and router attacks. Think of an A box as an "alarm."

C boxes

C boxes work a little differently than A boxes. After an attack has been detected, C boxes have the ability to provide countermeasures. This could include locking a user account or modifying the ACL (Access Control List). Think of a C box as a "counterattack." These work better because they save the administrator from dealing with every little flag. These are valuable in large or enterprise networks.

D boxes

D boxes are rather simple. They provide a means of logging data. One of the best practices for protecting a Linux/UNIX server is to record the logs to a different machine. This works the same way. Servers and IDSs may send their logs to a D box that serves only as a repository. D boxes are important because you may need to analyze data at anytime, even after a C box has taken action. Think of a D box as a "dump server."

E boxes

E boxes are a very important part of an IDS. While an E box cannot be an IDS on its own, without an E box, an IDS cannot function. The function of the E box is simple, it produces "events." Events are not always suspicious. An event can be as simple as recording a user logging on to a server. Think of an a E box as an "event creator."

It is important to know how the term "boxes" is used. While the term "boxes" does not actually refer to physical machines, these "boxes" can and often are used in combination. For example, IDS software can utilize a combination or all of the above framework.

Types of IDS

Generally speaking, there are 3 main types of IDSs:

• Suspicious Detection
• Abnormal Detection
• Signature/Pattern Detection

The suspicious detection is used to flag a defined activity. For example, a firewall may or may not block a port scan. Suspicious detection will automatically flag this event, record the source IP, and the ports scanned. This type of detection is usually customized. System administrators will need to specify what activity qualifies as "suspicious."

The abnormal detection is usually customized as well. It does what its name describes. It looks for abnormal behavior. How is this different from suspicious detection? Here is an example; Most corporate LANs are only active during business hours. From 9 AM - 6 PM, the servers are active, users are logged on, and the routers are busy. However, during non-business hours, the network should be rather stagnant. This is where the abnormal IDS comes into play. In the event that a workstation on your network is infected with a Trojan, the hacker could use that machine to gain access to the rest of your network including the file servers. Usually, this is late at night when the administrator and users won't notice. An abnormal IDS would record network activity and file requests during non-business hours. So, if a users was all of the sudden requesting files from server at 2 AM, the abnormal detection IDS would send a red flag. This allows network administrators to know exactly what is going on when they are not there.

The signature/pattern detection relies heavily on a database of, you guessed it, signatures and patterns! This means the known probing tools, like the ones used by "script kiddies." The common Trojans that are all over Mirc, and various worms have a consistent pattern of how they send and receive data. A database will include the signatures or patterns used by these programs. It constantly monitors the network and when there is activity that matches something from the database, the red flag goes up. This is helpful for large networks. Especially if the users are ignorant and download things they shouldn't...

The best IDSs use a hybrid approach by including 2 more of these detection methods. System administrators should be careful not specify rules that are too harsh. Going over-board can lead to false positives and unwanted chaos. However, it is important to specify rules that will catch intrusions.

Putting it all together...

IDSs can come in the form of hardware, software, or both. One example is the hardware based Enterasys Dragon IDS. This device employs a "network sensor" and "active response" technique to protect a network. The image below shows a Cisco WS-X6381-IDS. This device uses both hardware and software. Physically, this device is attached to an intermediate or core switch. The presence of a hard drive entails its use of software to analyze results.



On the software-based side, a program called Specter, looks like a great program. A rather steep price (retails for $899) makes this software un-attractive to small networks or organziations with a low budget. Although, it runs on any version of Windows and can emulate practically any system. I have not used it, but here is a screen shot of the interface.

Deploying an IDS

An IDS can play pretty much any role you need it to play. For instance, software can be installed on a workstation (like specter) to monitor requests from other parts of the network or outside traffic. An IDS can also be used in conjunction with other network devices. The diagram below shows an example of setting up a dedicated machines with IDS software. Notice the Enterasys Dragon is located in the DMZ. Placing a decoy in the DMZ will deter hackers from the rest of the network. Taking the time to trip the IDS gives system administrators time and data to analyze. This in-turn helps them protect the network.



The most efficient technique to deploying IDSs on your network is proper analysis. Don't go overboard right away. Analyze the way your network is setup. Every system administrator knows the potential weak points of their network. Setting up an IDS may take some time to get everything working right. Trial and error will always be an important tool for tuning up everything and getting it just the way you want.

