Assignment 1: Question 4: Anti virus software

This post is for testing the anti-virus software you are using. eicar.com is a virus test file by which you can test the strength of your antivirus software. To perform the test you need to have an anti virus software installed in your computer.

Step: 1|| Check the antivirus settings on your computer. Click Start>Control Panel>Security>Security center.

Step: 2|| The virus protection setting should be on. If not turn it on.

Step: 3|| close all windows.

Step: 4|| Open your web browser and type in http://www.eicar.org/anti_virus_test_file.htm#

Step: 5|| Read all the information carefully before proceeding further.

Step: 6|| Click eicar.com, which contains a fake virus. Wait to see what happens.

In my case, Norton anti virus, detected the virus and stopped from downloading.

Step: 7|| Now click eicar_com.zip. The file contains a fake virus in a compressed (.zip) file.

In my case, a winrar browser opens up which looks like this.

Step :8-12|| These steps are unnecessary in my case, as my norton anti virus stopped me from opening the content. and showed this message.

Step: 13|| Return to the web site and this time click eicarcom2.zip. This is a double compressed zip file with a fake virus.

A winrar browser opens up.

Step: 14-19|| Double click on eicar_com.zip from the winrar browser. it opens up another browser.

Double click on eicar.com. My norton anti virus software protects me from the virus and shows this message.

Assignment 1: Question 3: Virus Attacks

Internet is now a part and parcel of modern life. More people than ever uses internet for work and pleasure. Because of its immense popularity, it is very usual that cyber crime is increasing all the time. According to the Federal Bureau of Investigation (FBI), cyber crime has cost consumers and businesses $5.8 billion in 2009. (State of internet security 2009, n.d.)

The most common sort of attacks are trojan horses. According to FBI, during the year of 2009 71% of the attacks were trojans. (State of internet security 2009, n.d.). trojans are lightweight malicious software, which are used as gateways by intruders to attack or gain remote access/control over a system through global bots and botnets. Most of them, consists of 2 parts: server and client. When a victime (unknowingly) runs the a trojan server in his/her machine the attacker than uses the client part of the trojan to connetc to the server and starts using the trojan. The protocol that is typically used by trojan horses are TCP, but some of the trojans use other protocols such as UDP etc. trojans are mainly aimed at modifying system files or windows registry. Thus, an intruder can get partial or full access to the resources of the affected computer. (How do trojans work?, n.d.).

Another highly increasing notable threat are Rogue security softwares which gains user's attention and trick them to install them by displaying fake infection results prommising to remove the infected files upon installation. It claims to provide security while doing the oposite. Those who are being tricked with such softwares are bombered with annoying fake and enormous alert messages, exposing them to additional internet threats. I personally had experience with such a software named "Personal Security" and it was very hard to remove it. Amongst other Win32/Fake AV, Win32/Waledac, Win32/Kollah etc. are to name a few.

The next comes Win32/Conflicker family. conflicker is believed to be the largest worm infection since 2003. "Win32/Conflicker.B aggresively propogates from removable drives and shared folders within the affected network. It communicates with other infected machines through its own peer-to-peer protocol while participating in a global network." (State of internet security 2009, n.d.). In 2009, new conflickers has emerged with more destructive potentials such as Win32/Conflicker.B++ and Win32/Conflicker.C.

The file infectors are also a big concern in internet security. During the first half of the year 2009, Win32/Virut has been highly active and caused a lot of security damage. Virut attaches its malicious code in various ways. "When an infected file is executed, Virut's code runs before any host program code. The virus derypts then injects part of its codes into all running processes". (State of internet security 2009, n.d.).

Next to come, are the E-mail spams, which is the most common way of infection now-a-days. Spaammers use socail engineering techniques to trick users into clicking links which then either download virus or take them to malicious coded websites. Spammers continuously change schemes and strategies to go past spam filters and exploit realistic events and topics to acheive their goal of installing maliciopus program.

A surprise comeback of Ransomware was being experienced by the first half of 2009. Ransomeware encrypts user files and data making them unusable. cybercriminals then offers to decrypt the data for a fee. Examples of Ransomware includes, Win32/FileFixPro2009, which is a duo containing Win32/FileFixPro2009.A and Win32/RansomFix.A. Win32/RansomFix.A encrypts user files and data and informs the user about the infection. To repair the files Win32/RansomFix.A redirects the user to a website which hosts Win32/FileFixPro2009.A and asks the user to purchase it for $49.95 to fix the so called "corrupted files".

With the cyber crime at its peak than ever, it ios very important to be more security cautious and implement safe computing. To be safe, you must implement the right security software update regularly, understand your daily computer activity and use common sense.

