Test Computer for Installed KeyLoggers

Apart from Phishing, Keyloggers are one of the key factors contributing to the rise of cases of Identity theft in recent times. Keyloggers are not the old hardware types anymore, which could easily be spotted by a careful visual inspection of your computer wires and cables.

Today’s keyloggers are smart. They have the capabilities to hide themselves deep into your software applications and operate from there. And they are easy to install and control for a remote person, thanks to some careless attitude of many of the victims.

How to check, if your computer already has a Keylogging Software installed?

Many of the Security Software suites available today are able to detect most of the common keylogging software. As soon as some keylooger is attempted to be installed on your system, your security suite warns you about that and you can take appropriate action.

But, are you sure that your security software is capable of identifying keylogging activities? There is a simple test software available from Zemana, which lets you simulate a keylogger on your computer. You can download it absolutely free and run it on your computer. If your security software is able to detect it, then you may be confident about the effectiveness of that against keyloggers, otherwise it is time to have a second look at your choice of security software.

My Testing of Zemana

I have been using Norton 360 on my Laptop and it was not able to intercept this keylogging simulator software. But at the same time, I am also using KeyScrambler, which encrypts the data you enter through your keyboard. I was happy to note that all the text, which Zemana Keylogging Simulator could cpature was the encrypted text and not the actual keystrokes.

Thus, KeyScrambler was actually performing its job quite effectively and I was protected against such Keylogging activities.

Nice tool, and I recommend you to give it a try to test, if any keylogger is installed onto your system. You never know, when huge surprise start staring on your face.

Download Zemana Keylogging Simulator Test

Crack, Recover or Remove Lost or Forgotten Password in Excel

Passwords are your key to security. We have often advised against the use of weak passwords and not to repeat them at different websites and applications. But using strong passwords has its own inconveniences and hassles.

There are many instances when you may need to crack or recover a lost or forgotten passwords. For instance, an employee might have just left your company and that important client spreadsheet created by him last Friday had a password only known to him. Or you yourself had a locked an important Excel file with a strong password and you are not remembering it just because it is already six months back. Orone of your family members has put a not-so-easy password on your important file.

Or may be, you just want to break the Excel password of a colleague’s file.

We just found a nice tool to crack or recover passwords from Microsoft Excel Files with ease.Petri IT Knowledgebase Team has come out with an Excel Password recovery, which does the job of cracking Excel Passwords in a few clicks.

They have a useful step-by-step guide to help you out for recovering excel passwords. This guide outlines how to use a simple Excel password recovery application to crack lost or forgotten passwords, allowing you to unlock password-encrypted Microsoft Excel documents quickly as possible.

Barada Open source Two Factor Authentication system

Perhaps you occasionally find it necessary to access your email or login to a remote server from a computer that is not your own. The problem, of course, is that it is often unwise to type your password into computers that are not under your control. Terminals at libraries, internet cafes, or maybe even your less-careful friend's houses could be running keystroke loggers.

There are existing solutions for this, of course. The two obvious choices are a One Time Password system (like S/Key or OTPW) or a Two Factor Authentication system (like RSA SecureID or CryptoCard). We don't like the OTP option because it requires that you carry a list of passwords around with you, there can be logistical problems if you get to the end of your list while you're still traveling, and you have to type your constant "prefix" for each OTP into untrusted computers. So we prefer two factor authentication because there is the security of two factors (something you have and something you know) and it solves the keystroke logging problem in a more convenient way (no lists, no out of date information, no typing of anything but a temporary access code into untrusted computers).

Ironically, then, the problem with systems like SecureID or CryptoCard is that they're often not convenient. They cost money to license, the hardware costs money, and they're difficult to maintain. You have to setup a dedicated Solaris machine with RADIUS support just to deploy SecureID, which isn't really great for someone with a small setup.

And that's why we wrote this. Barada turns your phone into a two factor authentication device. It's an implementation of the HOTP protocol in the form of a PAM module (the server) and an Android applicaton (the client).

Basically, in addition to a normal password, users are also assigned a PIN number and a 128 bit key. Every time you'd like to login using two-factor authentication, you open up the Android application, type in your PIN number, and get back a six character one time password that you can then use to authenticate remotely. The PIN number is not stored on the phone, and the the OTP can only be used exactly once. Thus, the loss of the phone does not result in leaked passwords, and the capture of an OTP does not result in remote access.

