you think you are safe online. are you?

©2014 iYogi Limited. All Rights Reserved.

Presented By:

You Think You Are Safe online.

Are You?

http://www.techgenie.com/

http://www.techgenie.com/

Do you think hackers can?

Well yes, they can do all these. A lot more, actually... Let’s find out.

Transform a mobile device into an audio bug?

Turn Dropbox into a backdoor gateway to a network?

Convert a phone into a spy sensor?

Extract details from a pacemaker?

Install surveillance tools unbeknown to you?


The attacker can be your Which type of cyber attacks spooks market the most?

next door nerdy neighbor

a suave, introvert colleague

a geeky guy at the gym

that local computer repair shop

engineer

Prying Eyes You Never Noticed!


Common Cyber Attack Methods

Attack TechniquesJuly 2014


The more connected you are, the likelier you are to be their target. So, who’s their target?

You Are On Their Hitlist!

High-security locks of homes

Cloud computing services

Social media Smartphone and mobile devices

Smart devices

Power plants Your pacemaker(oh, yes!)

Your car Your geo-location Bring-your-own-devices (BYOD)


Types Of Cyber Attacks(you should be afraid of!)

Trojan attack

Impersonation

Phishing

Spoofing

DDoS attacks

DNS Poisoning

Password Cracking


Trojan Attack – How It Works?

Attackers hide Trojan program inside chat messages.

The hacker monitors and controls your PC and steal data.

The Trojan gets installed on your PC.

It takes control of your PC.

It removes, moves, extracts data and execute a file.

Every time you are online, Trojan notifies the hacker.

1

2

3

4

5

6

1. Download file

3. Malicious network

connection to command and control center

End user Machine

2. File get executed in workstation

2. File get executed in a similar environment inside sandbox

File System

Registry & Processes

Customized Virtual Machine


Impersonation – How It Works?

Hackers follow you on Instant Messengers.

They access your account details.

They steal your user names and passwords.

They impersonate the retrieved data

Interact with your contacts without your knowledge.

1

2

3

4

5

Thus, your IM account gets exposed to identity thefts.

Victim

Attacker

Internet Connection

How Impersonation works?


Phishing – How It Works?

Hackers divert you to a fake charitable websites

The hacker monitors and controls your PC and steal data

A Trojan is installed on your PC.

It takes control of your PC

It removes, moves, extracts data and execute a file.

Every time you are online, Trojan notifies the hacker.

1

2

3

4

5

6

Different methods of phishing:

Fake websites

Image manipulation

Phone phishing

Link manipulation

JavaScript commands


Spoofing – How It Works?

Hackers search for IP addresses of legitimate hosts.

They impersonate the message originated from that trusted host.

They gather data from your infected PC.

1

2

3

Different methods of spoofing include:

Man-in-the-middle attack

Spyware techniques

Spoofed PackedSource IP : 192.168.1.100 (Sniffer)Destination IP : 192.168.1.1 (Target)

Rogue antispyware programs

Server spoofing

IP : 10.0.0.1

Gather Sniffed Data

3

1

Spoof Response 2

TargetIP : 192.168.1.1

SnifferIP: 192.168.1.100

IP Spoofing Attach


DDoS Attacks – How It Works?

Hackers target large websites

You get infected while accessing the infected site.

They create a “zombie” network.

Install client software

Gain remote access on machines connected to the network.

The client software floods infected website with data traffic

1

2

3

4

5

6

Various types of DDoS cyber attacks are –

Buffer Overflow Attacks

SYN Flood Attacks

Teardrop Attacks

Smurf Attacks

Virus and worms

Ping of death

Distributed Denial of Service (or mostly known as DDoS) are conducted on massive level.

Send cookies, Online banking credentials and webmail credentials.

Slowloris DoS attacks

Orders Slowloris DoS attacks on Anonymous hacktivism targets

Anonymous HacktivismWebpage Target

Zeus-Infected Clients

Hacker C&C Server


DNS Poisoning – How It Works?

Hackers forge DNS information.

They send false DNS information to redirect the traffic.

They send fake DNS reply with fake information

The DNS server stores information in cache.

1

2

3

4

DNS poisoning is used to redirect site visitors from online bank account to a fake website to collect users’ bank account credentials so that they logon and steal data/money.

DNS Cache Poisoning

1 2 3

4

5

6

Cachepoisoned

203.74.17.22 208.174.175.2032

203.74.17.22

What is the IP addressof www.xyz.com?

What is the IP addressof www.xyz.com?

Name server Authoritativeserver(s)

Client

www.xyz.com

Attackingserver

Cache

1. Fictitious addresses


Password Cracking – How It Works?

Hackers distribute the load of password on several computers

They make a collaborative attempt of cracking password

Password thieves use password cracking tools

They automate the process of deciphering the password

1

2

3

4

Common password cracking tools are –

Mio-Star

Saltine Cracker

Slurpie

John the Ripper

L0phtCrack (LC3)


Safety Measures to Protect Against Cyber Attacks


VERIFY

Check for the proof of presence in the

real-world such as address, phone

number, email address so that you can

make a phone call when in doubt.

Right-click on the link, choose

‘Properties’ to verify if the destination

of the link matches with the

information in the email and under

Properties window.

Look for a padlock in the browser

window or if the URL starts with

“https://” .

Check if it has the same address of the

actual website.

3 Golden Rules of Online Safety

SECURE

Check for the proof of presence in the

real-world such as address, phone

number, email address so that you can

make a phone call when in doubt.

Right-click on the link, choose

‘Properties’ to verify if the destination

of the link matches with the

information in the email and under

Properties window.

Look for a padlock in the browser

window or if the URL starts with

“https://” .

Check if it has the same address of the

actual website.

PREVENT

Use less popular browsers having small market

share compared to Internet Explorer, Google

Chrome . Smaller browsers are unprofitable for

hackers to target.

Perform regular virus scan to prevent DDoS types

of cyber attacks.

Secure host systems by updating security patches,

firewall and real-time threat detection tools. With

these security and filtering measures, packets sent

out to the Internet are scrutinized by the security

program installed on the host machine.

Configure modems/routers to prevent those

send/receive broadcast messages to the network.


If you are too startled to use web services, email accounts or social networking sites, thenleave your cyber attack worries on the expert – TechGenie Absolute.

Above All These, You Should Also Remember –

There is no patch for human negligence toward cyber attacks

No security to prevent greed toward phishing mail with lures

of lottery prize money, large funds transfer etc.

Refrain from visiting unknown donation sites


http://www.techgenie.com/absolute.html



you think you are safe online. are you?

Technology