Uzair Afzal

Phishing is the technique of fraudulent attempt by the attacker to obtain sensitive and confidential information i.e. Credentials, PII information, credit card, bank details. It can also be targeted attack to focus on the specific organization of individual. The attacker often tailors an email to speak directory to targeted user. There are many types of phishing as follow. I wouldn't explain the types. You can read Here . In this article you'll learn how to analyze the sophisticated phishing email. So, Let's start the case study to explain.  Spearphising :  Spearphising is the technique in which attacker aims at one person and lures him/her into providing confidential data. Attacker compile the email according to the specific user. The email would consist some of the target's email, username, designation.  Case Study: User receive the spearphising email containing the PDF attachment with double extension. Email body contains the unprofessional statement "Kindly m...

What is Cyber Threat Intel? Threat intel is the information about the threats. Cyber threat intel is used to better understand, predict and adopt to the behavior of malicious actors. It plays an important role in preventing the zero-day attacks. " Threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes " (NIST). Threat Intel life Cycle: Intelligence lifecycle is the process of developing raw information into finished intelligence for policymaker to use in decision making and action. CTI Life Cycle Planning and Direction Planning and direction helps in setting up the goals for the threat intel program. Priorities and requirements are defined in this phase. Collection: Collection means gathering of data to produce the finished intelligence. Data includes logs(Firewall, IPS/IDS, Endpoints), threat feeds and OSINT(reports, social media, public forums). Collection Types of Collectio...

Basic Static Analysis: Let's jump into the labs of the  PMA (Practical Malware Analysis) . You can revise you basic concepts about the malware analysis from  blog . Outdated tools were used in the book So, I'll be using some latest tools which provides us the same results. Labs can be downloaded from  PMA Labs . Tools: Following tools are used throughout the  Lab-01 . PEStudio DIE (Detect it easy) Virus Total upx Lab-01: Binary Name:  Lab01-01.dll Question1: Upload the files to http://www.VirusTotal.com/ and view the reports. Does  either file match any existing antivirus signatures? Ans:  Open the file the file in  PEStudio.exe  to find out the hash of file. Figure 1 As you can see in  Figure 1  hashes are highlighted. Use any one of hash or click on the  URL  to find match for any existing antivirus signatures. You can also take help from PEStudio.exe to collect the virus total information as shown in the following figur...

Hi folks, just started the series on PMA (Practical Malware Analysis) . Being an analyst i would recommend to gain expertise on "Malware Analysis". This blog help us to quick recap the concepts of malware as well as from analysis perspective. We'll start from basic and proceed towards advance level. Introduction: Malware refers to "Malicious Binary" which is instructive by the threat actors (called as "Hackers" ) to achieve their motives. Motives can be vary like it could be data stealing, damage/destroy organization systems. Viruses Worms Trojan Spyware Adware Ransomware Aforementioned names are the malware types which is collectively called "Malware". Let's jump into the main topic of this blog without going into the details. Malware Analysis: Malware analysis is the process of understanding the working flow/behavior/malicious activity of malware. The results of the malware analysis help the analysts to detect and prevent the threats. ...

What is Cyber Kill Chain? The CKC is the classical model developed by Lockheed Martin. The purpose of this model is to better understand the stages an attacker must go through to conduct an attack, and also helps the security teams to stop an attack at each stage. It also helps to identify to what extent the organization is compromised. It also helps to understand the strategies used by cybercriminals and how to defend against them. Phases of Kill Chain: There are seven phases of CKC model which are described below: Reconnaissance Weaponization Delivery Exploitation Installation Command and Control Action on objective Reconnaissance: In this phase the attacker tries to find out as much information as possible about the target like contact information and IT infrastructure of the target. There are two types of reconnaissance: Passive: Looking for publicly available information on the internet like using google, social media, whois, NSlookup, Shodan and dumpster diving. Active: gather i...

RUDY Attack: It is the type of slow rate attacks. It also known as slow and low attack. It attempts to open a relatively few connections to the target server or website over a period of time, and leaves the connection as long as possible. How it works: It identifies the embedded form in the target site. After identification it sends the HTTP post request with abnormal long ‘content-type’ header field and then starts injecting the form with information, size of one byte packet at one time. This packet is not only sent in junks but at a very slow rate. So , a very long content-length field prevents the server from closing the connection. Ultimately the attacker exhausts the server connection table. Prevention Mechanisms: Server resource monitoring like memory, CPU usage, connection tables, application threads, long and open application connection or stuck application processes. Behavior analysis compares traffic and user behavior. Or if filling the form takes so much time like hours or m...

