Virtual Keyboard and the Fight Against Keyloggers

Welcome to Safe Bank’s net banking. Please enter your net banking userid and password.

Userid: 15236523 
Password: ************* 
Action = submit.jsp

and you have logged into net-banking application. Wow!!! You can now view your account balance, do third party funds transfer and much more.

Location: 
C:\WINDOWS\system32\config.dll

File contents: 
08-Aug-08: 08:00: Window title: Welcome to Safe Bank net banking
Userid: 15236523 [tab] Password: Welcome123!

Behind the Scenes: 
When you browsed to your net banking page and typed in your username and password to login into the online bank, there was a malicious program you were unaware of, named keylogger running in the background logging all the keystrokes into a config.dll file located in C:\WINDOWS\system32 folder. This file contains all the keystrokes typed in. It contains the window title and all those things typed into that window along with few other details. This file will then be uploaded to the attacker’s website which he can use to his benefit.

These keyloggers are easily and freely available on internet and also integrated with other programs like rookits making its detection very difficult. So your chance of being infected by such a malicious code even if you have an updated antivirus/anti-Spyware program is about 70%. See the brighter side, you still are 30% safe. Sounds scary..huh!!! So lets keep our focus to internet banking websites and see how we (BANK + USERS) can try to avoid compromising login credentials.

Round 1: Fight!

This is when password stealers were simple keyloggers. Whatever keys were typed in, they were captured by the malicious code and logged into some file in simple or encrypted form. This file was later uploaded to attacker’s site or simply the logs were mailed. This attack can be mitigated by virtual keyboards.

Figure 1.shows the basic virtual keyboard screenshot. It works simply by clicking the keyboard layout by a mouse. So the basic keyloggers cannot capture the mouse clicks and hence the passwords cannot be logged.

Fig 1. Virtual Keyboard (HDFC Net banking VKB)

You can achieve the same by Windows built-in virtual keyboard. Go to Start -> All Programs -> Accessories -> Accessibility -> on-screen keyboard.

Fig 2. Virtual Keyboard (Windows in-built)

Round 2: Fight!

Now the malware coders were challenged as to how to defeat the virtual keyboards.

Mouse clicks cannot be logged. However their x-y positions can be logged which can then be used to get the keys clicked using their x-y position on the web page.

This technique is much simpler to mitigate by simply randomizing the keyboard layout. However total randomizing can make end users unhappy. So a good tip can be randomizing only selected 2 or 3 rows of alphabets instead of all of them.

Round 3: Fight!

Now what? We have the x-y positions but how do we know that what keys were present in that x-y co-ordinate for that period as they have been randomized. Simple!!! Why not take a snap of the keys pressed. Screen snap-shot of say 1 by 1 cm can be taken when a mouse click occurs. The letter present in snapshot is the password of the victim. This code along with basic keylogger can get log username typed from keyboard and snapshots of keys pressed by mouse-clicks from the other code.

Fig 3: Screen shots of password typed as captured by the malicious code.

One well known worm using this technique was W32/Dumaru. How can this be mitigated? How about changing the characters on the keys pressed to something other, on a mouse click? Or simply put change all keys (instead of a single key) to a # sign or a * sign. So if I click on letter “p” then it changes to “#” and then to original letter.

Fig 4: p changes to # on a mouse click

So the key captured on the screen shot will be  instead of correct characters.

Round 4: Fight!

Again our frustrated malicious minded person, let us call them “Malman” (We can’t call them either a hacker or a script kiddie so in short Malman :) ) thinks of a way to fight their way to capture passwords. What if they capture screen shot of the keys clicked just a second after (or rather say few milliseconds after) the mouse is clicked. So when I click on “P” it becomes “#” on mouse click and back to “P” when click is released. Boom! Take a screen-shot of the key now. This works fine.

This can be defeated by changing the keys after the mouse click. So if I press “p”, it changes to “#” and then to “r”. Character “r” is captured in the screen shot.

