Working on orkut security, I know that fraudulent sites sometimes try to take advantage of orkut users like you and me. To help make sure that everyone is able to have a fun and safe experience on the site, I thought I'd share a few quick tips that I've picked up during my time on the orkut team. A bunch of these might seem like no-brainers, but hopefully you'll learn something new here as well:

• Create a tough password: While "yourname123" is always a tempting password to create, keep in mind that it's just as easy for a malicious user to figure out as it is for you to remember. Try creating a password that involves a combination of letters and numbers that no one could easily guess, even if they know basic details about who you are. The same goes for your security question (the question that pops up if you forget your password)– you should try your best to pick a question that only you can answer.

• Keep your private details private: Never share your orkut username and password with friends or on a site not authenticated by Google. orkut does not allow any external sites to store orkut login information and will never request that you enter it anywhere outside of the orkut login page. To be on the safe side, always check that your address bar reads "https://www.google.com/accounts/ServiceLogin?....." and nothing else when sharing your orkut user name and password.

• Leave the coding to the engineers: Never copy and paste code into your address bar, no matter what it claims to be able to do. Typically these scripts actually send messages (in your name!) to your friends trying to trick them into giving up their personal information.

• Downloads and orkut don't mix: Never download any file off of orkut, especially those that end in '.vb' or '.exe'. These files are often viruses that can infect your computer and start sending thousands of spam messages on your behalf. Sites offering special orkut themes or skins are particularly risky.

• Think twice about external links: Links to sites outside of orkut that appear in scraps or posts have not been verified by the orkut team, and could lead you to harmful sites. We'd recommend only clicking on links that go to trusted sites or those that are from other orkut users you know well.

• Anti-Virus software is always a good call: Even the most conscientious orkuteer can fall victim to a phishing attack, so it's important to always be alert and prepared. Regularly scanning your computer with updated anti-virus software is a great way to keep your computer secure.

• For new orkut features, check out apps!: Sometimes an unofficial site may claim to offer special orkut features, but these sites are known for taking over orkut accounts and directly violate our Terms of Service. If you're looking for fun new orkut functionality, check out the thousands of applications that we have available. All of these apps have been built by talented developers according to standards that we believe will help to keep you safe online. If you haven't visited the app directory recently, take a look– you might be surprised at how much cool stuff you find.

via orkut blog 

Read More

Denial Of Service (DoS) Attacks

A denial of service (DoS) attack is an attack that clogs up so much memory on the target system that it can not serve it's users, or it causes the target system to crash, reboot, or otherwise deny services to legitimate users.There are several different kinds of dos attacks as discussed below:-

1) Ping Of Death :- The ping of death attack sends oversized ICMP datagrams (encapsulated in IP packets) to the victim.The Ping command makes use of the ICMP echo request and echo reply messages and it's commonly used to determine whether the remote host is alive. In a ping of death attack, however, ping causes the remote system to hang, reboot or crash. To do so the attacker uses, the ping command in conjuction with -l argument (used to specify the size of the packet sent) to ping the target system that exceeds the maximum bytes allowed by TCP/IP (65,536).
example:- c:/>ping -l 65540 hostname
Fortunately, nearly all operating systems these days are not vulnerable to the ping of death attack.

2) Teardrop Attack :- Whenever data is sent over the internet, it is broken into fragments at the source system and reassembled at the destination system. For example you need to send 3,000 bytes of data from one system to another. Rather than sending the entire chunk in asingle packet, the data is broken down into smaller packets as given below:
* packet 1 will carry bytes 1-1000.
* packet 2 will carry bytes 1001-2000.
* packet 3 will carry bytes 2001-3000.
In teardrop attack, however, the data packets sent to the target computer contais bytes that overlaps with each other.
(bytes 1-1500) (bytes 1001-2000) (bytes 1500-2500)
When the target system receives such a series of packets, it can not reassemble the data and therefore will crash, hang, or reboot.
Old Linux systems, Windows NT/95 are vulnerable.