  NSM: History: Todd Heberlein started NSM informally in 1988. It was the first NSM that used the network traffic as its source for generating alerts. Air Force Computer Emergency was the first organization who informally followed the NSM principles. In 1993, AFCERT with collaboration of Heberlein deployed the first version of NSM as the ASIM(Automated Security Incident Measurement). NSM: It is the best method from zero defense to some defense. By using this organization would prevent himself from being exposed or (prevent data breach). This is operated by the group of people known as CIRT(Computer incident response team). Benefits: Collect a rich amount of network derived data from different devices. CIRT analyses this data to find compromise assets. CIRT uses the NSM data to assess the cause of the incident. Does NSM Prevent Incidents? No it does not prevent incidents because breaches are inevitable. Intruders different techniques to cause the incident but by using NSM you can fr...

  Incident Response: Security incident is an adverse event or series of events that can negatively affect the confidentiality, integrity, or availability of data or systems within an organization, or that has potential to do so. It includes the multiple phases which are discussed below: Preparation: In this phase helps personal on how to respond to an incident. It includes establishing and maintaining an incident response plan and incident response procedure. It also includes establishing procedures to prevent incidents. Identification: All events are not security incidents so when a potential incident is reported, personnel take the time to verify it is an actual incident or not. Containment: After successful identification of incident security personal attempt to isolate or contain it. This might include quarantining a device or removing it from the network. Eradication: After isolation of the system from the network. It is necessary to remove the components from the attack. It m...

SIEM: Security information and event management(SIEM) system provides a centralized solution for collecting, analyzing, and managing data from multiple sources. Then combine the services of security event management(SEM) and security information management(SIM) solutions. A SEM provides real-time monitoring, analysis, and notification of security events, such as suspected security incidents. Why SIEM? SIEMs are very useful in large enterprises that have massive amounts of data and activity to monitor. Consider an organization with over 1,000 servers. When an incident occurs on just one of those servers, administrators need to know about it as quickly as possible. The SIEM provides continuous monitoring and provides real-time reporting. Aggregation: Aggregation refers to combining several dissimilar items. Into a single item. A SIEM can collect data from multiple sources, such as firewalls, IPS, proxy servers, and more and aggregate this data and store it in such a way that it is easy t...

  Advance Attacks and Protection: In this section we will discuss some common types of attacks that can be launched against the systems and networks. Spoofing: Spoofing occurs when one person or entity impersonates or masquerades as someone or something else. There are two common types of spoofing attack one is IP spoofing and the other one is MAC spoofing. We can prevent IP spoofing by blocking the packet if it contains the private IP address on public interface. SYN Flood Attack: The SYN Flood attack is a common attack used against servers on the internet. They are very easy for attackers to launch and difficult to stop, and can cause significant problems. It can disrupt the TCP handshake process and can prevent legitimate clients from connecting. In a SYN flood attack, the attacker never completes the handshake by sending the ACK packet. So it consumes the server resources. We can prevent it by setting the threshold for SYN packet. MITM: Man in the Middle attack is a form of act...

  Malware and its types: It is also known as malicious software. It includes a wide range of software that has malicious intent. Malware is not the software that users knowingly purchase or download and install. It is important to realize that there are several different types of malware that are discussed below Virus: Virus is the malicious code that attaches itself to the host application. The host application must be executed to run, and the malicious code executes when the host application is executed. When the virus is activated it delivers its payload. Payload might delete files, cause random reboots, join the computer to botnet or enable backdoor. Worms: Worm is self-replicating malware that travels throughout a network without the assistance of host application or user interaction. A worm resides in memory and can use different transport protocol to travel over the network. Worms can replicate themselves hundreds of times and spread to all the system in the network. Logic B...

Wireless Attacks: There are several known attacks against the wireless networks. Most can be avoided by using strong security protocols such as WPA2 and CCMP. Disassociation Attacks: This attack effectively removes the wireless client from the wireless network. In disassociation attack, attackers send a disassociation frame to the AP with spoofed MAC address of the victim. The AP receives the frame and shutdown the connection. Victim then disconnected from the AP and need to go through the authentication process again to reconnect. WPS Attack: WPS is susceptible to the brute force attack. This attack keep trying different PINs until it succeeds. Once it discover the PIN, it can discover the passphrase in both WPA2 and WPA networks. Rogue AP: Rogue AP is an AP placed within a network without official authorization. It might be installed by the employee or attacker. Attacker may connect to a rogue access point to network devices in wireless closets that lack adequate physical security. T...