This module can be installed above the normal authentication module in the PAM stack, so at any moment you can either use your normal password or Barada's two-factor authentication interchangably. Sitting at a trusted computer, you might choose to quickly type in a password, while you might choose to use two-factor authentication when using a non-trusted or public computer.

Download :- Barada

Big Issue- The Never Expiring Password

It seems that many if not all IT Auditors, CSOs, and IT security staff, live daily with the fear of the “never expiring password” being exposed. It is the unspoken taboo – the wide open back door in every corporate network today. It is virtually certain that there is not a single business critical application in your company that isn’t wide open. Do you ever wonder how it is that information such as credit card details, personal data, intellectual property, seems to always be so vulnerable. You would think that companies had adequate security precautions to stop this happening, and yet it continues to be a problem.

So where is this wide open back door? In every one of your applications.

When, for example, a user accesses a web based application through a Portal, behind the scenes an awful lot of activity takes place to present the information to the user. This information is stored on systems and databases in your organisation. In order to access these resources, the Portal uses service accounts created on the systems to access the data.

The challenge of securing, managing and sharing the service accounts becomes a major overhead issue for IT departments and application managers in your organisation. The Service Account Passwords that enable applications to communicate with each other must also be managed as they present one of the biggest security backdoors.

In order for these applications to get access to data, they have to “logon” to the systems and applications that store the data, and since the credentials to logon are in the application, they are embedded in the code. Now since it is clearly impractical to rewrite applications on a regular basis, just to change the user ID and password, the result is that the user ID and password never changes. So what’s the big deal you might ask? Well there are a number of things.

Firstly you have the problem of the never expiring password on a system which is accessible by administrators and anyone else who might have privileged access to a system. The problem is more acute when a company is relying on hosting services from a third party. Your applications are accessing valuable business critical data thousands of times a day, using the same user ID and password. In fact there might very well be hundreds of applications all accessing using the same credentials. And since the applications do not have any integrated security such as VPN technology, the passwords to these accounts are often stored in clear text (not encrypted), thus becoming visible to developers, support staff and anyone that has access to the application code.

Secondly because these passwords are often hard coded within the applications/scripts, a reset of a Service Account password becomes a complex process involving changes to application code, compilation, and in some cases a long process of transferring the code from development to QA to production. In some cases this change might result in or require downtime for the application, a scenario that is unacceptable in cases of confidential information.

Thirdly auditing is virtually impossible. Because the credentials that are embedded in the application, although in theory only accessible to the application they can actually be used by any developer who has access to the code. So if for example a person was to log in using the credentials, it would be impossible to discover this through a simple audit check.

Finally the most serious aspect of this is that this user ID and password is known by developers and support staff and can be used for personal access to the resources. And in many cases today those credentials are know by off-shore developers who have been contracted to develop the applications for your organisation. So access to your business data is ultimately in the hands of developers who may be thousands of miles away.

It is likely that your organisation has gone to unprecedented efforts to secure your access as a user, using all kinds of innovative technology from tokens to digital certificates, and at the same time forgetting or possibly choosing to ignore that unauthorized personnel including ex-employees, MSP staff, off-shore developers, have the keys to open up your most valuable assets.The good news is that there are solutions available that will allow you to once and for all face up to this unspoken taboo and eliminate this threat.

The solution is digital vaulting technology. It means that no organisation today needs to feel a sense of being exposed to risks in this area. Regardless of the platform, the technology is available today to ensure that all your applications will never again require the never expiring password, but the first step in solving the problem is to face up to the unspoken taboo in your organisation and do something about it.

Beware the Default Password

During the course of a recent security audit I was rather surprised to find a critical system still running with a default password. The default password has long been the bug bear of many the security admin. At the same time it has been the savior of many of us at one stage or another, desperately locked out from that system, urgently requiring access, and no clue as to what the password is, or might be.

The default password is generally installed by the manufacturer, most often on hardware devices such as routers and wireless access points, but also by software application developers and even on some operating systems, although this is becoming less and less commonplace. The default password exists to allow an administrator initial access, for setup and configuration, and you are generally forced, or at least you should be, to change the password to something more complicated as the configuration advances. Unfortunately, this is not a step that everyone takes.

