Is DevOps Certification Worth It?

IT certifications have always served as the benchmark for assessing professionals’ ability to exploit technology and offer something which proves that the candidates are proficient with the required skills in the workplace. However, many such certifications are available and it’s hard to measure the softer, less-tangible skills that managers require with such certifications.

Subjective Assessment

The ‘idea’ of best practices varies from from one organisation to another and finding ‘one right answer’ to the question is not easy. You need to factor in things like how would the candidate design, create, deploy, and integrate the tools? What about security? Resource allocation and value?

Agile, and DevOps are niche areas that deal with continuous delivery. Since the space is yet to be clearly defined, certifications become more than just a necessity as they can help differentiate candidates in the industry by not just measuring technical competency but showing the candidate’s approach to addressing issues and problem solving.

These certifications can also be used to represent your point of view. New views and definitions are developing every single day within these frameworks, and a certification serves as a proof that you know exactly which approach you take while solving different customer issues.

The skills and tools developed using Agile and DevOps foundation are much broader than just one specific process or technology. In order to measure the capability of a candidate in these areas, you need to know whether they’re comfortable working with more than one technology and that’s exactly what a DevOps certification is trying to address.

Earning a DevOps certification demonstrates that you as an individual have gained a thorough understanding of concepts and skills like communication and management. It’s not easy to measure these skills even when the candidate has such a certification. Employers leave no stones unturned to ensure the validity of this certification and they do extensive research on the certification authority too as that’s the only way of ensuring that they get the results they’re looking for. So, make sure you’re taking this course from an institution that has the authority to certify DevOps.

How To Choose The Right Institution?

The certifying body needs to produce learning materials and a body of knowledge showing their own approaches to framework and topics related to DevOps. This is necessary so that candidates have a clear understanding of ‘how’ and ‘why’ of the best practices on which they’ll eventually be assessed on.

For the past 20-30 years, IT certifications have mostly been about taking an exam. However, with DevOps, things don’t work in the same way. A lot of emphasis is laid on courseware delivery, content, and most importantly on training. Apart from teaching material, candidates also should learn how to use that knowledge in real-world situations. They should be assessed on real time based scenarios, with a given set of facts and a specific technology.

DevOps-like certifications are difficult to design and develop, but these offer a deeper understanding of the candidate’s potential. Getting a DevOps certification is a great way to get a much-needed competitive edge over your peers in the IT hiring market. Experienced workers are scarce in this area and the best thing to do for any manager will be to get a DevOps certification. However, make sure that you choose the right institution in order to truly reap the benefits of the same.

Why cryptojacking has become more popular with hackers today?

                In 2019 Cryptojacking is going to be the hacker's attack choice for generating revenue. Criminals are using ransomware-like tactics and poisoned websites to get your employees’ computers to mine cryptocurrencies. 

                   Cryptojacking is a way for cybercriminals to make free money with minimal effort. Cybercriminals can simply hijack someone else’s machine with just a few lines of code. This leaves the victim bearing the cost of the computations and electricity that are necessary to mine cryptocurrency. The criminals get away with the tokens. Cryptojacking scripts do no damage to computers or victims’ data. They only steal CPU cycles.

                   Cryptojacking is a risk-free cheaper, more profitable alternative to ransomware, with every infected machine (100%) working for them to mine cryptocurrency (Monero and Zcash). Cryptojacking kits are available on the dark web for as little as $30. The risk of being caught and identified is also much less than with ransomware. The crypto mining code can go undetected for a long time. Darktrace has detected Coinhive and Crypto-Lootclandestine malwares on the networks of around 1,000 of its 5,000 banking clients in the last six months. 

How cryptojacking works?

                Hackers have two primary ways to get a victim’s computer to secretly mine cryptocurrencies. One is to trick victims into loading cryptomining code onto their computers. This is done through phishing-like tactics: Victims receive a legitimate-looking email that encourages them to click on a link. The link runs code that places the cryptomining script on the computer. The script then runs in the background as the victim works.

              The other method is to inject a script on a website or an ad that is delivered to multiple websites. Once victims visit the website or the infected ad pops up in their browsers, the script automatically executes. No code is stored on the victims’ computers. Whichever method is used, the code runs complex mathematical problems on the victims’ computers and sends the results to a server that the hacker controls.

