Stolen Data Research Articles

Web Application and Server Exploitation

Web applications play a vital role in every modern organization. But, if your organization does not properly test and secure its web apps, adversaries can compromise these applications, damage business functionality, and steal data. Most of the web application contains security vulnerabilities which enables attacker to exploit them and launch attack. As a result of attacks confidentiality, integrity and availability of information are lost. Web applications provide end users with client access to server functionality through a set of Web pages. . In This paper, we will briefly introduce the concept of Web application and server exploitation through SOL injection attack and the realization process of SQL injection attack. On this basis we will also describe how to detect SQL injection attacks. We will use various tools but the main tool is Kioptrix3 which will be used as a target machine. Keywords: VMware, Nmap, Kioptrix3, SQL injection, Vulnerabilities, Web application and Exploit.

Detection of File Level and Block Level Deduplication and attacks in Cloud Computing Environment

In cloud computing, security and storage space management techniques are most important factors for improving the performance of cloud computing. Secure deduplication is a technique for eliminating duplicate copies of storage data, and provides security to them. To reduce storage space and upload bandwidth in cloud storage The basic idea in this paper is that we can eliminate duplicate copies of storage data and limit the damage of stolen data if we decrease the value of that stolen information to the attacker. Dekey new construction in which users do not need to manage any keys on their own but instead securely distribute the convergent key shares across multiple servers for insider attacker. User profiling and decoys, then, serve two purposes. First one is validating whether data access is authorized when abnormal information access is detected, and second one is that confusing the attacker with bogus information.

Application of Cloud Security Services for the Secured Vendor Registration

Generally in current days, the business is mainly based on the network where security is the main constraint that should be considered while financial transactions, data retrieval, data storage and firm maintenance etc. The present technology provides security for all those constraints by using various encryption algorithms. In the proposed method the data is converted into different formats resulting that the stolen data may not be understandable. Here, we consider the vendor registration in which any number of vendors can be collaborated over a network to share the business plans and for firm maintenance where the security is to be considered taken into account to perform those actions. This paper focus on providing the security with the utilization of cloud services additional to conventional security mechanisms to differentiate the authorized and unauthorized vendors.

Corporate Directorss and Officerss Cybersecurity Standard of Care: The Yahoo Data Breach

On September 22, 2016 Yahoo! Inc. announced that a data breach and theft of information from over 500 million user accounts had taken place during 2014, likely including names, birthdays, telephone numbers, email addresses, hashed passwords, and, in some cases, encrypted or unencrypted security questions and answers. Yahoo further disclosed their belief that the stolen data “did not include unprotected passwords, payment card data, or bank account information. Just two months before Yahoo disclosed its 2014 data breach, a proposed sale of the company’s core business to Verizon Communications was announced. Social media and electronic commerce websites face significant risk factors and mergers and acquisitions may bring cyber liability and vulnerabilities to the acquirer. The fact pattern in this announced acquisition raises a number of important corporate governance issues, including: whether Yahoo’s conduct leading up to the breach and its handling of the breach constitutes a breach of the duty to provide security, the duty to monitor, the duty to disclose, or some combination thereof; whether the directors of Verizon will feel compelled to renegotiate pricing for the proposed acquisition of Yahoo given disclosure of the 2014 data breach; and whether clawbacks in compensation granted to key Yahoo executives are now in order? We believe that cybersecurity remains a threat to all enterprises and this article contributes to the corporate governance literature, particularly as it applies to mergers and acquisitions and the management risk.

Flow-based Anomaly Detection Using Access Behavior Profiling and Time-sequenced Relation Mining

Emerging attacks aim to access proprietary assets and steal data for business or political motives, such as Operation Aurora and Operation Shady RAT. Skilled Intruders would likely remove their traces on targeted hosts, but their network movements, which are continuously recorded by network devices, cannot be easily eliminated by themselves. However, without complete knowledge about both inbound/outbound and internal traffic, it is difficult for security team to unveil hidden traces of intruders. In this paper, we propose an autonomous anomaly detection system based on behavior profiling and relation mining. The single-hop access profiling model employ a novel linear grouping algorithm PSOLGA to create behavior profiles for each individual server application discovered automatically in historical flow analysis. Besides that, the double-hop access relation model utilizes in-memory graph to mine time-sequenced access relations between different server applications. Using the behavior profiles and relation rules, this approach is able to detect possible anomalies and violations in real-time detection. Finally, the experimental results demonstrate that the designed models are promising in terms of accuracy and computational efficiency.

