IT Technologies

IT technologies and concepts explorer and analyser in the web.

  • RSS
  • Delicious
  • Digg
  • Facebook
  • Twitter
  • Linkedin

New IT Concepts

Share Your Comments

  • Virtualization - The new technology evelution

    Virtualization, in computing, is the creation of a virtual (rather than actual) version of something, such as a hardware platform, operating system, a storage device or network resources.....

  • http://ittechnologies.blogspot.com/2011/04/common-security-vulnerabilities-in-e.html

    Security Vulnerabilities in E-Commerce Systemin

    Most of these attacks have utilized vulnerabilities that have been published in reusable third-party components utilized by websites, such as shopping cart software and poor design of such websites. Other factor is user awareness of security vulnerabilities.

  • VPN - Virtual Private Network

    VPN is a technology which is making secure private network through the public accessible network infrastructure. Virtual Private Network represent by the short name VPN. ...

  • Saas - Cloud Computing

    The cloud computing : is based on this three concepts. IaaS (Infrastructure as a service), PaaS (Platform as a Service) and SaaS (Software as a Service).

How Firewalls Work

Posted by Priyan Fernando - - 0 comments

How Firewalls WorkIf you have been usin Internet on a regular basis or working in a large company and surf the Internet while you are at work, you must have surely come across the term firewall. You might have also heard of people saying “firewalls protect their computer from web attacks and hackers” or “a certain website has been blocked by firewall in their work place”. If you have ever wondered to know what exactly is this firewall and how it works, here we go. In this post I will try to explain “How firewalls work” in a layman’s terms.

How Firewalls Work

 
Firewalls are basically a barrier between your computer (or a network) and the Internet (outside world). A firewall can be simply compared to a security guard who stands at the entrance of your house and filters the visitors coming to your place. He may allow some visitors to enter while denying others whom he suspects of being intruders. Similarly a firewall is a software program or a hardware device that filters the information (packets) coming through the Internet to your personal computer or a computer network.
How Firewalls Work
Firewalls may decide to allow or block network traffic between devices based on the rules that are pre-configured or set by the firewall administrator. Most personal firewalls such as Windows firewall operate on a set of pre-configured rules that are most suitable under normal circumstances so that the user need not worry much about configuring the firewall.
Personal firewalls are easy to install and use and hence preferred by end-users for use on their personal computers.  However large networks and companies prefer those firewalls that have plenty of options to configure so as to meet their customized needs. For example, a company may set up different firewall rules for FTP servers, Telnet servers and Web servers. In addition the company can even control how the employees connect to the Internet by blocking access to certain websites or restricting the transfer of files to other networks. Thus in addition to security, a firewall can give the company a tremendous control over how people use the network.
Firewalls use one or more of the following methods to control the incoming and outgoing traffic in a network:
1. Packet Filtering: In this method packets (small chunks of data) are analyzed against a set of filters. Packet filters has a set of rules that come with accept and deny actions which are pre-configured or can be configured manually by the firewall administrator. If the packet manages to make it through these filters then it is allowed to reach the destination; otherwise it is discarded.
2. Stateful Inspection: This is a newer method that doesn’t analyze the contents of the packets. Instead it compares certain key aspects of each packet to a database of trusted source. Both incoming and outgoing packets are compared against this database and if the comparison yields a reasonable match, then the packets are allowed to travel further. Otherwise they are discarded.
 

Firewall Configuration

 
Firewalls can be configured by adding one or more filters based on several conditions as mentioned below:
1. IP addresses: In any case if an IP address outside the network is said to be unfavorable, then it is possible to set  filter to block all the traffic to and from that IP address. For example, if a cetain IP address is found to be making too many connections to a server, the administrator may decide to block traffic from this IP using the firewall.
2. Domain names: Since it is difficult to remember the IP addresses, it is an easier and smarter way to configure the firewalls by adding filters based on domain names. By setting up a domain filter, a company may decide to block all access to certain domain names, or may provide access only to a list of selected domain names.
3. Ports/Protocols: Every service running on a server is made available to the Internet using numbered ports, one for each service. In simple words, ports can be compared to virtual doors of the server through which services are made available. For example, if a server is running a Web (HTTP) service then it will be typically available on port 80. In order to avail this service, the client needs to connect to the server via port 80. Similarly different services such as Telnet (Port 23), FTP (port 21) and SMTP (port 25) services may be running on the server. If the services are intended for the public, they are usually kept open. Otherwise they are blocked using the firewall so as to prevent intruders from using the open ports for making unauthorized connections.
4. Specific words or phrases: A firewall can be configured to filter one or more specific words or phrases so that, both the incoming and outgoing packets are scanned for the words in the filter. For example, you may set up a firewall rule to filter any packet that contains an offensive term or a phrase that you may decide to block from entering or leaving your network.
 

