nixiebytes

[nixiebytes]

How to Harden Your Cloud Environment in 5 Steps.

The single biggest existential threat that's out there, I think, is cyber.Michael Mullen

In recent years, with the rapid rise of cloud computing, the virtualization of applications and infrastructure has been replacing traditional in-house deployments of applications and services.

It’s currently more cost-effective for organizations to rent hardware resources from companies like Microsoft, Amazon, and Google and spin up virtual instances of servers with the exact hardware profiles required to run their services. But security in the cloud is just as vital as security in traditional on-premise environments. Just like in physical servers, system hardening is an excellent way to help minimize security vulnerabilities in the cloud.

Learn more about system hardening and what steps you need to take to adopt hardening measures in the cloud:

What is System Hardening?

System Hardening is the process of securing a system’s configuration and settings to reduce IT vulnerability and the possibility of being compromised. The purpose of system hardening is to eliminate as many security risks as possible, and in most cases, this is done by removing all non-essential software programs and utilities from the computer. By removing non-essential programs, account functions, applications, ports, permission and access, attackers and malware have fewer opportunities to gain a foothold into your IT environment.

What Hardening Recommendations Should I Follow?

There are hundreds of security recommendations out there to follow, but the most highly recommended are the CIS Benchmarks – configuration baselines and best practices for securely configuring a system.

In an on-prem environment, security recommendations such as the free CIS Benchmarks are predominantly applied by group policy for Windows and configuration management tools such as Puppet and Chef for Linux. In the cloud, however, organizations can pre-harden their server images using the CIS hardening guidelines ready for use or, in the case of AWS and Microsoft Azure, purchase a CIS hardened image from the respective marketplace.

Once the image is hardened then its security stance can be extended further by baking in your organization’s security software such as your chosen AV and change detection solution such as the NNT Change Tracker agent. These CIS Hardening Images make running secure operations in the cloud fast, simple and affordable. These images are available for all major cloud computing platforms like AWS, Microsoft Azure, Google Cloud Platform, as well as Oracle Cloud Marketplace.

What Can I Do Right Now to Harden Instances?

There is a lot that organizations can do right now to help secure sensitive data in the cloud. Cloud providers have collectively identified a few steps to take to harden your instances, including:

Least Access – Restrict server access from both the network and on the instance, install only the required OS components and applications, and leverage host-based protection software.

Least Privilege – Define the minimum set of privileges each server needs in order to perform its function.

Configuration Management – Create a baseline server configuration and track each server as a configuration item. Assess each server against the currently recorded baseline to identify and flag and deviations. Ensure each server is configured to generate and securely store appropriate log and audit data.

Change Management – Create processes to control changes to server configuration baselines.

Audit Logs – Audit access and all changes to EC2 instances to verify server integrity and ensure that only authorized changes are made.

#nixiebytes

[nixiebytes]

what is Phishing ? examples,techniques,Prevention&protection.

What is a phishing attack?

Phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link, which can lead to the installation of malware, the freezing of the system as part of a ransomware attack or the revealing of sensitive information.

An attack can have devastating results. For individuals, this includes unauthorized purchases, the stealing of funds, or identify theft.

Moreover, phishing is often used to gain a foothold in corporate or governmental networks as a part of a larger attack, such as an advanced persistent threat (APT) event. In this latter scenario, employees are compromised in order to bypass security perimeters, distribute malware inside a closed environment, or gain privileged access to secured data.

An organization succumbing to such an attack typically sustains severe financial losses in addition to declining market share, reputation, and consumer trust. Depending on scope, a phishing attempt might escalate into a security incident from which a business will have a difficult time recovering.

Phishing attack examples

The following illustrates a common phishing scam attempt:

A spoofed email ostensibly from myuniversity.edu is mass-distributed to as many faculty members as possible.

The email claims that the user’s password is about to expire. Instructions are given to go to myuniversity.edu/renewal to renew their password within 24 hours.

Several things can occur by clicking the link. For example:

The user is redirected to myuniversity.edurenewal.com, a bogus page appearing exactly like the real renewal page, where both new and existing passwords are requested. The attacker, monitoring the page, hijacks the original password to gain access to secured areas on the university network.

The user is sent to the actual password renewal page. However, while being redirected, a malicious script activates in the background to hijack the user’s session cookie. This results in a reflected XSS attack, giving the perpetrator privileged access to the university network.