SQLiGoT: Detecting SQL injection attacks using graph of tokens and SVM

SQL injection attacks have been predominant on web databases since the last 15 years. Exploiting input validation flaws, attackers inject SQL code through the front-end of websites and steal data from the back-end databases. Detection of SQL injection attacks has been a challenging problem due to extreme heterogeneity of the attack vectors. In this paper, we present a novel approach to detect injection attacks by modeling SQL queries as graph of tokens and using the centrality measure of nodes to train a Support Vector Machine (SVM). We explore different methods of creating token graphs and propose alternative designs of the system comprising of single and multiple SVMs. The system is designed to work at the database firewall layer and can protect multiple web applications in a shared hosting scenario. Though we focus primarily on web applications developed with PHP and MySQL, the approach can be easily ported to other platforms. The experimental results demonstrate that this technique can effectively identify malicious SQL queries with negligible performance overhead.

Ex-Post Mitigation Strategies for Breaches of Non-Financial Data

As the financial sector has gotten better at dealing with data breaches of payment card information, criminals have increasingly switched their focus to other targets. But the shift of large-scale data breaches to increasingly target non-financial data (that is, data other than payment card numbers and bank account credentials) has rendered long-standing strategies for mitigating the damage of these breaches ineffective. This paper explores avenues of ex-post defense and damage mitigation that apply to emerging types of data breaches that target non-financial data, including medical records, personal communications, and personnel records. The central research questions it aims to answer are: How do the costs of non-financial data breaches differ from those of financial data theft, and in the aftermath of breaches of non-financial data, what has been and can be done to protect victims from harm even after their data has been stolen? To answer this question, we analyze case studies of three organizations targeted in breaches of non-financial data reported in 2014 and 2015: the US Office of Personnel Management (OPM), Sony, and the health insurance company Anthem. We review the different ex-post mitigation strategies undertaken following each incident and discuss the reasons certain types of harm — including identity theft and fraud — provide many more opportunities for ex-post mitigation than other types of harm, such as humiliation and espionage. For each of these classes of harm, we discuss how defenders may try to limit the extent of those harms using mechanisms that fall into five broad categories of ex-post mitigation strategies: (1) limiting the value of stolen information to criminals, (2) drawing attention to the theft and thereby limiting the longevity of stolen information, (3) shifting or limiting liability and insulating specific classes of victims from harm, (4) limiting the spread or transfer of stolen data, and (5) identifying, arresting, and prosecuting the perpetrators.

Protection of Data Under Information Technology Law in India

The concept of privacy differs from society to society. The concept of privacy in modern times is not restricted to mere physical movement or domiciliary surveillance, but also encompasses protection of a wide range of information, whether it’s medical, financial, biometric or personal etc. India does not have specific legislation to deal with issues of privacy, however the Information Technology Act 2000 provides protection in the form of damages in case of failure to protect data and criminal liability in case wrongful disclosure of information in breach of a lawful contract. Protection of data is an important concern as it protects ones right to privacy, further stolen data can be a matter for concern as it can be misused for personal gain and to cause loss to another person. Section 43A of the Information Technology Act, 2000 imposes civil liability on body corporate dealing with sensitive personal data, to provide for damages in case of failure to protect data. Section 72 and Section 72A of the information Technology Act 2000 imposes criminal liability for breach of privacy or lawful contract. Section 72 of the Act imposes liability for breach of confidentiality and privacy and section 72A for disclosure of information in breach of lawful contract. The power to intercept, monitor and decrypt information through computer resource is vested with the Government. The section 69 of the Act is a general exception to rule of privacy and confidentially. The Government or any officers authorized by the Government if necessary can direct any agency of the Government or intermediary to block access of any information, generated and stored or hosted (websites) in any computer resource.

