Six Common Myths about Microsoft Azure

Myth 1: Azure is too complicated for my business

Some organizations are concerned that switching to Microsoft Azure would be too complicated and they lack the technical expertise to make it work. However, one of the major benefits of Azure is that if you are familiar with other Microsoft and Windows products you will find it actually relatively easy to use. The service has been designed to be suitable for businesses of all sizes, so there is no reason to assume you will be overwhelmed.

Of course, not every company has the technical knowledge and it can leave owners worried that they will not feel in full control of their infrastructure. Thankfully, however, it is possible to work with specialists who can offer managed Azure hosting services. So, whether you need just a little help with Azure deployments or a fully managed package, there is something out there to suit your business.

Myth 2:  It’s a security risk

With rules and regulations such as the GDPR (General Data Protection Regulation) coming into force, it has never been more important to have powerful cybersecurity in place. This means that many businesses worry that their data is put at risk if they use services like Microsoft Azure. However, if this is a concern for you, it’s worth knowing that Azure holds the most comprehensive list of compliance certifications of any cloud provider.

Microsoft is an industry leader in privacy protection with unique residency guarantees to protect data at all times. The system is designed to give customers complete confidence in their security. So ultimately you can have complete peace of mind that working with Azure can keep your business entirely secure and private.

Myth 3: The costs are prohibitive

In some cases, businesses are put off the idea of switching to Microsoft Azure because they believe either that the cost of changing the infrastructure and working practice will be too high, or the actual ongoing costs are too expensive. Of course, it is natural to be want to be in complete control of finances but it can often be the case that businesses that are not willing to invest in infrastructure get overtaken by competitors who do.

Clearly, this will depend on your business, but it should be noted that a switch to Azure can see excellent improvements in efficiency and productivity. Additionally, Azure is engaged in a pricing battle with other services - which ensure that the costs of bandwidth and storage are kept to a minimum.

Myth 4: Efficiency is the only reason to switch to public cloud storage

Yes, there is no doubt that increased efficiency is a major benefit of using public cloud storage services with Microsoft Azure, but it is far from the only reason to consider making the change. One of the best reasons to choose public cloud storage is the increased innovation it allows – this might even top reason. 

It allows your developers to spend their time actually developing, rather than simply on the time-consuming maintenance and management. Azure actually handles many of the complex tasks for you, taking that burden away from developers and freeing them up. This could give them time to work on anything from machine learning or business-critical enhancements to your website. 

Myth 5: It’s incompatible with the open source software 

It is sometimes assumed that Azure is completely incompatible with popular open source software, which could make it difficult to implement alongside your existing infrastructure. If this was true it could make it potentially extremely challenging for those businesses that currently utilize open source software as it would mean not only changing over their system to Microsoft Azure but also changing many internal systems.

Myth 6: Using the cloud effectively means ONLY using the cloud

Perhaps you are concerned that if you make the move to Azure you are committing the whole of your business to the cloud. Some businesses do not fully understand how the cloud works and it can put them in a position where they never consider services such as Azure because they don’t think it would be appropriate for them. 

However, this does not need to be the case at all as Azure supports hybrid functionality, allowing you to keep on-premises infrastructure in place and simply work with Azure to offer additional capacity. The solutions can be completely bespoke and based around the needs of your company, so there is no reason to assume that you have to stick with a one-size-fits-all package. 

If you are still concerned about whether Microsoft Azure is right for you, it’s a good idea to speak to specialists, who have experience working with businesses like yours. Whether you would benefit from a hybrid system or hosting based entirely on the cloud, they will be able to advise you as to whether it is a good idea to make the switch.

Configuration Management

Configuration management (CM) is a systems engineering process for establishing and maintaining consistency of a product's performance, functional, and physical attributes with its requirements, design, and operational information throughout its life.