References:

1. How do trojans work? (n.d.). retrieved December 25, 2009 from http://kbase.gfi.com/showarticle.asp?id=KBID001671

2. State of internet security 2009. (n.d.). retrieved December 25, 2009 from http://itc358.googlegroups.com/web/2009ThreatReportFinal.pdf?hl=en&gda=Rkpc2k8AAAAbuQXOjJwpORSVPvRy9SpeB3MGidS2VdTc51jzEKnBjpHJOOEQ3YCMKdY77q9kpntSFZZj4oONa9gflrHsMyKw8LHiMuWlzfoXX4r9YSbaeg

Assignment 1: Question 2: Keylogger

Keylogger is aprogram that captures everything that a user enters on a computer keyboard. The program runs invisibly in the background and cannot be detected by normal users even from the Windows Task manager, as it is not shown in the application tab. However, it is possible for advanced user or computer experts to detect it from the processes tab though it is hard to find out.

The purpose of this activity is to provide information regarding how these programs function in order that adequate defenses can be designed and implemented. The steps to follow are the followings:

Step:1|| Open your web browser and enter the URL www.softdd.com/keystrokerecorder/index.html.

Step:2|| Click download here.

Step:3|| When the file download dialog box appears, click save and follow the instructions to save this file in a location such as your desktop or a folder designated by your instructor. When the download has been finished click run and follow the default installation process. Note that, some anti-virus software may detect that this program is a malware. It might be needed to temporarily disable the antivirus software in order to download and run the application. It is highly recomended though that, you turn the antivirus software back on once this assignment is finished.

Step:4|| click run keyboard collector and then click ok. when asked for a password click ok. The keyboad collector settings are as below.

Step: 5|| Select the always run checkbox.

Step:6|| click Activate/Start and then click Yes to confirm.

Step: 7|| Spend several minutes performing normal activities like creating a text document.

Step: 8|| Now examine what keylogger has captured. double click the Keyboard Collector Trial on desktop.

Step: 9|| When asked to enter a password click ok.

Step: 10|| click Run Keyboard Collector and then click ok.

Step: 11|| click view your logs and then click ok. Notice that the text you've typed has been captured.

Step: 12|| click Return and then Exit.

Step: 13|| Now notice that keyboard collector is cloaking itself so that it does not appear to be running. Press the ctrl+alt+del keys and click Start task Manager.

step: 14|| Click the application tab to see all the programs that are running at the moment.

Note that, Keylogger is not shown in the list. This kind of malwares work behind the screen so normal user cannot detect them and doesn't come to know that they are affected. They hide themselves from the Task Manager's application tab, however, it is possible to detect them if you go through every single processes that are running from the processes tab.

How to install keylogger in a computer for which you dont have a user name or password?

The best way of doing it would be sending e-mails with the virus attached to it. once the email is opened and downloaded the program will be automatically installed in that computer.

References:

1. Security+ guide to Network Security Fundamentals, Third edition, by Mark Ciampa. page: 31-33.

2. http://www.viruslist.com/en/analysis?pubid=204791931

Assignment 1: Question 1: Google Reconnaissance

This post is about "how to use google or other search engines to uncover unprotected information", which is also called "Google Reconnaissance". The steps are shown below.

Step:1|| Open your web browser and the URL www.google.com

Step:2|| Click on advance search to display the advance search screen.

Step:3|| In the text box that says, "Find web pages that has all these words:" enter "login:*" "password=*".

Step:4|| Under the file type select Microsoft Excel (.xls). The page should look like this:

step:5|| Click on Advanced search, the pages with result will be displayed.

Open selected documents and view their contents.

Step:6|| This time we will look for a list of password in clear text. In the text box that says, "Find web pages that has all these words:" erase any content and replace with "index.of passlist". And change the format type to any format. The page should look like this:

Step:7|| click on advanced search. the pages of result will be displayed.

After opening some documents and view their contents, I've found out that most of the results are rubbish, but this page was really interesting as google didn't allow me to access it. It seems that google is now aware of these hackers trying to hack using google and trying to stop them from doing so.

however, i tried a different search quote which has bring me some result. I typed inurl:passlist.txt searched for it. the result page shown like this:

after going through several pages I've finally found out something interesting. here it is, have a look.

References:

1. Security+ guide to Network Security Fundamentals, Third edition, by Mark Ciampa. page: 31-33.

Welcome

Welcome to my blog "ITC358- by Mohammad Hasibul Kaifi". This blog is mainly crated for assignment purpose of the subject named "ITC358". Thanks and welcome to view my posts. any comments are entirely welcome.