Hackers' Bazaar: The Markets for Cybercrime Tools and Stolen Data

MALICIOUS hackers and cyberattacks are getting more attention these days--a result of both an uptick in the number amount of attacks as well as of increased public attention and fascination. 2014 was the year the hack went viral. Notable data breaches included those at retail giants Target and Home Depot, health-care provider Community Health Systems, financial institution J.P. Morgan Chase, and entertainment giant Sony. For the retail sector in particular, the stolen data from these hacks appeared within days on black market sites. These cyber black markets offer the computer-hacking tools and services to enable and carry out cybercrime attacks, as well as the byproducts from those attacks the stolen credit cards, personally identifiable information, and intellectual property. The RAND Corporation, with support from Juniper Networks, wanted to under stand the landscape and the character of these cybercrime black markets: what the markets look like today, where they came from, as well as where we're headed in the future. To do so, we sought out and interviewed experts ranging from academics, to Different Types of Cyber Threat are distinguished by motivation and intent: * Cybercriminals: use cyber means to go after financial data * Nation-States: use cyber means to monitor, exploit, or attack * Hacktivists: use cyber means to send a message, sometimes politically motivated * Cyber-terrorists: use cyber means to recruit, spread propaganda, or instill fear security researchers, reporters, security vendors and law enforcement personnel folks who have a personal connection to these markets, from a variety of angles. We also reviewed literature and technical reports on this topic and personally observed some of the marketplace forums and websites. The markets for cybercrime tools and stolen data have become so pervasive and accessible that the malicious hacking trade today can for some people in certain aspects be more lucrative and easier to carry out than the illegal drug trade. The hacking trade has matured into specialized markets, in which those who have gained the greatest access deal freely in its tools and spoils: exploit kits (software for creating, distributing, and managing attacks), bot-nets (remotely controlled computers used for sending spam or flooding websites), as-a-service offerings (hacking for hire), compromised hosts, and a continually flooded market for stolen credit-card numbers and other personal credentials. These markets are dispersed, diverse, and segmented; constantly changing and innovating to both keep pace with consumer trends as well as to prevent law-enforcement and security vendors from understanding them. They come in many forms. Some are dedicated to one product or a specialized service. Others offer a range of goods and services for a full lifecycle of an attack--from the tools needed to exploit a system, all the way through to the cyber laundering of the stolen goods. I. The Current State of These Markets: Where Are We Now? Today, the markets for cybercrime tools and stolen data are quite advanced. Cybercrime markets are rapidly growing, maturing, and continuously innovating. They are full of increasingly sophisticated organizations, people, products, and methods for communicating and conducting business transactions. They are resilient in the face of takedowns and constantly adapting to new tactics and techniques of law enforcement and computer security vendors. Finally, they are easy to enter. Cyber Crime markets: The collection of skilled and unskilled suppliers, vendors, potential buyers, and intermediaries for goods or services to facilitate digitally based crimes (e.g., stealing financial data, ecommerce accounts, and social media credentials; intellectual property theft; and takedowns of sites) II. How Did We Get Here? Less than 15 years ago, cybercrime was committed by ad hoc networks of individuals motivated largely by ego and notoriety, who mostly wanted to get on to systems and prove themselves to one another. …

Teasers on Various Spoofing Attacks

This paper proposed to give in depth survey on types of spoofing attacks. Spoofing is a way of masquerading identity of a person or a computer by providing fake data. In this paper huge variety of spoofing methods which includes brief introduction of Dns, Ip, Email, Arp, Web, Wireless, Mac spoofing. The intention of spoofing is to manipulate, steal data which in turn results in data loss and loss on millions of dollars.

