Entries Categorized as 'Threats'
July 8, 2008
Top Ten Reasons why Websites Get Hacked
Experts say most Web applications can be hacked. Here are the top ten vulnerabilities that could put your Web site at risk.
1. Cross site scripting
2. Injection flaws
3. Malicious file execution
4. Insecure direct object reference
5. Cross site request forgery
6. Information leakage and improper error handling
7. Broken authentication and session management
8. Insecure cryptographic storage
9. Insecure communications
10. Failure to restrict URL access
SOURCE: OWASP (the Open Web Application Security Project)
Related Links For added reading : NetworkWorld.com
Posted in Hacks, Info, Threats, Web Security 
No Comments »
April 17, 2008
The FBI called for new legislation that allows the federal police to keep close look at internet activity to track down illegal activities. This seem to go beyond a current plan to monitor traffic on federal-government networks, and that the bureau should have a broad “omnibus” authority to conduct monitoring and surveillance of private-sector networks as well. This could violate the Fourth Amendment’s guarantee of freedom from unreasonable searches and seizures. In general, courts have ruled that police need search warrants to obtain the content of communication
Source
Posted in Info, Network Security, Threats, Web Security No Comments »
April 15, 2008
Suspecting a spyware in your system? Here are some tips on how you could get rid of spyware in your computer:
1. Get, install and periodically run Ad-aware and Spybot Search & Destroy.
2. To prevent reinfection by Aureate/Radiate - search for advert.dll on your system. If it’s there and if you can, delete it (Ad-aware will do this for you). Then create an empty text file, name it advert.dll, make it read-only and save it in your Windows/System directory. Then configure Ad-aware (version 5 or later) to ignore advert.dll.
Posted in Hacks, Info, Network Security, Prevention, Threats, Tips, Web Security No Comments »
April 10, 2008
A spyware is computer software that is classified as privacy-invasive. This is installed covertly on a personal computer. Once installed, it can monitor the user’s behavior, collect personal information like surfing habits and sites that visited. It can interfere with user control of the computer such as installing additional software, redirecting Web browser activity, accessing websites blindly that will cause more harmful viruses, or diverting advertising revenue to a third party. It can change computer settings, resulting in slow connection speeds, different home pages, and loss of Internet or other programs.
Posted in Hacks, Info, Network Security, Threats, Web Security No Comments »
March 31, 2008
Here are some simple ways on how to could keep yourself same from threats and vulnerabilities on the Internet.
• Install anti-spyware and anti-virus on your personal computer
• Update your operating system and software (especially your anti-virus and anti-spyware) promptly for security patches and other important updates.
• Install Firewall too. Most operating systems have built-in firewall all you have to do is to enable them.
• Avoid visiting malicious websites.
• Avoid downloading files that are malicious (especially .exe files).
• Do a regular maintenance of your personal computers (Update, Defrag, Virus scan and other things that can improve the security and stability of your system).
Image source: www.reliabletechaz.com
Posted in Prevention, Threats, Tips, Web Security No Comments »
March 20, 2008
“Mendacious machines controlled by hackers that reroute Internet traffic from infected computers to fraudulent Web sites are increasingly being used to launch attacks, according to a paper published this week by researchers with the Georgia Institute of Technology and Google Inc.
The paper estimates roughly 68,000 servers on the Internet are returning malicious Domain Name System results, which means people with compromised computers are sometimes being directed to the wrong Web sites — and often have no idea.
The peer-reviewed paper, which offers one of the broadest measurements yet of the number of rogue DNS servers, was presented at the Internet Society’s Network and Distributed System Security Symposium in San Diego.
The fraud works like this: When a user with an affected computer tries to go to, for example, Google’s Web site, they are redirected to a spoof site loaded with malicious code or to a wall of ads whose profits flow back to the hackers.
The hackers who hijack DNS queries are looking to steal personal information, from e-mail login credentials to credit data, and take over infected machines.
The spoof sites run the gamut. Some are stunningly convincing, others amusingly bogus with spelling errors and typos.”
Source
Posted in Hacks, Info, Threats, Web Security No Comments »
March 15, 2008
If you are fond of renting personal computers from the nearby Intenet café, be sure that your private information like e-mail address, browser history, cookies and others are still safe. How can you keep your private information safe? Here are some steps if you are using Internet Explorer:
1. On Internet Explorer, click on Tools
2. Click Internet Properties.
3. Now select Delete cookies, Delete Files, Clear History.
4. After everything else you click OK.
You private information are now delete on the workstation you rented. If you are using Mozilla Firefox all you have to do is click Tools then click Clear Private Data.
