Digitization is basically a portmanteau for both the terms “Digital Actualization” and “Digital Realization” coined by very clever men of different times in different parts of the world.

Of course, that called for a debate but by the time one could be arranged, the word digitization was a trend already.

What exactly is Digitization? Why bother with it?

By definition, it is the incorporation of digital technologies in your business.

Pretty lame - why would you do that?

You would do that as it is going to help create revenue, improve business, streamline operations and processes and create an environment based around digital information.

Has ‘Digitization’ married the ‘Internet’?

It has. The era of offline information is over. You barely find CD/DVDs or flash drives anywhere today. Backup image recovery would be one example where you do, but the same can be done “online” too, in a more efficient manner.

If we want to look at the Internet's effect on the global market and small businesses, we need to remember that today internet is the prime carrier of information as well as commerce.

The effects of instant availability of information can be as powerful as they are transformative. The prospect of reaching a worldwide audience opens your portal gates to other dimensions.

The bad part is, you really don't know what all forms of beings hurtle across that dimension and whether it could spawn trouble. Dragon outta portal kind.

Hence as a small business, you still need to carefully examine the effects of the Internet on international markets to understand whether or not an online presence would be the right move.

Some Elaboration?

When we say the word “leveraging” the internet, we are pointing to a very large universe of possibilities. Digitization of a small business inevitably includes everything from selling your stuff online to owning a restaurant/hotel where you provide complimentary Internet access to your customers.

In India ...

For small businesses, the last year has been tough. And with the recent surge in Covid-19, there seems no early respite. However, these problems notwithstanding, small businesses in India do have a bright future ahead - the opportunity to go lean, mean and digital.

Going Lean? Exactly what the doctor advises when we put on a lot of weight - cutting down the unnecessary fat. For an enterprise, going lean means cutting down unnecessary staff, outsourcing processes if the need is and leveraging automation where it helps.

Going Digital? The number of Small-Medium Businesses (SMB) in India stands at 75 Mn, offering a $30 Bn digital opportunity for companies to tap into. Despite the slump, it is predicted to reach a massive $80 Bn.

These Small Medium Businesses constituted more than 40% of our GDP in 2019, cementing their permanent spot on the Indian Economy.

Employment is the next important aspect. Without a massive population, getting our country employed has remained a top challenge for successive governments. SMBs are the best bet in that direction too.

“If every small business creates one or two jobs more (incorporating their leanness), it inevitably means 50 to 100 million new jobs.”
- N. Nilekani

The Digitization Challenge? For change is stupendous at the beginning ...

“Small and medium businesses are the bedrock of any country’s economy, yet the thing about bedrock is, it is not easy to get to.”

Lack of KnowHow leading to fraud.

Even as of 2021, I am sure you will find grocers, retailers near you who don't accept digital payments. The reason?

In some cases, the person is unlettered with negligible knowledge of digital interfaces but most of the time they have been cheated in past by people using screenshots of previous payments.

More than being a play of morally corrupt people, this breach of trust has wider-reaching repercussions and leads to even genuine enterprises being stranded at bay.

Limited Availability of Pocket Friendly Scalable Solutions.

According to estimates, over 90% SMBs in India are small and micro organizations, and such organizations might not require complicated technology tools due to their nature of work.

In case they do, then we are looking at hand-tailored scalable solutions. Solutions lacking scalability are only going to make matters worse as they might also not be affordable for them as many work under liquidity and budget constraints.

Dissipated as Sunrays?

Another considerable challenge is the dissipation factor - the businesses are spread across our country. A fragmented, highly diversified and dispersed market is almost impossible to harness and channelize for any one solution.

Protecting the Digital Move

Be it a payments fraud or a DDoS attack against your fledgling company, the threat of cybersecurity looms large. Specialized products in addition to the adoption of best practices, are of utmost importance if you don't want to fall prey to the dragon lurking behind the portal.

What all can be going “digital” actually help you with?

On the bright side now, and building upon the “portal” hypothesis, incorporation of increased automation and digitization can help you in ...

Enhancing your product/service

Prior to the Internet, business information travelled around via telephone, while most critical information was available via print. Only the large businesses back then would have access to the newest information, providing them with a permanent edge in the market.

This has changed with the increased penetration of the internet and today, a product developed by your micro-enterprise can definitely compete with one from larger companies out of its sheer willingness to “survive” the big ocean of competition.

Marketing your product/service

Today your small business can reach an international audience for a very low cost. Having a website for your business can also serve as a marketing resource being accessible to anyone in the world.

Social media presence itself can help even if you don't have a website - you can still interact with millions of potential clients locally and globally.

Research & Development

Becomes way easier if you have unhindered access to the information needed to build upon. Premade digital libraries, artificially intelligent systems make working on your innovation a piece of cake.

Ease of Managing your business

The Internet makes you more mobile - you can now manage your business from anywhere. You can stay in real-time contact with your office online and exchange important information right from your washroom.

Ease of Expanding your business

In the case of retailers, the credit in big part goes to aggregators like Amazon and the subsequent generation of a wealth of data. This data is then used to tailor the audience as well as services in accordance with your business - for example, better lending options for your enterprise.

When going digital …

You need to keep your eyes peeled for the many services currently available, evaluating and proceeding based on a good understanding of the tools, technologies and offerings when at the table.

It is really important for you to analyze and evaluate these services before making a commitment.

Building Your Own Website

When shifting your offline business to online, building a new website should be your first step. Let it be the centre for all your operations online and make sure the business values you stand for are reflected there.

Make sure to follow the best design and maintenance practices while getting it is getting built. Double-check all spellings and links - the credibility of your business is as good as the quality of your website.

Maintaining it

In the case of online presence, consistency matters more than style and other interesting features. When I say maintain, I am not talking about the regular maintenance you have to undertake anyway, but making sure your online content stays up to date and relevant.

Need Help?

It is completely plausible that a majority of our readers here are still not comfortable with the idea of a website - “sounds easy, but is very hectic” - you must be wondering and in such a case, I’d recommend you visit godaddy.com once. It is an A to Z platform that can get you started quickly.

Namecheap is a competition but mostly restricted to WordPress sites.

Separate space for IT

Needs to be carved out, if you haven’t outsourced your online presence altogether. When established, you need to keep this work network separate from other networks and protect it for the safety of your servers.

Traditional networking tools like firewalls being too complicated and expensive for SMEs, it is a good idea to invest in scalable next gen network solutions like BhaiFi.

Avoid what is strong, attack what is weak

Instead of fighting for market position among the strongest players in the game, carve out a niche (subcategory) or even use the re-seller programs of established websites to help launch your own.

A “Customary” dilemma

For the white collars here - good culinary skills make for an amazing experience, but good culinary skills with access to smooth internet is simply dope. Everyone wants the world to know they are having the most expensive coffee at your outlet.

Sharing your internet connection around can be troublesome - especially if someone commits a cybercrime while connected to your wifi - so if you plan on doing that make sure to check on cybersecurity and get out of jail free card “forensic logging.”

Playing on Feasibility

While underselling competition can draw in customers, too much of a good thing can make your enterprise unprofitable. This is especially true if your online prices are considerably lower than your in-store pricing - instead, invite your customers over to have a look.

Be Ready to Scale

Now, what if the portal spawns gold? Lots of it? Shouldn’t you be ready to receive it all? Your small enterprise may get an explosion of business virtually overnight and you will need to be ready to handle it. Scalable solutions and planning come in critically handy here.

Reaching Out "Glocally" too

It is always a good idea to capture the credentials of local visitors who walk into your store. Similarly, from the moment you launch your website, you should be working to collect the mailing credentials of potential leads.

Offer coupons, have customers register at check-out, take a survey or offer an email newsletter. The more email addresses you have, the more customers you can reach with special offers and intriguing updates.

Protecting Data while guaranteeing privacy

You are going to end up with data - lots of user and employee-related data that would be of great use to you and of even greater use to the cybercriminals. Safeguarding this data is of prime importance to you as its breach can lead to losses with wide repercussions.

And that’s it

With all that said and received, you are all set to open the portal gates - this is the tipping point where you need to sail out of the safe harbor.

Don't worry, this sickening feeling is temporary - once you hit the high seas, the glory is going to be permanent.

Don't forget to share the link of your newly designed website in the comments and if you believe there was we should have covered, don't forget to flag it.

Till next time.

Cheers and Happy Reading!

It is just another day at your office when a guest, probably there to meet somebody, walks in.

Its the age of today and so its naturally impossible (as well as uncourteous) to keep a guest waiting without access to internet.

So, when the guest walks towards nearest receptionist, he is automatically pointed to the QR Code/password for the Guest Network.

Once having connected his device, your guest conducts a quick port scan of your network to look for vulnerabilities.

It is not long before the guest has successfully located the smartphone belonging to somebody from your staff with credentials required to access network admin panel.

Since you have just started off on your business journey, you didn't bother with either securing or managing your wifi network - it is just the beginning and why would someone attack you - nothing of value here, you wrongly presume.

And that is where most of us go wrong - even if your enterprise doesn't hold huge volumes of money, you definitely do hold a treasure trove of user data - name, address, contact etc. that, believe me, are equally lucrative to a cybercriminal.

An unprotected network is like a fish tank for a cybercriminal - it saves their time as they don't have to wait around for potential targets to take the bait - like otherwise on the internet.

Keeping your business running

Now, networking is a big thing - so for simplicity, engineers have divided IT networking into two main components - network management and network security.

Frankly even if the boundary does exist, it is somewhat overlapping and this region of overlap is all we need to keep your business running. At least the online component of it.

A well managed network will be secure in its own right - as it will be easier for the IT personnel to monitor and manage threats and vice versa; it is always easier to manage a properly secured network.

We can conclude that network management and network security always go hand in hand.

Networking traditionally

Has mostly been centered around everything you can imagine - from bulky, serious looking equipment to a horrendous mesh of wires and antennas scattered all around.

And that is still true to a degree, for example this very basic network with at least 1 component of each type -

You don't need to have them all to get your network up and running, but this minimalistic setup serves as a standard for benchmarking.

In a real world scenario - the size of this enterprise network is going to grow with the addition of more people, bringing more devices - laptops, smartphones - making it all the more difficult and costly to maintain, administer and secure if we are to stick to traditional means.

Too Centered around the firewall?

All management and security aspects of this network we discussed above, inevitably center around the firewall.

The firewall - consider it a CPU that has to run 24x7 and is primed to secure and manage your enterprise network. Usually placed at the entrance of your network, the firewall protects it by denying entry to malicious elements.

Being a CPU like entity, the traditional hardware firewall has similar limitations - the hardware.

Imagine investing in the best CPU around today - loaded with best in class processor, RAM, graphics and disk, but will they remain same way a little beyond 2 months from now?

And what is going to be its state after 3-4 years?

In order to operate the firewall, one needs special training focused around its operating system, usually provided by the manufacturer.

Compatibility issues that pour cold water on 'fire'.

A Firewall cannot be integrated with every other piece of hardware you have in your office - integration is difficult, time consuming and impossible in many cases.

The device monitoring - a feature meant to keep a tab on the health of devices connected to your network - is most affected by this incompatibility problem, requiring drastic last minute budget reconsiderations.

As a result of all these complications

Cybercrime figures around the world (and esp. India) have shot up significantly. Just look at the loss, rather wastage of resources (in million USD)

Most small and medium businesses believe that investing in cybersecurity is not just expensive but too cumbersome and mentally taxing for its own good.

