this blog is providing information and tutorial about ethical hacking. cybersecurity, cybercrime awareness. cybercrime investigation, cybercrime detection, information security.!
Thursday, August 18, 2022
How much safe your VPN is?
Well, the answer is...It depends!
You use a reliable VPN to be sure that you remain safe & secure while you browse the internet. When you don't want to be snooped on by government agencies or other companies, then you use a VPN. When you want to access the websites which have been blocked by your government, then you use VPN. When you don't want your ISP to track your online activities, you use VPN.
**VPN is a great tool, but they come with a caveat. **
Not all VPNs are equal. For example, if you are using a free VPN then you might be compromising your security as well as anonymity.
VPNs are used by individuals and the corporates as well by creating a private browsing session for each user.
Suppose you are travelling to a remote area and you need to connect to your company's network. In that case, you might need to connect to public Wi-Fi first. But such public Wi-Fi may let other users of that network to eavesdropping on what you are trying to do online. You should surely use a VPN in situations like this, because a VPN creates a secure tunnel between your computer/laptop and the VPN server which will hide your all online activities and location too.
Indeed, VPN allows you to protect your online privacy, and prevent your ISP to track your online activities. All VPNs work by connecting your device to VPN server and then bypassing your internet traffic through your VPN service provider's internet connection.
This process successfully hides your browsing information...
The very same process does not let any MiTM attacker to gather or monitor your online activities too.
___
Private Browsing is NOT equal to VPNs.
Though Google Chrome offers you 'InCognito' mode. Microsoft Edge, Firefox offer 'Private Browsing' modes. But you should not make a mistake of assuming that these modes are replacement of a VPN.
These modes may not let data from being stored on your local device or computer. These modes may not save your browsing history, for example. But it does not mean that no one can track you. Of course, your ISP can still track you. The vendors whose plugins are working in such modes, may also track your behavior.
On a side note, Opera does have an inbuilt 'VPN' feature.
___
Why FREE VPNs may not be safe for you?
1. Free VPN tools can compromise your security.
You may not realize that if you are using some Free VPN service, then the application you are using to connect with VPN server may not be safe. It is very much possible that such apps may contain malware within themselves. Such malware could also be used by cyber-attackers to steal your data, gain unauthorized access to your data or machine, or launch a malicious attack on your system. In 2016, a paper was published on VPN tools' privacy and security issues for Android devices. ICSI Network and Security Group had found that as many as 283 Android VPN apps contained some form of malware presence. So many of these apps were asking for too many of permissions, quite more than they required.
Same can be true of all sort of VPN applications...You need to be watchful here.
**2. Free VPN tools track your online activity. **
The same study found that 72% of Free VPN services were using third-party tracking tools in their software. It means those third-parties were collecting users information and sell it for money to the highest bidders. The objective was to allow targeted advertising to those users by online-advertisers.
A VPN is supposed to protect your activity while you are browsing the internet. But they were doing the opposite by tracking your online activities.
Some free VPN tools totally hide this information about -- whether they share or sell user data, however others service providers may mention this in their privacy policies. A normal user ironically never tends to read their privacy policies.
3. Free VPN tools limit data usage too.
Let us take an example, that you want to watch a movie from Netflix, but it is not available in your country or region, because of any restriction. VPN would let you do that. But in case of using FREE VPNs, they may place some cap or limitation of the amount of data you can use through their tool. This limitation can be daily or monthly. There may be other types of limitations too.
Thus, if you want to protect your data or mask your location for a considerable length of time, then Free VPNs are not for you.
4. Free VPNs slow down users’ internet speed.
They do. I have seen that even paid VPN services succumbing to slow internet speed many a times. They do slow the internet-speed available to you, because ultimate objective is to push you to buy their paid version of the service.
5. Free VPN tools target users with ads.
These services need revenues to sustain their operations. If they cannot charge in case of FREE VPN, then they use direct advertising to boost their revenues. The ads are served to you, without even your permission. Ads not only slow down the internet speed further, they also can distract you from doing some productive work.
