Drag and Drop Problem in Virtual Box

Go to VirtualMachine's Settings->General->Advanced->Shared Clipboard (Bidirectional)
Reboot your virtual machine.

On the Network Adapter 1 page, no host-only network adapter is selected (problem in Virtual Box)

Probably, the virtual host-only network wasn't set up yet. Here's is how you can fix this:

1. From the main menu, select File > Preferences (Ctrl+G) - NOT the settings of a single vm
2. Select Network in the list on the left
3. You should see an empty white box with "Host-only Networks" at the top. On the right, there are three buttons to manage them. Click the topmost one (with a green plus symbol). A new Host-only network will be created and added to the list.

Normally, the settings of the new network will be ok, but for completeness, I give the default values here. You can access the settings for the host-only network through the screwdriver button on the right.

• Adapter:
  • IPv4 address: 192.168.56.1
  • IPv4 Network Mask: 255.255.255.0
• DHCP server:
  • Enable server: checked
  • Server Address: 192.168.56.100
  • Server Mask: 255.255.255.0
  • Lower Address Bound: 192.168.56.101
  • Upper Address Bound: 192.168.56.254

You can change these settings to your liking, as long as they're consistent.

How to install Virtual Box in Backtrack-5

Backtrack 5 doesnt come with the kernel headers installed.So you will need to download them and then proceed with installing virtualbox. The commands are listed below
root@bt # prepare-kernel-sources
root@bt # cd /usr/src/linux
root@bt # cp -rf include/generated/* include/linux/

After this is done, edit /etc/apt/sources.list as shown below and download virtualbox
root@bt # echo deb http://download.virtualbox.org/virtualbox/debian lucid contrib non-free >> /etc/apt/sources.list
root@bt # wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | sudo apt-key add -
root@bt # apt-get update
root@bt # apt-cache search virtualbox
root@bt # apt-get install virtualbox-4.0

  

OR

just go on official site of virtualbox:

https://www.virtualbox.org/wiki/Linux_Downloads

and then download following:

Ubuntu 10.04 LTS ("Lucid Lynx")  i386 |  AMD64 

i386 for 32 bit os

and AMD64 for 64 bit os

then type 

dpkg -i <name of your .deb file with its location>

Character Encoding

In the beginning, there was ASCII, and things were simple. But they weren't good, for no one could write in Cyrillic or Thai. So there exploded a proliferation of character encodings to remedy the problem by extending the characters ASCII could express. This ridiculously simplified version of the history of character encodings shows us that there are now many character encodings floating around.

A character encoding tells the computer how to interpret raw zeroes and ones into real characters. It usually does this by pairing numbers with characters.

Information on a computer is stored and transmitted in what are called bits. Certain bits or combinations of bits equate to certain characters.

...The "charset" parameter identifies a character encoding, which is a method of converting a sequence of bytes into a sequence of characters. This conversion fits naturally with the scheme of Web activity: servers send HTML documents to user agents as a stream of bytes; user agents interpret them as a sequence of characters. The conversion method can range from simple one-to-one correspondence to complex switching schemes or algorithms...

There are many different types of character encodings floating around, but the ones we deal most frequently with are ASCII, 8-bit encodings, and Unicode-based encodings.

·         ASCII is a 7-bit encoding based on the English alphabet.

·         8-bit encodings are extensions to ASCII that add a potpourri of useful, non-standard characters like é and æ. They can only add 127 characters, so usually only support one script at a time. When you see a page on the web, chances are it's encoded in one of these encodings.

·         Unicode-based encodings implement the Unicode standard and include UTF-8, UTF-16 and UTF-32/UCS-4. They go beyond 8-bits and support almost every language in the world. UTF-8 is gaining traction as the dominant international encoding of the web.

Why do I need Character Encoding?

You need to include character encoding because:

1. The declaration of character encoding is required as of the HTML 4.01 specification.
2. When a browser renders/parses a web document that does not have the character encoding declared it will guess at what character set to use and may choose the wrong one therefore rendering the web page incorrectly.
3. The visitor may have changed the default character encoding on their machine (Internet Explorer: View, Encoding) and it may not match the character encoding intended for the web document.
4. It helps speed up your web pages.

