5 The Top 10 Things You Should Do After a Cyber Security Breach

While a major part of preventing all massive potential data intrusion damage lies in the preventative measures of secure code, updated security software, use of frequently updated applications and strong passwords for all access points to your data; sometimes cyber breaches happen no matter how well you have protected yourself. When this happens, prevention no longer matters for the moment and purely defensive and sanitary measures are your best friend.
Top 10 after do of a cyber breach
Now let’s cover some of these, as applied to assorted systems, including computers, hosting servers and your internal networks

1.Make Sure you have been Hacked

Not all strange system behavior is a sign of third party or malware intrusion. Sometimes the complex systems we operate go haywire because of changes we ourselves have made to them without being aware of the consequences.
If your website, computer or network is behaving strangely, not loading properly or giving you blank displays where data or a visual interface should be visible, first think back to any recent changes you might have made that could be responsible for the differences.
In a website hosting system, for example, changing so much as a single parameter within a site’s MySQL database template can lead to a completely downed website even though all the internal data is perfectly safe.

2.Speak to your Support Team

As a follow up to step one above and as a part of general policy, you should speak to your technical support team as soon as you have noticed strange things about your system. If you’re a website owner, this could be the people who manage your IT and hosting servers and if you’re the owner of a business or organizational network, this could be your IT support staff.
They can not only tell you about any changes they may have done to provoke a system failure, they can also help you investigate the wider scope of the intrusion you may be suffering.

3.Image your Servers or Drive

Imaging software for computer hard drives and the same sort of software for servers should always be close at hand. In case of a breach, before proceeding with cleanup and removal of all malicious factors, you should first image your drives or servers immediately in the condition they have at the time of their hack.
This will preserve a large body of evidence which can later be examined through digital forensics techniques, and this evidence vitally needs to be preserved so that you can formulate a better future intrusion response. Knowing if you were the victim of a genuine virus, entry by a human hacker who’s been modifying your code or something as simple as some spyware is crucial.

4. Disconnect from the Web (if possible)

As soon as you have imaged your servers, hard drives and all data or code collections, you should immediately disconnect your servers or computers from the wider web if at all possible.
This may cause chaos and disruptions for clients if you’re running a business website, but as a preventative step it’s vital. By keeping your machines and servers connected, you’re allowing the malware or human intruders who have breached them to continue maintaining malicious access, keep stealing data or causing further damage.
Unless you’re running security scans that require a web connection to work, your systems should be offline while you recover.

5. Change all Passwords

In addition to imaging of all data storage media and disconnection from external access, you should also be moving quickly to change all of your access passwords. They may have been the cause of your security breach and by leaving them as they are, you’re inviting future attacks even after you repair and reinstall everything.
Your machine itself, your hosting server access, your MySQL databases and your FTP should all have their passwords and the passwords of any sub-accounts on them reset immediately.

6. Perform Security Scans

Antivirus software, anti-malware programs and network intrusion protection software should all be tools that you keep close at hand for intrusion incidents. Once your intrusion has been detected and the above steps taken, perform scans that cover all the major bases against malware, spyware, intruders and scripting attacks.

7.Remove all Malicious Files and Code

Through the assistance of your IT support team, your service providers and the security software you have been running, you can start slowly identifying and destroying all the malicious code you find on your network, servers or computer itself. This can be a tedious process and if you’re not sure that you have successfully removed everything, you probably need to do a full re-install.

8. Back up Everything

Back up all of your valuable data as soon as possible after a data breach. You may have already performed a full scale imaging process on your entire servers or drives but specific section backups of key databases and data volumes are also a good idea because they allow you to compartmentalize valuable information for later analysis through digital forensics.

9. Re-install as much as Necessary

If the breach was very severe and especially if the breach affected a lot of data or code, you might have to perform a full scale re-installation of all your software. In a computer, this will require you to format your entire hard drive and re-install your operating system.
On your website hosting servers, you’ll almost certainly need to re-install all o your database management software, LAMP (Linux, Apache, MySQL and PHP) applications along with any other third party software you were running for your website.
Always re-install to the newest versions of whatever software you need to replace.

10. Document Everything

Finally, document everything. Document all of the steps you took, the processes you followed and the files you erased, re-installed and used to clean your machine. Documentation is useful for future digital forensics (if needed) and it preserves a chain of evidence that can be used as a future prevention reference.

About the Guest author: Stephan Jukicis,a freelance writer who generally covers a variety of subjects relating to the latest changes in whitehat SEO, mobile technology, marketing tech and digital security. He also loves to read and write about location-free business, portable business management and finance. Connect with Stephan on LinkedIn.
Read more

30 Ramnit : Worm that loves Facebook

 "Ramnit"  the worm with multifaceted spreading capabilities,first detected on 2010 for infecting local systems. Now the hackers behind it have redesigned it into a more advanced kind of worm.The worm has already stolen 45000 facebook credentials and still on move.