Hardware vs. Software Firewall

 
Hardware firewalls provide higher level of security and hence preferred for servers where security has the top most priority whereas, the software firewalls are less expensive and are most preferred in home computers and laptops. Hardware firewalls usually come as an in-built unit of a router and provide maximum security as it filters each packet in the hardware level itself even before it manages to enter your computer. A good example is the Linksys Cable/DSL router.
 

Why Firewall?

 
Firewalls provide security over a number of online threats such as Remote login, Trojan backdoors, Session hijacking, DOS & DDOS attacks, viruses, cookie stealing and many more. The effectiveness of the security depends on the way you configure the firewall and how you set up the filter rules. However major threats such as DOS and DDOS attacks may sometimes manage to bypass the firewalls and do the damage to the server. Even though firewall is not a complete answer to online threats, it can most effectively handle the attacks and provide security to the computer up to the maximum possible extent.
[ Read More ]

How to Hack an Ethernet ADSL Router

Posted by Priyan Fernando - - 0 comments

ADSL-RoutersAlmost half of the Internet users across the globe use ADSL routers/modems to connect to the Internet however, most of them are unaware of the fact that it has a serious vulnerability which can easily be exploited even by a noob hacker just like you. In this post I will show you how to exploit a common vulnerability that lies in most ADSL routers so as to gain complete access to the router settings and ISP login details.
Every router comes with a username and password using which it is possible to gain access to the router settings and configure the device. The vulnerability actually lies in the Default username and password that comes with the factory settings. Usually the routers come preconfigured from the Internet Service provider and hence the users do not bother to change the password later. This makes it possible for the attackers to gain unauthorized access and modify the router settings using a common set of default usernames and passwords. Here is how you can do it.
Before you proceed, you need the following tool in the process
Angry IP Scanner
Here is a detailed information on how to exploit the vulnerability of an ADSL router.
Step-1: Go to www.whatismyipaddress.com. Once the page is loaded you will find your IP address. Note it down.
Step-2: Open Angry IP Scanner, here you will see an option called IP Range: where you need to enter the range of IP address to scan for.
Suppose your IP is 117.192.195.101, you can set the range something as 117.192.194.0 to 117.192.200.255 so that there exists atleast 200-300 IP addresses in the range.
 
Step-3: Go to Tools->Preferences and select the Ports tab. Under Port selection enter 80 (we need to scan for port 80). Now switch to the Display tab, select the option “Hosts with open ports only” and click on OK.
IP Scanner
I have used Angry IP Scanner v3.0 beta-4. If you are using a different version, you need to Go to Options instead of Tools
 
Step-4: Now click on Start. After a few minutes, the IP scanner will show a list of IPs with Port 80 open as shown in the below image.
IP Scanner
 
Step-5: Now copy any of the IP from the list, paste it in your browser’s address bar and hit enter. A window will popup asking for username and password. Since most users do not change the passwords, it should most likely work with the default username and password. For most routers the default username-password pair will be admin-admin or admin-password.
Just enter the username-password as specified above and hit enter. If you are lucky you should gain access to the router settings page where you can modify any of the router settings. The settings page can vary from router to router. A sample router settings page is shown below.
Router Settings Page
 
If you do not succeed to gain access, select another IP from the list and repeat the step-5. Atleast 1 out of 5 IPs will have a default password and hence you will surely be able to gain access.
 

What can an Attacker do by Gaining Access to the Router Settings?

By gaining access to the router settings, it is possible for an attacker to modify any of the router settings which results in the malfunction of the router. As a result the target user’s computer will be disconnected from the Internet. In the worst case the attacker can copy the ISP login details from the router to steal the Internet connection or play any kind of prank with the router settings. So the victim has to reconfigure the router in order to bring it back to action.
 

The Verdict:

If you are using an ADSL router to connect to the Internet, it is highly recommended that you immediately change your password to prevent any such attacks in the future. Who knows, you may be the next victim of such an attack. 
Since the configuration varies from router to router, you need to contact your ISP for details on how to change the password for your model.

