What is Surf web, Dark Web and Deep Web

Surf Web

The surf web is the place where all the sites that are hosted can be visited. it is not encrypted or hidden. with traditional search engines things in the surf web can be surfed.

• Google
• Bing
• Wikipedia

Deep Web

The Deep Web: It's all the data behind firewalls. Think user databases, business intranets, web archives, password-protected websites, etc. By some estimates, this part of the internet is estimated to be 400 to 500 times as large as the Surface Web.Sometimes you will hear the term Deep Web used interchangeably with "Dark Web," but they aren't really the same thing.

• Medical records
• Social media
• Scientific documents
• Legal documents
• Repositories
• Government resources

Dark web

Dark web is a collection of web sites which are hosted in a encrypted network in Deep web. Traditional search engines or search browsers can not access the dark web. Those sites hide their identity by using TOR networks. Refer the following link of my blog post on TOR network.
http://dinethri.blogspot.com/2017/10/tor-network.html

• Illegal Information
• Drug trafficking sites
• TOR- Encrypted sites
• Political Protests
• Private communications

PCI-DSS Standard

Basic PCI Data Storage Guidelines for Merchants

Cardholder data refers to any information contained on a customer’s payment card. The data is
printed on either side of the card and is contained in digital format on the magnetic stripe embedded
in the backside of the card. Some payment cards store data in chips embedded on the front side.
The front side usually has the primary account number (PAN), cardholder name and expiration date.
The magnetic stripe or chip holds these plus other sensitive data for authentication and authorization.
In general, no payment card data should ever be stored by a merchant unless it’s necessary to meet
the needs of the business. Sensitive data on the magnetic stripe or chip must never be stored. Only
the PAN, expiration date, service code, or cardholder name may be stored, and merchants must use
technical precautions for safe storage (see back of this fact sheet for a summary). The matrix below
shows basic “do’s” and “don’ts” for data storage security

Technical Guidelines for Stored Payment Card Data

PCI DSS Requirement 3 details technical guidelines for protecting stored cardholder data. Merchants
should develop a data retention and storage policy that strictly limits storage amount and retention
time to that which is required for business, legal, and/or regulatory purposes.

Sensitive authentication data must never be stored after authorization – even if this data is encrypted.

• Never store full contents of any track from the card’s magnetic stripe or chip (referred to as full
track, track, track 1, track 2, or magnetic stripe data). If required for business purposes, the
cardholder’s name, PAN, expiration date, and service code may be stored as long as they are
protected in accordance with PCI DSS requirements.

• Never store the card-validation code or value (three- or four-digit number printed on the front or
back of a payment card used to validate card-not-present transactions).

• Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever
it is displayed. The first six and last four digits are the maximum number of digits that may be
displayed. This requirement does not apply to those authorized with a specific need to see the full
PAN, nor does it supersede stricter requirements in place for displays of cardholder data such as
on a point-of-sale receipt.

Technical Guidelines for Protecting Stored Payment Card Data

At a minimum, PCI DSS requires PAN to be rendered unreadable anywhere it is stored – including
portable digital media, backup media, and in logs. Software solutions for this requirement may
include one of the following:

• One-way hash functions based on strong cryptography – also called hashed index, which
displays only index data that point to records in the database where sensitive data actually reside.
• Truncation – removing a data segment, such as showing only the last four digits.
• Index tokens and securely stored pads – encryption algorithm that combines sensitive plain text
data with a random key or “pad” that works only once.
• Strong cryptography – with associated key management processes and procedures. Refer to the
PCI DSS and PA-DSS Glossary of Terms, Abbreviations and Acronyms for the definition of “strong
cryptography.”

Some cryptography solutions encrypt specific fields of information stored in a database; others
encrypt a singular file or even the entire disk where data is stored. If full-disk encryption is used,
logical access must be managed independently of native operating system access control
mechanisms. Decryption keys must not be tied to user accounts. Encryption keys used for
encryption of cardholder data must be protected against both disclosure and misuse. All key
management processes and procedures for keys used for encryption of cardholder data must be
fully documented and implemented. For more details, see PCI DSS Requirement 3.

Virtual Currency

What is a 'Cryptocurrency'

A cryptocurrency is a digital or virtual currency that uses cryptography for security. A cryptocurrency is difficult to counterfeit because of this security feature. A defining feature of a cryptocurrency, and arguably its most endearing allure, is its organic nature; it is not issued by any central authority, rendering it theoretically immune to government interference or manipulation.