          Hackers often will use both methods to maximize their return. “Attacks use old malware tricks to deliver more reliable and persistent software [to the victims’ computers] as a fall back,” says Vaystikh. For example, of 100 devices mining cryptocurrencies for a hacker, 10 percent might be generating income from code on the victims’ machines, while 90 percent do so through their web browsers.


         Unlike most other types of malware, cryptojacking scripts do no damage to computers or victims’ data. They do steal CPU processing resources. For individual users, slower computer performance might be just an annoyance. Organization with many cryptojacked systems can incur real costs in terms of help desk and IT time spent tracking down performance issues and replacing components or systems in the hope of solving the problem.  

Delegate in c#

C# delegates are similar to pointers to functions, in C or C++. A delegate is a reference type variable that holds the reference to a method. The reference can be changed at runtime.

Delegates are especially used for implementing events and the call-back methods. All delegates are implicitly derived from the System.Delegateclass.

Declaring Delegates

Delegate declaration determines the methods that can be referenced by the delegate. A delegate can refer to a method, which has the same signature as that of the delegate.

For example, consider a delegate −

public delegate int MyDelegate (string s);

The preceding delegate can be used to reference any method that has a single string parameter and returns an int type variable.

Syntax for delegate declaration is −

delegate <return type> <delegate-name> <parameter list>

using System;

delegate int NumberChanger(int n);
namespace DelegateAppl {
   
   class TestDelegate {
      static int num = 10;
      
      public static int AddNum(int p) {
         num += p;
         return num;
      }
      public static int MultNum(int q) {
         num *= q;
         return num;
      }
      public static int getNum() {
         return num;
      }
      static void Main(string[] args) {
         //create delegate instances
         NumberChanger nc1 = new NumberChanger(AddNum);
         NumberChanger nc2 = new NumberChanger(MultNum);
         
         //calling the methods using the delegate objects
         nc1(25);
         Console.WriteLine("Value of Num: {0}", getNum());
         nc2(5);
         Console.WriteLine("Value of Num: {0}", getNum());
         Console.ReadKey();
      }
   }
}

When the above code is compiled and executed, it produces the following result −

Value of Num: 35
Value of Num: 175

Customize the Quick Access Toolbar

Microsoft® Office – Customize the Quick Access Toolbar (IT...

1.    Click on the File tab.

2.    Click on Options, located in the left margin.

3.    From the Word Options window, click on Quick Access Toolbar.

4.    In the Customize the Quick Access Toolbar window, click on the drop-down menu labeled Popular Commands from the Choose commands from: (left column)

Conditional Formatting

To create a conditional formatting rule:

·         Select the desired cells for the conditional formatting rule.

·         From the Home tab, click the Conditional Formatting command. ...

·         Hover the mouse over the desired conditional formatting type, then select the desired rule from the menu that appears. ...

·         A dialog box will appear.

Feds Charge Three in Mass Seizure of Attack-for-hire Services

Authorities in the United States this week brought criminal hacking charges against three men as part of an unprecedented, international takedown targeting 15 different “booter” or “stresser” sites — attack-for-hire services that helped paying customers launch tens of thousands of digital sieges capable of knocking Web sites and entire network providers offline.

As of Thursday morning, a seizure notice featuring the seals of the U.S. Justice Department, FBI and other law enforcement agencies appeared on the booter sites, including:

• anonsecurityteam[.]com
• booter[.]ninja
• bullstresser[.]net
• critical-boot[.]com
• defcon[.]pro
• defianceprotocol[.]com
• downthem[.]org
• layer7-stresser[.]xyz
• netstress[.]org
• quantumstress[.]net
• ragebooter[.]com
• request[.]rip
• str3ssed[.]me
• torsecurityteam[.]org
• vbooter[.]org

Booter sites are dangerous because they help lower the barriers to cybercrime, allowing even complete novices to launch sophisticated and crippling attacks with the click of a button.

Cameron Schroeder, assistant U.S. attorney for the Central District of California, called this week’s action the largest simultaneous seizure of booter service domains ever.

“This is the biggest action U.S. law enforcement has taken against booter services, and we’re doing this in cooperation with a large number of industry and foreign law enforcement partners,” Schroeder said.

