Denial Of Service Attacks

1. Definitions

We begin by defining Denial of Service and Distributed Denial of Service.

1.1 What is a DoS?

As the name implies, DoS is a Denial of Service to a victim trying to access a resource. In many cases it can be safey said that the attack requires a protocol flaw as well as some kind of network amplification.

Denial of Services is also an attack on a computer system or network that causes a loss of service to users, typically the loss of network connectivity and services through the the consumption of bandwidth of the victim network, or the overloading the computational resources of the victim system. (see the Wikipedia definition)

The motivation for DoS attacks is not to break into a system. Instead, it is to deny the legitimate use of the system or network to others who need its services. One can say that this will typically happen through one of the following means:

1. Crashing the system.
2. Deny communication between systems.
3. Bring the network or the system down or have it operate at a reduced speed which affects productivity.
4. Hang the system, which is more dangerous than crashing since there is no automatic reboot. Productivity can be disrupted indefinitely.

DoS attacks can also be major components of other type of attacks.

1.2 What is a Distributed DoS?

A Distributed DoS (DDoS) is the combined effort of several machines to bring down victim. In many cases there is a master machine that launches the attack to zombie machines that are part of a bot network, as shown below in Figure 1. Some bot networks contain many thousands of machines used to launch an attack.



With DoS and DDos defined, we'll now take a look at attacks that affect the consumption of resources, such as Smurf attacks, and then address attacks like SYN Flood that affect network connectivity.

Note that the consumption of resources is most evident when it involves the exploitation of bandwidth, CPU usage, memory, disk space, or access to other computers and resources.

2. Bandwidth exhaustion attacks

A bandwidth exhaustion attack is where an attacker tries to consume the available bandwidth of a network by sending a flood of packets. This is most often accomplished with the help of several other machines. There is soon a flood of malicious nonsense packets on the network in large quantity, whereby the chances of survival of any good, legitimate packets becomes remote. Eventually the network becomes choked with these packets, and the network is effectively cutoff from the Internet and services are denied.

An ideal example of a bandwidth exhaustion attack would be Smurf attacks. Consider a scenario with an ISP and three clients, as shown below in Figure 2. In this scenario, the ISP receives extensive traffic for client 2 on its backbone. Since the connection to client 2 is of limited capacity and smaller than the ISP's backbone, it can't push all the data received for client 2 through the link to client 2. Therefore it will start to drop packets, and the TCP connections will lead to retransmissions of the lost/dropped packets. There will be a time when a legitimate host wants to connect to Client 2's network, but this will timeout and hence a DoS will occur.



2.1 Smurf Attack

Named after a popular program which generates this attack, an ICMP echo request is sent to a broadcast network address (acting as an amplifying agent) with the source address of the victim spoofed. This results in a storm of replies from that network which, if large enough, has the power to take the victim's network down. It is to be noted that there is not much a victim can do about this attack since the link is simply overloaded with packets.

There are always three parts of a Smurf Attack:

1. Attacker
2. Amplifier - a router
3. Victim

This attack succeeds because the amplifier is misconfugred to forward the directed broadcasts.

Suppose the address range 172.30.164.0 to 172.30.164.255 is assigned to a company which has an amplifier, and an attacker sends packets with destination 172.20.164.255. All the routers and systems from attacker to the amplifier will not see the difference between this IP and 172.30.164.10 (an IP from the range). The packet reaches the amplifier and the amplifier notices that this is the broadcast address, so it forwards the request to all the systems on the network/subnet. This is known as directed broadcast.

The two crucial components of this attack were:

1. A misconfigured router forwarding the broadcast request to the subnet.
2. Machines that will respond to this ICMP broadcast request.

Going deeper we can see that the amplifier also makes itself and its network a victim of this attack.

Victims are typically chosen by attackers from IRC where bots (automated programs) are kept to look for the address of victims. Hackers often exchange the information about amplifiers with each other so when a mass attack takes palce it usually appears to come from all over the globe.

Powertech provides realtime statistics of the top amplifiers currently on the Internet.

Below is a typical depiction of the dumps at the Victim. These are ICMP Echo replies received at the Victim's end. Then Figure 3 provides an overview of a Smurf attack.

