PRACTICAL FILE OF

PROGRAMMING IN
INFORMATION SECURITY
(LAB)

SUBMITTED BY – ROHAN SINGH NEGI

CLASS - BCA 6
ROLL NO – 2212005
SUBMITTED TO : MRS. AMANPREET KAUR

GURU NANAK INSTITUTE OF MANAGEMENT ANDTECHNOLOGY,

MODEL TOWN, LUDHIANA
 Table of Contents
[Link] Experiments Page no.

1 Study of System threat attacks - Denial of 2

Services

2 Study of Sniffing and Spoofing attacks. 6

3 Study of Techniques uses for Web Based 11

Password Capturing.

4 Study of Different attacks causes by Virus and 16

Trojans.

5 Study of Anti-Intrusion Technique – Honey pot 21

6 Study of Symmetric Encryption Scheme – RC4 30

7 Implementation of S-DES algorithm for data 34

encryption

8 Implementation of Asymmetric Encryption 40

Scheme – RSA
9 Study of IP based Authentication 43

10 Study of Cryptography Techniques 45

11 Study of Encryption algorithms 49

12 Study of Security polices 56

13 Study of Network Security Fundamentals, Ethical 62

Hacking and Social Engineering

1
  Denial of Service Attack

A denial-of-service (DoS) attack is a type of cyber attack in which a

malicious actor aims to render a computer or other device unavailable to
its intended users by interrupting the device's normal functioning. DoS
attacks typically function by overwhelming or flooding a targeted machine
with requests until normal traffic is unable to be processed, resulting in
denial-of-service to addition users. A DoS attack is characterized by using
a single computer to launch the attack.

A distributed denial-of-service (DDoS) attack is a type of DoS attack that

comes from many distributed sources, such as a botnet DDoS attack.

The primary focus of a DoS attack is to oversaturate the capacity of a

targeted machine, resulting in denial-of-service to additional requests.
The multiple attack vectors of DoS attacks can be grouped by their
similarities.

2
DoS attacks typically fall in 2 categories:

Buffer overflow attacks

An attack type in which a memory buffer overflow can cause a machine to
consume all available hard disk space, memory, or CPU time. This form of
exploit often results in sluggish behavior, system crashes, or other
deleterious server behaviors, resulting in denial-of-service.

Flood attacks
By saturating a targeted server with an overwhelming amount of packets,
a malicious actor is able to oversaturate server capacity, resulting in
denial-of-service. In order for most DoS flood attacks to be successful,
the malicious actor must have more available bandwidth than the target.

Method to perform a DoS Attack:

Tool used: XERXES

Step 1: Clone the tool’s repository by searching it on GitHub, and use the
following command:
𝑔𝑖𝑡 𝑐𝑙𝑜𝑛𝑒 < 𝑆𝐼𝑇𝐸 >
In our case it is:
git clone [Link]

Step 2: Go into the cloned directory by

𝑐𝑑 𝑋𝐸𝑅𝑋𝐸𝑆

3
Step 3: Elevate the permissions of the executable file in 𝑝𝑤𝑑 by typing:
𝑐ℎ𝑚𝑜𝑑 𝑢 + 𝑥 𝑥𝑒𝑟𝑥𝑒𝑠

Step 4: Find the IP of the target website by using the 𝑑𝑖𝑔 command

As we can see the IP of [Link] is [Link].

Step 5: Use the above IP to crash the victim website with the following
syntax:
𝑥𝑒𝑟𝑥𝑒𝑠 < 𝐼𝑃 > < 𝑃𝑂𝑅𝑇 >
Generally, we use port 80, as it is the default for the HTTP protocol, like
this
./𝑥𝑒𝑟𝑥𝑒𝑠 [Link] 80
Time to crash the website

4
Output:

5
  Study of Sniffing and Spoofing attacks

What is Sniffing?

Sniffing is the technique of continuously monitoring and recording all data

packets that transit via a network. Network or system administrators
employ sniffers to monitor and troubleshoot network traffic. Hackers use
sniffers to capture data packets containing sensitive data such as
passwords and account information. Attackers install sniffers as hardware
or software in the system.

Types of Sniffing Attacks

Let us discuss the different types of Sniffing attacks.

Active Sniffing
Active Sniffing is sniffing in the switch. It is a network device that
connects two points. This switch monitors the MAC addresses on each
port, which ensures that data is passed only to the appropriate
destination. To sniff the traffic between targets, sniffers must actively
inject traffic into the LAN. There are several ways to accomplish this.

Passive Sniffing
The process of Sniffing through the hub is called passive Sniffing. All
machines on an un-bridged or non-switched network segment will be able
to see any traffic passing through it. They operate on the data link layer
of the network. A hacker transmits a network packet across the LAN,
where it reaches every machine connected to it. Attackers can passively
capture data by sending sniffers.
Active Sniffing involves infesting the switch content address memory
(CAM) table with address resolution protocols (ARPs). Consequently, the
attacker sniffs data from the switch by redirecting legitimate traffic to
other ports. There are several active Sniffing techniques, including
Spoofing, DHCP, and DNS poisoning.
Since we have understood Sniffing in detail, let us have a look at
Spoofing.

6
What is Spoofing?

Using a spoof to represent a communication coming from a known and

trusted source is Spoofing. It can be as simple as email Spoofing, phone
Spoofing, website Spoofing, or more technical such as a computer
Spoofing an IP address, ARP, or DNS server.

The purpose of a Spoofing attack is to gain access to sensitive data or

information by posing as a trustworthy source. Spamming can be done
through websites, emails, phone calls, texts, IP addresses, and servers.

Different Types of Spoofing Attacks

The different types of Spoofing attacks are listed here –

Caller ID Spoofing
Spoofing takes place when the caller ID is changed by using false
information. To hide their identity, phone scammers use Caller ID
Spoofing to make it impossible to block a number. In some cases,
scammers will use your area code to disguise the call as being local.
Scammers often use Voice over Internet Protocol (VoIP) to spoof caller ID
by creating fake phone numbers and names. Scammers will attempt to
get vital information from the call recipient, once they answer the phone.

Email Spoofing

Scammers use fake sender addresses to harm your computer, steal your
information, or infect your computer with malware through email
Spoofing. Such emails look like they came from a friend or co-worker.
This is so that you can be fooled into thinking that the emails are legit.

Using alternative numbers or letters to look slightly different from the

original will get you this result, or disguising the “from” field to become an
address that belongs to someone in your contact list.

Website Spoofing
Scammers use legitimate fonts, colors, and logos to make a dangerous
website appear to be a secure one. Scammers replicate a trusted website
so that users visit a phishing or malicious site. Most of these copied sites

7
look authentic at first glance due to the similar website addresses.
Nevertheless, their primary purpose is to gather visitor information.
DNS Server Spoofing
DNS Spoofing, also known as cache poisoning, is the process of rerouting
traffic to a different IP address. Malicious websites will be redirected to
this page. Scammers do this by replacing the DNS server’s IP addresses
with their own.

GPS Spoofing

A GPS Spoofing attack occurs when fake signals resemble real signals and
are broadcast to fool GPS receivers. Essentially, scammers pretend to be
in one place, while, in reality, being in another place.
Scammers use this type of attack to interfere with GPS signals of ships,
buildings, or aircrafts such as to drive them to wrong addresses. Apps
that rely on the location data from a smartphone are potentially
vulnerable to this type of attack.

ARP Spoofing
ARP Spoofing is to manipulate and steal data as well as hijack sessions.
As a result, spammers will connect their media access control to the IP
address to access the data belonging to the owner of that address.

Man-in-the-Middle (MitM) attack

MitM attacks occur when scammers hack a Wi-Fi network or create an
identical counterfeit network to intercept web traffic between two parties.
This allows scammers to reroute credit card numbers or login information
to themselves.

Text Message Spoofing

The practice of Spoofing texts occurs when scammers use another
person’s phone number to send a text message. Scammers use alpha-
numeric sender IDs to mask their identity, and they normally link to
phishing or malware downloads. Make sure that you are familiar with
mobile security tips, if you fear your data is being compromised.

8
Extension Spoofing

Extension Spoofing is used by scammers to mask malware extension

folders. These hacker files are often renamed as [Link], and
have malware hidden inside. The malicious program that runs when a file
appears to be a text document is a text document.
Our blog on Cyber Security Interview Questions will help you if you are
preparing for Cyber Security Interview questions.

Now, let us understand the difference between Sniffing and Spoofing.

Difference Between Sniffing and Spoofing

 Sniffing takes place when an attacker collects data packets that

pass over a network by utilizing packet sniffers and data traffic in
the network.
 In contrast to Sniffing, Spoofing happens when an attacker steals a
user’s rights and uses them to acquire legitimate user access to a
system to execute attacks against network hosts, steal data,
distribute malware, or evade access controls.
 Spoofing is when an attacker creates TCP/IP using another person’s
IP address. A sniffer software is placed between two interactive
endpoints in packet Sniffing, where the attacker pretends to be one
end of the connection to the target and snoops on data sent
between the two points.

Comparing IP Sniffing and IP Spoofing

To understand what is IP Sniffing and IP Spoofing, it is first necessary to
understand what these terms mean. The attacker manipulates authorized
readers to acquire valuable information by falsifying them, so as to scan
legal tags. Attackers who spoof a system appear to be authorized and
official operators.
Spoofing attacks are duplicating factors because the system’s authorized
users perform the same action. As opposed to counterfeiting or Sniffing,
Spoofing methods are distinct from these other types of attacks. First, let
us define packet Sniffing and packet Spoofing before learning their
differences:
A packet sniffer is a software or method for capturing network packets
without changing them in any manner.

9
In simple terms, packet Sniffing is listening in on other people’s
communications. Packet Spoofing is the dynamic presentation of fake
network traffic that impersonates someone else.

Packet Sniffing is a passive attack since attackers cannot mutilate the

system in any way. In packet Spoofing, stackers inject malicious software
into the victim’s system.
Attackers get access to the device or system that directs traffic in the
packet and carry out packet Spoofing attacks by sending packets with
false source addresses, i.e., changing routing tables.
Encryption is a common technique that is used to fight against Sniffing,
while digital signatures are the most effective means to combat Spoofing.
Discover more about Cyber Security by looking at our Cyber Security
Tutorial blog!