Booter services are typically advertised through a variety of methods, including Dark Web forums, chat platforms and even youtube.com. They accept payment via PayPal, Google Wallet, and/or cryptocurrencies, and subscriptions can range in price from just a few dollars to several hundred per month. The services are priced according to the volume of traffic to be hurled at the target, the duration of each attack, and the number of concurrent attacks allowed.

Purveyors of stressers and booters claim they are not responsible for how customers use their services, and that they aren’t breaking the law because — like most security tools — stresser services can be used for good or bad purposes. For example, all of the above-mentioned booter sites contained wordy “terms of use” agreements that required customers to agree they will only stress-test their own networks — and that they won’t use the service to attack others.

But experts say today’s announcement shreds that virtual fig leaf, and marks several important strategic shifts in how authorities intend to prosecute booter service operators going forward.

“This action is predicated on the fact that running a booter service itself is illegal,” said Allison Nixon, director of security research at Flashpoint, a security firm based in New York City. “That’s a slightly different legal argument than has been made in the past against other booter owners.”

For one thing, the booter services targeted in this takedown advertised the ability to “resolve” or determine the true Internet address of a target. This is especially useful for customers seeking to harm targets whose real address is hidden behind mitigation services like Cloudflare (ironically, the same provider used by some of these booter services to withstand attacks by competing booter services).

Some resolvers also allowed customers to determine the Internet address of a target using nothing more than the target’s Skype username.

“You don’t need to use a Skype resolver just to attack yourself,” assistant U.S. Attorney Schroeder said. “Clearly, the people running these booter services know their services are being used not by people targeting their own infrastructure, and have built in capabilities that specifically allow customers to attack others.”

Another important distinction between this week’s coordinated action and past booter site takedowns was that the government actually tested each service it dismantled to validate claims about attack firepower and to learn more about how each service conducted assaults.

In a complaint unsealed today, the Justice Department said that although FBI agents identified at least 60 different booter services operating between June and December 2018, they discovered not all were fully operational and capable of launching attacks. Hence, the 15 services seized this week represent those that the government was able to use to conduct successful, high-volume attacks against their own test sites.

“This is intended to send a very clear message to all booter operators that they’re not going to be allowed to operate openly anymore,” Nixon said. “The message is that if you’re running a DDoS-for-hire service that can attack an Internet address in such a way that the FBI can purchase an attack against their own test servers, you’re probably going to get in trouble.”

DOWN THEM ALL

Charged in a Los Angeles federal court this week were the alleged operators of “Downthem” — a booter service the government says helped some 2,000 customers launch debilitating digital assaults at more than 200,000 targets, including many government, banking, university and gaming Web sites.

Prosecutors say that in addition to running and marketing Downthem, defendants Matthew Gatrel from St. Charles, Ill., and Juan Martinez of Pasadena, Calif. sold huge, continuously updated lists of Internet addresses tied to devices that could be used by other booter services to make attacks far more powerful and effective.

Booter and stresser services let customers pick from among a variety of attack methods, but almost universally the most powerful of these methods involves what’s known as a “reflective amplification attack.” In such assaults, the perpetrators leverage unmanaged Domain Name Servers (DNS) or other devices on the Web to create huge traffic floods.

Ideally, DNS servers only provide services to machines within a trusted domain — such as translating an Internet address from a series of numbers into a domain name, like example.com. But DNS reflection attacks rely on consumer and business routers and other devices equipped with DNS servers that are (mis)configured to accept queries from anywhere on the Web.

Attackers can send spoofed DNS queries to these DNS servers, forging the request so that it appears to come from the target’s network. That way, when the DNS servers respond, they reply to the spoofed (target) address.

The bad guys also can amplify a reflective attack by crafting DNS queries so that the responses are much bigger than the requests. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This “amplification” effect is especially pronounced if the perpetrators query dozens of DNS servers with these spoofed requests simultaneously.

The government alleges that Gatrel and Martinez constantly scanned the Internet for these misconfigured devices, and then sold lists of Internet addresses tied to these devices to other booter service operators.

Schroeder said the government is arguing that the use of these third-party servers in reflective amplification attacks can be prosecuted under existing wire fraud and computer trespass laws.

“Certainly [booter service operators] don’t have permission from all of those other devices owners to use the devices and their bandwidth to direct these attacks,” she said. “We look at it as a wire fraud violation because essentially they’re stealing property from upstream providers and using their resources to conduct these attacks. There are also multiple ways we can show this is pretty clearly not lawful under the Computer Fraud and Abuse Act.”