Code:
10:10:17.100000 172.30.164.1 > victim: icmp: echo reply 10:10:18.300000 172.30.164.76 > victim: icmp: echo reply 10:10:18.310000 172.30.164.10 > victim: icmp: echo reply10:10:19.110000 172.30.164.223 > victim: icmp: echo reply 10:11:09.190000 172.30.164.51 > victim: icmp: echo reply 10:11:09.240000 172.30.164.18 > victim: icmp: echo reply10:11:10.110000 172.30.164.98 > victim: icmp: echo reply 10:11:10.600000 172.30.164.18 > victim: icmp: echo reply 10:11:10.790000 172.30.164.240 > victim: icmp: echo reply

2.2 How to protect against Smurf attacks

Step 1. Amplifier Configuration. The router should be configured so that it does not forward directed broadcasts onto networks. It is important to note that the broadcast has to be disabled on all the routers and not merely just the external ones. Command "no ip directed-broadcast" on Cisco routers should do the job in most cases. This will also ensure that employees on the internal network won't be able to launch Smurf attacks. However it is also advisable that one has a filtering device (such as a firewall) on the perimeter, thereby providing an extra layer of security.

Step 2. Configure the server operating systems. Servers should be configured so that they will not respond to a directed broadcast request. FreeBSD is one such system which by default does not respond to this request. Other systems can be similarly configured, and this will be discussed in the next section.

Step 3. Victim issues. As mentioned earlier, not much can be done at the victim's end and damage will be done unless victim's ISP takes some actions to block these ICMP Echo Reply floods. Even if the victim's parameter router denies the ICMP Echo Reply, the link from the ISP to the victim's site will suffer.
2.3 ICMP Ping Flood attacks

Ping Floods are where an attacker floods the victim's network with large number of ICMP Echo Requests - such as by flooding the network as fast as possible. In this scenario, filtering the incoming packets might help, however, if the victim is on a modem instead of a high-speed connection, nothing can be done. However the catch in this attack is that if not done properly the attacker can also be counter-attacked, so he needs to be on a faster network than the victim. In most cases, mitigating this attack involves isolating spoofed IPs. This attack is easy to peform since there are many tools on Internet and little knowledge is required to execute a ping flood.
2.4 Fraggle attacks

A Fraggle attack is a Smurf variant that uses UDP instead of ICMP. In this case, the ports echo, chargen, daytime, qotd are used to trigger responses. These ports are also susceptible to a pingpong attack, and therefore these serves should be turned off or blocked.

3. Network connectivity attacks

These attacks overload the victim so that its TCP/IP stack is not able to handle any further conections, and processing queues are completely full with nonsense malicious packets. As a consequence of this attack, legitimate connections are denied. One classic example of a network connectivity attack is a SYN Flood.
3.1 Example: SYN Flood attacks

A SYN Flood is where an attacker sends packets with a spoofed source IP Address and a TCP SYN Flag set to the server (victim). Let's first assume that the attacker knows which ports are open on the server. Since the source IP is spoofed, the response sent to the SYN packet by the server will never receive a reply back. The server will keep waiting until it times out. If this happens for a very large number of connections the result will be a DoS, since the server won't be available for any legitimate connections and its resources will be choked.

As will be shown, this attack exploits a vulnerability of the TCP protocol, by the way in which the TCP three-way connection is established. This is shown below in Figure 4.



3.2 Protecting against SYN Flood attacks

There are several things that can be done to protect against SYN Flood attacks.

1. Decrease the TCP Connection Timeout on the victim server.
2. Use a filtering device, like a firewall, at the perimeter which works as an intermediary in forwarding the connections to the server.
Use of a server farm: this can also help in fighting the SYN Flood since you will have number of the servers to answer the request, but this also has limitations and overhead considerations.

A detailed article on SYN Flood protection by Mariusz Burdach was previously published on SecurityFocus. Therefore, only a short overview of SYN Flood protection will be discussed in this section.
3.2.1 Protecting Microsoft Windows from a SYN Flood attack

Microsoft Windows has a mechanism to detect and start SYN Flood protection. The SYN flooding attack protection feature detects symptoms of SYN flooding and responds by reducing the time the server spends on connection requests that it cannot acknowledge.

Specifically, TCP shortens the required interval between SYN-ACK (connection request acknowledgements) retransmissions. TCP retransmits SYN-ACKS when they are not answered. As a result, the allotted number of retransmissions is consumed more quickly and the unacknowledgeable connection request is discarded faster.