And as a matter of fact, given the traditional approach to enterprise networking, this school of thought is not completely unjustified either.

But things are changing fast - Next Generation Networking Solutions

Some milestone technological innovations in networking, in recent past, have not just challenged the traditionalists, but are poised to pull the carpet anytime.

Firewalls are never going to be the same again.

The Floating Cloud - Rapid adoption of cloud has made it possible for manufacturers to better integrate the firewall with threat databases (big libraries containing malware signatures used to compare incoming/outgoing packets).

Cloud has also made it possible for the firewall to be managed by IT professionals working off premise - firewall as a service.

Then, thanks to the better resource availability on the cloud, most of the processing functions of the firewalls have been boiled over (sent to the clouds) optimizing their size and cost.

Software Defined Networking - has not just made the firewalls more flexible, but together with the cloud, has upgraded its performance and flexibility by many a fold.

It has allowed for the application of advanced algorithming - Artificial Intelligence and Machine Learning based models that can now manage and secure your network autonomously.

This completely eliminates the need for skilled professionals to supervise networks.

The one stop supermarket - The next generation networking solutions come preloaded with many features that are not there on basic, even mid range firewalls; remember the complementary features we just talked about.

These include advanced security and management features like IPS/IDS, Deep State Inspection & Analytics, Anti DoS measures, VPN, Application Security and Threat Intelligence platforms.

Firewalls sporting these additional features are known as next generation firewalls or UTMs (Unified Threat Mitigation) platforms - both fancy and mostly marketing terms, but the main takeaway here is that these firewalls (if you want to call them that) can save you a lot of 'getting things up and running' pain.

There can be differences depending upon brands but more or less it is going to be like plus minus one or two features.

A Firewall for Everyone?

Of course and why not?

With the rise of these next gen solutions, it doesn't really matter whether you run a small startup or a large enterprise, the "one size fits all" solutions are finally here.

This brings us to the next important point - next gen networking solutions boast of much better integration, owing largely to the ready availability of hardware drivers, tailored device profiling and automatic troubleshooting.

Once you plug in the firewall, it can autodetect its environment - making subtle adjustments to sculpt a security and management agenda best suited to your business.

NG solutions also prove cost effective in the longer run - even at the end of 3 years your next gen firewall is as good as new.

Its RAM, proc, disk - everything resides in the cloud and its capabilities were scaled to meet the demands of both changing times and your requirements, without even opening the door that leads to your server room.

What wonders would it have been if the same was possible with all devices - RAM automatically increasing from 3GB to 6GB as soon as you install Asphalt 9.

So long??

Frankly with the cybercrimes skyrocketing it was anything but expected for cybersecurity to have repositioned itself as such. Larger enterprises having dedicated network security setups are not the targets anymore with this shift creating a huge vaccum between cybersec demand and availability.

Cybercrimes against SMEs and SMBs have grown by a massive 210% over the past year and that figure too will have augmented 3x in 2021 itself.

Planning to be back soon with an exhaustive list of next gen networking solutions you might want to consider, and if you do have one in mind, don't forget to mention it in the comments, will surely pit it against rivals across all tracks before the list is up.

Also, if you think traditional security does the job better in your case, do let me know that too, along with why you prefer it?

Till next time.

Cheers and Happy reading!

Let’s start our story already - India is lagging behind in Cybersecurity - both in terms of awareness and preparedness. The scale and rate at which we’ve migrated over to digital payments are yet to be consolidated with the cybersecurity framework required to support the same in a healthy and sustainable manner.

If you happen to work in finance/bank, I am sure you must be coming across 10s of digital payment frauds every day, and even if you don't happen to work there, I am again sure that someone you know of personally, has definitely been defrauded within these months past.

“Why so? Such is the intensity!”

Statistically, “Vishing” is the most common successful cyberattack in India  - a dude calls you up, makes you download an app, makes you enter your account details and is off.

Most of the time these rings are controlled and coordinated in a hierarchical manner, meaning even if the caller is traced, he/she is usually found to be a pawn in a much larger game.

Why should we in India be all the more worried?

India is soon to become the world’s largest market for eCommerce, is already the largest market for online payment services and the rate at which the internet has proliferated has ensured that a huge chunk economy has now come to depend on it.

India takes the lead when it comes to cloud adoption and that pace too has been accelerated with the adoption of remote work.

Smart homes/Office spaces are picking up pace too.

All of this digitization presents an excellent opportunity for cybercriminals who, with the kind of sophistication they exercise in circumventing security and exploiting vulnerabilities, can easily churn out big bucks.

The presence of cybercriminals, by itself, is little reason to worry - A bitfence survey reveals 62% of people holding key positions like IT executive/IT managers associated with nameworthy brands failed the basic know-how.

Some good news?

Indeed yes, there is. We are already showing signs of inclination towards cybersecurity awareness with 58% of active concerned staff now finally acknowledging the elephant in the room.

“The problem is, acknowledgement doesn’t necessarily precipitate into a solution - it is just the first step towards it.”

Despite several attempts having been made in this direction, the rate of digitization still outpaces the rate of propagation of cybersecurity awareness.

The Cybersecurity Industry in India

Is still a fledgling.

Fact remains, most Indian cybersecurity companies have little to offer when it comes to some serious indigenously manufactured product.

What is a serious product?

It’s the 21st century and nothing says “keep out” better than a well designed and perfectly balanced …

Firewall

When we talk about cybersecurity and that too on an enterprise level, firewall is your base of operations for securing and managing the network.

A firewall behaves as a gated wall built around your network, separating it from the wild wild web. This gated wall inspects every incoming/outgoing packet to classify it as either “healthy” or “malicious”.

Healthy packets are allowed to pass, while the malicious ones are dropped. Sounds simple ...

But what makes a good Firewall?

Security provided by a firewall depends largely on the type and efficiency of packet filtering - Ingress/Egress/Combined and the presence/absence of an IPS/IDS (Intrusion Detection/Prevention System).

Then, there is this thing called Stateful Inspection which breaks down the packets further to better understand and prevent attacks. Deep State Inspection is an advanced form of the same.

Overall health & well being of your enterprise network - demands keep monitoring and management which in turn depend on visibility.

Features like isolation, segmentation and forensic logging increase the overall maintainability of the network and help the security systems with detection.

Features like Proxy Server and VPN help mask communications, guaranteeing privacy and online data security.

Each of these features plays an important role in compilation of firewall exhibits.

Made in India Firewalls that meet and beat global standards

The three different types of firewalls that made it here fall in different genres - hardware, software, hybrid and have merits and demerits specific to their architecture.

Exhibit #1: GajShield [Type: Hardware Firewall]

Founded in 2002, GajShield has been on an upward curve since its very inception - savouring the last 20 years to simplify and secure networks.

Being the oldest contender on this list, they have a considerable pool of experience to draw from and focus primarily on providing complete security solutions to Corporates.

Coming to the product, they are into Hardware Firewall - The firewall that you have most probably seen if you’ve been to a server room. Placed in front of all routers and switches, this type of firewall uses intelligent functions to detect and block threats from entering your network.

Designed as “keystones’’, once set up hardware firewalls can provide 24/7 protection and are the ‘fastest’ amongst rivals.

This speed + reliability combi comes at a cost - one is the monetary cost (when you scale up your operations and want more bandwidth) and the other is nuisance cost - if you are scaling up your business, you need a newer model - there are hard limits to performance.

Exhibit #2: Seqrite [Type: Software Firewall]

If you haven’t heard of this name before, I can’t blame you, but I am more than sure you must have heard of QuickHeal Antivirus. A made in India Antivirus that for a time was able to give giants like Norton and Kaspersky a run for the money.

Seqrite is the enterprise security wing of QuickHeal - custom-crafted for businesses and enterprises. Most users I have been in contact with the claim it offers one of the best UIs around and is easy to grasp even for beginners.

Insights are relevant and detailed just enough to get the best out of your time.

Coming to the type, Seqrite is a Software Firewall. A software firewall provides endpoint security to host computers - where it has to be installed. They are ideal for small enterprises with light network use.

With software-driven systems, the main drawback remains that the data packets still pass through network switch and router before the software can scan and block malicious packets.

Exhibit #3: BhaiFi [Type: Cloud Firewall]

Lastly, but not leastly, our very own BhaiFi kickstarted in 2015 under make in India fervour and securing your networks ever since. As a by-product of this late inception, BhaiFi has been quick to adopt the latest technologies.

BhaiFi boasts a hybrid nature with multiple advanced network security / management features like IPS, deep state inspection and VPN built into a single unit.

Here, we move onto the third category - Hybrid/Cloud firewall. In this kind of setup, a hardware module is installed on your network, but the firewall software is deployed off-site in the cloud.

All of your updates, (in fact even your network itself) can be managed off-site automatically, and you can easily scale your systems to meet the demands of a growing company.

The disadvantage with most cloud firewalls globally, is the pricing of course - cloud systems are difficult and expensive to maintain for vendors, and therefore negotiating a beneficial SLA for your organization is somewhat of a challenge.

Which one should you choose?

For starters, it is always good to opt for more scalable solutions - software/hybrid firewalls but as the organization grows in size, taking more comprehensive measures (hardware/hybrid/next gen firewalls) to secure and maintain the ever growing huge network becomes really important.

Parting Words

Era rapidly progressing, our entire lives are steadily moving to a digital environment and so we need to have trust in our institutions - government and private - while understanding there are criminals out there who ply on circumventing any protection that will be put up.

But not to worry, all epic journeys start with a single step and this was an ode to 3 of those steps.

Don't forget to let us know in the comments which type of firewall do you think is the best option for your network and why. Till the next time.

Cheers and Happy Reading!

What is common between a business, a bird’s nest and a whole civilization? The answer is, it takes years worth of time, labour and effort to build them up while it takes just one single disaster to bring them down.

One such disaster is that of a Cyberattack. If at this point in time you are amongst the lucky 57% of small businesses that have not faced a cyberattack to date, congratulations, you can take measures now.

38% of businesses amongst the unlucky 43% would tell you how not investing in cybersecurity led them towards a cumulative loss upwards of $3.92 million.

And then, not every loss can be calculated. There are some things we earn at a slower rate than wealth- things like -

Reputation: Holy grail for every startup that gets shattered by one single data breach which is easier for a hacker to pull, than we think.

Credibility: Now imagine if the hacker sells your information online, how do you prove that this was not an insider job? You might end up getting your banking or credit card facilities withdrawn!

Client Goodwill: Loss of a loyal clientele is anyway more crippling than the actual data loss.

Peace of Mind: After the attack takes place, you would spend ANY amount to deal with the situation.

“Less than a hundredth of the investment at the right time could have saved the day!”

Self Esteem: Commonest attacks - Ransomware delivered via Phishing Mails attack your mind rather than your network - encrypting your data with a 2048 bit encryption key, decrypting which is going to take trillions of years on a standard 8GB RAM system!

Tensed already? Don’t be. Now that you are here, your journey towards a secure, stable and high performing workspace internet has already begun.

Small business cyber attack examples

Premises first- we are only looking at the attacks against SMEs and the attacks which are common (P(Attack Type=X) > 0.62). We need to keep to the premises because

1. Attacks can be overlapped
2. Hackers are innovating fast.

DDoS Attack: Distributed Denial of Service attack aims to flood your network with bogus traffic to overwhelm your servers. Sometimes you might not even realize because of the low volume of attack since in that case, it is usually a Hacker trying to "probe" your network infrastructure for vulnerabilities.

