Visit: https://financeclub.viden.io
Dns Spoofing
DNS Spoofing is a type of computer attack wherein a user is forced to navigate to a fake website disguised to look like a real one, with the intention of diverting traffic or stealing credentials of the users. Spoofing attacks can go on for a long period of time without being detected and can cause serious security issues. Domain Name Server (DNS) resolves the alphabetical domain names like www.example.com into respective IP addresses that is used for locating and communicating between nodes on the Internet. DNS spoofing is done by replacing the IP addresses stored in the DNS server with the ones under control of the attacker. Once it is done, whenever users try to go to a particular website, they get directed to the false websites placed by the attacker in the spoofed DNS server. There are mainly two methods by which DNS spoofing is carried out – DNS cache poisoning and DNS ID spoofing. In DNS cache poisoning, the local DNS server is replaced with compromised DNS server containing customized entries of genuine website names with attacker’s own IP addresses. Hence, when a request is sent to the local DNS server for IP resolution, it communicates with the compromised DNS server, resulting in the user being redirected to a false website planted by the attacker. In DNS ID spoofing, the packet ID and IP information generated for the resolve request sent by the client is duplicated with false information inside it. As the response ID matches the request ID, the client accepts the response containing the information that is not expected. Common tips to prevent DNS Spoofing include maintaining the DNS software up-to-date, maintaining separate servers for public and internal services and using secure keys to sign updates received from other DNS servers to avoid updates from non-trusted sources
Palak Jain
Secure Sockets Layer (ssl)
SL functions around a cryptographic system which uses three keys to set up the SSL connection: public, private, and session keys. Anything encrypted by using the public key can only be decrypted with the private key, and vice versa. SSL Certificate will contain the company name, address, city, state, country, domain name, expiration date of the Certificate and details of the Certification Authority responsible for issuing the Certificate. When a browser connects to a secure site, it retrieves the website's SSL Certificate that authenticates that it has not expired, and that it has been issued by a Certification Authority the browser trusts. If it fails on any of these checks, the browser displays a warning message to the end user, letting them know that the site is not secured by SSL. Many websites use the protocol to collect confidential user information, including credit card numbers. Most web browsers support SSL. SSL connection URL starts with 'https:' instead of 'http:'. The complexities of the SSL protocol remain invisible to the customers. The lock icon in the lower right-hand corner in the browser displays the SSL Certificate and when the icon is clicked, it displays the whole description about the Certificate.
Cross-site Scripting
Cross-site scripting (XSS) is a type of computer security vulnerability. It is accounted for almost 85% of all website security vulnerabilities. Cross-site scripting (XSS) exploits the 'same-origin-policy' concept of web applications to allow hackers to extract information from the system Attackers conduct script injection that runs at the client side and is sometimes parsed at the server side. There are several ways to do this. The most common way is by putting some malicious data (script) in http query. This data is immediately parsed at the server side. It is a script in itself. When users surf these websites, this malicious script data is also served from the server and is displayed to users in the guise of some link. Users perceive this as simply a link. Once the user clicks on this link, the underlying malicious script gets executed. How can it access the private data of the user? The injected script is now part of the same domain that the user is surfing. This script can read user information from cookies since the injected script unfortunately happens to be in the same domain. So after getting information from the cookie, the script can send it to the attacker's server domain. Another example of XSS is e-mail content. An XSS attacker sends an e-mail to us, which contains malicious script in the form of some clickable html element. Whenever we open that email and click on that html element, the script gets executed.
Economics
Economics is a social science concerned with the production, distribution and consumption of goods and services. It studies how individuals, businesses, governments and nations make choices on allocating resources to satisfy their wants and needs, and tries to determine how these groups should organize and coordinate efforts to achieve maximum output.Economic analysis often progresses through deductive processes, much like mathematical logic, where the implications of specific human activities are considered in a "means-ends" framework.Economics can generally be broken down into macroeconomics, which concentrates on the behavior of the aggregate economy, and microeconomics, which focuses on individual consumers. Microeconomics focuses on how individual consumers and producers make their decisions. This includes a single person, a household, a business or a governmental organization. Microeconomics ranges from how these individuals trade with one another to how prices are affected by the supply and demand of goods. Also studied are the efficiency and costs associated with producing goods and services, how labor is divided and allocated, uncertainty, risk, and strategic game theory. Macroeconomics studies the overall economy. This can include a distinct geographical region, a country, a continent or even the whole world. Topics studied include government fiscal and monetary policy, unemployment rates, growth as reflected by changes in the Gross Domestic Product (GDP) and business cycles that result in expansion, booms, recessions and depressions. There are also schools of economic thought. Two of the most common are Classical and Keynesian. The Classical view believes that free markets are the best way to allocate resources and the government’s role should be limited to that of a fair, strict referee. In contrast, the Keynesian approach believes that markets don’t work well at allocating resources on their own, and that governments must step in from time to time and actively reallocate resources efficiently. Some branches of economic thought emphasize empiricism in economics, rather than formal logic — specifically, macroeconomics or Marshallian microeconomics, which attempt to use the procedural observations and falsifiable tests associated with the natural sciences. Since true experiments cannot be created in economics, empirical economists rely on simplifying assumptions and retroactive data analysis. However, some economists argue economics is not well suited to empirical testing, and that such methods often generate incorrect or inconsistent answers.
