Tuesday, April 12, 2016

Virus Detection Techniques and What is Next Generation Anti Virus or NGAV


There is always a big contest between virus creators and anti-virus experts. And, it is getting more and more complicated day by day. Virus writers keep trying new tactics to infect systems and the security experts always find out a way to overcome them. And, the battle continues.


Computer Viruses evolved a lot since when they were first developed and with that evolved their concealment tactics. As a result, traditional anti-virus programs gradually started becoming ineffective. Next Generation Anti-Virus or NGAV is a technology which uses dynamic analysis instead of static ones to overcome the shortcomings of traditional Anti-virus programs.





Computer Viruses and their concealment techniques


Computer Viruses take different techniques to conceal themselves, so that they remain undetected by the Anti-virus programs. A number of such strategies are given below :

Encryption


Encryption is basically the most primitive approach taken by the virus writers to evade detection. Encrypted viruses consist of mainy two parts – a decryptor and the virus body. The actual code of the virus is encrypted in the virus body and the function of the decryptor is to decrypt the virus body and transfer the control of execution to it.


The main purpose of encryption, as said, is to avoid detection by anti-virus programs. Many anti-virus programs use static analysis to analyze the code of the virus and use that to detect a virus. If the main body of the virus is encrypted, it becomes difficult for the security experts to analyze and detect the virus.

Sometimes, encryption is also used in viruses to prevent unintentional tampering of the code of the virus.

Oligomorphism


Though encryption in viruses make virus detection more difficult, it did not prove to be good enough for avoiding detection. Anti-virus programs often analyze known viruses and find out unique signatures or patterns in the virus code, using which the particular virus gets detected. So, once an encrypted virus is successfully analyzed and signature is obtained, the anti-virus programs can use that to detect new infections. So, if the decryptor of the virus remains same in the new infections, it would become easier to detect the virus.

Oligomorphism is a technique used by the virus writers in which the decryptor loop keeps changing in the new infections. Normally, a set of decryptors is interchangeably used in the new infections, so that signature matching based on fixed pattern in the decryptor loop becomes difficult.

Polymorphism


As said above, many anti-virus programs use signatures to detect infection of known viruses. When a virus is successfully analyzed, security experts find out a unique bit pattern in the virus called signature of the virus. Later, when a computer gets scanned for viruses, the signature is matched with a new virus to detect it.

In Polymorphism, the virus writers keep changing some instructions in the new generations, so that signature matching fails in the new infections. The virus modifies some pieces of its body to look dissimilar in the new infections. And, in the new generations, they again construct a different decryptor for the next infection.

The main difference between Oligomorphism and Polymorphism is, Polymorphic viruses have the capability of creating infinite number of new decryptors. And, each new decryptor may use several encryption techniques to encrypt the main virus body. As a result, Polymorphic viruses are much more difficult to detect.

Metamorphism


In Metamorphism, the virus writers mutate the viris body with different looking, but similar functioning instructions. As a result, the virus body looks different in the new infections and it becomes difficult for the anti-virus programs to detect them. These viruses are usually not encrypted.


Virus Detection Techniques


Techniques of virus detection also evolved much and security experts started applying new techniques to detect viruses. Some most popular virus detection techniques are mentioned below :

String Scanning


In this method, signature string is scanned in the new virus using some special conditions in byte comparison process. It uses wildcards, generic degree etc to match the signature.

Bookmarks


This technique is used to reduce false positives in detecting viruses. Several techniques can be used as Bookmarks, for example the offset of virus signature from the beginning of the virus code may be a good Bookmark.

Smart Scanning


Virus writers often conceal their code with a set of dummy instructions like NOP. In Smart Scanning, junk instructions like NOP or address of data and subroutines etc are first removed from the virus body and then the virus is scanned for signature matching. This technique is mainly used to detect macro viruses written in text format.

Skeleton Detection


This technique was invented by Russsian virus researcher Eugene Kaspersky, who is also founder of Kaspersky Anti-Virus.

In this method works by removing set of instructions from a file that do not probably belong to the virus code and then the scanning process starts. It parses statements one by one to remove unimportant statements and blank gaps and gets the skeleton of the code. And, the skeleton is then searched for virus signatures.

Exact Identification


In this method, more than one number of constant bytes in the virus code are searched for scanning. As a result, the number of false positives in the virus detection improves much.

