Ethical Hacking

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 12 today I am going to give you a couple of tips on how to prevent malware from infecting your system.This includes malware like viruses, worms, Trojans,ransomware, spyware, rootkits, and spam.Let's talk about viruses first, viruses are most commonly detected using a good antivirus software.These can be either third-party solutions like Norton or McAfee, or using the included Windows Defender from your operating system.In addition to antivirus software,you'll also want to make sure that you're continually doing your service packs and updates for your operating system.Most viruses are going to infect you by taking advantage of some known exploit, and if it's a known exploit,your operating system vendor, like Microsoft,is probably going to already have a patch ready for you.If you don't patch your system,or update it and use those service packs,you're basically asking yourself to get infected.In addition to having a good antivirus software that's continually being updated,you also want to have a good host-based firewall that will help prevent outside people from connecting to your machine.Additionally, whenever you're surfing the internet,websites, this will ensure that there's no man-in-the-middle connection between you and the destination that you're trying to get data from.When we talk about worms, Trojans,and ransomware, much like viruses,these are best detected using anti-malware solutions.Now, ransomware is usually going to be detected,not in its fully ransomware form, but instead,through its delivery mechanism,which is most commonly a Trojan horse.Remember, it's always important to ensure that your anti-malware solution is current and up-to-date,both for its definitions and for its scanning engine.Spyware is software that's installed on your machine that snoops on you.It collects data and sends it back to its owners.Well, if you want to stop spyware,you need a good anti-spyware product.There are third-party ones available out there,but again, Windows Defender has this capability built in.Just like anti-malware solutions, you need to ensure that your definitions are up-to-date so it can scan and detect most types of spyware out there.Also, when you're browsing the internet,you want to make sure that your web browser's security settings are set to a non-trusted method,meaning that you have a very low level of trust for the sites on the internet.This will ensure that you don't accept cookies,that you don't allow pop-ups and other things that may get you more spyware installed onto your system.Now, how do you know if you've been infected with spyware?Well, there's a couple of common giveaways.The first one is if you see a lot of pop-up ads.If you're getting a lot of advertisements based on traffic that you've done in the past,someone is looking at your information somehow.That could be through spyware,it could be through cookies,or it could be through database retention settings on their side of the server.Additionally, another dead giveaway that you've gotten some adware or some spyware installed on your machine is when you go to your home page of your browser and it's no longer your home page.For example, if whenever you open up your web browseryou default to Google.com, and now,when you open up your web browser,you're seeing some other page,that means somebody has adjusted your web browser settings,and that could be a sign that you've been infected with some kind of spyware.Next, let's talk about rootkits.Rootkits are a type of malware that installs itself and tries to bypass the operating system functions,and it acts as a go-between between the operating system and the kernel.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 11 today we are going to discuss about Once you've identified that there's a symptom of malware that may be existing on your computer what should you do about it? Well, the first thing you should do is scan the computer to see if there's actually malware on it. In this case we have a virus that's been detected.How are we going to clean out that system from this virus or other types of malware? Well, before we take any action to try to clean up the virus we want to make sure we have a good backup of our current system. As we go through, we try to clean up the malware, we may have to change file systems. We may have to delete everything and start all over. We may have to change different configurations. And so making sure that we have a good backup of all of our files is critically important. The first thing we're going to do is identify the symptoms of the malware infection. What is your computer doing that makes you think that it's been infected? Have new files been created? Is the computer acting slowly?Do you have gibberish showing on your screen? Whatever the things are you need to notate that. And because that will help you determine what type of virus or malware has been infecting your machine. Next, we're going to quarantine the infected systems. Now what does that mean exactly? It means that we want to prevent this system from communicating with other systems so that the malware from this system can't spread to others.Most commonly we do this by turning off the network card or unplugging the network cable to remove your computer from your production network. The third step to removing malware is to disable your system restore if you're using a Windows machine. The reason we want to do this is we want to make sure Windows isn't continuing to take snapshots of our infected machine. This makes a lot of sense if you think about it. Let's say we go and we clean out this piece of malware and a couple of months go by or even a year and we have an issue with our system. We decide to revert to a good backup. And we end up choosing one of those snapshots that was taken while the malware was enabled. This is going to be a mistake that we did, but by doing so we're reintroducing and reinfecting ourselves. And for this reason we want to go and turn off our Windows Restore. Also, we want to go back and delete any of the snapshot that may have been taken during the time the computer was infected. The fourth step to removing malware is to remediate the infected machine. This includes updating our antivirus and anti-malware software on the machine, using its scanning capabilities, quarantining capabilities, and removal techniques to our advantage. Now what are some of these techniques? Well, this includes doing things like rebooting your machine into safe mode and going into a pre-installation environment and then running the scans from your anti-malware software. Now this is important because if you're using a normal Windows machine a lot of the files are in use when you're normally booted up. And so to remove that virus you need to make sure that that file isn't in use. But when you reboot yourself into safe mode, you're able to minimize the amount of files that are in use and allows the anti-malware solution to more effectively remove the malware much more cleanly. Our fifth step is to schedule automatic updates and scans. This will ensure that we've removed the malware and we can prevent it from coming back. The most common way of getting malware into your system is because you don't have an updated anti-malware solution on there.