The presence of ads on a free VPN service is by default a privacy concern because it is likely the provider is sharing your online activity with third-party services.
___
The Secure VPNs
Different vendors have different parameters for delivering security to you.
If a VPN provider is ensuring your online privacy, providing transparent privacy policies, fixing data-leaks, and not tracking its users, then you can say that it is a 'safe' VPN.
The whole idea of VPN is to hide your IP address or disguise it. But sometimes, there can be some software bugs or coding errors, that may generate flows which may result in leaking your IP address or location. That's why, when you check online review of customers on internet, you should look for any history of IP-address leakage. If it was there, when it happened, how, or how it was stopped.
There should be ZERO Logging by VPN. They should not collect or log any data you or other users are sharing on such networks. They should not log any log-in credentials, files you have downloaded, website you visited, or your search queries. It is essential to maintain your anonymity. You don't want your VPN tools to have any ability to record or store such information even on your computer. If it does, then a malicious attacker can compromise the application and take out all the information, before it is purged.
You should activate the Multi-factor Authentication (MFA) feature of these VPN applications. This extra security feature is mandatory in modern times of cyber-crimes.
When a malfunction happens, your device using the VPN typically goes back to using its default internet connection. This happens automatically. Worse, this also usually happens without you being aware and your IP address gets leaked with a few seconds.
That's why, you should surely check that your VPN application has a VPN Kill-switch. This feature is important because it will result in automatic exit of specific programs that were using VPN internet connect. This feature comes very handy, when your VPN connection drops due to any reason. Most VPN services include one as part of the client application. When it detects a problem, the kill switch triggers and stop all of your device’s traffic from reaching the internet. It effectively kills your connection.
A VPN from a reliable & trustworthy service-provider should encrypt your data and online browsing history to shield them from hackers and ISPs.
Paid-versions of VPNs usually include ad-blocking tools, as well as features like malware protection and unlimited bandwidth, which keep your data secure.
Why is cyber security risk assessment so important?
A cyber security risk assessment is the process of identifying, analysing and evaluating risk. It helps to ensure that the cyber security controls you choose are appropriate to the risks your organisation faces.
Risk assessment is a process that includes:
* Identifying vulnerabilities, threats, and risks that can cause any
sort of damage to the organization
* Estimating the probability of risks being realized
* Defining mitigation priorities by risk severity and the likelihood
of occurrence
In risk management, assessment is preceded by framing (establishing the context of risks) and followed by responding to and monitoring these risks.
Without a risk assessment to inform your cyber security choices, you could waste time, effort and resources. There is little point implementing measures to defend against events that are unlikely to occur or won’t impact your organisation.
Likewise, you might underestimate or overlook risks that could cause significant damage. This is why so many best-practice frameworks, standards and laws – including the GDPR (General Data Protection Regulation) and DPA (Data Protection Act) 2018 – require risk assessments to be conducted.
Please understand very clearly that it is an ongoing process that helps you evaluate your security controls, detect issues, and estimate their impact.
5-Major Reasons For Conducting An Cyber/IT Risk Assessment:
1. To prevent hacks, data breaches, and data loss. A periodic review of cybersecurity controls allows you to detect and close off vulnerabilities before hackers can exploit them.
2. To examine network security. An independent risk assessment provides an unbiased examination of your network’s security controls. It helps you update knowledge on your protected environment, especially after significant changes like deploying new software, installing new hardware, or moving to a new location.
3. To improve decision-making. Determining the impact of discovered risks is an important part of a risk assessment. This information is useful for making further decisions related to cybersecurity: budgeting, planning improvements, prioritizing fixes, etc.
4. To reduce spending on cybersecurity. An assessment is a time- and cost-consuming procedure. But in the long term, it can save you from more severe losses by preventing data breaches, hacks, and compliance violations.
