Firewall is used to protect the network from external attacks by hackers. Firewall prevents direct communication between computers in the network and the external computers, through the Internet. Instead, all communication is done through a proxy server, outside the organization s network, which decides whether or not it is safe to let a file pass through. The term firewall now denotes a component or set of components that restrict access, protects, and filters the content passing through a protected network from the Internet. Firewalls can protect a network by screening out harmful files or data from within or outside and prevent its clients from accessing prohibited or harmful websites. The use of a firewall on a router is possible. A number of different router brands or designs like the CISCO collection of routers have options on setting up a basic firewall. A router is a device that diverts or routes information along a specified network.

What you will need in the process:

• Router
• Computer

Here we goes with the steps:

Step 1

Choose a router best suited for the computer. There are different types of firewalls that suit different kinds of computers and routers that cater to a user’s specific needs.

Step 2

It is a must to understand a basic firewall. Most routers incorporate a pre-configured basic firewall sufficient for most common needs. This basic firewall is generally adequate to protect the network while allowing the clients of the network appropriate access to be productive. Some users have specific needs that require an advanced degree of customized firewall configuration. Because of this, a router sometimes includes a filter set editor that can make a custom firewall set suitable to answering the specific needs of individual users.

Step 3
To further understand a firewall, some firewall terms must be defined. A host is a computer unit on a network. A packet is a unit of communication on the network and is filtered by packet filters. Packet filters allow or deny packets depending on source or destination IP addresses, the TCP ACK bit or TCP, or UDP ports. The port is a number that defines a particular type of service. The filter rule is a filter set comprised of individual filter rules while a filter set is a group of individual filter rules.

Step 4

Set up a basic firewall on your router. Usually, a firewall is activated by accessing the “Connection Profile” option on the “Quick Menus”. Change Connection Profiles into “IP Profile Parameters then “Filter Set”. This basic firewall will allow traffic originating from the Local Area Network (LAN) to move out and prevent traffic from moving in unless requested by the LAN. You may also check your Router User’s Manual for additional details not found here.

Step 5

Configure your basic firewall according your preference.

Below is the example of configuring CISCO ASA as a transparent firewall……. May be this is not related to the topic directly but will help to understand the procedure.

Security5 is an entry level professional certification for individuals interested in learning computer networking and security basics. This certification program insures an individual’s competency in basic security matters, such as the definitions and the safe implementation of Firewalls, ports, and Anti-virus software. The 5 in the Program name indicates the five components of IT Security, as defined by EC-Council:

• Intrusion Detection System (IDS)
• Firewalls
• Anti-Virus
• Networking
• Web Security

The field of information security has grown and evolved significantly in recent years. As a career choice, there are many ways of gaining entry into the field. It offers many areas for specialization including: securing networks and allied infrastructure, securing applications and databases, security testing, information systems auditing, business continuity planning, and digital forensics science, to name a few.

Information security professionals are the individuals who restrict the unauthorized access of information and resources. The field of information security has grown and evolved significantly in recent years. As a career choice, there are many ways of gaining entry into the field. It offers many areas for specialization including: securing networks and allied infrastructure, securing applications and databases, security testing, information systems auditing, business continuity planning, and digital forensics science, to name a few.

If you are new in the Information security field, then ECSS certification is the best option for you as it covers all the topics that one needs to know to become a valuable Information security professional. ECSS certification is of EC-Council, which is a well known in field of Information Security, Ethical Hacking, Computer Forensics, and Network Security. The ECSS exam will give a holistic overview of the key components of information security and that will help you to get a good job and/or promotions.

If you are new in the Information security field, then ECSS certification is the best option for you as it covers all the topics that one needs to know to become a valuable Information security professional. ECSS certification is of EC-Council, which is a well known in field of Information Security, Ethical Hacking, Computer Forensics, and Network Security. The ECSS exam will give a holistic overview of the key components of information security and that will help you to get a good job and/or promotions. This Certification provides great opportunity to academic Graduates as well as experienced professionals.

For more information, visit the following link. http://www.eccouncil.org/certification/ec-council_certified_security_specialist.aspx

Ettercap is a Unix and Windows tool for computer network protocol analysis and security auditing. It is capable of intercepting traffic on a network segment, capturing passwords, and conducting active eavesdropping against a number of common protocols. It is a free open source software. Ettercap supports active and passive dissection of many protocols (including ciphered ones) and provides many features for network and host analysis.

Ettercap can be downloaded from the following link: http://ettercap.sourceforge.net/download.php

I was wondering from last couple of months with the tools and techniques used to perform penetration testing. So I thought my fellow readers also might be wondering with this tiedious task too. Finally I have decided to post about most helpful and comprehensive tools used in this process.

Starting with the Netcat. Please comment on this idea. Is it helpful? or need to do something else. New more things to come, just wait and watch.