When enabled, the system monitors the connections maintained by TCP and starts the SYN attack flooding protection when the any of the following conditions, symptomatic of SYN flooding, are found:

* The total number of connections in the half-open (SYN-RCVD) state exceeds the value of TcpMaxHalfOpen
* The number of connections that remain in the half-open (SYN-RCVD) state even after a connection request has been retransmitted exceeds the value of TcpMaxHalfOpenRetried
* The number of connection requests the system refuses exceeds the value of TcpMaxPortsExhausted. The system must refuse all connection requests when its reserve of open connection ports runs out.

Microsoft suggests the following registry settings:

Code:
hkey_local_machine \system \currentcontrolset \services \tcpip \parameters \synattackprotect=1 REG_DWORD hkey_local_machine \system \currentcontrolset \services \tcpip \parameters \tcpmaxconnectresponseretransmissions=2 REG_DWORD hkey_local_machine \system \currentcontrolset \services \tcpip \parameters \tcpmaxdataretransmissions=3 REG_DWORD

3.2.2 Check Point protections against a SYN Flood attack

In the first scenario, we look at Check Point as a simple proxy to the victim server. This is shown below in Figure 5.



In this scenario Check Point acts a proxy to the server and responds to all the requests sent to the server. A request is forwarded to the server only if there is a corresponding ACK. The drawback of this configuration is that normally a perimeter firewall is very heavily loaded and this configuration will induce further load on it. The advantage is that the server will always be free to only take legitimate connections.

In the second scenario, we look at Check Point preventing a SYN Flood attack while residing in a transparent proxy configuration. This is shown below in Figure 6.



Here Check Point passes all the connections, irrespective of whether they are legitimate or not, to the server but also starts a timer once it sees a ACK/SYN from the server. If there is no corresponding ACK from the Client and the timer expires, the firewall will send a RST to the server thereby preventing its queue from overflowing with illegitimate connections. The advantage of this configuration is that load on firewall is reduced considerably as compared to previous configuration. The drawback, however, is that now the server sees all the connection attempts.

4. Conclusion

In this article we've defined DoS and DDoS and looked at attacks that affect the consumption of bandwidth: Smurf attacks, ICMP ping floods, and Fraggle attacks. We've also taken a first look at attacks that affect network connectivity, such as SYN Flood attacks and some of the ways to prevent them.

Next time in part two, we'll look at the consumption of other precious resources such as CPU time, disk space, memory utilization, and then examine any vulnerable printers that may be DoS attack vectors on the network. We'll also discuss Teardrop attacks, LAND attacks, Ping-of-death, and finally discuss some common Win32 worms that have been used to build botnets that perform broad DDoS attacks. Finally, we'll discuss mitigation techniques and best practices for preventing DoS attacks. Stay tuned.

SQL Injection Tutorial

How SQL Works:
-Before you can perform an injection, you must first understand how SQL works.
-When you register a new username and password on a website, the username and
password you entered is kept in the site’s member table; the username and
password are put in their separate columns.
-When you log in with the username and password you registered, the login page
looks for a row in the member table that has the same username and password that
you supplied.
-The login form takes the conditions that you supply, and searches the member
table for any rows that satisfy those conditions.
-If a row exists that has both the same username and password, then you are
allowed to go on your account.
-If no row is found, the login page will tell you that the account you specified
does not exist, or that your username and password is wrong.
-SQL can also display information on a website.
-If a site has a news section, there may be an SQL table that, for example, holds
all of the article names.
-More often than not, articles on a website are identified by a number.
-When you click on a link to an article, you are usually able to see the number of
the article you clicked on by looking at the URL of the page you are on.
*For the next three bullets, please refer to figure B below*
-When you click a link like this, www.site.com/news.asp?ArticleID=10, the link
tells the site to look in the table that stores the article names for an article who’s
“ArticleID” is 10.
-Once the website has found this column in the table, it may look for a column
named “Title” in the same row and display this value as the article’s title on your screen.
-In this case, “Cats” is what you would ultimately see on your screen as the title of
the article.
-It is important to realize that what is typed after the “=” sign in the URL is part of
an SQL command;

All About SQL Injection

SQL injection!
SQL injection is the most common and videly used exploit by hackers all over the
world...few days back i was just doing some SQL injection test on Indian govt sites,
I was shocked to see how many imp govt sites r open to it....this is a big thread
for us...a malicious hacker can do a lot of harm if he wish to.