New malware found using Google Drive as its command-and-control server

Since most security tools also keep an eye on the network traffic to detect malicious IP addresses, attackers are increasingly adopting infrastructure of legitimate services in their attacks to hide their malicious activities.

Cybersecurity researchers have now spotted a new malware attack campaign linked to the notorious DarkHydrus APT group that uses Google Drive as its command-and-control (C2) server.

DarkHydrus first came to light in August last year when the APT group was leveraging the open-source Phishery tool to carry out credential-harvesting campaign against government entities and educational institutions in the Middle East.

The latest malicious campaign conducted by the DarkHydrus APT group was also observed against targets in the Middle East, according to reports published by the 360 Threat Intelligence Center (360TIC) and Palo Alto Networks.


This time the advanced threat attackers are using a new variant of their backdoor Trojan, called RogueRobin, which infects victims' computers by tricking them into opening a Microsoft Excel document containing embedded VBA macros, instead of exploiting any Windows zero-day vulnerability.

Enabling the macro drops a malicious text (.txt) file in the temporary directory and then leverages the legitimate 'regsvr32.exe' application to run it, eventually installing the RogueRobin backdoor written in C# programming language on the compromised system.

According to Palo Alto researchers, RogueRobin includes many stealth functions to check whether it is executed in the sandbox environment, including checking for virtualized environments, low memory, processor counts, and common analysis tools running on the system. It also contains anti-debug code.

Like the original version, the new variant of RogueRobin also uses DNS tunneling—a technique of sending or retrieving data and commands through DNS query packets—to communicate with its command-and-control server.

However, researchers discovered that besides DNS tunneling, the malware has also been designed to use Google Drive APIs as an alternative channel to send data and receive commands from the hackers.

"RogueRobin uploads a file to the Google Drive account and continually checks the file’s modification time to see if the actor has made any changes to it. The actor will first modify the file to include a unique identifier that the Trojan will use for future communications," Palo Alto researchers say.

The new malware campaign suggests that the APT hacking groups are shifting more towards abusing legitimate services for their command-and-control infrastructure to evade detection.

It should be noted that since VBA macros is a legitimate feature, most antivirus solutions do not flag any warning or block MS Office documents with VBA code.

The best way to protect yourself from such malware attacks is always to be suspicious of any uninvited document sent via an email and never click on links inside those documents unless properly verifying the source.

Classful vs CIDR vs FLSM vs VLSM

Classful

Classful addressing is how the early Internet was formed. IP assignments were given on the Classful 

Boundaries:

Class A     First Octect: 0-127     Subnet Mask: 255.0.0.0

Class B     First Octect: 128-191   Subnet Mask: 255.255.0.0

Class C     First Octect: 192-223   Subnet Mask: 255.255.255.0

Class D     First Octect 224-239    Multicast

Class E     First Octect 240-255    Reserved / Unused

The idea was, if you were a company that needed 200 IP addresses, a class C assignment would have been provided. If you were a company that needed 50,000 IP addresses, a class B would have been provided. And if you were one of the few companies that justified requiring over 65k~ IP addresses, you would be given a Class A.

Obviously, this lead to a lot of wasted IP addresses. If, for instance, you only needed 300 IP addresses, a Class C wouldn't cut it, so you would end up with a Class B and nearly 60,000 IP addresses would be wasted.

Classful addressing "evolved" into what we know of as Classless Inter-Domain Routing, or CIDR

CIDR

With Classless Inter-Domain Routing, IP assignments were not limited to their classes. In effect, the entire unicast range (First octect 0-223) can be broken up into any size network.

Instead of requiring subnet masks to be 255.0.0.0 or 255.255.0.0 or 255.255.255.0 in the IP assignment from IANA/RIRs, they could be anything -- and for simplicity slash notation was adopted.

·         If you need 300 IPs? You get a /23.

·         If you need 500 IPs? You also get a /23.

·         If you need 1000 IPs? You get a /22.

