How does TLS or Transport Layer Security Protocol work ?

If not redirected, please click here https://www.thesecuritybuddy.com/encryption/how-does-tls-protocol-work/

When two hosts communicate with each other over the unsecured network and they want to transfer sensitive data between them, especially for bank transactions or ecommerce transactions, they must use an encrypted and secured connection. SSL or Secure Socket Layer was developed by Netscape for that purpose. It enabled bank and ecommerce transaction security over the unsecure network.

Protocols in the Application Layer need to remain unchanged, yet provide communication security. And hence, SSL was implemented in Session Layer.

SSL 2.0 was first publicly released version of the protocol. But, soon security flaws were found in it. So, SSL 3.0 replaced SSL 2.0. TLS 1.0 is an upgraded version of SSL 3.0.

How does TLS work ?

Once a client starts communication with the server, TCP connection gets established following the below mentioned couple of steps.

• The Client first communicates with the server sending a Hello message. The message includes number of options that will be used in the communication, such as version of the protocol to be used, CipherSuites supported by the client, compression methods and a 32 byte random number.
• Server replies to the Hello message and makes choices about the options to be used, like version of protocol, CipherSuite and compression method. It also fills up the SessionID and replaces the 32 byte random number with date and timestamp.
• The Server now sends Digital Certificates to the Client. This Digital Certificates contain the public key of the Server.
• The Client verifies the Digital Certificate with CA or Certificate Authority.
• After the Digital Certificate is verified, the Client starts to negotiate the symmetric key. There are a number of algorithms it can use. One example is Diffie-Hellman Key Exchange Algorithm. Please note that, at this point, secure connection is not yet established. So, symmetric key cannot be exchange between the Server and the Client directly and hence, key exchange algorithms like Diffie-Hellman Key Exchange Protocol is used. The Client also signs the message and sends the MAC or Message Athentication Code to the Server.
• The Server processes the key exchange parameters. It also checks the MAC or Message Athentication Code to verify the integrity and authenticity of the message sent.
• If everything goes well, a secure TLS connection is established between the Server and the Client and secure communication starts to transfer sensitive application data.

This was an informative article on TLS. Hope you enjoyed it.



Read More

How does SSL protocol work ?

How is TLS different from SSL ?

What is IPSec ?

How does IPSec protocol work ?

How does Point-to-Point protocol work ?

How does SSH protocol work ? 

How does HTTPS protocol work ? 

What is SSL VPN and how is it different from IPSec VPN ?

What is a Replay Attack ?

If not redirected, please click here https://www.thesecuritybuddy.com/vulnerabilities/what-is-replay-attack/

A Replay Attack is an attack in which the attacker repeats or delays a valid transmission and fraudulently re-transmits it. Using this approach, an attacker can fraudulently authenticate himself to a system though he is not authorized to do so.

How is Replay Attack perpetrated

Let's suppose, Alice and Bob are communicating with each other over the network. Bob wants to authenticate himself to Alice. So, Bob will provide his password which will then be transmitted over the network in encrypted fashion, may be as a password hash.

Suppose Charles is an attacker. He listens to the conversation between Alice and Bob and reads Bob's password while it was transmitted to Alice. So, after the session is over between Alice and Bob, Charles opens a connection to Alice. When the system asks for authentication, Charles provides Bob's password which he had read and fraudulently copied.

So, Alice's system will not understand the deception and authenticate Charles. Charles at this point will gain access to Alice's system and use that connection for malicious purposes like stealing sensitive data or performing even more attacks.

Prevention 

We can take a couple of steps to prevent this type of attacks :

• At the time of authentication, Alice can first send a session token like a random number to Bob. Bob can now append the hashed token value with his password and send the resultant encrypted hash to Alice. Alice will now decrypt the token and if there is a match, she will authenticate Bob. If we take this approach, then even if Charles later repeats the encrypted hash to Alice, the token value will not match and authentication will not be possible. This session token value should be a random number rather than a some other calculated number. Because that will reduce the possibility of guessing the session token by Charles.
• One Time Password is also another approach to prevent this attack. This One Time Passwords expire after a short period of time. So, if Charles repeats the communication after that interval, he cannot authenticate himself.
• Sending Time Stamp is another way to prevent this attack. Alice can periodically transmit her time. And when Bob will want to communicate with Alice, he needs to append the time in his clock at the time of authentication. In this approach, Alice does not need to generate random numbers.