Protection Against Sniffing and Spoofing

The development of technology brings more and more new cyber threats,
so staying informed about the protection measures is imperative to be
able to combat and defend against illegal hackers. We have listed a few
points that you can follow to keep your devices safe from hackers.

Sniffing
 Set up a strong antivirus on your device
 Secure your data with a VPN
 Avoid visiting unencrypted websites
 Avoid using public Wi-Fi
 Do not use unencrypted messaging apps

Spoofing

 Implement packet filtering with deep packet inspection

 Verify the authenticity of users and systems
 Use Spoofing detection software
 Implement encrypted and authenticated protocols

10
 Study of Techniques uses for Web Based Password
Capturing.

1. Phishing
Phishing is when a hacker posing as a trustworthy party sends you a
fraudulent email, hoping you will reveal your personal information
voluntarily. Sometimes they lead you to fake "reset your password"
screens; other times, the links install malicious code on your device. We
highlight several examples on the OneLogin blog.

Here are a few examples of phishing:

 Regular phishing. You get an email from what looks like

[Link] asking you to reset your password, but you didn't
read closely and it's actually [Link]. You "reset your
password" and the hacker steals your credentials.
 Spear phishing. A hacker targets you specifically with an email that
appears to be from a friend, colleague, or associate. It has a brief,
generic blurb ("Check out the invoice I attached and let me know if
it makes sense.") and hopes you click on the malicious attachment.
 Smishing and vishing. You receive a text message (SMS phishing,
or smishing) or phone call (voice phishing, or vishing) from a hacker
who informs you that your account has been frozen or that fraud
has been detected. You enter your account information and the
hacker steals it.
 Whaling. You or your organization receive an email purportedly
from a senior figure in your company. You don't do your homework
on the email's veracity and send sensitive information to a hacker.
To avoid phishing attacks, follow these steps:

 Check who sent the email: look at the From: line in every email to
ensure that the person they claim to be matches the email address
you're expecting.
 Double check with the source: when in doubt, contact the person
who the email is from and ensure that they were the sender.
 Check in with your IT team: your organization's IT department can
often tell you if the email you received is legitimate.

11
2. Man-in-the-Middle Attack

Man-in-the middle (MitM) attacks are when a hacker or compromised

system sits in between two uncompromised people or systems and
deciphers the information they're passing to each other, including
passwords. If Alice and Bob are passing notes in class, but Jeremy has to
relay those notes, Jeremy has the opportunity to be the man in the
middle. Similarly, in 2017, Equifax removed its apps from the App Store
and Google Play store because they were passing sensitive data over
insecure channels where hackers could have stolen customer information.

To help prevent man-in-the-middle attacks:

 Enable encryption on your router. If your modem and router can be

accessed by anyone off the street, they can use "sniffer" technology to
see the information that is passed through it.
 Use strong credentials and two-factor authentication. Many router
credentials are never changed from the default username and
password. If a hacker gets access to your router administration, they
can redirect all your traffic to their hacked servers.
 Use a VPN. A secure virtual private network (VPN) will help prevent
man-in-the-middle attacks by ensuring that all the servers you send
data to are trusted.

12
 3. Brute Force Attack
If a password is equivalent to using a key to open a door, a brute force
attack is using a battering ram. A hacker can try 2.18 trillion
password/username combinations in 22 seconds, and if your password
is simple, your account could be in the crosshairs.

To help prevent brute force attacks:

 Use a complex password. The difference between an all-lowercase, all-

alphabetic, six-digit password and a mixed case, mixed-character, ten-
digit password is enormous. As your password's complexity increases,
the chance of a successful brute force attack decreases.
 Enable and configure remote access. Ask your IT department if your
company uses remote access management. An access management
tool like OneLogin will mitigate the risk of a brute-force attack.
 Require multi-factor authentication. If multi-factor authentication
(MFA) is enabled on your account, a potential hacker can only send a
request to your second factor for access to your account. Hackers
likely won't have access to your mobile device or thumbprint, which
means they'll be locked out of your account.

4. Dictionary Attack
A type of brute force attack, dictionary attacks rely on our habit of
picking "basic" words as our password, the most common of which
hackers have collated into "cracking dictionaries." More sophisticated
dictionary attacks incorporate words that are personally important to
you, like a birthplace, child's name, or pet's name.

To help prevent a dictionary attack:

 Never use a dictionary word as a password. If you've read it in a book,

it should never be part of your password. If you must use a password
instead of an access management tool, consider using a password
management system.
 Lock accounts after too many password failures. It can be frustrating
to be locked out of your account when you briefly forget a password,
but the alternative is often account insecurity. Give yourself five or
fewer tries before your application tells you to cool down.

13
 Consider investing in a password manager. Password managers
automatically generate complex passwords that help prevent dictionary
attacks.

5. Credential Stuffing
If you've suffered a hack in the past, you know that your old
passwords were likely leaked onto a disreputable website. Credential
stuffing takes advantage of accounts that never had their passwords
changed after an account break-in. Hackers will try various
combinations of former usernames and passwords, hoping the victim
never changed them.

To help prevent credential stuffing:

 Monitor your accounts. There are paid services that will monitor your
online identities, but you can also use free services like
[Link] to check whether your email address is
connected to any recent leaks.
 Regularly change your passwords. The longer one password goes
unchanged, the more likely it is that a hacker will find a way to crack
it.
 Use a password manager. Like a dictionary attack, many credential
stuffing attacks can be avoided by having a strong and secure
password. A password manager helps maintain those.

6. Keyloggers
Keyloggers are a type of malicious software designed to track every
keystroke and report it back to a hacker. Typically, a user will
download the software believing it to be legitimate, only for it to install
a keylogger without notice.

14
 To protect yourself from keyloggers:
 Check your physical hardware. If someone has access to your
workstation, they can install a hardware keylogger to collect
information about your keystrokes. Regularly inspect your computer
and the surrounding area to make sure you know each piece of
hardware.
 Run a virus scan. Use a reputable antivirus software to scan your
computer on a regular basis. Antivirus companies keep their records of
the most common malware keyloggers and will flag them as
dangerous.

Preventing Password Attacks

The best way to fix a password attack is to avoid one in the first place.
Ask your IT professional about proactively investing in a common security
policy that includes:
 Multi-factor authentication. Using a physical token (like a Yubikey) or a
personal device (like a mobile phone) to authenticate users ensures
that passwords are not the sole gate to access.
 Remote access. Using a smart remote access platform like OneLogin
means that individual websites are no longer the source of user trust.
Instead, OneLogin ensures that the user's identity is confirmed, then
logs them in.
 Biometrics. A malicious actor will find it very difficult to replicate your
fingerprint or facial shape. Enabling biometric authentication turns your
password into only one of several points of trust that a hacker needs to
overcome.

15
 Study of Different attacks causes by Virus and Trojans.
Trojans are deceptive programs that appear to perform one function, but
in fact perform another, malicious function. They might be disguised as
free software, videos or music, or seemingly legitimate advertisements.

The term “trojan virus” is not technically accurate; according to most

definitions, trojans are not viruses. A virus is a program that spreads by
attaching itself to other software, while a trojan spreads by pretending to
be useful software or content. Many experts consider spyware programs,
which track user activity and send logs or data back to the attacker, as a
type of trojan.

Trojans can act as standalone tools for attackers, or can be a platform for
other malicious activity. For example, trojan downloaders are used by
attackers to deliver future payloads to a victim’s device. Trojan rootkits
can be used to establish a persistent presence on a user’s device or a
corporate network.

Trojan Infection Methods

Here are common ways trojans can infect computers in your corporate
network:

 A user is targeted by phishing or other types of social engineering,

opens an infected email attachment or clicks a link to a malicious
website
 A user visits a malicious website and experiences a drive-by
download pretending to be useful software, or is prompted to
download a codec to play a video or audio stream
 A user visits a legitimate website infected with malicious code (for
example, malvertising or cross-site scripting)
 A user downloads a program whose publisher is unknown or
unauthorized by organizational security policies
 Attackers install a trojan by exploiting a software vulnerability, or
through unauthorized access

16
“Daserf” Trojan created by the cyber-espionage group REDBALDKNIGHT
is often installed through the use of decoy documents attached in emails.

Types of Trojans

The first trojan was seen in the wild was ANIMAL, released in 1975. Since
then, many millions of trojan variants have emerged, which may be
classified into many types. Here are some of the most common types.

Downloader Trojan

A downloader trojan downloads and deploy other malicious code, such as

rootkits, ransomware or keyloggers. Many types of ransomware distribute
themselves via a “dropper”, a downloader trojan that installs on a user’s
computer and deploys other malware components.

A dropper is often the first stage in a multi-phase trojan attack, followed

by the installation of another type of trojan that provides attackers with a
persistent foothold in an internal system. For example, a dropper can be
used to inject a backdoor trojan into a sensitive server.

17
Backdoor Trojan

A backdoor trojan opens up a secret communication tunnel, allowing the

local malware deployment to communicate with an attacker’s Command &
Control center. It may allow hackers to control the device, monitor or
steal data, and deploy other software.

Spyware

Spyware is software that observes user activities, collecting sensitive data

like account credentials or banking details. They send this data back to
the attacker. Spyware is typically disguised as useful software, so it is
generally considered as a type of trojan.

Rootkit Trojans

Rootkit trojans acquire root-level or administrative access to a machine,

and boots together with the operating system, or even before the
operating system. This makes them very difficult to detect and remove.

DDoS Attack Trojan (Botnet)

A DDoS trojan turns the victim’s device into a zombie participating in a

larger botnet. The attacker’s objective is to harvest as many machines as
possible and use them for malicious purposes without the knowledge of
the device owners—typically to flood servers with fake traffic as part of
a Distributed Denial of Service (DoS) attack.

Trojan Horse Malware Examples

Following are some of the fastest-spreading and most dangerous trojan

families.

Zeus

Zeus/Zbot is a malware package operating in a client/server model, with

deployed instances calling back home to the Zeus Command & Control
(C&C) center. It is estimated to have infected over 3.6 million computers
in the USA, including machines owned by NASA, Bank of America and the
US Department of Transportation.

