The Top 10 Things You Should Do After a Cyber Security Breach

Monday, September 02, 2013
While a major part of preventing all massive potential data intrusion damage lies in the preventative measures of secure code, updated security software, use of frequently updated applications and strong passwords for all access points to your data; sometimes cyber breaches happen no matter how well you have protected yourself. When this happens, prevention no longer matters for the moment and purely defensive and sanitary measures are your best friend.
Top 10 after do of a cyber breach
Now let’s cover some of these, as applied to assorted systems, including computers, hosting servers and your internal networks

1.Make Sure you have been Hacked

Not all strange system behavior is a sign of third party or malware intrusion. Sometimes the complex systems we operate go haywire because of changes we ourselves have made to them without being aware of the consequences.
If your website, computer or network is behaving strangely, not loading properly or giving you blank displays where data or a visual interface should be visible, first think back to any recent changes you might have made that could be responsible for the differences.
In a website hosting system, for example, changing so much as a single parameter within a site’s MySQL database template can lead to a completely downed website even though all the internal data is perfectly safe.

2.Speak to your Support Team

As a follow up to step one above and as a part of general policy, you should speak to your technical support team as soon as you have noticed strange things about your system. If you’re a website owner, this could be the people who manage your IT and hosting servers and if you’re the owner of a business or organizational network, this could be your IT support staff.
They can not only tell you about any changes they may have done to provoke a system failure, they can also help you investigate the wider scope of the intrusion you may be suffering.

3.Image your Servers or Drive

Imaging software for computer hard drives and the same sort of software for servers should always be close at hand. In case of a breach, before proceeding with cleanup and removal of all malicious factors, you should first image your drives or servers immediately in the condition they have at the time of their hack.
This will preserve a large body of evidence which can later be examined through digital forensics techniques, and this evidence vitally needs to be preserved so that you can formulate a better future intrusion response. Knowing if you were the victim of a genuine virus, entry by a human hacker who’s been modifying your code or something as simple as some spyware is crucial.

4. Disconnect from the Web (if possible)

As soon as you have imaged your servers, hard drives and all data or code collections, you should immediately disconnect your servers or computers from the wider web if at all possible.
This may cause chaos and disruptions for clients if you’re running a business website, but as a preventative step it’s vital. By keeping your machines and servers connected, you’re allowing the malware or human intruders who have breached them to continue maintaining malicious access, keep stealing data or causing further damage.
Unless you’re running security scans that require a web connection to work, your systems should be offline while you recover.

5. Change all Passwords

In addition to imaging of all data storage media and disconnection from external access, you should also be moving quickly to change all of your access passwords. They may have been the cause of your security breach and by leaving them as they are, you’re inviting future attacks even after you repair and reinstall everything.
Your machine itself, your hosting server access, your MySQL databases and your FTP should all have their passwords and the passwords of any sub-accounts on them reset immediately.

6. Perform Security Scans

Antivirus software, anti-malware programs and network intrusion protection software should all be tools that you keep close at hand for intrusion incidents. Once your intrusion has been detected and the above steps taken, perform scans that cover all the major bases against malware, spyware, intruders and scripting attacks.

7.Remove all Malicious Files and Code

Through the assistance of your IT support team, your service providers and the security software you have been running, you can start slowly identifying and destroying all the malicious code you find on your network, servers or computer itself. This can be a tedious process and if you’re not sure that you have successfully removed everything, you probably need to do a full re-install.

8. Back up Everything

Back up all of your valuable data as soon as possible after a data breach. You may have already performed a full scale imaging process on your entire servers or drives but specific section backups of key databases and data volumes are also a good idea because they allow you to compartmentalize valuable information for later analysis through digital forensics.

9. Re-install as much as Necessary

If the breach was very severe and especially if the breach affected a lot of data or code, you might have to perform a full scale re-installation of all your software. In a computer, this will require you to format your entire hard drive and re-install your operating system.
On your website hosting servers, you’ll almost certainly need to re-install all o your database management software, LAMP (Linux, Apache, MySQL and PHP) applications along with any other third party software you were running for your website.
Always re-install to the newest versions of whatever software you need to replace.