Heuristics Analysis


In this method, a number of heuristics is used to detect infections of viruses. Some commonly used heuristic flags may be :

  • Possible gap between sections
  • Suspicious section characteristics
  • Suspicious code section name
  • Multiple or suspicious PE Headers
  • Suspicious imports from kernel
  • Suspicious code redirection

Static Decryptor Detection


This method is used to detect encrypted viruses. String scanning specific to the particular virus is used to detect the decryptor of the virus.

X-RAY Scanning


When an encrypted virus is first detected, the plaintext body of the particular virus is obtained. And, on some specific parts of the plaintext code like top and tail of the file, entry points etc, a number of encryption techniques commonly used by the virus writers are applied. Using those, signature is scanned in an unknown virus.

This technique is normally used in Polymorphic viruses. But, the problem with this method is it is very time consuming.

Code Emulation


This technique is widely used to detect viruses. In this method, a virtual environment simulates the CPU, memory, storage resources and some necessary functions of an Operating Systems and the virus code is made to run in that environment. Once the code runs, the behavior of the code is observed and analyzed. And, that information is utilized to detect new infections of the virus.



Disadvantages of traditional anti-virus techniques



Though the techniques of virus detection improved a lot over time, they have their own disadvantages, which eventually made traditional anti-virus programs ineffective. A number of them are mentioned below :


  • Signature scanning method usually maintains a database of signatures of known viruses, using which unknown viruses are scanned. But, as number of viruses started increasing drastically over time, it became quite impractical to maintain such databases of virus signatures.
  • Signature database do not contain signatures of newly found viruses, until they are analyzed successfully and added to the database. This makes traditional anti-virus programs quite ineffective in detecting new viruses.
  • Traditional techniques of detecting virus is ineffective for detecting Zero-day threats.
  • Hackers often use techniques like crypters, server side polymorphism etc which make much difficult for the traditional anti-virus programs to detect them.



The Next Generation Anti-Virus or NGAV


Next Generation Anti-Virus or NGAV is a technique which relies on machine learning to dissect new viruses in an automated way. It uses some dynamic analysis approach to detect viruses, instead of relying on analysis based on peviously captured samples of viruses. As a result, they are much more effective in detecting new viruses and Zero-day threats than the traditional anti-virus programs.

An NGAV may use several techniques to detect viruses. Some of them are mentioned below :

Automated Static Analysis


In this method, the suspicious binary file is divided into parts and each part is analyzed based upon features visible in the binary code. If it sees behavior or characteristics that are known to be malicious, it flags the binary file as infected. And, this technique is applied in an automated way.

Dynamic Analysis through Emulation


The suspicious binary is encapsulated within an optimized emulated environment and its behavior is analyzed. If any malicious characteristics are found, the binary is flagged to be infected.

Dynamic Analysis through Virtualization


In this technique, the suspicious binary is analyzed in a virtual environment, instead of an emulated one to detect malicious characteristics.

Dynamic Analysis through Bare-metal


In this case, the suspicious binay is analyzed in an environment that most accurately replicates that of a real and vulnerable device and its characteristics are observed. Many a times, when a malware can detect that it is being run in a virtual environment, it changes its behavior to avoid getting analyzed. This method is quite effective to analyze such malware programs.


So, to summarize :

  • NGAV does not rely on prior knowledge of some malicious binary to detect its infections.
  • It dynamically analyze suspicious binaries to detect malicious behaviors.
  • It does not require manual intervention to detect newly found viruses.


NGAV uses Machine Learning to detect newly found viruses in automated fashion. It applies the above mentioned methods to detect malicious behaviors and then extracts corresponding features of a malicious binary. It then trains the software with those features, so that when those features are observed in a suspicious new binary, it can flag it as infected.



Posted by at 2 comments:

Sunday, April 10, 2016

Evolution of Firewalls : From Packet Filters to Next Generation of Firewalls


A Firewall is a network security system which monitors the inbound and outbound network traffic of a system and filters them as per some predetermined rules. It can be implemented as a hardware or as a software. If configured properly, a Firewall can prevent network intrusions up to a great extent.





First Generation of Firewalls : The Packet Filters


This type of Firewalls was first developed in 1980's. They mainly monitor network addresses and ports of inbound and outbound network traffic, and filter them as per some predetermined rules.

