Google has removed 300 malicious apps from the Play Store

* Akamai has said that a botnet named WireX compromised Android devices
* It has joined Google, Cloudflare and other companies to combat it
* Google has removed 300 malicious apps from the Play Store

In the previous three months, we have seen a lot of dispersed refusal of administration (DDoS) assaults that have influenced the two companies and people. Web monster Google has been associated with the way toward keeping a mind such digital danger cases, and this time it has expelled around 300 noxious applications from Google Play store that could take control of Android gadgets to take part expansive scale DDoS assaults.

Analysts at Akamai in a blog entry have called attention to that a botnet named WireX adulterated different substance conveyance systems (CDNs) and other substance suppliers on August 17. The botnet contained Android gadgets that were running pernicious applications intended to make a DDoS assault. Akamai has held hands with significant organizations, for example, Google, Cloudflare, Flashpoint, Oracle Dyn, RiskIQ, and Team Cymru among others to battle this danger from spreading further.

In its blog, Akamai characterizes WireX botnet as "a volumetric DDoS assault at the application layer. The movement created by the assault hubs is essentially HTTP GET asks for, however a few variations seems, by all accounts, to be equipped for issuing POST asks." It notes assist that the contaminated applications, including capacity administrators, media/video players, ringtones, and different apparatuses, had "extra shrouded highlights" that initiated at dispatch. These highlights at that point influenced the Android to work or take an interest in a bigger DDoS assault as long as the gadget was fueled on. The quantity of abused Android gadgets is not clear yet but rather the specialists have announced it to be something around 7,000 to a Krebs On Security correspondent. 

"We distinguished roughly 300 applications related with the issue, blocked them from the Play Store, and we're expelling them from every single influenced gadget. The scientists' discoveries, joined with our own particular examination, have empowered us to better secure Android clients, all over the place," says Google while remarking in a reaction to Akamai's exploration, where it additionally specified that it is expelling up to 300 applications from the Play store. The cases of such applications were discovered when the scientists doled out to examine this issue followed back a few hubs to an assault that occurred on August 17 from an irregular APK document with a scattered up filename - 'twdlphqg_v1.3.5_apkpure.com.apk'. At that point, the scientists noticed that these applications could have more duplicates, copies, and cases straightforwardly identified with the DDoS assault. 


With the new organization together between the previously mentioned firms against the digital risk of DDoS assaults gradually infesting in the Android biological system, the organizations have likewise consented to share the measurements and information about the assaults. Google is likewise utilizing its machine learning capacities to guarantee better security for the Android stage, alongside the biological systems having a place with different partners.

How To Secure a Facebook Acoount

Step 1:Log in to Facebook
Type in your username (or email ID) and your password.Never check the box "keep me logged in."if you do so, it will increase the chances of people hacking into your accounts.

You can check the "Keep me logged in" box on your own personal computer only(if n one else uses it).

Step 2: Never share your password.
There have been times when Facebook users share their passwords with other Facebook users,which leads to account hacking.If you share your password with your friends, they might as well log into and mess with your account, which can land you in serious trouble, so you should avoid sharing your password.

Step 3: Never log into your Facebook account when out at a public place.
However, if you think your friends are trustworthy (or your cyber cafe is trustworthy) when at the place you're out at, you can log in at a public place.

Step 4 : Use strong password.
Always have a very strong password that no one can guess.The password can be very long.
Just  a long password can't make your account secure either.Hackers can do a "Dictionary Attack" where they use each and every word of the English alphabet in the password box to open up your account.You are always welcomed to use numbers,lower and uppercase characters, symbols to make your password invulnerable to such types of attacks.

Be sure to change your Facebook password once every 2-3 months.If someone knows your password, he/she can't access your account after some time.

These are the common mistakes which people often make.Never use passwords similar to your Facebook password.

Never use the same passwords on multiple sites.For example, use three different passwords for your Facebook, Twitter and Google accounts.The reason for keeping multiple passwords on multiple sites is because , for if someone has hacked one of your accounts, he/she can hack another account using the same password.

Step 5: Never allow a third party app to gain access to your personal information.
These apps will have fights to post anything on your behalf, which can make it dangerous if you want a secured Facebook account.Always use third party apps that are good and have a very good reputation on Facebook.

Step 6: Personalize your privacy settings
This step is the major factor to securing your Facebook account.
Go to the settings ->securing and Login

Use two factor authentication

Add trusted contacts

This feature allows your trusted contacts on Facebook to help you to get back on the site if your Facebook account is hacked or you've forgotten your password somehow.Add a few trusted contacts.

How To Get WiFi Password

This method is only valid for known WiFi network.Sometimes we forgot the WiFi password which is used to access to the network.It works because windows 8 and 10 create a profile of every WiFi network to which you attach.If you tell Windows to forgot the network, then it also forgets the password, so this won't work.but most people never explicitly do that.So we can simply obtain the password like this.

Command Prompt => Run as administrator

Then type this command on command prompt.

c:\windows\system32>netsh wlan show profiles

once you type this command and hit enter, you can see all the networks which are connected to that particular device.

