Robot in the Family

SIEM (Security Information and Event Management)

What is SIEM?

Security information and event management (SIEM) is an approach to security management that combines SIM (security information management) and SEM (security event management) functions into one security management system.

§  A SIEM system collects logs and other security-related documentation for analysis. Most SIEM systems work by deploying multiple collection agents in a hierarchical manner to gather security-related events from end-user devices, servers, network equipment -- and even specialized security equipment like firewalls, antivirus or intrusion prevention systems.

Why is SIEM Necessary?

Ø  Rise in data breaches due to internal and external threats.

Ø  Attackers are smart and traditional security tools just are not enough.

Ø  Mitigate sophisticated cyber-attacks.

Ø  Manages large volumes of logs from multiple sources.

Ø  Meets exact compliance requirements

Why do organizations use it?

Threat Management:

The ability to detect risky scenarios and common attacks, as well as attack paths defined by the organization itself.

Compliancy:

                Joining the logs and reports of multiple systems within the organization, enabling an easy access and analysis by a built-in framework in each system.

Forensic Support:

Ø  The information available within SIEM is very valuable from a forensic perspective and can greatly aid a forensic analyst in his or her investigation.

Ø  SIEM allows forensic analysts to search within logs of many systems in a centralized way, without the need of re-collecting the log files of compromised systems.

Protection (What and How):

Implementation of SIEM:

Requirements:

  Ø  All Unix systems need a centralized logging system to be developed for the SIEM. Databases require a great many configuration steps

  Ø  Each web server needs a new process installed to monitor the web logs. Taking logs from cloud resources on AWS involves another complex series of configuration procedure.

  Ø  SIEM requires highly skilled IT personnel resources.

  Ø  Patching, hardware refreshes and overall change management have to be coordinated with SIEM

Use Cases:

SIEM Tools:

•       Hewlett Packard Enterprise (HPE) ArcSight

•       Splunk Enterprise Security (ES)

•       IBM Security QRadar

•       AlienVault Unified Security Management (USM)

•       LogRhythm SIEM

•       McAfee Enterprise Security Manager (ESM)

•       Micro Focus Sentinel Enterprise

•       SolarWinds Log & Event Manager

•       Trustwave SIEM Enterprise and Log Management Enterprise

•       RSA NetWitness Suite

"It takes time and effort to get things set up, and this is going to be a manpower initiative proportional to the complexity of organization"

Petya Ransomware

Petya Ransomware:

Description:

                It’s not all over with wannacry. A new variant of the petya ransomware was discovered by security researchers which is spreading rapidly by the help of same Windows SMBv1 vulnerability and brings into confusion worldwide by shutting down computers at corporates, power supplies, and banks across Russia, Ukraine, Spain, France, UK, India, and Europe and demanding $300 in bitcoins.

What is Petya?

                Petya has been in existence since 2016. It differs from typical ransomware as it doesn’t just encrypt files, it also overwrites and encrypts the master boot record (MBR).

In this latest attack, the following ransom note is displayed on infected machines, demanding that $300 in bitcoins be paid to recover files:

How it works:

By taking inspiration from wannacry ransomware petya appears to have same SMB work based on the NSA's ETERNALBLUE exploit. Unlike other traditional ransomware, Petya does not encrypt files on a targeted system one by one.

Instead, Petya reboots victim’s computers and encrypts the hard drive's master file table (MFT) and rendering the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk.

Petya replaces the computer's MBR with its own malicious code that displays the ransom note and leaves computers unable to boot. Once it is done you will be able to observe a text stating:

"If you see this text, then your files are no longer accessible, because they are encrypted. Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service."

Targeted file extensions:

.3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.

djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf

.pdf.php.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb

.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls.xlsx.xvd.zip.

WannaCry Ransomware

WannaCry Ransomware 

Earlier today, a massive ransomware campaign hit computer systems of hundreds of private companies and public organizations across the globe – which is believed to be the most massive ransomware delivery campaign to date.

The Ransomware in question has been identified as a variant of ransomware known as WannaCry (also known as 'Wana Decrypt0r,' 'WannaCryptor' or 'WCRY').

Like other nasty ransomware variants, WannaCry also blocks access to a computer or its files and demands money to unlock it
Once infected with the WannaCry ransomware, victims are asked to pay up to $300 in order to remove the infection from their PCs; otherwise, their PCs render unusable, and their files remain locked.

In separate news, researchers have also discovered a massive malicious email campaign that's spreading the Jaff ransomware at the rate of 5 million emails per hour and hitting computers across the globe.

Ransomware Using NSA's Exploit to Spread Rapidly

What's interesting about this ransomware is that WannaCry attackers are leveraging a Windows exploit harvested from the NSA called EternalBlue, which was dumped by the Shadow Brokers hacking group over a month ago.

