Code Injection.

There has been a sudden increase of attacks on sites that have Code Injection vulnerabilities. Code Injection is a term used when code is injected straight into a program/script from an outside source for execution at some point in time.

Read More

Preventing DNS poisoning

DNS poisoning could lead to crime ware by Identity theft, purchasing a fake anti-virus, getting unwanted malware without knowledge. These could lead to severe consequences like taking the punishment for someone else's crime.

Preventing DNS poisoning:
The First thing we can do to prevent DNS poisoning is to make sure that we have the latest version of DNS. DNS based on BIND 9.3.x or Microsoft Windows Server 2003 is far more secure than DNS implemented with earlier versions.
Recursive queries should be limited to internal DNS servers. If Internet facing recursive queries are required, only queries from internal addresses should be accepted. This will help prevent outside systems from sending queries with malicious intent.

Many cache poisoning attacks can be prevented on DNS servers by trusting the information to a lesser extent passed to them by other DNS servers, and ignoring any DNS records passed back which are not directly relevant to the query. We can use cryptography help to help secure our DNS servers from being poisoned.

Adding additional security to the LAN with the encrypting technology like DNSSEC where it uses cryptographic electronic signatures signed with a trusted public key certificate to determine the authenticity of data. DNSSEC can counter cache poisoning. Clearing the cookies when we go to any particular suspicious site having a good firewall, Updating the Internet Security Definitions regularly will help mitigate the poisoning.

• Use TSIG to digitally signed zone transfers and zone updates – one of the best ways to prevent poisoning is to force identification of the sending authoritative source

•  Restrict dynamic DNS updates when possible
• Hide the version of BIND being used on the DNS servers 
• Remove unnecessary services running on the DNS servers and use dedicated appliances instead of multi-purpose servers that allow unauthenticated Server queries
• Physically separate external and internal DNS servers
• Restrict Zone transfers.

Read More

DNS is abbreviation of Domain Named System which helps in changing the IP addresses to names given to their respective domain names. This avoids the task of remembering numerous IP addresses that are there in the world. Its poisoning means the compromise occurs when data is introduced into a DNS name server's cache database that did not originate from authorized DNS sources. It may be a deliberate attempt of a maliciously crafted attack on a named server.When a DNS server has received such non-authentic data and caches it for performance optimization, it is considered poisoned, supplying the non-authentic data to the clients of the server.Domain Named Server translates a domain name in to an IP address that Internet hosts use to  contact Internet Resources of that particular domain.If a DNS server is poisoned, it may return an incorrect IP address, diverting traffic to another computer.

Read More

Using Shortened URLs: Security Risks

URL shortening services such as TinyURL.com and Bit.ly are becoming trendy attack methods. We all share website links with each other through emails, blogs, social media sites, book marking websites and word of mouth and we rarely, if ever, think about the potential security risk this simple act can raise. You may not want to automatically click on the shortened URL after you read this.

What is URL Shortening?

The compacted URLs produced by services such as TinyURL.com, bit.ly, is fine, and many others are convenient and save space, but they can also be used to hide the identity of malicious sites. The idea behind URL shortening or link shortening is very simple, take a long URL and encrypt it to produce a shorter URL. This is what URL shortening services do.

Security Risks

• Allow spammers to override spam filters as domain names like TinyURL are automatically trusted.
• Prevent users from checking for suspect URLs by obfuscating the actual Web-site URL.
• Redirect users to phishing websites in order to get sensitive personal information.
• Redirect users to malicious websites, just waiting to download malware.

Fortunately, there are several ways to look behind a shortened URL to see exactly where the link will take you - before you click it! Every URL-shortening service I'm aware of offers one or more ways to preview the real destination of a shortened link.

For example, here's a typical bit.ly URL that I created. All it does is take you to the http://www.techsupp247.com/ home page, but there's no way to know that in advance - it's a blind link:

bit.ly/tsp247

So you want to see where the link really goes before you click it.  It's easy: all you have to do is copy the link, paste it into the address bar of any browser window or tab, and add a plus sign to the end, like this:

bit.ly/tsp247+

Adding a plus sign to the end of any bit.ly URL brings you to a special bit.ly page that shows you information about the link, including the full, expanded URL. Using the information on that bit.ly page, you can decide whether the link is safe and worth following.

TinyURL has a similar option. But instead of adding a plus sign at the end of a link, you prepend the word preview. For example, here's a regular TinyURL link to the Windows Secrets home page:

http://tinyurl.com/TS247

Copy that link into the address bar of your browser and add the word preview:

http://preview.tinyurl.com/TS247

Now the link will bring you to a preview page that displays the full, expanded URL. Like all the other major URL-shortening services, TinyURL offers an easy way (circled in green) to preview the true destination of a shortened link.

All the major URL-shortening services have similar ways of letting you preview what's behind their URLs.
If you're checking lots of links, it can be tedious process to manually copy, paste, and edit URLs. Several sites offer automated scripts to make things a bit easier. For example, when you encounter a suspicious short URL, you can try Longurl.org, ExpandMyURL.com, or LongURLPlease.com

Firefox users can install the bit.ly preview add-on to allow previewing of short URLs without needing to leave the page you're on. Despite the name, the add-on works for many URL-shorteners - not just bit.ly. Chrome users can also download a similar extension for that browser. There is no fully automated preview tool for Internet Explorer, although several URL-shortening apps are available in the Microsoft IE Add-ons Gallery. Just type url into the search bar.

Conclusion

URL shortening is a useful and convenient service; just make sure you exercise some common sense and an ounce of caution to avoid being exploited by a shortened URL. Many industry experts say that we shouldn’t click on active links, whether they’re in e-mail messages, IM messages, or tweets. That’s an unrealistic expectation; so just make sure to approach links with caution. If possible, use one of the preview features to check out the link first.

Read More

Threat Types

Threats to your computer system, data, and identity come in many different forms, a few of the most common are listed as follows:

Viruses:

A virus is a self-replicating program that is designed to damage or degrade the performance of a computer. A virus is replicated by being copied or by initiating its copying to another program, computer boot sector or document. Viruses can be classified into four different categories as follows:

File Infector

A File infector virus when executed on a system will seek out other files and insert its code into them. The programs with .EXE and .COM extensions are the most commonly targeted, but a file infector virus can target any executable file.

This infection is most commonly distributed via compromised networks, over the web via drive-by, or from a corrupted media (CDRW, flash media).

Read More