10. Document Everything

Finally, document everything. Document all of the steps you took, the processes you followed and the files you erased, re-installed and used to clean your machine. Documentation is useful for future digital forensics (if needed) and it preserves a chain of evidence that can be used as a future prevention reference.


About the Guest author: Stephan Jukicis,a freelance writer who generally covers a variety of subjects relating to the latest changes in whitehat SEO, mobile technology, marketing tech and digital security. He also loves to read and write about location-free business, portable business management and finance. Connect with Stephan on LinkedIn.
The Top 10 Things You Should Do After a Cyber Security Breach The Top 10 Things You Should Do After a Cyber Security Breach Reviewed by Satyajit (Admins,a.k.a Satosys) on Monday, September 02, 2013 Rating: 5

Ramnit : Worm that loves Facebook

Friday, January 20, 2012
 "Ramnit"  the worm with multifaceted spreading capabilities,first detected on 2010 for infecting local systems. Now the hackers behind it have redesigned it into a more advanced kind of worm.The worm has already stolen 45000 facebook credentials and still on move.





It is also confirmed that this worm is able to bypass the two level authentication used by banking organizations and online money transfer.Below I have taken the snapshot of the code of the worm that was detected in 2010.
 It comes from online malicious sources and   creates infected .html files through that it infects the executable and .dll files. As,depicted in the video below.





But as the worm has spread its root to financial and social media so it a big concern.Users are advised to change there credentials in every 14 days.
Ramnit : Worm that loves Facebook Ramnit : Worm that loves Facebook Reviewed by Satyajit (Admins,a.k.a Satosys) on Friday, January 20, 2012 Rating: 5

A Beginner's Guide to Android Rooting | Easy Reference

Saturday, October 22, 2011
Android in the one of the widely accepted OS in devices(phones,Tabs etc) these days because of its largely managed apps and control it give to its users.Where is honey so bears are there......
I mean because of its popularity it is one of the hotspot for attacker these days.So,I thought of sharing few security tips with my readers,for that the apps we need to work with will be functional on certain criteria that is we need to have root access on the device.Before going into the security part of it I would like to give my readers a basic idea about rooting.

What is Rooting in Android?

"Root" as you all may be knowing is related to Linux and it is analogous to administrator in Windows.So rooting an Android device means we get the full access and freedom on the functionality of the device,in windows language we can say we have the admininstrative previlage.So,the process by which we get the root access/previlage is called "Rooting".

Why we need Rooting?


1. Full access and control over the device.(Superuser access)

2. Make your device fast to your wish.

3. Add more apps of your choice.(Will be covered in the next Post)

4. Use the OS version of your choice.

Disclaimer: Root may cancel/void your warranty.Carry out the process at your own risk,the author will not be held responsible for any damage caused to your device.
How to root an Android device?

Instead of giving a detailed tutorial I will cover the basic overview of how this is exactly done and the tools and software associated with it.Here it is worth mentioning that all the android based devices do not have excatly the same rooting procedure.So,here I have listed out all the possible methods.

Note:Install Microsoft .Net Framework version 2.0 or greater.
         Enable USB debugging in device settings.
         Need USB drivers for your device and install it.
The first and foremost thing is to find the method which is compatible with your device(just Google it)

1.Rooting Android devices with SuperOneClick.

2.Rooting Android devices with Universal Androot

3.Rooting Android devices with Z4Root.

4.Rooting Android devices with flashRec

5.Rooting Android device using Easy Root.

6.Unrevoked Method:
If the above mentioned methods are not compatible with your device then you may try this method.This method is mostly used for HTC devices.You may download Unrevoker here.

 A Reference of how to "Root a HTC wildfire(Video Tutorial)".

You may need the below mentioned help before working with Unrevoker.
 
     * S-off tool  Revolutionary (Download)
    
     * You may need a Rom to get downgrade(Download)
   
     * Need to find the HBOOT version,as we may need it.


7.Rooting Android 2.3 Gingerbread devices with GingerBreak.

If the Android is 2.3 then no need to downgrade it to 2.2 and start rooting,you may see if your device is compatible with GingerBreak exploit.Follow the reference here as this may help you carry out the steps.

After you are done with rooting then you may install the desired OS version and add your custom ROM.