DNS Amplification Attack: A type of DDoS Attack that leverages the Domain Naming System (DNS) to conduct a MORE POWERFUL DDOS from a relatively weak device. Collectively these types of attacks where the hacker leverages the existing internet infrastructure are commonly known as “Reflection Attacks”.

Malicious Port Scan: Remember the hacker trying to “probe” your network for vulnerabilities? Well, that probing is carried out via Port Scanning. Malicious bots scan for open ports or known devices on IP ranges to create a target list.

Targeted Attack: Takes place when the cybercriminal has been following you around the internet to find out important things about you and is now using the same to launch an attack like SQL Injection (SQLi), Cross-Site Scripting (XSS) or Man in The Middle (MiTM).

Ransomware: As discussed will encrypt your data and ask you for ransom should you ever wish to see it again. Notorious for spreading fast, usually the ransomware is spread around via ...

Phishing Attacks: Mostly carried out via (but not limited to) Emails that carry malicious links and all the convincing content required to get you to click, which in turn invites the malware into your system or network. The link could be directly visible, hidden within attachment, image, text - possibilities are endless!

Crypto Jacking Attack: Embeds an undetectable malware into your system that harnesses your processing power behind your back to mine cryptocurrency for the cybercriminal at the expense of your infrastructure.

IP Spoofing based Attacks: The attacker will impersonate a device or user recognized by your network and then launch attacks against hosts, steal data, spread malware or bypass access controls.

What should cybersecurity for a small & medium business look like?

To secure your network, you need a professional cybersecurity solution, the essence of which lies in its IDS/IPS (Intrusion Detection/Prevention System), primarily tasked with filtering the traffic entering/leaving your network.

If the traffic is healthy, it is allowed to pass, if it is malicious, it is blocked. But ...

How does the IDS or IPS know which one is a healthy packet and which one is not?

It refers to a database known as a threat database.

Now since storing data (or even metadata) of all threats that have ever emerged in this world is impossible given the diversity and ingenuity of cybercriminals, this database store rules formulated based on what we call “indicators of compromise”.

“Right from detection and mitigation to the prevention of future cyberattacks, indicators of compromise are what you should be looking out for!”

Although you still need a network monitoring solution to be able to look for these indicators, timely detection can help IT personnel prevent major impending attacks or breaches and plug security vulnerabilities.

Top Indicators of Compromise

Don’t panic, but be alarmed when your network comes across-

Failed Login Attempts: It is completely human to forget passwords or enter the wrong ones by mistake. However, if you witness continuous repeated failed login attempts or login attempts outside of office hours, it could be a cybercriminal attempting to brute force their way in.

Mismatched Traffic: Always keep your eyes open for the port-application mismatch. Command-and-control (CNC) traffic is important to an attacker because it allows them to manage an ongoing attack and can be spread over port 53, masked as a DNS request or over port 80, masked as an HTTP request. If an application is using an unusual port, it could be CNC traffic masquerading as "normal".

Abnormal Traffic: Computers infected with adware/spyware/malicious trackers generate observable volumes of traffic in short bursts. This should be immediately red-flagged as it doesn’t match with normal human browsing behavior.

DNS Exfiltration: Malicious CNC traffic can also be caught by closely monitoring DNS requests. A spike in requests from a specific host or DNS requests to external hosts with GeoIP anomalies and suspicious reputation data indicates potentially suspicious activity.

Database Bandwidth Spike: If an attacker is trying to extract sensitive information from your database, it generates an enormous amount of read volume, much higher than what you would usually see when the data is being accessed in a more procedural manner.

Inconsistent Outbound Traffic: Monitoring outbound traffic is as important as inbound traffic! Compromised systems will try to communicate with their command-and-control servers, and if you are able to intercept this traffic in real-time, you can move to block it.

Privileged Account Anomaly: Attackers try to gain control of admin accounts or they try to escalate privileges of accounts they've already compromised. Keeping tabs on unusual account behaviour from privileged accounts such as time of activity, systems accessed, type or volume of information accessed can help drastically reduce such attacks.

Geographical Irregularities: Connections, logins and traffic to and from countries your company doesn’t usually do business with should sound the alarm. Same is the case with one account logging in from multiple geo-locations within a short period of time. Keeping custom tunnel settings for VPN can help distinguish employees in this case.

Unwanted Programs, Patches and Files: Software that gets installed on your systems (usually as a patch or update) abruptly is a cause for concern. Abruptly means at a time when a manufacturer like Microsoft or Linux has not notified an update in advance. These ‘patches’ can contain potentially harmful software that can infect your network.

At least in theory, if you take these precautions, you are safe. In reality, there are many more things we need to keep our eyes peeled for and these things move really fast. Registry Anomalies would be a good example here, though it has several iterations and keeping track isn't always easy.

Parting Words and Takeaways

The role of cybersecurity for your organization is as critical as that of any other department and if implemented properly, can guarantee sustained productivity, high returns and seamless peace of mind.

It is always better to invest in a professional cybersecurity solution given the wide variety of attacks and the sheer number of indicators of compromise.

Don’t wait for something to happen, as there is a 50% chance it won't be to your liking. ;-) Simple math!

Cheers and Happy Reading!

A distributed denial of service (DDoS) attack is a malicious attempt to disrupt the functioning of your system, network or server by making it impossible for a service to be delivered.

In its simplest form, the DDoS is carried out by flooding the target system with high speed, high volume of bogus traffic with the final aim of overwhelming the target system.

The target system gets overloaded processing bogus traffic and the “service” is “denied” to the genuine traffic, hence the name.

DDoS can be carried out against virtually anything: servers, devices, networks, cloud drives, applications or even specific transactions or services within those transactions!

Usually the attack conducted against a network, augments over time- it begins with probing traffic that maps network infrastructure, progresses to overwhelm monitoring and security infrastructure and then finally sweeps across the entire network like a tidal wave.

Why bother?

Why we must all be concerned about DDoS is because they have been increasing in both intensity and frequency - and steadily!

Well Exponentially Steadily! Just look at the growth rate of DDoS attacks!

For 2011, it was an increase of 11%,

By 2016, the increase had increased to 35% and

In 2020 (last year), the number of attacks tripled in volume with a recorded increase of a massive 200%!

Availability of cheap virtual servers, advanced botnets and high returns in form of ransom and stolen data make DDoS a lucrative attack for cybercriminals.

Difference between DoS and DDoS attack

A DoS (Denial of Service) attack is carried by one single system that sends the malicious data or requests while a DDoS attack involves multiple systems sending those malicious queries.

These multiple systems may either all be owned by the hackers (like a seedbox for torrents) or they might be slaves (or bots) controlled by one master system (belonging to the hacker), through malware.

This network of slaves (or bots) is known as a botnet (network of bots).

How is a DDoS attack performed? What are DDoS Attack Tools?

In reality, an effective DDoS almost always requires high end hardware or a robust botnet, both of which require considerable investment in terms of time and resources.

However, if you want to check your existing device/network security systems for vulnerabilities, or maybe DoS somebody for fun (don’t do that!) Here is how to do it.

A fairly simple and fairly effective (in case of DoS attacks) is the open-source LOIC (Low Orbit Ion Cannon). As you can see, it is easy to set up and use - a good tool to test individual device safety and with proper modifications - a deadly weapon.

Then for a DDoS attack, it is recommended you set up a small botnet of at least 5 machines and clean them later on. Get the tools RUDY and HULK up and running on all machines with process permissions explicitly granted.

Start with RUDY (RU Dead Yet) to probe a network for vulnerability with slow rate HTTP flooding. RUDY can then generate and export the vulnerability report.

Once you know the way in (mostly recommended settings based on the report) HULK (HTTP Unbearable Load King) can be used to generate unique HTTP requests to attempt flooding.

Types of DDoS attacks

Depending upon how they are carried out, DDoS attacks can be classified into 5 main types.

Volumetric DoS

Most common type of DDoS where the attackers overwhelm your systems by flooding them with massive amounts of bogus traffic. Now this section too, can be broken into direct attacks that bombard queries and the more sinister reflection attacks that flood DNS reply requests. More on that in another dedicated article.

Fragmentation DoS

So any data that you send or receive over the network, is transmitted in fragments (or pieces). The receiver then has to rebuild those fragments to recreate the original data.

In this attack, the attacker overwhelms the reassembling ability of your receiver system by bombarding it with faultily fragmented packets.

Network-Layer DoS

In this case, the hacker pushes through large numbers of malicious packets (SYN floods, Ping of Death or Smurf DDoS) into your network, capable of COMPLETELY OVERLOADING AND DISABLING your server (if unprotected) or intermediate communication equipment (Firewall/DMZ/Load Balancer).

State Exhaustion DoS

Now today, the hacker will tear down the state tables present in your network servers or communication equipment (Firewall/Load Balancer).

The TCP connections will get distorted and within moments your registry is overwhelmed, tables lose consistency, and a DDoS attack is here!

Application-layer DoS

Malicious request type attack carried out by exploiting glitches (bugs) in the application. Hence, you guessed it right, this is also known as a “0-day-DDoS”.

This one is harmful and nasty as it can target even specific services within infected applications - say denying your website’s billing page or exploiting your consumers who land there.

DDoS Attacks Examples (Famous DDoS Attacks In History)

Dyn DNS DDoS Attack

Attack targeted Dyn, an internet infrastructure services provider. Dyn DNS (Now Oracle DYN) was struck by a wave of DNS queries from tens of millions of IP addresses. That attack, executed through the Mirai botnet that had an arsenal of over 400,000 slave systems (bots).

Github DDoS Attack

A 1.35 Tbps of traffic struck the developer platform GitHub in Jan 2018. GitHub struggled with their monitoring and security systems and sought help from Akamai Prolexic who took over as an intermediary, routing (casting) all the traffic coming into and out of GitHub through their threat management centres to weed out and block malicious packets.

Amazon DDoS Attack

In Feb of 2018, Amazon Web Services had to defend against a DDoS attack with a peak traffic volume of 2.3 Tbps, the largest ever recorded. Amazon said that the attack was mitigated by an advanced anycast based threat mitigation system - AWS Shield.

How to prevent a DDoS Attack?

Comprehensive protection like one offered by tools like Firewalls and unified threat mitigators are required to fend against DDoS attacks. In case one happens we have to rely on casting techniques to divert the attack before engaging backup systems.

Following are some tips to help you mitigate the risks of a DDoS attack against your network. They involve,

• Proper monitoring of all traffic entering and leaving your network and its trend.
• Beefing up the server farm infrastructure by including better casting techniques like multicast and anycast to handle large no of requests and get a bigger bandwidth.
• Performing regular network analysis/vulnerability testing to find out the possibility of a DOS attack and set up thresholds.
• Rate limiting the traffic allowed from one source: to about 5 requests/sec. A rate of more than 15 requests/sec from a single source can be a DDoS.
• Adding load balancing lines on throttle logic to absorb and control traffic.
• Shutting down (pruning) unnecessary services on your network.
• Performing proper and ingress/egress filtering with in-depth packet analysis to filter out unwanted traffic.
• Regular activity profiling. What type of traffic does your business have to usually deal with? Profile it, and use that to compare anomalies.
• Reducing system vulnerability by rectifying program errors. Use the tools we discussed above to test.
• Following Whitelisting Approach, rather than blacklisting malicious sources.

OR if you want to save all that time and hassle and still want to make sure your network is prepared to deal with DDoS attacks, you can do so by SIGNING UP for BhaiFi. It is going to automatically take care of everything, so that you sit back, relax and enjoy!