3) SYN - Flood Attack :- In SYN flooding attack, several SYN packets are sent to the target host, all with an invalid source IP address. When the target system receives these SYN packets, it tries to respond to each one with a SYN/ACK packet but as all the source IP addresses are invalid the target system goes into wait state for ACK message to receive from source. Eventually, due to large number of connection requests, the target systems' memory is consumed. In order to actually affect the target system, a large number of SYN packets with invalid IP addresses must be sent.

4) Land Attack :- A land attack is similar to SYN attack, the only difference being that instead of including an invalid IP address, the SYN packet include the IP address of the target sysetm itself. As a result an infinite loop is created within the target system, which ultimately hangs and crashes.Windows NT before Service Pack 4 are vulnerable to this attack.

5) Smurf Attack :- There are 3 players in the smurf attack–the attacker,the intermediary (which can also be a victim) and the victim. In most scenarios the attacker spoofs the IP source address as the IP of the intended victim to the intermediary network broadcast address. Every host on the intermediary network replies, flooding the victim and the intermediary network with network traffic.
Smurf Attack Result:- Performance may be degraded such that the victim, the victim and intermediary networks become congested and unusable, i.e. clogging the network and preventing legitimate users from obtaining network services.

6) UDP - Flood Attack :- Two UDP services: echo (which echos back any character received) and chargen (which generates character) were used in the past for network testing and are enabled by default on most systems. These services can be used to launch a DOS by connecting the chargen to echo ports on the same or another machine and generating large amounts of network traffic.

Read More

How Computer Viruses / Malware Attack?

Computer users are facing all sorts of security threats these days, computer viruses, computer worms, hackers, phishing, spyware.  Almost every computer is challenged by more than one type of malicious attack each day.  Knowing how these malicious programs spread and work can help you avoid potential damage to your computer.
How Malware Attack

Computer viruses, worms, and Trojan horses are collectively known as malware.  They spread on the internet via email, instant messages and file sharing.  Computer viruses need a host program to run whereas computer worms are self-contained.  Both can replicate and spread in enormous rate over the internet.

Computer viruses usually cause damage to boot sector, system BIOS, software or data files.  Your system may fail to start, legitimate programs cannot run and data files are lost or corrupted.

Computer worms are usually designed to spread automatically via email program, causing major disruption of internet traffic.  Some worms can create back door to allow authorized access to your computer.

Trojan horses usually do not replicate, they appear as some innocent programs, such as free games or free screensavers.  This tricks you into downloading and running the Trojan horse.  Trojan horses can open a back door, disable antivirus program and allow the download of other malware.
How Hackers Attack

Hackers are computer users who explore networks and computers, looking for vulnerabilities and infiltrate your system without your knowledge and permission. Some people argue that hackers may not have malicious intent, they are just curious about how computer network works.  Nevertheless, unauthorized access to someone’s computer or network is not a moral act.

Malicious hackers gain access to your computer via different ways.  For examples, hackers may use keystroke logger to record your every stroke, giving them enough information to infiltrate your system.  They may hack your password by generating different combinations of numbers, letters and symbols.  Hackers also search for unprotected network or enter your system via a back door installed previously by other malware.
How Spyware Attack

Spyware are usually downloaded from web sites, email messages, instant messages or file sharing network.  Some legitimate programs may install spyware in your computer when you accept the End User License Agreement.  Spyware does exactly what its name suggests: it spies on you by collecting personal or sensitive information or tracking your browsing and shopping habit.  Some spyware programs can change your web browser's home page or install additional components to your browser without your consent.

Spyware can result in identity theft, computer slowdown and slow internet access.  Spyware should not be confused with adware.  Adware is a program that displays advertisements, usually in the form of pop up ads.  Strictly speaking, adware is not spyware if no personal information and browsing habit is collected.  It is a way for some software developers to reimburse their development cost by providing freeware to their customers.
How Spam Attack

Email spam is the electronic form of junk mail.  Most spam messages are unsolicited advertising sent to a large number of recipients.  Spam messages are not only annoying, some of them are dangerous.  Some spam messages are used to deliver Trojan horses, viruses, spyware or links to offensive web sites with inappropriate content.