---

¹ http://myphliputil.pearsoncmg.com/student/bp_hoffer_moderndbmgmt_6/glossary.html

² Mairs, John. VPNs: A Beginners Guide, Berkeley, CA: McGraw-Hill, 2002

Read More

How To Keep Your PC Safe With Sandboxing.

  How to Keep Your PC Safe With Sandboxing

If viruses and malware are a regular problem for you, or if you're simply worried that your antivirus program isn't sufficient, you can add an extra layer of defense to your PC by setting up a sandboxing application. A properly sandboxed set of Windows programs can protect you from malware that your antivirus utilities miss, keeping your PC and your personal data more secure while you're shopping online, say, or visiting potentially dicey Web sites.

Sandboxing is a form of software virtualization that lets programs and processes run in its isolated virtual environment. Typically, programs running within the sandbox have limited access to your files and system, and they can make no permanent changes. That means that whatever happens in the sandbox stays in the sandbox.

You can find programs dedicated to sandboxing, but some antivirus programs also feature sandboxing; I'll explore both in this article. The exact sandboxing functionality varies between programs, but here are some of the common uses:

- Automatically or manually run unknown programs in the sandbox in case they contain viruses, spyware, or other malware.
- Run your Web browser within the sandbox to prevent damage from any infections you pick up while browsing, which is the most common origin of malware.
- Run your browser within the sandbox to stop any existing malware on your computer from capturing your site login credentials or your online-shopping payment details.

Most sandboxing tools, such as the ones I'll discuss here, can run programs inside the sandbox right alongside your other programs in Windows. Generally speaking, programs running inside the sandbox will appear normal. But some tools load a separate environment, and have a different look and feel--and they may even require you to reboot the PC when you exit the sandbox.


Sandboxing in Comodo Internet Security
Comodo Internet Security is a free security suite for both personal and business use. In addition to antivirus and firewall components, it features automatic and manual sandboxing.

CIS automatically detects untrusted executable files and programs, and runs them in the virtual environment. You can also manually run any program within the sandbox; simply select a program to run via the main CIS application window (under the Defense+ tab).


Sandboxing in Comodo Internet Security.

Alternatively, you can right-click a program anywhere in Windows and select Run in COMODO Sandbox. However, the option doesn't appear when you right-click a shortcut icon; you must right-click the actual executable program file, which can be a pain.

The sandboxing functionality in CIS is best for automatic protection, or for the occasional manual running of suspicious downloads. If you'd like sandboxing for Web browsing, consider another utility such as Avast or Sandboxie, both of which I'll discuss on the next page.


Sandboxing in Avast Antivirus
Avast provides a free antivirus program for personal use, as well as premium versions with additional features or for commercial use. Avast Free Antivirus offers only auto sandboxing, while Avast Pro Antivirus and Avast Internet Security offer both auto and manual sandboxing.

Like CIS, each Avast product automatically runs suspicious programs in the virtual environment; by default, the utility will prompt you before doing so. Within the Avast settings, you can specify programs you want to exclude from being sandboxed automatically.

Manually running programs inside the sandbox with the Avast premium products is similar to using CIS. You can select a program to run via the main Avast program window (under the Additional Protection, Sandbox tab).


Avast Internet Security offers highly customizable sandboxing features.

If you prefer, you can right-click a program anywhere in Windows and select Run in Sandbox or Always Run in Sandbox. Unlike CIS, Avast gives you the sandboxing options even when you right-click a shortcut rather than just the executable program file itself. Additionally, you can specify that a program always run sandboxed even when you open it normally. Avast also gives you more sandboxing settings to customize, such as limiting which sandboxed applications can access the Internet.

Avast Free Antivirus is great for automatic sandboxing, but if you want manual sandboxing or Web browsing protection, consider upgrading to the Avast paid products or using another utility. The premium editions of Avast are good for manual sandboxing, but you still might want to try another application, such as Sandboxie, for advanced customization and use.


Using Sandboxie
Sandboxie is a shareware utility offered free for personal use, though if you don't pay for it after 30 days you'll get nag screens. It allows you to open your Web browser, email client, and any other program inside customizable sandboxes.


Sandboxie is a shareware app that lets you set up your own sandboxing environments.