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 10 today we are going to discuss about Symptoms of Infection.How do you know your computer has been infected with malware? Well, the most common thing is to notice that it starts beginning to act strange. That could be a myriad of different things, though. For example, your computer might start running slower than normal.Why might this occur? Well, if you have a worm for example, it's using up processor resources and network resources to spread itself throughout the system and throughout the network. If you happen to be getting spam, that again is something that's going to tax your system. Lots of different malware will start making your computer act slower than normal. And this is one of the indications that you have a problem. Another symptom of infection is that your computer starts locking up or stops responding to you frequently. Maybe you're seeing more 'blue screens of death' than you've ever seen before. Well, this again is something that is a common symptom of malware. If a virus goes in and overwrites a critical system file by mistake, that can cause the computer to crash or lock up. This brings us to our third thing. If your computer restarts or crashes a lot, this again is another symptom that you may have a malware infection. Next, if your hard drive, files or applications aren't accessible anymore, this could be a symptom of a malware infection. Because if a virus or piece of malware takes over a file, it's going to change its permissions. And by doing that, it can remove your permissions that allow you to run it or delete it or change it. This is one of the ways that the malware will keep persistence in your system. Another symptom of malware is if your computer starts to make strange noises, or you start to see unusual error messages, or your computer, the display starts looking strange, or when you print something, it looks like gibberish or gobbledygook, and it uses symbols instead of normal letters. All of these things can happen when you get a virus or you get malware, depending on the way the virus or malware starts infecting your system. Another sign that you might have an infection is if you start to see new icons appear on your desktop or conversely, icons from your desktop start to disappear. Again, as any additional programs are added, new icons might show up, and if you start deleting programs, that can remove those as well. Another way that malware tries to hide itself when it's in your system is by using double file extensions. This is because in Windows, by default, if there's a know file extension, such as .exe for executable, or .txt for text files, that part won't be shown on the icon's name. So if you have something that says textfile.txt on your desktop, it could have a hidden .exe at the end of it. And when you double-click that file that looks like a text file, it's actually going to run this executable file. And that can actually embed malware into your system even further. Another symptom that you may have had something bad happen is if you try to run your antivirus software but it just won't run. A lot of malware is programmed to attack your antivirus software, and that way it can prevent it from running and maintain persistence longer. The reason for this is that malware doesn't want to be taken out of your system. And if you're able to run your antivirus you might be able to clean up the malware. But if they can attack your antivirus and keep it from running, that means that they can stay on your computer for longer and dig in deeper. Yet another symptom is when your files or folders are corrupted, or you may see new files and folders that have been created. Again, as a piece of malware goes and infects your files this corruption can make them be deleted, or it'll create new files for it to hide in.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 09 today we are going to discuss about Backdoors and logic bombs.A backdoor was originally placed in computer programs to bypass the normal security and authentication functions. Now, if this sounds like a horrible idea to you, it really is, and it's a horrible security practice. This is something that was originally created back in the 80's, by manufacturers and programmers as a way for them to get back into the system to do maintenance and repairs, without having to go through all the authentications and going through the firewalls and the layers of security that they would if they went in the front door. Now, this is a horrible and bad practice, and it should not be used in current networks. And these days, it's actually considered a breach of good, secure coding practices. But, back in the 80's and the 90's, and even into the early 2000's, backdoors were a commonplace thing that were put in by programmers. Now these days, most software does not have a backdoor. It's been patched up and cleared up because they know how bad these are for security. But, there is something that acts just like a backdoor. What do you think that might be? Well, it's a remote access trojan. A remote access trojan can be placed by an attacker to maintain their persistent access to your system. So if I'm able to trick you into clicking a spearfishing link, and then you install malware based on clicking that link, now I have something that can make a call back to me. That can give me that remote access. I have a way to bypass your system's natural security and use that remote access trojan as a backdoor, to gain access to your system anytime I want. Another insecure coding practice that was used by programmers is what we refer to as an Easter Egg. An Easter Egg would be placed in the code as a joke or a form of gag gift. Essentially, there would be different things that would happen in different video games, or different pieces of software when certain code was executed. For example, a few years ago, you could go to Google.com and type in do a barrel roll, and the whole page would do a 360 degree rotation as if it was doing a barrel roll in an airplane. There was no real function to doing that except it was a joke, it was a gag. It was a joke that Google programmers decided to put into the code. Now, Easter Eggs are generally harmless but they do add additional code, that can have additional vulnerabilities. The reason for this is because their code, because it's a joke, is usually put in at the last minute and it doesn't undergo rigorous security testing. Now, why am I talking about Easter Eggs in this lesson? Well, it's because it brings us up to the subject of logic bombs. Logic bombs are a descendant of those earlier Easter Eggs. But logic bombs were designed with malicious intent in mind. Logic bombs are malicious code that's inserted into a program, and it will execute only when certain conditions have been met. For example, a disgruntled employee may insert a logic bomb into the server's code so that if that employee isn't on the payroll anymore, a bad action, like deleting all the files, could occur. One of my favorite examples of a logic bomb actually comes from the movie Jurassic Park. In the movie, the park's programmer, Dennis Nedry, decides he's going to put a logic bomb into the power grid system, so that it will go off at a certain time.He does this so that when the power gets turned off by the logic bomb, he's able to sneak out of the room, go past all the alarms and get into the nursery and steal some of the dinosaur embryos. He thinks he's going to get off and sell those embryos and become a millionaire. 

