sOuLineage

at 5/30/2023 05:58:00 PM

What is cyber security in hacking?

The term cyber security refers to the technologies and processes designed to defend computer system, software, networks & user data from unauthorized access, also from threats distributed through the internet by cybercriminals,terrorist groups of hacker.

Main types of cybersecurity are

Critical infrastructure security

Application security

Network Security

Cloud Security

Internet of things security.

These are the main types of cybersecurity used by cybersecurity expert to any organisation for safe and protect thier data from hack by a hacker.

Top Skills Required to become Cybersecurity Expert-

Problem Solving Skills

Communication Skill

Technical Strength & Aptitude

Desire to learn

Attention to Detail

Knowledge of security across various platforms

Knowledge of Hacking

Fundamental Computer Forensic Skill.

These skills are essential for become a cybersecurity expert.

Cyber cell and IT cell these are the department in our india which provide cybersecurity and looks into the matters related to cyber crimes to stop the crime because in this digitilization world cyber crime increasing day by day so our government of india also takes the immediate action to prevent the cybercrimes with the help of these departments and also arrest the victim and file a complain against him/her with the help of cyberlaw in our constitution.

Continue reading

at 5/30/2023 09:02:00 AM

Top 5 most useful linux tools for Programmer

Linux is a free and open-source software operating systems built around the Linux kernel. It typically packaged in a form known as a Linux distribution for both desktop and server use. It is a great development environment for programmers and developers. However, without the development tools, that would be impossible. Fortunately, plenty of Linux tools are available. Here are the top 5 most useful Linux tools for programmers.

Also Read;- How To Clone One Android To Another

5 Most Useful Linux tools for Programmers

1. VIM

VIM is a free and open source software written by Bram Moolenaar in 1991. It is designed for use both from a command-line interface and as a standalone application in a graphical user interface. It comes standard with almost every Linux distribution and is also known as "the programmer's editor". VIM is great for coding and can also be used for editing things like configuration files and XML documents.

Vim has been developed to be a cross-platform that supports many other platforms. In 2006, it was voted as the most popular editor amongst Linux Journal readers. In 2015, Stack Overflow developer survey found it to be the third most popular text editor while in 2016, the Stack Overflow developer survey found it to be the fourth most popular development environment.

Read more;- How To Use WhatsApp without Mobile No

2. Zsh

Zsh is written in C and initially released in 1990. It is a Unix shell that can be used as an interactive login shell and as a powerful command interpreter for shell scripting. Zsh is an extended version of Bourne shell (BASH) with a large number of improvements, including some features of Bash, ksh, and tcsh. Zsh gives a user-friendly experience on the command line. It also gives better auto-completion, Vim key bindings, and smart guesses when you write a command wrong.

Its features include (but not limited to):

Programmable command-line completion,
Sharing of command history among all running shells
Extended file globbing
Improved variable/array handling
Editing of multi-line commands in a single buffer
Spelling correction
Various compatibility modes,
Themeable prompts, and
Loadable modules.

3. Byobu

It was initially released in 2009 written in Sh and Python. Byobu can be used to provide on-screen notification or status and tabbed multi-window management. Thus, it is intended to improve terminal sessions when users connect to remote servers with an operating system Linux and Unix-like. It is is an enhancement for the GNU Screen terminal multiplexer or tmux used with the GNU/Linux computer operating system.

4. GIT

Git was initially released on April 7, 2005. It is a version control system to track changes in computer files and to coordinate work on those files among multiple people. It is primarily used for source code management in software development and can be used to keep track of changes in any set of files available in the English language. It is aimed at speed, data integrity, and support for distributed, non-linear workflows. It is free and open source software distributed under the terms of the GNU General Public License version 2.

Moreover, Linus Torvalds was the creator of GIT for the development of the Linux kernel. On the other hand, its current maintainer since then is Junio Hamano. Thus, every Git directory on every computer is a full-fledged repository with complete history and full version tracking abilities, independent of network access or a central server.

Read more;- How To change Facebook Default Theme

5. Docker

Written by Solomon Hykes in 2013, it is a computer program that performs operating-system-level virtualization, the containerization, which is developed by Docker, Inc. Primarily, Docker was developed for Linux to use as the resource isolation features of the Linux kernel. It is a tool that can package an application and its dependencies in a virtual container that can run on any Linux server. This helps enable the flexibility and portability on where the application can run, whether on premises, public cloud, private cloud, bare metal, etc. Moreover, it accesses the Linux kernel's virtualization features either directly using the libcontainer library.

Read more

at 5/30/2023 12:16:00 AM

TL;DR: Don't use MD-5 to identify malware samples. Believe me, it is a bad idea. Use SHA-256 or a stronger hash function.

This post is dedicated to all malware researchers, still using MD-5 to identify malware samples.

Before deep-diving into the details, let me explain my view on this topic. Whenever you want to identify a malware, it is only OK to publish the MD-5 hash of the malware if you post at least the SHA-256 hash of the malware as well. Publishing only the MD-5 hash is unprofessional. If you want to understand why, please continue reading. If you know about the problem, but want to help me spread the word, please link to my site www.stopusingmd5now.com.