So, this was a very short article on Replay Attack just for your information. Hope you enjoyed it.

Authentication Reflection Attack and DoS Reflection Attack

If not redirected, please click here https://www.thesecuritybuddy.com/dos-ddos-prevention/authentication-reflection-attack-and-dos-reflection-attack/

In this article, we will discuss about Authentication Reflection Attack and Denial of Service Reflection Attack.

What is Authentication Reflection Attack ?

Two hosts over the network use Challenge-Response-Authentication system to authenticate each other. In this system, one host throws a challenge to another host and the other host sends the response back to the first host. If the response matches, the other host is authenticated.

But, sometimes same protocol is used to authenticate hosts in either direction. That is, the same challenge-response protocol is used to authenticate either of the hosts. To authenticate any host, the first host encrypts the challenge C with encryption key K and sends E(K, C) to the other host.

But, as the same challenge-response authentication protocol is used in either direction, the other host can open another connection to the first host and throw the same challenge E(K, C) to the first host. At this point, if the first host sends a response to the challenge to the second host, the second host can use the same response in the first connection and send it back to the first host. As a result, the second host will be able to fraudulently authenticate it to the first host though it is not authorized to do so. And the attackers use this vulnerability to attack a system and steal data. This is called Authentication Reflection Attack.

How to prevent Authentication Reflection Attack ?

With a few modifications with the authentication protocol this vulnerability can be eliminated :

• The first host can include its identifier in the response to the second host. So, if the second host sends the same response to the first host back, the first host can easily identify that and reject the response.
• If the second host opens a second connection to the first host, while the first connection from the first host to the second host is already open, the first host can delay its response to the second host over the second connection until the second host is done with responding to the first challenge over the first connection.
• We can also use different key or protocol between the two directions.

What is DoS Reflection Attack ?

In DoS Reflection Attack, an attacker spoofs his IP address, and sends lots of request messages to other hosts of the network. As the attacker uses the victim machine's IP address as the source IP address of the outgoing request messages, all the other hosts sends a response to the victim machine. At this point, if the attacker has much higher bandwidth than the victim machine, the victim machine gets lots of reponses which uses up all its network bandwidth. As a result, victim machine becomes no longer available for legitimate requests. This is called DoS Reflection Attack.

DNS Amplification Attack is also a type of Reflection Attack. In this attack, the attacker sends lots of DNS query to a DNS server, but forges the IP address of the victim machine as source IP. As a result, the DNS server ends up sending all the responses to the victim machine. As the DNS responses are much larger in size, the victim machine ends up getting flooded with the responses which use up all its bandwidth.

So, beware of various security vulnerabilities, so that you can protect your systems in a better way and stay safe, stay protected.



Read More

What is Web Application Firewall ?

What is Deep Packet Inspection ?

What is Next Generation Firewall ?

How to prevent DDoS attacks ?

What is IoT Botnet ?

How does Network Segmentation improve security ?

What is Side Channel Attack ?

If not redirected, please click here https://www.thesecuritybuddy.com/vulnerabilities/what-is-side-channel-attack/

If a burglar wants to break into your house, not necessarily he has to break the lock and come inside. He may break in through the window or break the hinges of the door and break in. Attackers use similar concept to break a cryptosystem through Side Channel Attack.

Side Channel Attack

In practice, cryptosystem is implemented on physical devices. Algorithmically it is very difficult to break the cryptographic algorithm itself.

But, normally during cryptographic computation, the physical devices reveal some information in terms of power consumption, heat dissipation, time of computation, electromagnetic leaks etc. These information are called Side Channel Information.

In Side Channel Attack, attacker uses these Side Channel Information to determine the secret keys and break the cryptosystem.

Types of Side Channel Attack

There are different types of Side Channel Attack, each based on different Side Channel Information.

