Authentication Reflection Attack and DoS Reflection Attack

If not redirected, please click here https://www.thesecuritybuddy.com/dos-ddos-prevention/authentication-reflection-attack-and-dos-reflection-attack/

In this article, we will discuss about Authentication Reflection Attack and Denial of Service Reflection Attack.

What is Authentication Reflection Attack ?

Two hosts over the network use Challenge-Response-Authentication system to authenticate each other. In this system, one host throws a challenge to another host and the other host sends the response back to the first host. If the response matches, the other host is authenticated.

But, sometimes same protocol is used to authenticate hosts in either direction. That is, the same challenge-response protocol is used to authenticate either of the hosts. To authenticate any host, the first host encrypts the challenge C with encryption key K and sends E(K, C) to the other host.

But, as the same challenge-response authentication protocol is used in either direction, the other host can open another connection to the first host and throw the same challenge E(K, C) to the first host. At this point, if the first host sends a response to the challenge to the second host, the second host can use the same response in the first connection and send it back to the first host. As a result, the second host will be able to fraudulently authenticate it to the first host though it is not authorized to do so. And the attackers use this vulnerability to attack a system and steal data. This is called Authentication Reflection Attack.

How to prevent Authentication Reflection Attack ?

With a few modifications with the authentication protocol this vulnerability can be eliminated :

• The first host can include its identifier in the response to the second host. So, if the second host sends the same response to the first host back, the first host can easily identify that and reject the response.
• If the second host opens a second connection to the first host, while the first connection from the first host to the second host is already open, the first host can delay its response to the second host over the second connection until the second host is done with responding to the first challenge over the first connection.
• We can also use different key or protocol between the two directions.

What is DoS Reflection Attack ?

In DoS Reflection Attack, an attacker spoofs his IP address, and sends lots of request messages to other hosts of the network. As the attacker uses the victim machine's IP address as the source IP address of the outgoing request messages, all the other hosts sends a response to the victim machine. At this point, if the attacker has much higher bandwidth than the victim machine, the victim machine gets lots of reponses which uses up all its network bandwidth. As a result, victim machine becomes no longer available for legitimate requests. This is called DoS Reflection Attack.

DNS Amplification Attack is also a type of Reflection Attack. In this attack, the attacker sends lots of DNS query to a DNS server, but forges the IP address of the victim machine as source IP. As a result, the DNS server ends up sending all the responses to the victim machine. As the DNS responses are much larger in size, the victim machine ends up getting flooded with the responses which use up all its bandwidth.

So, beware of various security vulnerabilities, so that you can protect your systems in a better way and stay safe, stay protected.



Read More

What is Web Application Firewall ?

What is Deep Packet Inspection ?

What is Next Generation Firewall ?

How to prevent DDoS attacks ?

What is IoT Botnet ?

How does Network Segmentation improve security ?

What is Side Channel Attack ?

If not redirected, please click here https://www.thesecuritybuddy.com/vulnerabilities/what-is-side-channel-attack/

If a burglar wants to break into your house, not necessarily he has to break the lock and come inside. He may break in through the window or break the hinges of the door and break in. Attackers use similar concept to break a cryptosystem through Side Channel Attack.

Side Channel Attack

In practice, cryptosystem is implemented on physical devices. Algorithmically it is very difficult to break the cryptographic algorithm itself.

But, normally during cryptographic computation, the physical devices reveal some information in terms of power consumption, heat dissipation, time of computation, electromagnetic leaks etc. These information are called Side Channel Information.

In Side Channel Attack, attacker uses these Side Channel Information to determine the secret keys and break the cryptosystem.

Types of Side Channel Attack

There are different types of Side Channel Attack, each based on different Side Channel Information.

Some most common ones are mentioned below :

Time of Cryptographic Computation :

Various cryptographic computations normally take different time to execute. If an attacker has the information of time taken for computation of various inputs, and he does statistical analysis on the data, it becomes much easier for him to get the secret key.