Warning


All the information provided in this post are for educational purposes only. Please do not use this information for illegal purposes.
[ Read More ]

How to Protect Your Computer from Keyloggers

Posted by Priyan Fernando - - 0 comments

Protect from Keyloggers
Keyloggers have been a major problem today as it does not require any prior knowledge of computers to use it. So hackers mainly use keyloggers to steal your passwords, credit card numbers and other confidential data. Below are some methods through which you can protect your computer from keyloggers:
 

Use a Good Antivirus

This is the first and basic step that you need to take in order to protect your computer from keyloggers. Use a Good antivirus such as Kaspersky, Norton or Mcafee and update it regularly.
 

Use a Good Antispyware

Since keyloggers are basically spywares, if you are a frequent user of Internet then you could be exposed to thousands of keyloggers and spywares. So you should use a good antispyware such as NoAdware.
 

Antilogger can be Handy

Antiloggers are programs that detect the presence of keyloggers on a given computer. Over past few years, I have tested a lot of anti-logging programs and have found Zemana Antilogger as the best antilogger.
Zemana
Normally a keylogger can be easily detected by a Good Antivirus program, but hackers use some methods such as hexing, binding, crypting and similar techniques to make it harder to be detected by antivirus programs. In this case Zemana Antilogger comes handy as the program is specially developed to protect your system against harmful keyloggers.
Zemana Antilogger
 

Online Scanning

When ever you receive a suspicious file, you scan it with online scanners such as Multi engine antivirus scanner which scans your file with 24 antivirus engines and reports it back to you if the file is recognized as a virus or spyware. This ensures that none of the malicious programs can escape from being detected as there are 24 different antivirus engines are involved in the scanning process.
 

Sandboxie

Sandboxie is another great program to help you protect your computer against harmful keyloggers and spywares. Sandboxie runs your computer in an isolated space which prevents your program from making permanent changes to other programs in your computer.
When ever you receive a file that looks suspicious, just run the program with Sandboxie so even if it is a keylogger or any other virus it will not make permanent changes to your computer system.
Sandboxie
To run a program in Sandboxie follow the steps as mentioned below:
1. Open sandboxie and click on sandbox menu on the top
2. Now goto Default sandbox
3. Then click on run any program
4. Now select the file you wish to run in sandboxie and click open
 

Keyscrambler

Keyscrambler is one of the best protection against keyloggers that you can have, Keyscrambler is a small program which encrypts your typed keystrokes so even if the victim has installed a keylogger on your system, he or she will get encrypted keys. Keyscrambler currently supports Firefox, Internet explorer and other applications, however its premium version supports more than 160 applications.
Hope you liked my post! Pass the comments.
This is a guest post by Rafay baloch who is an 18 year Computer engineering student, Ethical hacker, Tech blogger and an Internet marketer, He blogs at his blog Learn How to Hack and he is the writer of the book “A Beginners Guide To Ethical Hacking“
[ Read More ]

Hack Facebook Password – Facebook Hacking

Posted by Priyan Fernando - - 0 comments

How to get face book Hack






 Wondering to know how to hack Facebook password? Well, before you can do that, it is very much necessary to understand the real ways of hacking that actually work and also those that are simply scam and do not work. So in this post, we’ll look at some of the possible ways to hack Facebook password!
Every day I get a lot of emails from people requesting me to hack Facebook passwords of their spouse, girlfriend or boyfriend so as to reveal their secret relationships (if any). Most of them are even willing to pay for the service. However, I strongly deny any such requests since I do not provide any paid hacking service. But anyhow, I have decided to write down this post so that you can learn the tricks for yourself and implement everything at your own risk.
With my experience of over 7 years in the field of ethical hacking and security, all I can tell you is that there are only two ways to successfully hack Facebook password.