18
Zeus infects Windows computers, and sends confidential data from the
victim’s computer to the Zeus server. It is particularly effective at stealing
credentials, banking details and other financial information and transmit
them to the attackers.

The weak point of the Zeus system is the single C&C server, which was a
primary target for law enforcement agencies. Later versions of Zeus
added a domain generation algorithm (GDA), which lets Zbots connect to
a list of alternative domain names if the Zeus server is not available.

Zeus has many variants, including:

 Zeus Gameover—a peer-to-peer version of the Zeus botnet

without a centralized C&C.
 SpyEye—designed to steal money from online bank accounts.
 Ice IX—financial malware that can control content in a browser
during a financial transaction, and extract credentials and private
data from forms.
 Citadel—an open-source variant of Zeus that has been worked on
and improved by a community of cybercriminals, and was
succeeded by Atmos.
 Carberp—one of the most widely spread financial malware in
Russia. Can exploit operating system vulnerabilities to gain root
access to target systems.
 Shylock—uses a domain generation algorithm (DGA), used to
receive commands from a large number of malicious servers.

ILOVEYOU

ILOVEYOU (commonly referred to as the “ILOVEYOU virus”) was a trojan

released in 2000, which was used in the world’s most
damaging cyberattack, which caused $8.7 billion in global losses.

The trojan was distributed as a phishing email, with the text “Kindly check
the attached love letter coming from me”, with an attachment named
“ILOVEYOU” that appeared to be a text file. Recipients who were curious
enough to open the attachment became infected, the trojan would
overwrite files on the machine and then send itself to their entire contact
list. This simple but effective propagation method caused the virus to
spread to millions of computers.

19
Cryptolocker

Cryptolocker is a common form of ransomware. It distributes itself using

infected email attachments; a common message contains an infected
password-protected ZIP file, with the password contained in the message.
When the user opens the ZIP using the password and clicks the attached
PDF, the trojan is activated. It searches for files to encrypt on local drives
and mapped network drives, and encrypts the files using asymmetric
encryption with 1024 or 2048-bit keys. The attackers then demand a
ransom to release the files.

Stuxnet

Stuxnet was a specialized Windows Trojan designed to attack Industrial

Control Systems (ICS). It was allegedly used to attack Iran’s nuclear
facilities. The virus caused operator monitors to show business as usual,
while it changed the speed of Iranian centrifuges, causing them to spin
too long and too quickly, and destroying the equipment.

20
 Study of Anti-Intrusion Technique – Honey pot

When we talk about security, we often talk about how to keep

cybercriminals away from your network. With honeypot traps, security
practitioners achieve the opposite. But what is a honeypot? A honeypot is
an open or otherwise intentionally vulnerable decoy technology that’s
designed to misdirect cyber-attacks from critical IT systems. It does this
by mimicking those very systems and by providing fabricated files and
data.

Moreover, a honeypot is a computer system that helps IT security pros

observe and learn from cybercriminals’ attacks by observing them in real
time. Basically, it helps organizations detect unauthorized use or access
to systems. It also helps them gain crucial information about attackers
and how they operate. Of course, all of this occurs with the intruder being
none the wiser about what’s really happening. It may comprise of several
components such as:

 Network devices,
 Keyloggers,
 Monitoring tools,
 Packet analysers, and
 Alerting tools.

What Honeypots Do

In a nutshell, honeypots help organizations:

 Assess the latest trends in attacks,

 Understand where cyber attacks arise, and
 Better frame security policies to mitigate future risks.

This deceptive technology can be hardware-based (like an appliance) or

software-based virtual honeypots that can scale and be set up to emulate
a legitimate network.

How Honeypots Work

Honeypots are a way for organizations and businesses to detect, deflect

and fight back against cybercriminals who desire unauthorized access.
Honeypot traps lure bad guys into attacking these fake networks, servers,
or other devices because they contain applications and data similar to
legitimate targets.

Ever watch Shark Week on the Discovery Channel? Marine biologists and
other scientists use chum and bait to lure sharks into attacking decoys

21
while they record it with video, pressure sensors, and speed-monitoring
technologies. This is part of their research to learn more about sharks by
observing their hunting methods and attack tactics as they occur.
Honeypots are much the same — just for cyber attacks instead of shark
attacks.

But wouldn’t a hacker realize that they’re attacking a fake system? Not
necessarily. Honeypots are designed to appear like legitimate systems. In
fact, they typically contain a variety of fake data to make them seem
legitimate. So, when bad guys attack, their efforts appear successful on
their end. This keeps them on your system longer so you can log and
record more information about their attack.

What Is a Honeypot vs Honeynet

A network of honeypots (honeynet) can be placed in different positions,

for example — outside the external firewall, in the DMZ, or within the
internal network. A honeynet has servers, networking devices, and
systems that are similar to a legitimate network with fake data. Since the
purpose is to lure attackers into exploiting intentionally vulnerable
systems to monitor and study their activities, placing a honeynet on the
internal network is risky business unless the attack can be trapped within
it.

A simplified illustrative example of a network that contains a honeynet.

However, since more than 75% of security incidents occur due to insider
threats, installing a honeypot with proper configurations to monitor user
behavior on the internal network is often worth the risk. A honeypot on
the internal network can detect misconfigured firewall settings and be

22
useful in detecting zero-day exploits. All in all, installing honeypots can
strengthen your organization’s network security posture significantly.

What Are the Different Types of Honeypots?

Honeypots are typically categorized in one of two ways — either based on

their interaction levels or the types of threats they’re able to detect. We’ll
first take a quick look at the different types of honeypots based on their
interactivity levels before moving on to talk about honeypots based on
their purpose.

Types of Honeypots Based on Interaction Level and Complexity

Interaction levels define the hacker’s degree of interactivity with the

systems that they’re attempting to infiltrate. “Pure” honeypots mimic the
full-scale production environment and run on servers with live, faux
“sensitive” data. They’re the most complex honeypot systems to deploy
and are challenging to maintain. Some other options include:

High-Interaction Honeypots

These honeypots imitate real-world systems and applications with actual

services, functions, and operating systems involving high levels of
interactivity (though less than pure honeypots). Setting up high-
interaction honeypots is a complex and resource-intensive process. It
gives extensive details about how an attack progresses and how payloads
execute in a network. However, since there are actual operating systems
and services involved, the chance of infection is higher if the hackers are
able to compromise the honeypots and use them gain access to your
organization’s real production environment.

Medium-Interaction Honeypots

As the name suggests, medium-interaction honeypots fall between high

and low interaction honeypots. They come with expanded capabilities
compared to low interaction honeypots but reduced implementation
complexities than high interaction honeypots. They imitate the application
layer but don’t have their own operating system. Organizations typically
deploy these types of honeypots to stall attackers to give them time to
respond to attacks.

Low-Interaction Honeypots

Low-interaction honeypots allow partial interaction with systems since

they run limited emulated services with restricted functionality as would
be typically expected from a server. Though these are the easiest to set
up and maintain, they run the risk of coming across as inauthentic targets
to potential attackers. These types of honeypots serve as an early

23
detection mechanism, and organizations commonly use them in
production environments.

Some Other Types of Honeypots

 Malware Honeypots — These types of honeypots detect malware

based on known replication techniques and propagation vectors.
 Database Honeypots — Since attacks on databases like SQL
injections are fairly common, you can use database honeypots to
distract an attacker from your legitimate database servers by
setting up decoy databases.
 Client Honeypots — These honeypots typically act as servers,
listening in for incoming connections. Client honeypots actively
engage with malicious servers that attack clients. They pose as a
client to monitor and record any modifications.
 Email Honeypots — Email honeypots are a list of email addresses
used by email service providers to detect spammers. Typically,
accounts inactive over a long period of time are used for this
purpose.
 Spider Honeypots — These honeypots are used to trap web-
crawlers by creating fake web pages and links only reachable by
crawlers. Detecting these crawlers can be useful in blocking bot
activity.

Types of Honeypots Based on Purpose

An illustrative example of a honeypot being targeted by attackers

24
What drives the need for setting up a honeynet in your environment?
There are different types of honeypots that serve different purposes. Do
you need insights to study attack methodologies for research purposes or
respond efficiently to active internal security threats? Or are you just
trying to thwart attackers from attacking their real targets?

Research Honeypots

These honeypots are deployed and used by researchers to gain a better

understanding of attack techniques, motivations, information about
malware strains in the wild, and security vulnerabilities. This is done to
specifically use the knowledge gained to make informed decisions about:

 Defense strategies,
 Patching prioritizations,
 Future security investments, and
 Identifying and developing new security solutions.

Production Honeypots

Production honeypots are placed within your organization’s internal

network with other production servers. Though the intention is similar in
terms of gaining insights about active attacks, it is typically less complex
than research honeypots with lesser data. It is primarily deployed to
identify active attacks on the internal network and distract or misdirect
hackers from attacking your legitimate servers.

Benefits of Honeypots

Placing a honeypot in your network doesn’t replace or fulfill the needs of

other traditional security controls such as intrusion detection systems
(IDS), intrusion prevention systems (IPS), firewalls, etc. Instead, it
complements the existing systems by providing highly specific
information. A honeypot:

 Distracts cybercriminals from targeting legitimate

systems. The more time and effort they spend on the honeypot,
the less they have to invest in attacking your organization’s real
network and systems.
 Gives you greater visibility of attacks as they’re
happening. Logs an attacker’s keystrokes during a session and
share instant alerts whenever there is an attempted access to the
system.
 Monitors an attacker’s behaviors and detect zero-day
vulnerabilities. An IDS/IPS, on the other hand, relies on already
published signatures to identify an attack.
 Puts your organization’s incident response capabilities to the
test. Does your team know how to take appropriate

25
 countermeasures to block the attacker’s access to legitimate
servers?
 Helps to improve your organization’s overall security. A
honeypot shines a light on the types of adversaries and attacks in
the wild so that you can formulate appropriate prevention
strategies.

Disadvantages of Honeypots

Though there are several benefits of using a honeypot, doing so doesn’t

come without risks. Some of them, like high-interaction honeypots, can
be resource intensive and difficult to maintain.