Fig 5: p changes to # on a mouse click and then to r

This can however make the end-user uncomfortable because each time the keys location will change and he will have to search for his password which will greatly help shoulder surfing. Hovering is a technique in which the keys will automatically be selected and entered into the password field when a mouse cursor is held over it for a few milliseconds. Again the time delay has to be such that it should cause neither user in-convenience nor aid shoulder surfing.

The fight continues

The fight will go on and on. New attack vectors target Win32 API calls made to access HTML document where virtual keyboard fails to protect your passwords. However this can be mitigated in combination with products from different vendors like Trusteer’s Rapport, Juniper’s “Secure Virtual Workspace” or by secured remote terminal sessions using citrix. But then this again adds to increased cost and security overheads. Not many banks will happily implement such solutions.

So should we as end users let the “Malman” get all our passwords. No. We can fight back by taking few precautions from our side in combination with few other trusted tools which can help us protect our passwords.

• Regularly update your Operating System for any patches released.
• Use latest anti-virus and anti-spywares engines. Regularly update with detection signatures and periodically scan your system
• Also do scan for any rootkit present on your system with tools like Rootkit Revealer
• Always use updated version of internet browsers with latest patches. Do not forget to regularly update the patches
• Simple freeware tools like KeyScrambler Personal firefox add-on can add to the increased security
• Keep yourself educated with different techniques used by Malman to steal passwords

At last

This is what-in-short you can do to secure your Bank accounts. I mainly focused on Virtual Keyboards and how their fight against keyloggers evolved. But there are many attack vectors like Phishing etc. on internet used to compromise Bank accounts. Both Bank and the end customers should fight side by side to defeat the Malman. Individually it is impossible to fight them back

Database Links Security

Database links (DBLinks in Oracle) are a technique for one database to connect to a remote database and execute queries. The originating database uses an account in the remote destination database to connect. This connection thus uses a username and password of an account in the destination database. The connection has the privileges of the account that’s used in the destination database.

Insecurities with Database Links

Database links introduce several insecurities for the destination database:

• If the originating database is insecure and compromised, the database link could be used by an unauthorized user
• If the originating database is compromised, the user name and password of the database link connection could be compromised
• An adversary who gains access to a database link can execute queries with the privileges of the DBLink account

Best Practices for Database Links

Database links can be made secure through a combination of technical and process controls:

Technical Controls

1. Use Private Database links, instead of Public links. This restricts access to the DBLink to the owner of the DBLink.
2. Use accounts with minimal privileges to access the database link.
3. If the DBLink requires read access to some tables, and update access to some other tables, split this into two DBLinks with different accounts – one with Read, and the other with Update privileges
4. Ensure that the DBLink password is stored encrypted in the originating database
5. Ensure that the DBLink connection is encrypted in transit, by using, say SSL.
6. Restrict the IP addresses from which the DB Link connection may originate.

Process Controls

1. Evaluate the need for database links and authorize them only when they are essential
2. Verify the level of privileges required for the database link - give the minimal set of privileges required to function
3. Assign different accounts for database links from different sources - this allows better auditing and tracking
4. Insist that the originating database server adhere to security best practices - remember security is only as strong as the weakest link, and the originating database should be secure
5. Perform periodic audits of the originating database to ensure that it complies with the best practices for database security, and that the database links adhere to the technical controls specified above

Recommended Reading

1. Database Links: A Definition in Plain English, Lewis Cunningham,http://it.toolbox.com/blogs/oracle-guide/database-links-a-definition-in-plain-english-7023
2. Database Links, Pete Finnigan’s Oracle Security Forum,http://www.petefinnigan.com/forum/yabb/YaBB.cgi?board=ora_sec;action=display;num=1181549741
3. A Simple Oracle Host Based Scanner, Pete Finnigan,http://www.securityfocus.com/infocus/1522
4. Public DBLinks or Not?, AskTom, http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:5991749853476
5. Guidelines for Securing the Network, Keeping your Database Securehttp://download.oracle.com/docs/cd/B28359_01/network.111/b28531/guidelines.htm#i1009371
6. Oracle Database Listener Security Guide,http://www.integrigy.com/security-resources/whitepapers/Integrigy_Oracle_Listener_TNS_Security.pdf
7. Database Links, Ask Tom, http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:456820211101