BREAKING DOWN 'Cryptocurrency'

The anonymous nature of cryptocurrency transactions makes them well-suited for a host of nefarious activities, such as money laundering and tax evasion.

The first cryptocurrency to capture the public imagination was Bitcoin, which was launched in 2009 by an individual or group known under the pseudonym Satoshi Nakamoto. As of September 2015, there were over 14.6 million bitcoins in circulation with a total market value of $3.4 billion. Bitcoin's success has spawned a number of competing cryptocurrencies, such as Litecoin, Namecoin and PPCoin.

Cryptocurrency Benefits and Drawbacks

Cryptocurrencies make it easier to transfer funds between two parties in a transaction; these transfers are facilitated through the use of public and private keys for security purposes. These fund transfers are done with minimal processing fees, allowing users to avoid the steep fees charged by most banks and financial institutions for wire transfers.

Central to the genius of Bitcoin is the block chain it uses to store an online ledger of all the transactions that have ever been conducted using bitcoins, providing a data structure for this ledger that is exposed to a limited threat from hackers and can be copied across all computers running Bitcoin software. Many experts see this block chain as having important uses in technologies, such as online voting and crowdfunding, and major financial institutions such as JP Morgan Chase see potential in cryptocurrencies to lower transaction costs by making payment processing more efficient.

However, because cryptocurrencies are virtual and do not have a central repository, a digital cryptocurrency balance can be wiped out by a computer crash if a backup copy of the holdings does not exist. Since prices are based on supply and demand, the rate at which a cryptocurrency can be exchanged for another currency can fluctuate widely.

Cryptocurrencies are not immune to the threat of hacking. In Bitcoin's short history, the company has been subject to over 40 thefts, including a few that exceeded $1 million in value. Still, many observers look at cryptocurrencies as hope that a currency can exist that preserves value, facilitates exchange, is more transportable than hard metals, and is outside the influence of central banks and governments.

Transactional properties:

1.) Irreversible: After confirmation, a transaction can‘t be reversed. By nobody. And nobody means nobody. Not you, not your bank, not the president of the United States, not Satoshi, not your miner. Nobody. If you send money, you send it. Period. No one can help you, if you sent your funds to a scammer or if a hacker stole them from your computer. There is no safety net.

2.) Pseudonymous: Neither transactions nor accounts are connected to real-world identities. You receive Bitcoins on so-called addresses, which are randomly seeming chains of around 30 characters. While it is usually possible to analyze the transaction flow, it is not necessarily possible to connect the real world identity of users with those addresses.

3.) Fast and global: Transaction are propagated nearly instantly in the network and are confirmed in a couple of minutes. Since they happen in a global network of computers they are completely indifferent of your physical location. It doesn‘t matter if I send Bitcoin to my neighbour or to someone on the other side of the world.

4.) Secure: Cryptocurrency funds are locked in a public key cryptography system. Only the owner of the private key can send cryptocurrency. Strong cryptography and the magic of big numbers makes it impossible to break this scheme. A Bitcoin address is more secure than Fort Knox.

5.) Permissionless: You don‘t have to ask anybody to use cryptocurrency. It‘s just a software that everybody can download for free. After you installed it, you can receive and send Bitcoins or other cryptocurrencies. No one can prevent you. There is no gatekeeper.

What is BOT network???

A botnet is a collection of internet-connected devices, which may include PCs, servers, mobile devices and internet of things devices that are infected and controlled by a common type of malware. Users are often unaware of a botnet infecting their system.
Infected devices are controlled remotely by threat actors, often cybercriminals, and are used for specific functions, so the malicious operations stay hidden to the user. Botnets are commonly used to send email spam, engage in click fraud campaigns and generate malicious traffic for distributed denial-of-service attacks.

How botnets work

The term botnet is derived from the words robot and network. A bot in this case is a device infected by malware, which then becomes part of a network, or net, of infected devices controlled by a single attacker or attack group.

The botnet malware typically looks for vulnerable devices across the internet, rather than targeting specific individuals, companies or industries. The objective for creating a botnet is to infect as many connected devices as possible, and to use the computing power and resources of those devices for automated tasks that generally remain hidden to the users of the devices.