·         If you need 70,000 IPs? You get a /15

·         If you need 250,000 IPs? You get a /14 (instead of a /8 that you would have gotten in the Classful world)

---

FLSM

Fixed Length Subnet Mask refers to a strategy where every one of your networks within your infrastructure was the same size.

Whether you got a classful assignment or a classless assignment from your RIR, you can deploy the IP addresses in a Fixed Length manner. For example:

You are assigned by your RIR this /24: 200.2.2.0/24

You have one Router, with the following requirements of IP addresses and designation of addresses within your assignment:

·         Fa0/0 - Needs 10 IP addresses - Assigned: 200.2.2.0/26

·         Fa0/1 - Needs 20 IP addresses - Assigned: 200.2.2.64/26

·         Fa0/2 - Needs 40 IP addresses - Assigned: 200.2.2.128/26

·         Fa0/3 - Needs 15 IP addresses - Assigned: 200.2.2.192/26

Because Fa0/2 needed 40 IP addresses, the minimum size for all your networks is a /26, and these four router interfaces have used up all 256 addresses of your assigned IP space, even though you only needed 85 IP addresses).

Obviously this is a huge waste. So the question that follows is why was this ever a thing? The reason: To save bits on the wire.

The early early routing protocols, aka RIP, saved bits on the wire by not included the subnet mask... the mask for alladvertised networks was assumed to be the same mask assigned to the receiving interface.

Try it, fire up to routers in GNS3 (or maybe even packet tracer). Configure four /26's on one and four /27's on the other. Configure the link between the routers as a /26 and /27 respectively, but actual interfaces within the same /27 (aka, so they can still ping despite the non-matching subnet mask). Fire up RIP on all networks/interfaces and watch what happens. You'll see the router's perceive each other's advertisements as their own subnet mask.

The point being... (and this is often often confused in the industry)... FLSM is not the same thing as Classful assignments. FLSM is simply using one subnet-mask on all your router interfaces, on all your routers in your deployment

Whether the addresses you received from IANA/RIR came Classful or Classless is irrelevant to FLSM.

VLSM

As we can see in the example above, FLSM leads to many wasted addresses. The evolution of FLSM is what brought us to VLSM, or Variable Length Subnet Mask. Hopefully at this point you can deduce what VLSM is (as compared to FLSM):

FLSM is a subnet deployment strategy that requires all subnet-masks to be the same size. VLSM is a subnet deployment strategy that allows all subnet-masks to be variable sizes.

The same example above:

You are assigned by your RIR this /24: 200.2.2.0/24

You have one Router, with the following requirements of IP addresses and designation of addresses within your assignment:

·         Fa0/1 - Needs 20 IP addresses - Assigned: 200.2.2.0/27

·         Fa0/3 - Needs 15 IP addresses - Assigned: 200.2.2.32/27

·         Fa0/2 - Needs 40 IP addresses - Assigned: 200.2.2.64/26

·         Fa0/0 - Needs 10 IP addresses - Assigned: 200.2.2.128/28

Assigning the minimum IPs blocks to each network you've only assigned out .0-.139, leaving you a remaining 116 IP addresses for expansion. Not perfect, but definitely much better than FLSM.

TLDR:

·         Classful addressing is an IP Assignment policy mandating IANA/RIR give out address blocks on bit boundaries (/8, /16, /24)

·         Classless or CIDR is an IP assignment policy allowing IANA/RIR to give out address blocks of any size, as required

.

·         FLSM mandates that every network within your deployment be the same size -- required for archaic routing protocols like RIP

·         VLSM allows any network within your deployment to be any size

Classes And Objects

C++ Classes and Objects. Class: The building block of C++ that leads to Object Oriented programming is a Class. It is a user defined data type, which holds its own data members and member functions, which can be accessed and used by creating an instance of that class. A class is like a blueprint for an object.