Vocabulary:

* SQL: Server Query Language-used in web applications to interact with databases.
* SQL Injection: Method of exploiting a web application by supplying user input
designed to manipulate SQL database queries.
* "Injection": You enter the injections into an html form which is sent to the web
application. The application then puts you input directly into a SQL query.
In advertantly, this allows you to manipulate to query...

Prerequisite:

* A background of programming and a general idea of how most hacking methods are done.
see this pic --->




Application:

* Hacking a SQL database-driven server (usually only the ones that use unparsed user
 input in database queries). There is still a surprising number of data-driven web
applications on the net that are vulnerable to this type of exploit. Being as typical
as all method, the frequency of possible targets decreases over time as the method
becomes more known. This is one those exploits that aren't easily prevented by a
simple patch but by a competent programmer.

Use:
First, let's look at a typical SQL query:
SELECT fieldName1, fieldName2 FROM databaseName WHERE
restrictionsToFilterWhichEntriesToReturn

Now, to dissect...
The red areas is where criterion is inputed. The rest of the query structures the
query.

* SELECT fieldName1, fieldName2 - Specifies the of the names of fields that will
be returned from the database.
* FROM databaseName - Specifies the name of the database to search.
* WHERE restrictionsToFilterWhichEntriesToReturn - Specifies which entries to return.

Here is an example for somebody's login script:

SELECT userAcessFlags FROM userDatabase WHERE userName="(input here)"
AND userPass="(input here)"

The idea is guess what that application's query looks like and input things
designed to return data other than what was intended.

In the example, input like the following could give gain access to the
administrator account:

User: administrator
Pass: " OR ""="

Making the query like this:

SELECT userAcessFlags FROM userDatabase WHERE userName="administrator"
AND userPass="" OR ""=""

As you can see, ""="" (nothing does indeed match nothing)
Note: Injections are rarely as simple as this...

One can be creative and use error messages to your advantadge to access other
databases, fields, and entries. Learn a little SQL to use things like UNION to
merges query results with ones not intended.On the security side, parse user data
and get rid of any extra symbols now that you know how it's done.

The idea in this example is to break out of the quotation marks.
When stuff is inside quotation marks, the stuff isn't processed as code or anything
but as a phrase and what it is.

The password injection was: " OR ""="
What this does is close the string that was started by the quotation mark in the part
userPass=". Once you break out, THEN stuff is considered code. So, I put OR ""="
after I break out of the string. You will notice that it is comparing two quotation
marks with one, but the quotation mark already built in by the application finishes
it so we have this:
userPass="" OR ""=""
Notice how the first and last quotation marks are not colored and are not built in.

Additional notes:
This was just an extremely simplified version and you will probably need to learn a
little SQL to fully understand.

Here are a few SQL terms that do other things:
UNION: You use this to merge the results of one query with another. You may put
things like SELECT after UNION in order to search other databases and stuff.
Sometimes you may need to use ALL in conjuction to break out of certain clauses.
It does no harm so when in doubt you could do something like:
" UNION ALL SELECT 0,'','hash' FROM otherDatabase WHERE userName="admin
The key when using UNION is to make your new query return the same amount of columns
in the same datatype so that you may get the results you want.

:-- This works sometimes to terminate the query so that it ignores to the rest
 of the stuff that might be fed afterwards if you don't like it. For example:
SELECT * FROM userDatabase WHERE userName="admin";--" AND userPass="aH0qcQOVz7e0s"

NOT IN: If you have no idea which record you want you could record cycle
(you request vague info, and you put what you already got in the NOT IN clause so
that you can get the next entry)
Usage:
SELECT userName userPass FROM userDatabase WHERE userName NOT IN
('Dehstil','Twistedchaos')

EXEC: This command should never work, but if it does...you win; you could do anything.
For instance, you could inject something like this:
';EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:

All my examples so far have dealt with read processes. To manipulate a write process,
here is an example for those who know what their doing:
INSERT INTO userProfile VALUES(''+(SELECT userPass FROM userDatabase WHERE
userName='admin')+'' + 'Chicago' + 'male')
This example would theoretically put the admin's password in your profile. 

How to Hide Data in Image, Audio & Video Files: Steganography

Ever wondered to know how to hide secret messages in images, audio and video files? Well, in this post I will take you through a concept called steganography using which, it is possible to hide your secret information in image files, songs or any other file of your choice. At the end of this post, you can also download free stegnographic tools and start hiding your data.