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 08 today we are going to discuss about Active Interception and Privilege Escalation.What is active interception? Active interception occurs when a computer Is placed between your sending computer and your receiving computer.Because of that position it's able to capture or modify the traffic that's going between the two computers. Now what does that really mean? We'll let's take a field trip. You and I are going to go meet at the local coffee shop. You're going to bring your laptop and I'm going to bring mine. We order a cup of coffee and we sit down at the table and we connect to the wireless network. We think we're connected to Pete's Coffee or Starbucks, or whatever your favorite coffee shop is. But in actuality we're not connected to the coffee shop wifi.Instead, we're connecting to an attacker who's sitting in the back of the room with their laptop. This attacker has set up their laptop and is putting out a signal stronger than the coffee shop's signal. So our machines are connecting to them. Now whenever we're trying to go to the internet we're actually going from our laptops to the hackers laptop and from the hackers laptop out to the internet. To us it still looks like we're connected and we can go online and everything is fine with the world. But because of the placement of the attackers laptop in between us and our final destination they can capture anything that we're doing. They can see the emails that we're sending. They may be able to capture usernames and passwords. They may be able to modify what's coming back to us as well and embed malware into the files that we'd been requesting. That's what active interception is. It's when somebody gets in between you and the destination server and they can modify things based on that position. The second thing I want to cover in this lesson is Privilege Escalation. Now privilege escalation occurs when you're able to exploit a design flaw or a bug in a system to gain access to resources that a normal user isn't able to access. As an attacker, anytime I'm trying to break into a system I'm going to do that in a myriad of different ways. It may involve malware or a phishing attack, or an impersonation. Whatever the method is, most likely, I'm going to get into that system as a user, because I'm going to trick some ang user into doing something for me. When I do that, I now have user level credentials. But that's not going to allow me to do everything on the system that I want to do. My goal is to go from having that user level credential all the way up to administrative or root level credentials. To do that, I'm going to do a privilege escalation. There's a lot of ways to do a privilege escalation. Most of them involve exploiting some sort of bug in the software, the operating system, or the application and that let's me get closer to the kernel and being able to operate as an administrative or root user and stay tune for next episode and thankyou...