Cheers and Happy Reading!

Starting with what port scanning is - It is simply the process of sending packets to specific ports on a host network to determine which ports are open to sending/receiving data.

An analysis of these ports on your network can help you identify vulnerabilities which is why most IT personnel carry it out routinely.

In order to conduct this scan, you will first have to conduct a network scan. Make a list of active hosts and map them to their IP addresses.

When a cybercriminal conducts a port scan of your network, he/she is looking for vulnerabilities that can be exploited to gain access to your network.

Why Bother?

After completing a successful scan, the hacker is able to get his hands on valuable information critical to the safety of your network, such as

• Nature of your business
• Nature of your networking operations (reveals a lot)
• Dynamics of data inside your network
• The operating systems you use
• The Firewall/Routerguard Model and version
• Network Consistency Table status
• Status of all connected infrastructure
• Critical information about everything else connected to your network

What is a port?

Well, a port is a harbour - where the freighter picks up our goods, travels across the ocean - only to arrive at another port. In computer networks too, a port is a place where the data that is to be sent or received is parked. If your computer is a house (identifiable by home address), then ports are your gates.

In order to make life easy for techies, each port is denoted by a port number. (Port Number + IP Address) form the combi that can be used to pinpoint your device on the network.

Port numbers range from 0 to 65,536 where 0 to 1023 are used for communication/special purposes, 1024 to 49151 are registered ports and 49,151 to 65,536 can be used by nearly everyone, playing a role in exploits.

How do we scan this port or network? Whatever?

There are a bunch of Port Scanning Techniques around, each with its own set of pros, cons and use cases. To start off, of course, you need the host list first which is obtained by conducting network scans.

Network Scanning allows you to determine all active devices on your network by sending a ping to each device on the network and awaiting a response.

Once this initial step has been completed, you are all ready to scan the ports - types and techniques of which are as follows.

Ping Scan

Ping Scan sends an ICMP echo request to the target (or across the whole network, if the target hasn’t been identified) to check if it is open. If the response is an ICMP reply, it means the port is open if there is no response, it means there is a firewall guarding the network.

TCP Half Open

This relatively commonly used port scan sends a packet with the SYN flag set and waits for the SYN-ACK from the target. Unlike a regular full TCP connection, the sender does not reply with an SYN-ACK response packet, since the SYN-ACK received is enough to determine the state of the port. This makes the entire process extremely fast - you can scan 1000s of ports every second.

TCP Connect

This is essentially the same as the half-open scan above but instead, we finish the handshake process and establish a connection by sending the final ACK packet. This is a much slower means of port scanning as it takes more packets to finish.

Response analysis for both these TCP based techniques is similar;

Successful handshake = open port,

RST (reset) packet = target is alive but the port is closed,

No response = target is alive but the port is filtered.

UDP

UDP scans work by sending a packet, which is usually empty. These scans are slow, and UDP is directionless - you can never be sure if the packet got to its target in the first place.

Response analysis is a little trickier here;

ICMP unreachable error = port is closed.

ICMP unreachable error + other error codes = port is filtered.

No response = port is open/filtered. Here, you need the “version enumeration” to determine if there is a firewall blocking communication.

Advanced Scanning Techniques  – NULL, FIN, X-MAS

These types of scans are also known as “stealth scans” because here we are trying to induce a response from the target without going through the handshaking process.

They are impactful as the techniques required are fairly simple and they cannot be traced by most logging tools - only high-end firewalls and BhaiFi Time Machine can trace them.

What makes them different from TCP Half Open? The way the packets are crafted- most of these packets like the ones used in FIN and NULL type stealth scans - shouldn't even exist.

Well, I cannot explain their functioning here, do let us know in the comments; we’d be more than happy to discuss the same in an upcoming article.

How to do a basic open port scan on Windows?

The Windows operating system comes loaded with this command-line utility called netstat.exe that can be used to determine open ports on a particular host. (Yes this cannot scan the whole network).

To view which ports are listening (open) on a local host type the following command in prompt:

netstat –an ¦find /i “listening”

The results will be displayed across 4 columns – the protocol type, local IP address and associated port number, foreign IP address, and state.

You want to look at the 2nd column (local IP address with associated port number), the state of which can be affirmed from the 4th column.

What is a Port Scanning Attack?

Port scanning almost always precedes any major cyberattack. It is the most popular recon tactic used by hackers when looking for vulnerable servers.

This problem becomes all the more acute because, as discussed, there are scanning techniques that do not appear in security logs. To cover tracks better, attackers also use “decoy traffic” to perform port scans without revealing any network address to the target.

Attackers probe networks and systems to analyze how each port will react — whether it’s open, closed, or filtered and what is the nature of security.

Once complete the hackers use the open ports to deploy their malware. It is an excellent method of pumping malware directly into a network. The hacker can easily save the time they would have otherwise wasted on social engineering the infection.

Usually, the malware of choice is a CNC (command and control) malware capable of lateral movement within the network like a RAT (Remote Access Trojan).

Once safely inside the network, the malware causes disruption, steals data, mines cryptocurrency, locks down your data for ransom - depending upon how good or bad your stars have aligned on that particular day.

Malware is just one part of the story. Open ports can also be used to conduct denial of service attacks like DoS and DDoS.

How to Defend Against Malicious Port Scanning?

Most effective ways of detecting and avoiding Malicious Port scanning requires comprehensive security measures with up-to-date threat intelligence because protocols and security tools are evolving daily.

• IPS (Intrusion Detection and Prevention System) is specifically designed to address the control related issues with respect to open ports.
• They can be availed separately as well as parts of higher end firewall systems.
• Packet filtering firewalls can also detect a port scan in progress and shut it down, but require the proper policy implementations.
• More autonomous solutions like next gen firewalls can go a step further and detect even the dummy traffic used by hackers as a decoy, keeping you a step ahead.
• Using Wrapping: TCP wrapper allows you to control access to the servers based on IP addresses or domain names, especially effective on Linux and BSD.
• Plugging the holes: Conduct your own port scan to determine if there are more ports open than required.
• Check your system to determine existing weak points that could be exploited and take measures to prevent the same.
• Threat intelligence: Plays the most important role here. If intrusion is detected, ports should be shut ( by disconnecting remote access, shared drives etc) and active measures should be taken to reboot in safe mode.
• Remember, port scans only precede a major attack.
• Take measures to ensure that operating systems and firmware stay up to date with latest security definitions. More often than not it is the vulnerability associated with the old system that gets compromised.

Parting Words

That was all about that, with some minor alterations that are always there. Isn't it kinda funny how 3 states of a port can be used to determine so many things about your network and machines? I feel so.

Hope this was able to help you get better acquainted and hence better prepared against the threat. Anything you believe we missed, or is not clear, fire a question right there in the comments below and don't forget to sign up for our weekly newsletter to stay a step ahead of cybercriminals, always.

Cheers and Happy Reading!

Ransomware is a malware that uses strong encryption techniques to lock down your important data. The cybercriminal who has infected your system with the ransomware then demands a ransom with a deadline. Fail to make the payment within the given time and your data is lost forever.

An almost impossible to decode 2048-bit encryption key makes sure you spend a higher amount trying to figure it out - yes an 8 GB RAM system will take trillions of years to crack it. In such a case, accepting the demands of the attackers become a smarter choice.

What is this ‘encryption’ thingy?

When we say that something is encrypted, we mean that it is converted from a readable format like this -

To something like this-

Readable only by machines. And there too, not every machine can read it though - to convert it into readable English again, you need the mathematical key we just talked about.

Why Bother?

Simply put, Ransomware is easy money and big bucks! The ransomware market has expanded rapidly since the beginning of the decade. In terms of the amount of ransom paid, time lost and other related costs,

In 2017, ransomware resulted in $5 billion in losses,

In 2019, we saw them grab some $11.5 billion and

In 2020, this figure stood at a massive $20 billion!

That is a 4X increase in a span of just 3 years! Based on the trend we can only wonder what 2021 has in store for us.

Businesses particularly prone to ransomware attacks are Hospitals, MSMEs, Coworking Spaces and Hospitality Chains, as these businesses have become increasingly reliant on the internet and their security standards are not up to the mark. It's estimated that 35% of ransomware attacks target healthcare orgs, 28% attack MSMEs and another 17% have been known to target Coworking Spaces.

How Ransomware Attacks - The Threat Vector

For Ransomware, the most common delivery system is a Phishing Email - through attachments masquerading as a file coming from a source you can trust. The goal is to get you to click on the link, on the image or download and run the attachment.

Although it is possible for ransomware like NotPetya and WannaCry to penetrate your network, without your clicking anywhere by simply leveraging the security loopholes, attacks like that are extremely rare.

Once the malware makes it to your system/network, it begins by disabling your security before proceeding to encrypt your files.

Where did it all begin?

The first known malware extortion attack was carried out in 1989 by Joseph Propp, using his "AIDS Trojan". This particular attack was easily defeated owing to a severe design failure - the malware simply encrypted the names and hid the files on the hard drive.

But, the idea of a trojan deployed to extort quickly caught the fantasies of several criminal-minded coders from around the world.

Types of Ransomware

The Encryptor (The locker)

The usual guy around, Encryptor leverages strong encryption to deny you access to your files. In most of cases, the encryptor does not lock down your interface, though it does use overlays to deny access to your security dashboard.

The Exfiltrator (Leakware)

The steps of attack are almost the same - data is scanned, critical files are located, prepared (moved to encryption directories) - but instead of being encrypted, it is exfiltrated (hijacked). Your data is leaked to the attacker, earning it the name - leakware. The attacker will then threaten to publicize your sensitive data unless a ransom is paid.

The Blocker (Smartphone Ransomware)

Since mobile devices are ‘always awake’ and always in sync with the cloud, restoring data is not a difficult thing to do. Due to this, the ransomware that attacks smartphones is essentially a ‘blocker’. It targets Android's core functionalities using ‘clickjacking’ and uses an overlay to display a blocking message.

Some High-risk Ransomware

CryptoLocker Ransomware Attack: First reported in 2013, September, Cryptolocker is the harbinger of the modern age of ransomware. It infected up to 500,000 machines at its height.

WannaCry Ransomware Attack: Unlike the usual Trojan based Ransomware, this was the first of its kind based on worm architecture - the WannaCry cryptoworm. It propagated through EternalBlue, an exploit (security loophole) on older Windows systems.

Since Microsoft had immediately released patches to close the exploit, many of WannaCry's victims were people who DON'T UPDATE THEIR SYSTEMS REGULARLY.

WYSIWYE Ransomware Attack: Wysiwye (What you see is what you encrypt) scans the web for open Remote Desktop Protocol (RDP) servers, steals admin credentials and then brute forces its way inside the network, making it exceptionally good for targeted attacks.

GandCrab Ransomware Attack: GandCrab, the terror of 2018, is the most lucrative ransomware ever, to a hacker. Sold as RaaS (Ransomware as a Service), GrandCrab based malware have claimed more than $2 billion in victim payouts. The infamous Sodinokibi is one such GrandCrab based strain.

Thanos Ransomware Attack: Thanos is the most disruptive ransomware detected thus far. It leverages the RIPlace technique to bypass most anti-ransomware systems. Thanks to a highly developed UI, customizing Thanos is a matter of minutes for anybody.

How to remove Ransomware from your system?

Removing Ransomware is not difficult, just like any other malware it can be removed from your system by an antivirus.

Hit Win+R and type in “msconfig”.