Possible Ways to Hack Facebook Password


1. Keylogging – The Easiest Way!

Keylogging refers to simply recording each and every keystroke that is  typed on a specific computer’s keyboard. This is possible with the use of a small computer program called keylogger (also known as spy software). Once installed, this program will automatically load from the start-up, runs in the invisible mode and start capturing each and every keystroke that was typed on the computer. 
Some keyloggers with advanced features can also capture screenshots and monitor every activity of the computer. One doesn’t need to have any special knowledge in order to install and use a keylogger. That means, anyone with a basic knowledge of computer can install and use this software with ease. Hence for a novice computer user this method is the easiest way to hack Facebook password. I recommend the following keylogger as the best for gaining access to Facebook account.
Easily Access any Email
SniperSpy (TESTED) is a revolutionary product that will allow you to easily access *ANY* online account or password protected material such as MySpace, Facebook, Yahoo, Gmail or Hotmail. There are absolutely *NO* limitations to what accounts or websites this software can access!
Why SniperSpy is the best?
Today there exists hundreds of keyloggers on the market but most of them are no more than a crap. However, there are only a few that stand out of the crowd and SniperSpy is the best among them. I personally like SniperSpy for it’s REMOTE INSTALLATION FEATURE. With this, you can install it on a remote computer without the need for having physical access to it. It operates in a complete stealth mode so that it remains undetected.
Here is a summary of benefits that you will receive with Sniperspy software:
1. Access ANY Password
With SniperSpy you can hack any password and gain access to Facebook or any other online account.
2. Monitor Every Activity
You can monitor every activity of the target computer, take screenshots and record chats & IM conversations.
3. Never Get Caught!
SniperSpy operates in a total stealth mode and thus remains undetectable. Therefore you need not have the fear of being traced or getting caught.
4. Remote Installation Feature
With the Remote Install feature, it is possible to install it even on computers for which you do not have physical access. However, it can also be installed on a local computer.
5. Extremely Easy to Use
Installing and using SniperSpy is simple and needs no extra skill to manage.
6. Completely Safe to Use
This software is 100% safe to use since it does not collect any personal information from your computer. SniperSpy is a reputed, trustworthy and reliable company which offers 100% privacy for it’s users.
7. Works on both Windows and Mac
Fully compatible with Windows 2000/XP/Vista/7 and Mac.
So what are you waiting for? If you are really serious to hack Facebook password then SniperSpy is for you. Go grab it now and expose the truth!

2. Phishing – The Difficult Way

The other common way to hack passwords or online accounts is via Phishing. This is the most widely used technique by many hackers to gain access to Facebook and other social networking websites. This method will make use of a fake login page (often called as spoofeed webpage) which will exactly resemble the original one. Say for example, a spoofed webpage of Facebook looks exactly same as that of the original page. This page is actually created by the hacker and is hosted on his own server. Once the victim enters his/her password in such a fake login page, the login details are stolen away by the hacker.
Most Internet users would easily fall prey to such online phishing scams. Thus phishing scams trick users in such a way that, they themselves give away their passwords. But phishing requires specialized knowledge and high level skills to implement. Hence it would not be possible for a noob user (perhaps like you) to attempt this trick. It is a punishable offense too. So, I would recommend that you stay away from phishing and make use of the keyloggers to hack Facebook password since it is the easiest and the safest way.

Facebook Hacking Methods that Do Not Work! 


Today, there are hundreds of scam websites out there that are waiting to rip off your pockets by making false promises. These websites claim to be the experts in the field of hacking and boast to instantly obtain any password for you. Most people fall victim to these websites and lose their hard earned money. Thus the idea behind this post is to expose the truth behind hacking the Facebook (or any email password) so that you can learn how to do it for yourself and stay away from all those scam websites. The following are some of the hacking methods that actually do not work:
1. Many scam websites claim to exploit a certain vulnerability of Facebook website as a means to crack the password. Unfortunately, there is no such vulnerability in Facebook (or any other online account) that can be exploited to crack the password. I advise you to stay away from such scam websites.
2. There is no ready-made software program that is available to hack Facebook password except the keylogger (spy software). In fact, keyloggers are pretty generic and meant to record the keystrokes of a computer which obviously includes the password also. Keep in mind that apart from the keylogger, there is no such program that is specifically designed to gain access to Facebook accounts. Stay away from any website that claim to sell such program.
3. Beware! On many websites and Internet forums you will often see fake articles about Facebook hacking. Most of them will tell you something like this: “you need to send an email to passwordretrieve@facebook.com along with your username and password” (or something similar). Never give away your password to anyone nor send it to any email address. If you do so, you will lose your password itself in attempt to hack somebody else’s password.
I hope this post will help you avoid scams and choose the right approach to accomplish your goal.
[ Read More ]

what is trojan virus?

Posted by Priyan Fernando - - 0 comments

In computers, a Trojan horse is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the file allocation table on your hard disk. In one celebrated case, a Trojan horse was a program that was supposed to find and destroy computer viruses. A Trojan horse may be widely redistributed as part of a computer virus.


The term comes from Greek mythology about the Trojan War, as told in the Aeneid by Virgil and mentioned in the Odyssey by Homer. According to legend, the Greek



presented the citizens of Troy with a large wooden horse in which they had ecretly hidden their warriors. During the night, the warriors emerged from the wooden horse and overran the city.