Hacker Demos Jailbreak of iOS on iPhone X

A security researcher with the Qihoo 360 Vulcan Team, Qixun Zhao (@S0rryMybad), has revealed the second stage of an exploit chain in which he was able to remotely jailbreak the latest iOS system on iPhone X.

 Zhao released the proof of concept (PoC) of a kernel vulnerability that can be reached in the sandbox, which he dubbed Chaos. For the benefit of beginners, he provides what he calls elaborate details on the tfp0 exploit, though he does not reveal the exploit code.

Instead, he stated, “if you want to jailbreak, you will need to complete the exploit code yourself or wait for the jailbreak community’s release. At the same time, I will not mention the exploit details of the post exploit, as this is handled by the jailbreak community.”

Following his intuition, Zhao said he believed there would be a path that would cause a leak, which he found could be exploited before iOS 12 even started in the sandbox.

Noting that the bug has been fixed in the most recent version, Zhao wrote, “As soon as I saw the code I felt that this part of the code is definitely lacking review and the quality is not high enough. After all, the code that can be directly reached in the sandbox, that means the kernel developer may not be familiar with the rules for generating MIG code. This information is more important than finding the bug in the above.”

Despite the misguided belief that PAC mitigation was the end of UaF or jailbreak, Zhao said the UaF hole can still be used in the PAC environment. “We can see that in the whole process of getting tfp0, we didn't need to control the pc. This is because there was a port property value in the object ipc_voucher we released. The exploitation of the UaF vulnerability depends greatly on the data structures of the released object, as well as how to use them, since in the end we have to convert to type obfuscation."

x

Configuring TCP/IP

Type ncpa.cpl in the box, then press OK. Select the local area connection, right click it and select Properties. Select Internet Protocol Version 4(TCP/IPv4), double click it or click Properties. There are two ways to configure the TCP/IP Properties, Assigned by DHCP server automatically or manually.

Amazing Mobile Hacking Tools and Techniques

TRANSCRIPT:

Thank you everyone for joining everybody right now so I have been certified by EC Council as an EC Council certified instructor been certified by various certification programs like CEH, ECIL handling and ECSA. Penetration testing is a first thing what I am going to discuss and then we'll go to introduction for mobile hacking then I'll give you some of the technique how the Android operating system works. And then will move to iOS architecture and then I will show you multiple hacking techniques and I am going to the demonstrate that thing over EC Council ilabs at the end I will take your query send feedback.
Mobile phones are allowed under the “BYOD” policy, which stands for “Bring Your Own Devices”. This makes the vulnerable to leak their data and hackers are looking for such kinds of vulnerabilities or threats or mobile devices.

Mobile Hacking can be divided into two categories:

1. Hacking the Mobile Devices which the companies do.
2. Using the Mobile Devices for hacking.

Hackers use Mobile Devices to hack other systems. Because there are tools supported by mobiles and even EC-Council started their own Mobile Hacking devices called the “Storm”. Now, let me move to the introduction to Mobile Hacking. Mobile hacking is one of the new horizon for hackers. Where data decides per use. Now data is used by the Mobile Devices but where does the data reside? The data moves over network, data can be stored permanently over storage devices, Now the data has to be secure. 

Now the hacking when it happens There are few common attacks that also happen over mobile devices. All computer systems are over any other smart platforms. Data exfiltration extracted from Data stream and email, screen capture, copy to the USB keys . Now, this all things come under data exfiltration. Where it may be a link to the organisational data . And your organisation will  lose their data  the matter will come under confidentiality, integrity, availability of losing the data. And company me lose everything out of it. 