Types of crptography
Modern cryptography concerns with: Confidentiality - Information cannot be understood by anyone Integrity - Information cannot be altered. Non-repudiation - Sender cannot deny his/her intentions in the transmission of the information at a later stage Authentication - Sender and receiver can confirm each Cryptography is used in many applications like banking transactions cards, computer passwords, and e- commerce transactions. Three types of cryptographic techniques used in general. 1. Symmetric-key cryptography 2. Hash functions. 3. Public-key cryptography Symmetric-key Cryptography: Both the sender and receiver share a single key. The sender uses this key to encrypt plaintext and send the cipher text to the receiver. On the other side the receiver applies the same key to decrypt the message and recover the plain text. Public-Key Cryptography: This is the most revolutionary concept in the last 300-400 years. In Public-Key Cryptography two related keys (public and private key) are used. Public key may be freely distributed, while its paired private key, remains a secret. The public key is used for encryption and for decryption private key is used. Hash Functions: No key is used in this algorithm. A fixed-length hash value is computed as per the plain text that makes it impossible for the contents of the plain text to be recovered. Hash functions are also used by many operating systems to encrypt passwords.
Path Traversal
Path Traversal is one of the many critical web application security vulnerabilities. It allows an attacker to get access to the files on the web server that is originally inaccessible to him/her. It employs the method of tricking the web application - or directly the web server on which the application is running - into returning files that exist outside of the web root folder. Any application that exposes an HTTP-based interface is potentially vulnerable to Path Traversal. Let’s take a website running on http://www.example123.com. Let us say that the web server we are running makes adding pages to website very easy. All we have to do is add pages to the web root folder ,/var/www, on the server file system and it is done. If we add the file /var/www/articles/latest.html, this page becomes accessible to anyone who will visit http://example123.com/articles/latest.html. Now, you can use some special character sequences like ../ to traverse directory chain and access files outside of root folder i.e. /var/www, like this: http://www.example123.com/../../protected/configuration.xml. The web server on receiving this request appends the user-specified relative path ../../configuration.xml to directory holding web pages /var/www for obtaining full path /var/www/../../configuration.xml. As a result, the attacker successfully obtains confidential information, probably even the database credentials which can be used to steal other users' information or simply wipe it out. A similar situation arises when the web server is up-to-date and non-vulnerable, yet this vulnerability is introduced in the application itself. Consider an application which is a bit advanced wherein every page has a link for downloading a PDF for information. Sample PDF link looks like this: http://www.example123.com/download?file=latest.pdf Using the same .../ technique, the attacker will be able to escape the PDF directory and access anything on the system. http://www.example123.com/download?file=../../protected/configuration.yml. Some easy ways to prevent Path Traversal vulnerability are keeping web server and application up-to-date, not relying on user input for any calls to file system and judiciously applying file system permissions.
Memory Corruption
Memory corruption bugs mostly occur in low-level programming languages like C or C++. It is one of the problems that existed for more than 30 years when it comes to the subject of computer security. The lack of memory safety (or type safety) in such languages allows attackers to exploit memory bugs by altering the program’s behavior or by even taking full control. Memory is used in blocks and malloc()/calloc() methods in C/C++ programming languages and are used for memory allocation and deallocation. Sometimes, array elements accessed beyond the array limit can create many problems. For instance, it can set unpredictable values to the next memory elements or it can set invalid pointer values. It can even corrupt dynamic memory allocators which can cause the application process to crash. Exploitation can be stopped by preventing stack, heap and integer overflows. Stack overflows are by far the most commonly exploited class of memory corruption flaws. The programming languages like Java, Ada, SML etc. are much safer than C/C++ and buffer overflow. There are several ways to defeat security attacks. Type-safe programming languages, formal methods and compiler analyses have been adopted to stop programmers from writing insecure software. This doesn’t solve all security problems, but does help solve most of them.
All about Https
HTTPS stands for Hypertext Transfer Protocol Secure. It is the protocol where encrypted HTTP data is transferred over a secure connection. By using secure connection such as Transport Layer Security or Secure Sockets Layer, the privacy and integrity of data are maintained and authentication of websites is also validated. HTTPS ensures data security over the network - mainly public networks like Wi-Fi. HTTP is not encrypted and is vulnerable to attackers who are eavesdropping and can gain access to website database and sensitive information. By virtue, HTTPS encryption is done bi-directionally, which means that the data is encrypted at both the client and server sides. Only the client can decode the information that comes from the server. So, HTTPS does encryption of data between a client and a server, which protects against eavesdropping, forging of information and tampering of data. But how do you ensure if you are seeing an HTTPS-enabled web page? Just check the address bar that carries the site name against different background colours with a lock icon at the left corner. However, this design can be different for different browsers. For example, consider going to a bank website, say hdfcbank.com. A non-secured HTTP will open up. But when we go to the login page, we can see an HTTPS in the address bar with some specific design. Implementation: HTTPS is mainly used by those websites which deal with monetary transactions or transfer user's personal data which could be highly sensitive. Banking websites are common examples. In layman's terms, HTTPS ensures that users watch websites that they want to watch. Data exchanged between the user and the website is not read, stolen or tampered with by a third party. But it can't encrypt everything - it has some limitations too. For example, HTTPS can't encrypt host addresses and port numbers.