Potential Security Threats To Your Computer Systems @cmd_programming

A computer system threat is anything that leads to loss or corruption of data or physical damage to the hardware and/or infrastructure.
Knowing how to identify computer security threats is the first step in protecting computer systems. The threats could be intentional, accidental or caused by natural disasters.
In this article, we will introduce you to the common computer system threats and how you can protect systems against them.
@cmd_programming
What is a Security Threat?

Security Threat is defined as a risk that which can potentially harm computer systems and organization. The cause could be physical such as someone stealing a computer that contains vital data. The cause could also be non-physical such as a virus attack. In these tutorial series, we will define a threat as a potential attack from a hacker that can allow them to gain unauthorized access to a computer system.
@cmd_programming
What are Physical Threats?
A physical threat is a potential cause of an incident that may result in loss or physical damage to the computer systems.

The following list classifies the physical threats into three (3) main categories;
Internal: The threats include fire, unstable power supply, humidity in the rooms housing the hardware, etc.
External: These threats include Lightning, floods, earthquakes, etc.
Human: These threats include theft, vandalism of the infrastructure and/or hardware, disruption, accidental or intentional errors.
@cmd_programming
To protect computer systems from the above mentioned physical threats, an organization must have physical security control measures.

The following list shows some of the possible measures that can be taken:
Internal: Fire threats could be prevented by the use of automatic fire detectors and extinguishers that do not use water to put out a fire. The unstable power supply can be prevented by the use of voltage controllers. An air conditioner can be used to control the humidity in the computer room.

External: Lightning protection systems can be used to protect computer systems against such attacks. Lightning protection systems are not 100% perfect, but to a certain extent, they reduce the chances of Lightning causing damage. Housing computer systems in high lands are one of the possible ways of protecting systems against floods.

Humans: Threats such as theft can be prevented by use of locked doors and restricted access to computer rooms.

What are Non-physical threats?
A non-physical threat is a potential cause of an incident that may result in;
- Loss or corruption of system data
- Disrupt business operations that rely on computer systems
- Loss of sensitive information
- Illegal monitoring of activities on computer systems
- Cyber Security Breaches
- Others
@cmd_programming
The non-physical threats are also known as logical threats. The following list is the common types of non-physical threats;

- Virus
- Trojans
- Worms
- Spyware
- Key loggers
- Adware
- Denial of Service Attacks
- Distributed Denial of Service Attacks
- Unauthorized access to computer systems resources such as data
- Phishing
- Other Computer Security Risks

@cmd_programming

To protect computer systems from the above-mentioned threats, an organization must have logical security measures in place. The following list shows some of the possible measures that can be taken to protect cyber security threats.

To protect against viruses, Trojans, worms, etc. an organization can use anti-virus software. In additional to the anti-virus software, an organization can also have control measures on the usage of external storage devices and visiting the website that is most likely to download unauthorized programs onto the user’s computer.

Unauthorized access to computer system resources can be prevented by the use of authentication methods. The authentication methods can be, in the form of user ids and strong passwords, smart cards or biometric, etc.

Intrusion-detection/prevention systems can be used to protect against denial of service attacks.There are other measures too that can be put in place to avoid denial of service attacks.

@cmd_programming

Skills Required to Become a Ethical Hacker
@cmd_programming
Skills allow you to achieve your desired goals within the available time and resources. As a hacker, you will need to develop skills that will help you get the job done. These skills include learning how to program, use the internet, good at solving problems, and taking advantage of existing security tools.

What is a programming language?
A programming language is a language that is used to develop computer programs. The programs developed can range from operating systems; data based applications through to networking solutions.
@cmd_programming
Why should you learn programming?
- Hackers are the problem solver and tool builders, learning how to program will help you implement solutions to problems. It also differentiates you from script kiddies.
- Writing programs as a hacker will help you to automate many tasks which would usually take lots of time to complete.
- Writing programs can also help you identify and exploit programming errors in applications that you will be targeting.
- You don’t have to reinvent the wheel all the time, and there are a number of open source programs that are readily usable. You can customize the already existing applications and add your methods to suit your needs.
@cmd_programming
What languages should I learn?
The answer to this question depends on your target computer systems and platforms. Some programming languages are used to develop for only specific platforms. As an example, Visual Basic Classic (3, 4, 5, and 6.0) is used to write applications that run on Windows operating system. It would, therefore, be illogical for you to learn how to program in Visual Basic 6.0 when your target is hacking Linux based systems.