Worse again, there have been numerous accounts of software and hardware products that have 'undocumented' administrative accounts installed. So, even if you took the conscientious step of removing or changing what you thought was the default, you may still be exposed. Take Oracle for example. Pete Finnegan, the self-confessed master of all things Oracle, maintains a web page devoted to the Oracle default password. At the last count, there are more than 600 unique accounts in his list. Mr. Finnegan has some interesting views on how many of these accounts come about to be created in the first instance. He says some "are created by Oracle itself when the database is created. For instance the accounts SYS and SYSTEM, DBSNMP and OUTLN are often created by default when a database is created. If the database is created by using the wizard the problem can be much bigger with 10s 0r 20s of accounts being created simply as part of the database creation".

It is also the case that further Oracle default users can be created when third party software is installed for use such as BAAN or SAP. The same issues of default users being added to the database can occur when third party development or maintenance tools are added such as TOAD or PL/SQL Developer. An excellent tool that will scan your Oracle implementation for signs of default accounts can be downloaded here. If your organization uses Oracle, there is a strong chance that you will be susceptible.

As recently as February this year, researchers at the University of Indiana published reports that show how attackers could take over your home router using malicious JavaScript code. All is required is for the default password to be in place. Once the router has been compromised, victims can be redirected to fraudulent Web sites, the researchers say. So instead of downloading legitimate Microsoft software updates, for example, they could be tricked into downloading malware. Instead of online banking, they could be giving up sensitive information to phishers. At the heart of the problem is the fact that consumer routers ship with simple, well-known default passwords, like "admin," which could be exploited by attackers. "Owners of home routers who set a moderately secure password - one that is non-default and non-trivial to guess - are immune to router manipulation via JavaScript," the paper states.

It is easy to lay some of the blame on the door of the manufacturer. They could be accused of shipping product with poorly configured security settings. Lets face it; it is not hard for them to force the user to change the initial configuration password. But that alone is not enough. What about the 'undocumented' password, the one that you don't even know about?

There are resources available on the Internet that allows you to audit your network devices and software applications. This should be performed as part of your yearly audit schedule. A simple Google search for 'default password list' yields hundreds of sites that claim to have the most comprehensive database of default passwords. One of the oldest, and still reliable, can be found here. It makes for some interesting reading and is regularly updated.Whatever the organization, whatever the choice of software or hardware vendor, the default password is likely to raise its ugly head from time to time. Be proactive and get scanning. You will be amazed at what you may find.

Reducing Shoulder-surfing by Using Gaze-based Password Entry

Shoulder-surfing – using direct observation techniques, such as looking over someone's shoulder, to get passwords, PINs and other sensitive personal information – is a problem that has been difficult to overcome. When a user enters information using a keyboard, mouse, touch screen or any traditional input device, a malicious observer may be able to acquire the user’s password credentials.

EyePassword, a system that mitigates the issues of shoulder surfing via a novel approach to user input. With EyePassword, a user enters sensitive input (password, PIN, etc.) by selecting from an on-screen keyboard using only the orientation of their pupils (i.e. the position of their gaze on screen), making eavesdropping by a malicious observer largely impractical.

This paper contains a number of design choices and discusses their effect on usability and security. We conducted user studies to evaluate the speed, accuracy and user acceptance of our approach. Our results demonstrate that gaze-based password entry requires marginal additional time over using a keyboard, error rates are similar to those of using a keyboard and subjects preferred the gaze-based password entry approach over traditional methods.Download the paper in PDF format here.

raWPacket HeX - Network Security Monitoring & Analysis LiveCD

HeX is a project aimed at the NSM (Network Security Monitoring) community for use by network security analysts। The developers believe that simplicity and analysis work flow logic must be enhanced and emphasized through-out the process of designing this liveCD. Not only have they carefully chosen all the necessary applications and tools to be included to the liveCD, they have also tested them to make sure everything running as smooth as possible. In order to summarize the objective of HeX, they are trying to develop the first and foremost Network Security Monitoring & Network Based Forensics liveCD!

HeX Main Features
HeX Main Menu - Cleaner look and more user interface oriented and maximum 4 levels depth HeX Main Menu allows quick access to all the installed applications in हेक्स।

Terminal - This is exactly what you need, the ultimate analyzt console!
Instant access to all the Network Security Monitoring(NSM) and Network Based Forensics(NBF) Toolkits via Fluxbox Menu। We have also categorized them nicely so that you know what to use conditionally or based on scenario.