NetCat:

Netcat is a networking utility tool, which is used to read and write data across network connections, using the TCP/IP protocol.
It is a reliable “back-end” tool that can be used directly or easily driven by other programs and scripts. It is also very efficient in network debugging and exploration.

Features of Netcat, which drive me to keep it at first place are as follows:

1. outbound or inbound connections, TCP or UDP, to or from any ports
2. Full DNS forward/reverse checking, with appropriate warnings
3. Ability to use any local source port
4. Ability to use any locally-configured network source address
5. Built-in port-scanning capabilities, with randomization
6. Built-in loose source-routing capability
7. Hex dump of transmitted and received data
8. Optional telnet-options responder
9. Featured tunneling mode which allows also special tunneling such as UDP to TCP, with the possibility of specifying all network parameters

It looks something like this in Linux.

and something like this in Windows:

This is a GNU project and can be downloaded from here

More to come.

Cryptographic attacks are methods of evading the security of a cryptographic system by finding weaknesses in such areas as the code, cipher, cryptographic protocol or key management scheme in the cryptographic algorithm. The following are the cryptographic attacks usually performed by an attacker: Known plaintext attack: In a known plaintext attack, an attacker should have both the plaintext and…copy of it with the encrypted data. This is used to find patterns in the cryptographic output that might uncover a vulnerability or reveal a cryptographic key.Chosen ciphertext attack: In this type of attack, an attacker can choose the ciphertext to be decrypted and can then analyze the plaintext output of the event. The early versions of RSA used in SSL were actually vulnerable to this attack.

Wireless networks today are the real needs of the business and technology world as it provides the interconnection between computers without any wires. The bottleneck of location and wires ,costs are all eliminated by the wireless technology. The wireless network setup concept is very much similar to that of a wired network where instead of the wires only wirelessly connections are made through wave spectrum.

It is a fairly simple setup. The Internet connection comes in from your provider and is connected to a wireless access point or router which broadcasts the signal. You connect wireless antenna network cards to your computers to receive that signal and talk back to the wireless access point and you are in business.

What are the Security issues ?

The risks to users of wireless technology have increased as the service has become more popular. There were relatively few dangers when wireless technology was first introduced. Crackers had not yet had time to latch on to the new technology and wireless was not commonly found in the work place. However, there are a great number of security risks associated with the current wireless protocols and encryption methods, and in the carelessness and ignorance that exists at the user and corporate IT level.Cracking methods have become much more sophisticated and innovative with wireles networks.

What are the different types of wireless security threats?

Denial of service attack

A Denial-of-Service attack (DoS) occurs when an attacker continually bombards a targeted AP (Access Point) or network with bogus requests, premature successful connection messages, failure messages, and/or other commands. These cause legitimate users to not be able to get on the network and may even cause the network to crash. These attacks rely on the abuse of protocols such as the Extensible Authentication Protocol (EAP).

. The usual reason for performing a DoS attack is to observe the recovery of the wireless network, during which all of the initial handshake codes are re-transmitted by all devices, providing an opportunity for the malicious attacker to record these codes and use various “cracking” tools to analyze security weaknesses and exploit them to gain unauthorized access to the system. This works best on weakly encrypted systems such as WEP, where there are a number of tools available which can launch a dictionary style attack of “possibly accepted” security keys based on the “model” security key captured during the network recovery.

Network Injection attack

In a network injection attack, a cracker can make use of access points that are exposed to non-filtered network traffic, specifically broadcasting network traffic such as “Spanning Tree”, OSPF, RIP, and HSRP. The cracker injects bogus networking re-configuration commands that affect routers, switches, and intelligent hubs. A whole network can be brought down in this manner and require rebooting or even reprogramming of all intelligent networking devices.

What to do to detect the intrusion?

A number of times all the prevention schemes fail to provide you the wireless fulproof security. Wireless intrusion detection systems give you the way to deal in the lost conditions. Wireless IDSs can be purchased through a vendor or developed in-house. There are currently only a handful of vendors who offer a wireless IDS solution – but the products are effective and have an extensive feature set.

Popular wireless IDS solutions include Airdefense RogueWatch and Airdefense Guard , and Internet Security Systems Realsecure Server sensor and wireless scanner products . A homegrown wireless IDS can be developed with the use of the Linux operating system, for example, and some freely available software. Open source solutions include Snort-Wireless and WIDZ , among others.

WHOIS is a famous protocol chiefly used for database query to determine the information of Internet resources like domain name, IP address, or any autonomous address. WHOIS lookup is basically performed with command user interface. Many web-based tools are available to perform WHOIS query. This service is usually communicated using the Transmission Control Protocol (TCP). Server listens to the request on the port number 43. The WHOIS system is originally developed for the system administrator to acquire contact information for different IP address or domain name administrators. Now a days WHOIS lookup query evolved into various different important aspects, including:

• It helps in determining the registration status of domain names.
• WHOIS also helps in law enforcement by various authorities in investigations for enforcing national and international laws.Specialized non-governmental bodies may be involved in this work of law enforement using this database query service.
• WHOIS lookup also help businesses, organizations and users in fighting fraud, complying with relevant laws and safeguarding the interests of the public properties.