In the System Configuration box that opens up, go to the second tab (boot) and click on the radio button next to “safe boot”.

Install an antivirus if you don't have one and run a full system scan. (A boot scan may be required, the antivirus will inform you.)

Allow the scan to complete and “quarantine” the malware files that are found (don't delete them).

Does it help? Hell NAH! XD Your Data is Still Encrypted!

And had I not told you to quarantine the ransomware instead of deleting it, you would have lost your chances of paying the ransom and getting your files back as well. Go back to your quarantine and restore and allow it- the damage has already been done.

Ransomware Prevention - The key lies in blocking it!

On a more reassuring note, if you follow the cybersecurity best practices in general, you have an upper hand already! Ransomware is ultimately a malware and can be blocked by both endpoint and network security solutions.

The essence of dealing with Ransomware lies in BLOCKING IT AT THE ENTRY POINT - either when it is entering your machine (by antivirus) or when it is entering your network (by firewall).

Stopping it before it gets inside your network is always the better bet as you can save everything inside and hence we recommend availing a comprehensive cybersecurity solution like a high-end firewall or BhaiFi to guarantee the peace of mind you are looking for.

If however, you intend to continue without that, here are some tips that can help.

• Keep your operating systems patched and up-to-date to ensure you leave fewer vulnerabilities for the hacker to exploit.
• For Windows, set ‘Core Isolation’ to active in Defender. This feature isolates the core files of your system, making it difficult for ransomware to take footing.
• Use Folder/Directory locking software.
• Don't give administrative privileges to unverified software unless extremely sure of its functionality and authenticity.
• Make sure your IT team is extra careful with remote access.
• Install antivirus software - even a free version - it can still detect malware and actively block them. Browser extensions of these antiviruses are also very helpful.
• Go for Whitelisting software - Only the trusted applications would be allowed to ply on your network and devices, increasing security.
• And, of course, make a habit of taking regular backups of your data. It won't stop an attack, but it can make the damage caused by one seem much less significant.

And most importantly- stay vigilant. Cybersecurity is always a human problem.

Conclusively Enough

Ransomware attackers know their trade well. They keep prices relatively low - an amount companies can usually afford to pay on short notice. Additionally, what looks like ransomware may not have actually encrypted your data at all!

Before making the ransom payment, make sure you aren't dealing with a "scareware popup”. See if it is possible to minimize the extortion message screen and access files.

Hope this was able to help. Do let us know in the comments if there is something we missed out and don't forget to sign up for our newsletter for fortnightly updates.

Cheers and Happy Reading!

Starting off with what this CryptoJacking attack is - it is an innovative cyberattack - one of the few where the injected malware is NOT after your important data.

The Cryptojack DOESN’T even want to cause disruption, in fact, it wants your system/network to function at its best!

Seriously!

All this crypto mining malware wants to do is harness your processing power to mine cryptocurrency for the hacker who planted it on your machine/network.

The method of spreading a cryptojack (threat vector) is nearly the same as that of any other malware - from a malicious link in an email or an infected download file/application to auto executing javascript.

Why Bother?

Though limited in number as compared to other mainstream cyberattacks, cryptojacking is slowly picking up pace with a 200% increase in the number of attacks since 2017.

The sophistication of attacks has gone up too with emerging cryptojacks steadily targeting android smartphones in addition to PCs and laptops.

The main attraction for the hackers seems to be the low-risk high payoff factor. Worst that can happen - you will detect and remove the cryptojack - the hacker will then innovate and make his malware stealthier.

What culminates to all this - we’ll look at that but let's see the whole picture first.

What is Cryptocurrency?

For a better understanding of cryptomining malware, we need to first know what cryptocurrency is and how it works.

Cryptocurrencies are encrypted digital currencies created as an alternative to traditional money that exists only in soft copy and the money is protected with cryptography - an encryption technique that makes it nearly impossible to counterfeit or double spend.

The “Coins” of cryptocurrency are basically entries in a decentralized database - a distributed ledger maintained by a network of individual computers.

Now if you use your computer (basically its processing power) to verify transactions on this ledger, you will receive some “coins” in return and this process is called mining.

How does your processing power help?

Special administrative computers collect data from the latest cryptocurrency transactions every 10 minutes and turn them into a mathematical puzzle.

Now, to verify this particular transaction, you have to solve the puzzle it has been converted into. ‘Solving’ this puzzle is exactly what we call ‘mining’.

The miner who solves the puzzle receives some amount of cryptocoin as a reward.

“However, with an increase in the number of miners, the complexity of the puzzle calculations has also augmented over time and today even high-end machines cannot mine profitably enough to cover the costs involved.”

For instance, A bitcoin mining farm can cost up to $80K every month in electricity bills.

Enter CryptoJacking - The way around these bills?

Just asking - what time would it have taken for a criminal mind to come across the idea of “stealing” this “processing power”? Well because that is what this cryptojacking is all about.

Instead of paying for an expensive mining computer, hackers infect a large number of regular computers with ‘cryptojack’ (a Remote Access Trojan based malware) to create a botnet (network of bots or zombie computers).

The malware allows the hacker to control this entire botnet and harness the processing powers of individual systems to mine bitcoin. Since the malware doesn’t have any symptoms, users end up believing their system has slowed down due to age.

How does Cryptojacking Work?

Cryptojacking is of 3 main types based on how hackers get hold of your machine. They either

Infect System

Hackers trick the victims into loading crypto mining code onto their machines, through carefully crafted, genuinely convincing phishing emails. Once you click on the link in the mail, a code runs that installs the cryptojack.

Infect Browser

Hackers inject a script on a website/ad/applet that is delivered to multiple websites. Once victims visit the website script automatically executes and the malware infects their browser.

It is important to mark that since no code is stored on the victims’ computer, most anti-malware programs cannot detect it.

Infect Network

Also known as ‘cloud based’ cryptojacking, this is a targeted attack where the hackers probe the network, exfiltrate API keys and consequently gain access to your cloud drive. Once there they siphon off CPU resources for cryptomining.

Far more profitable as compared to the browser or system based cryptojacking as the gain in computational power is significant.

More often than not, hackers usually use a combination of both - browser and system based cryptojacking to maximize returns. Again, since infecting browsers is easier and stealthier, 80% of cryptojacks are browser-based and about 20% are device-based.

Cryptojacking Facts and Trivia

• A fresh installation of an OS gradually slows down over time due to cache/prefetch data; so a slow system is not a litmus indication of a cryptojack.
• It is possible to program the cryptojack to utilize only a certain number of cores of your processor, say only 2-3 of them, to trick you into believing that the machine is slowing down naturally.
• Some rare cryptomining scripts have worming capabilities that allow them to infect other devices and servers on a network.
• Some others include multiple versions matching different architectures on the network, to allow for better spreading. A cryptojack might also simply download the implants for each architecture until one of them works.
• Cryptojacks can detect and remove competition. As soon as the script installs, it scans your machine to see if it is infected by competing cryptomining malware.
• The cryptojack can also scan your machine for your cryptocurrency wallet private key and exfiltrate it to the hackers. (If you do use some cryptocurrency).
• Thanks to cheap hardware manufacturing, China mines over 75% of the bitcoins and is yet to apprehend any impactful cryptomining campaign.

How to detect and prevent cryptojacking?

Cryptojack, like any other malware, can be detected and blocked by antiviruses and firewalls. On a personal scale, it is not much of a challenge if you follow the personal cybersecurity best practices.

The real challenge lies in dealing with a cryptojack in a professional (business) internet network. Not only are we dealing with a powerful network infecting malware, but things become increasingly complicated with the size of the network.

Add the BYOD factor and situations seemingly start getting out of hand.

In such a case a comprehensive solution like a well-configured hardware firewall or AI-driven cybersec solution like BhaiFi is strongly recommended if you want to be 100% sure.

Still, a lot can be saved, if you-

• Conduct periodic performance/security audits and device profiling drives to keep a tab on anomalies that might be indicative of a cryptojack.
• Standardize your software and familiarize all users with the resources utilized by it. Train them to raise an alarm immediately as they notice anything odd.
• Organize cybersecurity awareness workshops to help users detect phishing emails, malicious ads and website links. Cryptojacks are mostly delivered by emails and infected websites.
• Software (Endpoint) Firewalls and Antiviruses can help detect and block cryptojacking software.
• Enforce basic web content filtering at least and if possible, use the whitelisting approach as recommended by our security experts.
• Browser extensions can help. Unchecked Malicious Ads are rigged by hackers to spread cryptomining malware and ad blocking extensions like Adblock can help block them.
• Similarly, browser extensions of Antiviruses can effectively block compromised websites, malicious scripts and compromised downloads.
• In case the worst comes to pass, always conduct root-cause analysis to identify how the malware got installed. This can help formulate the security policy for the future.

Parting Words

While these tips can definitely help you ward off the majority of attacks, it must be stressed yet again that running an enterprise without comprehensive network protection is like leaving the gates of your home open at night.

It is an open invitation to cybercriminals and should someone decide upon a targeted attack, you have no defence against that at all. To know more about what all attacks your organization can face, check our series here.

So hopefully that’s about all you wanted to know about cryptojack - the cryptomining malware. If it wasn’t we are all eyes and ears.

Cheers and Happy Reading!

It is not uncommon for businesses to lose critical client information, trade secrets and intellectual property to their rivals. When we try and deduce these cases, we realize that the organization at the receiving end has been a victim of a targeted cyber attack.

Why Bother?

Targeted Attacks are Specialized - The malware that wrecked your enterprise was specifically designed to target your network. They knew your strengths and weaknesses.

Recovering from them is another story  - You can be sure that the hackers have been following you around the internet for a while. They probably know a lot about you including how much money you can cough up closing any window for a bargain.

Moreso, as of now, a staggering 85% of organizations have reportedly been hit with spear phishing, the lethality, as well as convincingness of the same, has gone up dramatically.

Talking of the whole picture, targeted attacks which used to form 41% of all attacks back in 2010, amount to 69% of all attacks today.

So what is a Targeted Attack?

A targeted include could be any, or a collection of different cyberattacks like- Ransomware, 0-day exploit, data exfiltration, spear phishing, DDoS executed against your network after a long drawn strategy.

Since you have been in the attackers’ crosshairs for quite some time now, they have had ample time to evaluate your defences, adapt to any measures you recently took and improvise their attacks.

A better way of understanding these attacks is by breaking them down into steps depending upon what activity is taking place.

Steps that make up a targeted attack.

Step #1: Scouting Phase

The aim of hackers in this phase is to gather as much information about you as possible to tailor their attacks. The cybercriminals zero in on you by following your digital footsteps around the internet and by rigging your network with their port scanners. This phase is barely noticeable.

Step #2: Into the breach

The hackers have acquired the necessary information needed to launch an attack. Attacks like spear phishing, malicious queries (water holing), 0-day and other bundle exploits aimed at delivering the malware (mostly RATs- Remote Access Trojans) to your network are carried out in this phase.

Step #3: Infection Phase

Having made it safely inside your network, the malware will now move laterally to scan your network, infect more devices, data storages and execute malicious routines. Hackers use the CNC (Command and Control) protocol to get the RATs into attack positions.

Step #4: The Attack

The malware starts isolating the important data and preparing it for extraction. Files are either copied or moved (depending on the customization) to hidden directories, ready to be picked up. At the same time, the malware also updates your network drive tables and registry values to avoid radar.