They store no information on connection state. Instead, they inspect source IP addresses, destination IP addresses, source and destination ports and protocols like TCP, UDP etc to filer the traffic.


This type of Firewalls mainly work in first three layers of the OSI model – the physical layer, the network layer and the transport layer to see the source and destination ports. And, as the Packet Filters do not store any information on the connection state, they cannot filter traffic depending on whether a particular network packet is part of an existing stream of traffic.



Second Generation of Firewalls : The Stateful Filters


This type of Firewalls was first developed in early 1990's. They retain the network packets until it gets enough information on the connection state of the packet. They determine whether a packet is part of an existing connection or not part of any connection and filters the traffic as per that.

Second Generation Firewalls can operate up to layer 4 of the OSI model, so that they can do stateful packet inspection.




Third Generation of Firewalls : The Application Layer Firewalls


This type of Firewalls was first developed in mid-1990's. Till now Firewalls were able to filter traffic based on IP addresses, ports or connection state, but they were unable to understand application layer protocols like HTTP, FTP, DNS. As a result, they were unable to detect whether an unwanted protocol is trying to bypass the firewall in an allowed port or any protocol is getting abused. The Application Layer Firewalls can monitor and understand certain application layer protocols and filter traffic as per that.



The Next Generation of Firewalls : Deep Packet Inspection


A Next Generation Firewall or NGFW is a recently developed integrated network platform that combines a traditional firewall with other security system functionalities like an application firewall, Intrusion Prevention System or IPS, SSL/SSH interception, QoS/bandwidth management, malware inspection etc. An NGFW includes the typical functionalities of a traditional firewall, yet it is much more powerful than a traditional firewall in detecting and preventing attacks and enforcing security.

An NGFW uses Deep Packet Inspection or DPI using which it can examine the data part of the network packets and search for protocol non-compliance, virus, spam, intrusions and other statistical information to filter the traffic and enforce security in a better way.

And, as an NGFW integrates multiple security technologies in an efficient manner, it has several advantages over the traditional Firewalls. It reduces administrative cost, can detect malware concealed in encrypted SSL/SSH traffic, can associate network traffic to users, and improves network throughput.





The Firewall technology emerged first in 1980's, and since then the technology improved a lot. Now it has become almost inevitable in network security. This article just gives a brief history on Firewall technology. Hope you liked it.
Posted by at 1 comment:

Thursday, April 7, 2016

Advanced Persistent Threat


An Advanced Persistent Threat is a series of network attacks which is made in a stealthy manner for a long duration of time with the purpose of gaining unauthorized access in the network and stealing sensitive data for malicious purposes.

In a normal network attack, the attackers make the attack, fulfills their purposes and leave immediately, so that the attackers do not get caught. But, in APT the attackers remain stealthy for a long period of time and proceed as planned in a covert manner to steal sensitive data gradually. An APT is much more covert and much more sophisticated than a normal network attack.



Purpose of Advanced Persistent Threat


In a normal attack, the attackers may have several purposes. Normally those attacks are done for causing damage to the network and systems or stealing sensitive data from the systems. In an APT, usually causing damage to the network or the systems is not the purpose of the attackers. APT is done mainly with the purpose of stealing sensitive data from the systems gradually in a covert manner.



How APT Attacks are perpetrated


An APT Attack is perpetrated typically following the following stages :

  • Firstly, the attackers use some social engineering, spear phishing, zero-day malware or other security vulnerabilities to infect the systems in the network. The attackers may even plan for a Watering Hole Attack, in which malware is placed in websites that the employees of the organization are likely to visit. (To know more on Watering Hole Attack : What is a Watering Hole Attack ? )
  • After infecting the systems in the network, the attackers stealthily place a RAT or Backdoor in the sysems which enable the attackers to gain unauthorized access of the systems.
  • The attackers can escalate the privileges and gain administrative privileges of the systems.
  • The attackers then start to collect information from the network.
  • The attackers can expand control to other workstations and harvest data from them also.
  • Next, the attackers exfiltrate the data to the attackers from the victim's network.


Targets of Advanced Persistent Threat


The attackers usually target a group or organization from where they can steal sensitive data. The most common targets usually are :

  • Government organization
  • Higher Education
  • Financial Institutions
  • Industries



Prevention of Advanced Persistent Threats


APT is quite sophisticated and it is much more difficult to detect and prevent than the normal network attacks. Attackers normally take extra precautions to remain covert for a long period of time. They use sophisticated techniques for evasion.