Programming languages that are useful to hackers
@cmd_programming
HTML
- Language used to write web pages.
- *Cross platform
Purpose : Web hacking
Login forms and other data entry methods on the web use HTML forms to get data. Being able to write and interpret HTML, makes it easy for you to identify and exploit weaknesses in the code.
@cmd_programming
JavaScript
- Client side scripting language
- *Cross platform
Purpose: Web Hacking
JavaScript code is executed on the client browse. You can use it to read saved cookies and perform cross site scripting etc.
@cmd_programming
PHP
- Server side scripting language
- *Cross platform
Purpose: Web Hacking
PHP is one of the most used web programming languages. It is used to process HTML forms and performs other custom tasks. You could write a custom application in PHP that modifies settings on a web server and makes the server vulnerable to attacks.
@cmd_programming
SQL
- Language used to communicate with database
- *Cross platform
Purpose: Web Hacking
Using SQL injection, to by-pass web application login algorithms that are weak, delete data from the database, etc.

@cmd_programming

Python, Ruby, Bash, and Perl @cmd_programming
- High level programming languages
- *Cross platform
Purpose: Building tools & scripts
They come in handy when you need to develop automation tools and scripts. The knowledge gained can also be used in understand and customization the already available tools.
@cmd_programming
C & C++
- Low Level Programming
- *Cross platform
Purpose: Writing exploits, shell codes, etc.
They come in handy when you need to write your own shell codes, exploits, root kits or understanding and expanding on existing ones.
@cmd_programming
Java, CSharp(C#), Visual Basic and VBScript
- Other languages
- Java & CSharp are *cross platform.
- Visual Basic is specific to Windows
Other uses
The usefulness of these languages depends on your scenario

* Cross platform means programs developed using the particular language can be deployed on different operating systems such as Windows, Linux based, MAC etc.
@cmd_programming #hacking

Other skills
In addition to programming skills, a good hacker should also have the following skills:

- Know how to use the internet and search engines effectively to gather information.
- Get a Linux-based operating system and the know the basics commands that every Linux user should know.
- Practice makes perfect, a good hacker should be hard working and positively contribute to the hacker community. He/she can contribute by developing open source programs, answering questions in hacking forums, etc.

Summary
- Programming skills are essential to becoming an effective hacker.
- Network skills are essential to becoming an effective hacker
- SQL skills are essential to becoming an effective hacker.
- Hacking tools are programs that simplify the process of identifying and exploiting weaknesses in computer systems.
@cmd_programming

How to Crack a Password

What is Password Cracking?
Password cracking is the process of attempting to gain Unauthorized access to restricted systems using common passwords or algorithms that guess passwords. In other words, it’s an art of obtaining the correct password that gives access to a system protected by an authentication method.

Password cracking employs a number of techniques to achieve its goals. The cracking process can involve either comparing stored passwords against word list or use algorithms to generate passwords that match

What is password strength?
Password strength is the measure of a password’s efficiency to resist password cracking attacks.
The strength of a password is determined by;
- Length: the number of characters the password contains.
- Complexity: does it use a combination of letters, numbers, and symbol?
- Unpredictability: is it something that can be guessed easily by an attacker?

Let’s now look at a practical example. We will use three passwords namely
1. password
2. password1
3. #password1$
The 3rd is long, complex and unpredictable more than the 1st and the 2nd.

@cmd_programming #password #cracking

Password cracking techniques @cmd_programming
There are a number of techniques that can be used to crack passwords. We will describe the most commonly used ones below;
- Dictionary attack– This method involves the use of a wordlist to compare against user passwords.
@cmd_programming
- Brute force attack– This method is similar to the dictionary attack. Brute force attacks use algorithms that combine alpha-numeric characters and symbols to come up with passwords for the attack. For example, a password of the value “password” can also be tried as p@$$word using the brute force attack.
@cmd_programming
- Rainbow table attack– This method uses pre-computed hashes. Let’s assume that we have a database which stores passwords as md5 hashes. We can create another database that has md5 hashes of commonly used passwords. We can then compare the password hash we have against the stored hashes in the database. If a match is found, then we have the password.
@cmd_programming
- Guess– As the name suggests, this method involves guessing. Passwords such as qwerty, password, admin, etc. are commonly used or set as default passwords. If they have not been changed or if the user is careless when selecting passwords, then they can be easily compromised.
@cmd_programming
- Spidering– Most organizations use passwords that contain company information. This information can be found on company websites, social media such as Facebook, twitter, etc. Spidering gathers information from these sources to come up with word lists. The word list is then used to perform dictionary and brute force attacks.
@cmd_programming
Password cracking tool
These are software programs that are used to crack user passwords.
The website www.md5this.com uses a rainbow table to crack passwords.
We will now look at some of the commonly used tools;
@cmd_programming
John the Ripper
John the Ripper uses the command prompt to crack passwords. This makes it suitable for advanced users who are comfortable working with commands. It uses to wordlist to crack passwords. The program is free, but the word list has to be bought. It has free alternative word lists that you can use. Visit the product website https://www.openwall.com/john/ for more information and how to use it.
@cmd_programming
Cain & Abel
Cain & Abel runs on windows. It is used to recover passwords for user accounts, recovery of Microsoft Access passwords; networking sniffing, etc. Unlike John the Ripper, Cain & Abel uses a graphic user interface. It is very common among newbies and script kiddies because of its simplicity of use. Visit the product website https://www.softpedia.com/get/Security/Decrypting-Decoding/Cain-and-Abel.shtml for more information and how to use it.
@cmd_programming
Ophcrack
Ophcrack is a cross-platform Windows password cracker that uses rainbow tables to crack passwords. It runs on Windows, Linux and Mac OS. It also has a module for brute force attacks among other features. Visit the product website https://ophcrack.sourceforge.io/ for more information and how to use it.