The most important difference between a trojan virus/trojan horse and a virus is that trojans don’t spread themselves. Trojan horses disguise themselves as valuable and useful software available for download on the internet. Most people are fooled by this ploy and end up dowloading the virus disguised as some other application. The name comes from the mythical “Trojan Horse” that the Ancient Greeks set upon the city of Troy.
A trojan horse is typically separated into two parts – a server and a client. It’s the client that is cleverly disguised as significant software and positioned in peer-to-peer file sharing networks, or unauthorized download websites. Once the client Trojan executes on your computer, the attacker, i.e. the person running the server, has a high level of control over your computer, which can lead to destructive effects depending on the attacker’s purpose.
Trojan Virus Trojan Virus
A trojan horse virus can spread in a number of ways. The most common means of infection is through email attachments. The developer of the virus usually uses various spamming techniques in order to distribute the virus to unsuspecting users. Another method used by malware developers to spread their trojan horse viruses is via chat software such as Yahoo Messenger and Skype. Another method used by this virus in order to infect other machines is through sending copies of itself to the people in the address book of a user whose computer has already been infected by the virus.

Types of Trojan Horse Viruses

Trojan Horses have developed to a remarkable level of cleverness, which makes each one radically different from each other. For an inclusive understanding, we have classified them into the following:
Remote Access Trojans
Remote Access Trojans are the most frequently available trojans. These give an attacker absolute control over the victim’s computers. The attacker can go through the files and access any personal information about the user that may be stored in the files, such as credit card numbers, passwords, and vital financial documents.
Password Sending Trojans
The intention of a Password Sending Trojan is to copy all the cached passwords and look for other passwords as you key them into your computer, and send them to particular email addresses. These actions are performed without the awareness of the users. Passwords for restricted websites, messaging services, FTP services and email services come under direct threat with this kind of trojan.
Key Loggers
Key Loggers type of Trojans logs victims’ keystrokes and then send the log files to the attacker. It then searches for passwords or other sensitive data in the log files. Most of the Key Loggers come with two functions, such as online and offline recording. Of course, they can be configured to send the log file to a specific email address on a daily basis.
Destructive Trojans
The only purpose of Destructive Trojans is to destroy and delete files from the victims’ computers. They can automatically delete all the core system files of the computer. The destructive trojan could be controlled by the attacker or could be programmed to strike like a logic bomb, starting on a particular day or at specific time.
Denial of Service (DoS) Attack Trojans
The core design intention behind Denial of Service (DoS) Attack Trojan is to produce a lot of internet traffic on the victim’s computer or server, to the point that the Internet connection becomes too congested to let anyone visit a website or download something. An additional variation of DoS Trojan is the Mail-Bomb Trojan, whose key plan is to infect as many computers as possible, concurrently attacking numerous email addresses with haphazard subjects and contents that cannot be filtered.
Proxy/Wingate Trojans
Proxy/Wingate Trojans convert the victim’s computer into a Proxy/Wingate server. That way, the infected computer is accessible to the entire globe to be used for anonymous access to a variety of unsafe Internet services. The attacker can register domains or access pornographic websites with stolen credit cards or do related illegal activities without being traced.
FTP Trojans
FTP Trojans are possibly the most simple, and are outdated. The only action they perform is, open a port numbered 21 – the port for FTP transfers – and let anyone connect to your computer via FTP protocol. Advance versions are password-protected, so only the attacker can connect to your computer.
Software Detection Killers
Software Detection Killers kill popular antivirus/firewall programs that guard your computer to give the attacker access to the victim’s machine.
FTP Trojans
Note: A Trojan could have any one or a combination of the above mentioned functionalities. Some might also come on USB drives, usually as “Autorun.inf” viruses.
The best way to prevent a Trojan Horse Virus from entering and infecting your computer is to never open email attachments or files that have been sent by unknown senders. However, not all files we can receive are guaranteed to be virus-free. With this, a good way of protecting your PC against malicious programs such as this harmful application is to install and update an antivirus program.
[ Read More ]

What Is Ethical Hacking?

Posted by Priyan Fernando - - 0 comments


An Ethical Hacker is an expert hired by a company to attempt to attack their network and computer system the same way a hacker would. Ethical Hackers use the same techniques and tactics as those used by illegal hackers to breach corporate security systems. The end result is the company's ability to prevent an intrusion before it ever occurs.