Some most common ones are mentioned below :

Time of Cryptographic Computation :

Various cryptographic computations normally take different time to execute. If an attacker has the information of time taken for computation of various inputs, and he does statistical analysis on the data, it becomes much easier for him to get the secret key.

The basic principle that the attacker uses here is, computation time of various cryptographic operation depends to some extent on the secret key. And, based on that information this type of Side Channel Attacks are perpetrated.

Power Consumption :

Similarly, power consumption of a cryptographic device also may reveal much information for the attackers.

For example, if for a smart card or embedded system power is drawn from an untrusted source and an attacker has the information on how much power is drawn by the cryptosystem at various inputs, the attacker can do statistical analysis on that information and it will become much easier for him to break the cryptosystem.

Electromagnetic Radiation :

Electrical devices often generate electromagnetic radiation as part of their operation. An attacker can observe this electromagnetic radiation of the cryptographic device and understand their relationship with the cryptographic computation. This can reveal a surprising amount of information with which it will become quite easier for the attacker to get the secret key. In this type of Side Channel Attack, attackers exploit this Side Channel Information.

Injection of Faults :

In this type of Side Channel Attack, the attacker injects faults in the cryptographic devices and observes its behavior.

The attacker may inject computational faults in the cryptosystem or he may send intentionally corrupted data to the device and then observe the output. If the attacker observes this non-standard information, it also reveals much information for the attacker.

Acoustic Sound :

Attackers sometimes even analyze the acoustic sounds produced at the time of cryptographic computation of the physical device and use that information to break the cryptosystem.

Reading Data from Memory :

Other than these, the attackers may read sensitive data from the memory after they are supposedly been deleted, or they may exploit the off-limit memory to access adjacent memory and use that information to break the cryptosystem.


Attackers may even use a combination of Side Channel Information to make the attack easier.

Countermeasures 

We can take some steps which may prove to be much helpful. Some of them are mentioned below :

• As Side Channel Attacks are made based on leaked Side Channel Information, an effective countermeasure of Side Channel Attacks is to reduce the correlation between Side Channel Information and the secret key. One such countermeasure is to add random delay in cryptographic computations. One way this can be done is by Blinding. In this method, before decrypting the cyphertext, a random number is encrypted and added to the cyphertext. The decryption algorithm is then applied on the combined component and the random number is eliminated after the decryption. As a result of these operations, a random delay is added on the computation time and it becomes difficult for the attackers to extract the secret key observing the time of execution of various cryptographic computations.
• Another countermeasure is to add some delay and design the cryptosystem in such a way that every cryptographic computation takes same amount of time. It reduces much the correlation between the secret key and computation time, making it very difficult for the attackers to attack.
• Sometimes, special shielding is applied to lessen the electromagnetic emissions. This helps much in reducing leaked electromagnetoc emissions.
• Power line conditioning and filtering can help in reducing power-monitoring attacks.
• Another countermeasure is to make the software “PC-Secure”. In a PC-Secure program, the execution path does not depend on the secret values. All conditional branches instead depend on the public information only. As a result, it reduces the correlation between leaked Secure Channel Information and the secret key.
• Sometimes, cryptographic code is designed to use memory only in a predictable fashion, such as accessing only the input, output and program data and in a fixed pattern only. This helps much in reducing Side Channels Attacks based on timing information or cache access pattern.

So, this was just an introductory article on Side Channel Attack. Hope you enjoyed it.

How to prevent Phishing ?

If not redirected, please click here https://www.thesecuritybuddy.com/phishing/how-to-prevent-phishing/ 

What is Phishing ?

Phishing is a technique used by attackers to acquire sensitive information like username, passwords, credit card numbers etc of victims for using those information in malicious purposes. Generally the attackers masquerade them to be trustworthy entity and communicate the victims in an electronic communication, convincing them to provide sensitive information.

The term Phishing is obtained as a homophone of fishing, as the attackers use fake bait to trap victims.

We see the first example of Phishing back in 1995. Attackers used to pose to be AOL company representatives and contact AOL users saying “to verify account” or “confirm billing information”. Some users would get trapped and provide sensitive information like account number, password, credit card etc. Lots of AOL users were victims. Eventually, AOL's policy was enforced against Phishing and lots of steps were taken, which almost stopped the illegal activities. But, since then on, attackers started applying many new fraudulent techniques and now also they trap many victims.