@cmd_programming

In this practical scenario, we are going to crack Windows account with a simple password. Windows uses NTLM hashes to encrypt passwords. We will use the NTLM cracker tool in Cain and Abel to do that.
@cmd_programming #hacking #password #cracking #cain and #abel

Summary
- Password cracking is the art of recovering stored or transmitted passwords.
- Password strength is determined by the length, complexity, and unpredictability of a password value.
- Common password techniques include dictionary attacks, brute force, rainbow tables, spidering and cracking.
- Password cracking tools simplify the process of cracking passwords.
@cmd_programming

Cryptography Tutorial: What is Cryptanalysis, RC4 and CrypTool
Information plays a vital role in the running of business, organizations, military operations, etc. Information in the wrong hands can lead to loss of business or catastrophic results. To secure communication, a business can use cryptology to cipher information. Cryptology involves transforming information into the Nonhuman readable format and vice versa.

What is Cryptography?
Cryptography is the study and application of techniques that hide the real meaning of information by transforming it into nonhuman readable formats and vice versa.

Let’s illustrate this with the aid of an example. Suppose you want to send the message “I LOVE APPLES”, you can replace every letter in the phrase with the third successive letter in the alphabet. The encrypted message will be “K NQXG CRRNGU”. To decrypt our message, we will have to go back three letters in the alphabet using the letter that we want to decrypt. The image below shows how the transformation is done.
@cmd_programming

Cipher Encryption and Decryption
@cmd_programming
The process of transforming information into nonhuman readable form is called encryption.
@cmd_programming
The process of reversing encryption is called decryption.

Decryption is done using a secret key which is only known to the legitimate recipients of the information. The key is used to decrypt the hidden messages. This makes the communication secure because even if the attacker manages to get the information, it will not make sense to them.

The encrypted information is known as a cipher. Next in this Cryptography tutorial, we will learn what is cryptanalysis.

What is Cryptanalysis?
Cryptanalysis is the art of trying to decrypt the encrypted messages without using the key that was used to encrypt the messages. Cryptanalysis uses mathematical analysis and algorithms to decipher the ciphers. It is used to breach security systems to gain access to encrypted content and messages even the cryptographic key is unknown.
@cmd_programming
The success of cryptanalysis attacks depends
- Amount of time available
- Computing power available
- Storage capacity available

The following is a list of the commonly used Cryptanalysis attacks;

- Brute force attack– this type of attack uses algorithms that try to guess all the possible logical combinations of the plaintext which are then ciphered and compared against the original cipher.
- Dictionary attack– this type of attack uses a wordlist in order to find a match of either the plaintext or key. It is mostly used when trying to crack encrypted passwords.
- Rainbow table attack– this type of attack compares the cipher text against pre-computed hashes to find matches.
@cmd_programming
What is cryptology?
Cryptology combines the techniques of cryptography and cryptanalysis.

Encryption Algorithms @cmd_programming

MD5– this is the acronym for Message-Digest 5. It is used to create 128-bit hash values. Theoretically, hashes cannot be reversed into the original plain text. MD5 is used to encrypt passwords as well as check data integrity. MD5 is not collision resistant. Collision resistance is the difficulties in finding two values that produce the same hash values.
@cmd_programming
SHA– this is the acronym for Secure Hash Algorithm. SHA algorithms are used to generate condensed representations of a message (message digest). It has various versions such as;
- SHA-0: produces 120-bit hash values. It was withdrawn from use due to significant flaws and replaced by SHA-1.
- SHA-1: produces 160-bit hash values. It is similar to earlier versions of MD5. It has cryptographic weakness and is not recommended for use since the year 2010.
- SHA-2: it has two hash functions namely SHA-256 and SHA-512. SHA-256 uses 32-bit words while SHA-512 uses 64-bit words.
- SHA-3: this algorithm was formally known as Keccak.
@cmd_programming
- RC4– Brute force RC4 algorithm is used to create stream ciphers. It is mostly used in protocols such as Secure Socket Layer (SSL) to encrypt internet communication and Wired Equivalent Privacy (WEP) to secure wireless networks.
- BLOWFISH– this algorithm is used to create keyed, symmetrically blocked ciphers. It can be used to encrypt passwords and other data.

@cmd_programming

In this practical Cryptool tutorial, we will create a simple cipher using the RC4 brute force tool. We
will then attempt to decrypt it using brute-force attack. For this exercise, let us assume that we
know the encryption secret key is 24 bits. We will use this information to break the Cipher.
@cmd_programming