HOW DO U FIND IF YOUR PC IS HACKED?- PART 3

1.  While WMIC is a relatively new command, let's not lose site of some useful older commands. One of my favourites is the venerable "net" command. Administrators can use this to display all kinds of useful information. For example, the "net user" command shows all user accounts defined locally on the machine. The "net localgroup" command shows groups, "net localgroup administrators" shows membership of the administrators group and the "net start" command shows running services.

2.  Attackers frequently add users to a system or put their own accounts in the administrators groups, so it's always a good idea to check the output of these commands to see if an attacker has manipulated the accounts on a machine. Also, some attackers create their own evil services on a machine, so users should be on the lookout for them.

More here.....

HOW DO U FIND IF YOUR PC IS HACKED?- PART 2

1.    WMIC stands for Windows Management Instrumentation Command-line It lets administrative users access all kinds of detailed information about a Windows machine, including detailed attributes of thousands of settings and objects. WMIC is built into Windows XP Professional, Windows 2003 and Windows Vista.

C:\> wmic process

2.    When you run this command, the output may not be an easy to understand format but the same can be formatted in several different ways, but two of the most useful for analysing a system for compromise are the "list full" option, which shows a huge amount of detail for each area of the machine a user is interested in, and the "list brief" output, which provides one line of output per report item in the list of entities, such as running processes, autostart programs and available shares. For example, we can look at a summary of every running process on a machine by running:

C:\> wmic process list brief

3.   That command will show the name, process ID and priority of each running process, as well as other less-interesting attributes.

C:\> wmic process list full

4.   This command shows all kinds of details, including the full path of the executable associated with the process and its command-line invocation. When

investigating a machine for infection, an administrator should look at each process to determine whether it has a legitimate use on the machine, researching unexpected or unknown processes using a search engine.

5.   Beyond the process alias, users could substitute startup to get a list of all auto-start programs on a machine, including programs that start when the system boots up or a user logs on, which could be defined by an auto-start registry key or folder:

C:\> wmic startup list full

6.   A lot of malware automatically runs on a machine by adding an auto-start entry alongside the legitimate ones which may belong to antivirus tools and various system tray programs. Users can look at other settings on a machine with WMIC by replacing "startup" with "QFE" (an abbreviation which stands for Quick Fix Engineering) to see the patch level of a system, with "share" to see a list of Windows file shares made available on the machine and with "useraccount" to see detailed user account settings.

7.   A handy option within WMIC is the ability to run an information-gathering command on a repeated basis by using the syntax "/every:[N]" after the rest of the WMIC command. The [N] here is an integer, indicating that WMIC should run the given command every [N] seconds. That way, users can look for changes in the settings of the system over time, allowing careful scrutiny of the output. Using this function to pull a process summary every 5 seconds, users could run:

C:\> wmic process list brief /every:1

Hitting CTRL+C will stop the cycle.

More good examples here

HOW DO U FIND IF YOUR PC IS HACKED?- PART 1

1.   We all keep ourselves worried over issues pertaining to our PC security including issues like if or not it is a zombie or if the same is already a compromised one etc. But how would you find the answer to these......call an expert and pay from your pocket? NO....the answer is MS it self...yesss!!....Microsoft Windows has a series of commands with the help of which a normal PC user would be able to find out the answers.....

2.   Following are the list of commands which would be used

WMIC Command

            - C:\> wmic process

            - C:\> wmic process list brief

- C:\> wmic process list full

- C:\> wmic startup list full

- C:\> wmic QFE list full

- C:\> wmic process list brief /every:1

The net Command

-         net localgroup

-         net localgroup administrators

Openfiles Command

          - C:\> openfiles /local on

Netstat Command

-         C:\> netstat –nao

-         C:\> netstat -s -p icmp

-         C:\> netstat -na 2

Find Command

For more details on these commands...click here....

IE users stand vulnerable again : Warning from MICROSOFT

1. This one is a real eye (....or more simply account) opener of so many IE Web browser users across the globe and this one comes straight from the horses mouth....ie MICROSOFT which has warned that the approx 900 million users of its Internet Explorer Web browser are at risk of having their computers commandeered and their personal information stolen by hackers.Microsoft has issued a 'critical' security alert over a newly-disclosed flaw that impacts all versions of the company's Windows operating system, including Windows XP (SP3), Windows Vista, Windows 7, Windows Server 2003 and Windows Server 2008 (R2).

2. The trouble is meant primarily for users of IE only since no other major web browser available supports MHTML files.Microsoft also adds that the bug is inside Windows, (else who is going to use IE??????).Till date/hr as of now no hackers have been reported to exploit the vulnerability. 