Step #5: Extraction Phase

The isolated and prepared data is then transferred by the RATs which can also adapt to your packet sizes and harness ports to make the file transfer look legit. Extraction of data can be quick or gradual with the latter being very hard to detect thanks to their low bandwidth consumption.

Even after the purpose of the attack has been achieved, the hackers can leave behind a dormant RAT to facilitate another round of attack sometime in future.

Targeted Attack vs Others

In an untargeted attack, the hackers don't have a specific target in mind, hence, they target as many devices, services or users as possible.

A Phishing Email that is fired randomly and reads “Dear Customer” is an example of an untargeted attack.

In a targeted attack, your organization has been singled out well in advance because the hacker has a specific interest in your business.

The groundwork for the attack could have taken months so rest assured the cybercriminals had already discovered the best route to deliver their exploit directly to your systems.

A Spear Phishing Email that addresses you by your name is an example of a targeted attack.

Most Common Types of Targeted Attacks

Social engineering

Social engineering attempts to manipulate your psychology by exploiting trust. Social engineers will leverage your poor understanding of technology and inability to understand the attack patterns to play their card. Social engineering is a predominant component of targeted attacks because it helps in critical when what, where and how planning.

Spear Phishing

Spear Phishing involves sending malware/malicious link bearing emails to specific, well-researched targets. If phishing is like wading across the water with a net, spear phishing is like using the spear to pick the big fat fish. A spear-phishing mail will never be unrelatable - exactly why you need to be extra careful.

DDoS

A Volumetric attack conducted against a specific organization’s internal network or website aims to flood the target with bogus queries to overwhelm its capabilities and “deny” service to legitimate users/customers.

Ransomware

Most Ransomware are a targeted attack since it is useless wasting malware on people with low-value data or empty pockets, sufficient background research is carried out before firing the ransomware. Once it has infected the system/network, the ransomware will encrypt all data and hold it for ransom. Pay the price if you want to see your data again.

A successful targeted ransomware attack against a company can easily stop its business processes for days, making owners more likely to pay up.

CryptoJacking

Is an attack where the RATs are used to take over your network and its components, but unlike Ransomware primarily aimed at encryption and exfiltration, Cryptojacks tend to harness your computing power to mine bitcoin for the attacker.

Waterholing

A variant of a drive-by download attack, in targeted waterholing, the attacker will use your stolen data to predict which websites you are likely to visit next and lay a trap there. Attack derives its name from the waterhole used by hunters to lure animals.

Protecting against Targeted Attacks

Now well, since the targeted attack is not even defined in cybersecurity, there is no “as-such” dedicated protection against the same. There are tools to deal with ransomware, RATs, worms or sweepers, but by the time they are noticeable, the attack is almost through.

One thing you can do is minimize your social signature as much as possible. Of course, it cannot be reduced to 0 and there are data breaches from trusted sources, but let's start with checking the unnecessary trumpets first.

“Securing the network comprehensively is the only reasonable chance we have at preventing Targeted Attacks."
- Dr Leroy NW

Stopping targeted attacks requires a sophisticated approach to security that integrates multiple layers of defence with up-to-the-minute threat intelligence. IDS/IPS (Intrusion Detection/Prevention Systems) are packet filtering modules that prevent malicious traffic from plying on your network.

Properly Configured and Maintained Firewalls or AI-Driven Automated Networking Solutions like BhaiFi deal with targeted attacks by mitigating them at different steps.

For example, if your malware somehow makes it beyond step 2, it still will not be able to spread and infect the network because of extensive checks and measures. In the case of BhaiFi, the existence of network antivirus makes things worse for the malware by actively tracing and eliminating it.

I would have otherwise directed to our list of cybersecurity best practices that minimize attacks, you could still have a walk there, but honestly, they aren't too good against targeted attacks.

Parting Words

And that was all about Targeted attacks, how they are carried out and what all you can do to keep your network protected.

Once again there is this assumption that we were able to help you know all you wanted to, about these attacks, and if it is not true, do feel more than free to let us know in the comments.

Cheers and Happy Reading!

Phishing is not some malware, it is a threat vector - a method of getting malware across to the target machine. When we talk about phishing attacks, the most common ones either make use of mailing services (phishing emails) or real looking counterfeit websites (phishing websites).

Usually, the mails are used to fire malware whereas the phishing websites are used to capture credentials.

The best way of understanding phishing is by looking at real-life fishing.

How do we fish? We lower the bait into the pond and wait for some dumb fish to swallow it. Once swallowed, we retract the fishing line, claiming our prize.

How do we Phish?

This time, we send over the bait via an email and then wait for the dumb fish to swallow it. Once the fish swallows it, we pull the line and claim our prize.

More formally, Phishing is a 90% social engineering and a 10% technical acumen based method of causing disruption.

Hiding malware inside files is not difficult, getting you to click on the malicious link or download the infected file is more critical. Hence the cybercriminals leave no stone unturned to make their email/website look as genuine as possible.

In a targeted attack, they can even go as far as to hack the email account of somebody you know/trust and will then send you mail from there to increase their chances.

Why Bother?

As already discussed, Phishing continues to ace out in both, its commonness and its success rate. However, what if I told you that phishing also aces out in terms of growth - the number of incidents swelling by over 225% in 2020.

Research from Forcepoint indicates that 75% of organizations around the world have experienced a phishing attack in 2020, and 74% of these were actually successful.

To date, information (credential) capture remains the top motive behind the attack (47%), followed by ransomware delivery (18%), trojan (RAT) delivery (15%) and spyware delivery (8%).

According to IBM, nearly 1/5 companies that suffered a malicious data breach in 2020 were INFILTRATED DUE TO STOLEN CREDENTIALS.

With 44% of attacks conducted in its name, Microsoft is the most impersonated brand globally when it comes to phishing attempts, owing mainly to the popularity of Windows OS.

What is a Phishing Email?

A phishing Email is essentially a malicious link/attachment bearing message disguised as something important to get you to click on! It exploits your greed and fears - a request from your bank, investor or an account deactivation warning.

Recent research has shown that 96% of social engineering attacks are delivered by email, while just 3% arrive through a website, and 1% are associated with phone or SMS communications and malicious documents respectively.

A big chunk of Phishing Emails (35%) are targeted towards Software-as-a-Service (SaaS) users and promise special features/product upgrades.

Over 90% of malicious attachment bearing phishing emails would either turn out to be carrying either a windows exe file (74%), a script file (11%) or an office document (5%). Fending off against office documents and PDFs (2%) is next to impossible given the sophisticated nature of malware involved.

What is a Phishing Kit?

A phishing kit is an archive of software tools that allow even people with little technical skills to launch a phishing attack.

A single kit bundles phishing website resources - the cloned legitimate website, credential stealing overlay script, remote access trojan and other support/modification tools - ready to be installed on a compromised website.

Once installed, all the attacker needs to do is send out emails to potential victims. Phishing kits, as well as mailing lists, are available on the dark web.

How easy is it to launch a Phishing Campaign?

Let's say you have next to 0 technical acumen - you can still launch your very own phishing campaign for less than $100! All the ingredients you need are available on the dark web.

A phishing email list that costs somewhere between $40-$80, a basic email address spoofer ($12), a phishing kit ($5-$15), and a free VPN like Psiphon are enough to set your very own campaign into motion.

Feeling more evil? Add another $100 and you can load your malicious mail with ransomware and extract 10x the value!

Is it possible to launch a phishing attack without social engineering?

Yes it is! DNS cache poisoning is a method of carrying out a clone website phishing attack without requiring you to click on a malicious link. This is an advanced targeted type attack and needs a whole article to itself.

We'll be looking at social engineering based clone website phishing soon ...

Types of Phishing Attacks

Broadly, phishing attacks can be classified into the following 6 categories depending upon how the attacks are carried out.

Spear Phishing

While usual phishing is like wading across the water with a massive net to catch any fish that falls in its span, spear phishing is like pinning the “big” fish with your spear. Contrary to normal phishing mail, spear phishing mail will be addressing you personally and may even carry details such as your cellular contact or home address.

Catphishing

Is a type of online deception that involves attackers creating a social network presence as a fictional person (fake ID) in order to lure someone into a romantic relationship. This usually begins online and the victims end up divulging sensitive information, if not downloading professed malware.

Clone Mail Phishing

In clone phishing, the attacker will create an identical replica of a trusted legitimate message (most commonly a subscribed newsletter) from a reputed institution to trick you. Either the attackers penetrate the legit source, or create a ditto copy of it.

Clone Website Phishing

This is the best way of gathering credentials. The attacker uses a phishing kit to clone the login page of a legitimate website (say amazon) you have your account on. Then, you receive an email saying you need to verify your password. You click on the link, visit the page and enter your credentials.

The phishing site records your credentials before displaying an “Incorrect password” popup and then redirects you to the real website’s login page.

On the second attempt, you are actually able to log in successfully eliminating all doubts that indeed you entered the wrong password the first time!

Vishing

Vishing (voice phishing) initially began with fraudulent calls but turned malicious over time. In a classic case, you will receive an IVR call apparently from your bank, investor or some other financial institution.

The IVR will then direct you to dial your account number, CVV, PIN for some verification or KYC purpose which gets leaked to the hacker.

Smishing

Although Smishing (SMS Phishing) accounts for less than 1% of attacks, they are deadly when they land. 78% of text messages are read and 37% are responded to as compared to respective 20% and 6% of emails, making this an exploitable opportunity.

How to not be a victim of Phishing?

The best way of preventing phishing is by learning to spot phishing emails.

Following are a few more tips you'd like to look at-

• Always check the spellings of the URLs in email links before clicking on them.
• If the URL of the website doesn’t start with “HTTPS”, or you cannot see a closed padlock icon next to the URL, do not click!
• Always pay attention to details of website design, while the attackers try to make it look real, there always remain flaws that can be caught.
• Browser add ons like Cloudphish can help. Even Adblock can help detect and block phishing ads. Similarly, browser integrations that come bundled with antiviruses can also help.
• Installing antivirus can help, even a free version is better than nothing. Basically, the sandbox thingy is a pretty helpful feature that helps contain malware infection.
• If you receive an email from a source that appears suspicious, contact that source with a new email, rather than replying directly.
• Regularly rotate and update your online account passwords to prevent the attacker from gaining unlimited access.

Parting Words

At some point, the situation will inevitably boil down to “how dedicated the cybercriminal has been in designing the mail” and “how observant you are about leaving your next digital footprint.”

The good news is that many mail services now have this inbuilt anti phishing mechanism in place which limits the possible propagation and download of malicious links.

Still, it is always better to have comprehensive network security - segmentation, DMZs, IDS/IPS, filtering, blocking, forensic logging - not just for stopping an attack but minimizing the effects in case one does happen.

Cheers and Happy Reading!

I am presuming we are aware of what a DoS/DDoS attack is, and DNS Based Attacks are a subset within this DoS family. DNS Amplification Attack is that notorious thug in the family that plays stealthy and pulls carpets from under people’s feet.

Why Bother?

It is not easy to block these attacks and tracing the attacker is also next to impossible thanks to the UDP (Connectionless) packets deployed.

A DNS Amplification attack can be so powerful that at its top speed, it can represent up to 20% of a country’s total internet traffic. How does it get so powerful? Let’s see.

Our Story Starts with the DNS…

DNS (Domain Naming System) is the address book of the internet. You enter a name like www.bhaifi.com and the DNS directs you to the website by matching it to its IP address (which is usually alphanumeric) like 20.512.32.66.

Thanks to DNS, we don't have to remember the complicated alphanumeric addresses of websites that we want to access.

