Learn Cyber Security

Live Capture Procedures As we move to a world of cloud based systems, we are increasingly finding that we are required to capture and analyse data over networks. Once, analysing a disk drive was a source of incident analysis and forensic material. Now we find that we cannot access the disk in an increasingly cloud based and remote world requiring the use of network captures. This is not a problem however. The tools that are freely available in both Windows and Linux offer a means to capture traffic and carve out the evidence we require As we move to a world of cloud based systems,we are increasingly finding that we are required to capture and analyse data over networks. To do this, we need to become familiar with the various tools that are available for these purposes. In this article, we look at a few of the more common free tools that will enable you to capture traffic for analysis within your organisation. Once, analysing a disk drive was a source of incident analysis and for...

Android Application Assessment In this article we’ll discuss about steps involved in performing security assessment of an Android based application. We will see use of various tools and methodologies. There are various other methods and tools but steps are very common in nature. There are various tools/ methods to do this kind of assessments. We shall discuss the general and popular approach. Our assessment revolves around the following two methodologies: • Black Box approach • White Box approach First we need to set up the test bed for which we need to download the Andriod SDK. Download the Android SDK tool from http://developer.android. com/sdk/index.html. It includes SDK and AVD (Android Virtual Device). They are necessary for creating the VM and installing emulator. Setting up the AVD and emulator is out of scope for this article but it’s very easy, once you follow the above link. Once the AVD is setup it appears as in the following Figure 1. We have named our AVD as...

Intel SMEP overview and bypass on Windows 8 This paper provides an overview of a new hardware security feature introduced by Intel and covers its support on Windows 8. Among the other common features it complicates vulnerability exploitation on a target system. But if these features are not properly configured all of them may become useless. This paper demonstrates a security flaw on x86 version of Windows 8 leading to a bypass of the SMEP security feature. With a new generation of Intel processors based on the Ivy Bridge architecture a new security feature has been introduced. It is called SMEP which stands for “Supervisor Mode Execution Prevention”. Basically it prevents execution of a code located on a user-mode page at a CPL = 0. From an attacker’s point of view this feature significantly complicates an exploitation of kernel-mode vulnerabilities because there’s just no place for a shellcode to be stored. Usually while exploiting some kernel-mode vulnerability an attacker woul...

Windows 8 Security in Action Is Windows 8 the next operating system for your enterprise? In this article, we will take a quick look at Microsoft’s new OS – Windows 8. We will see some of the new security features that make it more secure than its predecessor Windows 7. We will also run the security through the paces and see some of the possible issues that are new to the OS and some that have carried over from previous versions of Windows. The much anticipated (and debated) next version of Windows software is set to be released on October 26, 2012. Several prerelease versions were made available, and just recently Microsoft released a 90 Day Windows 8 Enterprise RTM (Release to Manufacturer) evaluation copy. In this article we briefly cover the new look of Windows 8, which has caused some complaints from Enterprise entities and the media alike. We will then highlight some of the new security features, and finally, put them to the test. From the Backtrack 5 r3 security testing p...

SQL Injection Database has been a common repository for many applications that were been develop as a centralized location to store the information. However over the year, we hear a lot of incident around the world regarding issue such as SQL injection and no one take note on it till they have been hit. There are different type of databases are available in the market which the primary function is to store and retrieve data when it was been requested by other software application. Mostly this type of architecture consists of a web which are facing the internet. The function of this web interface it serve as a UI for the users to use. An application server does exists which have a direct connection to the databases it self. No matter what is the size of the infrastructure, the DB will be important repository to store data. Since this architecture was been implemented in all of the company, there is also security vulnerability that exist on the system which part ...