Dear Friends,
Just few days ago one of my valuable reader from USA mailed me and asked me whether I had an experience on real life critical cyber-stalking case investigation or not and I mailed him some of my real life investigation experiences but I did not published those in my blog, so I want to share one of my critical case investigation on very recent complaint about cyber-stalking, which made the life of a gentle lady hell.
Before reading this case study I would request you to visit here for knowing details about cyber stalking.
This is a case where, a multinational renowned corporate house A complained that someone had been continuously sending offensive and abusive email to their customer care mail id with some obscene pictures as attachment in the name of a lady of another company B. All the mail was clearly disclosing the name of that lady and the content was written in such a manner that it seemed to company A that the mail was sent by the lady herself due poor package to her. Here company A outsourced his customer care work from company B.
During enquiry it came into light that the mail id in the name of lady of company B was created by a guy as his love offer was not accepted by that lady. The guy became so violent that one day he assaulted the husband of the lady badly and searching the address of the lady from Telephone Directory he dialed her neighbors in different names from different booths and tried to prove her prostitute in her locality. Investigating agency during investigation further revealed that the said guy also did same kind of work one year ago and at that time he sent mail to Police authority by sending a challenge to explode bomb in a renowned temple on the night of a Puja celebration. At that time also she used another girls email id as she also turned him down. His intention in both the cases was to make hell the life of the lady of his target. He thought Police would arrest those ladies as their names came openly in the email.
Finally he was arrested and all the evidences were collected against him by the investigating agencies in both the cases.
Someone may call this guy Erotomanic or love obsessional cyber stalker. Whatever it may be but they are really dangerous to the society as a large. If these kind of guys are refused by his desired one they can do anything.
So my friends beware from them. Best of luck.
Thanking you,
Urproblemmysolution Team
Saturday, December 11, 2010
Thursday, December 2, 2010
What are Different types of Phishing
Hi My Friends,
I had already discussed you a lot about phishing but I think I have made you clear about the meaning and style of phishing but now the time has come to tell you about different types of phishing. I think you are thinking about online lottery fraud, job offer fraud, and fund transfer fraud and so on but my friends it’s not like that. I am going to tell about “Old wine in new bottle”. What does it mean? It is the style of business men to bring their old product in new style and in some specific style. I did not mention it earlier as all of these are phishing but some of friends told me to write about these topics otherwise writing about phishing will be incomplete.
Initially all the experts in the cyber world called all these activities are phishing and as time moves the experts started to christen the name of style of phishing as follows:-
A) Spear Phishing: - This comes in the form email like updating banking password, email id password and so on but this kind of email comes to a specific group of persons like the employees of a company or a government organization or same group and so on. It seems that the mail has come from your employer for divulging important information.
B) Smishing: - This comes in the form of SMS message. Like your mobile number has won $5 bln in a lottery and you are requested to contact Mr. G…… in his email id a….@hotmail.com and so on. And you are trapped.
C) Vishing: - This style of phishing happens through VoIP i.e:- Voice over Internet Protocol . Actually this is a combination of ‘Voice’ and ‘Phishing’. You are getting a net call from someone, who is asking you about your personal important information in the name of a company, where you have stake or you are a stake holder, employee or some other style. You will see an example of vishing in this blog here.
D) Whale-Phishing: - I think all of you know about whale. Whale is a big fish in the sea. So if you consider the net is a sea where we all are fish then if the phisher catches the most important person by his technique, he is a whale phisher. So I think you have understood about whale phishing. It’s a style of phishing where phisher targets the most important person of the concern like CEO of a company.
So my friends now you are clear about the types of phishing which are used to catch the netizens. Be cautious and divulge your personal information to him only, whom you trust after proper verification.
For reading other case studies on cyber crime pl visit.
Best of luck.
Thanking you,
Urproblemmysolution Team
I had already discussed you a lot about phishing but I think I have made you clear about the meaning and style of phishing but now the time has come to tell you about different types of phishing. I think you are thinking about online lottery fraud, job offer fraud, and fund transfer fraud and so on but my friends it’s not like that. I am going to tell about “Old wine in new bottle”. What does it mean? It is the style of business men to bring their old product in new style and in some specific style. I did not mention it earlier as all of these are phishing but some of friends told me to write about these topics otherwise writing about phishing will be incomplete.
Initially all the experts in the cyber world called all these activities are phishing and as time moves the experts started to christen the name of style of phishing as follows:-
A) Spear Phishing: - This comes in the form email like updating banking password, email id password and so on but this kind of email comes to a specific group of persons like the employees of a company or a government organization or same group and so on. It seems that the mail has come from your employer for divulging important information.
B) Smishing: - This comes in the form of SMS message. Like your mobile number has won $5 bln in a lottery and you are requested to contact Mr. G…… in his email id a….@hotmail.com and so on. And you are trapped.