 Perhaps one of the primary downsides with using honeypots is that

it may introduce additional risks into your environment. A
compromised honeypot that’s not isolated effectively may be used
launch an attack on the real network.
 Another major drawback of using honeypots is that it can only
detect an intrusion when it is attacked directly. However, if an
attacker identifies the honeypot for what it is, they can evade the
system and infiltrate the network.
 Additionally, attackers may be able to fingerprint a honeypot (i.e.
identify honeypots) based on certain specific characteristics such as
misspelt error messages and so on. They can launch false attacks to
distract administrators and while the organization chases these
alerts, the attacker can focus on orchestrating a real attack.

How do you build a honeypot?

There are quite a few commercial and open source software tools
available that assist with honeypot deployment. Regardless of which one
an organization uses, there are four steps involved in setting up one of
these traps on an enterprise network. They are as follows:

1. Install the honeypot software

The first step in implementing a honeypot is to create the right
environment. Admins should choose honeypot software they want to
use, prepare the infrastructure for that software and install it. Virtual
servers and physical servers can host honeypots. When using a
physical server, it is important to take the following precautions to
ensure its secure:

 Don't use administrator accounts with access to important

systems. Use a different account.

26
  Don't store important data on the server, use decoy data
instead.
 Isolate the physical server from the rest of the network.
Virtual machines are safer because if they are compromised, they can
just be shut down quickly and recreated. If using a virtual server,
network admins will want to create one or a collection of virtual
machines using a hypervisor.
2. Configure firewall and logging policies
The next step in the installation process is to determine which events
the honeypot program will monitor. These can include login attempts,
file changes and other activity. Admins must set up an alternative
logging method, because hackers can change log files if they know
where to look for them. To prevent this, log files should be out of sight
and in a place hackers wouldn't think to look, such as in the Windows
logging tool or some other cloud logging services that store the
information outside of the honeypot.
The honeypot itself is placed outside the internal firewall, but inside of
the DMZ. The external firewall should be configured so that only the
ports necessary to access the honeypot are open, and all others are
closed. This approach will direct traffic toward the open network
where the honeypot is and not the internal network behind the
firewall.
3. Configure the honeypot
In contrast to the internal firewall, the honeypot is vulnerable. It
should have several ports open and invite attackers in. However,
admins should not open all the ports. Doing so will make it obvious to
attackers that they are not on a critical server, and they will leave, or
worse, they will manipulate the honeypot to their advantage.

27
4. Testing

Port scanners, such as Nmap and penetration testing tools, are useful
for testing a honeypot setup. Attackers will often undertake their own
port scan to look for vulnerabilities in a target network. Network
admins can use Nmap to see what attackers see when they are poking
around.

Next, admins should perform some activity inside the honeypot and
then review server logs to check that everything logged properly. For
example, if an IDS is running, it might automatically block a port scan
attempt and show that the port as unavailable, alerting the attacker
that the port is defended and encourage them to go elsewhere.

28
These issues should be fixed before putting a honeypot into
production. The honeypot must be able to lure attackers in and
capture as much information as possible, and any impediment to that
should be removed. After initial testing, put the honeypot into
production, monitor it closely and fine-tune the configuration.

29
 Study of Symmetric Encryption Scheme – RC4

RC4 means Rivest Cipher 4 invented by Ron Rivest in 1987 for RSA
Security. It is a Stream Ciphers. Stream Ciphers operate on a stream of
data byte by byte. RC4 stream cipher is one of the most widely used
stream ciphers because of its simplicity and speed of operation. It is a
variable key-size stream cipher with byte-oriented operations. It uses
either 64 bit or 128-bit key sizes. It is generally used in applications
such as Secure Socket Layer (SSL), Transport Layer Security (TLS), and
also used in IEEE 802.11 wireless LAN std.

Why Encryption Is Important?

Unauthorized data access can be prevented by encryption. If we perform

encryption then third parties can not have access to data which we share
or receive. The encryption is done by using a secret key, or we can say
that by using a public key and private key. Both sender and receiver are
having their public key and private key through which encryption of plain
text and decryption of ciphertext is performed.

History of RC4 Encryption

RC4 was designed by Ron Rivest in 1987. He was working under RSA
Security. Rivest Cipher 4 is an official name while it is also known as
Ron’s Code. Initially, RC4 was trade secret but once it’s code spread in
the public domain it was no more a trade secret. While Ron did not
reveal the RC4 algorithm until 2014 when he described the history of
RC4 in English Wikipedia.

Applications of RC4

RC4 is used in various applications such as WEP from 1997 and WPA
from 2003. We also find applications of RC4 in SSL from 1995 and it is a
successor of TLS from 1999. RC4 is used in varied applications because
of its simplicity, speed, and simplified implementation in both software
and hardware.

30
Types of RC4

There are various types of RC4 such as Spritz, RC4A, VMPC, and RC4A.
1. SPRITZ: Spritz can be used to build a cryptographic hash
function, a deterministic random bit generator (DRBG), n an
encryption algorithm that supports authenticated encryption
with associated data (AEAD).
2. RC4A: Souraduyti Paul and Bart Preneel have proposed an RC4
variant, which they call RC4A, which is stronger than RC4.
3. VMPC: VMPC is another variant of RC4 which stands for
Variably Modified Permutation Composition.
4. RC4A+: RC4A+ is a modified version of RC4 with a more
complex three-phase key schedule which takes about three
times as long as RC4 and a more complex output function which
performs four additional lookups in the S array for each byte
output, taking approximately 1.7 times as long as basic RC4.

Algorithm

The algorithm operates on a user-selected variable-length key(K) of 1 to

256 bytes (8 to 2048 bits), typically between 5 and 16 bytes. To
generate a 256-byte state vector S, the master key is used.
The first step is the array initialization. It is a character array of size 256
i.e. S[256]. After that, for every element of the array, we initialize S[i]
to i.
KSA is going to use the secret key to scramble this array. KSA is a
simple loop, in which we are having two variable i and j. We are using
these variables to rearrange the array. Rearranging the array is done by
using a secret key.

Code for KSA (Key Scheduling Algorithm ) :

std::array<char, 256> S;
std::ranges::iota(S, 0);
for (int i = 0; i < 256; ++i) {
int j = (i + S[i] + S[i % 256]) % 256;
std::swap(S[i], S[j]);
}

KSA has been scrambled, S[256] array is used to generate the

PRGA(Pseudo Random Generation Algorithm). This is the actual
Keystream.

31
Code for PRGA (Pseudo Random Generation Algorithm):
static constexpr int MAX_SIZE = 256;
std::array<char, MAX_SIZE> S;
std::iota(begin(S), end(S), 0);
int i{}, j{};
while (std::[Link]() != EOF) {
i = (i + 1) % MAX_SIZE;
j = (j + S[i]) % MAX_SIZE;
std::swap(S[i], S[j]);
std::cout << S[(S[i] + S[j]) % MAX_SIZE] << '\n';
}

This is the next step of scrambling.

Working of RC4

Encryption Procedure
1. The user inputs a plain text file and a secret key.
2. The encryption engine then generates the keystream by using
KSA and PRGA Algorithm.
3. This keystream is now XOR with the plain text, this XORing is
done byte by byte to produce the encrypted text.
4. The encrypted text is then sent to the intended receiver, the
intended receiver will then decrypted the text and after
decryption, the receiver will get the original plain text.

32
Decryption Procedure
Decryption is achieved by doing the same byte-wise X-OR operation on
the Ciphertext.
Example: Let A be the plain text and B be the keystream (A xor B) xor
B=A

Advantages

1. RC4 stream ciphers are simple to use.

2. The speed of operation in RC4 is fast as compared to other
ciphers.
3. RC4 stream ciphers are strong in coding and easy to implement.
4. RC4 stream ciphers do not require more memory.
5. RC4 stream ciphers are implemented on large streams of data.

Disadvantages

 If RC4 is not used with strong MAC then encryption is

vulnerable to a bit-flipping attack.
 RC4 stream ciphers do not provide authentication.
 RC4 algorithm requires additional analysis before including new
systems.
 RC4 stream ciphers cannot be implemented on small streams of
data.
 RC4 fails to discard the beginning of output keystream or fails
to use non-random or related keys for the algorithm.

33
 Implementation of S-DES algorithm for data
encryption
Simplified Data Encryption Standard is a simple version of Data
Encryption Standard having a 10-bit key and 8-bit plain text. It is
much smaller than the DES algorithm as it takes only 8-bit plain text
whereas DES takes 64-bit plain text. It was developed for educational
purpose so that understanding DES can become easy. It is a block
cipher algorithm and uses a symmetric key for its algorithm i.e. they
use the same key for both encryption and decryption. It has 2 rounds
for encryption which use two different keys.

First, we need to generate 2 keys before encryption. After generating

keys we pass them to each individual round for s-des encryption. The
below diagram shows the steps involved in the s-des algorithm.

34
Components :

S-DES encryption involves four functions –

1. Initial permutation (IP)

2. Complex function (fk) –

It is the combination of permutation and substitution
functions. The below image represents a round of encryption
and decryption. This round is repeated twice in each
encryption and decryption.