I hope this post will come to your help.If you feel that I need to add any thing else then feel free to drop a comment. :) 
A Beginner's Guide to Android Rooting | Easy Reference A  Beginner's Guide to Android Rooting | Easy Reference Reviewed by Satyajit (Admins,a.k.a Satosys) on Saturday, October 22, 2011 Rating: 5

Yersinia | Analyze and Test Deployed Networks

Sunday, October 16, 2011
"Yersinia" a type of bacteria but here in context to this site it is  a  Network tool designed to analyze,test and monitor  the weakness in different network protocols listed with it.

Attack on the following Network Protocol are possible as listed below.

Recently Cisco VTP Dos exploit  included in the latest version:0.7.1
Home Page : http://www.yersinia.net
Yersinia | Analyze and Test Deployed Networks Yersinia | Analyze and Test  Deployed  Networks Reviewed by Satyajit (Admins,a.k.a Satosys) on Sunday, October 16, 2011 Rating: 5

winAUTOPWN V2.7 | Windows Interactive exploit framework Tool

Wednesday, September 21, 2011
winAUTOPWN is a simple tool which works on windows platform and is quick in systems vulnerability exploitation.This is tool which takes less information from your side and does more effective work.



Why you should use this tool?

1. It takes simple inputs like IpAddress,Hostname,CMS Path

2. It also does a smart multi-threaded port scan (1 to 65535).

3. Exploits written by other writers can be added to it to evoke a remote shell from target box.

4.It helps the attacker to check the no of exploits it has used on the target box.

In the new version this tool has added few extra features like
  • Commandline parameters for Reverse Shell URL 
  • Mail-to,mail-from(Email server exploit)
Download
winAUTOPWN V2.7 | Windows Interactive exploit framework Tool winAUTOPWN V2.7  | Windows Interactive exploit  framework Tool Reviewed by Satyajit (Admins,a.k.a Satosys) on Wednesday, September 21, 2011 Rating: 5

Katana | A portable multi-boot security suite

Wednesday, February 09, 2011
Katana a tool which holds over 100 applications under it which can be run a USB/flash drive.As the new v2 has come up with a major addition called "Forge",which helps in further addition of new applications to the booting list.

>>>>>Learn how to use portable applicaions from your PC.

Portable Applications:

1.BackTrack
2.Computer Aided Investigative Environment(CAINE)
3.Ultimate Boot CD for Windows
4.Ophcrack Live

and many more......Find more portable applications here... :)

(Download)
Katana | A portable multi-boot security suite Katana | A portable multi-boot security suite Reviewed by Satyajit (Admins,a.k.a Satosys) on Wednesday, February 09, 2011 Rating: 5

More Security for Firesheep from Mozilla | HSTS

Wednesday, February 02, 2011
Firesheep was a buzz word few months ago then came the blacksheep to counter protect users from it.
The firesheep tutorial I demonstrated in a post shows how an attacker can gain access to any account(Twitter,Facebook,Gmail etc) with out even knowing the password using Sidejacking.
 Now with the increase of threats from the tools like Firesheep Mozilla has come with a concept of "HTTP Strict-Transport-Security", that will be employed in the version 4 of it and is available in the beta versions available.

What is "HTTP Strict-Transport-Security" ?

Actually when we access any login page it is done by default with http so our initial connection is unencrypted so an attacker can plant a MITM(Man in the Middle Attack) to recieve the connection from the user and the user feels that he/she is connected to the real server.Here comes the role of "HTTP Strict-Transport-Security" in protecting the user's session.What it does is that it guides the user's session to be strictly over Https there by encrypting the user's session from the initial point and also protect the sniffing of cookies.

How to use this feature?

1.A site need to ebable the "Strict-Transport-Security HTTP header",in order to allow the user to access a https login page and the firefox 4 will take care rest of the thing.

2.If you are using Firefox 3.6 you can use an addon called "ForceTLS" to use this functionality.

3.This is built in with Firefox 4 and in the beta but you can also use additonal controls by using "STS-UI" addon.

With this feature added to Firefox 4 the online activities of users from public
Wifi hotspots can be secured to some extent... :)
More Security for Firesheep from Mozilla | HSTS More Security for Firesheep from Mozilla | HSTS Reviewed by Satyajit (Admins,a.k.a Satosys) on Wednesday, February 02, 2011 Rating: 5
Powered by Blogger.