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 07 today we are going to discuss about Botnets and zombies. What happens to your computer if it becomes the victim of a botnet? Well, let's say that your computer has picked up some kind of malware and that malware, it's purpose is to change your computer into it's victim, into what we call a zombie. That's right, a zombie becomes part of the botnet and a botnet is simply a collection of compromised computers under the control of a master node. So, what does this really look like? Well, if your computer becomes a zombie, it becomes under the control of some attacker and that attacker has what they call the command and control node or C2 node. That command and control node controls not just your computer but hundreds or thousands or hundreds of thousands of other computers that are part of their botnet. What kind of things can these zombies do? Well, they might be used as a pivot point so that when they get a new victim, or if they're attacking a server, they can access it through your computer and it looks like you're doing the attack instead of the master node. They'll jump from their command and control node into one of the zombies and from the zombie over to the victim and they might go out and use those zombies to host files that are illegal, like child pornography so they don't get caught with them and all sorts of things like that. They may use them to spam other people and send out phishing campaigns and other malware or, most commonly, they can use this botnet to conduct a DDoS, a distributed denial-of-service attack. What exactly is a distributed denial-of-service attack? Well, a distributed denial-of-service attack occurs when many machines target a single victim and attack them at the exact same time. So let's assume that I'm the bad guy and I control a botnet of 100,000 machines and I want to go and take down somebody's website, I can make all 100,000 of my victims, my zombies, target that victim's server and make the request simultaneously. That type of load could end up forcing the web server offline, causing it to crash and not be able to serve its real customers. That is denying it the ability to do its normal functions or its service. That makes it a denial of service and a distributed denial-of-service is just that, it's the most common use of botnets and it's been that way for a long time but these days attackers aren't just doing it for fun and games. Instead they want to make money and so they're using zombies to do things that are processor intensive like bitcoin mining or other cryptomining on their behalf. That's right, when you have a botnet with lots and lots of zombies, you have a lot of processing power at your disposal because each of those machines can give you some of its resources and then they can work in a distributive manner. So, I can set them off and let them start mining coins for me  and thankyou..

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 06 today we are going to discuss about Common Delivery Methods of malware and how do they get into your machines .There are number of ways that your computer can get infected with malware. But by far, the most common ones come from software, messaging, and media. Software and messaging are things like email programs, peer- to-peer networks like BitTorrent, FTP servers, and pretty much any other way that we communicate from one computer to another. When I'm 

talking about media, we're talking about things like CDs and DVDs, USB thumb drives, external hard 

drives, tape backups, and even old school floppy disks.Now, I know what you're thinking. vijay, I'm smart enough not to pick up some USB drive off the ground and take some disks that I don't know where they came from, and slide it into 

my work computer.But guess what? This stuff happens every single day. Often it's because our human nature is to be nice,and we're trusting and we want to be helpful to people. So somebody comes over to your cubicle with a USB drive and 

says, hey I got three minutes before I got to give this presentation.Can you please print out my slide deck for me? Will you take that and put it in your drive? Well, you might.A lot of people do.And when they do that, there could be 

malware on that USB drive and we just infected the network. So, beyond plugging in a USB drive or a CD that you found on the floor, what's another place that you can get infected from? Well, there's a thing known as a watering hole.But 

before we talk about in computers, let's talk about a watering hole in the real world. If you go to Africa, there's a lot of desert there, and the animals need water. And so when they find a lake or an oasis, the animals will gather 