Phishing techniques :

Email phishing scams

Email phishing is a numbers game. An attacker sending out thousands of fraudulent messages can net significant information and sums of money, even if only a small percentage of recipients fall for the scam. As seen above, there are some techniques attackers use to increase their success rates.

For one, they will go to great lengths in designing phishing messages to mimic actual emails from a spoofed organization. Using the same phrasing, typefaces, logos, and signatures makes the messages appear legitimate.

In addition, attackers will usually try to push users into action by creating a sense of urgency. For example, as previously shown, an email could threaten account expiration and place the recipient on a timer. Applying such pressure causes the user to be less diligent and more prone to error.

Lastly, links inside messages resemble their legitimate counterparts, but typically have a misspelled domain name or extra subdomains. In the above example, the myuniversity.edu/renewal URL was changed to myuniversity.edurenewal.com. Similarities between the two addresses offer the impression of a secure link, making the recipient less aware that an attack is taking place.

Spear phishing

Spear phishing targets a specific person or enterprise, as opposed to random application users. It’s a more in-depth version of phishing that requires special knowledge about an organization, including its power structure.

An attack might play out as follows:

A perpetrator researches names of employees within an organization’s marketing department and gains access to the latest project invoices.

Posing as the marketing director, the attacker emails a departmental project manager (PM) using a subject line that reads, Updated invoice for Q3 campaigns. The text, style, and included logo duplicate the organization’s standard email template.

A link in the email redirects to a password-protected internal document, which is in actuality a spoofed version of a stolen invoice.

The PM is requested to log in to view the document. The attacker steals his credentials, gaining full access to sensitive areas within the organization’s network.

By providing an attacker with valid login credentials, spear phishing is an effective method for executing the first stage of an APT.

How to prevent phishing.

Phishing attack protection requires steps be taken by both users and enterprises.

For users, vigilance is key. A spoofed message often contains subtle mistakes that expose its true identity. These can include spelling mistakes or changes to domain names, as seen in the earlier URL example. Users should also stop and think about why they’re even receiving such an email.

For enterprises, a number of steps can be taken to mitigate both phishing and spear phishing attacks:

Two-factor authentication (2FA) is the most effective method for countering phishing attacks, as it adds an extra verification layer when logging in to sensitive applications. 2FA relies on users having two things: something they know, such as a password and user name, and something they have, such as their smartphones. Even when employees are compromised, 2FA prevents the use of their compromised credentials, since these alone are insufficient to gain entry.

In addition to using 2FA, organizations should enforce strict password management policies. For example, employees should be required to frequently change their passwords and to not be allowed to reuse a password for multiple applications.

Educational campaigns can also help diminish the threat of phishing attacks by enforcing secure practices, such as not clicking on external email links.

[nixiebytes]

TYPES OF COMPUTER NETWORKS

A computer network is a cluster of computers over a shared communication path that work for the purpose of sharing resources from one computer to another, provided by or located on the network nodes.

Some of the uses of computer networks are the following:

Communicating using email, video, instant messaging, etc.

Sharing devices such as printers, scanners, etc.

Sharing files

Sharing software and operating programs on remote systems

Allowing network users to easily access and maintain information

Types of Computer Networks

Personal Area Network (PAN)

Local Area Network (LAN)

Wide Area Network (WAN)

Wireless Local Area Network (WLAN)

Campus Area Network (CAN)

Metropolitan Area Network (MAN)

Storage Area Network (SAN)

System-Area Network (SAN)

Passive Optical Local Area Network (POLAN)

Enterprise Private Network (EPN)

Virtual Private Network

These are explained as following below.

1. Personal Area Network (PAN) :

PAN is the most basic type of computer network. This network is restrained to a single person, that is, communication between the computer devices is centred only to an individual’s work space. PAN offers a network range of 10 meters from a person to the device providing communication.

Examples of PAN are USB, computer, phone, tablet, printer, PDA, etc.

2. Local Area Network (LAN) :

LAN is the most frequently used network. A LAN is a computer network that connects computers together through a common communication path, contained within a limited area, that is, locally. A LAN encompasses two or more computers connected over a server. The two important technologies involved in this network are Ethernet and Wi-fi.

Examples of LAN are networking in a home, school, library, laboratory, college, office, etc.

3. Wide Area Network (WAN) :

WAN is a type of computer network that connects computers over a large geographical distance through a shared communication path. It is not restrained to a single location but extends over many locations. WAN can also be defined as a group of local area networks that communicate with each other.