What is Steganography?

Steganography is a means of obscuring data where secret messages are hidden inside computer files such as images, sound files, videos and even executable files so that, no one except the sender and the receiver will suspect the existence of stealth information in it. Steganography may also involve the usage of cryptography where the message is first encrypted before it is concealed in another file. Generally, the messages appear to be something else such as an image, sound or video so that the transfer of secret data remains unsuspected.

The main advantage of steganography over other methods such as cryptography is that, it will not arose suspicion even if the files fall in the hands of a third party. Unlike cryptographic messages, stegnographic messages will no way attract the attention of a third party by themselves. Thus stegnanography has an upper hand over cryptography as it involves both encryption and obscurity.

What are the Applications of Steganography?

Steganography is mainly used to obscure confidential information/data during storage or transmission. For example, one can hide a secret message in an audio file and send this to another party via email instead of sending the message in the textual format. The receiver on the other end will decrypt the hidden message using the private decryption key. In a worst case scenario, even if a third party does manage to gain access to the email, all he can find is the audio file and not the hidden data inside it. Other usage of steganography include digital watermarking of images for reasons such as copyright protection.

Eventhough steganography has many useful applications, some may use this technique for illegitimate purposes such as hiding a pornographic content in other large files. Roumors about terrorists using steganography for hiding and communicating their secret information and instructions are also reported. An article claiming that, al-Queda had used steganography to encode messages in images and transported them via e-mails, was reported by New York Times, in October 2001.

How do Steganography Tools Work?

Stegnography tools implement intelligent algorithms to carefully embed the encrypted text messages or data inside other larger files such as an image, audio, video or an executable file. Some tools will embed the encrypted data at the end of another file so that there will be enough room for storing larger data.

There are many steganography tools available online but only a few are able to work flawlessly. I did not find any tool that worked perfectly on both small and large data. However I have  managed to develop my own tool that can work perfectly on all types of files and all size of data. The tool is called “Stego Magic“. You can download it from google.

How to Use Stego Magic?

Suppose you want to hide a text message inside a JPG file:

1. Place the JPG and the text file (.txt) in the same folder as that of StegoMagic_TXT.exe

2. Run StegoMagic_TXT.exe and follow the screen instructions to embed the text message inside the JPG image.

3. Note down the secret decryption key.

Now you can send this image to your friend via email. To decrypt the hidden message, your friend should load this JPG file onto the Stego Magic tool and use the secret decryption key.

Malware Infection on Websites

                                                

Malware is a type of software that attempts to steal your personal information or use your computer to do things that you do not intend. Malware infections quite often lead to harsh consequences, causing victim’s computer become slow or unresponsive. Malware is usually spyware, deceptive adware, etc. Common malwares are free screen savers that secretly generate advertisements, malicious web browser toolbars that take your browser to different pages than the ones you expect or could be key logger programs that can transmit your personal data to others.

Detecting the Malware

Malwares affect client systems but use innocent webservers to reach a large number of clients. You may not have any evil intentions but someone might have secretly modified your web pages on your website, by injecting malicious code, insert iframes, adding links to a different website which actually hosts the malware in it or caused due to the third party ads that appear on your website. Quickly detecting malware on your website and removing it will avoid dangers to your visitors and reputation of your site.

Let us look at few ways to detect the presence of malware on your website:

• Check Google’s search results for your website, a warning message saying “This Site May Harm Your Computer” would be displayed near the title of the web page if any malware is found.
• Use Microsoft Webmaster tools to scan your website to find out all rogue pages on your site that are possibly infected with malware and identify external links on your site that point to pages hosting malware.
• Scan your website at McAfee Site Advisor to obtain a detailed report of possible malware issues and malicious links on your website.

Removing the Malware

Once it is confirmed that your website is infected with malware, you have to stop all advertising media on your website and make the whole site offline temporarily so further damage can be prevented until you are sure that your site is free of malware.

The first step when you find a malware on your site is to do a thorough check for more malwares. There could be other pages on your site that download and install rogue programs on the user’s computer without his/her consent. Check your server logs for any suspicious activity, like failed login attempts, remote command execution, unknown user accounts, etc.

You have to check mainly for attacks which would be the main reason for such behaviors. Your website will become more vulnerable to attacks when you are not using the latest security updates. When a hacker gains access to your website, he would modify webpages so that his malicious code gets executed and the spam links get displayed or redirect to a malicious website when people view your web pages.

