Advocate (Dr.) Prashant Mali's Blog

How NSA Allegedly Hacks into your Network ? The United States' National Security Agency succeeded years ago in penetrating the company's digital firewalls. An NSA division called ANT has burrowed its way into nearly all the security architecture made by the major players in the industry -- including American global market leader Cisco and its Chinese competitor Huawei, but also producers of mass-market goods, such as US computer-maker Dell. The specialists at ANT, which presumably stands for Advanced or Access Network Technology, could be described as master carpenters for the NSA's department for Tailored Access Operations (TAO). In cases where TAO's usual hacking and data-skimming methods don't suffice, ANT workers step in with their special tools, penetrating networking equipment, monitoring mobile phones and computers and diverting or even modifying data. Such "implants," as they are referred to in NSA parlance, have played a considerable role

Court in EU Backs 'Right to be Forgotten' European Union   Internet users now can ask Google and other search engines to remove certain sensitive information from Internet search results, Europe's highest court ruled on May 13,2014. The ruling, handed down by the  Court of Justice of the European Union , states the "operator of the search engine ... is, in certain circumstances, obliged to remove links to Web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person's name." The court's ruling on the "right to be forgotten" stems from a case involving a man in Spain who argued that Google's search results disclosed details about the auction of his repossessed home over unpaid debts. "[The man] stated that the proceedings concerning him had been fully resolved for a number of years and that reference to them was now

DDoS Analysis for 2014 DDoS attacks are evolving in complex, dangerous ways. Companies assessing their risk and protection  should consider: • Nearly twice as many companies (60 percent) report being attacked in 2013. • Almost 92 percent of those attacked were hit repeatedly. • 57% of DDoS targets were victims of theft: funds, customer data or intellectual property. • Though attack duration is down, the number of attacks between 1–5 Gbps shot up nearly three times. • DDoS drains manpower: over half of businesses (57 percent) need 6 or more people to mitigate DDoS attacks. • Risks of $1M a day (estimated outage losses) are common: 4 in 10 companies would suffer this much or more. • DDoS is costly across the enterprise. Customer service and other public-facing areas now take as  large a hit as IT/Security. In protecting against DDoS attacks, companies must ask: What do they stand to lose if they’re hit hard? Rigorous risk, threat and cost analysis is in order.  Predicting DDoS

2014 Internet Security Threat Report Highlights from the 2014 Internet Security Threat Report Key Findings 91% increase in targeted attacks campaigns in 2013 62% increase in the number of breaches in 2013 Over 552M identities were exposed via breaches in 2013 23 zero-day vulnerabilities discovered 38% of mobile users have experienced mobile cybercrime in past 12 months Spam volume dropped to 66% of all email traffic 1 in 392 emails contain a phishing attacks Web-based attacks are up 23% 1 in 8 legitimate websites have a critical vulnerability

Citadel : The Banking Trojan wanna buy one .. Citadel  is a banking trojan based on the Zeus source code. A few months after the Zeus source code was leaked, a threat actor using the moniker "AquaBox" was observed on a Russian-language eCrime forum offering Citadel 1.1, a new derivative of Zeus malware. Citadel retained basic Zeus functionality but added modifications to improve the functionality and security of this banking trojan. Citadel developed a community of customers and contributors around the globe that suggested new features and contributed code and modules as part of an ad hoc criminal social network. Capabilities included AES encryption of configuration files and communications with the C2 server, an ability to evade tracking sites, the capacity to block access to security sites on victims' systems, and the ability to record videos of victims' activities. The network of Citadel contributors continued adding innovative features to the trojan, makin

Cyber Weapon : Duqu I have been analyzing an  malware threat identified as the Duqu trojan. This Trojan horse has received a great deal of attention because it is similar to the infamous Stuxnet worm of 2010. I had put countermeasures in place  to detect Duqu C2 traffic, and they continue to monitor for new Duqu samples and update protections as needed. What is Duqu? The Duqu trojan is composed of several malicious files that work together for a malicious purpose. The first component is a Windows kernel driver that searches for and loads encrypted dynamic link library (DLL) files. The decrypted DLL files implement the main payload of Duqu, which is a remote access trojan (RAT). The RAT allows an adversary to gather information from a compromised computer and to download and run additional programs. In addition to the RAT, another piece of malware was recovered with Duqu in one instance. This malware is an information stealer designed to log user keystrokes and other informati

Evaluate Your Cyber Security Strategy with focus on DDoS & APT’s The Cyber Law Consulting Team(CLC) has observed cyber threats becoming more advanced as hackers seek new ways to breach information security or disrupt operations. Distributed Denial of Service (DDoS) attacks and Advanced Persistent Threats (APTs) are a big concern. Organizations must evaluate and develop their IT security controls to protect themselves from these sophisticated and unpredictable cyber-attacks. DDoS Attacks and DoS Attacks In a  Denial of Service attack , hackers try to disrupt a website, network or machine. The goal may be solely to prevent people from connecting to the website that is being attacked, but a Distributed Denial of Service (DDoS) attack is often used to distract a business so attackers can conduct other attacks behind the scenes while the business is focused on getting its website back up. Many times, hackers conduct a DDoS test-run on an organization to see whether it is susc