Securing your wireless network

The whole aspect of security of wireless networks has become very important ever since terror e-mails were sent to media by alleged terrorists. Terrorists used unsecured wireless networks to hack into an individual's Wi-Fi network and sent e-mails just before bombs went off in Ahmedabad and New Delhi. It is in this environment protecting your unsecured Wi-Fi network becomes very important lest somebody misuses the same. Here are 10 simple ways in which you can secure your wireless network :

1. Change default administrator usernames and passwords : Most routers or access points come enabled with a default set of username / password combinations. These combinations are well documented and available online for hackers to use. If a hacker can access your device's administrative pages they can modify the configuration and control all aspects of your device. These username / password combinations can be changed from the administrative panel and should be set to something difficult to guess. Keep a password which is difficult to guess and not easy to crack. A good password is 8 characters long, not easily guessable, contains mixture of uppercase and lowercase letters as well as numbers and preferably contains special characters like.

2. Turn on encryption : All wireless devices support some form of encryption. Encryption technology scrambles messages sent over the air and ensures that they cannot be intercepted by hackers. Several encryption technologies exist for wireless communication today. WPA is the strongest commonly available encryption technology for home devices. While WEP can also be used cracking WEP is just a matter of few minutes. We would advice corporates to go for WPA with EAP Authentication, TKIP / RC4 Encryption or WPA 2 with EAP Authentication, AES-CCMP encryption for better security.

3. Change the default SSID : Access points and routers all use a network name called the SSID. Manufacturers normally ship their products with the same SSID set for all routers. For example, the SSID for Netgear devices is normally 'NETGEAR'. The default SSID can be changed from the administrative panel and should be set to something unique.

4. Enable MAC Address filtering : Each wireless device possesses a unique identifier called the physical address or MAC address. Access points and routers keep track of the MAC addresses for all devices that connect to them. Wireless routers offer the option to key in the MAC addresses of your home equipment so as to restrict the network to only allow connections from those devices. It ensures that rogue users cannot connect to the wireless router without using advanced MAC spoofing techniques.

5. Disable SSID Broadcast : The wireless access point or router typically broadcasts the network name (SSID) over the air at regular intervals. This feature was designed for businesses and mobile hotspots where wireless clients may roam in and out of range. For the home user, this roaming feature is unnecessary, and it increases the likelihood someone will try to log in to your home network. Fortunately, most wireless access points allow the SSID Broadcast feature to be disabled by the network administrator. Your SSID name can be manually entered into your devices to prevent the need for SSID Broadcasts to be enabled.

6. Do not auto-connect to open wireless networks : Connecting to an open wireless network such as a free wireless hotspot or your neighbour's router exposes your computer to security risks and attacks. Although not normally enabled, most computers have a setting available allowing these connections to happen automatically without notifying the user. This setting should not be enabled except in temporary situations.

7. Assign static IP addresses to devices : Most home wireless devices use dynamic IP addresses. DHCP technology is indeed easy to set up. Unfortunately, this convenience also works to the advantage of network attackers, who can easily obtain valid IP addresses from your network's DHCP pool. Turn off DHCP on the router or access point, set a fixed IP address range instead and then configure each connected device to match. Using a private IP address range (like 10.0.0.x) prevents computers from being reached directly from the Internet.

8. Enable firewalls on each computer and router : Modern network routers contain built-in firewall capability, but the option also exists to disable them. Ensure that your router's firewall is turned on. For extra protection, consider installing and running personal firewall software on each computer connected to the router.

9. Position the router or access point safely : Wireless signals normally reach to the exterior of a home. A small amount of signal leakage outdoors is not a problem, but the further this signal reaches, the easier it is for others to detect and exploit. Wireless signals often reach through neighboring houses and into streets. When installing a wireless home network, the position of the access point or router determines its reach. Try to position these devices near the centre of the home rather than near windows to minimise leakage. Many routers allow you to reduce the range of your router from the administrative panel to prevent the signal leakage.