If the malware in your website is injected due to hacking attacks, check the HTML source code of your web page for suspicious blocks of JavaScript code or hyperlinks that point to bad neighborhoods hosting malware. Look for any recently modified and uploaded files on your web server.

Most of the hackers would not place the malware on the infected website, instead they would inject a redirect code on the legitimate website so identify such recent activity on your website where user content can be added. Discard the pages which are suspected to have malware and redesign these pages.

Update your web server software and website software, install all latest patches available. Perform manual checks instead of depending on just antivirus software because generally, the antivirus software will only check for malwares installed or present on your system.

Key prevention measures to be taken in common suspected areas for malware behavior:

• Downloads available on your site: Scan your web server for malicious server files.
• Automatic redirects from your site: The redirect code is typically an I-frame that will silently attack the visitor’s browser with the browser specific exploits. Anti-virus scans on your web server or website will rarely detect this redirect code hence perform manual checks in the web page source code.
• Third party advertisements present on your site: Use only reputed, conscientious advertisement providers and regularly monitor them to be sure they stay clean.
• Malicious links posted in your site due to user activities: You can begin checking your site by making a list of all links to external sites. Then verify that you’ve intentionally put those links on your site. Next check your web pages for any obfuscated code.
• Hacking attacks on the site: Keep monitoring the web logs for hacking activities by any Web monitoring tools.

Removing the Flaw

Use encrypted protocols like SSH and SFTP for file transfer instead of clear text protocols like telnet or FTP. Telnet and FTP are both considered insecure, since they transmit user credentials in a way that anyone with access to the network can read, hence they are called clear text protocol. SSH and SFTP are based on an encrypted protocol which prevents network sniffing.

Use strong password policies in your website so that no one can break into user accounts and mess up.

Configure your website not to allow users to link directly to any form of executable files or to insert JavaScript into the user modifiable areas.

The malware may have been inserted into your application through some vulnerability in your code. Detecting this and fixing it may be the most important step to take. This will be discussed in more detail in more articles to come in the next few issues.

Monitoring the Website

Update any software you use on your web server, and make sure you are always running the most recent versions, with recent security patches. Perform regular scans on your site for security vulnerabilities using any vulnerability auditing scanners. Use security updated management tools to track down missing patches and apply those patches instantly. Actively monitor areas in your website, which is affected by user activities for suspicious links or executable files. Run webmaster tools frequently to review about any malware in your website.

Use Your Mobile Phone As WebCam For Your PC

Are you thinking of buying webcam for your PC? If  you have a mobile phone with a camera then no need to waste money for buying a webcam. A free software called SmartCam have solution for this. Nowadays most of we have a mobile phone with camera. So it is an useful software for us to use our mobile phone camera as webcam. It is an open source project software.

Click here to download this software

You have to install this software both on your mobile phone and computer. Connect your phone and computer via bluetooth and now use the webcam.

Also we have another software called mobiola. With mobiola client you can use your webcam via data cable, bluetooth or wifi. You have to install mobiola client both on your pc and mobile

Top 10 Tips to love about windows 8

Now that the Windows 8 Developer Preview has been available for a while, it is easier to take a step back and evaluate it without the powerful emotions that strike most people the first time they deal with it. Looking at it from a long-distance perspective, there’s a lot to like about Windows 8, especially if you are ready to cut the cord from an installed desktop application base and transition to Web applications and Windows 8 native applications. Here are 10 things I think are great about Windows 8.

1: It’s designed for tablets and touch

Microsoft is working hard to make Windows 8 work well with tablets and the touch UI paradigm, to the point of alienating traditional desktop users. It remains to be seen how Microsoft will respond to criticism over the Metro UI. But I can tell you that after using a phone with the Metro UI for well over half a year now, I think it is extremely effective for touch, and I would love to have a tablet running Windows 8.

2: Apps “share” data

One of the big changes in the application development model is that native Windows 8 apps (those using the new Metro UI and WinRT API) really do not directly communicate with each other, even through the file system, except via carefully defined interfaces. While this handcuffs developers a bit, it means that when applications do share data, Windows is aware of how they do it and makes it easy. For example, you could have an application that handles images and use it to share the pictures with, say, an application to upload them to Facebook. That unleashes a lot more power for developers because it means that applications from different vendors will work together seamlessly, and the developers do not even have to write anything specific for the application theirs works with.