Data storage security in Cloud

Cloud computing is worthy of consideration and try to build business systems as a way for businesses in this way can undoubtly bring about lower costs, higher profits and more choice; for large scale industry, Data security has become the most important issue of cloud computing security. Though many solutions have been proposed, many of them only considers one side of security ;this paper proposes the cloud data security must be considered to analyze the data security risk, the data security requirements, deployment of security functions and the data security process through encryption. Distribution of file is done on cloud servers with token generation. The security architecture of the system is designed using encoding algorithms, which eliminates the fraud that occurs today with stolen data. There is no danger of any data sent within the system being intercepted, and replaced. The system is acceptably secure, but that the level of encoding has to be stepped up as computing power increases. Results in order to be secured the system the communication between modules is encoded. Since the customer does not have control over data the cloud provider should assure the customer that data is not modified. In this paper a data correctness scheme is proposed in which a cloud service provider assures the user that the data is stored in the cloud is safe. This scheme also achieves the integration of storage correctness insurance and data error localization i.e., the identification of misbehaving server(s).

How Do Viruses Attack Anti-Virus Programs

As the anti-viruses run in a trusted kernel level any loophole in the anti-virus program can enable attackers to take full control over the computer system and steal data or do serious damages. Hence the anti-virus engines must be developed with proper security in mind. The ant-virus should be able to any type of specially created executable files, compression packages or documents that are intentionally created to exploit the anti-virus’s weakness.Viruses are present in almost every system even though there are anti-viruses installed. This is because every anti-virus, however good it may be, leads to some extent of false positives and false negatives. Our faith on the anti-virus system often makes us more careless about hygienic habits which increases the possibility of infection. It is necessary for an anti-virus to detect and destroy the malware before its own files are detected and destroyed by the malware.

Technology of Secure File Archiving in the Uniformly Random Distributed Archive Scheme

This paper investigates the security features of the distributed archive scheme named Uniformly Random Distributed Archive (URDA). It is a simple, fast and practically secure algorithm that meets the needs of confidentiality and availability requirements of data. URDA cuts a file archived into fragments, and distributes each fragment into randomly selected n －k + 1 storages out of n storages. As the result, users only need to access at least k storages to recover original file, whereas stolen data from k －1 storages cannot cover original file. Thus, archived files are nothing but sequences of a large number of fixed length fragments. URDA is proved of disappearing both characters and biased bits of original data in archived files, indicating the probabilities of both a fragment and a bit appearing at particular position are uniformly constant respectively. Yet, through running experiments, we found out the risk of likelihood that URDA might be vulnerable to bit pattern attack due to the different ratios of characters appearing in real world files. However, we solved the problem by modifying URDA with variable fragment lengths, which results in that all the bits in revealed sequences are distributed uniformly and independently at random.

Malware Detection Module using Machine Learning Algorithms to Assist in Centralized Security in Enterprise Networks

Malicious software is abundant in a world of innumerable computer users, who are constantly faced with these threats from various sources like the internet, local networks and portable drives. Malware is potentially low to high risk and can cause systems to function incorrectly, steal data and even crash. Malware may be executable or system library files in the form of viruses, worms, Trojans, all aimed at breaching the security of the system and compromising user privacy. Typically, anti-virus software is based on a signature definition system which keeps updating from the internet and thus keeping track of known viruses. While this may be sufficient for home-users, a security risk from a new virus could threaten an entire enterprise network. This paper proposes a new and more sophisticated antivirus engine that can not only scan files, but also build knowledge and detect files as potential viruses. This is done by extracting system API calls made by various normal and harmful executable, and using machine learning algorithms to classify and hence, rank files on a scale of security risk. While such a system is processor heavy, it is very effective when used centrally to protect an enterprise network which maybe more prone to such threats.