However, network traffic associated with APT can be detected in network layer. And, deep log analysis and log correlation from various sources can detect APT activities. A good log correlation tool can be used for that purpose.



So, this was a short article to give information on Advanced Persistent Threats. Beware of various security threats, so that you can protect your data in a better way. And, stay safe, stay protected.
Posted by at No comments:

Next Generation Firewall or NGFW


If not redirected, please click here https://www.thesecuritybuddy.com/data-breaches-prevention/what-is-ngfw-or-next-generation-firewall/


A Next Generation Firewall or NGFW is an integrated network platform that combines a traditional firewall with other security system functionalities like an application firewall, Intrusion Prevention System or IPS, SSL/SSH interception, QoS/bandwidth management, malware inspection etc. An NGFW includes the typical functionalities of a traditional firewall, yet it is much more powerful than a traditional firewall in detecting and preventing attacks and enforcing security.




Traditional Firewall and how it works


A traditional firewall monitors incoming and outgoing network packets of a system and prevents unauthorized access depending on some pre-configured rules.


A traditional firewall filters traffic based on mainly the following parameters :

  • Source IP address and destination IP address of the network packets.
  • Source port and destination port of the inbound and outbound traffic.
  • Current stage of connection.
  • Filtering rules based on per process basis.
  • Protocols used.
  • Routing features.


So, though a traditional firewall is good in ensuring security, it is not sufficient. One has to rely on other security solutions like IPS, anti-malware products, content filtering packages etc to ensure proper security.

The disadvantage of using different network security techniologies separately is it increases administrative cost and degrades network performance. An NGFW combines multiple network security technologies to provide better security mechanism while taking care of most of the disadvantages of using seperate security solutions at a time.


Next Generation Firewalls


An NGFW typically includes :

  • Intrusion Prevention System
  • Malware protection
  • Filtering traffic per application basis.
  • QoS or Quality of Service to guarantee network throughput
  • VPN
  • SSL/SSH interception


An NGFW uses Deep Packet Inspection or DPI using which it can examine the data part of the network packets and search for protocol non-compliance, virus, spam, intrusions and other statistical information to filter the traffic and enforce security in a better way.

An NGFW can monitor and filter traffic per application basis instead of port basis, which enables it to troubleshoot network problems in a better way. It can also associate network traffic with specific user or group of users, which helps in enforcing better acceptable-use policies.

NGFW can intercept the encrypted SSL and SSH traffic to look for any malicious traffic concealed in the encrypted traffic. And, this enables it to detect advanced threats and attacks.

And, as NGFW integrates multiple security technologies in an efficient manner, it improves network performance over using different security technologies separately.


Advantages of Next Generation Firewalls


An NGFW has a number of advantages over traditional firewalls. Some of the most important ones are listed below :


Lower Administrative Cost


In an NGFW, all the above mentioned security technologies are installed and configured as a unit. As a result, it reduces administrative cost significantly.


Easier to identify threats


An NGFW monitors the network traffic and reports all the events through a single reporting system, which is much more convenient than using different security techniologies separately.


Inspection of SSL/SSH traffic


Malware can be concealed in an encrypted SSL/SSH communication. For example, botnets and Advanced Persistent Threats often create SSL tunnels and exchange communication with the attackers. But, traditional firewalls cannot decrypt SSL/SSH traffic. As a result, the attackers can take advantage of that to make attacks.

NGFW can decrypt and inspect SSL/SSH traffic using Deep Packet Inspection and filter network traffic based upon that.


Filtering based on application


Traditional firewalls can filter traffic based on port, but that may prove to be inconvenient at times.

NGFW can associate traffic based on application, which enables it to block or monitor network traffic per application and troubleshoot problems based on that.


Identifying network traffic by users


Traditional firewalls cannot associate network traffic to users easily. One has to laboriously look at the log files for that purpose.

But, as NGFW can easily associate network traffic to specific users, it helps in enforcing better acceptable use policies.

For example, in a company marketing and Human Resource group may need to access some social networking sites, but others need not. Using NGFW one can easily set proper acceptable-use policy for that purpose.