3: The apps can be integrated into the OS

Just as the applications can “share” with each other, they can do the same thing with Windows itself. Again, this allows some really neat integrations to be done without much work by application makers. You can see things like a new social networking application come out and within weeks, Windows will be able to use your friends who are on it in its contact list, or the pictures can go into your picture gallery. The possibilities are endless.

4: It offers ARM support

While the ARM CPUs may not be for everyone or every purpose, lots of mobile vendors have a deep commitment to that platform and understand it well. The ARM devices will not be able to run legacy Windows applications, but they will run the Windows 8 native apps without a hitch. That’s great news for hardware makers, software developers, and users.

5: It beefs up security

The new programming model for Windows 8 native applications is extraordinarily secure. While I am sure that exploits will be found, it will be difficult for the native applications to break free of their chains. Microsoft has really flipped it around. Instead of allowing everything and slowly adding restrictions over the years (and breaking applications in the process, like XP SP2 and Vista did), it’s starting from an “allow nothing” stance.

6: App markets will benefit developers and users

Application markets are nothing new. Even Vista had one (although no one seems to remember it). With Windows 8 native applications, Microsoft is making the application market the primary way of getting apps onto the computer, much like Windows Phone 7. That’s great news for developers who need to get some more visibility for their applications and who do not want to deal with payments processing and such, especially for low-priced apps. And the application market is great for users, too. As we’ve seen, app markets encourage lower prices, and Microsoft will surely apply the same strict quality control that it has to the Windows Phone 7 app market.

7: System restore is easier

Microsoft has built new utilities into Windows 8 that makes it much easier than ever to send the system back to “out of the box,” while preserving your data. Providing a more appliance-like experience is critical for the typical user, and the help desk will appreciate it too.

8: Cloud sync is everywhere

While not everyone is in love with the cloud as an idea, Windows 8 has great facilities for allowing applications and users to automatically sync data between devices using the cloud. That’s great for users who can seamlessly transition between their tablet and desktop PC (and perhaps their phone), as well as for tech support, who can just replace a broken device instead of worrying about data loss.

9: It offers simplified administration and configuration

The Control Panel has been stripped down to the bare essentials, and you can’t even think about tasks like registry editing, defragging, etc., from the Metro UI. (You can do these tasks through the legacy desktop, if needed, but that won’t work for ARM devices.) Throughout Windows 8, a primary theme has been giving the user a more appliance-like “It just works” experience. Power users might howl about it, but the truth is, the Windows experience is still far more complex than the average user wants to deal with. Windows 8 is a great move in the right direction for those users.

10: System stability is improved

Windows 7 has really set the standard for system reliability. Short of hardware or driver problems, the old blue screen of death is almost never seen anymore. Windows 8 takes this to the next level. The same changes to the application development model also improve system stability. Applications can’t run over each other’s data easily, and the new WinRT API just does not allow the kinds of shenanigans that have caused unstable systems over the years. If you stick with native Windows 8 applications, reboots (other than for patching) and crashes should be extraordinarily rare.

Virtual Keyboard and the Fight Against Keyloggers

Welcome to Safe Bank’s net banking. Please enter your net banking userid and password.

Userid: 15236523 
Password: ************* 
Action = submit.jsp

and you have logged into net-banking application. Wow!!! You can now view your account balance, do third party funds transfer and much more.

Location: 
C:\WINDOWS\system32\config.dll

File contents: 
08-Aug-08: 08:00: Window title: Welcome to Safe Bank net banking
Userid: 15236523 [tab] Password: Welcome123!

Behind the Scenes: 
When you browsed to your net banking page and typed in your username and password to login into the online bank, there was a malicious program you were unaware of, named keylogger running in the background logging all the keystrokes into a config.dll file located in C:\WINDOWS\system32 folder. This file contains all the keystrokes typed in. It contains the window title and all those things typed into that window along with few other details. This file will then be uploaded to the attacker’s website which he can use to his benefit.

These keyloggers are easily and freely available on internet and also integrated with other programs like rookits making its detection very difficult. So your chance of being infected by such a malicious code even if you have an updated antivirus/anti-Spyware program is about 70%. See the brighter side, you still are 30% safe. Sounds scary..huh!!! So lets keep our focus to internet banking websites and see how we (BANK + USERS) can try to avoid compromising login credentials.