10. Turn off network during extended periods of non-use : The ultimate in wireless security measures, shutting down your network will most certainly prevent outside hackers from breaking in! While impractical to turn off and on the devices frequently, at least consider doing so during travel or extended periods of downtime. http://www.nag.co.in/securitytips.html

What’s good password ?

- Use different passwords for different Web sites. Maintain separate passwords for e-mail, work and other important Web sites and routine web- surfing. - Use difficult-to-guess password by taking the first alphabet from each word of a phrase. What is a good password? It is a password which is at least 8 characters long, not easily guessable, contains mixture of uppercase and lowercase letters as well as numbers, and preferably contains special characters like $, *, %, !, * etc. Some examples of a good password are: &(^.3235*cRack&.^). - Always use alphanumeric passwords with special characters and try to adopt phrasing technique to construct passwords which are easy to remember, hard to guess and impossible to crack. Create a unique acronym. Never use a dictionary based password like guest, home etc. It takes little time for a good cracker to crack the password.

Soure link- http://www.nag.co.in/securitytips.html

Online shopping security

While purchasing online, look for signs that these are secure (SSL secured sites or 128 bit encryption) like shopping.rediff.com. At the point when you are providing your payment information, a golden-coloured lock appears (for SSL secured sites) on the right hand side corner of the browser or the beginning of the Web site address should change from http to https, indicating that the information is being encrypted ie turned into code that can only be read by the seller.

- Your browser may also signal that the information is secure with a symbol, such as a broken key that becomes whole or a padlock that closes.

- Carefully use credit-cards and online banking for online shopping. Check your credit card and bank statements at regular intervals. Notify the bank immediately if there are unauthorised charges or debits. Avoid using credit card details and online banking on public computers and in cyber cafes. It is very unsafe because most of them are infected with viruses, trojans and key loggers.

- Some banks have launched their services like Net Safe to create temporary credit cards with a limited value to transact online. Paypal is also a secure way to do the transactions .This way, in the worst case scenario you can minimise the impact.
soure link-http://www.nag.co.in/securitytips.html

How to protect your computer from internet hackers

You do it every day. Log into your computer, send e-mails, open attachments, shop online, transfer money using your bank's secure payment gateway, chat, and upload personal information on social networking and job Web sites. Here's a thought: what if someone was watching everything you were doing?

Just like someone who hacked into Ken Haywood's Wi-Fi connection was and sent threat mail just a few minutes before the first of many bombs went up in Ahmedababd. Given the lax security that users as well as internet service providers have cyber criminals are always on the watch out for vulnerable people whose computers could be at risks.

There's a worryingly large possibility that someone could be keeping a close watch on all your online activities. From any corner of the world, someone could get inside your computer every day, and could have access to one of the most important resources of the information age: Your Personal Data.

Personal Data can be abused to make online purchases, carry out attacks against all those on your contact list and an innumerable list of things that can harm your everyday life. Welcome to the age of hackers (these are people who try to gain access to your computer using various hacking tools and misuse your personal data) and spies lurking on the vast Internet highway.

If that got you worked up, breathe. There are many ways in which you can defend yourself against hackers -- even though when it comes to security, nothing can give you 100 per cent guarantee. A host of new tools and exploits are developed every single day, so updating the knowledgebase to counter them must be a regular process.
 source link-http://www.nag.co.in/securitytips.html

General computer security

Install the latest Antivirus Software on all your computers and never disable them. Popular antivirus softwares include Kaspersky, Bit Defender, Nod32, Antivir, Grisoft AVG and Quickheal. Also install a personal firewall and an anti-spyware solution. Popular firewalls include Antivir, Grisoft AVG, Quickheal, 3Com and Sonicwall.

Update antivirus/ anti-spyware/ firewall at least every 15 days. Carry out a complete system scan with your anti-virus at least once a week, or better, auto-schedule it to run every Friday.

There are a few free online antivirus scanners available at Trend-Micro, Kaspersky and F-Secure.