Different Types of Phishing 

There are mainly four different types of Phishing.

Sometimes, the attackers do not target any individual victim as such. Instead, they masquerade them to be trustworthy authority and send fraudulent emails to thousands of recipients together. Some of them fall in trap and end up providing sensitive information.

But, sometimes individuals or a company are targetted seperately. This is called Spear Phishing. This is reported to be the most widely used Phishing technique.

In one Phishing technique, attackers copy a legitimate email sent by actual authority and replace the links with the fraudulent website. They also change the sender email id to look like that of the trustworthy entity and claim to be an updated version of the original email. Lots of victims cannot detect this fraudulent techniques and fall in trap, ending up in providing sensitive information visiting the fraudulent links provided by the attackers. This is called Clone Phishing.

In another Phishing technique, attackers target senior executives. They send emails claiming to be customer complaint or executive issue or even legal subpoena. The emails contain fraudulent links which look real, but actually they collect sensitive information. Sometimes, the emails also ask to install some software from the link to visit the email and trap the victims. This is called Whaling.

Different Techniques Used in Phishing 

The attackers use various techniques for Phishing. Some mostly used techniques are mentioned below.

Attackers sometimes manipulate the links to look like coming from trustworthy entity. For that purpose, they often use misspelled URLs of the actual website. Sometimes, they even use trickery of using subdomains. For example, www.some.example.com may appear to come from “example” section of www.some.com website, but actually, it may be “some” section of fraudulent www.example.com website. (What is Typosquatting and how is it used in phishing ?)

Attackers sometimes use images containing texts instead of plain texts in emails. As a result, it becomes much harder for anti-phishing software to detect the Phishing. But, today many anti-phishing filters use OCR or Optical Character Recognition to detect texts inside images and filter them.

Sometimes, the attackers use javascript to change address bar and place a legitimate iage of actual URL over the address bar. As a result, once the victims click on the fraudulent links, it becomes very difficult for them to understand the deception.

Sometimes the attackers corrupt the actual officcial website and once a user visits the website, a fraudulent pop-up appears asking them to provide sensiive information like account name, password etc. Just to give a more specific example, a user might click on a link appear to be coming from official networking website and while clicking on it, it might ask, whether the user wants to authorize the appplication. If a user clicks on “yes”, it may send a token to the attackers containing sensitive information like mail-id, friend list etc. This sort of Phishing is called Covert Redirect and it is much harder to detect.

In Phone Phishing, the attackers call a victim using phone and convince him using trickery to type bank account number, PIN etc over the phone. The victims cannot understand the deception and fall in trap. (What is Vishing and how to prevent it ?) And, Smishing is a technique of phishing using SMS (What is Smishing and how to prevent it ?)

In Tabnabbing, the attackers load a webpage of their fraudulent website in one of the open tabs of the victim and silently redirect him to the fraudulent website to steal sensitive information.

Attackers can also use Pharming to redirect legitimate traffic to a malicious website covertly and use it for phishing (What is Pharming ?).

And some attackers are even more evil. They create a wifi network looking identical to an official public wifi network. Some users cannot detect the difference and they start using the fraudulent network. And, whatever unencrypted information gets transferred through the network gets stolen. (How to deal with Evil Twin ?)

You can find more information in various techniques used in phishing here : What is social engineering and what all are the various techniques used in social engineering ?

 

How to prevent Phishing ?