A new form of spam message is used to launch phishing attack.  Phishers, pretending to be legitimate companies such as banks, financial institutes, PayPal, send out spam messages to a large number of recipients.  They usually use scare tactic and ask you to update your personal information (login ID and password, account information, etc) immediately or your account will be suspended.  Once you click on the link provided in the spam messages, you would land on phish sites which look remarkably similar to the legitimate company web sites where the phishers will steal your personal information.

Now that you know how malware, spyware, hackers and spam attack your computer, you can be more proactive in your defense.  Be careful of free download, free scan, email attachment, file sharing and don’t click on the hyperlink of spam messages.  Read the End User agreement carefully when you install any software.  Keep track of unusual inbound and outbound internet activities.  If you do all of these and install an all-in-one internet security program (antivirus, antispyware, firewall, spam control), you should be pretty safe from these malicious attacks.

Read More

Cyber war: Google, China in fresh spat over email hacking

BEIJING/SAN FRANCISCO: Suspected Chinese hackers tried to steal the passwords of hundreds of Google email account holders, including those of senior US government officials, Chinese activists and journalists , the internet company said.[sintuhack]

The claim by the world's largest web search engine sparked an angry response from Beijing, which said blaming China was "unacceptable," pointing to further tensions in an already strained relationship with Google.[sintuhack]

The perpetrators appeared to originate from Jinan, the capital of China's eastern Shandong province, Google said. Jinan is home to one of six technical reconnaissance bureaus belonging to the People's Liberation Army and a technical college US investigators last year linked to a previous attack on Google.[sintuhack]

Washington said it was investigating Google's claims while the FBI said it was working with Google following the attacks — the latest computerbased invasions directed at multinational companies.[sintuhack]

Andrew Davies of the Australian Strategic Policy Institute , an independent security and defence think tank, said governments needed to pay more attention to hacking no matter where it originated from. "I think there has been a certain lack of appreciation of the looming threat around the world," Davies said.

The hackers recently tried to crack and monitor email accounts by stealing passwords, but Google detected and "disrupted " their campaign, the company said on its official blog. Google said it had notified the victims.
[sintuhack][sintuhack][sintuhack][sintuhack][sintuhack][sintuhack]

NOTE-- THE ABOVE CONTENT TAKEN FROM GOOGLE NEWS http://timesofindia.indiatimes.com/world/china/Cyber-war-Google-China-in-fresh-spat-over-email-hacking/articleshow/8705176.cms

Read More

Cyber law or It act of India

Cyber laws are meant to set the definite pattern, some rules and guidelines that defined certain business activities going on through internet legal and certain illegal and hence punishable .Today sintuhack will explian some fact about cyber case (sintuhack). The IT Act 2000, the cyber law of India , gives the legal framework so that information is not denied legal effect, validity or enforceability, solely on the ground that it is in the form of electronic records.

One cannot regard government as complete failure in shielding numerous e-commerce activities on the firm basis of which this industry has got to its skies, but then the law cannot be regarded as free from ambiguities.(sintuhack)


The IT Act 2000 attempts to change outdated laws and provides ways to deal with cyber crimes. Let’s have an overview of the law where it takes a firm stand and has got successful in the reason for which it was framed.(sintuhack)

1. The E-commerce industry carries out its business via transactions and communications done through electronic records . It thus becomes essential that such transactions be made legal . Keeping this point in the consideration, the IT Act 2000 empowers the government departments to accept filing, creating and retention of official documents in the digital format. The Act also puts forward the proposal for setting up the legal framework essential for the authentication and origin of electronic records / communications through digital signature.(sintuhack)

2. The Act legalizes the e-mail and gives it the status of being valid form of carrying out communication in India . This implies that e-mails can be duly produced and approved in a court of law , thus can be a regarded as substantial document to carry out legal proceedings.(sintuhack)

3. The act also talks about digital signatures and digital records . These have been also awarded the status of being legal and valid means that can form strong basis for launching litigation in a court of law. It invites the corporate companies in the business of being Certifying Authorities for issuing secure Digital Signatures Certificates.