Sandboxie lets you create multiple highly customizable sandboxes, each running in its own virtual environment and retaining its own data. For example, you might use one sandbox for running questionable programs and browsing on potentially dangerous sites, and another sandbox for performing sensitive activities such as online banking or shopping.

Sandboxie will create one default sandbox for you. To add more, you open Sandbox Control, click Sandbox, and select Create New Sandbox.

Unlike the sandboxing features of some antivirus programs, Sandboxie doesn't automatically sandbox unknown programs. But it does provide several ways to open programs within the sandbox.

- Open your Web browser: Click the Sandboxed Web Browser shortcut on your desktop or Start menu to open your default browser within a sandbox.
- Open any program via Sandboxie: Click Start, All Programs, Sandboxie, Run any program Sandboxed. Select the sandbox to launch in, and then browse for the program.
- Open any program via Windows: Anywhere in Windows, right-click a program and select Run Sandboxed.
- Open items from the Start menu: Click Start, All Programs, Sandboxie, Sandboxie Start Menu, and then select the sandbox to launch in. Choose a program from the Sandboxie list of your Start menu desktop shortcuts.

The registered version of Sandboxie also lets you specify any programs that should be sandboxed automatically, even when you open them normally: To set this up, open Sandboxie Control, right-click the desired sandbox, select Sandbox Settings, choose Program Start, and then select Forced Programs.

By default each sandbox retains any data associated with the programs you run inside the sandbox. For example, if you run a Web browser, it saves your browsing history and temporary Internet files. However, you can delete the sandbox data contents at any time: Open Sandboxie Control, right-click the desired sandbox, and select Delete Contents.

When you download files within a sandboxed browser or save files from any sandboxed program, Sandboxie prompts you to recover them. This action lets you save the items outside of the sandbox onto your regular drives. If you choose not to recover files when prompted, you can always view and recover them later: Open Sandboxie Control, right-click the desired sandbox, and select Quick Recovery.

Sandboxie is great if you plan on using sandboxing on a daily basis, or even just occasionally when you're Web browsing. But for automatic protection against possible malware, consider using an antivirus suite that includes sandboxing, such as Comodo Internet Security or Avast.

Read More

Microsoft Share Point Service.

Windows SharePoint Services is a versatile technology that organizations and business units of all sizes can use to increase the efficiency of business processes and improve team productivity. With tools for collaboration that help people stay connected across organizational and geographic boundaries, Windows SharePoint Services gives people access to information they need.


Built on Microsoft Windows Server 2003, Windows SharePoint Services also provides a foundation platform for building Web-based business applications that can flex and scale easily to meet the changing and growing needs of your business. Robust administrative controls for managing storage and Web infrastructure give IT departments a cost-effective way to implement and manage a high-performance collaboration environment. With a familiar, Web-based interface and close integration with everyday tools including the 2007 Microsoft Office system, Windows SharePoint Server is easy to use and can be deployed rapidly.
                                 
Installation over Windows Small Business Server: If you intend to install Windows SharePoint Services 3.0 on a server that is running Windows Small Business Server 2003, please read “Installing Windows SharePoint Services 3.0 on a Server Running Windows Small Business Server 2003”. This white paper contains important installation steps and procedures that you must perform to ensure a successful deployment. Caution: If you do not follow the instructions in this white paper, your configuration of Windows Small Business Server 2003 and Windows SharePoint Services 3.0 may not function properly or might not be supported.

Search Server 2008 Express: If you’re using Windows SharePoint Services, you can easily add search capabilities to your collaboration environment across SharePoint sites, file shares, web sites, Exchange Public Folders, and third party repositories using Microsoft Search Server 2008 Express. Click here to download.

System requirements

Supported Operating Systems: Windows Server 2003 Service Pack 1
Minimum hardware requirements:

Server with a processor speed of at least 2.5 GHz
1 GB RAM
The following is also required:

Microsoft .NET Framework 3.0
For further deployment and information and requirements, consult the Deployment for Windows SharePoint Services 3.0 technology site.


Take Tour of Windows Share Point:http://office.microsoft.com/en-us/windows-sharepoint-services-help/demo-tour-a-windows-sharepoint-services-3-0-site-HA010205563.aspx
 

Download:http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=14117

Read More

Man In The Middle (MITM) Attack.