We can educate ourselves to be aware of the most common Phishing techniques, so that we do not fall in trap. Here, I am writing down few steps that can easily be taken by anyone :

• If a user is contacted to verify or confirm his account, it contains at least the username. So, if you get such email which do not contain any personal information, especially your username, it is most likely a Phishing email. If you are still doubtful, contact the authority directly, instead of clicking on any link on the email.
• If a bank contacts you, it will use at least few digits of your account number, masking the other digits. So, if you get an email asking for account verification etc and it does not contain any digits of your account number, it is most likely a Phishing email. Instead of clicking on any link on that email, directly contact the bank and verify its authenticity.
• Use trusted security software and update it regularly.
• Update the software you use in your computer with recent security patches. Attackers often use security holes in common software to perform all these attacks.
• Do not click on any link if you are not very sure of its trustworthiness. It may cost you heavily.
• If you get fake phone calls, take down the caller's information and report it to local authority.
• If you get spam emails in your inbox, select the email and mark it as spam. Normally, machine learning is used to detect spams in inbox. So, more you help the software in detecting spams, the more the software will help you in future to detect spams. (How are spamtraps used to detect spam emails automatically ?)
• Verify the green padlock in the URL in the address bar before making any sensitive transaction (What is EV Certificate and how does it help to prevent phishing ?). 
• And last but not the least, configure proper firewall in your system. You can close unused ports and prevent unnecessary applications from using the Internet when it is not needed (What is firewall and how can it protect us ?). You can also use an Intrusion Detection System to protect your system (What is an Intrusion Detection System ?) 

Purpose of Phishing

The attackers use so much deception to collect personal information, but what do they do with that ?

Sometimes the attackers do collect bank information etc to steal money. But mostly, this personal information are sold to other software attackers for money. So many times we hear about various attacks, have we ever wondered how do the attackers target victims ?

So, follow the simple rules stated above and never, ever reply to any fraud emails. Sometimes, these emails are sent in bulk and if you send a reply, it would at least confirm the attackers that your email id is a valid one. So, you may end up getting even more fraudulent emails later, if not anything else. And stay safe, stay protected.



Read More

What is Social Engineering ?

What is Vishing ?

What is Smishing ?

What is Pharming ?

How do attackers use Typosquatting for phishing and spreading malware ?

How to safeguard oneself from Evil Twin ?

What are EV Certificates ?

Infographic : How to prevent malware ? 

What is 2 Factor Authentication and why should we always enable it if possible ?




 

What is Malvertising ?

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/what-is-malvertising/

Today many websites earn revenue by displaying online-advertising in the websites. And, the sad part is, attackers are taking advantage of that to spread malware to computers.

What is Malvertising and how is Malvertising perpetrated ?

Normally, websites outsource the ad contents to their pages to third-party ad networks.

Online advertisements keep changing on the pages. So, if one advertisement of them is a malware, it will be very difficult to find that out. But, that would be enough for infecting a computer. And the attackers exploit this opportunity in Malvertisements.

In Malvertising, attackers inject malware-laden online advertisements into legitimate online advertising networks and webpages. Malvertisings are normally very attractive and it is very difficult to differentiate them from legitimate online advertisements. So, they can easily spread across a large number of legitimate websites.

Malvertising is fairly new concept of spreading malware. Normally, they can bypass firewalls and do not need user clicks to infect his computer.

How do Malvertisements infect a computer ?

Malvertisements can infect a computer pre-click or post-click. A pre-click Malvertisement can be embedded in main-scripts of the page. They can even initiate drive-by-download on visiting the malvertising-laden website.

A drive-by-download is a download which a user initiates without knowing the consequence. It can even happen without the user's knowledge on visiting the website.

For a post-click Malvertisement, it infects a computer when a user clicks on the ad to see the advertisement, but instead is redirected to a malware infected website. And those malware infected websites trick a user to copy malware normally disguised in a flash file.

The first recorded Malvertisement was reported in late 2007 or early 2008 and it exploited a security vulnerability of Adobe Flash affecting a number of platforms including MySpace, Excite and Rhapsody. Since then, Malvertising has continued unabated and affected many computers.

How to prevent Malvertising ?

We can take a few steps which can reduce the possibility of our computer getting affected to a large extent.

• Update your browser whenever new patches are available. Modern browsers like Internet Explorer 9 or Google Chrome include some security advances which can make attacks much more difficult.
• Update commonly used programs like Adobe Flash Player or Adobe Reader whenever new patches are available. Sometimes attackers exploit their security flaws to spread malware. With regular patches these security flaws will be minimized.
• You can enable Click-to-Play Plugins. This will disable autoplaying of Flash or java-object. It won't automatically run unless you click on it.
• You can use MalwareBytes Anti-Exploit. It monitors your web browser and blocks potential Malvertisements.
• Disable or uninstall plug-ins which you are not using anymore. This will disable the attackers from exploiting it.
• Keep your plug-ins up-to-date with recent security patches.