Similarly, a company may allow its employees to access some social networking sites to make posts or comments, but may not allow them to play games. Using NGFW the company can set required policies easily.


Improved Network Performance


Using different network security technologies separately often causes degradation of network performance. Administrators often need to respond to that by disabling monitoring of certain ports, disabling some firewall rules or limiting Deep Packet Inspection which compromise network securities.

But, as NGFW integrates multiple network technologies together efficiently, it improves network throughput without having to trade off security for performance.



Posted by at No comments:

Wednesday, April 6, 2016

Heap Spraying


Heap Spraying is a technique using which an attacker can write certain sequence of bytes at a predetermined memory location of a process and then exploit that to facilitate execution of arbitrary malicious code.

Let's try to understand what it actually is.





What is Heap


A process in execution uses different sections of memory for different purposes.


To name a few :

Text Section : Text Section is used to store static code of the program. It is usually marked as read-only and cannot be modified by the program.

Data Section : Data Section is used to store static and global variables.

Stack Section : Usually every function uses some local variables. They are in use as long as the process executes that particular function and after that they are not needed anymore. A process uses Stack Section to store those local variables. Memory is allocated when the function is called and it is freed upon returning from the function.

Heap Section : Many a times it is not possible for a process to know in advance how much memory it would need for a certain variable. A dynamic array or a linked list may be a good example of that. For that purpose, the process dynamically allocates memory for that variable at run time. For storing these dynamically allocated data, a process uses Heap Section.


In Heap Spraying, the attacker writes series of bytes in Heap Section of a process and later exploit that for malicious purposes, usually in a separate attack.



How is Heap Spraying perpetrated


In Heap Spraying, the attackers exploit the fact that heap is usually deterministic. It often starts at a predetermined location in memory and located in consecutive manner.

So, the attackers first use some mechanism to put their shellcode to some predictable location in the heap and then, trigger a bug to make the EIP instruction pointer to directly point to the location.


A browser is an easy mechanism to do this. The attackers can use scripting support to spray the heap and then trigger the bug.

The attackers can even use other mechanisms like JavaScript or Actionscript in Adobe Reader to put the shellcode in predetermined location in the heap.


So, to summarize, in Heap Spraying the attackers first take scripting support to put their shellcode in the heap section of the process. After that, they trigger a bug and make the instruction pointer point to the predetermined location.


Detection and Prevention


There are a couple of ways of detection and prevention of Heap Spraying :

  • The Nozzle Project of Microsoft Research aims to detect and prevent Heap Spraying.
  • BuBBle is another countermeasure which can be used in detecting and prevention Heap Spraying. BuBBle is basically a JavaScript Engine level countermeasure for Heap Spraying.


So, beware of various security vulnerabilities so that you can protect your systems in a better way. And, stay safe, stay protected.
Posted by at No comments:

Monday, April 4, 2016

The Deep Web, the Dark Web and Tor


We often hear the terms Deep Web, Dark Web and Tor. Sometimes, we even use the terms Deep Web and Dark Web interchangeably. But, are they same or are hey different ? And, how does Tor work ?

Let's try to understand this.




Deep Web


Deep Web is a part of the World Wide Web which are not indexed by standard search engines. So, one cannot browse those pages normally.

For example, one can login to social networking sites by giving his username and passwords and then change the profile settings in such a way that only a selected people would be able to see information about him. So, his profile pages will not be indexed by standard search engines and those webpages will be considered to be a part of Deep Web.


There are a number of ways a webpage can be part of a Deep Web. Just to name a few :

  • Webpages that need authentication to browse through.
  • Textual content encoded in multimedia files.
  • Dynamic pages that are returned by the server in response to a specific query, for example after submitting a form.
  • Websites that limit access to their webpages.
  • Webpages that are accessible only through links produced by JavaScript.
  • Webpages that are intentionally hidden from the internet and is accessible only through special software like Tor, I2P or other darknet software.
  • Webpages that are not linked by other pages searchable by standard search engines, i.e. pages without backlinks.
  • Archived versions of webpages that are now inaccessible by search engines. There are many web archival services which enable users to see archived versions of webpages across time.



Dark Web


Dark Web is a part of the Deep Web which require specific software, configuration or authorization to access. The Dark Web is normally used for malicious purposes like child pornography, blackmarkets, or for whistleblowing etc.