The basic principle that the attacker uses here is, computation time of various cryptographic operation depends to some extent on the secret key. And, based on that information this type of Side Channel Attacks are perpetrated.

Power Consumption :

Similarly, power consumption of a cryptographic device also may reveal much information for the attackers.

For example, if for a smart card or embedded system power is drawn from an untrusted source and an attacker has the information on how much power is drawn by the cryptosystem at various inputs, the attacker can do statistical analysis on that information and it will become much easier for him to break the cryptosystem.

Electromagnetic Radiation :

Electrical devices often generate electromagnetic radiation as part of their operation. An attacker can observe this electromagnetic radiation of the cryptographic device and understand their relationship with the cryptographic computation. This can reveal a surprising amount of information with which it will become quite easier for the attacker to get the secret key. In this type of Side Channel Attack, attackers exploit this Side Channel Information.

Injection of Faults :

In this type of Side Channel Attack, the attacker injects faults in the cryptographic devices and observes its behavior.

The attacker may inject computational faults in the cryptosystem or he may send intentionally corrupted data to the device and then observe the output. If the attacker observes this non-standard information, it also reveals much information for the attacker.

Acoustic Sound :

Attackers sometimes even analyze the acoustic sounds produced at the time of cryptographic computation of the physical device and use that information to break the cryptosystem.

Reading Data from Memory :

Other than these, the attackers may read sensitive data from the memory after they are supposedly been deleted, or they may exploit the off-limit memory to access adjacent memory and use that information to break the cryptosystem.


Attackers may even use a combination of Side Channel Information to make the attack easier.

Countermeasures 

We can take some steps which may prove to be much helpful. Some of them are mentioned below :

• As Side Channel Attacks are made based on leaked Side Channel Information, an effective countermeasure of Side Channel Attacks is to reduce the correlation between Side Channel Information and the secret key. One such countermeasure is to add random delay in cryptographic computations. One way this can be done is by Blinding. In this method, before decrypting the cyphertext, a random number is encrypted and added to the cyphertext. The decryption algorithm is then applied on the combined component and the random number is eliminated after the decryption. As a result of these operations, a random delay is added on the computation time and it becomes difficult for the attackers to extract the secret key observing the time of execution of various cryptographic computations.
• Another countermeasure is to add some delay and design the cryptosystem in such a way that every cryptographic computation takes same amount of time. It reduces much the correlation between the secret key and computation time, making it very difficult for the attackers to attack.
• Sometimes, special shielding is applied to lessen the electromagnetic emissions. This helps much in reducing leaked electromagnetoc emissions.
• Power line conditioning and filtering can help in reducing power-monitoring attacks.
• Another countermeasure is to make the software “PC-Secure”. In a PC-Secure program, the execution path does not depend on the secret values. All conditional branches instead depend on the public information only. As a result, it reduces the correlation between leaked Secure Channel Information and the secret key.
• Sometimes, cryptographic code is designed to use memory only in a predictable fashion, such as accessing only the input, output and program data and in a fixed pattern only. This helps much in reducing Side Channels Attacks based on timing information or cache access pattern.

So, this was just an introductory article on Side Channel Attack. Hope you enjoyed it.

How to prevent Phishing ?

If not redirected, please click here https://www.thesecuritybuddy.com/phishing/how-to-prevent-phishing/ 

What is Phishing ?

Phishing is a technique used by attackers to acquire sensitive information like username, passwords, credit card numbers etc of victims for using those information in malicious purposes. Generally the attackers masquerade them to be trustworthy entity and communicate the victims in an electronic communication, convincing them to provide sensitive information.

The term Phishing is obtained as a homophone of fishing, as the attackers use fake bait to trap victims.