5. To ensure compliance. Risk management is part of many laws, regulations, and standards including NIST Special Publications, HIPAA, PCI DSS, and GDPR. Failing to comply with those that are relevant to your business may lead to substantial fines.
A REVIEW CHECKLIST FOR NETWORK SECURITY ANALYSIS
All network analyzers/sniffers have the ability to capture data from network. But most of them only do some simple statistics then throw pages of numbers to the users. Especially in a big network with heavy traffic, network administrators have to figure out a network problem even a simple one.
The Security Analysis is a perfect example. The Security Analysis is an analysis profile which has the power to detect the following network anomalies and attacks:
* ARP attack
* Worm activity
* DoS attack
* TCP port scanning
* Suspicious conversation
Review a Checklist of Analysis Tasks
There are a large number of tasks which a Security Analyst should perform. These tasks can be considered proactive or reactive.
Proactive methods include BASELINING network communications to learn the current status of the network and application performance. It can also be used to spot network problems before they are felt by the network users.
For example, identifying the cause of packet loss before it becomes excessive and affects network communications helps avoid problems before they are even noticed.
Reactive analysis techniques are employed after a complaint about network performance has been reported or when network issues are suspected. Sadly, reactive analysis is more common.
The following lists some of the analysis tasks that can be performed using Wireshark:
@@ Find the top talkers on the network
@@ Identify the protocols and applications in use
@@ Determine the average packets per second rate and bytes per second rate of an application or all network traffic on a link
@@ List all hosts communicating
@@ Learn the packet lengths used by a data transfer application
@@ Recognize the most common connection problems
@@ Spot delays between client requests due to slow processing
@@ Locate misconfigured hosts
@@ Detect network or host congestion that is slowing down file transfers
@@ Identify asynchronous traffic prioritization
@@ Graph HTTP flows to examine website referrals rates
@@ Identify unusual scanning traffic on the network
@@ Quickly identify HTTP error responses indicating client and server problems
@@ Quickly identify VoIP error responses indicating client, server or global errors
@@ Build graphs to compare traffic behavior
@@ Graph application throughput and compare to overall link traffic seen
@@ Identify applications that do not encrypt traffic
@@ Play back VoIP conversations to hear the effects of various network problems on network traffic
@@ Perform passive operating system and application use detection
@@ Spot unusual protocols and unrecognized port number usage on the network
@@ Examine the startup process of hosts and applications on the network
@@ Identify average and unacceptable service response times (SRT)
@@ Graph intervals of periodic packet generation applications or protocols
Networks vary greatly in the traffic seen. The number and type of network analysis tasks you can perform depends on your network traffic characteristics.
Deploying Sensors for Intrusion Prevention Systems (IPS)
Today, I am sharing the crux of that discussion with you…
Technical factors to consider when selecting sensors for deployment in an organization include the following:
~~ The network media in use
~~ The performance of the sensor
~~ The overall network design
~~ The IPS design (Will the sensor analyze and protect many systems or just a few?)
~~ Virtualization (Will multiple virtual sensors be created in the sensor?)
Important issues to keep in mind in an IPS design include the following:
1. Your network topology:
Size and complexity, connections, and the amount and type of traffic.
2. Sensor placement:
It is recommended that these be placed at those entry and exit points that provide sufficient IPS coverage.
3. Your management and monitoring options:
The number of sensors often dictates the level of management you need.
Locations that generally need to be protected include the following:
* Internet: Sensor between your perimeter gateway and the Internet
* Extranet: Between your network and extranet connection
* Internal: Between internal data centers
* Remote access: Hardens perimeter control
* Server farm: Network IPS at the perimeter and host IPS on the servers
-
Please let me know of what do you think about this in the comment section. You can also share with all if the information shared here helps you in some manner.
TYPES OF CYBER ATTACKS
Saturday, August 13, 2022
Kali Linux 2022.3 – Added Bruteshark And Test Lab Environment
Offensive Security has released Kali Linux 2022.3 with major updates.