The most common example of WAN is the Internet

4. Wireless Local Area Network (WLAN) :

WLAN is a type of computer network that acts as a local area network but makes use of wireless network technology like Wi-Fi. This network doesn’t allow devices communicating over physical cables like in LAN, but allows devices to communicate wirelessly.

The most common example of WLAN is Wi-Fi.

5. Campus Area Network (CAN) :

CAN is bigger than a LAN but smaller than a MAN. This is a type of computer network which is usually used in places like a school or college. This network covers a limited geographical area that is, it spreads across several buildings within the campus.

Examples of CAN are networks that cover schools, colleges, buildings, etc.

6. Metropolitan Area Network (MAN) :

A MAN is larger than a LAN but smaller than a WAN. This is the type of computer network that connects computers over a geographical distance through a shared communication path over a city, town or metropolitan area.

Examples of MAN are networking in towns, cities, a single large city, large area within multiple buildings, etc.

7. Storage Area Network (SAN) :

SAN is a type of computer network that is high speed and connects groups of storage devices to several servers. This network does not depend on LAN or WAN.. Instead, a SAN moves the storage resources from the network to its own high-powered network. A SAN provides access to block-level data storage.

Examples of SAN are a network of disks accessed by a network of servers.

8. System Area Network (SAN) :

A SAN is a type of computer network that connects a cluster of high performance computers. It is a connection-oriented and high bandwidth network. A SAN is a type of LAN that handles high amounts of information in large requests. This network is useful for processing applications that require high network performance.

Microsoft SQL Server 2005 uses SAN through virtual interface adapter.

9. Passive Optical Local Area Network (POLAN) :

A POLAN is a type of computer network which is an alternative to a LAN. POLAN uses optical splitters to split an optical signal from a single strand of single mode optical fiber to multiple signals to distribute users and devices. In short, POLAN is a point to multipoint LAN architecture.

10. Enterprise Private Network (EPN) :

EPN is a type of computer network mostly used by businesses that want a secure connection over various locations to share computer resources.

11. Virtual Private Network (VPN) :

A VPN is a type of computer network that extends a private network across the internet and lets the user send and receive data as if they were connected to a private network even though they are not. Through a virtual point to point connection users can access a private network remotely. VPN protects you from malicious sources by operating as a medium that gives you protected network connection.

#nixiebytes

[nixiebytes]

INTRODUCTION TO TYPES OF LANGUAGES

The computer language is defined as code or syntax which is used to write programs or any specific applications. The computer language is used to communicate with computers. Broadly the computer language can be classified into three categories assembly language, machine language, and high-level language. The machine language is considered as oldest computer language among all three. In machine language, the input is directly given as binary input which is processed by the machine. Binary inputs mean one and zero form. For computer language processing the system needs compiler and interpreter to convert the language in computer language so that it can be processed by a machine.

Different Types of Computer Language

Below are the top 3 types of computer language:

1. Machine Language

The machine language is sometimes referred to as machine code or object code which is set of binary digits 0 and 1. These binary digits are understood and read by a computer system and interpret it easily. It is considered a native language as it can be directly understood by a central processing unit (CPU). The machine language is not so easy to understand, as the language uses the binary system in which the commands are written in 1 and 0 form which is not easy to interpret. There is only one language which is understood by computer language which is machine language. The operating system of the computer system is used to identify the exact machine language used for that particular system.

The operating system defines how the program should write so that it can be converted to machine language and the system takes appropriate action. The computer programs and scripts can also be written in other programming languages like C, C++, and JAVA. However, these languages cannot be directly understood by a computer system so there is a need for a program that can convert these computer programs to machine language. The compiler is used to convert the programs to machine language which can be easily understood by computer systems. The compiler generates the binary file and executable file.

Example of machine language for the text “Hello World”.

01001000 0110101 01101100 01101100 01101111 00100000 01010111 01101111 01110010 01101100 01100100.

2. Assembly Language

The assembly language is considered a low-level language for microprocessors and many other programmable devices. The assembly language is also considered as second-generation language. The first generation language is machine language. The assembly language is mostly famous for writing an operating system and also in writing different desktop applications. The operations carried out by programmers using assembly language are memory management, registry access, and clock cycle operations. The drawback of assembly language is the code cannot be reused and the language is not so easy to understand. The assembly language is considered a group of other languages. It is used to implements the symbolic representation of machine code which is used to program CPU architecture. The other name of assembly language is assembly code. For any processor, the most used programming language is assembly language.