For example, an ad fraud botnet that infects a user's PC will take over the system's web browsers to divert fraudulent traffic to certain online advertisements. However, to stay concealed, the botnet won't take complete control of the web browsers, which would alert the user. Instead, the botnet may use a small portion of the browser's processes, often running in the background, to send a barely noticeable amount of traffic from the infected device to the targeted ads.

On its own, that fraction of bandwidth taken from an individual device won't offer much to the cybercriminals running the ad fraud campaign. However, a botnet that combines millions of devices will be able to generate a massive amount of fake traffic for ad fraud, while also avoiding detection by the individuals using the devices.

Botnet architecture

Botnet infections are usually spread through malware, such as a Trojan horse. Botnet malware is typically designed to automatically scan systems and devices for common vulnerabilities that haven't been patched, in hopes of infecting as many devices as possible. Botnet malware may also scan for ineffective or outdated security products, such as firewalls or antivirus software.

Encrypting and Decrypting Files

Do you want to protect sensitive information from a third party??

          Then the solution is to encrypt the file or the folder which contains sensitive data and transfer the encrypted file.

This encryption and decryption mechanism is called as Cryptology. In Cryptology is a combination of two terms. (cryptography and cryptoanalysis). 

Cryptoanalysis  

          

              →  Converting encrypted information to Understandable information.

Cryptography   

              

              →  Study of hiding information.

For encryption and decryption we use keys. According to these keys encryption can be divided into two categories.

1. Symmetric key encryption
2. Asymmetric key encryption

Symmetric Key Encryption

           In this method of encryption, the key that is used to encrypt the message is same as the key that is used to decrypt the message. So the key have to be shared between the sender and the receiver carefully. This key is known as preshared key.

Asymmetric Key Encryption

               In asymmetric key encryption two keys are used. One has two keys. Public key and the private key. Public key is published for everyone while the private key is only known by him/her self.

Message can be encrypted with the receiver's public key and the receiver can decrypt the message with receiver's private key.

Message can be encrypted with the sender's private key and the receiver can decrypt the message with sender's public key.

Here you can go through the code in my GITHUB repository and download it. Save that inside of the netbeans project file and run it.

https://github.com/tharushi-pushpakumara/FileEncryptor

first select what you want to do from home page.(Encryption or Decryption)

When you select encrypt or decrypt button you are directed to a form to select the file that you want to encrypt.

further if you want add some more files to encrypt with the same password, then you can add all that files or folders here by clicking add files to encrypt button.

Then you are prompted to enter a password to decrypt the file.

You can see the progress of the encryption function.

when you click on decryption button in the home page the you are prompted to enter the password which you have used to encrypt the relevant file or the folder.

If there are more files and folders that you have encrypted with the same password then you can add all of them here.

Progress of the decryption can be seen here.

Stop Intruders in their Tracks

Security challenges are getting smarter  day by day. Devices hardening, controlling the access and firewall features are all part of a secured network. But they cannot defend against fast moving virus and worms. A network should have the ability to identify and mitigate threats of virus and worms.

Intrusion Prevention Systems and Intrusion Detection Systems are required to identify and mitigate threats.In implementing IDS or IPS it is necessary to be familiar with the types of system available in placing of these systems, Host-Based and Network-Based Approaches.

IDS (Intrusion Detection Systems)

IDS are implemented to monitor the network traffic passively. This device copies and analyzes the network traffic rather than analyzing the actual packets and compare the packets with the known malware.

IDS works in offline mode.

• works passively
• physically positioned in a place where the traffic can be mirrored.
• unless the traffic is not mirrored then the traffic will not pass through the IDS.

The problem in IDS is it cannot prevent attacks and protect the network. It can only detect the attacks. The solution foe this is IPS.

IPS (Intrusion Prevention Systems)

IPS is built upon the technology of IDS. IDS monitors the traffic of layer 3 and layer 4. CISCO IPS platforms use several detection technologies.

• Signature based
• Profile based
• protocol analysis based

IPS can stops malicious packets from reaching the secured network by analyzing the actual packets and the negative side is it affects the packet flow of forwarded packets. If the IPS fails the the whole network goes down as it is configured in inline mode.

Cyber forensics

Computer forensics is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law. The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computing device and who was responsible for it.