35
 Components in fk are –
a) Expanded Permutation (EP) –
It takes a 4-bit input and converts it into an 8-bit output.

b) S-boxes (S0 and S1) –

It is a basic component of a symmetric key algorithm that
performs substitution.

c) Permutation P4 –

3. Switch (SW) –

36
4. Inverse of Initial Permutation (IP-1) –

37
# Python Implementation of the S-DES Algorithm

def apply_table(inp, table):

res = ""
for i in table:
res += inp[i - 1]
return res

def left_shift(data):
return data[1:] + data[0]

def XOR(a, b):

res = ""
for i in range(len(a)):
if a[i] == b[i]:
res += "0"
else:
res += "1"
return res

def apply_sbox(s, data):

row = int("0b" + data[0] + data[-1], 2)
col = int("0b" + data[1:3], 2)
return bin(s[row][col])[2:]

def function(expansion, s0, s1, key, message):

left = message[:4]
right = message[4:]
temp = apply_table(right, expansion)
temp = XOR(temp, key)
l = apply_sbox(s0, temp[:4]) # noqa: E741
r = apply_sbox(s1, temp[4:])
l = "0" * (2 - len(l)) + l # noqa: E741
r = "0" * (2 - len(r)) + r
temp = apply_table(l + r, p4_table)
temp = XOR(left, temp)
return temp + right

if name == " main ":

key = input("Enter 10 bit key: ")

message = input("Enter 8 bit message: ")

p8_table = [6, 3, 7, 4, 8, 5, 10, 9]

p10_table = [3, 5, 2, 7, 4, 10, 1, 9, 8, 6]
p4_table = [2, 4, 3, 1]
IP = [2, 6, 3, 1, 4, 8, 5, 7]
IP_inv = [4, 1, 3, 5, 7, 2, 8, 6]

38
expansion = [4, 1, 2, 3, 2, 3, 4, 1]
s0 = [[1, 0, 3, 2], [3, 2, 1, 0], [0, 2, 1, 3], [3, 1, 3, 2]]
s1 = [[0, 1, 2, 3], [2, 0, 1, 3], [3, 0, 1, 0], [2, 1, 0, 3]]

# key generation
temp = apply_table(key, p10_table)
left = temp[:5]
right = temp[5:]
left = left_shift(left)
right = left_shift(right)
key1 = apply_table(left + right, p8_table)
left = left_shift(left)
right = left_shift(right)
left = left_shift(left)
right = left_shift(right)
key2 = apply_table(left + right, p8_table)

# encryption
temp = apply_table(message, IP)
temp = function(expansion, s0, s1, key1, temp)
temp = temp[4:] + temp[:4]
temp = function(expansion, s0, s1, key2, temp)
CT = apply_table(temp, IP_inv)
print("Cipher text is:", CT)

# decryption
temp = apply_table(CT, IP)
temp = function(expansion, s0, s1, key2, temp)
temp = temp[4:] + temp[:4]
temp = function(expansion, s0, s1, key1, temp)
PT = apply_table(temp, IP_inv)
print("Plain text after decypting is:", PT)

39
 Implementation of Asymmetric Encryption Scheme –
RSA

The RSA algorithm is an asymmetric cryptography algorithm; this means

that it uses a public key and a private key (i.e. two different,
mathematically linked keys). As their names suggest, a public key is
shared publicly, while a private key is secret and must not be shared with
anyone.
The RSA algorithm is named after those who invented it in 1978: Ron
Rivest, Adi Shamir, and Leonard Adleman.
The following illustration highlights how asymmetric cryptography works:

How it works
The RSA algorithm ensures that the keys, in the above illustration, are as
secure as possible. The following steps highlight how it works:

1. Generate 2 large prime numbers P and Q, such that 𝑃 ≠ 𝑄

2. Calculate a value 𝑛 = 𝑃. 𝑄 and 𝑚 = (𝑃 – 1)(𝑄 – 1)
3. Select the key for encryption denoted by e such that e is relative prime to
n and e < m. i.e.
𝑔𝑐𝑑 (𝑒, 𝑚) = 1
This e will be used for calculating the ciphertext using the following
expression:
𝑐 = 𝑝𝑒 𝑚𝑜𝑑 𝑛
and we say that the public key for encryption is 𝐾𝑃𝑈 = (𝑒, 𝑛)
1. Calculate the key for decryption denoted by 'd' such that d is multiplicative
inverse of e mod m, i.e.
𝑑. 𝑒 𝑚𝑜𝑑 𝑚 = 1
𝑃 = 𝐶𝑑 𝑚𝑜𝑑 𝑛

40
from math import gcd

def rsa_algo(p: int,q: int, msg: str):

n = p * q
z = (p-1)*(q-1)
e = find_e(z)
d = find_d(e, z)

cypher_text = ''
for ch in msg:
ch = ord(ch)
cypher_text += chr((ch ** e) % n)

plain_text = ''
for ch in cypher_text:
ch = ord(ch)
plain_text += chr((ch ** d) % n)

return cypher_text, plain_text

def find_e(z: int):

e = 2
while e < z:
if gcd(e, z) == 1:
return e
e += 1

def find_d(e: int, z: int):

d = 2
while d < z:
if ((d*e) % z)==1:
return d
d += 1

if name == " main ":

p, q = map(int, input('Please Enter two prime numbers: ').split())
msg = input('Please Enter the message to be encrypted: ')

cypher_text, plain_text = rsa_algo(p, q, msg)

print("Encrypted (Cypher text) : ", [ord(ch) for ch in cypher_text])

print("Decrypted (Plain text) : ", plain_text)

41
42
 Study of IP based Authentication
What is IP Authentication?
IP authentication works by checking the physical IP address of the
machine accessing ProQuest and validating it against a list of allowed IP's
and ranges. Normally, IP Authentication is used for on-campus/in-library
access and can be used in certain circumstances for home access, as well.

How can IP Authentication be used for Home Access?

IP authentication is only supported for home access when used in
conjunction with a proxy server or VPN service. These services pass
through all traffic for ProQuest through its own IP address, which is
normally inside the allowed list of IP's or ranges on the account.
What is a Shared IP?
Some institutions share internet with multiple ProQuest account holders
(ie. Main Library and Law Library or multi-campus academic institutions).
In order to cover all possible internet devices, some institutions may need
to add an IP range on to multiple ProQuest accounts. For your security,
this can only be done internally by ProQuest Support. Please
contact ProQuest Support to request an IP address be shared between 2
or more accounts.

What is a Proxy Server?

A proxy server is a piece of software or hardware that allows all internet
traffic to be passed through its internet connection so that you can appear
as if you are on-campus when accessing resources from home. Examples
of proxy servers are OCLC's EZproxy software, Innovative Interfaces WAM
Proxy software, and reverse proxies.
Please note: Reverse proxies are very customized and generally
cannot be troubleshooted directly by ProQuest Support. We
recommend using EZproxy or WAM proxy in lieu of reverse
proxies.

What is a VPN service?

A VPN, like a proxy server, also routes all internet traffic through its
internet connection to make you appear as if you are accessing from on-
campus. However, VPN services route ALL internet traffic through a
secure connection to the server whereas proxy servers mainly only route
browser traffic. VPN services create a private network that allows you to
tunnel into the campus network and access all Internet traffic as if you
were on-campus.

The following products can have their IP data updated in the ProQuest
Administrator Module (under Authentication/Access > IP):

 ProQuest Academic ([Link] or [Link])

 ProQuest Dissertations & Theses (A&I and Global)

43
  Alexander Street Press (both legacy and new platforms inculding
the enhanced video platform)
 [Link] Library Edition
 Fold3 Library Edition
 ProQuest Research Companion
 ProQuest K-12 (eLibrary and SIRS only)

The following products require IP data updates to be submitted

to ProQuest Support:

 CultureGrams
 Chadwyck Healey legacy (including History Study Center and
ProQuest Learning Literature)
 Bowker (RCL, Books in Print, BBAS)
 Factiva
 Safari Books Online Classic
 PressDisplay (formerly NewspaperDirect)

44
Study of Cryptography Techniques
Various cryptography techniques have been developed to provide data
security to ensure that the data transferred between communication
parties is confidential, not modified by an unauthorized party, to prevent
hackers from accessing and using their information. Caesar cipher,
monoalphabetic cipher, homophonic substitution cipher, Polyalphabetic
Cipher, Playfair cipher, rail fence, One-time pad, hill cipher are some of
the examples of cryptography techniques.
Cryptography deals with various security principles, which are as follows:

1. Confidentiality – It specifies that only the sender and the recipient

or recipients should be able to access the message. Confidentiality
will get lost if an authorized person can access a message.
2. Authentication – It identifies a user or a computer system so that
it can be trusted.
3. Integrity – It checks that a message’s contents must not be
altered during its transmission from the sender to the recipient.
4. Non-repudiation – It specifies that the sender of a message
cannot be refused having sent it, later on, in the case of a dispute.

Top 5 Cryptography Techniques

Here are some very easy codes and more complex
modern encryption technologies used on the Internet today.

1) Simple Codes

 This category is any way of writing a message by side that it is

difficult for anyone else to read. That involves writing stuff in
another alphabet. Here we can see that Icelandic runes and IPA and
another niche built alphabets such as the Deseret Alphabet.

 In this, we can use language to code. We have looked into the

creation of created languages such as Elvish and Esperanto.
 Chester Naz and Judith Schiess Avila’s book Code Talker is a book
that explains how the Navajo language had been used as a code in
the Second World War and never was cracked into extremely
intense conditions.
 If Navajo had no words for a particular notion, the code speakers
chose a term instead. The Navajo word for ‘ hummingbird, ‘ for
example, had become a fighter plane, and ‘ iron hat ‘ was Germany.

45
2) Symmetric Encryption

 Symmetrical encryption is a type of encryption that is used for

the encryption and decryption of electronic data by just one key (a
secret key). Substitution ciphers are symmetrical encryption
techniques, but modern symmetric encryption can be much more
complicated.
 Data are converted to a method that anyone cannot understand
without a secret key to decrypt it using symmetrical encryption
algorithms.
 Symmetric encryption is an old algorithm, but it is faster and
efficient than asymmetric encryption. Because of great performance
and fast speed of symmetric as compare to asymmetric encryption.
 Whereas Symmetric key cryptography involves the usage of the
same key for encryption and decryption. At the same time,
Asymmetric key cryptography involves using one key for encryption
and another different key for decryption.
 Symmetric encryption is typical for big quantities of information,
e.g. for database encryption, in bulk encryption. In the case of a
database, the secret key can only be encrypted or decrypted by the
database itself.
We can see the working of Symmetric encryption in the picture given
below:

Two kinds of symmetrical encryption algorithms are available:

1. Block algorithm
2. Stream algorithm

46
A) Block Algorithm
The set of bits is encoded with a specific secret key in electronic data
blocks. The system keeps the data in its memory while it is waiting to get
complete blocks when the data are encrypted. Some important Block
cipher algorithms are DES, Triple DES, AES, etc.

B) Stream Cipher Algorithm

In this, Plain text numbers or characters are combined with
pseudorandom cipher digit stream. Some important Stream cipher
algorithms are RC4, A5, BLOWFISH, etc. In symmetric key encryption,
The encryption code can be cracked if someone finds out the symmetric
key. But this problem can be overcome with the Diffie-Hellman algorithm.
In the Diffie-Hellman key exchange or agreement algorithm, the sender
and receiver must agree on a symmetric key using this technique. This
key can then be used for encryption or decryption purpose.
3) Asymmetric Encryption

 Asymmetric encryption is also called public-key cryptography.