Web Services Security - The Basics

Wiki defines Web services as “Application programming interfaces (API) or web APIs that can be accessed over a network, such as the Internet, and executed on a remote system hosting the requested services”. So putting this down in simpler words, it is a function of the application that can be made available for use for other developers to integrate it into their applications.

Say I have a piece of code which precisely calculates the age of any girl based on 5 questions and their answers. Believe me this is really a difficult piece of code and everyone will wish to have it on their website. Now if I publish this code as a service, you as a developer can simply use this service and integrate into your application instead of itching your gray cells and trying to write one of your own. Since web services can be used to connect to data sources from even outside the enterprise, they are prone to hacker attacks.

Before moving towards basic security concepts lets first understand the four technologies that form the basis of web services:

1. Extensible Markup Language (XML):
1. XML is plain text.
2. XML was designed to carry data, not to display data
3. XML tags are not predefined. You must define your own tags
4. XML is designed to be self-descriptive
5. XML is the standard of web services standards.
2. Simple Object Access Protocol (SOAP):
   
   1. SOAP is a communication protocol
   2. SOAP is a format for sending messages
   3. SOAP is designed to communicate via Internet
   4. SOAP is platform independent
   5. SOAP is language independent
   6. SOAP is based on XML
   7. SOAP is simple and extensible
   8. SOAP allows you to get around firewalls
   SOAP consists of 2 parts, the header which contains information about SOAP messages like management and securing the message etc and the other part is the body which contains the message payload.
3. Web Services Description Language (WSDL):
1. WSDL is used to describe Web services
2. WSDL is used to locate Web services
3. WSDL describes the set of operations the web service provides.
4. WSDL is a set of rules to describe your web service & how you can communicate with my web services, how & what messages will be sent in SOAP envelope.
4. Universal Description, Discovery & Integration (UDDI):
1. UDDI is a directory for storing information about web services
2. UDDI is a directory of web service interfaces described by WSDL
3. UDDI defines the set of services supporting the description & discovery of other web services providers, the web services they make available & the interfaces which may be used to access this services.

Web Services thus aim to deliver interoperability and reusability thus helping different business applications to talk/transact across multiple platforms. And like any other technology, even Web Services do not have security incorporated or enabled by default. Web Services Security can broadly be divided into two categories: interface and implementation security and message security.

Interface and implementation security includes controls such as Secure Socket Layer (SSL), Access Control Lists (ACL) etc. These are the basic web based security implementations.

For message security, XML mechanisms such as WS-Security, the Security Assertion Markup Language (SAML), XML Signature and XML Encryption can sign, encrypt, and authenticate message data. Thus the trust in confidentiality and authenticity in the transit of data increases giving a greater sense of security. Let us have their quick overview.

XML Signature

Defines XML syntax for digital signatures. Also referred as XML DSig, it is more flexible than PGP and other form of digital signatures as the fact that it operates on XML infoset rather than binary data. (XML infoset in simpler words is describing XML document as a data model in terms of information items). It is core to WS-Security, XKMS, and other Web services security standards. It provides integrity and non-repudiation, and can play a vital role in the process of key sharing that is needed by XML Encryption.

Another important concept is canonicalization. Verifying data integrity in XML is particularly challenging since the differences in platforms and XML parsers can result in logically equivalent documents being physically different. So canonicalization signs only the necessary element, eliminating meaningless differences like white space and line endings.