Hierarchical and Decentralized, DNS is valid not just for the Internet but all networks in general, but its role in network security is a topic for another day.

But how does this DNS help in amplifying the attack?

About 90% of all cyberattacks leverage DNS directly or indirectly.

Any internet communication generally starts with a DNS resolution until after a complicated process we finally have an IP address that is actually usable by the application.

“Now this DNS is like a gunpowder keg that supplies hunters in a wilderness commune. It is needed for food, but at the same time if someone ignites it, there is a disaster!”

In this type of attack, hackers use the “replying mechanism” of the DNS to manipulate it into flooding the target system.

While usually, most trusted enterprises have dedicated resolvers with protected access, there also exist open DNS servers that are used in such attacks.

What is the DNS Reflection Attack?

DNS based attacks are volumetric in nature like their matriarch DDoS hence they too, aim to overwhelm the victim’s network by flooding it with more traffic than it can handle.

Since Hardware capable of bombarding sites with terabytes of traffic every second comes really expensive, let's use the open DNS Servers.

The DNS resolver looks up and loads websites, beginning with your device and travelling through a hierarchy of DNS resolvers across the Internet. But to do that your system sends some queries to the DNS (questions/information) and the DNS replies with the parameters needed to proceed with browsing.

A typical DNS request packet is very small (20-30 Bytes) and returns a response that’s only slightly larger (40-50 Bytes). In its simplified form, the DNS request packet looks something like this ...

The attacker will spoof (edit) the “source address” part of his requests to the DNS Server to resemble yours (victim’s) and when the DNS replies, it will bombard your system with 40 Byte responses. Since the attack is “reflected” over a DNS Server, it is called a reflection attack.

But, there is a catch . . . .

The size of this response packet from the DNS Server is not fixed and there exist techniques that can be used to increase the response size to upwards of 300KB.

How is the size of DNS Response packets manipulated?

You can increase the size of DNS response by either ...

Requesting additional information from the server

We have already seen how a packet with default DNS information looks like, now let’s compare the same to a response. Note this field which says Answers - corresponding to the number of Qs asked by the communicating client.

Since minimal information is required to establish the connection, as discussed, the response is just slightly larger than the query.

However, what do you think will happen if we ask for other UNNEEDED AND BOGUS INFORMATION? Information that is not required for communication like- Details on subdomains, system volume information, backup server information, account information, mail servers and similar additional records?

It gets returned within the DNS Question and Answer section, amplifying the size of the response packet.

Or

Using EDNS (Extended DNS) protocol extension

EDNS(0) was designed to overcome the restrictions in the size of flag fields, return codes and label types available in the basic DNS protocol that restricted many desirable features.

A 10-byte DNS request, in this case, can generate a response that’s 10, 20, even 50 times larger effectively ushering packets as large as 4000KB. Since 4000KBs can’t be transmitted at once, they get broken into fragments that are bombarded.

What is a DNS Amplification Attack?

Just like in the case of our DNS Reflection attack, here too, the hacker spoofs (edits) the “source address” of the DNS packet to resemble that of the victim, who in turn receives overwhelming responses, the size of responses here is MUCH LARGER.

It is worth mentioning here, that since these attacks are carried out via UDP (User Datagram Protocol), there is no way of determining that the “source address” is valid.

In a real scenario, these spoofed packets requesting heavy data are sent out by multiple systems (botnets) and get reflected over multiple servers. All this volume is directed at the target system or network.

How to prevent DNS attacks?

Protection against DNS attacks is tricky. You cannot block all traffic from open recursive servers since that can interfere with legitimate communication attempts. Whitelisting and strict filtering come with their own sets of issues. Still we can rely on,

• Actively monitoring the network and filtering incoming/outgoing packets. You need to make sure that your system inspects packets entering and leaving your network for indications of compromise. The firewall should be trained so as to not allow “public IP addresses originating from a private network” to leave the perimeter.
• Similarly, incoming packet traffic needs to be checked for the destination - if it is anything different from DNS resolvers handling outbound requests, these packets should immediately be dropped. BhaiFi’s proactive filtering for example uses live threat inputs to identify and block these packets.
• Setting up a network DMZ and fortifying it. If your company offers web-based services, setting up a DMZ outside of your internal network can help to a great extent. In a DMZ, the publicly accessed servers are placed outside of the firewall-protected network and then another firewall is added to protect those servers.
• As further reinforcement to the abovementioned strategy, you can place the DNS Resolver that deals with remote employees within the DMZ and local (internal) DNS Resolver inside the network. Then, configure the local DNS server to handle DNS requests from within the organization to draw a clear line.
• A network DMZ created by setting up 2 BhaiFi controllers in parallel can guarantee 99.9% safety. AI driven system ensures that the DMZ is fortified with reinforced channels, facilitating not just security within DMZ but also speeding up the entire response mechanism.
• Casting - Adding failover lines for backup. DNS Anycast can distribute the volume of DNS traffic among servers across multiple locations which in turn balances the load effectively making it difficult for hackers to overload a single server.
• Scrubbing. A good DDoS protection and mitigation (scrubbing) service can stop an attack before it hits your network by routing it through protected systems that absorb malicious traffic. It's like having those flood control dykes and wells that take in the extra water.

Parting Words

Before we part, a word of wisdom from our security experts at BhaiFi - we recommend having some form of forensic logging available (available in a limited manner with monitoring tools) for post-attack analysis and diagnosis processing. Nothing beats that in helping prepare for upcoming attacks.

Hope all that was able to help and feel free to let me know in the comments if there was something else about DNS Amplification attacks that you wanted to know and we sadly missed out.

Cheers and Happy Reading!

Your curiosity first - IP Spoofing is when we change the source addresses of the packets we send across on the internet - to either hide or to impersonate somebody’s else’s computer - the guy to whom that IP address actually belongs.

IP spoofing ought not always to be malicious in nature - people often do that to bypass authoritarian governments and organizations for whistleblowing purposes.

Talking about its ‘lethality’, IP Spoofing does little to no damage by itself but just like the rocket that carries the probe to space, IP Spoofing can be used to launch further attacks like DDoS (Denial of Service), MiTM (Man in the Middle) and XSS (Cross-Site Scripting).

Why Bother?

Would it be a surprise to you if I told you that I could use your “secure office wifi” to conduct a DoS attack against somebody and your network administrators won’t even come to know about it?

“These spoofing based attacks are no rocket science - they are but a simple manipulation of the call and response mechanism of the internet - yet, how do you prove to the law enforcement that it was me and not you?”

Research by the Center of Applied Internet Data Analysis (CAIDA) states that:

99.9% of all attacks are carried out by machines using spoofed IP addresses. Those that are not, are carried out by amateurs.

Over the course of 2020, about 187,000 spoofing based attacks have been recorded every day, tallying at 126M for the entire year.

A total of 37.3M unique IP Addresses were targeted over the year past, implying that all major ISPs have been under some or the other form of attack at any given time.

Before we get to it - What is an IP Address?

IP (Internet Protocol) Address is a unique identifying address that helps in connecting your device to other devices/servers across the internet.

Since IP Address is unique, it can be used to pinpoint and reach your device on the network at a given time.

An IP Address readable by machines is made up of numbers and characters and looks something like 76.157.14.214. You are supposed to enter in your browser to get to that website.

However, thanks to this thing called DNS resolver, you don't really need to memorize it, but only need to write the name of the website like say www.bhaifi.com which automatically gets converted to the machine format.

What is IP Spoofing?

Any data that is to be transmitted over the internet will first be broken into multiple packets, and then those packets are transmitted independently.

The system at the receiving end acknowledges the receipt of packets before they are finally reassembled.

Each of these packets has an IP (Internet Protocol) header that contains information about the packet, including the source IP address and the destination IP address.

To spoof this IP, we use tools to modify the source address in the packet header to mask the origins of the sender to the receiving system.

What is the IP Spoofing attack?

The situation where spoofed packets are used to overwhelm a target system, deliver malware, gain unauthorized access or probe it for vulnerabilities, is categorized as an IP Spoofing based attack.

Call it an example, call it a tutorial; but launching a basic Volumetric Attack (DoS) leveraging IP Spoofing is really simple. All you need to do is-

1. Run your VPN and wait for it to connect. VPN disguises your IP address.
2. Run the LOIC (Low Orbit Ion Cannon) - a DoS tool - to bombard the target with bogus packets.
3. Complement your attack with a split manipulation tool (won’t mention one) to fragment your data packets irregularly, confusing and overwhelming the receiver further.

And this is but one instance, on the whole - you can modify, complement, adapt and restructure the attack into serving multiple purposes in a single shot. After all, you have changed the very thing required to trace you - your address.

How dangerous can that be?

You send out letters in someone else’s name and address instead of your own - imagine what all you could deliver and in what ways could you land the other guy in trouble.

IP spoofing attacks can be categorized based on their procedure and motive.

Volumetric Attacks based on IP Spoofing

Denial-of-Service (DoS) attacks overwhelm target machines with high-speed bogus traffic so that their ‘service’ is denied to the ‘actual’ or legitimate users. Direct query DDoS attacks are often the weakest, therefore the hackers have now shifted over to...

DNS Reflection Attacks, where the hacker will first impersonate your IP address and then send huge volumes of requests to the DNS server. The server believes you requested the information and replies to your system with a huge volume of data, overwhelming it. A deadlier variant of this attack is the...

DNS Amplification Attack, where the attacker requests additional information from the server causing it to reply with larger “amplified” packets. So this time, the DNS server will bombard your system/network with a huge volume of amplified packets, making this the deadliest DoS attack out there. An important aspect of DoS attacks is the...

Botnet Preparation; Botnets are zombie computers that have been penetrated by CnC (Command and Control) malware like RATs (Remote Access Trojans) and are controlled by a hacker. The botnet is usually prepared to launch DoS attacks or to mine cryptocurrency.

Phishing Websites

Phishing Websites are created as standalone websites with the interface and URL resembling the original website.

Next, the IP address of the original website is spoofed and as a result, the phishing site receives all the traffic headed towards it. This is achieved by…

DNS Cache Poisoning, where the hackers exploit and enter wrong information on DNS Resolver, causing it to redirect unsuspecting victims to their phishing websites.

The relief is, companies are always watchful of the same and more often than not, target organization will be an SMB .

Targeted IP based attacks

Remember, all targeted attacks are carried out against high-value targets.

Targeted DNS Amplification is a DNS Amp DoS that will be conducted against your system in case you happen to be an IT specialist/network/system administrator, wherein a compromise at your end could be disastrous.

Targeted IP Spoofing, is another attack you may face, this is done usually as a prelude to...

Targeted Brute Forcing, aka system breach to bypass IP address authentication on a secured network and gain access to critical admin accounts, privileges, data and for...

Targeted Phishing, because your colleagues/employers are more likely to open mail coming from you, rather than from some random source.

MiTM Attack

Man in the Middle Attack is carried out by inundating the local area network with fake packets that disrupt the traffic routing process and help the hacker interrupt communication between two computers.

The hacker then alters these packets with malicious code and subsequently transmits them without the original sender or receiver knowing.

IP address spoofing provides the launch pad that boosts the hackers into infinity.

How to defend against IP spoofing attacks?

Spoofing itself cannot be prevented. Endpoint Security is only partially effective against basic attacks. VPNs are somewhat safer and when compounded with personal cybersecurity best practices, are pretty effective.

For an enterprise network, best that can be done is preventing spoofed packets from entering - in short, comprehensive network security devices, protocols and practices.