Asymmetric key encryption helps to resolve a key exchange
problem of symmetric key Cryptography. In Asymmetric encryption,
Two keys are used to encrypt plain text in asymmetrical encryption.
Through the internet or big network, the secret keys are
exchanged. It is necessary to notice that anyone with a secret key
can decrypt the message, so asymmetric encryption uses two
corresponding keys to increase safety.
 Anyone who wishes to send you a message will have a public key
freely accessible, but the second private key is held the secret for
you to understand you only. A message encrypted with a public key
can be decoded with a private key. A message encrypted with a
private key can also be decrypted with a public key.
We can see the working of Asymmetric encryption in the picture given
below:

47
4) Steganography

 Steganography is a technique that facilitates the hiring of a

message that is to be kept secret inside other messages. Earlier,
people used methods to hide messages such as invisible ink, minute
variations, etc.
 But in an age of technology, Steganography is a technique to
conceal data that can be the file, message, image, etc., inside other
files, message or images.

5) Hashing

 Hashing is the cryptographic technique that converts data that can

be any form into a unique string. Regardless of size or type, any
data can be hashed using a hashing algorithm. It takes data of
random length and converts it into a fixed hashed value.
 Hashing is different from other encryption methods because, in
hashing, encryption cannot be reversed; that is cannot be decrypted
using keys. MD5, SHA1, SHA 256 are the widely used hashing
algorithms.
Conclusion
This article has seen what cryptography and various Cryptography
techniques to encrypt and decrypt the data are. Cryptography is used in
all fields to secure data and prevent it from getting hacked. For example,
for securing passwords, authenticating banking transactions, etc.
Nowadays, various new cryptographic techniques are developed and
cracked; hence, it is important always to be aware of computer threats
and take precautions to avoid them as best as we can.

48
 Study of Encryption algorithms
Different types of encryption algorithms are designed to obfuscate data in
a way that it is only possible to extract the original data with the correct
secret key. However, there are a variety of different ways of
accomplishing this.

The two main categories of encryption algorithms are symmetric and

asymmetric encryption. Each of these approaches to encryption has its
pros and cons.

Symmetric Encryption
Symmetric encryption algorithms use the same secret key for both
encryption and decryption. This means that the sender and the recipient
of an encrypted message need to share a copy of the secret key via a
secure channel before starting to send encrypted data. Symmetric
encryption algorithms come in two different varieties: block and stream
ciphers.

Block Ciphers
A block cipher encrypts data in fixed-size chunks. For example, the
Advanced Encryption Standard (AES) uses a block length of 128 bits.
If the plaintext is shorter than the block length, then it is padded out to
the desired length before encryption. At the other end, the recipient of
the message will decrypt it and then remove the padding to restore the
original message.
If a plaintext is longer than the block length, then it is broken up into
multiple different chunks for encryption. A block cipher mode of operation
defines how these chunks are related to one another.
Each mode of operation has its pros and cons. For example, Electronic
Code Book (ECB) mode is the simplest mode of operation. With ECB, each
block is encrypted completely independently.

The downside of this is that blocks with the same plaintext produce the
same ciphertext. The image above is a picture of the Linux penguin.
While this data is encrypted, the ciphertexts for a pixel of a certain color
(black, white, etc.) are the same throughout the image, so the penguin is
still visible.
Other modes of operation eliminate this issue by interrelating the
encryption of each block. Some also provide additional features, such as
Galois Counter Mode (GCM), which generates a message authentication
code (MAC) that verifies that data has not been modified in transit.

Example: The Advanced Encryption Standard (AES)

49
The most famous block cipher is the Advanced Encryption Standard
(AES). This encryption algorithm was selected as the result of a contest
run by the National Institute of Standards and Technology (NIST) to
replace the aging Data Encryption Standard (DES).
AES is a family of three different algorithms designed to use a 128, 192,
or 256 bit encryption key. These algorithms are broken into a key
schedule and an encryption algorithm.
The encryption algorithm of AES is largely the same for all three
versions. It is divided into rounds, which are composed of a set of
mathematical operations. The main difference between the different AES
versions is the number of rounds used: 10, 12, and 14.
Each round of AES uses a unique round key that is derived from the
original secret key. Deriving these round keys is the job of the key
schedule Each AES version’s key schedule is different because they take
different length secret keys and produce different numbers of 128-bit
round keys.

Stream Ciphers

The other type of symmetric encryption algorithm is a stream cipher.

Unlike a block cipher, a stream cipher encrypts a plaintext one bit at a
time.

A stream cipher is designed based on the only completely unbreakable

encryption algorithm: the one-time pad (OTP). The OTP takes a random
secret key the same length as the plaintext and exclusive-ors (XORs)
each bit of the plaintext and key together to produce the ciphertext as
shown in the image above.

50
Decryption with a OTP is the same as encryption. This is because anything
XORed with itself is zero and anything XORed with zero is itself. With a
plaintext P, ciphertext C, and key K
C XOR K = (C XOR K) XOR K = C XOR (K XOR K) = C XOR 0 = C
While it has great security, the OTP is rarely used because it is impractical
to securely share the massive amounts of key material that it needs to
work. A stream cipher uses the same idea as the OTP with a slightly less
secure key.
Instead of a fully random key, a stream cipher uses a secret key to feed a
pseudo-random number generator. By sharing the same secret key and
algorithm, the sender and recipient of a message can crank out the same
string of bits, enabling them to encrypt and decrypt a message.

Example: Rivest Cipher 4 (RC4)

RC4 is an example of a widely-used stream cipher. It was created by Ron

Rivest in 1987 and was originally a trade secret of RSA Security. In 1994,
the details of the cipher were leaked, making it publicly usable.

RC4 is used in a variety of different applications, including the WEP and

WPA encryption standards for Wi-Fi. The cipher has some known
vulnerabilities, especially for certain applications, but can still be used if
some of the initial bytes of the generated keystream are discarded.

Asymmetric Encryption

Unlike symmetric encryption, asymmetric cryptography uses two different

keys for encryption and decryption. The public key is used to encrypt a
message, while the private key is used for decryption.

The private key is a completely random number. The public key is derived
from the private key using a mathematically “hard” problem.

This “hard” problem is based on a mathematical operation that is “easy”

to perform but “hard” to reverse. A number of different “hard” problems

51
are used, including integer-based ones and ones based upon elliptic
curves.

Integer-Based Cryptography

Integer-based asymmetric cryptography uses two main “hard” problems.

These are the factoring and discrete logarithm problems.

The factoring problem is based on the fact that it is relatively easy to

multiply two numbers together but it is hard to factor them. In fact,
factoring is so hard that the best way to do so (on a “classical” computer)
is through a brute force search. Someone wanting to factor the product of
two prime numbers needs to test potential factors until they happen to
find one of the two factors, which can take a very long time.

An asymmetric encryption algorithm based on the factoring problem will

have a public key calculated using the product of two private keys (large
prime numbers). This calculation is easy to perform, but anyone wanting
to derive the private key from the public key will need to factor it, which
is much harder.

The difficulty of multiplication grows polynomially with the length of the

factors, but the difficulty of factoring grows exponentially. This makes it
possible to find a “sweet spot”, where a system is usable but essentially
unbreakable.

The discrete logarithm problem uses exponentiation and logarithms as its

“easy” and “hard” operations. Similar to factoring, the complexity of
calculating logarithms grows much more quickly as the size of the
exponent increases.

Example: Rivest-Shamir-Adleman (RSA)

Symmetric encryption is a simple cryptographic algorithm by today’s

standards, however, it was once considered state of the art. In fact, the
German army used it to send private communications during World War
II. The movie The Imitation Game actually does quite a good job of

52
explaining how symmetric encryption works and the role it played during
the war.
With symmetric encryption, a message that gets typed in plain text goes
through mathematical permutations to become encrypted. The encrypted
message is difficult to break because the same plain text letter does not
always come out the same in the encrypted message. For example, the
message “HHH” would not encrypt to three of the same characters.
To both encrypt and decrypt the message, you need the same key, hence
the name symmetric encryption. While decrypting messages is
exceedingly difficult without the key, the fact that the same key must be
used to encrypt and decrypt the message carries significant risk. That’s
because if the distribution channel used to share the key gets
compromised, the whole system for secure messages is broken.

One of the most famous asymmetric encryption algorithms in existence is

the one developed by Ron Rivest, Adi Shamir, and Leonard Adleman
called RSA. This algorithm is based on the factoring problem.

The image above shows a simple example of how RSA works. The
plaintext (2) is raised to the power of the public key (5): 2^5 = 32. This
value is then divided by a public modulus (14) and the remainder (4) is
sent as the ciphertext: 32 % 14 = 4.
At the other end, the same operation is performed with the private key
instead of the public key to produce the plaintext: (4^11) % 14 = 2. This

53
calculation works because the public and private keys are selected so that
they are inverses in the chosen modulus.

Elliptic-Curve Cryptography

Integer-based asymmetric cryptography uses factoring and discrete

logarithm problems to build secure encryption algorithms. Elliptic curve
cryptography uses the same problems with a little twist.

Instead of using integers for its calculations, elliptic curve cryptography

uses points on an elliptic curve, like the one shown above. A private key
is still a random number, but a public key is a point on the curve.
A few different mathematical operations are defined on these curves. The
two important ones here are:
 Point Addition (equivalent to integer multiplication)
 Point Multiplication (equivalent to integer exponentiation)

54
On these curves, it is possible to perform calculations that are equivalent
to the “easy” operations of the factoring and discrete logarithm problems.
This means that the same basic algorithms can be adopted to use with
elliptic curves.
But why bother? Elliptic curve cryptography is useful because smaller key
lengths provide the same level of security. This means that elliptic curve
cryptography uses less storage, processing power, and energy to protect
data at the same level as an equivalent integer-based algorithm. These
savings can be important for resource-constrained systems like Internet
of Things (IoT) devices or smartphones.

Pros and Cons of Symmetric and Asymmetric Encryption

Symmetric and asymmetric encryption algorithms both are designed to do
the same job: protecting the confidentiality of data. However, they do
their jobs in very different ways, and each approach has its pros and
cons:
 Symmetric Encryption: The main advantage of symmetric
cryptography is its efficiency. In general, symmetric encryption
algorithms use less memory and processing power than asymmetric
cryptography.
 Asymmetric Encryption: Asymmetric encryption does not require
the two parties to securely share a secret key before sending
encrypted messages. This makes it possible to securely
communicate with anyone as long as you have their private key.