Microsoft released a patch for the vulnerability in March (MS17-010), but many users and organizations who did not patch their systems are open to attacks.

The exploit has the capability to penetrate into machines running unpatched version of Windows XP through 2008 R2 by exploiting flaws in Microsoft Windows SMB Server. This is why WannaCry campaign is spreading at an astonishing pace.

Once a single computer in your organization is hit by the WannaCry ransomware, the worm looks for other vulnerable computers and infects them as well.

Infections from All Around the World

In just a few hours, the ransomware targeted over 45,000 computers in 74 countries, including United States, Russia, Germany, Turkey, Italy, Philippines and Vietnam, and that the number was still growing, according to Kaspersky Labs.

According to a report, the ransomware attack has shut down work at 16 hospitals across the UK after doctors got blocked from accessing patient files. Another report says, 85% of computers at the Spanish telecom firm, Telefonica, has get infected with this malware.

Another independent security researcher, MalwareTech, reported that a large number of U.S. organizations (at least 1,600) have been hit by WannaCry, compared to 11,200 in Russia and 6,500 in China.

Screenshots of the WannaCry ransomware with different languages, including English, Spanish, Italian, were also shared online by various users and experts on Twitter.

Bitcoin wallets seemingly associated with WannaCry were reportedly started filling up with cash.

The Spanish computer emergency response organization (CCN-CERT) has even issued an alert that warns users of the "massive attack of ransomware" from WannaCry, saying (translated version):

"The ransomware, a version of WannaCry, infects the machine by encrypting all its files and, using a remote command execution vulnerability through SMB, is distributed to other Windows machines on the same network."

It is unclear how the WannaCry ransomware is infecting systems, but obvious attack vector can be phishing emails or victims visiting a website containing malware.

"Power firm Iberdrola and utility provider Gas Natural were also reported to have suffered from the outbreak.," according to BBC.

How to Protect Yourself from WannaCry

First of all, if you haven't patched your Windows machines and servers against EternalBlue exploit (MS17-010), do it right now.

To safeguard against such ransomware infection, you should always be suspicious of uninvited documents sent an email and should never click on links inside those documents unless verifying the source.

To always have a tight grip on all your important files and documents, keep a good backup routine in place that makes their copies to an external storage device that is not always connected to your PC.

Moreover, make sure that you run an active anti-virus security suite of tools on your system, and most importantly, always browse the Internet safely.



Taken from:
http://thehackernews.com/2017/05/wannacry-ransomware-unlock.html

Basic Networking topics

Footprinting: Footprinting is the most convenient way to gather the system information or data. It helps to give the information about all the system regarding remote accessibility, port activity etc. It helps the intruder to take the complete control over the system. It not only helps the intruder but also to the security provider, it gives information of the loopholes in the system.

Google Hacking: Google Hacking is one of the computer hacking technique which involves with Google search engine and Google applications to find out the configuration and security codes. That configuration gives intruder a chance to employ a scanner, which scans massive amount of information of system.

Scanning: Scanning is nothing but looking all over in order to detect some part. In networking scanning is a process to identify the active host, even it might not be serious threat host scanning takes plays in security basis. Scanner will consider ports, active host, network and many. It helps for monitoring and analysis of a system.

Enumeration: Enumeration is a computing activity which retrieves the services of networked computers. It is used to identify the host or devices in network. It usually runs with the protocol ICMP and SNMP to gather information. For the services it also scans the port and remote hosts, to know the functionality performed by the host. Some scanners also perform the enumeration operation.

System Hacking: It is a process to manipulate the normal behavior of a system by some technical effort. Basically hacking takes place with a skilled programmer which changes the behavior of the system, sometimes total control of the system.

Trojan: Trojan is a malicious software which attracts the user with routine, interesting, appears useful to install. Trojan generally spread by social engineering or by download.

Back Doors: Backdoor is mostly used in security purpose while unauthorized user get access to a computer remotely.

Virus: Virus is a programming code which is a self-replicate, which induce into the another program and effects the executable code. Virus may attack from the email, by downloads or by CD drives. Some viruses show their effect immediately to the system where some goes when had made initiate to move on.

Worms: Worm is also a self-replicating malicious code and penetrates into the operating system. It makes harmful to the system functionality. Worms basically effects through an existed file were virus don’t. Many worms are created just spread over the system not to change over the system credibility.

Sniffers: Sniffers is a program or a device which is used to monitor the data traveling of a system. Sniffers can be used for the functionality management of a legitimate network and also for the stealing of the information. It is very difficult to detect the unauthorized sniffers they are extremely dangerous. Hackers use sniffer as a weapon in this account.