Just to give some typical examples of contents of Dark Web :

  • Botnets which communicate with their C & C Server for hidden purposes.
  • Bitcoin services like tumblers.
  • Commercial darknet markets for transactions of illegal drugs etc.
  • Hacking groups and services.
  • Phishing and scams.
  • Pornography.
  • Terrorism.



What is Tor


Tor or The Onion Router is a software which can be used for browsing the internet anonymously. Tor was first developed by the United States Navy to protect sensitive communications. Later, it became open source and a multi-platform browser that is available in public.


What is anonymous browsing ?


Normally, when we browse internet, our activities can be traced back in a number of ways. Our IP address can be traced easily. Moreover, websites use cookies to store data which can reveal much information about us.

Sometimes we use Proxy Servers which work as intermediary in the connection. But, that also cannot ensure the anonymity. They keep logs of traffic, from which the actual source can be traced back.

For anonymous browsing, one needs software like Tor. Using Tor one can browse the internet without revealing his personal identity. It is mainly done by using different techniques to conceal the user's IP address and by disabling pop-up windows, cookies etc.


How does Tor work ?


Tor uses a number of different dedicated nodes using which an outgoing network packets reach its destination. In each node, the network packet is encrypted to conceal the source IP address. Only at the destination node, the packet is decrypted and the data is retrieved.

For example, suppose a user is using a Tor browser and the corresponding network packets travel from node A to node Z before reaching the destination. So, a network packet will typically follow the following path :

  • The data packet is encrypted at the user's system and reaches node A.
  • Node A will again encrypt the data packet and send it to node B.
  • Node B also will do the same and send it to node C.
  • Eventually, the data packet will reach node Z.
  • Node Z will decrypt all the layers and send it to the destination.
  • When the data will be sent back to the source from the destination, it will typically follow the reverse path.


As at each node, the packet is encrypted to conceal the IP addresses, it is extremely hard to trace back the source.



Weaknesses of Tor


Tor cannot be called to be truly anonymous. It has a number of weaknesses. And, there are a few ways that can be used to derive information on the identity of the source.

For example, one can eavesdrop on the exit node to derive data. As Tor cannot encrypt the traffic between the exit node and the destination, any exit node that does not use SSL/TLS can reveal much information on the identity of the source.

This was a short article to give information on the Dark Web, the Deep Web and Tor. Hope you liked it.



Posted by at 1 comment:

Friday, April 1, 2016

PGP vs OpenPGP vs GnuPG

If not redirected, please click here https://www.thesecuritybuddy.com/pgp-and-gpg/pgp-vs-openpgp-vs-gnupg/

PGP is a widely known software program using which one can sign, encrypt and decrypt documents, texts or emails. It can even be used to encrypt a whole disk.

But, we often see the terms PGP, OpenPGP and GnuPG. Are they same or are they different ? How are they different from each other ?

Let's try to understand that.





What is PGP ?


PGP or Pretty Good Privacy is a software program which was first created by Phil Zimmermann in 1991. History of PGP is actually pretty rich.


After creating the program in 1991, Zimmermann and his team started a company in 1996. The company started to develop new versions of PGP. It was merged with ViaCrypt and the company was named PGP Inc. They started developing PGP 3 which could be used with GUI.


In 1997, PGP Inc was acquired by Network Associates Inc. Zimmermann and his team became members of the company.


Under Network Associates Inc, PGP team started adding new features to the existing PGP program. It was at that time when features of Disk Encryption, Desktop Firewalls, Intrusion Detection and IPSec VPN was added.


In 2001, Zimmermann left Network Associates Inc.


In 2002, ex-PGP team members formed a new company named PGP Corp and bought most of the PGP assets from Network Associates Inc. Zimmermann now serves as a special advisor and consultant to PGP Corp.



What is OpenPGP ?


OpenPGP is the standard defined by OpenPGP Working Group of the Internet Engineering Task Force or IETF.

The OpenPGP Working Group was formed in 1997 and they defined the standard OpenPGP which was since then a proprietary product since 1991.

As OpenPGP became an IETF Proposed Standard, OpenPGP can now be implemented by any company without paying any license fees to anyone.



What is GnuPG ?


GnuPG or GNU Privacy Guard is an OpenPGP compliant program which was developed by Free Software Foundation.

GnuPG is freely available together with its source code under the GNU General Public License or GPL.