A company can't know if their security system is solid unless they test it. It's hard, though, for a company's IT team to thoroughly ring out the system. Try as they might, the techs can't go at the system with all the malicious or mischievous motives of a true illegal hacker. To thoroughly uncover vulnerabilities, the theory goes; you must examine your security system through the eyes of an illegal hacker.
The word hacking has strongly negative connotations, and, for the most part, rightly so. But ethical hacking is much different. It takes place with the explicit permission of the company whose system is being attacked. In fact, their "good guy" role is underscored by the nickname "white hat" Ethical Hackers have been given. The nickname is a throwback to old Westerns where the good cowboys could be identified by their white hats.
The company and the Ethical Hacker enter into a legally binding contract. The contract, sometimes called a "get out of jail free card," sets forth the parameters of the testing. It's called the "get out of jail free card" because it's what harbors the Ethical Hacker from prosecution. Hacking is a felony, and a serious one at that. The terms of the agreement are what transform illegal behavior into a legal and legitimate occupation.
Once the hacker has exhausted his attempts, he reports back to the company with a list of the vulnerabilities he uncovered. The list in and of itself, however, is not particularly useful. What's most valuable is the instructions for eliminating the vulnerabilities that the Ethical Hacker provides.
An Ethical Hacker works to uncover three key pieces of information. First, he determines what information an illegal hacker can gain access to. Next, he explores what an illegal hacker could do with that information once gained. Last, the Ethical Hacker ascertains whether an employee or staff member would be alerted to the break-in, successful or not.
At first it might sound strange that a company would pay someone to try to break into their system. Ethical hacking, though, makes a lot of sense, and it is a concept companies have been employing for years. To test the effectiveness and quality of product, we subject it to the worst case scenario. The safety testing performed by car manufacturers is a good example. Current regulatory requirements including HIPAA, Sarbanes Oxley, and SB-1386 and BS 799 require a trusted third party to check that systems are secure.
In order to get the most out of the assessment, a company should decide in advance the nature of the vulnerabilities they're most concerned with. Specifically, the company should determine which information they want to keep protected and what they're concerned would happen if the information was retrieved by an illegal hacker.
Companies should thoroughly assess the qualifications and background of any Ethical Hacker they are considering hiring. This individual will be privy to highly sensitive information. Total honesty and integrity is of the utmost importance.
Paul Walsh, of Protocol Solutions asks the scariest question out there: Think your network is safe from malicious attack? Find out for sure - a quick, complimentary chat will help you sleep better.


Article Source: http://EzineArticles.com/842484
[ Read More ]

Common Security Vulnerabilities in E-Commerce System

Posted by Priyan Fernando - - 0 comments

INTRODUCTION

The tremendous increase in online transactions has been accompanied by an equal rise in the number and type of attacks against the security of online payment systems. Some of these attacks have utilized vulnerabilities that have been published in reusable third-party components utilized by websites, such as shopping cart software. Other attacks have used vulnerabilities that are common in any web application, such as SQL injection or cross-site scripting.



Consumer privacy is becoming the most publicized security issue replacing theft and fraud as top concerns in e-commerce. The DDOS attacks demonstrated that business sites did not maintain adequate security protection and intrusion detection measures. Some of the sites did not detect the compromise, which occurred months before the DDOS attacks. The hackers who penetrated these sites had the ability to deliver a data integrity attack on the compromised business for the same amount of time. Businesses were spared simply because the hackers chose not to attack them in that manner. No customer will want to use a business that distributes sensitive customer data such as credit card information, SSN information or credit limits without the knowledge or permission of the customer.

User and system administrator awareness is becoming more important in the effort to counter e-commerce attacks. Consumers are slowly becoming aware of some security features such as encrypted web transactions, privacy statements by companies, etc. Internet service providers are becoming more responsive to complaints about Internet abuse originating from their sites.

E-commerce security needs to be addressed not only at the business site with its servers/network, but also on the client side, which includes direct connected home computers. It is this group of computers that are the most vulnerable to attack because the level of user security training or awareness is not high at all.
 The tremendous increase in online transactions has been accompanied by an equal rise in the number and type of attacks against the security of online payment systems. Some of these attacks have utilized vulnerabilities that have been published in reusable third-party components utilized by websites, such as shopping cart software. Other attacks have used vulnerabilities that are common in any web application, such as SQL injection or cross-site scripting. 