Prosecutors further allege Gatrel resold his booter services to other booter operators, including Quantum Stresser — one of the 15 services seized by the government this week. The alleged operator of that service, Pennsylvania resident David Bukoski, was charged in the District of Alaska this week for aiding and abetting computer intrusions.

Investigators say Bukoski’s booter service was among the longest running services targeted by the FBI, operating since at least 2012. An indictment against Bukoski unsealed this week maintains Quantum Stresser had over 80,000 customer subscriptions, and that during 2018 the service was used to conduct over 50,000 actual or attempted attacks targeting people and networks worldwide.

Adam Alexander, assistant U.S. attorney for the District of Alaska, said additional prosecutions against booter service operators will be forthcoming.

“We are becoming more experienced, thanks to the growing expertise and shoe-leather investigative work required to attribute, identify and prosecute individuals responsible for these services,” Alexander said. “Actions like this one demonstrate our capabilities are increasing as well.”

According to the government, the use of booter and stresser services to conduct attacks is punishable under both wire fraud laws and the Computer Fraud and Abuse Act (18 U.S.C. § 1030), and may result in arrest and prosecution; seizure of computers or other electronics; significant prison sentences; a penalty or fine.

Schroeder said the government understands this week’s takedowns aren’t going to solve the booter problem once and for all, and that other booter services will likely spring up in the wake of those dismantled this week. But she said the arrests and seizures have helped build a template that the government can use in tandem with its industry partners to shorten the lifespan of new booter services and to bring those responsible to justice.

“We certainly don’t expect this problem to go away after this,” Schroeder said. “But this is an attempt to build a strategic approach to this problem, to look at it in a more systemic way and deal with it on a much larger scale.”

How to create our own header file

How to create our own header file

1.    Step 1 : Make headerfile. Example (write only function definition as you write in General C Program) int add(int a,int b){ ...

2.    Step 2 : Save Code. Save Above Code with [.h ] Extension . Let name of our header file be myfirstheader [ myfirstheader.h ]

3.    Step 3 : Write Main C Program To Use header file. #include<stdio.h>

JAVA vs Python

Entering text in a document

Typing and Editing Text

1.    Start typing your text.

2.    To start a new paragraph, press Enter.

3.    To add extra space between paragraphs, press Entertwice.

4.    To move the cursor in a document, click where you want to insert it or use the keyboard arrow keys to move it.

5.    To edit text, click in the word you want to change.

Quora Hacked! More Than 100 Million Users Data Stolen

We all know very well that Quora is the 95th most visited website on the internet, hence, gaining more than 700 million monthly visits. This website simply works like the well-known Yahoo! Answers portal where people can simply ask questions and users around the globe simply answer them to clarify the doubts.

The well-known question-and-answer website, of course, I am talking about Quora has been hacked. This well-known question-and-answer based portal was launched in 2010, and since then they have not stopped growing. But, recently, the security experts of Quora has discovered a major security breach that has exposed the data of its 100 million users to unauthorized third parties.

Hence, the company, of course, Quora has contacted the authorities and hired a well-known security company simply to determine how the security breach occurred and who carried out the attack. Among the data that was exposed the 100 million users are:-

• Account information: name, email, encrypted password and data imported from associated networks.
• Public profile content: questions, answers, comments and votes.
• Non-public content: response requests, negative votes, direct messages.
• 

Moreover, any possible data associated with the accounts have been affected by this failure. However, the fact is that the passwords are encrypted is good, but in most of these cases the attackers manage to reverse the encryption process and get the passwords in the plain text once they can guess what encryption process has been applied; especially if they have used one with less than 10,000 iterations.

If you have not used anything to make your password complex, then attackers can easily hack them quickly. In case if they have used functions like bcrypt then it will be almost impossible to convert them to plain text. However, Quora has not said anything beyond this statement “the passwords are encrypted.”

The security experts do not close any possibility, and at the moment they do not know how the attacker has managed to have access to the systems of Quora. Moreover, the users of the well-known web portal, of course, Quora are already being contacted by the company to tell them to change their passwords as soon as possible. Luckily, no more serious personal information was stored on the website like bank details, identity number or personal physical address etc.

Hence, if you have an account on Quora, we recommend that you must change the password right now.