The next thing will be data tampering,  modification using another app Kind of trojans  or viruses worms  or rat programs. Now these things come under data tampering. Let me give you a small example  let us talk about the Trojan  suppose the Trojan has been wrapped with the  gaming program And people tend to play the games over mobile devices  now this may lead to some kind of internal operations On maybe Android or iOS device So you don't get to know that your device is sending multiple information like Videos of screenshots And these all things are moving over to the attackers phone over a small piece of code called Back door. There will be another kind of attack that you  where the data loss happens maybe loss of device. Your device has been changed to a break maybe on  probe access. This is kind of jailbreaking or rooting the device Or maybe there is the vulnerability over an application So this all things may lead to data loss. At the end of the day the  Malware is doing everything. Virus applications and mobile  modifications.

The moving to the next  slide we will see the architecture of the Android OS.It is a very popular operating system and it is an open source and a lot of applications are running on it This is supported by multiple vendors for multiple types of operations and applications He talked about business, banking and finance You can even talk about retail or you can talk about anything That is coming over this application it is also emerging with the new updates Like iot and all.

ANDROID OS ARCHITECTURE

Now I will look into the Android OS architecture there will be 4 different layers You will find the application layer, application framework Libraries and the Linux Kernel The application layer is where you are  referring into the look and feel of the device Like home, contacts, phone, phone numbers, All browsers, these all things come under the application layer Where user in is interacting with the device Below that you will find the application Framework where lot of frameworks are running like API Which take the request from the user and give it to the kernel Now it is responsible for running all kinds of drivers That means you are come cameras. your Flash Memory. your binders. Keypads. WiFi drivers. audio drivers , power management. These all things are going to run on top of it So  there is a layer call library layer Which is defined according to the application and not according to the mobile device It helps to run the application independently or isolated So if anything will happen to the Slayer the application will crash. Show that how the Android OS layer works. Now let's see how a hacker can enter into this layer structure Now imagine a scenario where we are running an application and the application has Manual settings And on this application there is a Trojan behind and it is sitting on the Linux Kernel And it is by passing your personal data like your camera or microphone Or something else which gives data to the attacker So that is where your device is going to be vulnerable and nowadays there is more than one vulnerabilities. Can talk about dos attacks sniffing over the networks or  phishing, You can talk about the web application attacks on the normal application attacks Over the network can be possible.

IOS ARCHITECTURE

In a similar way iOS is also an architecture which is famous over the Apple platform Set also comes with multiple layers like the Android Operating System Architecture. Here the upper layer has the application Here the users will be interacting with the mobile directly. Here the Coco attach layer helps to create the look and feel. Or you can say it is a user interface kit. Below that is the media layer where you can find all the audios and videos. And the core service layer which take cares of the entire iOS architecture With the kernel based module This is a fully secured layer or the hardware layer which takes care of the entire Operating system. This also connects with the core OS layer + Linux kernel.

So now let us discuss about the multiple hacking techniques used by hackers to actually get into your device.  Or using a device to do other kind of attacks. Saudi attacks on mobile devices you can say about the  

• Rooting the mobile device or jailbreaking it.
• Hacking network using “network spoofer”
• Sessions hijacking using “ droidsheep”
• Mobile  sniffer, “ packet sniffer”

Now let me demonstrate you some of the hacking techniques using EC Council ilabs  so  let me quickly move to the environment.

ROOTING THE MOBILE DEVICE OR JAILBREAKING IT

So this is the lab environment which will be getting access to during your classroom training or CEH training. It's not only the mobile hacking tools you'll get 18 different tools to practice hacking. So let me quickly move to one of the last which is mobile hacking. Some connecting to one of the Android devices here and let me quickly put the IP addresses. So I'm just connecting this device to the network. I am giving the IP address to the simulator Over one of the Ethernet ports. 
Now I will log in to the Kali Linux to create an exploit. This will be an APK backdoor vacancy Android operating system runs all the APK applications. 