XML Encryption

XML Encryption provides end-to-end security for applications that require secure exchange of structured data. XML-based encryption is the best suited way to handle complex XML requirements for security in data interchange applications. TLS/SSL is originally used to encrypt the data. However XML encryption provides a mechanism for security requirements that are not covered by SSL. The following are the two important areas not addressed by SSL:

• Encrypting part of the data being exchanged
• Secure sessions between more than two parties

XML encryption are divided into two main parts:

• Symmetric encryption for data transfer
• Asymmetric encryption to exchange the eyes which can be used for data transfer later.

XML Encryption applies standard algorithms to data and then stores that encrypted result in XML.

SAML

Security Assertion Markup Language is an XML-based standard for exchanging authentication and authorization data between security domains, that is, between an identity provider (a producer of assertions) and a service provider (a consumer of assertions). Assertion applies to an individual or entity which is attached to the message. Thus in short SAML provides a set of rules that can be used to obtain these assertions from trusted third party services that make authorization and authentication decisions about individuals and entities. After the authority makes its assertion, SAML also provides a way to exchange the information.

Also the other single most important problem that SAML is trying to solve is the Web Browser Single Sign-On (SSO) problem

WS-Security

WS-Security deals more with SOAP security and is the member of WS-* family of web service specifications which were published by OASIS. The protocol specifies how integrity and confidentiality can be enforced on messages and it abstracts different security technologies into claims and tokens. Its main focus is the use of XML Signature and XML Encryption to provide end-to-end security.

WS-Security describes three main mechanisms:

• How to sign SOAP messages (using XML signatures) to assure integrity and non-repudiation.
• How to encrypt SOAP messages (using XML encryption) to assure confidentiality.
• How to apply for security token, hoe to link them to identity & how they are attached to web services.

Auditing

Other than above mentioned basic controls, auditing should also be enabled. This can help detect any “broken into” kind of requests. They can also reveal larger weaknesses that might affect regulatory compliance and even corporate governance. Auditing can basically include the following categories:

• Authentication, Authorization & Access
• Data Changes & Application Changes
• Threats such as invalid inputs
• Resource management
• Startups & Shutdown events
• Faults & Errors

Other Concerns

Other issues which needs to be considered while securing web services include:

1. Brute force attack: Proper measures should be in place to avoid brute force attacks to gain privilege access. Recently improper controls against brute force attack on Yahoo web services was in the news. The attacker was able to gain login credentials for hundreds of users (with weak passwords). The account must be locked out after specified number of incorrect login attempts.
2. Spoofing attack: An attack can spoof user information to gain unauthorized access. If the compromised credentials belong to an administrator account, the outcome can be worse. Proper authentication mechanism can help tackle spoofing attacks.
3. Security bugs: Bugs in the application can be used by attacker to launch attacks like XPATH/SQL injection, Input variable manipulation etc. The user input should be proper validated.
4. XML Denial of Service attack: The vulnerability mainly exists in the XML parser. Specially crafted payloads can bring the XML parser down to its knees. Some known attacks are XML Bombs, External Entity attacks. There are various ways to defend against DoS attacks like disabling unwanted services like inline DTD schemas in our XML parsing object, securely configuring the behavior of XmlReader etc.

Thus we have done a brief walk-through of security concepts and controls that can be implemented in Web Services. Controls for encryption, authentication, authorization, non-repudiation and availability when implemented correctly can help protect your web services against preying eyes of hackers.

Fake Microsoft Updates pages Used in Attacks Targeting Firefox on Windows

Cyber criminals are now using fake Microsoft update website to launch fake Antivirus attack targeted at users of FireFox on Windows.  Chester Wisniewski, a Senior Security Advisor at Sophos Canada is warning of the new “distribution model” of a fake antivirus which attempts to fool customers into thinking they’re actually downloading and installing a security solution from Microsoft Update. 
Cyber crimials have created a fake page which looks like original Microsoft update page but the property of this web page is that it only comes when you are surfing on firefox on windows. This type of social engineering has been used many times to launch this type of attacks. In this attack a warning is shown to users with a message that Critical update is needed.
Users update their system to protect from attackers but they are actually infecting their system with a malicious software.