Today rapidly increasing using online transaction on online payment systems.the attacks for such systems is increasing more than that. Most of these attacks have utilized vulnerabilities that have been published in reusable third-party components utilized by websites, such as shopping cart software and poor design of such websites. Other factor is user awareness of security vulnerabilities.

Today there many types of attacks for e-commerce applications. such ass SQL injection, denial of service attacks, Cross-site Scripting (XSS) attack ant etc.


  • SQL Injection - this will use sql quarries to get information, update or damage the system.attacker's queries are executed by the back-end database.SQL injection techniques differ depending on the type of database being used.


  • Price Manipulation - This is almost completely unique to online shopping carts and payment gateways.attacker can get and change the hidden information while transaction.
  • Buffer overflows - Sending in a large number of bytes to web applications can damage and get important information while the application is generating the errors.


  • Cross-site scripting XSS - The XSS attack requires a web form that takes in user input, processes it, and prints out the results on a web page, which also contains the user's original input.
  • Remote command execution - When CGI script allows an attacker to execute operating system commands due to inadequate input validation. This is most common with the use of the 'system' call in Perl and PHP scripts. 


Vulnerabilities                                                                 


There are a number of reasons why security vulnerabilities arise in shopping cart and online payment systems. The reasons are not exclusive to these systems, but their impact becomes much greater simply because of the wide exposure that an online website has, and because of the financial nature of the transactions.

One of the main reasons for such vulnerabilities is the fact that web application developers are often not very well versed with secure programming techniques. As a result, security of the application is not necessarily one of the design goals. This is exacerbated by the rush to meet deadlines in the fast-moving e-commerce world. Even one day's delay in publishing a brand new feature on your website could allow a competitor to steal a march over you. It is found that there are cases where e-commerce sites need to add functionality rapidly to deal with a sudden change in the business environment or simply to stay ahead of the competition. In such a scenario, the attitude is to get the functionality online; security can always be taken care of later.

Another reason why security vulnerabilities appear is because of the inherent complexity in most online systems. Nowadays, users are placing very demanding requirements on their e-commerce providers, and this requires complex designs and programming logic.
Let’s look at the common security vulnerabilities that have been discovered in E-Commerce sites.

Using denial of service attacks                                      


The denial of service attack is one of the best examples of impacting site availability. It involves getting the server to perform a large number of mundane tasks, exceeding the capacity of the server to cope with any other task. For example, if everyone in a large meeting asks you your name all at once, and every time you answer, they ask you again. You have experienced a personal denial of service attack.


Distributed DoS is a type of attack used on popular sites, such as Yahoo!®. In this type of attack, the hacker infects computers on the Internet via a virus or other means. The infected computer becomes slaves to the hacker. The hacker controls them at a predetermined time to bombard the target server with useless, but intensive resource consuming requests. This attack not only causes the target site to experience problems, but also the entire Internet as the number of packets is routed via many different paths to the target.


SQL Injection                                                                   


SQL injection refers to the insertion of SQL meta-characters in user input, such that the attacker's queries are executed by the back-end database. Typically, attackers will first determine if a site is vulnerable to such an attack by sending in the single-quote (') character. The results from an SQL injection attack on a vulnerable site may range from a detailed error message, which discloses the back-end technology being used, or allowing the attacker to access restricted areas of the site because he manipulated the query to an always-true Boolean value, or it may even allow the execution of operating system commands.

SQL injection techniques differ depending on the type of database being used. For instance, SQL injection on an Oracle database is done primarily using the UNION keyword and is much more difficult than on the MS SQL Server, where multiple queries can be executed by separating them with the semi-colon. In its default configuration, MS SQL server runs with Local System privileges and has the 'xp_cmdshell' extended procedure, which allows execution of operating system commands.

 

 

Price Manipulation                                                          


This is a vulnerability that is almost completely unique to online shopping carts and payment gateways. In the most common occurrence of this vulnerability, the total payable price of the purchased goods is stored in a hidden HTML field of a dynamically generated web page. An attacker can use a web application proxy such as Achilles to simply modify the amount that is payable, when this information flows from the user's browser to the web server. Shown below is a snapshot of just such a vulnerability that was discovered in one of the author's penetration testing assignments.


Achilles web proxy

The final payable price (currency=Rs&amount=879.00) can be manipulated by the attacker to a value of his choice. This information is eventually sent to the payment gateway with whom the online merchant has partnered. If the volume of transactions is very high, the price manipulation may go completely unnoticed, or may be discovered too late. Repeated attacks of this nature could potentially cripple the viability of the online merchant.