It is also confirmed that this worm is able to bypass the two level authentication used by banking organizations and online money transfer.Below I have taken the snapshot of the code of the worm that was detected in 2010.
 It comes from online malicious sources and   creates infected .html files through that it infects the executable and .dll files. As,depicted in the video below.

But as the worm has spread its root to financial and social media so it a big concern.Users are advised to change there credentials in every 14 days.
Read more

42 A Beginner's Guide to Android Rooting | Easy Reference

Android in the one of the widely accepted OS in devices(phones,Tabs etc) these days because of its largely managed apps and control it give to its users.Where is honey so bears are there......
I mean because of its popularity it is one of the hotspot for attacker these days.So,I thought of sharing few security tips with my readers,for that the apps we need to work with will be functional on certain criteria that is we need to have root access on the device.Before going into the security part of it I would like to give my readers a basic idea about rooting.

What is Rooting in Android?

"Root" as you all may be knowing is related to Linux and it is analogous to administrator in Windows.So rooting an Android device means we get the full access and freedom on the functionality of the device,in windows language we can say we have the admininstrative previlage.So,the process by which we get the root access/previlage is called "Rooting".

Why we need Rooting?

1. Full access and control over the device.(Superuser access)

2. Make your device fast to your wish.

3. Add more apps of your choice.(Will be covered in the next Post)

4. Use the OS version of your choice.

Disclaimer: Root may cancel/void your warranty.Carry out the process at your own risk,the author will not be held responsible for any damage caused to your device.
How to root an Android device?

Instead of giving a detailed tutorial I will cover the basic overview of how this is exactly done and the tools and software associated with it.Here it is worth mentioning that all the android based devices do not have excatly the same rooting procedure.So,here I have listed out all the possible methods.

Note:Install Microsoft .Net Framework version 2.0 or greater.
         Enable USB debugging in device settings.
         Need USB drivers for your device and install it.
The first and foremost thing is to find the method which is compatible with your device(just Google it)

1.Rooting Android devices with SuperOneClick.

2.Rooting Android devices with Universal Androot

3.Rooting Android devices with Z4Root.

4.Rooting Android devices with flashRec

5.Rooting Android device using Easy Root.

6.Unrevoked Method:
If the above mentioned methods are not compatible with your device then you may try this method.This method is mostly used for HTC devices.You may download Unrevoker here.

 A Reference of how to "Root a HTC wildfire(Video Tutorial)".

You may need the below mentioned help before working with Unrevoker.
     * S-off tool  Revolutionary (Download)
     * You may need a Rom to get downgrade(Download)
     * Need to find the HBOOT version,as we may need it.

7.Rooting Android 2.3 Gingerbread devices with GingerBreak.

If the Android is 2.3 then no need to downgrade it to 2.2 and start rooting,you may see if your device is compatible with GingerBreak exploit.Follow the reference here as this may help you carry out the steps.

After you are done with rooting then you may install the desired OS version and add your custom ROM.

I hope this post will come to your help.If you feel that I need to add any thing else then feel free to drop a comment. :) 
Read more

9 Yersinia | Analyze and Test Deployed Networks

"Yersinia" a type of bacteria but here in context to this site it is  a  Network tool designed to analyze,test and monitor  the weakness in different network protocols listed with it.

Attack on the following Network Protocol are possible as listed below.

Recently Cisco VTP Dos exploit  included in the latest version:0.7.1
Home Page : http://www.yersinia.net
Read more

11 DroidSheep | Sidejacking & Android phones

What is DroidSheep?

DroidSheep is a mobile form of "Firesheep" and also derives the name from it also.It does the same as firesheep that is Http Session Hijacking a.k.a Sidejacking.

How does this works?

Droidsheep works as the same way as firesheep but the only difference is that it wroks from a smartphone.

What do you need to run DroidSheep on Android phones?

    1. Android 2.1 or greater.
    2. Phone should be rooted.
    3. LibPcap similar to winPcap in PC.
    4. Public Wifi access.


The application can be obtained from two places

1.Android Market(Removed from here)

2.From the GET IT section of Droidsheep page.(Use this source)

Download DroidSheep Source code here

As droidsheep is no longer approved by android market so you need to follow the below video inorder to install it.

How to use droidsheep?

Inorder to use droidsheep ROOT previlages is most necessary.If you are unable to get this then try this.

Follow the below video to get an idea of how this application works.

If you find this post worth reading then do drop a comment or if you have any queries then let me know... :)
Read more

Delete this element to display blogger navbar

© 2018 SecurityHunk All Rights Reserved and Template by Fresh Blogger Templates