When choosing a character encoding choose one that will be versitle, covering all the different languages and requirements of your intended audience. Unicode (UTF-8) is a very versitle character encoding to choose

Delegation of Duties

In Backtrack5 r3 sql are already installed.
So go on backtrack>services>MYSQLD>MYSQL START

Now open a terminal and write as below:
root@bt:~# mysql -u root -p
Enter password:           // u will be asked for password ,so in backtrack ,default MYSQL password is "toor" and it nothing to do with ur computer root password,so, enter "toor as password"
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 45
Server version: 5.1.63-0ubuntu0.10.04.1 (Ubuntu)

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> create database admin;
Query OK, 1 row affected (0.00 sec)

mysql> create user 'usr'@'localhost' identified by 'usrpass';
//'usr' is a username
//'localhost' is a name of the machine on which mysql is running , u can also use ip address on which mysql is running
//'usrpass' is a password which u want to set for user 'usr'
Query OK, 0 rows affected (0.00 sec)

mysql> use admin;
Database changed
mysql> create table tbl(name varchar(20));
Query OK, 0 rows affected (0.08 sec)

mysql> exit;  //exit as root and login as user that u have created
Bye
root@bt:~# mysql -u usr -p //login as user and enter the password which u had set in above case it was 'usrpas'
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 46
Server version: 5.1.63-0ubuntu0.10.04.1 (Ubuntu)

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
+--------------------+
1 row in set (0.00 sec)
// so now u can observe that there is no database above becz 'usr'has not been granted permission
mysql> exit;
Bye
root@bt:~# mysql -u root -p //login as root & lets grant permission to 'usr'
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 47
Server version: 5.1.63-0ubuntu0.10.04.1 (Ubuntu)

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> grant select,insert,create on admin.* to 'usr'@'localhost';//granting permission to user 'usr'
'admin.*'    means database 'admin' and '*' means all table of  'admin'
In above user 'usr' has been granted permission of select,insert and create to the all table of database ' admin'

Query OK, 0 rows affected (0.00 sec)

mysql> flush privileges; //actually ur all information of user are stored in a file ,so after editing if u are using flush then it reload the updation.So after editing use flush
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye
root@bt:~# mysql -u usr -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 48
Server version: 5.1.63-0ubuntu0.10.04.1 (Ubuntu)

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| admin              |        //so now u can see that 'admin ' is also visible to user 'usr', becz he has been granted     by the admin
+--------------------+
2 rows in set (0.00 sec)

mysql> use admin
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables;
+-----------------+
| Tables_in_admin |
+-----------------+
| tbl             |          //table is also visible to user
+-----------------+
1 row in set (0.00 sec)

mysql>//now further if  'usr ' try to update any table of  'admin' database then error will be generated

Comparison between DES & RSA

Execution Time for Decryption of different Data Packet Size:

                                             Final difference:

Information Security Jobs In Government of India depatments

India manage its Information Security Infrastructure by following 6 agencies:

1. Department of Electronics and Information Technology (DEITy)
•  Indian- Computer Emergency Response Team (CERT-In)
• National Informatics Centre (NIC)
2.  Department of Telecom (DoT)
3. National Technical Research Organisation (NTRO)
4. Ministry of Defence
5. Intelligence Bureau (IB)
6. Defence Research and Development Organisation (DRDO)

so these are the agencies in which an Information Security Professional can work . 

Robots Are Taking Over the Web!

Black Box vs Grey Box vs White Box

Black Box testing:Specific knowledge of the application's code/internal structure and programming knowledge in general is not required. The tester is aware of what the software is supposed to do but is not aware of how it does it. For instance, the tester is aware that a particular input returns a certain, invariable output but is not aware of how the software produces the output in the first place.

White Box Testing: is a method of testing software that tests internal structures or workings of an application, as opposed to its functionality. White-box testing is a method of testing the application at the level of the source code

 

S.N.	Black Box Testing	Grey Box Testing	White Box Testing
1	The Internal Workings of an application are not required to be known	Somewhat knowledge of the internal workings are known	Tester has full knowledge of the Internal workings of the application
2	Also known as closed box testing, data driven testing and functional testing	Another term for grey box testing is translucent testing as the tester has limited knowledge of the insides of the application	Also known as clear box testing, structural testing or code based testing
3	Performed by end users and also by testers and developers	Performed by end users and also by testers and developers	Normally done by testers and developers
4	Testing is based on external expectations - Internal behavior of the application is unknown	Testing is done on the basis of high level database diagrams and data flow diagrams	Internal workings are fully known and the tester can design test data accordingly
5	This is the least time consuming and exhaustive	Partly time consuming and exhaustive	The most exhaustive and time consuming type of testing
6	Not suited to algorithm testing	Not suited to algorithm testing	Suited for algorithm testing
7	This can only be done by trial and error method	Data domains and Internal boundaries can be tested, if known	Data domains and Internal boundaries can be better tested

Cryptographic Hash Function

A cryptographic hash function is a hash function; that is, an algorithm that takes an arbitrary block of data and returns a fixed-size bit string, the (cryptographic) hash value, such that any (accidental or intentional) change to the data will (with very high probability) change the hash value. The data to be encoded are often called the "message," and the hash value is sometimes called the message digest or simply digest.
As a minimum, it must have the following properties:

•     Pre-image resistance

        Given a hash h it should be difficult to find any message m such that h = hash(m). This concept is related to that of one-way function. Functions that lack this property are vulnerable to preimage attacks.