3. An attacker could construct an HTML link designed to trigger a malicious script and somehow convince the targeted user to click it. When the user clicks that link, the malicious script would run on the user's computer for the rest of the current Internet Explorer session.Such a script might collect user information (e.g. email), spoof content displayed in the browser, or otherwise interfere with the user's experience.

4. For the otherwise already loosing users at a quick pace,this release would pacen up the loosing percentage of IE users across.

5.   Thanks http://www.smh.com.au

Adobe flash Player hit!!!!

1.    A critical vulnerability has been exposed in Adobe Acrobat 9.4 and earlier 9.x versions for Windows and Macintosh operating systems & Adobe Flash Player 10.1.85.3 and prior versions for Windows, Macintosh, Linux and Solaris operating systems; Adobe Flash Player 10.1.95.2 and earlier versions for Android; and the authplay.dll component .

2.   This exploit (CVE-2010-3654) could cause a crash and provision attacker into the drivers seat to take control of the affected system. 

3.   Adobe has released recommendations of how to avoid becoming a target on the subject matter but is still working in labs to find a fix.....click here for more

TABNAPPING : A new generation Cyber Crime

1. Another new term in the cyber crime is "Tabnapping" a combination of "tab" and "kidnapping" that could be used by phishers to dupe users into giving up passwords by secretly changing already-open browser tabs. All browsers on Windows and Mac OS X are vulnerable.It is thus a computer exploit,a kind of phishing attack, which persuades users to submit their login details and passwords to popular Web sites by impersonating those sites and convincing the user that the site is genuine. Eg . An open tab of Facebook for instance may be a false window. But very few of us may notice. As a result, we readily log in our username and password when prompted, only to fall to phishers.

2. Aza Raskin is the person behind coining this term,this 1984 born genius is an active phishing researcher.It is unlikely that Browser makers will patch this up soon the risk does not emanate from security vulnerabilities per se.

3. However, every major browser has a filter of some kind designed to weed out malicious sites and sites suspected of being infected with attack code. Those filters, assuming the blacklists underlying them are current and accurate, would block tabnapping attacks.

4. Thanks http://www.standardmedia.co.ke & http://www.couponsherpa.com

Windows Systernals

1. I had not heard and read about this very low key but very powerful utility site which helps one manage, troubleshoot and diagnose Windows systems and applications incl so many unheard functions and utilities that one can go on and on exploring all.....the complete Windows systernals Suite can be downloaded by clicking here.

2. Another related site named Sysinternals Live is a service that enables to execute Sysinternals tools directly from the Web without hunting for and manually downloading them.

3. Must see and must try site.....click here to hit direct.

Augment your regular desktop with a FACE RECOGNITION feature

1. Face recognition technology although has been compromised earlier on various times and occasions which have been mentioned at this blog here,here and here.But again things are improving with more complex algorithms being used for processing and allowing a person to Log In.Now suppose an online exam is being conducted which requires students to login with their accounts; anybody could login with anybody’s account as long as they knew their username and password.So for regular window OS users,Luxand Blink allows an alternative to traditional Windows login and a solution to problems. It provides its users with a different way to login to Windows: through Facial Recognition.

2. Luxand Blink is a free application comptable with 32 bit version of Windows Vista and Windows 7. The download size of the application is 8MB and installs in a standard way. A webcam is required to be installed in the computer...(did I need to tell that?)

3. So just look into a webcam for a moment, and you’ll be logged into your account before you notice. Blink! employs advanced face recognition technologies to provide automatic, quick and reliable login to one or many computer users. It uses its advance image recognition algorithms to recognize our face. Such is the competence of this application, that whether the lighting is different or our hair are different, Luxand Blink will still recognize our face and log us in.So a regular old desktop becomes ready with the FACE RECOGNITION feature.

4. Thanks http://www.luxand.com/blink/

SVCHOST.EXE vs SCVHOST.EXE

1. Two approximately similar names but with poles apart function and reason to exist.If ever you have tried cleaning or accessing an infected pen drive you must have come across these names in the file names list.I would just try and make the difference clear in brief below.

2. SCVHOST.EXE is a process which is registered as W32/Agobot-S virus. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

3. SVCHOST.EXE is located in the System32 folder and is an built-in part of Windows OS. It cannot be stopped or restarted manually. This process manages 32-bit DLLs and other services. At startup, Svchost.exe checks the services portion of the registry and constructs a list of services that it needs to load. Under normal conditions, multiple instances of Svchost.exe will be running simultaneously. Each Svchost.exe session can contain a grouping of services, so that many services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.

4. I hope this amply makes the difference clear