Constant lookout/vigil needs to be maintained for indicators of compromise especially the more visible ones like spikes in traffic, outgoing packets with source IP that doesn’t match your company standards, abnormally high device activity trends and escalation/alterations in account privileges.

Lastly, enforcing strong data encryption techniques and multifactor authentication can help a lot. They make sure that even if the data is intercepted, the attacker will not be able to decode it.

Oh, scan this QR code & have FUN!  - Friend replied.

Little did I know that I was going to be screwed in the next couple of minutes as this is what he shared with me:

Damn! He could see all that I could surf over my device.

The most important question here is not how he did it or why he did it but is it that easy to hack into someone’s privacy with your Mobile WiFi Hotspot?

That’s not all! There is a never-ending list of kinds of attacks possible through Mobile Hotspot!

1. DNS Spoofing
2. Password sniffing
3. Session Hijacking
4. JS Injection
5. Fingerprinting your device for replay attack
6. Forged Datagram Packets

And tons of more!

Is it dangerous to use a friend’s Mobile WiFi Hotspot?

Of course, YES! And it is a double-edged sword. The person sharing the Mobile Hotspot can be get into trouble too, here is how:

Imagine you are Saintly Human (one with no bad intentions), but your friend with whom you share your Mobile Hotspot, is not same & lets assume he does something that counts as Cybercrime. As easy as:

1. Abusing a political leader from a fake Twitter account
2. Downloading a pirated movie using a Torrent
3. Cyberbullying someone online, or, worst of all,
4. Uploading a Revenge Porn!

In each of these cases, since, you own the Internet, God forbid if some legal probe does take place, you are behind the bars! :(

Wait, you didn’t do any Cybercrime? Indeed!

But, can you prove that it wasn’t you? Can you prove it was your friend? HELL NO! The next big thing is that the person you shared your Internet with, will be able to connect automatically to your Hotspot the next time it is on and he is in range. They have already saved your Hotspot password and I’m sure you don’t change it that often :(

Thinking that either of these cases can happen to you? There are no numbers on that, but no one thinks they will get in a car accident either. The sad fact is that eventually we are bound to get into some sort of accident. If one is lucky, it’s a band-aid & if not it’s a life changing event.

What should you be doing now?

Getting yourself insured against this. Of course, nothing is 100% safe, but you can increase your odds to be safe with this advice:

As sharing your Mobile Hotspot:

1. Share your Mobile Hotspot only to your immediate family members and closest friends.
2. If the device supports, try to limit access to your known ones.
3. Every time you share it, change your password right away.

As getting other’s Mobile Hotspot:

1. Avoid asking for one unless it is too urgent for you.
2. Try to use a known on-demand VPN (I personally don’t recommend this one & soon I may be able to share a better alternative).
3. Hop on to nearby WiFi Hotspot powered by BhaiFi.

What if you run a workspace or business that involves sharing internet with your clients/employees?

What we talked about is just your Mobile Hotspot & see the possibilities of getting screwed. Just imagine what wonders can be done if someone were to misuse your high speed workplace WiFi Network  - Office, Coworking Space, Cafe, Restaurant or Co Living Space WiFi??

"If you are sharing your WiFi or connecting to the internet using public WiFi, you should definitely consider some way of securing access."

What does DoT say?

In a nutshell, the guidelines laid down by Department of Telecommunication (DoT) states that you need to store the credentials of every person using your internet for a period of at least 1 year.

This article had more to do with introduction of concept and I will be publishing another article on following DoT Legal Compliance in detail to make doubly sure you are safe when you share your Internet at your workplace with your coworkers. Stay tuned!

Happy BhaiFi-ng!

Let’s remove the User from User-Experience & what remains is the best ever Experience we can deliver — I replied.

That’s how the conversation started between Amit & I while discussing the pain our marquee customer had.

Pain-Point:

Before getting started, let me explain what precisely the Pain-Point was to keep things easy for you. So imagine you are connecting your MacBook to your workplace’s WiFi Network powered by BhaiFi, you will see a Captive Portal (Login Page) coming up as shown below, asking you to authenticate your identity via Mobile Number as a part of the Compliance:

Yes, Legal Compliance. Anyone sharing the Internet with anyone outside of the family should verify the user identity (not only the device identity) to keep yourself safe in case of Cybercrime. I will cover this in detail in my next article.

Now, doing this once looks exciting but doing that ever again in your life seems like you under constant surveillance bringing you on your nerves in no time.

Solution: Auto-Connect

We invented a way where once you have authenticated yourself, next time you just come into your WiFi Network's vicinity & you are seamlessly connected just like shooo! Yeah! shooo! (See my previous article to know what shooo! is?).

Wait, what about the Legal Compliance I just boasted about? It is so important & blah blah! Yes, it is! You are still under compliance, but that is happening magically behind the scenes in just 2 seconds & you don’t have to do anything.

Am I not making a fool out of you? Ahan! NO!

You might say that’s how I have been connecting to my home WiFi. I reach home & my WiFi stays connected. Yes! But your workplace WiFi Network after being powered by BhaiFi changes a few things:

1. It doesn’t have any password on the WiFi SSID (or WiFi name)
2. It has Captive Portal enabled, so every time it is a must to authenticate your identity as part of the Legal Compliance.
3. Tomorrow even if you change the WiFi name to something else, it won’t change anything for you.

That’s not the case with your home WiFi. So in a nutshell, Auto-Connect makes your workplace WiFi like your home WiFi but with Legal Compliance in place. YES!

That’s all why it matters? NO!

That was just the base to get you started to take on a new journey. What this invention also does is:

It has the capability to convert all the heterogeneous networks or distributed networks to act as a one-single network on a single click.

Imagine that you have already authenticated yourself once at your workplace WiFi network in Gurugram.

1. You happen to be travelling to your site office in Mumbai & the next morning you reach there you are already connected.
2. You step out to have lunch at a Modern Cafe nearby and there you get connected to the WiFi again.
3. Done with your lunch, hop on a cab & you get connected again just like that.
4. Finally, you head back to your hotel & you are yet connected again!

What the heck? How do I always get connected to these different networks from different owners in different cities with different Internet providers running different WiFi infrastructure without doing anything? How about my privacy or the owner’s security?

The Magic & its power to change the world:

Yes. That’s what this invention does. It automatically authenticates you behind the scenes across all the networks, powered by BhaiFi beyond all the odds. You are always connected, on the move!

Auto-Connect doesn’t compromise the owner’s security because they always have legal compliance whenever you are connected. Moreover, they have all the rights & control of their network. Giving you seamless access has been their choice.

Auto-Connect also doesn't compromise your privacy ever. We have got your back to make sure that no owner could see or misuse your data in any way. There is a thin line difference to ensure your privacy & owner’s security — that’s what we are known for!

Now imagine the power of this invention when 70+ million SMEs are powered by BhaiFi across industries creates a distributed mesh-wifi-network owned by them, used by you, powered by BhaiFi. One India, One Network, BhaiFi!

The day is not so far when you, your car & your gadgets will always be connected across India & beyond keeping you all the way safe.

Let’s pledge — BhaiFi Nahi To WiFi Nahi! Happy BhaiFing :).

Well, nothing to boast about but I can’t ignore the feeling of being joyful on getting our 1st Patent GRANTED — Auto Connect. Though the reason for being joyful is not just the patent, but the hustle that team did to make it happen & its impact to reimagine the way we connect to our WiFi Networks.

Before I share our journey from a Pain Point to Patent (PPP), let me just brief you on what BhaiFi does:

“Networks get hacked, becomes slow, gets down more often than you think compromising millions from your honest profits.”

BhaiFi supports SMEs across industries with a plug-n-play cybersecurity product that avoids all aforementioned things without investing in an expensive IT infrastructure and active human intelligence.

Trigger:

Having a handful of customers then, we had the privilege to kick in the strong feedback loop relatively early to navigate our path to Product-Market Fit. And that’s when the CEO of a 150 employees company based out of Gurugram said to me:

Ankit, I am happy that BhaiFi has relieved me from my worries of securing my network, following the compliance, keeping my efforts and costs to a minimum from all the ways. Still, it takes a toll on the User-Experience that my employees go through each morning while connecting to the Network. Can’t you make it connect like shooo!

Me (in my mind): Really just like shooo? :D

Identification:

That’s how it started. We were just a team of 4 people in 2017 & worked hard enough to onboard some of the great customers who still are top shots in their respective industries. Not solving this User-Experience problem could mean losing them.

Opportunity:

Not knowing if we could solve the problem at all but we started researching our competitors on how are they solving it? (I know it was mean but that’s how it works initially, you tend to learn from everyone). The results were terrific because a few of them didn’t have this problem initially as they were not leveraging the Captive Portal. Still, an old-fashioned way of approving the device’s MAC address & others who were leveraging Captive Portal didn’t care about solving it.

For those who don’t know what Captive Portal is or approving MAC address is:

Captive Portal: is a web page accessed with a web browser that is displayed to newly connected users of a Wi-Fi or wired network before they are granted broader access to network resources like Internet.

MAC Address Approval: allows you to define a list of devices on the basis of MAC addresses and only allow those devices on your Wi-Fi network.

Invention, Implementation & Testing:

My co-founder, Amit & I, started figuring out ways to solve it. Since it involved both hardware & software, we attempted 11 different ways before the 12th attempt became successful.

We finally removed the User from the User Experience letting only the Experience remain :).

Now, users were getting Connected automatically in the background as soon as they stepped into the workplace without doing anything. We implemented it across & tested it for 90 days letting 5000 end-users feel this magical experience.

Dilemma! Trade Secret or Patent?

Now, we had something that didn’t exist before. We surpassed our customer’s expectations & soon, it becomes the most beneficial feature for them. Then came the tricky question if we should keep it a Trade Secret or get it Patented. Here is a sharp difference between both:

Patents give you the exclusive right to exclude others from making, selling, using or importing a particular product or service in exchange for full public disclosure of your invention. Whereas Trade secrets are formulas, processes, or other business information that derive their commercial value from being kept secret, and that a company is making reasonable effort to keep secret. One famous example: Google’s search algorithm, Coco-cola’s secret ingredients. Credits — www.mondaq.com

TIP: If you have an invention that is not eligible for a patent, you can still protect that invention by claiming it as a trade secret.

Of course, for obvious reasons & the future impact we want this invention to have, we chose to get it patented, but that can only happen if the design is patentable. That’s where the role of a Patent Agent starts. We contacted one from the official website http://www.ipindia.nic.in/ — they have published a list of authorised Patent Agents.

Now, it is his job to check the invention's patentability at a deeper level, beyond the Google Search. Yeah! At both the national & international level.

Note: India doesn’t entertain software-only patents so far, unlike the US or other countries.

Our intuition went right, and our design was unique. Our Patent Lawyer suggested to file the Provisional Patent as early as possible & then we had 12 months to file the entire compilation.

Soon after we applied, we got multiple objections from the Controller of patents we had to clarify. Finally, we got it GRANTED after two years.

Cost: All these activities including official fees, patent agent’s feed, handling objections etc. costed us approximately INR 50,000 then.

You may find cheaper or costlier Patent Agents depending upon the level of research they do, the knowledge they have in your domain to draft your application with all the minute details & handling objections.

Impact of this Patent?

This invention's impact is vast & it has the potential to change how 70+ million SMEs across India connect to their WiFi or wired network. My next post will be on its working & the power of this patent to impact these many SMEs.

Stay tuned!