We see the first example of Phishing back in 1995. Attackers used to pose to be AOL company representatives and contact AOL users saying “to verify account” or “confirm billing information”. Some users would get trapped and provide sensitive information like account number, password, credit card etc. Lots of AOL users were victims. Eventually, AOL's policy was enforced against Phishing and lots of steps were taken, which almost stopped the illegal activities. But, since then on, attackers started applying many new fraudulent techniques and now also they trap many victims.

Different Types of Phishing 

There are mainly four different types of Phishing.

Sometimes, the attackers do not target any individual victim as such. Instead, they masquerade them to be trustworthy authority and send fraudulent emails to thousands of recipients together. Some of them fall in trap and end up providing sensitive information.

But, sometimes individuals or a company are targetted seperately. This is called Spear Phishing. This is reported to be the most widely used Phishing technique.

In one Phishing technique, attackers copy a legitimate email sent by actual authority and replace the links with the fraudulent website. They also change the sender email id to look like that of the trustworthy entity and claim to be an updated version of the original email. Lots of victims cannot detect this fraudulent techniques and fall in trap, ending up in providing sensitive information visiting the fraudulent links provided by the attackers. This is called Clone Phishing.

In another Phishing technique, attackers target senior executives. They send emails claiming to be customer complaint or executive issue or even legal subpoena. The emails contain fraudulent links which look real, but actually they collect sensitive information. Sometimes, the emails also ask to install some software from the link to visit the email and trap the victims. This is called Whaling.

Different Techniques Used in Phishing 

The attackers use various techniques for Phishing. Some mostly used techniques are mentioned below.

Attackers sometimes manipulate the links to look like coming from trustworthy entity. For that purpose, they often use misspelled URLs of the actual website. Sometimes, they even use trickery of using subdomains. For example, www.some.example.com may appear to come from “example” section of www.some.com website, but actually, it may be “some” section of fraudulent www.example.com website. (What is Typosquatting and how is it used in phishing ?)

Attackers sometimes use images containing texts instead of plain texts in emails. As a result, it becomes much harder for anti-phishing software to detect the Phishing. But, today many anti-phishing filters use OCR or Optical Character Recognition to detect texts inside images and filter them.

Sometimes, the attackers use javascript to change address bar and place a legitimate iage of actual URL over the address bar. As a result, once the victims click on the fraudulent links, it becomes very difficult for them to understand the deception.

Sometimes the attackers corrupt the actual officcial website and once a user visits the website, a fraudulent pop-up appears asking them to provide sensiive information like account name, password etc. Just to give a more specific example, a user might click on a link appear to be coming from official networking website and while clicking on it, it might ask, whether the user wants to authorize the appplication. If a user clicks on “yes”, it may send a token to the attackers containing sensitive information like mail-id, friend list etc. This sort of Phishing is called Covert Redirect and it is much harder to detect.

In Phone Phishing, the attackers call a victim using phone and convince him using trickery to type bank account number, PIN etc over the phone. The victims cannot understand the deception and fall in trap. (What is Vishing and how to prevent it ?) And, Smishing is a technique of phishing using SMS (What is Smishing and how to prevent it ?)

In Tabnabbing, the attackers load a webpage of their fraudulent website in one of the open tabs of the victim and silently redirect him to the fraudulent website to steal sensitive information.

Attackers can also use Pharming to redirect legitimate traffic to a malicious website covertly and use it for phishing (What is Pharming ?).

And some attackers are even more evil. They create a wifi network looking identical to an official public wifi network. Some users cannot detect the difference and they start using the fraudulent network. And, whatever unencrypted information gets transferred through the network gets stolen. (How to deal with Evil Twin ?)

You can find more information in various techniques used in phishing here : What is social engineering and what all are the various techniques used in social engineering ?

 

How to prevent Phishing ?

