Man In The Middle Attack (MITM)

 Man In The Middle Attack (MITM)

Source: Ethical Hackers Academy

Tips To Prevent Social Engineering Attacks

 Tips To Prevent Social Engineering Attacks

Source: LinkedIn - Ethical Hackers Academy

Migrate from Microsoft Windows to Linux

 Migrate from Microsoft Windows to Linux

SSO (Single Sign-On)

 SSO (Single Sign-On)

What is an Evil Twin Attack and How Does It Work?

 What is an Evil Twin Attack and How Does It Work?

Types of Cyberattacks / Tipos de Ciberataques

 Types of Cyberattacks / Tipos de Ciberataques 

32 Cyber Security Terms

 32 Cyber Security Terms 

1. Malware

Malware is a portmanteau of “malicious” and “software,” and describes any malicious code that infects a computer with unwanted files, programs or lines of code that can do a variety of destructive things. Malware can decrease a device’s functionality, allow cybercriminals to steal data or personal information, or take control of an entire computer or network. 

2. Phishing

Phishing scams began in the mid-1990s, when hackers started targeting users of AOL, then the leading provider of internet service. Hackers stole users’ passwords by sending them emails posing as AOL employees, then generating random credit card numbers in the hopes of matching some of them to real users’ accounts. When the credit card number generator was shut down, phishers began targeting payment systems, which are the custodians of millions of credit card profiles. 

Today the practice continues with hackers using fake emails and websites to lure people into handing over personal information like bank details or account passwords.

3. DDoS Attack

Denial of service (DoS) attacks and distributed denial of service (DDoS) attacks are two similar types of cyber threats. Both are designed to interrupt a website’s normal functionality by overwhelming and paralyzing the site with a massive amount of illegitimate, bot-generated traffic, blocking legitimate users from accessing it. In a DDoS attack, the action is a system-on-system attack launched by a network of malware-infected machines controlled by the hacker. 

4. Ransomware

Ransomware is a type of malware that holds a company’s data or devices hostage, encrypting it until a specific amount of money is paid. Cybercriminals engaging in ransomware attacks may also threaten to use the stolen data to perpetrate additional attacks on a company’s customers. 

Healthcare payment systems have been recent ransomware targets. In early 2024, a ransomware attack on the country’s largest healthcare payment processor reverberated throughout the entire healthcare system. The attack prevented healthcare providers throughout the United States from electronically filling prescriptions or processing reimbursement from insurance companies.

5. Botnet

A botnet is a network of devices that are infected with and controlled by malware, used to carry out a coordinated cyberattack. You may have also heard the term “zombie computers” used to collectively describe these connected devices, because they carry out the commands of a single attacker (called the bot-herder) who maintains control over them. By using botnets, cybercriminals can carry out attacks on a large scale.

6. Internet of Things

The internet of things (IoT) is a term used to describe the network of interconnected devices that communicate to each other. This term covers everything from smart devices, appliances, vehicles and wearable smart products that enhance our day to day lives, to industrial machinery that monitor environmental conditions, track warehouse inventory and shipments, and control manufacturing processes. 

In the IoT, each device has its own Internet Protocol (IP) address, which enables users to interact with it, and allows the device itself to interact with a wide-reaching network of other devices to exchange data and perform tasks autonomously. 

7. Encryption

Encryption is a method of scrambling information to make it inaccessible to unauthorized users. When used effectively, encryption enables even the most sensitive information like passwords and financial documents to be transmitted securely online. Encryption works by encoding text into a version called ciphertext, which can then be decoded back to plain text using an algorithm-generated key.

8. Firewall

A firewall is a piece of hardware or software that follows a strict, predetermined set of security rules that determine what traffic to allow on a network and what to block.  

In computer networks, firewalls, sometimes called gateways, filter traffic and monitor it for malware or other external threats. 

9. VPN

A VPN, or virtual private network, makes working, shopping or browsing safer by creating an encrypted connection between your device and a remote server. Anyone who might be watching your online activities will then see the IP address of the VPN server, and not your computer. 

Encrypting your internet traffic through a VPN isn’t a cyber security cure-all, but it makes it much harder for would-be cybercriminals, or even advertisers, to monitor your web traffic.

10. Data Breach

A data breach is any incident where unauthorized parties gain access to sensitive data. This may include corporate data like intellectual property and financial information, or personal data like social security numbers, back account details or healthcare information. 

Organizations of all types and sizes can be vulnerable to data breaches. Even if there was no actual data lost, the cost of a data breach can be quite high. According to a 2023 IBM report, the global average cost of a data breach was $4.45 million. 