HSC Guides - Ethical Hacker2

[TCP Flag Types]

Flag Purpose

SYN Synchronize and Initial Sequence Number (ISN)
ACK Acknowledgement of packets received
FIN Final data flag used during the 4-step shutdown of a session
RST Reset bit used to close an abnormal connection
PSH Push data bit used to signal that data in the packet should be pushed to the beginning of the queue. Usually indicates an urgent message.
URG Urgent data bit used to signify that urgent control characters are present in this packet that should have priority.

At the conclusion of communication, TCP terminates the session by using a 4-step shutdown. Those four steps proceed as follows:

1. The client sends the server a packet with the FIN/ACK flags set.
2. The server sends a packet ACK flag set to acknowledge the clients packet.
3. The server then generates another packet with the FIN/ACK flags set to inform the client that it also is ready to conclude the session.
4. The client sends the server a packet with the ACK flag set to conclude the session.

HSC Guides - Ethical Hacker

This article is taken from CEH Ethical Hacker Exam Prep: Understanding Footprinting and Scanning by Michael Gregg]

Footprinting and Scanning is the first basis of hacking. Information gathering has many phases like profiling your target. Whois, ARIN can reveal public information of a domain that can be leveraged further. Traceroute and mail tracking can be used to target specific IP and later for spoofing. Nslookup can reveal specific users and zone transfers can compromise DNS security. Footprinting is necessary to systematically and methodically ensure that all pieces of information related to the aforementioned technologies are identified.

Without a sound methodology for performing this type of reconnaissance, you are likely to miss key pieces of information related to a specific technology or organization. Footprinting is often the most arduous task of trying to determine the security posture of an entity; however, it is one of the most important.

Footprinting must be performed accurately and in a controlled fashion. This is the reconnaissance step before anything is done. Tools like Nmap will be deployed to scan the target and get any available information possible. Information warfare is not without its battle plans or surveillance techniques. In this context, a strategic map used in a battle would be a close analogy to a footprint.

Note that through this course, we use the term 'organization' to represent a target system. This includes discussion pertaining to a single system as well. Footprinting therefore, needs to be carried out precisely and in an organized manner. The information unveiled at various network levels can include details of domain name, network blocks, network services and applications, system architecture, intrusion detection systems, specific IP addresses, access control mechanisms and related lists, phone numbers, contact addresses, authentication mechanisms and system enumeration. This listing may include more information depending on how various security aspects are addressed by the organization.

Privacy? What's That?

Recently, Twitter released a "transparency report"which explained in some detail the extent to which this tremendous social medium complies with requests for information from government agencies around the world. The report contains the usual assortment of good news and not-so-good news about the state of personal privacy in the post-9/11 era. As such, it serves as a reminder to all of us that social media are really public platforms, not private venues.

It is easy to forget that our utterances on Facebook and Twitter, or the pins we set on Pinterest, can be discovered by just about anyone. Sure, some digging is necessary to uncover the good stuff -- or should I say, the bad stuff -- but everything we do on social media is public information, even the alleged private messages that we share. This sort of renders the notion of gossip irrelevant, because gossip is supposed to be the sharing of dirty secrets and it's impossible to have any secrets in social media. Just ask former Congressman Anthony Wiener of New York.

But let's go back to Twitter's attempts at transparency. According to data from the report, Twitter was asked for information in 2011 from 948 accounts and handed over at least some information from 679 of them. In other words, Twitter's lawyers were compliant with government requests 75 percent of the time. Perhaps the most prominent of these was Malcolm Harris of Occupy Wall Street, who was required to have his Tweets handed over to the New York State Attorney General's office.

In its defense, Twitter's Jeremy Kessel, manager for legal policy, noted that the site has a "long-standing policy to proactively notify users of requests for their account information unless we're prohibited by law." That may be okay for Twitter, but it may be problematic for some of us. Twitter seems to be operating under something that I call the "barn door principle," as in "closing the barn door after the horse has escaped." Twitter will let you know when a government agency has requested information and will also tell you whether that information has been handed over. Notice that this information will be worded in the past tense. So, roughly 679 people were told last year, "Hey, the authorities asked for your Tweets and we had to give them up. You might need a lawyer now. Have a nice day." In short, Twitter is attempting to protect you, but is really succeeding only 25 percent of the time.