Man in the middle attack is a type of attack in which the attacker intercept into the existing connection and breaks it in two different connections, one between the client and the attacker and the other between the attacker and the server. Now all the data would go through the attacker and he would be able to read, modify and insert data in the communication. Man in the middle attacks are sometimes known as fire brigade attacks.
This attack is very effective on http protocol because data is seny on plain text form. It is possible to capture session cookies by header and also possible to change.


                               MITM Attack tools:
There are several tools to perform a MITM attack.

1. PacketCreator
2. Ettercap
3. Dsniff
4. AirJack
5. Cain e Abel

Read More

What Is Spyware?

                                          
A spyware is a piece of malicious code or program installed in system to monitor activities of a person. A spyware is capable of logging key strokes, it can take screen shots and if there is active Internet connection then it can even mail logs to specified email-address or transfer logs to ftp server.
Beyond just monitoring it can record your computing habits including which site you browse more, at what time you prefer to be on system or amount of time you spend on computer.
                                    
A spyware can be used to track all information about your social-networking habits and IRC(Internet Relay Chat) Clients including all major and minor chat clients example: Google Talk, Rediff Messenger, Yahoo Messenger, Microsoft Live Chat, absolutely every thing related to IRC client is exposed to spyware. On the basis of its commercial use and monitoring capabilities spywares are classified as follows,

On Basis Of Commercial Use: Domestic Spywares and Commercial Spywares
On Basis Of Monitoring: Key Loggers, E-mail Loggers/Chat Recorders, Screen Recorders.

Domestic Spywares: This kind of spywares are purchased and used by common people to monitor their system. Most of the times parents install this type of spyware to monitor their children or network admin or a company to monitor computing activities of their employees. The most widely and most powerful use of these spywares are done for hacking purposes only.
Example: SniperSpy, Winspy, Sentry PC, Spy Agent

Commercial Spywares: Commercial Spywares incude the services included in your Operating System and softwares to monitor event logs and crash reports. The information about software crash is anonymously sent to software vendors, also the reports about user experience, crash, memory dump etc are sent to Operating System Vendor. The only fact is that this type of spying is legal to improve product and provide better and secure service.
Example:Windows and Linux Crash Logs, Virus info in Anti-Virus program, Event Collectors etc.

Key Loggers: Key loggers are spywares specially made to record keystrokes from keyboard. Key Logging can retrieve information about bank account password, online transactions, login passwords etc.

E-mail Loggers/Chat Recorders:These spywares are used to track e-mails and chat report from your IRC. If you use e-mail client like Windows Mail or Mozilla Thunderbird etc. Then these spywares are capable of modifying internal settings to forward mails to attacker's inbox without keeping a track in your Outbox.

Screen Recorders: Screen recorders are capable of capturing screen and send recording using minimum bandwidth. Such monitoring is done by parents on their children to protect them from online pornography.
Example:Spy Agent, Winspy, Sniper Spy

Ok being honest I want to clear that today actually nobody bothers about classification of spyware and reason is quite obvious that spyware manufactures pack their spywares with nearly 90% of features of all types of spywares. So if you don't want to remember classification of spyware then its ok, no problem at all but you must know what is spyware. Sorry forgot you already know that.

Read More

How does the Internet work?

                                 
Even though the Internet is still a young technology, it's hard to imagine life without it now. Every year, engineers create more devices to integrate with the Internet. This network of networks crisscrosses the globe and even extends into space. But what makes it work?

To understand the Internet, it helps to look at it as a system with two main components. The first of those components is hardware. That includes everything from the cables that carry terabits of information every second to the computer sitting in front of you.

Other types of hardware that support the Internet include routers, servers, cell phone towers, satellites, radios, smartphones and other devices. All these devices together create the network of networks. The Internet is a malleable system -- it changes in little ways as elements join and leave networks around the world. Some of those elements may stay fairly static and make up the backbone of the Internet. Others are more peripheral.

These elements are connections. Some are end points -- the computer, smartphone or other device you're using to read this may count as one. We call those end points clients. Machines that store the information we seek on the Internet are servers. Other elements are nodes which serve as a connecting point along a route of traffic. And then there are the transmission lines which can be physical, as in the case of cables and fiber optics, or they can be useless signals from satellites, cell phone or 4G towers, or radios.