It is a popular platform for ethical hackers and penetration testers, and an operating system for identifying vulnerabilities within a network.
Previously in Kali Linux 2022.2 version were added 10 tools.
Kali’s 2022.3’s Release Highlights:
- Discord Server – Kali’s new community real-time chat option has launched!
- Test Lab Environment – Quickly create a test bed to learn, practice, and benchmark tools and compare their results
- Opening Kali-Tools Repo – We have opened up the Kali tools repository and are accepting your submissions!
- Help Wanted – We are looking for a Go developer to help us on an open-source project
- Kali NetHunter Updates – New releases in our NetHunter store
- Virtual Machines Updates – New VirtualBox image format, weekly images, and build-scripts to build your own
Other Kali updates
- For people who use Xrdp (like Win-KeX), there is a new look to the login
- Fixed up some confusion between fuse and fuse3
- Some maintenance to our network repository, and shrank /kali from 1.7Tb to 520Gb!
New Tools Added –
Kali Linux would not be a release without some new tools!
A quick run down of what has been added (to the network repositories):
- BruteShark – Network Analysis Tool
- DefectDojo – Open-source application vulnerability correlation and security orchestration tool
- phpsploit – Stealth post-exploitation framework
- shellfire – Exploiting LFI/RFI and command injection vulnerabilities
- SprayingToolkit – Password spraying attacks against Lync/S4B, OWA and O365
There have been numerous packages updates as well.
Kali NetHunter Updates
Full Android 12 support is getting closer to being a reality with 6 new kernels in our NetHunter repository and updates to the NetHunter app.
It is still not for the fainthearted as a little tinkering is required to install all the components individually but we’re getting closer to releasing the first OnePlus image soon.
For the meantime, we have updated the apps in our NetHunter Store to the latest releases, including:
- aRDP, aSPICE, bVNC, Opaque = v5.1.0
- Connectbot = 1.9.8-oss
- Intercepter-NG = 2.8
- OONI Probe = 3.7.0
- OpenVPN = 0.7.38
- Orbot = 16.4.1-RC-2-tor.0.4.4.6
- SnoopSnitch = 2.0.12-nbc
- Termux = 118
- Termux-API = 51
- Termux-Styling = 29
- Termux-Tasker = 6
- Termux-Widget = 13
- Termux-Float = 15
- WiGLE WiFi Wardriving = 2.64
If you would like to get involved and help out with the development, or just like to chat to like-minded Android tinkerers, why don’t you join us in the NetHunter channels on our new Discord server? We’d love to see you around!
Existing Installs:
If you already have an existing Kali Linux installation, remember you can always do a quick update:
┌──(kali㉿kali)-[~] └─$ echo “deb http://http.kali.org/kali kali-rolling main non-free contrib” | sudo tee /etc/apt/sources.list
┌──(kali㉿kali)-[~] └─$ sudo apt update && sudo apt -y full-upgrade
┌──(kali㉿kali)-[~] └─$ cp -rbi /etc/skel/. ~
┌──(kali㉿kali)-[~] └─$ [ -f /var/run/reboot-required ] && sudo reboot -f
You should now be on Kali Linux 2022.3 We can do a quick check by doing:
┌──(kali㉿kali)-[~] └─$ grep VERSION /etc/os-release
VERSION=”2022.3″
VERSION_ID=”2022.3″
VERSION_CODENAME=”kali-rolling”
┌──(kali㉿kali)-[~] └─$ uname -v
#1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali6 (2022-07-07)
┌──(kali㉿kali)-[~] └─$ uname -r
5.18.0-kali5-amd64
NOTE: The output of uname -r may be different depending on the system
Evil Twin attack
Evil Twin Attack is attack is frequently carried upon wireless access points with malicious intentions. This attack happens when...
-
A typical organization is divided into operational, middle, and upper level. The information requirements for users at each level differ. ...
-
How to Know Who Logged into your computer and when? In Windows, there is one in-built too will records all events in your computer ...