Round 1: Fight!

This is when password stealers were simple keyloggers. Whatever keys were typed in, they were captured by the malicious code and logged into some file in simple or encrypted form. This file was later uploaded to attacker’s site or simply the logs were mailed. This attack can be mitigated by virtual keyboards.

Figure 1.shows the basic virtual keyboard screenshot. It works simply by clicking the keyboard layout by a mouse. So the basic keyloggers cannot capture the mouse clicks and hence the passwords cannot be logged.

Fig 1. Virtual Keyboard (HDFC Net banking VKB)

You can achieve the same by Windows built-in virtual keyboard. Go to Start -> All Programs -> Accessories -> Accessibility -> on-screen keyboard.

Fig 2. Virtual Keyboard (Windows in-built)

Round 2: Fight!

Now the malware coders were challenged as to how to defeat the virtual keyboards.

Mouse clicks cannot be logged. However their x-y positions can be logged which can then be used to get the keys clicked using their x-y position on the web page.

This technique is much simpler to mitigate by simply randomizing the keyboard layout. However total randomizing can make end users unhappy. So a good tip can be randomizing only selected 2 or 3 rows of alphabets instead of all of them.

Round 3: Fight!

Now what? We have the x-y positions but how do we know that what keys were present in that x-y co-ordinate for that period as they have been randomized. Simple!!! Why not take a snap of the keys pressed. Screen snap-shot of say 1 by 1 cm can be taken when a mouse click occurs. The letter present in snapshot is the password of the victim. This code along with basic keylogger can get log username typed from keyboard and snapshots of keys pressed by mouse-clicks from the other code.

Fig 3: Screen shots of password typed as captured by the malicious code.

One well known worm using this technique was W32/Dumaru. How can this be mitigated? How about changing the characters on the keys pressed to something other, on a mouse click? Or simply put change all keys (instead of a single key) to a # sign or a * sign. So if I click on letter “p” then it changes to “#” and then to original letter.

Fig 4: p changes to # on a mouse click

So the key captured on the screen shot will be  instead of correct characters.

Round 4: Fight!

Again our frustrated malicious minded person, let us call them “Malman” (We can’t call them either a hacker or a script kiddie so in short Malman :) ) thinks of a way to fight their way to capture passwords. What if they capture screen shot of the keys clicked just a second after (or rather say few milliseconds after) the mouse is clicked. So when I click on “P” it becomes “#” on mouse click and back to “P” when click is released. Boom! Take a screen-shot of the key now. This works fine.

This can be defeated by changing the keys after the mouse click. So if I press “p”, it changes to “#” and then to “r”. Character “r” is captured in the screen shot.

Fig 5: p changes to # on a mouse click and then to r

This can however make the end-user uncomfortable because each time the keys location will change and he will have to search for his password which will greatly help shoulder surfing. Hovering is a technique in which the keys will automatically be selected and entered into the password field when a mouse cursor is held over it for a few milliseconds. Again the time delay has to be such that it should cause neither user in-convenience nor aid shoulder surfing.

The fight continues

The fight will go on and on. New attack vectors target Win32 API calls made to access HTML document where virtual keyboard fails to protect your passwords. However this can be mitigated in combination with products from different vendors like Trusteer’s Rapport, Juniper’s “Secure Virtual Workspace” or by secured remote terminal sessions using citrix. But then this again adds to increased cost and security overheads. Not many banks will happily implement such solutions.

So should we as end users let the “Malman” get all our passwords. No. We can fight back by taking few precautions from our side in combination with few other trusted tools which can help us protect our passwords.

• Regularly update your Operating System for any patches released.
• Use latest anti-virus and anti-spywares engines. Regularly update with detection signatures and periodically scan your system
• Also do scan for any rootkit present on your system with tools like Rootkit Revealer
• Always use updated version of internet browsers with latest patches. Do not forget to regularly update the patches
• Simple freeware tools like KeyScrambler Personal firefox add-on can add to the increased security
• Keep yourself educated with different techniques used by Malman to steal passwords

At last

This is what-in-short you can do to secure your Bank accounts. I mainly focused on Virtual Keyboards and how their fight against keyloggers evolved. But there are many attack vectors like Phishing etc. on internet used to compromise Bank accounts. Both Bank and the end customers should fight side by side to defeat the Malman. Individually it is impossible to fight them back