Cybersecurity

• 

• 

• 

• 

• 

What is cybersecurity?

Cybersecurity is the practice of protecting critical systems and sensitive information from digital attacks. Also known as information technology (IT) security, cybersecurity measures are designed to combat threats against networked systems and applications, whether those threats originate from inside or outside of an organization.

In 2020, the average cost of a data breach was USD 3.86 million globally, and USD 8.64 million in the United States. These costs include the expenses of discovering and responding to the breach, the cost of downtime and lost revenue, and the long-term reputational damage to a business and its brand. Cybercriminals target customers’ personally identifiable information (PII) - names, addresses, national identification numbers (e.g., Social Security numbers in the U.S., fiscal codes in Italy), credit card information - and then sell these records in underground digital marketplaces. Compromised PII often leads to a loss of customer trust, regulatory fines, and even legal action.

Security system complexity, created by disparate technologies and a lack of in-house expertise, can amplify these costs. But organizations with a comprehensive cybersecurity strategy, governed by best practices and automated using advanced analytics, artificial intelligence (AI) and machine learning, can fight cyberthreats more effectively and reduce the lifecycle and impact of breaches when they occur.

Common cyber threats

Although cybersecurity professionals work hard to close security gaps, attackers are always looking for new ways to escape IT notice, evade defense measures, and exploit emerging weaknesses. The latest cybersecurity threats are putting a new spin on “known” threats, taking advantage of work-from-home environments, remote access tools, and new cloud services. These evolving threats include:

Malware The term “malware” refers to malicious software variants—such as worms, viruses, Trojans, and spyware—that provide unauthorized access or cause damage to a computer. Malware attacks are increasingly “fileless” and designed to get around familiar detection methods, such as antivirus tools, that scan for malicious file attachments.

Ransomware Ransomware is a type of malware that locks down files, data or systems, and threatens to erase or destroy the data - or make private or sensitive data to the public - unless a ransom is paid to the cybercriminals who launched the attack. Recent ransomware attacks have targeted state and local governments, which are easier to breach than organizations and under pressure to pay ransoms in order to restore applications and web sites on which citizens rely.

Phishing / social engineering Phishing is a form of social engineering that tricks users into providing their own PII or sensitive information. In phishing scams, emails or text messages appear to be from a legitimate company asking for sensitive information, such as credit card data or login information. The FBI has noted about a surge in pandemic-related phishing, tied to the growth of remote work.

Insider threats Current or former employees, business partners, contractors, or anyone who has had access to systems or networks in the past can be considered an insider threat if they abuse their access permissions. Insider threats can be invisible to traditional security solutions like firewalls and intrusion detection systems, which focus on external threats.

Distributed denial-of-service (DDoS) attacks A DDoS attack attempts to crash a server, website or network by overloading it with traffic, usually from multiple coordinated systems. DDoS attacks overwhelm enterprise networks via the simple network management protocol (SNMP), used for modems, printers, switches, routers, and servers.

Advanced persistent threats (APTs) In an APT, an intruder or group of intruders infiltrate a system and remain undetected for an extended period. The intruder leaves networks and systems intact so that the intruder can spy on business activity and steal sensitive data while avoiding the activation of defensive countermeasures. The recent Solar Winds breach of United States government systems is an example of an APT.

Man-in-the-middle attacks Man-in-the-middle is an eavesdropping attack, where a cybercriminal intercepts and relays messages between two parties in order to steal data. For example, on an unsecure Wi-Fi network, an attacker can intercept data being passed between guest’s device and the network.

Keyloggers

The term ‘keylogger’ itself is neutral, and the word describes the program’s function. Most sources define a keylogger as a software program designed to secretly monitor and log all keystrokes. This definition is not altogether correct, since a keylogger doesn’t have to be software – it can also be a device. Keylogging devices are much rarer than keylogging software, but it is important to keep their existence in mind when thinking about information security.