All of this hardware wouldn't create a network without the second component of the Internet: the protocols. Protocols are sets of rules that machines follow to complete tasks. Without a common set of protocols that all machines connected to the Internet must follow, communication between devices couldn't happen. The various machines would be unable to understand one another or even send information in a meaningful way. The protocols provide both the method and a common language for machines to use to transmit data.

We'll take a closer look at protocols and how information travels across the Internet on the next page.

Read More

BOT AND BOTNETS

 
The term bot, derived from “ro-bot” in its generic form. It is a script or set of scripts or a computer program which is designed to perform predefined functions repeatedly and automatically after being triggered intentionally or through a system infection. Bot runs automated tasks over internet. According to the type of working we can say that there are two of Bots.


Benevolent bots: Bots that are used to carry out legitimate activities in an automated manner are called benevolent bots. These are used in search engines to spider online website content and by online games to provide virtual opponent.
Malicious bots: Bots that are meant for malicious intent are known as malicious bots. bots used for DDos attack and spam bots are example of Malicious bots.


The first bot program Eggdrop created by Jeff Fisher in 1993 originated as a useful feature on Internet Relay Chat (IRC) for text based conferencing on many machines in a distributed fashion.

An IRC malicious bot program runs on an IRC host or client each time it boots in a hidden manner and controlled by commands given by other IRC bot(s). It is typically an executable file with a size of less than 15 KB in its compressed form. An IRC host computer running an IRC bot malware program becomes a Zombie or a drone (Choo – 2007). 

The first malicious IRC bot, Pretty Park Worm that appeared in 1999 contained a limited set of functionality and features, such as the ability to connect to a remote IRC server, retrieve basic system information e.g. operating system version, login names, email addresses, etc.

A collection of such type of bot affected systems are know as BOTNET (Bot Networks). A collection of compromised hosts or bot-infected machines running malware such as worms, Trojan horses, or backdoors under command & control (C&C) infrastructure.

Types of Botnets:  There are a variety of botnets in existence today. The three most commonly seen on home and office client computers are HTTP botnets that exploit vulnerabilities in web browsers, IRC botnets that allow operators to control the computers of unsuspecting users through an internet relay chat (IRC) channel, and Peer to Peer (P2P) botnets that infect files shared on P2P services like Gnutella or Limewire.

HTTP Botnets:HTTP typically is used for creation and control of botnets. Bots will sign in to an http server and wait for commands from a bot herder, or they will simply visit pre-designated sites to get commands that are coded into the site’s files.  Many HTTP bots have their own servers for downloading malware, phishing, etc. 

P2P Botnets:Many P2P applications are utilized by bot herders to share files that have bots and malware attached. In most cases, these bots are pre-programmed to perform specific functions when a file is opened, or when a container application like a game or desktop application is installed.

IRC Botnets: The most abundant use of botnets is accomplished using IRC applications. This is because the IRC protocol has been around the longest, and that is where earlier botnets operated before HTTP came along. IRC is used by a wide variety of applications to allow users to have simple text based chatting environments. Infected IRC clients log into a specific IRC server and wait for specially formatted text messages that contain commands. Commands can also be encoded into the title or name of the chat channel, so that every bot entering can be given commands. More sophisticated versions of this will group bots into sub-nets based on the tasks to be performed, or some other distinction. IRC Botnets are generally the most complex and the hardest to detect.

                                          

this is the diagram which shows how an attacker spread his bots on victims computer and control those bot program. Mostly these Affected systems are use for illegal activities by attacker without the knowledge of system owner. 

Look at the figure which shows how botnets are used in DDos attacks.

How to Avoid Botnets: 

• Install an antivirus program from a trusted provider.
• Make sure the operating system’s firewall is turned on, as well as the firewall of any connected router(s).
• Keep your operating system, web browser, firewall and antivirus applications up to date.
• Keep all media players up to date.
• Pay close attention to the options available when installing downloaded software. Installing toolbars or other gadgets that come from sources other than the site they were created on may have bots attached to the install. Also be skeptical of installation options that ask for permission to change your browser’s home page.
• Learn to be very critical of emails containing links of any kind or ask you to go to a specific site that you’re unfamiliar with.

if you have any query regarding this post please comment.