11. User Account Control

User Account Control (UAC) is a security feature in the Windows operating system, which works by limiting malware’s ability to make unauthorized changes.   

When a user signs in, the operating system creates an access token, a kind of passport, for that user that has their level of access built into it. With UAC enabled, if a standard computer user (which is what malware might be identified as) attempts to run an application that requires an administrator-level token, the user is prompted to provide additional administrator credentials. An example of this prompt would be: “Do you want to allow this app to make changes to your device?”

12. Password Management Tools

Many data breaches are the result of poor password management. Passwords that are weak, or using the same password for multiple accounts can be exploited by cybercriminals looking to gain access to accounts and networks. 

Password management tools help users stay safe by generating randomized passwords that are difficult to decipher for hackers but only require the user to remember one password for when they need to access the tool. Some of the top password managers provide high-quality user interfaces, tutorials, password hygiene alerts and support multiple forms of multi-factor authentication.

13. Antivirus Software

This specialized software is designed to scan your files for suspicious activity at regular intervals and detect and remove malware from your devices when it finds it. Antivirus software provides a defense against many kinds of malware, including spyware tools like keyloggers that allow hackers to steal your work or personal login credentials. 

14. Security Awareness Training

For many organizations, security awareness training provides a way to educate their employees about best practices for spotting social engineering attempts like phishing or other scams. Despite all the technologies and tools companies use to fortify their systems, it’s the individual users that can often represent potential weaknesses in a company’s safeguards. 

Organizations are encouraged to extend this training to temp workers, contractors or anyone else who works with important information or has network access.  

15. Trojan Horse Virus

This common form of malware is named for the giant wooden horse the ancient Greeks used to infiltrate the city of Troy. While they may look like legitimate programs, a Trojan Horse Virus can take control of your computer once it’s let in and rapidly spread across any network that it’s connected to. There are many different variations of this type of malware, each of them designed to infiltrate and exploit in a different way.

16. Spyware

Next in our cyber security glossary of terms is spyware, which accesses your devices and watches your activity without your consent. 

Commonly used forms of spyware include adware and system monitors, which track a user’s activity like social media habits, emails, sites visited or keystrokes. It’s often used for a number of nefarious purposes, like identity theft, but it can also be used to collect and sell your data to third parties. 

17. Clickjacking

This form of malicious activity typically uses social engineering tactics to trick users into clicking harmful links or downloading dangerous files with the goal of hijacking their accounts or stealing sensitive information. A common clickjacking strategy is using a transparent overlay that looks like a legitimate webpage over the malicious one and its strategically placed link. 

18. Hackers

This broad category can actually embrace both friend and foe in the realm of network security: 

Black hat hackers: Cybercriminals who gain unauthorized access to steal or damage sensitive data, usually for financial gain.

White hat hackers: These engage in a practice called ethical hacking, as they attempt ways to penetrate network’s defenses in order to identity and patch system vulnerabilities before bad actors can discover them.

Gray hat hackers: If these hackers gain unauthorized access to data systems, their intentions can be questionable. When they identify a system vulnerability, they may leak it online to inform the organization so it can be patched up, but it’s mostly done to show off their skill or potentially receive payment.

19. Virus

Computer viruses are a type of malware that attach themselves to a program or document on your device. They generally lie dormant until you activate the program or open the document the virus is attached to, but at that point they quickly replicate and spread. 

20. IP Address

IP (Internet Protocol) addresses are an important part of how the internet functions. Each connected device has its own IP address, or an identifier that makes the device accessible and identifies what kind it is (computers, routers, websites, etc.)

The format for IP addresses is 4 sets of numbers broken up by a period, with each set ranging from 0 to 255. You may think IP addresses are generated randomly, but they’re actually produced and allocated by the Internet Corporation for Assigned Names and Numbers (ICANN).

21. Worm Virus

This malware is particularly troublesome because it can replicate itself and spread automatically. Worm viruses can be used to steal data or cause servers to become overloaded and malfunction, consuming large volumes of memory and bandwidth along the way.

22. Authentication

User authentication is the process of verifying a user’s identity and is an important step in minimizing unauthorized access to systems and the information they contain. While passwords can be effective, using 2 or more authentication methods is recommended as a best practice. For example, in addition to a password, a second form of authentication could be an SMS message with a one-time access code sent to the user’s cellphone.

23. Deepfake

Deepfake is a term we’re likely to hear more about as generative AI technologies mature. This term describes audio or video that’s been altered or generated using AI to create a misleading version of it. Initially used in the entertainment arena, there is concern that deepfakes could be used for more wide-spread and nefarious purposes. For example, politically motivated groups could release deepfake videos of public figures making incendiary statements or engaging in unwelcome behaviors. These actions could be used to embarrass an individual, but they also have the potential to have wide-reaching effects on public discourse. 