  Network Devices: Network connects computing devices together so that users can share resources, such as data, printers, and other devices. Switch: Switch can learn which computers are attached to each of its physical ports. It then uses this knowledge to create internal switched connections when two computers communicate with each other. Security benefits of switch: If an attacker connects his computer to the port of switch and installs the protocol analyzer. He would not capture the unicast traffic going through the switch to other ports. So, switch reduces the risk of an attacker capturing data with a sniffer. Switches also increase the efficiency of a network. Router: Router connects multiple network segments together into a single network and routes traffic between the segments. It route the traffic from segment to segment. Because routers don’t pass broadcasts, they effectively reduce traffic on any single segment. Segments separated by routers are sometimes referred to as b...

Access Control Models: Access Controls ensures that only authenticated and authorized entities can access resources. Role Based Access Controls: It uses roles to manage rights and permissions for users.This is useful for users within a specific department who perform the same job functions. An administrator creates the roles and then assigns the specific rights and permissions to the roles instead of users. Rule Based Access Controls: Rule Based Access Controls uses rules. Rules can be static and dynamic. Static rules are implemented on routers or on firewalls. Examples of dynamic rules are IPS then modify rules to block the traffic from an attacker. Discretionary Access Controls: Every object has an owner, and the owner establishes access for the objects.  Mandatory Access Controls: It uses labels sometimes referred to as security labels to determine access. Administrators assign labels to users and files/folders. When the label matches then the system grants access to that files/...

  Authentication Services: In this section we will discuss the authentication services. The main goal of these services are to ensure that unencrypted credentials are not sent across the network. In other words they ensure that credentials are not sent in clear text. Kerberos: It is a network authentication mechanism mostly used in both windows active directory domain and some Unix environments. Kerberos provides mutual authentication that can help prevent MITM attacks and uses tickets to help prevent replay attacks. Working of Kerberos: The KDC(key distribution center) uses a complex process of issuing TGTs(Ticket granting tickets) and other tickets. The KDC packages user credentials within the ticket. Tickets provide authentication for users when they access resources such as files on the file server. These tickets are sometimes referred to as tokens. NTLM: New Technology LAN Manager is a suite of protocols that provide authentication, integrity, and confidentiality within window...

Authentication Factors: An authentication may require administrators to implement one factor of authentication for basic authentication, two factors for more authentication and more factors for higher security. In this section we will discussed the authentication factors that an organization can use for secure authentication Something you know: It refers to a shared secret, such as a password or even a PIN. It is the least secure authentication factor. However organizations can increase the security of password by implementing the strong password policy. Something you have: It refers to the something you physically hold. It includes smart cards, CAC(Common Access Cards) and hardware token. Something you are: It refers to the use of biometrics for authentication. It is the strongest form of authentication because they are most difficult for an attacker to falsify. Somewhere you are: It refers to the identification of a user based on the user’s geo location. But it is not foolproof becau...

Security Controls: There are hundreds of thousands of security controls that organizations can implement to reduce the risks. Some of the common security controls we will discuss in this section.      Technical Control: These controls use technology to reduce vulnerabilities. An administrator installs and configures technical controls and then these technical controls automatically provide protection. Some of the technical controls are discussed below: Encryption:           It is the strong technical control to ensure confidentiality. Anti Virus Software:           It provides the protection against the malware functions. IDS and IPS:           IDS/IPS can monitor the network or host for intrusion and provide the ongoing protection Firewalls:           Firewalls restrict the traffic going in or out of the network. Least Privileges:      ...

 Mitigation of Network Threats: In this section we will discuss best practices we can use to mitigate various network threats. How do we better protect ourselves against various outsiders or even insiders that might be trying to compromise our network resources.   Signature Management: we should use devices like an intrusion prevention system sensor or an intrusion detection system sensor, those sensors rely on signatures, patterns that allow them to recognize well known attacks. We should make sure to keep our signature database whether it's IDS or IPS or virus signatures, any sort of signatures that can help us identify malicious traffic. Device Hardening: we should not use the default configurations or default passwords. We should disable any unnecessary services that might be running on a device. If a server doesn't need to have web services running, maybe we disable web services on that server. Change of Native VLAN: Configure the trunk’s untagged VLAN to a non default va...