Buffer overflows                                                                                       


Buffer overflow vulnerabilities are not very common in shopping cart or other web applications using Perl, PHP, ASP, etc. However, sending in a large number of bytes to web applications that are not geared to deal with them can have unexpected consequences. In one of the author's penetration testing assignments, it was possible to disclose the path of the PHP functions being used by sending in a very large value in the input fields. As the sanitized snapshot below shows, when 6000 or more bytes were fed into a particular field, the back-end PHP script was unable to process them and the error that was displayed revealed the location of these PHP functions.


PHP timeout error
Using this error information it was possible to access the restricted 'admin' folder. From the structure of the web site and the visible hyperlinks there would have been no way to determine that there existed the 'admin' directory within the 'func' sub-directory below the main $DocumentRoot.

Cross-site scripting                                                    

The Cross-site Scripting (XSS) attack is primarily targeted against the end user and leverages two factors:

1.      The lack of input and output validation being done by the web application
2.      The trust placed by the end-user in a URL that carries the vulnerable web site's name.

The XSS attack requires a web form that takes in user input, processes it, and prints out the results on a web page, which also contains the user's original input. It is most commonly found in 'search' features, where the search logic will print out the results along with a line such as 'Results for <user_supplied_input>'.

In this case, if the user input is printed out without being parsed, then an attacker can embed JavaScript by supplying it as part of the input. By crafting a URL, which contains this JavaScript, a victim can be social engineered into clicking on it, and the script executes on the victim's system. A typical XSS attack URL would look like this: http://www.vulnerablesite.com/cgi-bin/search.php?keywords=&lt;script>alert("OK")&lt;script>. In this case, when the victim clicks on this link, a message box with the text "OK" will open up on his system.

 







Remote command execution                                         


The most devastating web application vulnerabilities occur when the CGI script allows an attacker to execute operating system commands due to inadequate input validation. This is most common with the use of the 'system' call in Perl and PHP scripts. Using a command separator and other shell meta-characters, it is possible for the attacker to execute commands with the privileges of the web server. For instance, Hassan Consulting's Shopping Cart allowed remote command execution, because shell meta-characters such as |;& were not rejected by the software. However, directory traversal was not possible in this software.




Weak Authentication and Authorization                        

 

Authentication mechanisms that do not prohibit multiple failed logins can be attacked using tools such as Brutus. Similarly, if the web site uses HTTP Basic Authentication or does not pass session IDs over SSL (Secure Sockets Layer), an attacker can sniff the traffic to discover user's authentication and/or authorization credentials.

Since HTTP is a stateless protocol, web applications commonly maintain state using session IDs or transaction IDs stored in a cookie on the user's system. Thus this session ID becomes the only way that the web application can determine the online identity of the user. If the session ID is stolen (say through XSS), or it can be predicted, then an attacker can take over a genuine user's online identity vis-à-vis the vulnerable web site. Where the algorithm used to generate the session ID is weak, it is trivial to write a Perl script to enumerate through the possible session ID space and break the application's authentication and authorization schemes.

Conclusion


The most important point is to build security into the web application at the design stage itself. In fact, one of the key activities during the design phase should be a detailed risk assessment exercise. Here, the team must identify the key information assets that the web application will be dealing with. These could include configuration information, user transaction details, session IDs, credit card numbers, etc. Each of these information assets needs to be classified in terms of sensitivity. Depending upon the tentative architecture chosen, the developers along with security experts must analyze the threats, impact, vulnerabilities and threat probabilities for the system. Once these risks are listed out, system countermeasures must be designed and if necessary the architecture itself may be modified. Countermeasures should also include strict input validation routines, a 3-tier modular architecture, use of open-source cryptographic standards, and other secure coding practices.

 

The vulnerabilities are not only present in shopping carts or online payment systems but also present in other types of web applications as well. However, in the case of e-commerce systems, the vulnerabilities acquire a graver dimension due to the financial nature of transactions. What is at stake is not only a direct loss of revenues, but companies may face a serious loss to their reputations as well. It is of paramount importance for designers and developers of web applications to consider security as a primary design goal and to follow secure coding guidelines in order to provide the highest possible degree of assurance to their customers.



 


References:

http://www.ecommerce-digest.com/ecommerce-security-issues.html

http://www.upu.int/security/en/e-commerce_security_en.pdf

http://www.securityfocus.com/infocus/1775

http://www.ecommerce-guide.com/news/trends/article.php/7761_253601


[ Read More ]