24. Man-In-The-Middle Attack

This cybercrime method positions the hacker between two network users. After intercepting an authentic communication, the cybercriminal puts up a fake version that the unsuspecting recipient interacts with, allowing the attacker to access and steal data from their computer or information network.

25. Penetration testing

Penetration testing involves authorized attempts to gain access to apps or systems in order to identify weaknesses in their defenses before malicious hackers have a chance to exploit them. 

26. Advanced Persistent Threat (APT)

Typically launched against high-value organizations by experienced and well-funded cybercriminals, this sophisticated and sustained cyberattack enables intruders to steal intellectual property or state secrets for long periods of time.  

Like other intrusions, the cybercriminals gain access to a network through social engineering techniques, only this time they’re typically geared toward executive-level employees.

27. Keylogger

Keyloggers, which are also called keystroke loggers, are a type of spyware that monitors and records everything you type, then sends the information to hackers. Keyloggers can infect your system in the same way as other malware; once installed, the information they harvest (like account and credit card numbers or passwords) can be used to commit identity theft or fraud. 

28. Social Engineering

Social engineering describes a variety of techniques used by hackers and con artists to exploit our human instincts. A social engineering strategy could be as straightforward as a persuasive individual bluffing their way past security in a physical space, or it could also be the first step in a plan to infiltrate a data network via phishing emails. Phishing emails, as we mentioned earlier, prey upon our tendencies to be helpful, polite or compliant, tricking us into divulging sensitive information or providing access to a source that appears to be trustworthy. 

29. Artificial Intelligence

Artificial intelligence integration is an emerging cyber security trend. When cyber security is powered by AI, it can analyze data quickly and efficiently, and assist in rapid decision-making when it comes to handling threats. AI and machine learning can understand trends and patterns in the flow of information and help security professionals work to predict them by providing data visualization and forecasting.

30. Bug

In cyber security, a bug is a software coding or specification defect that can lead to security failures by initiating a chain of weaknesses. The chain begins with the bug, then propagates through errors that become faults. These errors in system behavior can cause security failures that become convenient targets for cybercriminals.

31. Cloud Computing

Cloud computing has become a critical part of today’s Internet of things economy. Compared with the traditional model of physical, on-site data infrastructure, the cloud model gives organizations greater flexibility, and the ability to scale up their information systems. Used by businesses of all sizes, cloud computing and its data storage and security characteristics enable remote workforces and their organizations to take care of business seamlessly and productively.

32. Cryptography

Cryptography is a vital element in the secure transit of data and communication. Designed to prevent cybercriminals from intercepting sensitive information, modern cryptography uses algorithms and ciphers to convert information into a format that is only readable if you have the key to decode it. 

Source and Credits: DeVry University

HOW WE MANAGE PROJECTS (Iterative, Agile, Waterfall, Spiral Model, RAD Model)

 

HOW WE MANAGE PROJECTS?

Iterative, Agile, Waterfall, Spiral Model, RAD Model... What are the differences?

The Software Development Life Cycle (SDLC) is a framework that outlines the process of developing software in a systematic way. Here are some of the most common ones:

 

1 - Waterfall Model:

- A linear and sequential approach.

- Divides the project into distinct phases: Requirements, Design, Implementation, Verification, and Maintenance.

 

2 - Agile Model:

- Development is done in small, manageable increments called sprints.

- Common Agile methodologies include Scrum, Kanban, and Extreme Programming (XP).

 

3 - V-Model (Validation and Verification Model):

- An extension of the Waterfall model.

- Each development phase is associated with a testing phase, forming a V shape.

 

4 - Iterative Model:

- Focuses on building a system incrementally.

- Each iteration builds upon the previous one until the final product is achieved.

 

5 - Spiral Model:

- Combines iterative development with systematic aspects of the Waterfall model.

- Each cycle involves planning, risk analysis, engineering, and evaluation.

 

6 - Big Bang Model:

- All coding is done with minimal planning, and the entire software is integrated and tested at once.

 

7 - RAD Model (Rapid Application Development):

- Emphasizes rapid prototyping and quick feedback.

- Focuses on quick development and delivery.

 

8 - Incremental Model:

- The product is designed, implemented, and tested incrementally until the product is finished.

Each of these models has its advantages and disadvantages, and the choice of which to use often depends on the specific requirements and constraints of the project at hand. 