4. The Act now allows Government to issue notification on the web thus heralding e-governance.(sintuhack)

5. It eases the task of companies of the filing any form, application or document by laying down the guidelines to be submitted at any appropriate office, authority, body or agency owned or controlled by the government. This will help in saving costs, time and manpower for the corporates.(sintuhack)

6. The act also provides statutory remedy to the coporates in case the crime against the accused for breaking into their computer systems or network and damaging and copying the data is proven. The remedy provided by the Act is in the form of monetary damages, not exceeding Rs. 1 crore($200,000).(sintuhack)

7. Also the law sets up the Territorial Jurisdiction of the Adjudicating Officers for cyber crimes and the Cyber Regulations Appellate Tribunal.(sintuhack)

8. The law has also laid guidelines for providing Internet Services on a license on a non-exclusive basis.(sintuhack)

The IT Law 2000, though appears to be self sufficient, it takes mixed stand when it comes to many practical situations. It looses its certainty at many places like:(sintuhack)

1. The law misses out completely the issue of Intellectual Property Rights, and makes no provisions whatsoever for copyrighting, trade marking or patenting of electronic information and data. The law even doesn’t talk of the rights and liabilities of domain name holders , the first step of entering into the e-commerce.(sintuhack)
2. The law even stays silent over the regulation of electronic payments gateway and segregates the negotiable instruments from the applicability of the IT Act , which may have major effect on the growth of e-commerce in India . It leads to make the banking and financial sectors irresolute in their stands .(sintuhack)(sintuhack)
3. The act empowers the Deputy Superintendent of Police to look up into the investigations and filling of charge sheet when any case related to cyber law is called. This approach is likely to result in misuse in the context of Corporate India as companies have public offices which would come within the ambit of "public place" under the Act. As a result, companies will not be able to escape potential harassment at the hands of the DSP.(sintuhack)
4. Internet is a borderless medium ; it spreads to every corner of the world where life is possible and hence is the cyber criminal. Then how come is it possible to feel relaxed and secured once this law is enforced in the nation??(sintuhack)

The Act initially was supposed to apply to crimes committed all over the world, but nobody knows how can this be achieved in practice , how to enforce it all over the world at the same time???(sintuhack)

* The IT Act is silent on filming anyone’s personal actions in public and then distributing it electronically. It holds ISPs (Internet Service Providers) responsible for third party data and information, unless contravention is committed without their knowledge or unless the ISP has undertaken due diligence to prevent the contravention .(sintuhack)
* For example, many Delhi based newspapers advertise the massage parlors; and in few cases even show the ‘therapeutic masseurs’ hidden behind the mask, who actually are prostitutes. Delhi Police has been successful in busting out a few such rackets but then it is not sure of the action it can take…should it arrest the owners and editors of newspapers or wait for some new clauses in the Act to be added up?? Even the much hyped case of the arrest of Bajaj, the CEO of Bazee.com, was a consequence of this particular ambiguity of the law. One cannot expect an ISP to monitor what information their subscribers are sending out, all 24 hours a day.(sintuhack)

Cyber law is a generic term, which denotes all aspects, issues and the legal consequences on the Internet, the World Wide Web and cyber space. India is the 12th nation in the world that has cyber legislation apart from countries like the US, Singapore, France, Malaysia and Japan .(sintuhack)

But can the cyber laws of the country be regarded as sufficient and secure enough to provide a strong platform to the country’s e-commerce industry for which they were meant?? India has failed to keep in pace with the world in this respect, and the consequence is not far enough from our sight; most of the big customers of India ’s outsourcing company have started to re-think of carrying out their business in India .Bajaj’s case has given the strongest blow in this respect and have broken India ’s share in outsourcing market as a leader.(sintuhack)