•     Second pre-image resistance

        Given an input m1 it should be difficult to find another input m2 such that m1 ≠ m2 and hash(m1) = hash(m2). Functions that lack this property are vulnerable to second-preimage attacks.

•     Collision resistance

        It should be difficult to find two different messages m1 and m2 such that hash(m1) = hash(m2). Such a pair is called a cryptographic hash collision. This property is sometimes referred to as strong collision resistance. It requires a hash value at least twice as long as that required for preimage-resistance; otherwise collisions may be found by a birthday attack.

difference between Vulnerability Assessment and Penetration Testing

• A Vulnerability Analysis answers the question: “What are the present Vulnerabilities and how do we fix them?”
•  A Penetration Testing simply answers the questions: “Can any External Attacker or Internal Intruder break-in and what can they attain?”
• Vulnerability Analysis is the process of identifying vulnerabilities on a network .
•  Penetration Testingis focused on actually gaining unauthorized access to the tested systems and using that access to the network or data, as directed by the client.

 

Penetration Testing consists of a Vulnerability Analysis, but it goes one step ahead where in you will be evaluating the security of the system by simulating an attack usually done by a Malicious Hacker.

policy ,standard, guidelines & procedure

·         Policy:

->Outlines the security roles and responsibilities.

->defines the scope of the information need to be protected.

->provide a high level description of control that must be in place to protect information.

->In addition it should make preference to the standard and guidelines that support it.

->it should make preference to the standard and guidelines that support it.

->should be produced by senior management.

·         Standard:

->are low level mandatory controls that helps, enforce & support mandatory control.

·         Guidelines:

->consists of recommended non-mandatory controls that helps supports standard and served as references when no applicable standard is in place

·         Procedure:

->consists of step-by-step instruction to assist worker in implementing various policy ,standard & guidelines.

Managing Identity Risk though

Identity’s Attributes

Risk management strategies are often presented with two distinct challenges:

1.   Assessing the risk associated with existing customers

2.   And evaluating new consumers services.

But, what can a company  do to manage risk when it wants to offer products or services to brand new customers?

·        Many institutions ask for the prospective customer’s personally identifiable information (PII) and will submit it to a third party for purposes of authenticating the person’s identity or determining the risk for fraud and then , risk management solution providers can return summarized credit or fraud scores(are calculated using different identity attributes) which can be very useful at predicting the likelihood of default or risk ,for fraud based on the PII used in the application.

So ,whether an institution wants to authenticate an identity or prevent frauds or to optimize the decision, identity attributes are proved to be powerful tools that can reduce risk, while facilitating safe commerce.

Types of Identity Attributes:

There are multiple ways to categorize identity elements based on their use and the type of information available.

The following is a high-level overview of some of those categories:

1.Confirmed negative behaviour: Compares event information against confirmed, historic fraudulent events.

for example :Number of times confirmed fraud was reported using a Social Security Number (SSN) within last one, five, fifteen, or thirty days

2.Pattern: Examines anomalies in identity elements and general consumer behaviour.

Validation: Assesses the validity of input. Invalid input can highlight discrepancies that require resolution.

for example:

·        Name appears to be a business name

·        SSN likely frivolous (e.g., “123-45-6789”)

3.Velocity: Examines the frequency with which an input element has been asserted across a range of time periods. These attributes provide insights into behaviour that is out of the norm; the presence of increased velocity is potentially indicative of risk.

for example:

·        Number of events using address in the last 15 days

·        Number of events using SSN in the last year

·        Number of different industry segments in which the consumer has submitted an application in the last 30 days (e.g.,wireless, mortgage)

4.Verification: Assesses the legitimacy of input information.

for example:

•      Last name and primary phone confirmed

•      SSN and name combination reported as deceased.

But the most important thing is the principal determining factor of attribute quality which depend on :

1.   How accurate is  the data source?

2.   How often are the data sources updated?

•      For example:attributes derived from public records or white page data, which are only periodically updated, often present an outdated picture of identity risk.

3.   Do the attributes provide consistent geographic coverage?

•      i.e   whether a company is operating regionally or nationally, it’s important for an attribute provider to provide consistent geographic coverage

4. Do the attributes capture and represent consumer behaviors that are relevant, meaningful and important to the decisions being made?