Social Engineering: It is a non-technical method used by the intruders where heavy human interaction takes place. By breaking normal security procedure this is a trick usually plays by the intruder.

Denial of Service: In networking denial of service is to make unavailable to user/users. It is happened due to source attack with thousands of IP addresses. This attack is to make the service suspend for temporarily. DOS attack will be mostly effected highly used websites, banks etc.

Session Hijacking: The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is normally managed for a session token. Because http communication uses many different TCP connections, the web server needs a method to recognize every user’s connections. The most useful method depends on a token that the Web Server sends to the client browser after a successful client authentication. The Session Hijacking attack compromises the session token by stealing or predicting a valid session token to gain unauthorized access to the Web Server.

Hacking Web Servers: A web server is program that stores files and makes them accessible via network or internet. A web server requires both hardware and software. Attackers usually target to exploits in the software and gains the authorization and enters into the server.

Password Cracking: Password cracking is the process of recovering data that have been stored in a computer system. By repeating this process, the cryptographic hash can be found by the attacker. There are different techniques for password cracking which is called as password cracking techniques like phishing, brute force attack etc.

SQL Injection: SQL injection is a code injection technique, which involves some malicious SQL statements for execution to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution. SQL injection must exploit a security vulnerability in an application's software.

Vulnerability:

In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw.

Web Application Vulnerabilities: The loopholes obtained in the web applications is nothing but called as Web Application Vulnerabilities. The vulnerability which is not patched by the user or organization, by taking that advantage attacker can change the code in the web application. Sometimes new vulnerabilities can be created by the attacker and attacks the organization.

Phishing: Phishing is an attempt made by the intruder to acquire sensitive data from the user. Basically it goes through communication sites(mails) which helps for an intruder to attract user by interaction. Once user get attracted with the phishing mails he used to accept the malware unknowingly which spread into the system and also breaks credentials of the user authentication.

Hacking E-mail Accounts: It is an illegal way to manipulate the account, Accounts will be hack on by stealing the password. Emails get hack with weak passwords, by key logger activity, social engineering.

Generalization or Specialization?

    

 

Now no one wants to use only half of their brain! How inefficient would that be? Specialization in a particular field is a must have in this era...But only if you want to sell your soul for 40+ years doing the same redundant work. Generalization is required for doing any kind of work at any point of time and is a number one quality of any entrepreneur's success.

            The world today is shifting from demanding a “jack of all trades” to demanding the “master”. The abundance of information in today’s world leads to any person adept at internet search skills is able to provide a general perspective about any topic under the sun. The need is to be able to provide an in-depth idea about the topic. Also, the level of competition in today’s world leaves no scope for error and thereby, comes the demand for specialization. With a team of such specialists, the performance delivered tends to have been scrutinized from the different perspectives, leaving lesser scope for flaws.

The shift to specialization has influenced the growth of new industries and markets. It has also influenced our lifestyle, career choices and decisions. The need of the hour today is to hone the skill that exists nowhere but in yourself and thereby making oneself indispensable.

          I don’t believe that there is a “best approach”. I think that combining generalization and specialization works well for schools and organizations. If I need my car's engine fixed, I go to a mechanic who specializes in my engine. We need specialists for sure. If I want a large robotics project to be successful, I don't go and get the best mechanical engineer I can to oversee the programmers, electrical folks, etc. I get someone with a good general knowledge of all areas needed.

Social networking in our lives

“Social networking is a communication tool but does not generate meaningful connections.” Social networking is a valuable form of communication. It makes it possible for people to be able to quickly and conveniently communicate with large amounts of people simultaneously. It does not, however, generate any real emotion. It is immediate, entertaining and allows me to keep in touch with old friends. That aside, I believe social networking contributes to a disappointing and disingenuous social life. Social networking replaces earnest interaction with pleasantries, leaving one yearning for human connection.

             We also have the communication between people and businesses. Since they have paved a new way for interaction between the two, customers can now tell brands exactly what they want. Businesses can then use that information to tailor their products of more appeal. They used to have to spend a ton of cash for this kind of marketing data. Customers used to have to spend hours on phones getting more and more frustrated when they had a problem or complaint.

Non-profits are seeing the benefits of using social media for their awareness campaigns. Sites like Facebook, Twitter, YouTube and others are a cost effective means of spreading the word and getting support. Not to mention socially shared petitions from sites like Causes.org, reaching hundreds of thousands of people.

There is no doubt that there are many reasons to love social media.

But…….

not all consequences of this technology are good ones. Like the way it has allowed us to hide behind screens and limited our social interaction face to face. You get the feeling of being social without having to go out and socialize. In the same vein, it gives you the feeling of being a friend (or having friends) without having to put in any actual work to build the relationship. Just think of how many people you have on your Facebook friends list. How many of them do you see on a semi-regular basis? At all?