there and they'll drink the water, and then they'll go off and they'll do what animals do all day. And eventually they'll come back because they need more water again. And they'll do this time and time again. So watering holes are a 

place that people have to return to,or in this case, animals.Now, what does this have to do with your business and with computers? Well, it's the exact same concept. There's a lot of us who have routine habits, where we do the same 

thing day in and day out. And those places that we go are our watering holes. For example, every morning my friend gets up, he get a cup of coffee,he logs into Facebook and he starts scrolling his feed. For him, that would be a 

watering hole.It's something he goes to every single day. Are there those type of things inside your business? Maybe there's a supplier that you go to every single day to check your invoices. Well, if you think about this, an attacker 

can figure out where that website is that you go to every day. And if they can go and attack that company and embed viruses or malware into their website, when you go to the website to do regular work, like pulling your invoices,you 

can also be pulling that virus. So their website now becomes a watering hole for malware.And the malware that sits there behind that website will get potential victims. Now, if they got your supplier and they got all the people who 

visit the supplier,they can ultimately get you too. There are lots of things that can create watering holes for us.There's an automated toolkit called an exploit kit that makes this really easy to do as an attacker. Fortunately for us, 

a lot of websites that are watering holes and places that we go every single day, are very well secured.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 05 Today we're going to talk about malware infections,malware doesn't just appear on your computer.It doesn't just show up out of thin air.Somebody has to deliver it somehow and install it on your machine.Malware can be delivered in lots of different ways,including through software,messaging and media,from a botnet or zombies.It can have activate interception that's going to put malware into your network,or it can have a privilege escalation.Where somebody goes from being a regular user to a super user and infects your computer.Also, there's back doors and logic bombs.There is a lot of different ways

to get malicious software onto your machine.In fact, one of the simplest delivery methods is when somebody has physical access to your machine and plugs in something like a thumb drive that's already infected.

So, when we think about malware there's really two pieces of how malware gets onto your machine.The first, is what we call a threat vector. A threat vector is the method used by an attacker

to access a victims machine.Some examples of threat vectors are unpatched software, installation from a USB thumb drive, a fishing campaign,where one of your users clicks on a link to install a program, and many other

different methods that are out there.After we figure out what the threat vector is the next piece is what we call the attack vector.An attack vector is the means by which the attacker is going to gain access to that computer,

in order to affect you with malware.Now I know these two terms sound very similar, but there is a key difference.A threat vector is how we get to the machine itself, but the attack vector includes both the way we got to the machine

and how we're going to infect it. Let me provide you an example,to hopefully simply this just a little bit.Let's pretend that your house is a computer and I have a cupcake that's going to represent malware.My job as the attacker

is to get the cupcake from my house to your house and put it on your kitchen table.Now, that's my goal, as the attacker.You are going to try and defend against it.The threat vector I use might be that I can drive right up to your house,because your house isn't inside a gated community and there's no security guards looking for me.This would be a threat vector, your unguarded neighborhood. Now if I walk up to your door,and I start picking your lock,

and I enter your house,and I place the cupcake on your kitchen table, this represents the attack vector.It's all the things I did from driving to your house, to picking your lock, and delivering that poison

cupcake onto your kitchen table.That's the difference between the threat vector and the attack vector.Now, let's go back to the world of computers for a moment. Let's pretend that you have an old computer

that's running Windows 7 and you haven't bothered installing or downloading the latest security patches, because you've just been busy and haven't had time. Well, maybe you haven't installed these patches,in quite a long while.

So you have a computer that's missing a critical patch, like the Microsoft 17-010 patch, which came out in 2017. This was an essential security patch for the Eternal Blue vulnerability, this is a threat vector.This is your un-patched computer, but I don't yet have an attack vector, not yet.Now, as an attacker, I'm sitting there and I'm scanning the internet. I'm trying to find unpatched computers and lo and behold I find your computer and I determine that it's

missing this critical patch and therefore, you're vulnerable to an exploit against your file and printer services, which are known as SMB. Once I run this exploit, I'm going to be able to gain access to your machine

and install some kind of malware on it.This series of events now becomes my attack vector.