We can educate ourselves to be aware of the most common Phishing techniques, so that we do not fall in trap. Here, I am writing down few steps that can easily be taken by anyone :

• If a user is contacted to verify or confirm his account, it contains at least the username. So, if you get such email which do not contain any personal information, especially your username, it is most likely a Phishing email. If you are still doubtful, contact the authority directly, instead of clicking on any link on the email.
• If a bank contacts you, it will use at least few digits of your account number, masking the other digits. So, if you get an email asking for account verification etc and it does not contain any digits of your account number, it is most likely a Phishing email. Instead of clicking on any link on that email, directly contact the bank and verify its authenticity.
• Use trusted security software and update it regularly.
• Update the software you use in your computer with recent security patches. Attackers often use security holes in common software to perform all these attacks.
• Do not click on any link if you are not very sure of its trustworthiness. It may cost you heavily.
• If you get fake phone calls, take down the caller's information and report it to local authority.
• If you get spam emails in your inbox, select the email and mark it as spam. Normally, machine learning is used to detect spams in inbox. So, more you help the software in detecting spams, the more the software will help you in future to detect spams. (How are spamtraps used to detect spam emails automatically ?)
• Verify the green padlock in the URL in the address bar before making any sensitive transaction (What is EV Certificate and how does it help to prevent phishing ?). 
• And last but not the least, configure proper firewall in your system. You can close unused ports and prevent unnecessary applications from using the Internet when it is not needed (What is firewall and how can it protect us ?). You can also use an Intrusion Detection System to protect your system (What is an Intrusion Detection System ?) 

Purpose of Phishing

The attackers use so much deception to collect personal information, but what do they do with that ?

Sometimes the attackers do collect bank information etc to steal money. But mostly, this personal information are sold to other software attackers for money. So many times we hear about various attacks, have we ever wondered how do the attackers target victims ?

So, follow the simple rules stated above and never, ever reply to any fraud emails. Sometimes, these emails are sent in bulk and if you send a reply, it would at least confirm the attackers that your email id is a valid one. So, you may end up getting even more fraudulent emails later, if not anything else. And stay safe, stay protected.



Read More

What is Social Engineering ?

What is Vishing ?

What is Smishing ?

What is Pharming ?

How do attackers use Typosquatting for phishing and spreading malware ?

How to safeguard oneself from Evil Twin ?

What are EV Certificates ?

Infographic : How to prevent malware ? 

What is 2 Factor Authentication and why should we always enable it if possible ?




 

What is Malvertising ?

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/what-is-malvertising/

Today many websites earn revenue by displaying online-advertising in the websites. And, the sad part is, attackers are taking advantage of that to spread malware to computers.

What is Malvertising and how is Malvertising perpetrated ?

Normally, websites outsource the ad contents to their pages to third-party ad networks.

Online advertisements keep changing on the pages. So, if one advertisement of them is a malware, it will be very difficult to find that out. But, that would be enough for infecting a computer. And the attackers exploit this opportunity in Malvertisements.

In Malvertising, attackers inject malware-laden online advertisements into legitimate online advertising networks and webpages. Malvertisings are normally very attractive and it is very difficult to differentiate them from legitimate online advertisements. So, they can easily spread across a large number of legitimate websites.

Malvertising is fairly new concept of spreading malware. Normally, they can bypass firewalls and do not need user clicks to infect his computer.

How do Malvertisements infect a computer ?

Malvertisements can infect a computer pre-click or post-click. A pre-click Malvertisement can be embedded in main-scripts of the page. They can even initiate drive-by-download on visiting the malvertising-laden website.

A drive-by-download is a download which a user initiates without knowing the consequence. It can even happen without the user's knowledge on visiting the website.

For a post-click Malvertisement, it infects a computer when a user clicks on the ad to see the advertisement, but instead is redirected to a malware infected website. And those malware infected websites trick a user to copy malware normally disguised in a flash file.

The first recorded Malvertisement was reported in late 2007 or early 2008 and it exploited a security vulnerability of Adobe Flash affecting a number of platforms including MySpace, Excite and Rhapsody. Since then, Malvertising has continued unabated and affected many computers.

How to prevent Malvertising ?