Instant access to the Network Visualization Toolkit, you can watch the network traffics in graphical presentation and that assist you in identifying large scale network attacks easily।

Instant access to Pcap Editing Tools which you can use to modify or anonymize the pcap data, it’s great especially when you want to share your pcap data।

Network and Pentest Toolkits contain a lot of tools to perform network or application based attacks, you can generate malicious packets using them and study malicious packets using those analysis tools listed in NSM-Toolkit and NBF-Toolkit as well।

While we think HeliX liveCD is better choice in digital forensics arsenal, Forensics-Toolkit can be considered as the add-on for people who are interested in doing digital forensics.
Under Applications, there are Desktop, Sysutils and Misc, all of them are pretty self-explained and contain user based applications such as Firefox, Liferea, Xpdf and so forth. Additionally, Misc contains some useful scripts, for example you can just start ssh service by clicking on SSHD-Start.
You can download HeX 1.0.3 here:
hex-i386-1.0.3.iso

NetworkMiner - Passive Sniffer & Packet Analysis Tool for Windows

NetworkMiner is a passive network sniffer/packet capturing tool for Windows with an easy to use interface. It can detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis.
NetworkMiner makes use of OS fingerprinting databases from both p0f (by Michal Zalewski) and Ettercap (by Alberto Ornaghi and Marco Valleri) in order to do as correct passive OS fingerprinting as possible। NetworkMiner also uses the MAC-vendor list from Nmap (Fyodor).

The purpose of NetworkMiner is to collect data about hosts on the network rather than to collect data regarding the traffic on the network. The main view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames).
NetworkMiner can extract files transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This is a neat function that can be used to extract and save media files (such as audio or video files) which are streamed across a network.
Another very useful feature is that the user can search sniffed or stored data for keywords। NetworkMiner allows the user to insert arbitrary string or byte-patterns that shall be searched for with the keyword search functionality.

A feature the author wants to include in future versions of NetworkMiner is to use statistical methods to do protocol identification (protocol fingerprinting) of a TCP session or UDP data. This means that instead of looking at the port number to guess which protocol is used on top of the TCP/UDP packet NetworkMiner will identify the correct protocol based on the TCP/UDP packet content. In this way NetworkMiner will be able to identify protocols even if the service is run on a non-standard port.
You can download NetworkMiner here:
NetworkMiner-0.82
Or you can read more here.

Issues to look out for during the holiday season

Piracy

During the Christmas period, companies are at higher risk of having one or more employees copy copyrighted material onto their network. This can be for a number of factors. Employees will figure that security will be more lax, with the possibility of multiple administrators on holiday thus risking more than usual, figuring they can get away with copying or downloading illegal material without getting caught.

During Christmas time a lot of people buy presents for each other. In the tech industry especially, but even in any other industry it is likely that a good deal of these presents will be some kind of electronic gadgets. Gadgets that are likely to be able to copy and carry a good deal of data, such as mp3 players, portable video players, cameras, and portable storage. Eager to try these devices out, employees are likely to bring them to work with them.

Spamming and Social Engineering mails are also a possible source of piracy. Illegal software vendors might try selling illegal copies of software at low prices, portraying the low price as a big Christmas discount making the deal seem more legitimate.

Strong Passwords

Before leaving for Christmas holidays, it is essential to ensure that any computers which will be left running have strong passwords. During the Christmas holidays machines are more likely to suffer attacks.

Malicious persons will likely be on holiday as well, thus having more time on their hands to perform targeted attacks.

Attackers will figure that security is probably quite lax as administrators too go on holiday. This would be the perfect time to run brute force attacks which are not likely to be detected or acted upon until after the next year, plenty of time to cover tracks and set a stronghold on the hacked machine.

Administrators absence

As administrators take holidays there are numerous aspects that have to be considered and secured. The security of the network must still be handled efficiently, even with the decreased administrator to users ratio or even, in some cases, complete administrator absence.

Automatic updates. During the holiday season, viruses and Malware are more likely to be on the rise as virus writers take break from their respective work places and find themselves with more free time. Thus it is essential that, in the administrators absence, antiviruses continue running, scanning the network and updating themselves with the latest virus definition files.