Forensic investigators typically follow a standard set of procedures: After physically isolating the device in question to make sure it cannot be accidentally contaminated, investigators make a digital copy of the device's storage media. Once the original media has been copied, it is locked in a safe or other secure facility to maintain its pristine condition. All investigation is done on the digital copy.

Investigators use a variety of techniques and proprietary software forensic applications to examine the copy, searching hidden folders and unallocated disk space for copies of deleted, encrypted, or damaged files. Any evidence found on the digital copy is carefully documented in a "finding report" and verified with the original in preparation for legal proceedings that involve discovery, depositions, or actual litigation.

Cybercrimes cover a broad spectrum, from email scams to downloading copyrighted works for distribution, and are fueled by a desire to profit from another person's intellectual property or private information. Cyberforensics can readily display a digital audit trail for analysis by experts or law enforcement. Developers often build program applications to combat and capture online criminals; these applications are the crux of cyberforensics.

Cyber-forensic techniques include:

Cross-driven analysis that correlates data from multiple hard drives

Live analysis, which obtains data acquisitions before a PC is shut down

Deleted file recovery

Each of the above techniques is applied to cyberforensic investigations.

Why is Computer Forensics Important?

Adding the ability to practice sound computer forensics will help you ensure the overall

integrity and survivability of your network infrastructure. You can help your organization

if you consider computer forensics as a new basic element in what is known as a

“defense-in-depth” approach to network and computer security. For instance,

understanding the legal and technical aspects of computer forensics will help you capture

vital information if your network is compromised and will help you prosecute the case if

the intruder is caught. 

Legal Aspects of Computer Forensics 

Anyone overseeing network security must be aware of the legal implications of forensic activity. Security professionals need to consider their policy decisions and technical actions in the context of existing laws. For instance, you must have authorization before you monitor and collect information related to a computer intrusion. There are also legal ramifications to using security monitoring tools. Computer forensics is a relatively new discipline to the courts and many of the existing laws used to prosecute computer-related crimes, legal precedents, and practices related to computer forensics are in a state of flux. New court rulings are issued that affect how computer forensics is applied. The best source of information in this area is the United States Department of Justice’s Cyber Crime web site.4 4 http://www.cybercrime.gov The site lists recent court cases involving computer forensics and computer crime, and it has guides about how to introduce computer evidence in court and what standards apply. The important point for forensics investigators is that evidence must be collected in a way that is legally admissible in a court case. Increasingly, laws are being passed that require organizations to safeguard the privacy of personal data. It is becoming necessary to prove that your organization is complying with computer security best practices. If there is an incident that affects critical data, for instance, the organization that has added a computer forensics capability to its arsenal will be able to show that it followed a sound security policy and potentially avoid lawsuits or regulatory audits. 

Your Files have been encrypted

If you got a message like that, it means that you have been exposed to a ransomeware....

Ransomware???💥😨💥

Ransomware is a type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking the users' files unless a ransom is paid. More modern ransomware families, collectively categorized as crypto-ransomware, encrypt certain file types on infected systems and forces users to pay the ransom through certain online payment methods to get a decrypt key

Ransomware malware can be spread through malicious e-mail attachments, infected software apps, infected external storage devices and compromised websites. In a lockscreen attack, the malware may change the victim’s login credentials for a computing device. In a data kidnapping attack, the malware may encrypt files on the infected device as well as other connected network devices.

There are two types of ransomware in circulation:

Encrypting ransomware, which incorporates advanced encryption algorithms. It's designed to block System files and demand payment to provide the victim with the key that can decrypt the blocked content. 
Ex: 

• Cryptolocker
• Locky
• Cryptowall

Locker ransomware, which locks the victim out of the operating system, making it impossible to access the desktop and any apps or files. The files are not encrypted in this case, but the attackers still ask for a ransom to unlock the infected computer. 

Ex;

• Police-themed ransomware
• Winlocker

Some locker versions can even infect the Master Boot Record (MBR). The MBR is the section of a PC’s hard drive which enables the operating system to boot up. When MBR ransomware strikes, the boot process can’t complete as usual and prompts a ransom note to be displayed on the screen.

Crypto-ransomware, as encryptors are usually known, is the most widespread ones, and also the subject of this article. The cyber security community agrees that this is the most prominent and worrisome cyber threat of the moment (and it’s been so for the past few years).