We can take a few steps which can reduce the possibility of our computer getting affected to a large extent.

• Update your browser whenever new patches are available. Modern browsers like Internet Explorer 9 or Google Chrome include some security advances which can make attacks much more difficult.
• Update commonly used programs like Adobe Flash Player or Adobe Reader whenever new patches are available. Sometimes attackers exploit their security flaws to spread malware. With regular patches these security flaws will be minimized.
• You can enable Click-to-Play Plugins. This will disable autoplaying of Flash or java-object. It won't automatically run unless you click on it.
• You can use MalwareBytes Anti-Exploit. It monitors your web browser and blocks potential Malvertisements.
• Disable or uninstall plug-ins which you are not using anymore. This will disable the attackers from exploiting it.
• Keep your plug-ins up-to-date with recent security patches.

This was an introductory article on Malvertising, just to keep you informed about the malware and how to combat it. Hope it has helped you.

Computer Worms Vs Computer Viruses Vs Trojans

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/worm-vs-virus-vs-trojan/

Computer worms, computer viruses and trojans have one similarity. They all are malware. But, how are worm, virus and trojan different from each other ? Let's try to understand.

What is malware ?

Malware is an abbreviated form of Malicious Software. It indicates any software which is used for malicious purposes like stealing private data, corrupting files, crashing hard disks, extorting money etc. They infect a computer stealthily, without the user's knowledge. And then spread themselves.

Worm, virus and trojan are malware. But, there are subtle differences among all these terms, though their intention is similar. So, what all are the differences among them ?

Let's start by Computer Worms.

Computer Worms

Computer Worms are malware which infect a computer without the user's knowledge, like other malware do. And then it spreads through self-replication.

But unlike Computer Virus, they do not need to attach themselves to an existing program. It often uses computer networks and spread itself taking the advantage of security vulnerability of an existing software.

They almost always cause some harm to the network, by taking lots of bandwidth if not anything else. And after infecting a computer, they can delete files, use the computer as a botnet (What is botnet ?) and use its computer resources for illegal activities, send spams (How to prevent email spams ?) or even blackmail companies by threatening about DoS or Denial of Service Attacks(What are DoS and DDoS attacks and how to prevent them ?). To give an example, Conficker malware is a good example of computer worm.

Computer Virus

Computer Viruses also infect a computer and then spread themselves to infect more computers. They normally attach themselves with other computer programs, so that, when a user executes the program in his computer, they infect the computer. Just to give a common example, Microsoft Word Document support macro so that it can execute while opening the document. A virus can attach itself to a Word Document as a macro, so that, whenever a user will open the document, the code of the virus will be executed and the computer will be infected (How does PowerSniff malware infect a computer ?).

Computer Viruses can attach themselves to data files also. For example, a virus can attach its code to a jpg file and change the name of the file to jpg.exe, so that, whenever a user will open the file, unknowingly his computer will get infected.

A virus can affect the Master Boot Record or MBR of a computer also. And when that happens, it can survive through reinstallation of Operating Systems(How does Nemesis Bootkit infect a computer ?).

Computer Viruses can perform many harmful activities like corrupting hard disks, deleting files, degrading performance of computer, display unrelated messages on computer screen, stealing private data by logging keystrokes (What are keyloggers and how to prevent them ?), spamming contacts etc.

Trojan

The word Trojan (Trojan Horses and their threats)is derived from the ancient Greek wooden horse that the Greeks used to invade Troy stealthily. Trojan programs generally tricks a user by some form of social engineering (What is social engineering and what all are the techniques used in social engineering ?) and get loaded and executed into the system. They often misrepresent themselves to appear useful, routine or interesting to the user and persuades the user to install it.

Trojans can infect a computer  by clicking on a suspicious link, opening email attachment(What is phishing and how to safeguard oneself from phishing ?), by installing software from untrusted sources or even by visiting unsafe website (What is drive by download ?). Sometimes, they even misrepresent themselves in unsafe websites as Anti-Virus software and when a user installs them, they infect the computer.