SOURCE: LINKEDIN POST

COMMENTS? WIRTE ME AND LEFT A COMMENT BELOW

Let’s talk about… What is Custom ROM in cellular phones

Let’s talk about… What is Custom ROM in cellular phones

Before we head down, you can learn about the custom ROM; well, with the word of XDA, Custom ROMs are one of the best things about Android. By installing custom ROM, you get the benefits such as an improved battery, better performance, easy root access, customization, themes (not all supported), and many more. Source: https://www.getdroidtips.com/best-custom-rom-xiaomi-poco-x3-pro/

 

ADVANTAGES OF A CUSTOM ROM

Source: https://www.quora.com/What-are-the-advantages-of-a-custom-ROM

There are lot of advantages of having a custom ROM, but all might not be applicable to you. I’ll list a few I know, see if they are good for you:

• NO BLOATWARE: Custom ROMs always come with only necessary apps and never contains promotional contents or bloatware (of all ROMs I have seen).
• UI OF YOUR CHOICE: For example, you are a redmi user and you are fed up with the UI, then you could get a makeover with Pixel Experience ROMs that has the same UI as Pixel phones.
• EXTREME CUSTOMIZATION: This is the major reason why everyone switches to custom ROMs. The level of customization it offers is mind blowing, you could change how your status bar appears, how the quick settings panel appear or behave, set up shortcuts which were unavailable in your phone before, you can even control how you charge your battery!
• IMPROVED PERFORMANCE: Most ROMs that are not stock android, are not that optimized and won’t use the full potential of your smartphone, but custom ROMs might be able to do that and improve your smartphone experience and, in some cases, can even extend battery life. NOTE: This need not be always true, there are instances where the opposite happened, so read the reviews of the ROM before flashing it.
• GET RID OF GOOGLE: To most of them this would look like a disadvantage, but it’s a choice the manufacturer never gave us. Google is not just an app that you install in your phone, it’s an entire framework interwoven with your ROM. So, you cannot uninstall Google from phone, so if you don’t want google flash a custom ROM that does not have Gapps (google apps). Yes, without gapps lot of apps won’t work on your phone, if you want those you can get a lighter version of the gapps, like BitGapps (does not have user activity tracking like the original GApps and so consumes less resources and battery), NikGapps, OpenGapps, microg, etc.

NOTE: For flashing a custom ROM you will have to unlock the bootloader, which WILL VOID YOUR WARRANTY, and any ERRORS in the flashing procedure or using unofficial or beta ROMs might lead even BRICKING your phone. SO DO IT AT YOUR OWN RISK. (I will not be held responsible if anything goes wrong)

There is misconception that you must root your phone to flash custom ROM, this is wrong, rooting has nothing to do with custom ROMs, you flash custom ROMs from a custom recovery where you already have access to the root directory. Rooting is done by flashing a root zip, thus giving us access to the root directory when we use the phone normally. You can use custom ROMs without rooting too!

The procedures for flashing custom ROMs are easily available on the internet and always search along with your phone model name, lot of phones have unique methods to unlocking bootloader. 

ADVANTAGES AND DISADVANTAGES

Source: https://www.quora.com/What-are-the-pros-and-cons-of-a-custom-ROM 

ADVANTAGES:

• Upgrade your android version
• Get latest security patches
• Improved gaming performance (You can install custom kernel of your choice)
• Customization: Many custom ROMS like EvolutionX offer a lot of customization features
• Get rid of bloatware and other unwanted apps

DISADVANTAGES:

• Almost none if you flash the rom correctly and don’t brick it
• May contain some bugs but that too depends on which rom you are using
• The warranty is void and can’t reclaim of it
• Requires too much time, resources and reading and downloading
• Sometimes the flashing goes bad or has unwanted processes (wait for time complete, unlock the bootloader, learn, and investigate about more tools and drivers, etc.

Note: You should install custom rom if you need those advantages. If it is already being fulfilled by your OEM then there’s no need to flash, it unless your phone is old enough.

Sources:

• Quora Answer 1
• Quora Answer 2

Top 20 false beliefs users hold about IT professionals (Michael Medina)

Top 20 false beliefs users hold about IT professionals

Author: Michael Medina

1. Users expect IT professionals to drop everything and fix an issue immediately, regardless of how important the request is.
Your relatively insignificant issue probably isn't the most important thing IT needs to focus on right now. Often they're working on higher-priority problems.

2. Users expect IT professionals to know everything about technology, as if they have infinite knowledge.
IT pros are great at problem-solving, but getting to the bottom of an issue is a process that involves research; trial and error to rule out potential causes; and often, good old-fashioned Googling.