                  I think that the effects of social media have been somewhat balanced, to be honest. There are many good things about it, and many bad things. In the end, if you can keep your own life centered in reality and use social networking as a small part of it, you should be just fine.

For those who can’t, it might be time to turn off the computer for a bit and go for a walk.

FDI in Indian retails- Boon or Bane?

FDI in retail means foreign direct investment in the Indian retail business. It is the intent and objective of the Government of India to attract and promote foreign direct investment in order to supplement domestic capital, technology and skills, for accelerated economic growth. As we are in the category of developing country and to develop properly we need to control the country’s economy very carefully. If the % in FDI in retail sector (multi-brand) is increased, then the investment in India’s retail market will be from foreign investors and the profits are also drained to the investors. And moreover in INDIA, the retail sector mainly depends upon the agricultural sectors and the producer and if FDI is increased then it is going to affect the agricultural sector of the Country very badly and which will affect the country’s economy. And if the % of FDI is increased to 100% in retail (both single and multi-brand) sector then government will lose the control over this sector completely and then it cannot help in controlling this sector with its rule and regulations as the whole retail sector would be privatized. And this privatization can make a very serious effect on the country’s economy.

                One of the most disadvantage of FDI in retail sector is that as we know that the retail sector is one of the major employment provider and permitting FDI in this sector can displace the unorganized sector and leading to loss of livelihood the most favoring example is if wall mart (ABCD) entry in retail sector is allowed then it will kill the millions of local shops and jobs. The global retailers would exercise monopolistic power to raise prices and monopolistic power to reduce the prices received by the supplier. Hence both the consumer and supplier would lose while the profit margin in such retail change would go up. So from the above points i can say that FDI in retail sector is not good for India.

Advantages:

 1. It is mandated in the policy that 50% of any investment over a $100 million would be in the backend infrastructure which would benefit by creating jobs as well as infrastructure for a developing country like India.

    2. Contractual farming would also mean improved and efficient farming practices as well as higher output and better prices.
    3. Foreign players will bring in the necessary investment to upgrade the retail sector infrastructure across the country.

  The emphasis would be on reduction in wastage of food items. This would bring down the food prices which have been a major cause of inflation in the country as well as a source of public dissent against the government.

Disadvantages:

  Will not benefit the farmers since the large foreign players will squeeze them for lower prices in order to earn higher margin.

  The large foreign players work on wafer thin margins since they offer their goods at low prices. In that scenario they would procure their goods at the lowest possible price to get the maximum benefit.

   Manufacturing sector would suffer since the foreign players would source their products from international markets in order to get low prices.

  The policy states that State Governments can take a decision about FDI in retail. But FDI is not a State Policy matter. Hence this is not possible. The central government will take the final call.

Advantages of FDI in Retail in India

Ø  Growth in Economy

Ø  Job Opportunities

Ø  Benefits to consumers

Ø  Lack of Infrastructure

Ø  Cheaper Production facilities

Ø  Availability of new technology

Ø  Long term cash liquidity

Ø  Conducive for the country’s economic growth

Ø  FDI opens up a new avenue for Franchising

Disadvantages of FDI in Retail in India

Ø  Impact on Local Markets (Kirana Shops)

Ø  Limited Employment Generation

Ø  Fear of Lowering Prices

Ø  Negative Impact on Indian Economy

Ø  Negative Impact on Indian Domestic Market

Technology Changing the face of Education

“Technology not only Changes the face of education but also the fate of Education.”  We are living in an era ruled by technological advancement that has eradicated most of the darkness of illiteracy. The traditional way of teaching has a lot of good ways/methods, but also have some flaws. Flaws like, student doesn’t get exposed to all kind of info related to that particular subject.

         We are gaining so much from it but we should not say no to the fact that it is diverting the student of age 15-22yr from studies because this age group student does not have that mature mind to concentrate on one thing positively and which make them think negative and technology is a booster for them. The innovative way of developed technology helping the people to get the solutions of all queries. E- learning courses are increasing skills. Many of the important communications are happening through social network websites. Now a days using Digital boards in Digital classrooms make study very simple, more collaborative and interactive also. In this digital classrooms you can record faculties lecture for further use and broadcast it anywhere in the world simultaneously live. Using these digital classrooms, you can interact teacher personally and questioning and answering privately. In this way you can make your study more detailed. It allows us to have easier access to "answers" but now students can practically cheat their way through school and not actually learn a single thing.

 Technology is good servant but bad master. The majority of people are using technology to waste time on apps and social media. The legitimate way of usage will be always helps for the education

       

OWASP Top ten Vulnerability PPT