If India doesn’t want to loose its position and wishes to stay as the world’s leader forever in outsourcing market, it needs to take fast but intelligent steps to cover the glaring loopholes of the Act, or else the day is not far when the scenario of India ruling the world’s outsourcing market will stay alive in the dreams only as it will be overtaken by its competitors.sintuhack,sintuhack,sintuhack,sintuhack,sintuhack,sintuhack,sintuhack,sintuhack

Read More

Online Survey Company Is Fraud Or Not-how to know

Today, when there is hot dispute is already going on between the star news and online paid survey company Speak Asia after publishing the negative news about Speak Asia and their business behavior. sintuhack strongly feel that sintuhack should post an article to help you find the possible online fraud survey companies which are asking for money any how.


1. Whois Lookup:
A/c to sintuhack try to who is look up for the domain of official website of paid survey company you can easily find the following details.sintuhack also suggest you to know
Who is the owner of website domain?
From since long the website is active, means since how long the company is in survey business?
What is the registered official address? Where the company office is actually located.
All these info helps a lot to decide weather the company you are researching about is just another online scam or not.


2. SEO Research:
Seo research on the paid survey website can easily tell you the fact about how the website is popular in the world. You can look for number of backlinks, Google page rank and alexa rank for this. From alexa traffic analysis you can also find the location of main traffic toward the website so you can know where the website is doing more business in the world.


3. Online Complains and Scam Discussion boards:
One thing more a/c to sintuhack use google to know page rank of that website.
If you search in Google with the words like complain, fraud, scam along with the company name, you can easily find the various blogs or websites where people might have discussed about their issues or complaints with the company. Although every good company will also have some issues with clients but too much of them can really alarm you about possible online scam.


4. Make money online blogs and forums.
Here sintuhack talking about the blogs and forums where people are generally from the similar niche and discuss about how to make money online. It would be great source to find the exact information about such paid scams. If you are new to online money making niche and much not aware of the scams you can also post comments (here also) and threads in forum in similar niche to get reviews of experts in the same niche.


5. Think smartly, wisely and independently.
And last sintuhack guide you to use internet smartly wisely and independently
Think smartly to detect online scams
Its my own experience that people always get trapped in scams because they are always in search of quick rich formula and hence they generally do not think for the most important questions. So think like you want to investigate about the company and not want to invest in it, this way you can find most answers easily.

Read More

Pharming Security

PHARMING-- BY request of one my reader,i am trying to explain what is Pharming.Due to short of time i cant explain all about pharming.
Pharming is the exploitation of a vulnerability in the DNS server software that allows a hacker to acquire the domain name for a site, and to redirect that website's traffic to another web site. DNS servers are the machines responsible for resolving internet names into their real addresses - the "signposts" of the internet.


If the web site receiving the traffic is a fake web site, such as a copy of a bank's website, it can be used to "phish" or steal a computer user's passwords, PIN or account number. Note that this is only possible when the original site was not SSL protected, or when the user is ignoring warnings about invalid server certificates.


For example, in January 2005, the domain name for a large New York ISP, Panix, was hijacked to a site in Australia. In 2004 a German teenager hijacked the eBay.de domain name.


Secure e-mail provider Hushmail was also caught by this attack on 24th of April 2005 when the attacker rang up the domain registrar and gained enough information to redirect users to a defaced webpage.

Read More

Computer Hackers and Predators

How computer hackers and predators are threat for your computer security?