Then you should select the network which you want to get the password.

c:\windows\system32>netsh wlan show profile name="D-Link" key=clear

You should replace the profile name with you have.Once you type this command on terminal and hit enter you can see the WiFi password like this.

SQL Injection

Overview

A SQL injection attack consists of injection or "injection" of a SQL query via the input data from the client to the application.A successful SQL injection exploit can read sensitive data from the database,modify database data (insert/delete/update), execute administration operations on the database,recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.SQL injection attacks are a type of injection attack, in which SQl commands are injected into data-plane input in order to effect the execution of predefined SQL commands.

SQL in Web Pages

SQL injection usually occurs when you ask a user for input, like their username/userid, and instead of a name/id, the user give you an SQL statement that you will unknowingly run on your database.

Example:-

txtUserId = getRequestString("UserId");
txtSQl = "SELECT * FROM Users WHERE UserId = " + txtUserId;

The original purpose of the code was to create an SQL statement to select a user, with a given user id.
If there is nothing to prevent a user from entering "wrong" input, the user can enter some "smart" input.

UserId:- 75 OR 1=1

Then SQL statement will be like this,

SELECT * FROM Users WHERE UserId = 75 OR 1=1;

The SQL above is valid and will return ALL rows from the "Users" table, since OR 1=1 is always TRUE.
A hacker might get access to all the user names and passwords in a database, by simply inserting 75 OR 1=1 into the input field.
SQL Injection Based on ""="" is Always true.

Username: John
Password: abc123

uName = getRequestString("username");
uPass = getRequestString("userpassword");

sql = 'SELECT * FROM Users WHERE Name ="' + uName + '" AND Pass ="' + uPass + '"'

Result 

SELECT * FROM Users WHERE Name =" john " AND Pass = "abc123"

A hacker might get access to user names and passwords in a database by simply inserting "OR""=" into the user name or password text box:

Username : "or ""="
Password : "or ""="

Result

SELECT * FROM Users WHERE Name = "" or  ""="" AND  Pass = "" or ""=""

The SQL above is valid and will return all rows from the "Users" table, since OR ""="" is always TRUE.

SQL Injection Based on Batched SQL Statements

Most databases support batched SQL statement.
A batch of SQL statements is a group of two or more SQL statements, separated by semicolons.
The SQL statement below will return all rows from the "Users" table, then delete the "Suppliers" table.

SELECT * FROM Users; DROP TABLE Suppliers

txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;


Input will be like this:

User id : 75; DROP TABLE Suppliers

Result

SELECT * FROM  Users WHERE UserId = 75; DROP TABLE Suppliers;

Use SQL Parameters for Protection

To protect a web site from SQL injection, you can use SQL parameters.
SQL parameters are values that are added to an SQL query at execution time, in a controlled manner.

txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = @0";
db.Execute(txtSQL,txtUserId);

Note that parameters are represented i the SQL statement by a @ marker.

The SQL engine checks each parameter to ensure that it is correct form its column and are treated literally, and not as part of the SQL to be executed.

Firewalls

What is a Firewall?

Firewall is a network security system to control and monitor the incoming and outgoing traffic based on predefined security rules.A firewall is normally barrier between trusted internal network and outside network.All the traffics which are allows to transmit over the network is predefined inside the firewall policy. All other traffics are denied.

Types of firewalls and history

Ancient history firewall was used to prevent the spread of fire.After that firewall concept is borrowed for computer security.Before firewalls emerged in the late 1980s, the only real form of network security performed by Access Control List(ACL).It has a predefined list of IP addresses were granted or denied access to the network.

The growth of the internet and connectivity  ACL wasn't enough to keep out malicious traffic.

Packet Firewalls

Packet filtering is a firewall technique used in used to control network access by monitoring outgoing and incoming packets and allowing them to pass or halt based on the source and destination Internet  

Protocol (IP) addresses, protocol and ports.

Network layer firewalls define packet filtering rule sets, which provide highly efficient security mechanisms.Packet filtering is also known as static filtering.

Stateful Firewalls

In order to recognize a packet's connection state, a firewall needs to record all connections passing through it to ensure it has enough information to assess whether a packet is the start of a new connection,a part of an existing connection, or not part of any connection.This is what's called "stateful packet inspection."Stateful inspection was first introduced in 1994 by Check Point Software in its Firewall-1 software firewall, and by the late 1990s,it was a common firewall product feature.

This additional information can be used to grant or reject access based on the packet's history in the state table,and to speed up packet processing; that way,packets that are part of an  existing connection based on the firewall's state table can be allowed through without further analysis.If a packet does not match an existing connection,it's evaluated according to the rule set for new connections.

Application Layer Firewalls

As attacks against Web servers become more common, so too did the need for a firewall that could protect servers and the applications running on them, not merely the notwork resources behind them, Application-layer firewall technology first emerged in 1999, enabling firewalls to inspect and filter packets on any OSI layer up to the application layer.

The key benefit of application-layer filtering is the ability to block specific content, such as known malware or certain websites, and recognize when certain applications and protocols such as HTTP,FTP and DNS are being misused.