But unlike, Computer Worms and Computer Viruses, they do not self-replicate themselves.

Spyware and Ransomware are types of Trojans. Spyware infect a computer to steal sensitive private data or spy on the activities of the user. And Ransomware also do the same, but for blackmailing the user to extort money (e.g. How does Petya ransomware infect a computer and how to prevent it ?).

Trojans, when they infect a computer with elevated privileges, can do much harm. They too can corrupt hard disks, corrupt data, crash a computer, format disks, infect MBR or Master Boot Record of a computer and they can even steal sensitive private data or encrypt user files to extort money (What is Remote Access Trojan or RAT ?). To give an example, Zeus malware is a good example of trojan.

Prevention Techniques

Computer Worms, Computer Viruses and Trojans have similar prevention techniques.

• Do not click on suspicious links.
• Do not open suspicious email attachments.
• Install software from trusted sources only.
• Do not download anything from untrusted websites. (What are the security risks of using P2P File Sharing Software like BitTorrent ?).
• Keep your operating system and other commonly used software updated with recent security patches. More updated a software is, lesser are its security vulnerabilities.
• Very often malware infects a computer exploiting security vulnerabilities present in a browser. So, keep your browser updated with recent security patches (What are Browser Hijackers ?)
• Keep your computer updated with a trusted security program.
• Do not pay money if someone is trying to extort money by infecting your computer. Instead, take regular backup of your computer and keep your system updated with security patches and software.
  
• Keep your online accounts protected with strong passwords(How to create a strong password that can be remembered easily ?)Do not use the same password for two different accounts. Attackers often hack one account and use the same password to hack multiple other accounts.
• Enable 2 Factor Authentication whenever it is possible (What is 2 Factor Authentication and why should we always enable it ?)
• Configure proper firewall in the system. It is better to prevent unnecessary applications from using the Internet when it is not needed. (What is firewall and how does it protect a computer ?)
• You can use an Intrusion Detection System to detect and prevent malicious intrusions in your computer (What is an Intrusion Detection System ?). There are quite a number of open source IDS also which are good enough.

Hope this helps.




Read More 

What is Firewall and how does it work ?

How to prevent spyware ?

How to safeguard oneself from trojans ?

Infographic : How to prevent phishing ?

Infographic : How to prevent ransomware ?

Infographic : How to prevent malware ?

What are keyloggers and how to prevent them ?

How to configure iptables firewall on Linux ?

What is an Intrusion Detection System and how does it work ?

What is a Backdoor and how to prevent it ?

What is a RAT or Remote Access Trojan and how to prevent it ?

What is Nemesis Bootkit ?

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/what-is-nemesis-bootkit/

Since early 2015 a new malware started targeting banks, payment card processors or other financial services, stealing sensitive information from them. It infects a computer and plucks sensitive data out of computer memory. It is called Nemesis Bootkit.

Nemesis Bootkit is a part of Nemesis malware, which includes programs for transferring files, capturing screens, logging keystrokes, injecting processes or do other malicious activities.

The difference which makes Nemesis Bootkit much more harmful than most other malware programs is that it changes Master Boot Record and can survive through re-installation of Operating Systems. It is much harder to detect and once detected, much harder to remove.

How does Nemesis Bootkit infect a computer

In Windows Systems, MBR or Master Boot Record stores information about the disk, including number and layout of partitions. This MBR is critical to boot process. It stores a small amount of code, which searches for primary active partition and transfers the control to the Volume Boot Record or VBR of the partition.

This VBR resides on the first sector of individual partition. It contains a small machine code specific to the Operating System and instructs the Operating System to begin the boot process.

Nemesis Bootkit hijacks the boot process of the computer. It first uses a multi-step process to create a custom virtual file system and stores the Nemesis components in the unallocated space between the partitions.