This was an introductory article on Malvertising, just to keep you informed about the malware and how to combat it. Hope it has helped you.

Computer Worms Vs Computer Viruses Vs Trojans

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/worm-vs-virus-vs-trojan/

Computer worms, computer viruses and trojans have one similarity. They all are malware. But, how are worm, virus and trojan different from each other ? Let's try to understand.

What is malware ?

Malware is an abbreviated form of Malicious Software. It indicates any software which is used for malicious purposes like stealing private data, corrupting files, crashing hard disks, extorting money etc. They infect a computer stealthily, without the user's knowledge. And then spread themselves.

Worm, virus and trojan are malware. But, there are subtle differences among all these terms, though their intention is similar. So, what all are the differences among them ?

Let's start by Computer Worms.

Computer Worms

Computer Worms are malware which infect a computer without the user's knowledge, like other malware do. And then it spreads through self-replication.

But unlike Computer Virus, they do not need to attach themselves to an existing program. It often uses computer networks and spread itself taking the advantage of security vulnerability of an existing software.

They almost always cause some harm to the network, by taking lots of bandwidth if not anything else. And after infecting a computer, they can delete files, use the computer as a botnet (What is botnet ?) and use its computer resources for illegal activities, send spams (How to prevent email spams ?) or even blackmail companies by threatening about DoS or Denial of Service Attacks(What are DoS and DDoS attacks and how to prevent them ?). To give an example, Conficker malware is a good example of computer worm.

Computer Virus

Computer Viruses also infect a computer and then spread themselves to infect more computers. They normally attach themselves with other computer programs, so that, when a user executes the program in his computer, they infect the computer. Just to give a common example, Microsoft Word Document support macro so that it can execute while opening the document. A virus can attach itself to a Word Document as a macro, so that, whenever a user will open the document, the code of the virus will be executed and the computer will be infected (How does PowerSniff malware infect a computer ?).

Computer Viruses can attach themselves to data files also. For example, a virus can attach its code to a jpg file and change the name of the file to jpg.exe, so that, whenever a user will open the file, unknowingly his computer will get infected.

A virus can affect the Master Boot Record or MBR of a computer also. And when that happens, it can survive through reinstallation of Operating Systems(How does Nemesis Bootkit infect a computer ?).

Computer Viruses can perform many harmful activities like corrupting hard disks, deleting files, degrading performance of computer, display unrelated messages on computer screen, stealing private data by logging keystrokes (What are keyloggers and how to prevent them ?), spamming contacts etc.

Trojan

The word Trojan (Trojan Horses and their threats)is derived from the ancient Greek wooden horse that the Greeks used to invade Troy stealthily. Trojan programs generally tricks a user by some form of social engineering (What is social engineering and what all are the techniques used in social engineering ?) and get loaded and executed into the system. They often misrepresent themselves to appear useful, routine or interesting to the user and persuades the user to install it.

Trojans can infect a computer  by clicking on a suspicious link, opening email attachment(What is phishing and how to safeguard oneself from phishing ?), by installing software from untrusted sources or even by visiting unsafe website (What is drive by download ?). Sometimes, they even misrepresent themselves in unsafe websites as Anti-Virus software and when a user installs them, they infect the computer.

But unlike, Computer Worms and Computer Viruses, they do not self-replicate themselves.

Spyware and Ransomware are types of Trojans. Spyware infect a computer to steal sensitive private data or spy on the activities of the user. And Ransomware also do the same, but for blackmailing the user to extort money (e.g. How does Petya ransomware infect a computer and how to prevent it ?).

Trojans, when they infect a computer with elevated privileges, can do much harm. They too can corrupt hard disks, corrupt data, crash a computer, format disks, infect MBR or Master Boot Record of a computer and they can even steal sensitive private data or encrypt user files to extort money (What is Remote Access Trojan or RAT ?). To give an example, Zeus malware is a good example of trojan.