3. Users expect IT pros to fix personal computers free of charge.
IT professionals get paid to do work in the office, but what they do after hours is their own business. It's weird to ask them to do work for free. You wouldn't expect a mechanic to fix your car for free, or an accountant to do your taxes for you.

4. Users expect IT pros to understand every feature of every software application ever written.
It's not reasonable to expect someone to know everything about obscure products they've never used before. Sometimes IT will need to do some research before they can help you out, or you can just read the manual and figure it out yourself.

5. Users think that any member of the IT department can fix anything with a plug on the end of it.
IT professionals maintain computer and network infrastructure. Not fridges, toasters, or air conditioners. You call someone else for that. And often IT pros specialize in a specific area. You shouldn't expect a database or security expert to know how to repair a printer.

6. Users think that if an IT pro is sitting at their desk, they aren't doing anything.
The fact that an IT pro isn't running around the office doesn't mean they're free. Perhaps they're in the middle of solving a complex issue, or using remote software to examine someone's computer. Don't take their presence as an invitation to ambush them with whatever questions you might have. It's best to submit a trouble ticket, or send an email. The appropriate person in IT will get to you when they have time.

7. Users think that replacing toner cartridges is an IT job function. (It's not always the case).
Here's a pro tip: IT professionals are not your full-service people in waiting. They're not going do everything for you if it's easy enough for someone else to do on their own. According to IT pros, sometimes IT departments might just give out new toner cartridges.

8. Users think IT pros know everyone's password.
While the IT department can typically reset your password, for security reasons this information is encrypted. So if you forgot your password, don't expect IT to be able to tell you what your password is. You wouldn't want anyone to be able to look up your passwords anyway.

9. Users think IT magically knows what every error message means, and they can fix it with as little info as, "I got an error message, but I didn't read it."
To get to the bottom of an issue, IT pros need to be able to understand exactly what's wrong first. If you don't provide them with any details, it's going to be very difficult for them to help you.

10. Users sometimes think when things magically work, you "did something behind the scenes."
Sometimes issues just work themselves out, or weren't a problem to begin with (working as designed!).

11. Users sometimes think if enough people call and report the same problem over and over, it will get fixed quicker.
If an important IT service like Wi-Fi is down in a large office, in all likelihood the IT department heard about it about 30 seconds after it happened. If you keep interrupting the IT department from their work, your probably delaying them from fixing the actual issue.

12. Users may mistakenly believe changes IT made months ago caused a problem, not the "free" software they just installed.
For every weird issue you might experience on your computer, there's an underlying cause. If you're seeing a problem pop just now, it's very likely that something changed recently.

13. Some businesses believe IT does not need to be consulted when buying software. But then they expect IT to install and support it as if they researched, recommended, and received training on it.
IT professionals should be involved when a business makes major technology purchases. They can help decision-makers consider if the product does what it claims, if it makes financial sense to use the product, and if the product is secure. By including IT in the process, you help ensure that you're making a good decision ... and not throwing money away. And you should always make sure IT is equipped actually to support the product as well.

14. Some users think IT is there to format their PowerPoint presentations, or make their Word documents look professional.
The primary goal of an IT department is to manage and maintain a business' computer infrastructure, not do your job for you.

15. Some users think IT knows all the functions of the phone system.
Don't expect IT professionals to know about every obscure feature on every single product.

16. Some users think e-mails from IT are unimportant.
Some people don't read the helpful tips and reminders IT sends out. Then they complain that IT never told them about the big update, a server reboot, planned downtime, security alert, or even something as simple as how to schedule use of a conference room.

17. Some users think rebooting a computer is a stupid advice, and it doesn't fix anything.
If you haven't learned by now, "turning it off and on again" really does fix many issues! Think of it as giving your computer a chance to start fresh. If an IT pro asks you to try rebooting your computer, do it. And don't lie about doing it because you think it's a waste of time.

18. Some people think all IT workers are geeks.
IT professionals don't necessarily fit a standard stereotype. They come from all walks of life, and they have unique interests and personalities. You shouldn't assume too much about someone just because they work in IT.

19. Some people think IT runs the internet.
The internet is a complex network of interconnected computers spanning the entire globe. While your IT department has control of the computer network in your office, if there's an internet connectivity problem, it might be due to a problem hundreds of miles away that's out of IT's hands.

20. Some users think saying "ASAP" makes things get done faster.
IT professionals are busy spinning many plates. They have to prioritize what to work on next based on how important an issue is. Just because you say you need something done ASAP doesn't mean that it's the most important thing the company needs fixed at the moment. Please be patient!

Author: Michael Medina