Now, several other vendors also have developed other OpenPGP compliant software.


The difference between PGP, OpenPGP and GnuPG


So, to summarize, PGP is the software program which was first developed by Phil Zimmermann in 1991. OpenPGP is the standard proposed by IETF. And, GnuPG is a freely available software under GNU General Public License.



How to use PGP ?


PGP is based on Public Key Cryptography. A user has to first create a public-private keypair. The private key is kept secret with the user and the public key can be distributed. This keypair can later be used to sign, encrypt or decrypt documents, texts, emails etc.


Digital Signature


Digital Signature is done to ensure authenticity and integrity of a document. A user has to make digital signatures using his private key. Any user who has public key of the sender, would be able to verify that the document is indeed sent by the particular sender and is unmodified since then.


Encryption and Decryption


To send someone an encrypted document or email securely, one has to encrypt it using the public key of the recipient. The recipient needs ro decrypt key using his private key. As the private key secret to the recipient only, only the recipient would be able to get the message.


Signing and Encryption


If a sender wants to send secret message to a recipient and ensure the authenticity and integrity of the message at the same time, then the sender has to sign as well as encrypt the message.

For that purpose, the sender needs to sign it using his provate key and encrypt it with the public key of the recipient. As the private keys are kept secret to users, only the recipient would be able to decrypt the message and at the same time, no one else other than the sender would be able to modify the message.



Read More


Posted by at No comments:

Thursday, March 31, 2016

What is DNSCrypt ?


When we type a URL in the address bar, our computer contacts the DNS Servers to get the corresponding IP address of the website. Normally, these DNS queries are unencrypted. So, attackers can intercept this process of Domain Name Resolution for various malicious purposes like Man-In-The-Middle Attacks. DNSCrypt is a protocol which is used to prevent those.



Why DNSCrypt ?



DNSCrypt is a network protocol which encrypts the traffic between the systems and the DNS Servers at the time of Domain Name Resolution, so that attackers cannot intercept that.

When we use HTTPS, SSL/TLS or VPN, the browsing traffic in encrypted. The data which is transferred between the servers and the user's computer is encrypted. But, before even establishing the secure connection with the server, our computer needs to resolve the IP address of the website using a DNS query and the connection between our computer and DNS Servers are normally not encrypted.

So, an attacker can perpetrate a Man-In-The-Middle Attack to intercept the communication with DNS Servers and use that for malicious purposes.

DNSCrypt uses Elliptic Curve Cryptography to encrypt the traffic between our computers and DNS Servers, making it difficult for the attackers to intercept the traffic.



How does DNSCrypt work ?






In DNSCrypt, both the clients and the DNS Servers first generate short term key pairs. A DNS resolver may have multiple certificates each including a validity period, a serial number, a version to indicate the key exchange mechanism, the encryption algorithm and the short term public key. The resolver can support multiple encryption algorithm and advertise multiple public keys.

When the client wants to resolve an IP address, it starts the DNSCrypt session with sending an unauthenticated and unencrypted DNS query including certificate versions supported by the client and public identifier of the provider.

The resolver responds with a public set of signed certificates.

The client then verifies the public key of the resolver which is already distributed to it. It selects the appropriate certificate.

Each certificate sent by the resolver includes a magic number unique to the public key and encryption algorithm to be used. The client then encrypts the actual query with the client's private key and the resolver's public key and sends it to the resolver.

The resolver decrypts the query with the public key of the client and appropriate private key of the resolver. And, it sends the response, again encrypting it with public key of the client and appropriate private key of the resolver.



How is DNSCrypt different from DNSSEC ?



DNSSEC does not provide encryption of actual DNS records. DNSSEC makes sure that the resolved IP address is an authentic one. But, it sends the response in an unencrypted fashion. DNSCrypt on the other hand encrypts the DNS response with cryptographic algorithm.



Can DNSCrypt and DNSSEC be used together ?



Using DNSSEC and DNSCrypt together is always a better option. By doing that, the client can be assured that the resolved IP address is the authentic IP address of the website. And, as the response is encrypted, the attackers cannot perpetrate any Man-In-The-Middle Attack there also.


So, beware of various security features, so that you can protect yourself in a better way. And, stay safe, stay protected.



Posted by at No comments:
Subscribe to: Posts (Atom)