Proxy Firewalls

Firewall proxy servers also operate at the firewall's application layer,acting as an intermediary for requests from one network to another for a specific network application. A proxy firewall prevents direct connections between either sides of the firewall; both sides are forced to conduct the session through the proxy, which can block or allow traffic based on its rule set.A proxy service must be run for each type of internet application the firewall will support,such as an HTTP proxy for Web services.

Advantages

-Higher security than packet filters

-Only need to scrutinize a few allowable applications

-Easy to log and audit all incoming traffic

Disadvantages

-Additional processing overhead on each connection (gateway as splice point)

GhostHook Attacks For Windows 10

Security experts have discovered a method of bypassing Windows PatchGuard protections and hooking malicious code into the Windows kernel, which allows an attacker to plant rootkits on systems previously thought to be impregnable.

PatchGuard, known under its official name of Kernel Patch Protection (KPP), is a security feature for Windows 64-bit editions that prevents third-party code from patching the Windows kernel with additional routines.

Microsoft introduced PatchGuard in 2005, starting with Windows XP, and the feature has prevented most rootkits from working on 64-bit editions.

GhostHook attack leverages Intel PT feature

Today, security researchers from CyberArk published research on a new technique named GhostHook that successfully bypasses PatchGuard using a feature of Intel CPUs.

According to researchers, GhostHook works only against systems running Intel Processor Trace (PT), a feature of Intel CPUs that uses dedicated hardware to capture information about current software execution to aid with debugging operations and the detection of malicious code.

Normally, tapping into Intel PT operations would require an attacker to patch his malicious functions into kernel-level code, an operation that PatchGuard would immediately detect and block.

CyberArk researchers said they found that by allocating an extremely small buffer for the processing of Intel PT packets would result in the CPU running out of buffer space and opening a PMI handler to manage the overflowing code.

The problem is that PatchGuard doesn't monitor the PMI handler and an attacker could hook his malicious code to patch kernel operations via that PMI handler.

This provides attackers with an undetectable method of patching the Windows kernel and embedding rootkits on Windows 64-bit versions. GhostHook works even on Windows 10, where very few rootkits have proven to be effective since the operating system's launch in the summer of 2015.

Microsoft won't patch GhostHook attack vector

CyberArk says it contacted Microsoft about the GhostHook attack, but the OS maker declined to issue a security update. Microsoft said it might patch the issue during its regular bug fixing cycle, but would not treat GhostHook as a security flaw.

Microsoft justified its decision by saying that an attacker needs to have kernel-level access on an infected machine to perform a GhostHook attack. An attacker with kernel-level rights could perform many other malicious actions, and users should focus on preventing an attacker from gaining this much level of access in the first place.

Responding to Microsoft's refusal to patch this attack vector, CyberArk reiterated that the issue is "the bypassing of PatchGuard" which opens the door for rootkits on 64-bit Windows versions, and not necessarily the attacker's access level.

The real problem is that attackers have a technique at their disposal to implant rootkits on platforms they did not have access in past years.

Currently, 64-bit malware makes up less than 1% of the entire malware landscape, and PatchGuard was one of the reasons that helped keep 64-bit versions secure and harder to infect.

Nuclear Power Plants Was Hacked

The attack was contained to the business associated side of the plant, and evidence indicates that critical infrastructure was not affected.But cyber security experts say that now that the network has been infiltrated, the nuclear systems have become "much more vulnerable."

Hackers have been penetrating the computer networks of companies that operate nuclear power stations and other energy facilities, as well as manufacturing plants in the United States and other countries.

But hackers can’t affect a nuclear power plant operations or safety systems. They can hack some business, personnel and other non-essential files, which may be embarrassing and costly, but not dangerous. These reactors are truly operational islands wholly disconnected from the Internet.

The origins of the hackers are not known, although a joint report from the DHS and the FBI suggests many of the hackers are backed by governments like Russia. In a joint statement, the government agencies said, “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks.”

America’s nuclear plants are one of the best protected of all systems from possible cyber threats. The safety and control systems for our nuclear reactors and other vital plant components are not connected to business networks or the Internet. We learned a lot from Stuxnet, the malicious computer worm that substantially damaged Iran’s nuclear program and that was introduced with a thumb drive.

Unlike other industries, the nuclear power industry conducts regular briefings, and receives quarterly classified briefings on cyber and physical threats, with the FBI and the DHS to discuss threat assessments, to strategize on guarding against them and to maintain situational awareness.

The nuclear industry does not use firewalls to isolate these systems, that’s not good enough. The plants use hardware based data diode technologies developed for high assurance environments, like the DOD. Data diodes allow information to be sent out, like operational and monitoring data, but ensure that information cannot flow back into the plant.

Updating software and equipment using portable devices, have strict restrictions. Outside laptops and thumb drives cannot be used without serious scrubbing, if at all.

The NRC has established regulations that thoroughly monitor and inspect cyber security at all U.S. reactors. But the nuclear energy industry took the initiative to implement a cyber security program for those digital assets needed to maintain nuclear safety and continuity of power well before the NRC mandated such a program. The Nuclear Energy Institute’s cyber security task force, formed in 2002, continuously monitors possible cyber threats and upgraded protective approaches needed to counter them.