In assembly language, the programmer does the operation which can be directly executed on a central processing unit (CPU). The language has certain drawbacks as it does not contain any variables or functions in programs and also the program is not portable on different processors. The assembly language uses the same structure and commands which machine language does use but it uses names in place of numbers. The operations performed using the assembly language is very fast. The operations are much faster when it is compared to high-level language.

3. High-Level Language

The development of high-level language was done when the programmers face the issue in writing programs as the older language has portability issues which mean the code written in one machine cannot be transferred to other machines. Thus lead to the development of high-level language. The high-level language is easy to understand and the code can be written easily as the programs written are user-friendly in a high-level language. The other advantage of code written in a high-level language is the code is independent of a computer system which means the code can be transferred to other machines. The high-level of language uses the concept of abstraction and also focus on programming language rather than focusing on computer hardware components like register utilization or memory utilization.

The development of higher-level language is done for a programmer to write a human-readable program that can be easily understood by any user. The syntax used and the programming style can be easily understood by humans if it is compared to low-level language. The only requirement in a high-level language is the need of compiler. As the program written in a high-level language is not directly understood by the computer system. Before the execution of high-level programs, it needs to be converted to machine level language. The examples of high-level language are C++, C, JAVA, FORTRAN, Pascal, Perl, Ruby, and Visual Basic.

JAVA: The JAVA programming language is an object-oriented language that is based on objects and classes. The main motto of the development of this language is to make a computer program run on any system. The JAVA code is machine-independent code means the code needs to be written once and can be executed on any machine. The memory management is done automatically in the java programming language.

C: The C is a procedural and general-purpose programming language used for writing programs. This language is mostly used for writing operating system applications and desktop applications.

PASCAL: The Pascal is a procedural programming language which is based on data structures. It uses the concept of recursive data structures such as graphs, lists, and graphs.

Conclusion

As there is continuous development in the field of the programming language from machine language to low-level language to high-level language the programmers get the maximum benefit as they don’t have to write a complex program. The programs can be written easily which can be easily understood by a human. The only need is to convert it into machine language.

#nixiebytes

[nixiebytes]

🐱PenTest Tools!!!! Who's a hacker without hacking tools. These network pentest tools makes it easier to test the security taking it to whole another level ⚡ Do you have anything on your mind to share? Which of these do you work in? Comment your experiences below! . ❤Tag your friends and help them GROW! 👍🏻 . ♥Follow @nixiebytes, cause, this is YOUR community. . ⚡Also, don't forget to share this post with others. #nixiebytes

[nixiebytes]

5.. 4.. 3.. 2.. 1.. and you are hacked. 🙃 These devices looks harmless but are they? These devices operate or emulate peripherals like keyboard in inhumanely fast speed and inject payloads and compromising the target system within seconds. ⚡ Do you have anything on your mind to share? Which of these do you work in? Comment your experiences below! . ❤Tag your friends and help them GROW! 👍🏻 . ♥Follow @nixiebytes, cause, this is YOUR community. . ⚡Also, don't forget to share this post with others. . #nixiebytes

[nixiebytes]

We’ve compiled a shortlist of 8 Hacking & Bug bounty channels for you to subscribe and how to support them, ranked by subscriber count. With hundreds of amazing creators out there, we’re well aware that this list is incomplete, so if you didn’t spot your favorite hackfluencer, let us know so we can add them to our next compilation! . ⚡ Do you have anything on your mind to share? Which of these do you work in? Comment your experiences below! . ❤Tag your friends and help them GROW! 👍🏻 . ♥Follow @nixiebytes, cause, this is YOUR community. . ⚡Also, don't forget to share this post with others. #nixiebytes

[nixiebytes]

ABOUT US : Nixie_Bytes community formed by Cyfosis Cyber Solutions. Nixie_Bytes is an emerging hacking community enclosed for testing, proofing security & gaining knowledge on hacking skills for students and professionals alike.

OUR MISSION : To create a Better platform for testing, sharing and proving the hacking & security skills of the students and professionals.

WEBSITE : https://nixiebytes.com/

[nixiebytes]

8 cutting-edge Web sites to learn ethical hacking and master the art of cybersecurity and become a professional.

⚡ Do you have anything on your mind to share? Which of these do you work in? Comment your experiences below! . ❤Tag your friends and help them GROW! 👍🏻 . ♥Follow @nixiebytes, cause, this is YOUR community. . ⚡Also, don't forget to share this post with others.