Visual Trustworthy Monitoring System (v-TMS) for Behavior of Trusted Computing

As the platform mobility increases, it becomes increasingly susceptible to theft. Stolen data is often regarded as being more valuable than the notebook hardware itself. Thus, the need to protect user data and secrets is underscored in a mobile computing environment. The Trusted Platform Module (TPM) is defined as a hardware instantiation which has been proposed by the TCG (Trusted Computing Group) for trust computing. TPM offers facilities for the secure generation of cryptographic keys, and limitations on their use, in addition to a hardware pseudo-random number generator. It also includes capabilities such as remote attestation and sealed storage. A TPM can be used to authenticate hardware devices. Since each TPM chip has a unique and secret RSA key burned in during production, it is capable of performing platform authentication. The TPB (Trusted Platform Board) is an expansion of the TPM for enhancing the efficiency and usability of the TPM chip. In addition to the TPB functions supporting high-standard trust environments within the hardware standard of the system in this paper, we develop the v-TMS (Visual Trustworthy Monitoring System) that provides visualization of real-time monitoring for the behavior of system resources (process, memory, network, users, etc.) with TPB and system software for hardening of OS and applications. Moreover, v-TMS is not only a web-based computing environment for system resources but also a real-time monitoring system for a trust computing environment.

USB shortcoming lets devices spoof their way into stealing data

Data can be stolen with modified or specially built USB peripherals as long as they identify themselves as a regular device

The perils of sharing

Filesharing technologies, using Peer-to-Peer (P2P) networks, are shaping up to be one of the major threats of the coming year. They're being exploited to spread malware, through deliberately infected or modified versions of proprietary software and by the use of P2P mechanisms for botnet command and control systems. Filesharing networks are also rich hunting grounds for data thieves looking for personal information, in order to commit identity theft, or for confidential files. Attempts to limit or eliminate P2P networks - for example, through laws restricting their use - could just drive the problem underground, with filesharers adopting VPN and other encryption or masking technologies. Filesharing technologies, using peer-to-peer (P2P) networks, are shaping up to be one of the major threats of the coming year. They're being exploited to spread and control malware and steal data. And attempts to limit or eliminate them could just drive the problem underground.

PCI and Beyond - How to Secure Data in the Most Cost Effective Manner

The Payment Card Security Industry Data Security Standard (PCI DSS), US State and federal laws encourage and require businesses to encrypt consumers' computerized personal information and payment data. Most state data breach notice laws do not require businesses to notify their customers when customers' digital personal information has been stolen or lost if the information was encrypted. A motivating factor that prompted many companies to implement data at rest encryption was the large amount of negative media attention garnered by stories of lost or stolen data. The type of asset compromised most frequently is online data. An alternative method of analyzing these results is to examine the number of records of sensitive data compromised for each asset. This view shows the same conclusion. This fact may be surprising to some given the frequent public reports of massive amounts of data at risk from lost or stolen laptops, back-up tapes, and other media. Postponing some IT security projects could lead to risky business behaviors. Dealing with a breach is more expensive than preventing one. Regulations are requiring tighter security for more of your business information and organizations must learn how to protect their business information. PCI and PII (Personally Identifiable Information) data can be secured in the most cost effective manner by following the guidance in this article. The case study in this article is about an Enterprise Data Security project that addresses key areas of focus for file and database security encompassing all major platforms.

Privacy-Enabled Global Threat Monitoring

The history of intrusion detection research gives a nice example of a community in a perpetual race to stay relevant. While we once focused on detecting user account misuse in mainframes, we then moved on to local area network abuse, and then to address the scalability problems in enterprise-wide detection. With the rise of e-commerce in the late 1990s, we intrusion detection developers have had to react to the emergence of script kiddies and Web defacements. Distributed denial-of-service attacks and wide-scale virus propagation soon followed, as did a new term, malware research, to address the growing concern about viruses and self-replicating worms spreading across the Internet at alarming speeds. More recently, we've had to consider the problem of botnets, which can organize and maintain illicit control of thousands of machines for months at a time to spread spam, conduct phishing attacks, or steal data or computing resources. Over the past decade, intrusion detection research has rarely been boring

Disclosure of Information Theft: The ChoicePoint Security Breach

In recent months, the media have reported several major security breaches. Hackers have stolen the personal information of thousands of individuals from leading banks, credit bureaus, and insurance companies. In other cases, computers and disks with highly confidential data have simply vanished at the airport security counter or from vehicles parked in the company lot. Stolen data may include such sensitive information as Social Security and driver's license numbers, financial history, and bank account numbers and balances.