Image source: www.digitalbattle.com
Posted in Prevention, Threats, Tips, Web Security No Comments »
March 6, 2008
A Brute Force attack is an automated process of trial and error used to guess a person’s username, password, credit-card number or cryptographic key.
Many systems will allow the use of weak passwords or cryptographic keys, and users will often choose easy to guess passwords, possibly found in a dictionary. Given this scenario, an attacker would cycle though the dictionary word by word, generating thousands or potentially millions of incorrect guesses searching for the valid password. When a guessed password allows access to the system, the brute force attack has been successful and the attacker is able access the account.
The same trial and error technique is also applicable to guessing encryption keys. When a web site uses a weak or small key size, its possible for an attacker to guess a correct key by testing all possible keys.
Essentially there are two types of brute force attacks, (normal) brute force and reverse brute force. A normal brute force attack uses a single username against many passwords. A reverse brute force attack uses many usernames against one password. In systems with millions of user accounts, the odds of multiple users having the same password dramatically increases. While brute force techniques are highly popular and often successful, they can take hours, weeks or years to complete.
Source
Posted in Hacks, Threats, Web Security No Comments »
February 15, 2008
Maybe you asked yourself a few times already, “What is the most secure internet browser? Firefox? IE? Safari? Opera?” and the list goes on of popular internet browsers. A lot of us spends a lot of your time surfing the internet, everyone of us should make sure that we use the most secure internet browser to make sure that our private information are safe. According to Symantec, the least secure browser is Mozilla Firefox, which got 122 reported vulnerabilities for the past year. This is quite alarming because I use Firefox a lot. On the other hand, Opera is the most secure internet browser which got 19 reported vulnerabilities last year.
via Softpedia
Image source: www.pegysus.com
Posted in Threats, Web Security No Comments »
February 15, 2008
5. Swedish Urology Group — Urine Trouble!
Victims: “Hundreds”
Class Action Outrage Scale: 1 out of 10 lawyers
Doctors lost three hard drives containing patients’ personal information, and we mean personal!
4. The Nature Conservancy — Think of It as Recycled Data
Victims: 14,000
Class Action Outrage Scale: 9 out of 10 lawyers
Someone at the Conservancy was thinking locally but acting globally by apparently visiting a website of questionable provenance. The site was poisoned with malware. Soon, malicious hackers were clear-cutting names, home addresses, birthdates, Social Security numbers of employees and their dependents, and, yes, direct deposit bank account numbers. Let’s hope there’s been a climate change in the group’s security department.
3. TSA, Part II – Still Doing DHS Proud!
Victims: 100,000
Class Action Outrage Scale: 3 out of 10 lawyers
Thieves stole a computer hard drive with the names, Social Security numbers, dates of birth and bank account and routing information of current and former employees, including federal air marshals. Don’t worry, though. How easy could it be to pose as an air marshal with only that information?
2. Her Majesty’s Revenue and Customs — One Regrets the Error
Victims: 25 million
Class Action Outrage Scale: 10 out of 10 lawyers
Two CDs containing personal data on about 7 million families went missing in the mail, and the HMRC chancellor resigned. Frankly, we included it just so we could quote sentences like: “The chancellor seeks the advice of the Serious Organised Crime Agency,” and “Mr Cable said he sincerely hoped the discs would not fall into the hands of ‘the criminal fraternity,’” and “Police have visited London rubbish tips in their hunt for missing computer discs.” Makes the worst breach in Britain’s history sound kind of lovely.
1. TJX — ’Sorry About That. Here’s a Gift Card. Come Back Soon for our Sale!’
Victims: Millions of bargain shoppers worldwide
Class Action Outrage Scale: 8 out of 10 lawyers
No breach got more ink this year than TJX’s, which involved some, OK, tens of millions, OK, 50 million, all right all right around 100 million credit and debit card records. Priceless moments included TJX’s defense in press accounts that “our security was comparable to many other major retailers” and the portion of TJX’s proposed settlement with consumers in which the company would hold a three-day “Customer Appreciation Sale” and give some customers $30 store vouchers. (Sorry about the e. coli in the meat in our store; here’s a gift card to buy more meat in our store). After consumer advocates raised a stink, the vouchers were changed to $15 checks. Sad as the whole episode was for consumers, TJX’s stock has remained healthy. Don’t you just love a bargain?
via [CSOOnline]
Posted in Hacks, Info, Network Security, Threats, Web Security No Comments »
