Intentional misuse of your computer

posted under by nandu reddy
The most common methods used by intruders to gain control of home computers are briefly described below. More detailed information is available by reviewing the URLs listed in the References section below.

Trojan horse programs

Back door and remote administration programs

Denial of service

Being an intermediary for another attack

Unprotected Windows shares

Mobile code (Java, JavaScript, and ActiveX)

Cross-site scripting

Email spoofing

Email-borne viruses

Hidden file extensions

Chat clients

Packet sniffing

source:- http://www.cert.org/tech_tips/home_networks.html

What is IP?

posted under by nandu reddy
IP stands for "Internet Protocol". It can be thought of as the common language of computers on the Internet. There are a number of detailed descriptions of IP given elsewhere, so we won't cover it in detail in this document. However, it is important to know a few things about IP in order to understand how to secure your computer. Here we’ll cover IP addresses, static vs. dynamic addressing, NAT, and TCP and UDP Ports.
An overview of TCP/IP can be found in the TCP/IP Frequently Asked Questions (FAQ) at
http://www.faqs.org/faqs/internet/tcp-ip/tcp-ip-faq/part1/
and
http://www.faqs.org/faqs/internet/tcp-ip/tcp-ip-faq/part2/

source:- http://www.cert.org/tech_tips/home_networks.html

What is an IP address?

posted under by nandu reddy
IP addresses are analogous to telephone numbers – when you want to call someone on the telephone, you must first know their telephone number. Similarly, when a computer on the Internet needs to send data to another computer, it must first know its IP address. IP addresses are typically shown as four numbers separated by decimal points, or “dots”. For example, 10.24.254.3 and 192.168.62.231 are IP addresses.
If you need to make a telephone call but you only know the person’s name, you can look them up in the telephone directory (or call directory services) to get their telephone number. On the Internet, that directory is called the Domain Name System, or DNS for short. If you know the name of a server, say www.cert.org, and you type this into your web browser, your computer will then go ask its DNS server what the numeric IP address is that is associated with that name.
Every computer on the Internet has an IP address associated with it that uniquely identifies it. However, that address may change over time, especially if the computer is
dialing into an Internet Service Provider (ISP)
connected behind a network firewall
connected to a broadband service using dynamic IP addressing.

source:- http://www.cert.org/tech_tips/home_networks.html

What is computer security?

posted under by nandu reddy
Computer security is the process of preventing and detecting unauthorized use of your computer. Prevention measures help you to stop unauthorized users (also known as "intruders") from accessing any part of your computer system. Detection helps you to determine whether or not someone attempted to break into your system, if they were successful, and what they may have done.

source:- http://www.cert.org/tech_tips/home_networks.html

why computer security?

posted under by nandu reddy
We use computers for everything from banking and investing to shopping and communicating with others through email or chat programs. Although you may not consider your communications "top secret," you probably do not want strangers reading your email, using your computer to attack other systems, sending forged email from your computer, or examining personal information stored on your computer (such as financial statements).

source :- http://www.cert.org/tech_tips/home_networks.html

Ways how Hackers breach security !

posted under by nandu reddy
1. Stealing Passwords

2.Trojan Horses

3. Exploiting Defaults

4. Man-in-the-Middle Attacks

5.Wireless Attacks

6. Monitoring Vulnerability Research

for full article
source :- http://images.globalknowledge.com/wwwimages/whitepaperpdf/WP_Steward_Hackers.pdf

Safe Internet Browsing Practices

posted under by nandu reddy

1. Make sure your computer is updated!

2. Browse the Web with an up to date browser!

3. Run anti-spyware programs weekly.

4. Set your Operating System to always show file extensions.{PC Users: Go to 'My Computer' - 'Tools' - 'Folder Options' - 'View' tab - and take the check out of 'Hide file extensions for known file types'.Mac Users: Click on 'Finder' - and select the option to show all file extensions.}

5. Other Safe Browsing Practices

a)Stay on trusted web sites.
b)Never follow a link in an email that wants you to update account/personal information.
c)ot open unknown email attachments.
d)Links may not be what they seem. Hold the mouse pointer over a link to see the actual link location (usually displays in the bottom left).
e)Do not run programs that are of unknown origin.