Read More

How Windows Product Activation (WPA) Works?

                                              
Windows Product Activation or WPA is a license validation procedure introduced by Microsoft Corporation in all versions of it’s Windows operating system. WPA was first introduced in Windows XP and continues to exist in Windows Server 2003, Windows Vista, Windows Server 2008 and Windows 7 as well. WPA enforces each end user to activate their copy of Windows so as to prevent unauthorized usage beyond the specific period of time until it is verified as genuine by Microsoft. How WPA really works was a closely guarded secret until GmbH analyzed WPA using a copy of Windows XP RC1 and published a paper on their findings.



In this post you will find answers to some of the most frequently asked questions about Windows Product Activation.
Why activation?

Microsoft’s intention behind the activation is to limit the usage of it’s Windows operating system to only one machine for which the retail license is issued. Any other computer which runs on the same license must be disallowed from using the software. Thus WPA demands for activation of the product within 30 days of it’s installation so as to ensure that it is genuine.
What does “Genuine Windows” means?

The copy of Windows is said to be genuine only if the product key used during the installation is genuine. It means that a given product key (retail license) must be used to install Windows only on one computer for which the license was purchased. Thus if the same key is used for the installation on another computer, then it is said to be a pirated copy.
Exactly what information is transmitted during the activation?

When you activate your copy of Windows you are transmitting an Installation ID code to the Microsoft either by phone or Internet depending on the method you choose to activate. Based on this, the Microsoft’s licensing system can determine whether or not the installed OS is genuine. If it is said to be genuine, then the system will receive the Activation ID which completes the activation process. If the activation is done via telephone then the Activation ID needs to be entered manually to complete the activation process.
What information does the Installation ID contain?

This Installation ID is a 50-digit number which is derived from the following two data.

1. Product ID – It is actually derived from the 25-digit product key (the alphanumeric value that is printed on the sticker over the Windows CD/DVD case) that is entered during the installation of the operating system. The Product ID is used to uniquely identify your copy of Windows.

2. Hardware ID – This value is derived based on the hardware configuration of your computer.

The WPA system checks the following 10 categories of the computer hardware to derive the Hardware ID:
Display Adapter
SCSI Adapter
IDE Adapter (effectively the motherboard)
Network Adapter (NIC) and its MAC Address
RAM Amount Range (i.e., 0-64mb, 64-128mb, etc.)
Processor Type
Processor Serial Number
Hard Drive Device
Hard Drive Volume Serial Number (VSN)
CD-ROM / CD-RW / DVD-ROM

Thus the Installation ID which is a combination of Product ID and Hardware ID is finally derived and sent to Microsoft during the activation process.
How is the Installation ID validated?

The Installation ID needs to be validated to confirm the authenticity of the installed copy of Windows. So after the Installation ID is received by Microsoft, it is decoded back so as to obtain the actual product key and the hardware details of the computer involved in the activation process.

The Microsoft’s system will now look to see if this is the first time the product key is being used for the activation. This happens when the user is trying to activate his Windows for the first time after purchase. If this is the case then the Installation ID is validated and the corresponding Activation ID is issued which completes the activation process.

However Microsoft system will now associate this product key with the hardware ID of the computer and stores this information on their servers. In simple words, during the first use of the product key, it is paired together with the Hardware ID and this information is stored up on the Microsoft servers.
What if a computer running a pirated copy of Windows attempts to activate?

The activation fails whenever the copy of Windows installed is not said to be genuine. This usually happens when the product key used for the installation is said to have been used earlier on a different computer. This is determined during the activation process as follows:

During the validation of the Installation ID, the Microsoft’s system checks to see if the same product key was used in any of the previous activation processes. If yes then it looks to see the Hardware ID associated with it. The computer running a pirated copy of Windows will obviously have a different hardware configuration and hence the Hardware ID will mismatch. In this case the activation process will fail.

Thus for a successful activation, either of the following two cases must be satisfied:
The product key must have been used for the first time. ie: The product key should not have been used for earlier activations on any other computer.
If the product key is said to have been used earlier, then the Hardware ID should match. This happens only if the same computer for which the license was genuinely purchased is attempting for subsequent activation.
What about formatting the hard disk?