Hacker Group Sets Nov 5, 2011 as Facebook Destruction Date

There are millions of people worldwide who use Facebook every day for uploading pictures, videos, and information about where they are, what they're doing, and how they're feeling. There is one group of people, however, who has decided to make a stand against the privacy, or lack thereof, that Facebook has given its millions of users.

The matter of a user's privacy on websites like Facebook has been an ongoing debate among a very large number of people. Despite the fact that the vast majority of Facebook itself can be set to only allow your friends to see anything at all except your name and a picture, the applications that millions of people use through Facebook are constantly getting your information and using it for any number of things -- everything from deciding which ads to show on sidebars to gaining your computer's location based on your IP address.

Certain members of the hacker group known as Anonymous have decided to make a stand against Facebook; through a message sent to Internet users all over the world via YouTube, the group has declared it is going to "kill Facebook" Nov. 5, 2011. Strange that an organization devoted to finding, getting, and using your information is concerned about the privacy that Facebook offers.

Information from mashable.com states that this comes after the group's Google+ account, called "Your Anon News," was banned. The group also has plans to create its own social networking website at AnonPlus.com. They state that this networking website will be "a new social network where there is no fear of censorship, blackout and nor of holding back." 

Copyright © TechloMedia

Hackers hit canadian news paper website and claim Quebec PM dead

Again a big hacking news and this time it came from Canada. This time hackers hacked the website of a prominent Canadian newspaper early on Tuesday and posted a false news item alleging Quebec Premier Jean Charest had died of a heart attack. This false entry was on the page for more than a hour and it was re tweeted by many users before deletion. But this false news was spreaded among thousands of Internet users.
"We offer our most sincere apologies to the premier. Measures are being taken to find the person responsible for this crime," the newspaper said on its website.
Nothing about the hacking is disclosed by the newspaper. It said that engineers are working to find flaw and the hacker who did this.

Type of Computer Virus

Computer Virus is a program that can copy itself and attaches itself with your files and data and corrupt it. Computer viruses are many type like Worm, Trojan, Rootkit, Spyware, Maleware, Adware. You can save your data by using a anti virus software. Here you will find the brief definition of these viruses. 

Computer Worm – A computer worm is a self-replicating computer program, which uses a computer network to send copies of itself. it does not need to attach itself to an existing program.

Trojan Horse – It’s a destructive program. Trojan horses do not make copies of themselves, but they can be just destroy the computer data.


Rootkit – Rootkit has the power to take your computer under control.


Spyware – This virus can be install in your system without you permission & collect your personal information without your knowledge. You can say that a spyware is a keylogger.

Adware – It can be download advertisement package in your system without your permission. These advertisement can be a form of pop up.

Check a login page is real or fake

Hackers use this trick very often. They send you a link via email or other method. when you click on that link you find a login page there. They insist you t enter your personal information on it like email id, password etc. When you enter this detail in that login form your account can be hacked. But you can test whether this login page is real or fake by following methods.

1. When you open that login page see your address bar if you find their HTTPSthen this page is not a fake page. In HTTPS "s" means Secure. No hacker can make a secure fake login page.

2. This is also an very simple method when you open that login page don't fill the information & click on submit means leave all the column blank and click on submit. If this page is a fake page then it will take you to another page directly otherwise you will get an error message that you'll have to fill all the column.

so by using these method you can make yourself safe.

Test Your Windows XP Security

Security is becoming more and more important as new viruses and worms (Lovesan Worm, Blaster Worm...etc) keep being unleashed. That's why it's important to make sure your system is protected.Put your system to the test. Here are some great websites that will test your security:


Hackerwhacker.com

GRC

Testmyfirewall

Auditmypc