About a year ago, Facebook went through the same trials on privacy, though on a much smaller scale. A report in Reuters from last year noted that federal judges authorized the serving of more than two dozen warrants to search individual Facebook accounts. "Many of the warrants requested a laundry list of personal data such as messages, status updates, links to videos and photographs, calendars of future and past events, 'Wall postings' and 'rejected Friend requests.'" These warrants were obtained by the FBI, DEA and US Customs. The charges ranged from arson to rape to terrorism.

The Facebook warrants were significant because they had the potential to challenge our traditional notions of privacy, a vestige of the Fourth Amendment prohibition of "unreasonable search and seizure." The key to this case is the amount of information about us that is actually held by third parties. And that affects all of us.

We sometimes assume that our bank records, our telephone conversations, our Tweets and our Facebook postings are only shared with our permission to our circle of friends and followers. Not so. They really belong to the companies that enable the communication or which hold the data for us. In 1976, the Supreme Court in United States versus Miller ruled that a bank did not have to tell a customer that his financial records had been sent to a government agency, in this case the Bureau of Alcohol, Tobacco and Firearms. The Supreme Court ruled that the customer did not have to be informed that his records had been turned over to the government, because the records were the property of the bank and, therefore, the customer had no reasonable expectation of privacy.

So Facebook had to comply with the warrants.

This leads me to conclude that privacy is another quaint vestige of the 20th Century, and something that the ensuing generations may come to know as a charming artifact of another time. In an era when the places we visit and the people with whom we choose to associate -- and even our most intimate thoughts and desires -- are made available to everyone with our permission through the "third parties" of social media, we may wonder what is left to protect. 
Of course, the vast majority of us have little to fear from the government because we don't commit any crimes. But what if we are sued for divorce, or harm, or some perceived breach of contract? What then? Quite frankly, the precedents cited above mean that, in a court of law, our lives can become an open book. (Or should I say, tablet?)

Tweet at your own risk, I say. De-friend with care. As I advise my clients, "Never Tweet anything that you would regret being made public at a Congressional hearing!"

Eric Yaverbaum Posted: 07/08/2012 10:29 am

Threats, Attacks, Hackers & Crackers Brief Information

Every time a home PC or small home/office network goes online, it connects to thousands of unknown networks and millions of their users. Connecting to Internet provides the opportunities to communicate and share information with others. But it also gives opportunities to Internet users that are involved in malicious activities. Its often believed by many that they don't possess anything that would be of any interest to intruders. But in most of the computer attacks, these computers are used as launching pads to spread viruses, worms and other attacks. They just serve as one link in a chain of multiple compromised systems.

Security concerns of a home network or SOHO are similar to those of big corporate networks. Faster Internet connections are becoming popular and as they are "always on"; the computer networks are becoming more vulnerable to attacks. Possible attacks on SOHO and home networks include a Denial of Service (DOS) attack, a Distributed Denial of Service (DDOS) attack using SOHO networks, accessing and destroying confidential information on the system, etc. The only way to secure a computer from online intruders is to turn it off or by disconnecting it from the Internet. According to the experts, use of firewalls is the best way of securing a computer network from online intrusion. Firewalls are the first line of defense in protecting computers. A firewall filters the network traffic on the basis of certain pre set rules, hence protecting one network from another. However, there are other tools that can be used to protect the networks like antivirus software, anti hacker tools, etc. Protecting personal computers using PC monitoring tools, file protection tools and password security tools further enhances the security mechanism of the small networks.

What the password leaks mean to you (FAQ)

Three companies have warned users in the last 24 hours that their customers' passwords appear to be floating around on the Internet, including on a Russian forum where hackers boasted about cracking them. I suspect more companies will follow suit.

Curious about what this all means to you? Read on.