Each time the hard disk is reformatted and Windows is re-installed, it needs to be re-activated. However the activation process will be completed smoothly since the same computer is attempting for subsequent activation. In this case both the product key and the Hardware ID will match and hence the activation becomes successful.
What if I upgrade or make changes to my hardware?

In the above mentioned 10 categories of hardware, at least 7 should be the same. Thus you are allowed to make changes to not more than 3 categories of hardware. If you make too many changes then your activation will fail. In this case, it is necessary to contact the customer service representative via phone and explain about your problem. If he is convinced he may re-issue a new product key for your computer using which you can re-activate your Windows.
Some things WPA does not do
WPA does not send any personal information at all about you to Microsoft. There is still an option to register the product with Microsoft, but that is separate and entirely voluntary.
If you prefer to activate via phone, you are not required to give any personal information to Microsoft.
WPA does not provide a means for Microsoft to turn off your machine or damage your data/hardware. (Nor do they even have access to your data). This is a common myth that many people have about Microsoft products.
WPA is not a “lease” system requiring more payments after two years or any other period. You may use the product as licensed in perpetuity.

I have tried my best to uncover the secret behind the WPA. For further details and more technical information you can read the actual paper by Fully Licensed GmbH at http://www.licenturion.com/xp/fully-licensed-wpa.txt. I hope you like this post. Pass your comments.

Read More

How do Email Spam Filters Work?

                                                 
If you are the one who works with emails on a daily basis, you are most likely to be using a SPAM FILTER to ease the job of sifting through a large number of spam emails every day. Needless to say that spam filters do make our job a lot simpler by automatically filtering out the spam without which it is almost impossible to manually filter the junk emails that arrive in millions each day. However, it is often necessary to have a basic knowledge of how spam filters work and on what basis they flag an email as spam.


How Spam Filters Work?

There are different kinds of spam filters:

Header Spam Filters

Header spam filters work by examining the header information of a particular email message to check if it appears to have been forged. The header of every email contains information which tells the origin of the email. ie: The incoming email ID and usually the IP address (server address) of the sender. So spammers often forge the header to input a false sender ID and IP address so as to make it difficult to trace them. Thus if an email is supposed to have a forged header or if the same message is found to have been sent to multiple recipients, it is most likely considered as a spam by many filters. This method of spam filtering is often quite effective, however occasionally it may result in some of the requested newsletters from being misdirected into the spam folders.

Content Spam Filters

Content spam filter is one of the most effective and widely used filter to combat spam emails. They use a sophisticated algorithm with a set of pre-defined rules to determine whether a given email is a spam. They work by scanning the entire text/body of the email to search for specific words and patterns that make them resemble a typical spam message. Most content spam filters work based on the following criteria and check to see

1. If the message speaks a lot about money matter. Commonly suspected words include: lottery, discount, offer, bank account, money back guarantee etc.

2. If the message contains adult terms like: viagra, pills, bed, drugs, hot and so on.

3. If there is any sort of urgency. Most spam emails call for an urgency by using terms such as hurry, offer valid till etc.

4. If the message contains a single large image with little or no text then it is often considered as spam by many filters.

Each content spam filter may have it’s own set of additional rules using which it evaluates each incoming email. In most cases content and header spam filters are combined together to achieve higher level of accuracy.

Language Spam Filters

Language spam filter is designed to simply filter out any email that is not in the user’s native language. Since spammers come from all parts of the world with different languages, a language spam filter can help get rid of those annoying emails that come in the languages that you can’t read!

User Defined Spam Filters

User defined spam filters can be very handy, however they need a considerable amount of time investment in configuring and setting up a set the rules using which the filter works. For example, the user can configure to have all the emails from friends and company to reach the inbox, newsletters to reach a secondary inbox and all those remaining to the spam folder. Here the user must carefully examine the patterns of spam emails that he receives from time to time and needs to set up the rules accordingly. This filter when improperly configured can sometime lead to false positives or false negatives.

Other Types of Spam Filters

Popular webmail services like Gmail, Yahoo and Hotmail combine both header and content spam filtering techniques. In addition to this they also use their own algorithms to combat spam. For example services like Gmail uses “optical text recognition” to identify spammy text inside an image. Also users are provided with an option to “Report Spam” whenever a spam email accidentally reaches the inbox. With the user feedback, the filter learns and becomes more powerful in carrying out the filtering process.

Read More