As administrators are away from work, or a small percentage of administrators are left to cope with a large work load, systems must be in place to automatically monitor the network situation and alert administrators when things go wrong. During the holiday season it is essential that such tools support notifications not only through email system but also through mobile technologies such as SMS. This is crucial as email checking might suffer as people tend to be more socially active during this time of the year.

Company Shutdown

As companies shut down for the Christmas period, it is essential that not only the personnel go on shutdown but also the non essential services.

Wireless is one such service that, unless it is really needed during a company shutdown, it should be switched off. Wireless is a favorite attack vector as it gives a direct opportunity to gain access to the internal network infrastructure without having to physically break into the company building itself. As an example, the technology allows an attacker to park his car next to the company building and use wireless technology and software to sniff out communication packets, and possibly also use weak passwords to gain access to the operating environments susceptible to man-in-the-middle attacks like shares, unpatched operating systems and more. When not needed, especially during a Christmas shutdown, wireless should strictly be turned off.

Further to Wireless, any service and servers which are not required during the Christmas shutdown should also be disabled if they are not going to be used. This will ensure that, if the organization is targeted, hackers will have the minimum number of attack vectors available to them.

Ref: http://www.eimagazine.com/xq/asp/sid.0/articleid.A2E3D650-5469-4DAD-9C7F-BC3739D836B4/qx/display.htm

Physical Security

During the Christmas period, generally one would find less people at work places because most people would be enjoying Christmas holidays. Such a situation might lead insiders with bad intent to try to access restricted information, feel safer and might consider acting on it during this low period. Thus it is imperative to ensure critical servers which have crucial information are physically secure. Administrators should ensure server rooms are securely locked before leaving for holidays. Same goes for network switches, wireless equipment and any other device which might provide an entry point to secure networks.

Administrator computers should be considered as critical computers which also need to be physically secure just like servers. Furthermore, hard disk content should be encrypted. If hard disk content is left unencrypted and the only security is relied upon the login procedure, people with ill intend who have access to the administrator computer could easily extract the hard disk, connect it to another computer and possibly copy passwords or implant torjans and sniffers to allow easier future network penetration.

Good Password Guidelines

It’s common sense for most people on the hacking side of computer security as we know how easy it is to break a password when it’s only a few characters long or it uses a dictionary word (even if it is postfixed with a couple of digits, a hybrid dictionary attack breaks it pretty fast).

Even more so if you are utilising some decent Rainbow Tables and the RainbowCrack method (time/memory trade-off).

The basics of creating a secure password:

• Include punctuation marks (,.;), special characters (!#$%^) and numbers.
• Mix capital (uppercase), lowercase and space characters.
• Create a unique acronym.
• Short passwords should be 8 chars at least.

Some potential weaknesses to avoid:

• Don’t use a password that is listed as an example or public.
• Don’t use the same password you have been using for years.
• Don’t use a password someone else has seen you type.
• Don’t use a password that contains personal information (names, birthdays or dates that are easily related to you)
• Don’t use words or acronyms that can be found in a dictionary.
• Don’t use keyboard patterns (qwerty) or sequential numbers (12345).

Once you have a good password it’s equally important to keep your password secure:

• Never tell anyone your password or use it where someone can observe it.
• Never send your password by email or say it where others may hear.
• Occasionally verify your current password and change it to a new one.
• Avoid writing your password down. (Keep it with you in a purse or wallet if you have to write down the password until you remember it.)

And never label that scrap of paper in any way, write it down on an the back of an old businesscard or something that doesn’t indicate it’s a password.

Don’t give anyone who finds (or gains access to) your purse/wallet any clue of what the password means or what it is related to.

128 bit entropy in a password requires a long randomized passphrase, which wouldn’t be very usable, there has to be a trade somewhere between security and usability.

You can also use online password generators such as http://makemeapassword.com/, the problem with these however, is that they do create strong passwords but they aren’t easy to remember, which kind of defeats the purpose.

Another thing you can do is use something like a password safe to keep all the hard to remember passwords in one place, the one I would recommend is from Bruce Schneier and is actually called “Password Safe”.

Password Safe is an Open Source (free) tool that allows you to have a different password for all the different programs and websites that you deal with, without actually having to remember all those usernames and passwords. Password Safe runs on PCs under Windows (95/98/NT/2000/XP).

You can find it here:

http://passwordsafe.sourceforge.net/

Any other inputs?

Digg This Article