Prevention Techniques

Computer Worms, Computer Viruses and Trojans have similar prevention techniques.

• Do not click on suspicious links.
• Do not open suspicious email attachments.
• Install software from trusted sources only.
• Do not download anything from untrusted websites. (What are the security risks of using P2P File Sharing Software like BitTorrent ?).
• Keep your operating system and other commonly used software updated with recent security patches. More updated a software is, lesser are its security vulnerabilities.
• Very often malware infects a computer exploiting security vulnerabilities present in a browser. So, keep your browser updated with recent security patches (What are Browser Hijackers ?)
• Keep your computer updated with a trusted security program.
• Do not pay money if someone is trying to extort money by infecting your computer. Instead, take regular backup of your computer and keep your system updated with security patches and software.
  
• Keep your online accounts protected with strong passwords(How to create a strong password that can be remembered easily ?)Do not use the same password for two different accounts. Attackers often hack one account and use the same password to hack multiple other accounts.
• Enable 2 Factor Authentication whenever it is possible (What is 2 Factor Authentication and why should we always enable it ?)
• Configure proper firewall in the system. It is better to prevent unnecessary applications from using the Internet when it is not needed. (What is firewall and how does it protect a computer ?)
• You can use an Intrusion Detection System to detect and prevent malicious intrusions in your computer (What is an Intrusion Detection System ?). There are quite a number of open source IDS also which are good enough.

Hope this helps.




Read More 

What is Firewall and how does it work ?

How to prevent spyware ?

How to safeguard oneself from trojans ?

Infographic : How to prevent phishing ?

Infographic : How to prevent ransomware ?

Infographic : How to prevent malware ?

What are keyloggers and how to prevent them ?

How to configure iptables firewall on Linux ?

What is an Intrusion Detection System and how does it work ?

What is a Backdoor and how to prevent it ?

What is a RAT or Remote Access Trojan and how to prevent it ?

What is Nemesis Bootkit ?

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/what-is-nemesis-bootkit/

Since early 2015 a new malware started targeting banks, payment card processors or other financial services, stealing sensitive information from them. It infects a computer and plucks sensitive data out of computer memory. It is called Nemesis Bootkit.

Nemesis Bootkit is a part of Nemesis malware, which includes programs for transferring files, capturing screens, logging keystrokes, injecting processes or do other malicious activities.

The difference which makes Nemesis Bootkit much more harmful than most other malware programs is that it changes Master Boot Record and can survive through re-installation of Operating Systems. It is much harder to detect and once detected, much harder to remove.

How does Nemesis Bootkit infect a computer

In Windows Systems, MBR or Master Boot Record stores information about the disk, including number and layout of partitions. This MBR is critical to boot process. It stores a small amount of code, which searches for primary active partition and transfers the control to the Volume Boot Record or VBR of the partition.

This VBR resides on the first sector of individual partition. It contains a small machine code specific to the Operating System and instructs the Operating System to begin the boot process.

Nemesis Bootkit hijacks the boot process of the computer. It first uses a multi-step process to create a custom virtual file system and stores the Nemesis components in the unallocated space between the partitions.

It then replaces the VBR code with its own malicious code, so that it can intercept certain boot process functions and inject Nemesis components to Windows Kernel.

And once infecting a computer, it starts it malicious activities to steal sensitive data from the targeted banks, payment card processors or other financial services.

Countermeasures of Nemesis Bootkit

As discussed earlier, Nemesis Bootkit is much harder to detect and remove. Because of the way it infects a computer, simple re-installation cannot get rid of it completely.

But, there is a valid solution to remove it, though the practicality of the solution is questionable. If someone wipes the disks completely and then re-installs the Operating System, this malware can be removed.

Please note that, Nemesis Bootkit does not install itself on computers that use GUID partitions, which were introduced as part of Extensible Firmware Interface initiative and are an alternative for old Master Boot Record. So, use of this newer technology also can help the financial services from this threat.

This was an introductory article to give you some information about Nemesis Bootkit. Hope it helped.