I was surfing for the same topic and finally I found something very relevent to this topic. So I thought all my readers should also read this. Article on Footprinting on uCertify.com.

What is MD5?

MD5 is an algorithm, which is used to check the integrity of the data through the construction of a 128-bit message digest from the input data, which may be a message of any length and is claimed to be as only one of its kind to that specific data. MD5 algorithm was developed by Professor Ronald L. Rivest. This algorithm is originally created to use with digital signature applications, which requires that large files must be compressed by a secure method before being encrypted with a secret key, under a public key cryptosystem. MD5 is currently a standard, Internet Engineering Task Force (IETF) Request for Comments (RFC) 1321. It has been revealed that MD5 is not crash resistant; therefore MD5 algorithm is not suitable for the applications like SSL certificates or digital signatures that rely on this property. An MD5 hash is typically expressed as a 32 digit hexadecimal number. MD5 digests have been extensively used in the software industries to give assurance that the file, which is transferred has arrived unchanged. For example, file servers often provide a pre-computed MD5 checksum for the files, so that a user can compare the checksum of the downloaded file to it. Unix-based operating systems include MD5 sum utilities in their distribution packages, whereas Windows users use third-party applications. MD5 algorithm processes a variable-length message into a fixed-length output of 128 bits. The input message is broken up into pieces of 512-bit blocks; the message is padded so that its length is divisible by 512. The padding works as follows: first a single bit, 1, is appended to the end of the message. This is followed by as many zeros as are required to bring the length of the message up to 64 bits fewer than a multiple of 512. The remaining bits are filled up with a 64-bit integer representing the length of the original message, in bits.

Is CISSP certification is easy?

This is pretty controversial topic, some people think that it is easy but most of the people find it real hard. You should have experience of at least 3 years in IT security before you apply for the exam. You are required to come up with an extremely wide area of IT security such as physical security, very few people will have any experience in. And you will be expected to do enough reading and studying to get through CISSP certification exam: 250 questions to be answered in 6 hours. Hard to keep upwith much fun.

Get certified, sit back and enjoy.

The answer is big NO. After you pass the exam you are expected to earn CPE credits in order to keep your certification active. If you don’t then you are required to resit the exam after 3 years to keep the certification. Getting CPEs is fairly straightforward: if you publish papers, attend seminars, do some presentations, and basically remain active in the IT security arena then you should have no problem here. But it takes a little work: this isn’t a get-it and forget-it sort of certification.

You will get more money/better job/more recognition.

In actual fact, you probably won’t. I have found that many employers and even employment agencies have no idea what a CISSP is. They tend to think in terms of the product-certifications; you know, the Cisco CCNA and Checkpoint CCSE sort of thing. They have no idea that you need 3 years of experience to get a CISSP, and they have no idea that it is an ongoing professional-level certification like a CPA (Chartered Accountant). Ergo, you probably won’t get a better job or more money from waving your CISSP certificate around.

So, why would you want a CISSP? Its not easy to get, it takes maintenance, and may not gain you much. Why would you want to go through all that hassle? Here’s some good reasons:

1. To expand your knowledge in security concepts and practices.
2. To show a dedication to the security discipline.
3. To meet a growing demand for security professionals, and to work in a thriving field.
4. To join a professional organisation and to link up with like-minded individuals.

If you’re genuinely interested in IT security (cryptography, practices, ethics, etc), and you feel you need a driver to learn more then the CISSP is for you. Book the exam, then start learning as much as possible. On the other hand, if you just want a better job/more money then get an MCSE or CCNA

Certified Information Systems Security Professional (CISSP) is an independent information security certification governed by the not-for-profit International Information Systems Security Certification Consortium, commonly known as (ISC)2. In June, 2004, the CISSP was the first information security credential accredited by ANSI ISO/IEC Standard 17024:2003 accreditation, and, as such, has led industry acceptance of this global standard and its stringent requirements.It is formally approved by the U.S. Department of Defense (DoD) in both their Information Assurance Technical (IAT) and Managerial (IAM) categories. The CISSP has been adopted as a baseline for the U.S. National Security Agency’s ISSEP program. (ISC)2 promotes the CISSP certification as the “international gold standard” against which other security certifications are measured.

IT professionals with security expertise are often in high demand, and the CISSP is one metric by which that expertise can be demonstrated. A 2006 Certification Magazine salary survey also ranked the CISSP credential highly at $94,070 per year, and ranked CISSP concentration certifications as the top best paid credentials in IT, with CISSP-ISSAPs averaging at $114,210 per year and CISSP-ISSMP at $111,280 per year. These numbers correlate with compensation advantages enjoyed by IT security professionals in general, as well as with advantages accruing to the seniority and management roles that intersect with the concentration certificates.