These different strengths mean that symmetric and asymmetric

cryptography are often used together, like in the TLS protocol.
Asymmetric encryption is used to securely exchange a symmetric key,
and symmetric encryption is used for bulk data transfer.

55
 Study of Security polices

An information security policy (ISP) is a set of rules, policies and

procedures designed to ensure all end users and networks within an
organization meet minimum IT security and data protection security
requirements.
ISPs should address all data, programs, systems, facilities, infrastructure,
authorized users, third parties and fourth parties of an organization.

What is the Purpose of an Information Security Policy?

An information security policy aims to enact protections and limit the
distribution of data to only those with authorized access. Organizations
create ISPs to:

 Establish a general approach to information security

 Document security measures and user access control policies
 Detect and minimize the impact of compromised information assets
such as misuse of data, networks, mobile devices, computers and
applications
 Protect the reputation of the organization
 Comply with legal and regulatory requirements like
NIST, GDPR, HIPAA and FERPA
 Protect their customer's data, such as credit card numbers
 Provide effective mechanisms to respond to complaints and queries
related to real or perceived cyber security risks such
as phishing, malware and ransomware
 Limit access to key information technology assets to those who
have an acceptable use

Why is an Information Security Policy is Important?

Creating an effective information security policy and that meets all
compliance requirements is a critical step in preventing security incidents
like data leaks and data breaches.

ISPs are important for new and established organizations. Increasing

digitalization means every employee is generating data and a portion of
that data must be protected from unauthorized access. Depending on
your industry, it may even be protected by laws and regulations.

Sensitive data, personally identifiable information (PII), and intellectual

property must be protected to a higher standard than other data.

56
Whether you like it or not, information security (InfoSec) is important at
every level of your organization. And outside of your organization.

Increased outsourcing means third-party vendors have access to data

too. This is why third-party risk management and vendor risk
management is part of any good information security policy. Third-party
risk, fourth-party risk and vendor risk are no joke.

What are the Key Elements of an Information Security Policy?

An information security policy can be as broad as you want it to be. It can
cover IT security and/or physical security, as well as social media usage,
lifecycle management and security training. In general, an information
security policy will have these nine key elements:

1. Purpose
Outline the purpose of your information security policy which should:

 Preserve your organization's information security.

 Detect and preempt information security breaches caused by third-
party vendors, misuse of networks, data, applications, computer
systems and mobile devices.
 Protect the organization's reputation
 Uphold ethical, legal and regulatory requirements
 Protect customer data and respond to inquiries and complaints
about non-compliance of security requirements and data protection

2. Audience
Define who the information security policy applies to and who it does not
apply to. You may be tempted to say that third-party vendors are not
included as part of your information security policy.

This may not be a great idea. Third-party, fourth-party risk and vendor
risk should be accounted for. Whether or not you have a legal or
regulatory duty to protect your customer's data from third-party data
breaches and data leaks isn't important. Customers may still blame your
organization for breaches that were not in your total control and the
reputational damage can be huge.

3. Information Security Objectives

These are the goals management has agreed upon, as well as the
strategies used to achieve them.

In the end, information security is concerned with the CIA triad:

57
  Confidentiality: data and information are protected from
unauthorized access
 Integrity: Data is intact, complete and accurate
 Availability: IT systems are available when needed

4. Authority and Access Control Policy

This part is about deciding who has the authority to decide what data can
be shared and what can't. Remember, this may not be always up to your
organization. For example, if you are the CSO at a hospital. You likely
need to comply with HIPAA and its data protection requirements. If you
store medical records, they can't be shared with an unauthorized party
whether in person or online.

An access control policy can help outline the level of authority over data
and IT systems for every level of your organization. It should outline how
to handle sensitive information, who is responsible for security controls,
what access control is in place and what security standards are
acceptable.

It may also include a network security policy that outlines who can have
access to company networks and servers, as well as what authentication
requirements are needed including strong password
requirements, biometrics, ID cards and access tokens.

In some cases, employees are contractually bound to comply with the

information security policy before being granted access to any information
systems and data centers.

5. Data Classification
An information security policy must classify data into categories. A good
way to classify the data is into five levels that dictate an increasing need
for protection:

1. Level 1: Public information

2. Level 2: Information your organization has chosen to keep
confidential but disclosure would not cause material harm
3. Level 3: Information has a risk of material harm to individuals or
your organization if disclosed
4. Level 4: Information has a high risk of causing serious harm to
individuals or your organization if disclosed
5. Level 5: Information will cause severe harm to individuals or your
organization if disclosed
In this classification, levels 2-5 would be classified as confidential
information and would need some form of protection.

58
6. Data Support and Operations
Once data has been classified, you need to outline how data is each level
will be handled. There are generally three components to this part of your
information security policy:

1. Data protection regulations: Organizations that store personally

identifiable information (PII) or sensitive data must be protected
according to organizational standards, best practices, industry
compliance standards and regulation
2. Data backup requirements: Outlines how data is backed up, what
level of encryption is used and what third-party service providers
are used
3. Movement of data: Outlines how data is communicated. Data that
is deemed classified in the above data classification should be
securely communicated with encryption and not transmitted across
public networks to avoid man-in-the-middle attacks

7. Security Awareness Training

A perfect information security policy that no one follows is no better than
having no policy at all. You need your staff to understand what is required
of them. Training should be conducted to inform employees of security
requirements, including data protection, data classification, access control
and general security threats.

Security training should include:

 Social engineering: Teach your employees about

phishing, spearphishing and other common social engineering cyber
attacks
 Clean desk policy: Laptops should be taken home and documents
shouldn't be left on desks at the end of the work day
 Acceptable usage: What can employees use their work devices
and Internet for and what is restricted?

8. Responsibilities and Duties of Employees

This is where you operationalize your information security policy. This
part of your information security policy needs to outline the owners of:

 Security programs
 Acceptable use policies
 Network security
 Physical security
 Business continuity

59
  Access management
 Security awareness
 Risk assessments
 Incident response
 Data security
 Disaster recovery
 Incident management

9. Other Items an ISP May Include

Virus protection procedure, malware protection procedure, network
intrusion detection procedure, remote work procedure, technical
guidelines, consequences for non-compliance, physical security
requirements, references to supporting documents, etc.

What are the Best Practices for Information Security

Management?
A mature information security policy will outline or refer to the following
policies:

1. Acceptable use policy (AUP): Outlines the constraints an

employee must agree to use a corporate computer and/or network
2. Access control policy (ACP): Outlines access controls to an
organization's data and information systems
3. Change management policy: Refers to the formal process for
making changes to IT, software development and security
4. Information security policy: High-level policy that covers a large
number of security controls
5. Incident response (IR) policy: An organized approach to how
the organization will manage and remediate an incident
6. Remote access policy: Outlines acceptable methods of remotely
connecting to internal networks
7. Email/communication policy: Outlines how employees can use
the business's chosen electronic communication channel such as
email, slack or social media
8. Disaster recovery policy: Outlines the organization's
cybersecurity and IT teams input into an overall business continuity
plan
9. Business continuity plan (BCP): Coordinates efforts across the
organization and is used in the event of a disaster to restore the
business to a working order

60
10. Data classification policy: Outlines how your organization
classifies its data
11. IT operations and administration policy: Outlines how all
departments and IT work together to meet compliance and security
requirements.
12. SaaS and cloud policy: Provides the organization with clear
cloud and SaaS adoption guidelines, this helps mitigate third-
party and fourth-party risk
13. Identity access and management (IAM) policy: Outlines
how IT administrators authorize systems and applications to the
right employees and how employees create passwords to comply
with security standards
14. Data security policy: Outlines the technical requirements
and acceptable minimum standards for data security to comply with
relevant laws and regulations
15. Privacy regulations: Outlines how the organization complies
with government-enforced regulations such as GDPR that are
designed to protect customer privacy
16. Personal and mobile devices policy: Outlines if employees
are allowed to use personal devices to access company
infrastructure and how to reduce the risk of exposure from
employee-owned assets

61
 Study of Network Security Fundamentals, Ethical
Hacking and Social Engineering

Network Security Fundamentals (N|SF) is an entry-level security program

covering the fundamental concepts of network security. It enables
students with the skills to identify information security threats which
reflect on the security posture of the organization and implement general
security controls.
This program will give a holistic overview of the key components of
network security. It provides a solid fundamental knowledge required for
a career in network security.

This course is designed for those interested in learning the various

fundamentals of network security.

Why N|SF Is Important

Network security plays a vital role in most of the organizations. It is the

process of preventing and detecting unauthorized use of your computer.
It protects networks and their services from unauthorized modification,
destruction, or disclosure. Network security provides assurance that a
network performs its critical functions securely without any harmful side
effects.

The important essentials of network security are:

 Physical security
 Access controls

62
  Authentication

 Accountability

To establish a secured network, a well-designed network policy has to be

established. The network policy characterizes the organization’s idea of an
apt computer, usage of the network, and measures to deal with the
network incidents.

What is Ethical Hacking?

Ethical Hacking is an authorized practice of bypassing system security to

identify potential data breaches and threats in a network. The company
that owns the system or network allows Cyber Security engineers to
perform such activities in order to test the system’s defenses. Thus,
unlike malicious hacking, this process is planned, approved, and more
importantly, legal.

Ethical hackers aim to investigate the system or network for weak points
that malicious hackers can exploit or destroy. They collect and analyze
the information to figure out ways to strengthen the security of the
system/network/applications. By doing so, they can improve the security
footprint so that it can better withstand attacks or divert them.

Ethical hackers are hired by organizations to look into the vulnerabilities

of their systems and networks and develop solutions to prevent data
breaches. Consider it a high-tech permutation of the old saying “It takes a
thief to catch a thief.”

They check for key vulnerabilities include but are not limited to:

 Injection attacks

 Changes in security settings

63
  Exposure of sensitive data

 Breach in authentication protocols

 Components used in the system or network that may be used as

access points

Now, as you have an idea of what is ethical hacking, it's time to learn the
type of hackers.