So I am going to create an exploit using a metasploit payload that is the MSF console. Now this will give me a remote access over Android on a particular mobile device. No the back door has been created successfully you can see it is on the desktop. Now I am quickly going to create a directory to  share this backdoor to the Android device. Now I am going to the web server where I will create the link and I will share this link to the social engineering methods Maybe I will spam it or send it over an email or make use of all the social Engineering. Now I'm going to install the application and I'm changing the settings so that I can install it over the web browser. I am changing the contacts as of now.  so that anybody can access who is connecting over the web browser.  and I am going to share this folder.  I am pretty much time you are so I will just start the Apache server.  and I will just copy the back door from the desktop.  now I will move to MSFconsole to enable the handler so that whoever connect to this Android device can be handled by my Kali Linux machine. I am going for the river session and I am going to use reverse TCP here and I am going to keep the IP address of my Kali Linux machine so whoever is connecting to the system will connect to my Kali Linux machine. And now I'm going to create the  exploit.  so now it is connected Now I am sending it to the Android device the Android device is a victim to me Here I will make the device run this back door As of now I am accessing things over the web browser normally it happens over spam How sending the links and making the user to click on it, there are multiple methods to do so.  let me install the back door.

So once it is done on the device you can see the Kali Linux is got the response And I'm going to start the session. Now I got the access of the Android device.  I can see the Android devices on my hand now now I can run the webcam or chat or list or check.I can also check whether it is a rooted device or not. I can also check their contacts or call logs anything. I can also check the system information to cell information I can also execute Any commands I can download or upload anything. You can see here on the top I have multiple command which I can run . Speaking frankly the device is yours and you could do whatever you want. Hey this is the demonstration I have showed you that how an Android device is vulnerable to the back door. 

Similarly we will be seeing other attacks like how can we harvest the user credentials using SET. Are using the social engineering toolkit or dos attacks or sniffing . So there are a number of things.

HARVESTING USER CREDENTIALS

So I am going to show you one more live environment here.  So  I am going to show you how can you harvest user credentials using social engineering Toolkit. I have just drafted a website let me show you one more time. So here it has multiple options for you And I have chosen the option of harvesting the user credentials. This can be done on Android or iOS platform. In this website attack vectors and I have collected one of the tools among these.  here it has cloned one of the shopping website . Let me show you the shopping website.  so this is what I have cloned.  not Association website how it looks like. Once the cloning has been done the web server is running. So this link will be sent over two victims by multiple ways. It is the same website which is open right now. I am logging in right now . Now this website is taking me know where because is one website which is being used to have it your credentials.   once that has been done you have to go back to Kali Linux.  We can go to the folder  and see there is a file called harvester. You can see the user credentials once you open it. Let me log into the same website and I am giving the credentials whatever I have collected.  If you see once more these are the same credentials that we had harvested in Kali Linux. Now you can see the user has got locked in through the website. The thing comes under identity theft. This means I have sold in the credentials of the user without the permission.

DoS ATTACK USING ANDROID DEVICE

These are the techniques where hacking has been done on the mobile devices there will be instances where hackers use the mobiles to attack other victim devices.  let me show you one of the labs for that also. Let me show you how people do ddos attacks using mobile devices. So I'm going to create a dos attack and Windows 8.1 is going to be one of the victim machine and I am going to run one of the  snipping tool which is wireshark. 

Let's launch wireshark. So the stool is going to monitor the traffic of this particular device on this particular machine. Which I'm going to do a dos attack with the help of mobile devices. So this particular machine started capturing all the packets of this particular device. I am going back to mainstream. Going to connect one of the repository to just download the tool. So let's go to dos and ddos attack tools and from there I'll go to loic.apk. Once it is on what this particular tool is going to do is it is going to send. It will perform a ddos attack multiple requests to the Windows 8.1 machine.  so let me give the IP address of the windows machine here. Now you can do the attack. I can see the time is  elapsing. We can see your multiple packets. Now you can see the TCP heat which is sending multiple packets. Now within seconds you can see the small Android device can kill this big machine. Now you can see multiple http request and the machine is not working anymore. Just literally make the  machine stop working.  So these are the attack that you can do from any mobile platforms.