By writing articles/posts/etc. and publishing the MD-5 hash only, it is the lesser problem that you show people your incompetency about hash functions, but you also teach other people to use MD-5. And it spreads like a disease... Last but not least, if I find a sample on your blog post, and you use MD-5 only, I can't be sure we have the same sample.

Here is a list to name a few bad examples (order is in Google search rank order):

Kaspersky
Bromium
Fireeye
Webroot
Mcafee
Fox-IT
Cisco
SANS
ESET
Symantec
Watchguard
And unfortunately, even the best books on malware analysis promote the use of MD-5 - see "Practical malware analysis" Chapter 1 Page 10

Introduction to (cryptographic) hash functions

A long time ago (according to some sources since 1970) people started designing hash functions, for an awful lot of different reasons. It can be used for file integrity verification, password verification, pseudo-random generation, etc. But one of the most important properties of a cryptographic hash function is that it can "uniquely" identify a block of data with a small, fixed bit string. E.g., malware can be identified by using only the hash itself, so everybody who has the same malware sample will have the same hash; thus they can refer to the malware by the hash itself.

It is easy to conclude that there will always be collisions, where a different block of data has the same result hashes. The domain (block of data) is infinite, while the codomain (possible hash values) is finite. The question is how easy it is to find two different blocks of data, having the same hash. Mathematicians call this property "collision resistance." Proper cryptographic hash functions are collision-resistant, meaning it is impractical or impossible to find two different blocks of data, which have the same hash.

In 1989 Ronald Rivest (the first letter in the abbreviation of the RSA algorithm) designed the MD-2 hashing algorithm. Since 1997 there are publications about that this hashing algorithm is far from perfect.

In 1990 Ronald Rivest designed the MD-4 algorithm, which is considered as broken at least from 1991. But MD-4 is still in use from Windows XP until Windows 8 in the password protocol (NTLM). Unfortunately, there are more significant problems with NTLM besides using MD-4, but this can be the topic of a different blog post.

In 1991 (you might guess who) designed yet another hashing algorithm called MD-5, to replace MD-4 (because of the known weaknesses). But again, in from 1993 it has been shown many times that MD-5 is broken as well. According to Wikipedia, "On 18 March 2006, Klima published an algorithm [17] that can find a collision within one minute on a single notebook computer, using a method he calls tunneling". This means, that with the 8 years old computing power of a single notebook one can create two different files having the same MD-5 hash. But the algorithms to generate collisions have been improved since, and "a 2013 attack by Xie Tao, Fanbao Liu, and Dengguo Feng breaks MD-5 collision resistance in 2^18 time. This attack runs in less than a second on a regular computer." The key takeaway here is that it is pretty damn hard to design a secure cryptographic hash function, which is fast, but still safe. I bet that if I would develop a hash function, Ron would be able to hack it in minutes.

Now, dear malware researcher, consider the following scenario. You as, a malware analyst, find a new binary sample. You calculate the MD-5 hash of the malware, and Google for that hash. You see this hash value on other malware researchers or on a sandbox/vendor's site. This site concludes that this sample does this or that, and is either malicious or not. Either because the site is also relying solely on MD-5 or because you have only checked the MD-5 and the researcher or sandbox has a good reputation, you move on and forget this binary. But in reality, it is possible that your binary is totally different than the one analyzed by others. The results of this mistake can scale from nothing to catastrophic.

If you don't believe me, just check the hello.exe and erase.exe on this site from Peter Sellinger. Same MD-5, different binaries; a harmless and a (fake) malicious one... And you can do the same easily at home. No supercomputers, no NSA magic needed.

On a side-note, it is important to mention that even today it can be hard to find a block of data (in generic), if only the MD-5 hash is known ("pre image resistance"). I have heard people arguing this when I told them using MD-5 as a password hash function is a bad idea. The main problem with MD-5 as a password hash is not the weaknesses in MD-5 itself, but the lack of salt, lack of iterations, and lack of memory hardness. But still, I don't see any reason why you should use MD-5 as a building block for anything, which has anything to do with security. Would you use a car to drive your children to the school, which car has not been maintained in the last 23 year? If your answer is yes, you should neither have children nor a job in IT SEC.

Conclusion

If you are a malware researcher, and used MD-5 only to identify malware samples in the past, I suggest to write it down 1000 times: "I promise I won't use MD-5 to identify malware in the future."

I even made a website dedicated to this problem, www.stopusingmd5now.com . The next time you see a post/article/whatever where malware is identified by the MD-5 hash only, please link to this blog post or website, and the world will be a better and more professional place.

PS: If you are a forensics investigator, or software developer developing software used in forensics, the same applies to you.
PS 2: If you find this post too provocative and harsh, there is a reason for this ...

Update: I have modified two malware (Citadel, Atrax) with the help of HashClash, and now those have the same MD-5. Many thanks for Marc Stevens for his research, publishing his code, and help given during the collision finding.

Tuesday, May 30, 2023

What Is Cybersecurity And Thier types?Which Skills Required To Become A Top Cybersecurity Expert ?

Continue reading

Top 5 Most Useful Linux Tools For Programmers

5 Most Useful Linux tools for Programmers

1. VIM

2. Zsh

3. Byobu

4. GIT

5. Docker

Stop Using MD-5, Now!

Introduction to (cryptographic) hash functions

Conclusion

More info

The Foundation...

sOuLmates

FB sOuLmates

Blog Archive