How to Detect a Hacker Attack?

posted under by nandu reddy

How to Detect a Hacker Attack
Most computer vulnerabilities can be exploited in a variety of ways. Hacker attacks may use a single specific exploit, several exploits at the same time, a misconfiguration in one of the system components or even a backdoor from an earlier attack.
Due to this, detecting hacker attacks is not an easy task, especially for an inexperienced user. This article gives a few basic guidelines to help you figure out either if your machine is under attack or if the security of your system has been compromised. Keep in mind just like with viruses, there is no 100% guarantee you will detect a hacker attack this way. However, there's a good chance that if your system has been hacked, it will display one or more of the following behaviours.
Windows machines:
Suspiciously high outgoing network traffic. If you are on a dial-up account or using ADSL and notice an unusually high volume of outgoing network (traffic especially when you computer is idle or not necessarily uploading data), then it is possible that your computer has been compromised. Your computer may be being used either to send spam or by a network worm which is replicating and sending copies of itself. For cable connections, this is less relevant - it is quite common to have the same amount of outgoing traffic as incoming traffic even if you are doing nothing more than browsing sites or downloading data from the Internet.
Increased disk activity or suspicious looking files in the root directories of any drives. After hacking into a system, many hackers run a massive scan for any interesting documents or files containing passwords or logins for bank or epayment accounts such as PayPal. Similarly, some worms search the disk for files containing email addresses to use for propagation. If you notice major disk activity even when the system is idle in conjunction with suspiciously named files in common folders, this may be an indication of a system hack or malware infection.
Large number of packets which come from a single address being stopped by a personal firewall. After locating a target (eg. a company's IP range or a pool of home cable users) hackers usually run automated probing tools which try to use various exploits to break into the system. If you run a personal firewall (a fundamental element in protecting against hacker attacks) and notice an unusually high number of stopped packets coming from the same address then this is a good indication that your machine is under attack. The good news is that if your personal firewall is reporting these attacks, you are probably safe. However, depending on how many services you expose to the Internet, the personal firewall may fail to protect you against an attack directed at a specific FTP service running on your system which has been made accessible to all. In this case, the solution is to block the offending IP temporarily until the connection attempts stop. Many personal firewalls and IDSs have such a feature built in.
Your resident antivirus suddenly starts reporting that backdoors or trojans have been detected, even if you have not done anything out of the ordinary. Although hacker attacks can be complex and innovative, many rely on known trojans or backdoors to gain full access to a compromised system. If the resident component of your antivirus is detecting and reporting such malware, this may be an indication that your system can be accessed from outside.
Unix machines:
Suspiciously named files in the /tmp folder. Many exploits in the Unix world rely on creating temporary files in the /tmp standard folder which are not always deleted after the system hack. The same is true for some worms known to infect Unix systems; they recompile themselves in the /tmp folder and use it as 'home'.
Modified system binaries such as 'login', 'telnet', 'ftp', 'finger' or more complex daemons, 'sshd', 'ftpd' and the like. After breaking into a system, a hacker usually attempts to secure access by planting a backdoor in one of the daemons with direct access from the Internet, or by modifying standard system utilities which are used to connect to other systems. The modified binaries are usually part of a rootkit and generally, are 'stealthed' against direct simple inspection. In all cases, it is a good idea to maintain a database of checksums for every system utility and periodically verify them with the system offline, in single user mode.
Modified /etc/passwd, /etc/shadow, or other system files in the /etc folder. Sometimes hacker attacks may add a new user in /etc/passwd which can be remotely logged in a later date. Look for any suspicious usernames in the password file and monitor all additions, especially on a multi-user system.
Suspicious services added to /etc/services. Opening a backdoor in a Unix system is sometimes a matter of adding two text lines. This is accomplished by modifying /etc/services as well as /etc/ined.conf. Closely monitor these two files for any additions which may indicate a backdoor bound to an unused or suspicious port.

India tackles cyber crime BBC NEWS

posted under by nandu reddy
Sunday, 23 July, 2000, 16:45 GMT 17:45 UK

India's top police officials and information technology experts are meeting in Delhi to discuss ways of countering cyber crime.
The one-day "Cyber law and police" seminar has been organised by India's leading crime-fighting agency, the Central Bureau of Investigation (CBI).
Information and Technology Minister, Pramod Mahajan told the gathering that computer crime would soon be the biggest challenge for the police and lawmakers.
Mr Mahajan said the authorities need to wake up now, or face becoming mere spectators as criminal IT use increases.
Computer crimes mainly involve unauthorised access, data alteration and destruction and theft of intellectual property.
"Crimes like fraud, pornography, illegal sales can all be done by computers," Mr Mahajan said.
He also warned that cyber crimes could take on a far more serious dimension in the near future.
New breed
Experts believe a new breed of criminals could damage telecommunications or rail links, disrupt power supplies and harm other important parts of India's infrastructure.
The CBI has invited senior police officials from across India, and IT and law experts to work out effective ways of fighting cyber offences.
The CBI chief, R K Raghavan, said they had sought help from several foreign agencies, including the US Federal Bureau of Investigation, in tackling the recent boom in cyber crimes.
Last year, FBI experts visited India and trained policemen in dealing with such offences. The CBI has now set up its own special cyber crime unit.
The Indian parliament recently passed a law dealing with computer crimes, but experts say police and security agencies need to be more pro-active in dealing with the growing threat.

SOURCE:- http://cybercrime.planetindia.net/indiatackle_cybercrime.htm