Types of Hackers

The practice of ethical hacking is called “White Hat” hacking, and those
who perform it are called White Hat hackers. In contrast to Ethical
Hacking, “Black Hat” hacking describes practices involving security
violations. The Black Hat hackers use illegal techniques to compromise
the system or destroy information.

Unlike White Hat hackers, “Grey Hat” hackers don’t ask for permission
before getting into your system. But Grey Hats are also different from
Black Hats because they don’t perform hacking for any personal or third-
party benefit. These hackers do not have any malicious intention and
hack systems for fun or various other reasons, usually informing the
owner about any threats they find. Grey Hat and Black Hat hacking are
both illegal as they both constitute an unauthorized system breach, even
though the intentions of both types of hackers differ.

64
White Hat vs Black Hat Hacker

The best way to differentiate between White Hat and Black Hat hackers is
by taking a look at their motives. Black Hat hackers are motivated by
malicious intent, manifested by personal gains, profit, or harassment;
whereas White Hat hackers seek out and remedy vulnerabilities, so as to
prevent Black Hats from taking advantage.

The other ways to draw a distinction between White Hat and Black Hat
hackers include:

 Techniques Used

White Hat hackers duplicate the techniques and methods followed

by malicious hackers in order to find out the system
discrepancies, replicating all the latter’s steps to find out how a
system attack occurred or may occur. If they find a weak point in
the system or network, they report it immediately and fix the
flaw.

 Legality

Even though White Hat hacking follows the same techniques and
methods as Black Hat hacking, only one is legally acceptable.
Black Hat hackers break the law by penetrating systems without
consent.

 Ownership

White Hat hackers are employed by organizations to penetrate

their systems and detect security issues. Black hat hackers
neither own the system nor work for someone who owns it.

After understanding what is ethical hacking, the types of ethical hackers,

and knowing the difference between white-hat and black-hat hackers,
let's have a look at the ethical hacker roles and responsibilities.

65
Ethical Hacker Roles and Responsibilities

Ethical Hackers must follow certain guidelines in order to perform hacking

legally. A good hacker knows his or her responsibility and adheres to all of
the ethical guidelines. Here are the most important rules of Ethical
Hacking:

 An ethical hacker must seek authorization from the organization

that owns the system. Hackers should obtain complete approval
before performing any security assessment on the system or
network.

 Determine the scope of their assessment and make known their

plan to the organization.

 Report any security breaches and vulnerabilities found in the

system or network.

 Keep their discoveries confidential. As their purpose is to secure

the system or network, ethical hackers should agree to and
respect their non-disclosure agreement.

 Erase all traces of the hack after checking the system for any
vulnerability. It prevents malicious hackers from entering the
system through the identified loopholes.

Ethical Hacking Benefits

Learning ethical hacking involves studying the mindset and techniques of

black hat hackers and testers to learn how to identify and correct
vulnerabilities within networks. Studying ethical hacking can be applied by
security pros across industries and in a multitude of sectors. This sphere
includes network defender, risk management, and quality assurance
tester.

66
However, the most obvious benefit of learning ethical hacking is its
potential to inform and improve and defend corporate networks. The
primary threat to any organization's security is a hacker: learning,
understanding, and implementing how hackers operate can help network
defenders prioritize potential risks and learn how to remediate them best.
Additionally, getting ethical hacking training or certifications can benefit
those who are seeking a new role in the security realm or those wanting
to demonstrate skills and quality to their organization.

You understood what is ethical hacking, and the various roles and
responsibilities of an ethical hacker, and you must be thinking about what
skills you require to become an ethical hacker. So, let's have a look at
some of the ethical hacker skills.

Skills Required to Become an Ethical Hacker

An ethical hacker should have in-depth knowledge about all the systems,
networks, program codes, security measures, etc. to perform hacking
efficiently. Some of these skills include:

 Knowledge of programming - It is required for security

professionals working in the field of application security and
Software Development Life Cycle (SDLC).

 Scripting knowledge - This is required for professionals dealing

with network-based attacks and host-based attacks.

 Networking skills - This skill is important because threats mostly

originate from networks. You should know about all of the
devices present in the network, how they are connected, and how
to identify if they are compromised.

 Understanding of databases - Attacks are mostly targeted at

databases. Knowledge of database management systems such
as SQL will help you to effectively inspect operations carried out
in databases.

67
  Knowledge of multiple platforms like Windows, Linux, Unix, etc.

 The ability to work with different hacking tools available in the

market.

 Knowledge of search engines and servers.

What is social engineering

Social engineering is the term used for a broad range of malicious

activities accomplished through human interactions. It uses psychological
manipulation to trick users into making security mistakes or giving away
sensitive information.

Social engineering attacks happen in one or more steps. A perpetrator

first investigates the intended victim to gather necessary background
information, such as potential points of entry and weak security protocols,
needed to proceed with the attack. Then, the attacker moves to gain the
victim’s trust and provide stimuli for subsequent actions that break
security practices, such as revealing sensitive information or granting
access to critical resources.

Social Engineering Attack Lifecycle

68
What makes social engineering especially dangerous is that it relies on
human error, rather than vulnerabilities in software and operating
systems. Mistakes made by legitimate users are much less predictable,
making them harder to identify and thwart than a malware-based
intrusion.

Social engineering attack techniques

Social engineering attacks come in many different forms and can be

performed anywhere where human interaction is involved. The following
are the five most common forms of digital social engineering assaults.

Baiting
As its name implies, baiting attacks use a false promise to pique a victim’s
greed or curiosity. They lure users into a trap that steals their personal
information or inflicts their systems with malware.

The most reviled form of baiting uses physical media to disperse malware.
For example, attackers leave the bait—typically malware-infected flash
drives—in conspicuous areas where potential victims are certain to see
them (e.g., bathrooms, elevators, the parking lot of a targeted company).
The bait has an authentic look to it, such as a label presenting it as the
company’s payroll list.

Victims pick up the bait out of curiosity and insert it into a work or home
computer, resulting in automatic malware installation on the system.

Baiting scams don’t necessarily have to be carried out in the physical

world. Online forms of baiting consist of enticing ads that lead to
malicious sites or that encourage users to download a malware-infected
application.

Scareware
Scareware involves victims being bombarded with false alarms and
fictitious threats. Users are deceived to think their system is infected with
malware, prompting them to install software that has no real benefit
(other than for the perpetrator) or is malware itself. Scareware is also
referred to as deception software, rogue scanner software and fraudware.

A common scareware example is the legitimate-looking popup banners

appearing in your browser while surfing the web, displaying such text
such as, “Your computer may be infected with harmful spyware
programs.” It either offers to install the tool (often malware-infected) for

69
you, or will direct you to a malicious site where your computer becomes
infected.

Scareware is also distributed via spam email that doles out bogus
warnings, or makes offers for users to buy worthless/harmful services.

Pretexting
Here an attacker obtains information through a series of cleverly crafted
lies. The scam is often initiated by a perpetrator pretending to need
sensitive information from a victim so as to perform a critical task.

The attacker usually starts by establishing trust with their victim by

impersonating co-workers, police, bank and tax officials, or other persons
who have right-to-know authority. The pretexter asks questions that are
ostensibly required to confirm the victim’s identity, through which they
gather important personal data.

All sorts of pertinent information and records is gathered using this scam,
such as social security numbers, personal addresses and phone numbers,
phone records, staff vacation dates, bank records and even security
information related to a physical plant.

Phishing
As one of the most popular social engineering attack
types, phishing scams are email and text message campaigns aimed at
creating a sense of urgency, curiosity or fear in victims. It then prods
them into revealing sensitive information, clicking on links to malicious
websites, or opening attachments that contain malware.

An example is an email sent to users of an online service that alerts them

of a policy violation requiring immediate action on their part, such as a
required password change. It includes a link to an illegitimate website—
nearly identical in appearance to its legitimate version—prompting the
unsuspecting user to enter their current credentials and new password.
Upon form submittal the information is sent to the attacker.

Given that identical, or near-identical, messages are sent to all users in

phishing campaigns, detecting and blocking them are much easier for
mail servers having access to threat sharing platforms.

Spear phishing
This is a more targeted version of the phishing scam whereby an attacker
chooses specific individuals or enterprises. They then tailor their

70
messages based on characteristics, job positions, and contacts belonging
to their victims to make their attack less conspicuous. Spear
phishing requires much more effort on behalf of the perpetrator and may
take weeks and months to pull off. They’re much harder to detect and
have better success rates if done skillfully.

A spear phishing scenario might involve an attacker who, in

impersonating an organization’s IT consultant, sends an email to one or
more employees. It’s worded and signed exactly as the consultant
normally does, thereby deceiving recipients into thinking it’s an authentic
message. The message prompts recipients to change their password and
provides them with a link that redirects them to a malicious page where
the attacker now captures their credentials.

Social engineering prevention

Social engineers manipulate human feelings, such as curiosity or fear, to

carry out schemes and draw victims into their traps. Therefore, be wary
whenever you feel alarmed by an email, attracted to an offer displayed on
a website, or when you come across stray digital media lying about. Being
alert can help you protect yourself against most social engineering attacks
taking place in the digital realm.

Moreover, the following tips can help improve your vigilance in relation to
social engineering hacks.

 Don’t open emails and attachments from suspicious

sources – If you don’t know the sender in question, you don’t need
to answer an email. Even if you do know them and are suspicious
about their message, cross-check and confirm the news from other
sources, such as via telephone or directly from a service provider’s
site. Remember that email addresses are spoofed all of the time;
even an email purportedly coming from a trusted source may have
actually been initiated by an attacker.
 Use multifactor authentication – One of the most valuable
pieces of information attackers seek are user credentials. Using
multifactor authentication helps ensure your account’s protection in
the event of system compromise. Imperva Login Protect is an easy-
to-deploy 2FA solution that can increase account security for your
applications.
 Be wary of tempting offers – If an offer sounds too enticing,
think twice before accepting it as fact. Googling the topic can help
you quickly determine whether you’re dealing with a legitimate offer
or a trap.

71
 Keep your antivirus/antimalware software updated – Make
sure automatic updates are engaged, or make it a habit to
download the latest signatures first thing each day. Periodically
check to make sure that the updates have been applied, and scan
your system for possible infections.

72