It then replaces the VBR code with its own malicious code, so that it can intercept certain boot process functions and inject Nemesis components to Windows Kernel.

And once infecting a computer, it starts it malicious activities to steal sensitive data from the targeted banks, payment card processors or other financial services.

Countermeasures of Nemesis Bootkit

As discussed earlier, Nemesis Bootkit is much harder to detect and remove. Because of the way it infects a computer, simple re-installation cannot get rid of it completely.

But, there is a valid solution to remove it, though the practicality of the solution is questionable. If someone wipes the disks completely and then re-installs the Operating System, this malware can be removed.

Please note that, Nemesis Bootkit does not install itself on computers that use GUID partitions, which were introduced as part of Extensible Firmware Interface initiative and are an alternative for old Master Boot Record. So, use of this newer technology also can help the financial services from this threat.

This was an introductory article to give you some information about Nemesis Bootkit. Hope it helped.

Trojan Horse And Its Threats

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/how-to-prevent-trojan-horse/

Trojan Horse or Trojan is a malware that infects a computer without the user's knowledge and does malicious activities like stealing sensitive information, formatting disks, corrupting data, degrading system performance etc.

The name Trojan is derived from the ancient Greek wooden horse that the Greeks used to invade Troy stealthily. Trojan programs generally tricks a user by some form of social engineering and get loaded and executed into the system. They often misrepresent themselves to appear useful, routine or interesting to the user and persuades the user to install it.

Unlike worms or viruses, they cannot inject themselves to other files or self-replicate.

Destructive Activities of Trojans

If installed with elevated privileges, Trojans get unlimited access to the computer and do much destructive activities. This includes :

• data corruption
• formatting of disks
• crashing the computer
• spreading malware to other computers in network with the help of an infected computer
• steal sensitive information, like login information, bank account and credit card passwords etc.
• Spy on user activities
• use the infected computers as a botnet and using their computational resources for doing some illegal activities
• install ransomware and extort money
• keystroke logging
• controlling the computer system remotely

Some common types of Trojans

Let's look at a few types of Trojans to understand in a better way how it affects us.

Backdoor

This type of Trojans give the attacker remotes control over the computer after infecting it. This controls may be data corruption, system crash, rebooting computer, displaying attacker controlled data etc. Sometimes, attackers even use the infected computers as a botnet and use their resources for criminal purposes.

Exploit

This type of Trojans infect a computer and searches for vulnerabilities of the programs or software running on the system to control it further.

Rootkit

This type of Trojans infect a computer and disables anti-virus or other security programs, so that it can infect the computer further.

Trojan-Banker

They steal sensitive user data like bank account passwords, credit card numbers etc from the infected computer.

Trojan-DDoS

This type of Trojans use the infected computers to perform a DDoS or Distributed Denial of Service attack on a victim computer in the network.

Trojan-FakeAntiVirus

They misrepresent themselves to appear a security program and often reports that the computer is infected, though it is actually false. Their main purpose is to appear useful to the user so that the user installs it and gets infected by the Trojans.

Trojan-GameThief

They steal account information for online gamers.

Trojan-InstantMessenger

They steal login information of Instant Messaging users.

Trojan-Ransomware

The purpose of Trojan-Ransomware is to infect the computer and extort money from the user.

Trojan-SMS

They cost the user a huge amount of money by sending text messages to some premium rate phone numbers without the user's knowledge.

Trojan-Spy

They spy on the user using keylogger, webcam etc and collects sensitive data.

Trojan-MailFinder

They harvest email addresses from the infected computer.

Trojan-Joke

They play annoying sounds on the speaker or display taunting message on the screen, but otherwise comparatively less harmful.