People with bad mind, not the computers, create computer threats. Computer predators victimize unaware people for their gain.  A predator having access to the Internet is exponentially bigger threat to your PC than the others. Computer hackers and predators are unauthorized users who break into others computer systems to steal, change or destroy valuable information, often by installing dangerous and harmful malware without your knowledge. The use of clever tactics and detailed technical knowledge help them to access the information you really don’t want to let them know.
What computer hackers and predators do to find you?
Everyone who uses a computer with a Internet connection is susceptible by the threats of computer hackers and predators. These online demons mainly use spam emails or instant messages, phishing scams, and bogus Web sites (fake or duplicate webpage which almost look like the original) to deliver dangerous and harmful malware to the computer and disable your computer security. They will also try to access your computer and thus your private information directly if you had not taken protection by configuring your firewall. They can also peruse your personal Web page or monitor your chat room conversations. Generally by using a fake identity, predators can fool you and make you into revealing sensitive personal and financial information.
Be aware: computer hackers and predators can do the following things to you.
With the help of malware transmitted by the hacker, he can get your personal as well as financial information without your knowledge. Then he can use this information for his benefit and it will harm you in the aspect of loss of money as well as private information and data. In either case, they may:
•    Know your usernames and passwords and will change it or use it according to him.
•    Using your info they can open credit card and bank accounts in your name
•    Steal your money and Ruin your credit
•    additional credit cards  or Request new account Personal Identification Numbers (PINs) o
•    Make purchases form offline stores.
•    Add themselves or an alias that they control as an authorized user so it’s easier to use your credit
•    Obtain cash advances from your credit card
•     Abuse your Social Security number
•    Sell your information to such person who will use it for illegal purposes
Especially predators can pose a serious physical threat. Be extremely cautious when agreeing to meet an online “friend” or acquaintance in person.
Ways to know that are you in the net or not?
Regularly check the accuracy of your personal accounts, credit cards bills and other documents. Are there any unexplained transactions?
Questionable or unauthorized changes?
 If so, the dangerous and harmful malware is already installed by predators or hackers in your computer.
What can I do about computer hackers and predators?
Read as much as possible about the articles on computer security threats on this blog and increase our knowledge about this. Although Hackers and predators pose equally serious and but very different threats you will wiser enough to avoid their tricks.
To protect your computer from hackers and predators:
•    Regularly check the accuracy of your personal accounts and deal with any discrepancies instantly.
•    Use extreme caution when entering any chat rooms or posting on personal Web pages
•    Put a limit on the personal information you post on a personal Web pages
•    Carefully monitor requests  on social networking sites by online “friends” or acquaintances for predatory behavior
•    Keep personal and financial information out of any type of online conversations
Take these steps to protect your computer from hackers right away:
•    Switch to 2 way firewall.
•    Update your operating system on regular basis.
•    Increase your browser security settings.
•    Only download software from trusted sites you trust.
•    First carefully evaluate free software then use and do same in the case of file-sharing applications before downloading them.
•    Practice safe email protocol.
•    Don't respond messages from unknown senders, even don’t open it.
•    Immediately delete messages you suspect to be spam.
•    Make sure that you have the best internet security products installed on your computer.
•    Always use antivirus protection
•    Also Get antispyware software protection
An unprotected computer is a like a free gift for computer hackers and predators. To protect your computer from hackers and predators also use a spam filter or gateway to scan inbound email or IM messages. While free anti-spyware and antivirus downloads are widely available, they just can’t keep up with the continuous onslaught of new malware strains due to their limited functionality. Previously undetected forms of malware can often do the most damage, so it’s necessary to have up-to-the-minute updated and guaranteed protection.

Read More

Bug disables 150,000 Gmail accounts

NEW DELHI, INDIA: Gmail, with its huge storage capacity, is considered a store house of personal information for many, where many valuable informations are securely kept. But think twice before relying too much on keeping all your informations there alone.

Because, Google's email service has been affected with a bug and almost 150,000 Gmail account holders have reportedly lost their e-mail, attachments and Google Chat logs lost.
Google said it is investigating a glitch in the service of Gmail, which has caused the huge data lose for many users.
The bug reset the affected accounts and showed a welcome message to some users. Google said in a statement that the bug had affected less than 0.08 per cent of all Gmail users. Yes, percentage wise it is a small amount, but 150,000 not a small number too!
It said that their engineers are trying to solve the glitch and as soon as possible the accounts will be restored soon.
“Affected users will be temporarily unable to sign in while we repair their accounts. For those Gmail users reporting missing messages, our engineers are working to restore them as soon as possible,” Google said in a statement.

Read More