Legitimate programs may have a keylogging function which can be used to call certain program functions using “hotkeys,” or to toggle between keyboard layouts (e.g. Keyboard Ninja). There is a lot of legitimate software which is designed to allow administrators to track what employees do throughout the day, or to allow users to track the activity of third parties on their computers. However, the ethical boundary between justified monitoring and espionage is a fine line. Legitimate software is often used deliberately to steal confidential user information such as passwords. Most modern keyloggers are considered to be legitimate software or hardware and are sold on the open market. Developers and vendors offer a long list of cases in which it would be legal and appropriate to use keyloggers, including:

1)Parental control: parents can track what their children do on the Internet, and can opt to be notified if there are any attempts to access websites containing adult or otherwise inappropriate content; Jealous spouses or partners can use a keylogger to track the actions of their better half on the Internet if they suspect them of “virtual cheating”; 2)Company security: tracking the use of computers for non-work-related purposes, or the use of workstations after hours; 3)Company security: using keyloggers to track the input of key words and phrases associated with commercial information which could damage the company (materially or otherwise) if disclosed; 4)Other security (e.g. law enforcement): using keylogger records to analyze and track incidents linked to the use of personal computers; 5) Other reasons. However, the justifications listed above are more subjective than objective; the situations can all be resolved using other methods. Additionally, any legitimate keylogging program can still be used with malicious or criminal intent. Today, keyloggers are mainly used to steal user data relating to various online payment systems, and virus writers are constantly writing new keylogger Trojans for this very purpose.

Furthermore, many keyloggers hide themselves in the system (i.e. they have rootkit functionality), which makes them fully-fledged Trojan programs.

As such programs are extensively used by cyber criminals, detecting them is a priority for antivirus companies. Kaspersky Lab’s malware classification system has a dedicated category for malicious programs with keylogging functionality: Trojan-Spy. Trojan-Spy programs, as the name suggests, track user activity, save the information to the user’s hard disk and then forward it to the author or ‘master’ of the Trojan. The information collected includes keystrokes and screen-shots, used in the theft of banking data to support online fraud.

Hack Facebook Password using Keylogger :

Hack a Facebook password using a keylogger involves the following steps:

STEP 1: Create Server for Hacking Passwords First of all, for hacking any Facebook account password, we have to create our keylogger server that will run on the victim’s machine, capturing his keystrokes and emailing us the record. The keylogger server building process consists of several steps:

1.First of all download the Keylogger and a good binder. Binders are easily available via a Google search. 2.Extract the RAR file. Now you will get one folder and three files. 3.Open the Keylogger file. Here you will need a gmail ID and password. For safer use, create a fake Gmail account and use it 4.Click on server settings as shown. Here, enter the time at which you want to receive reports; it’s always preferable to use a 20 minute timer for receiving files. Click on the Output box to choose the location of the file and give it a name. We recommend using a system process name to make it undetectable, like svchost, or check any process name from your task manager and name it. Other fields are optional. 5.Click on Log and Result Setting. In Log Email Title enter the subject of email like “my keylogger report” or anything else that you you like. Click the last two options that add computer name and add the victim’s name. 6.Now click on “Other Options.” In this section you just have to do one thing. Most hackers prefer warning message POP up, but I prefer keylogger using any message – so unclick the message button. When you bind it with any other software it should not have a warning message attached, otherwise it will be detectable. 7.Finally click on Build Keylogger. You will see your keylogger file at the location that you have chosen in the 4th step. This keylogger server file will be used to bind with other software in Binding Step. 8.Now your keylogger server is ready for you to hack Facebook accounts.

Step 2: Extracting the icon file from any installer (resource hacker)

1.Open the resource hacker folder and select the reshacker file. 2.Go to its menu and open any setup file. Suppose we want to attach our keylogger to a Ccleaner setup file. Open the Ccleaner setup with resource hacker. 3.In the menu, there is one action button. Click on it and then click save all resources. 4.Save all the resources to the desktop or any other location of your choice. 5.It consists of two files. One is icon file and other is res file. We only need the icon file, so you can delete the other one. 6.That leaves us with the icon of installer file

Step 3: Bind the Keylogger server with any software

1.Go to keylogger folder and open the Binder. 2.Click on the button shown below to add files. 3.Add the keylogger server and the setup software (in our case it’s Ccleaner setup). 4.In the Binder menu, go to Settings. There, select the icon that we have generated in the previous step and set the location of the output file 5.Now again go to file’s menu in Binder and click on Bind files. 6.Now your Binded keylogger is ready. You just need to spread it or send it to the victim that is your friend.

Step 4: How to spread the keylogger

1.Now you have one software setup file with a keylogger attached to it. (In our case, we have Ccleaner setup with keylogger attached with it) 2.Spread your keylogger through forums. If you are a member of various forums, use them to spread your keylogger in the form of software posts. 3.Spread it through pendrives or USB hard drives. Suppose a friend asked you for a software, give them the software with the keylogger attached to it on the hard drive.

Built With

• keylogger