Countermeasures

• Trojans mostly uses some social engineering to infect a victim's computer. Do not click on any link if you are not very sure of its authenticity. Do not open email attachments if you are not sure of the sender. And, always avoid downloading software from untrusted sources.
• Trojans often exploit security vulnerabilities of commonly used software to infect a computer. So, always keep your computer updated with recent security patches of all the commonly used software.
• Update your Operating Systems with recent patches for the same reason.
• Always keep your system updated with recent patches of anti-malware programs from a trusted source.
• Configure Firewalls in your system properly.

This was an introductory article on Trojans. Hope to keep you updated with more information from time to time. Stay safe, stay protected.

Spyware And Its Threats

If not redirected, please click here https://www.thesecuritybuddy.com/malware-prevention/how-to-prevent-spyware/

I think almost all of us are aware of the term Spyware and if you are a frequent internet user, probability is quite high that you might have affected by it at least once. How does this Spyware infect a computer actually and how to prevent them ?

Spyware

Spyware is a malware that infects a computer stealthily and then keeps collecting information about user behavior like internet surfing habits, user logins or even bank or credit card account information. Sometimes, it collects information on web browsing habits and serves pop up ads to the user. And sometimes, it even asserts control over the computer without the user's knowledge.

How does Spyware infect a computer

On visiting unsafe websites, spyware can be downloaded from websites, email messages, instant messages, and from direct file-sharing connections. Sometimes, even when the user accepts End User License Agreement of an unsafe software and gets infected by spyware unknowingly.

Sometimes Spyware infects a computer through security holes in browser or other software. When the user visits a website controlled by a spyware attacker, the spyware attacks the browser taking advantage of its security holes and forces its download without the user's knowledge.

One difference of Spyware with other malware programs is, it does not self-replicate itself. So, it cannot transmit to other computers like the way viruses or other malware programs do.

Threats of Spyware

Spyware, after infecting a computer, can interfere with the user control over the computer. It may change web browser settings, redirect websites, change search results or settings of other software or the computer. Sometimes, it results in slow computer, making it almost impossible for the user to use it.

A Spyware program is rarely alone in infecting a computer. Sometimes, it disables firewalls or antivirus software and security settings of web browser and makes the computer vulnerable for other infections.

As it can change computer settings, it may result in extremely poor performance in terms of CPU activity, disk usage or network performance. Spyware which interferes with networking software, may result in poor networking performance.

The worse thing is, sometimes a user cannot even guess the proper reason of poor performance of his computer. He sees slow performance, frequent crashes, stability issues, application freezing, booting issues etc because of Spyware and ends up discarding the computer.

And some Spyware programs include keyloggers. It observes keystrokes pattern of user and can even capture screen of user computer and send sensitive information to outside entity.

Some Examples of Spyware

CoolWebSearch – It infects a computer and then, displays pop-up ads, redirects search results and directs DNS lookups to websites controlled by the attackers.

HuntBar – It adds toolbar to web browser, tracks web browsing behavior, redirects affiliate references and displays ads.

Internet Optimizer – It redirects web browser error pages to advertising.

Look2Me – It can even start in safe mode. It is actually a combination of rootkit and spyware. It is harder to detect and difficult to remove.

Zlob Trojan – It collects information about websites visited, search history or even keystrokes and sends the information to attackers. It even hijacks routers set to defaults.

Countermeasures of Spyware

There are couple of good anti-spyware programs which help removing the spywares. These anti-spyware programs scan network data and blocks known spyware threats.

Some anti-spyware programs can even do regular scans on computer and remove Spywares if already installed.

Some organizations enable firewalls and web proxies and block the websites which are known to install spywares. This also helps at times.

Words of Caution

Some malicious Spyware attackers make malicious anti-spyware programs and display ads of those through website banners. Once installed, they help installing even more Spywares instead of removing them. So, be very careful about using an anti-spyware programs. Use an anti-spyware from a trusted source only.

So, this was an article on Spywares to increase awareness among us about Spywares. Be very careful about the websites visited or installation of software. Do not click on suspicious links or email attachments. Enable firewalls and keep your system updated with a good security programs. And stay safe, stay secured.