C) Vishing: - This style of phishing happens through VoIP i.e:- Voice over Internet Protocol . Actually this is a combination of ‘Voice’ and ‘Phishing’. You are getting a net call from someone, who is asking you about your personal important information in the name of a company, where you have stake or you are a stake holder, employee or some other style. You will see an example of vishing in this blog here.
D) Whale-Phishing: - I think all of you know about whale. Whale is a big fish in the sea. So if you consider the net is a sea where we all are fish then if the phisher catches the most important person by his technique, he is a whale phisher. So I think you have understood about whale phishing. It’s a style of phishing where phisher targets the most important person of the concern like CEO of a company.
So my friends now you are clear about the types of phishing which are used to catch the netizens. Be cautious and divulge your personal information to him only, whom you trust after proper verification.
For reading other case studies on cyber crime pl visit.
Best of luck.
Thanking you,
Urproblemmysolution Team
Wednesday, November 24, 2010
Link of Identity Theft, Phishing and Cheating
My Dear Friends,
Now I am going to share you few live case studies,which I got for the last 6 months in the field of my daily work in investigating cyber crime related cases. I am sharing this real life stories with you as my moto of writing this blog is to make you aware about the cyber crime and keep you away from cyber criminals.
This is the crime of phishers in disguise of HR of a renowned company. Now read step by step what they are doing for cheating a person, who is in search of a job.
Step 1:- They are sending mails by offering a lucrative job to different persons, who had enlisted their names on online job searching portals, as an HR of a renowned company such as IBM, Videocon, Sony by creating false email id in the name of that company. Like:- hr_sony@gmail.com, hr.videoconindia@hotmail.com and so on.
Step 2:- Then the mail receiver is receiving the offer and communicating with them over a telephone number as provided by them.
Step 3:- They are claiming security deposit for that good job and asking them to deposit that money in the bank accounts as supplied by them. Thereafter they are telling them to send the scan copy to them to their email id.
Step 4:- They are stopping to communicate with the victim.
Now you will be perplexed to know that the victims are educated guys even the the experienced guys of IT sector. I am telling you about a girl from Cog....... company became a victim and came to me for lodging a complaint. I asked her about her qualification and what he told that seemed to me that she is educated with specialization in IT sector.
You will definitely call me so what this thing may happen to anyone but my friends you should keep in mind that an HR of a company like Sony will not have an email id of other domain i.e gmail or yahoo or rediff or others their email id must end with @sony.com or some domain name which belongs to Sony. Its an example. So my dear friends before depositing any amount in any one's bank account pl verify the person who has sent you the mail as in most of the cases the address of phone numbers and bank account numbers are fake and they can't be traced.
So I would suggest you not to accept this kind of online offers until you are confirmed about the caller or sender and please find the original website of the employer company and make a communication with them to know the genuinity of your offer letter. I think now you will remain alert from this scoundrels and if you can't understand me pl mail me I will respond or comment here and I will respond.
Best of luck and be ahead and beware of phishers, who are stealing identity of another and cheating the educated job aspirants.
Thanking you
Love your Country.
Now I am going to share you few live case studies,which I got for the last 6 months in the field of my daily work in investigating cyber crime related cases. I am sharing this real life stories with you as my moto of writing this blog is to make you aware about the cyber crime and keep you away from cyber criminals.
This is the crime of phishers in disguise of HR of a renowned company. Now read step by step what they are doing for cheating a person, who is in search of a job.
Step 1:- They are sending mails by offering a lucrative job to different persons, who had enlisted their names on online job searching portals, as an HR of a renowned company such as IBM, Videocon, Sony by creating false email id in the name of that company. Like:- hr_sony@gmail.com, hr.videoconindia@hotmail.com and so on.
Step 2:- Then the mail receiver is receiving the offer and communicating with them over a telephone number as provided by them.
Step 3:- They are claiming security deposit for that good job and asking them to deposit that money in the bank accounts as supplied by them. Thereafter they are telling them to send the scan copy to them to their email id.
Step 4:- They are stopping to communicate with the victim.
Now you will be perplexed to know that the victims are educated guys even the the experienced guys of IT sector. I am telling you about a girl from Cog....... company became a victim and came to me for lodging a complaint. I asked her about her qualification and what he told that seemed to me that she is educated with specialization in IT sector.
You will definitely call me so what this thing may happen to anyone but my friends you should keep in mind that an HR of a company like Sony will not have an email id of other domain i.e gmail or yahoo or rediff or others their email id must end with @sony.com or some domain name which belongs to Sony. Its an example. So my dear friends before depositing any amount in any one's bank account pl verify the person who has sent you the mail as in most of the cases the address of phone numbers and bank account numbers are fake and they can't be traced.
So I would suggest you not to accept this kind of online offers until you are confirmed about the caller or sender and please find the original website of the employer company and make a communication with them to know the genuinity of your offer letter. I think now you will remain alert from this scoundrels and if you can't understand me pl mail me I will respond or comment here and I will respond.
Best of luck and be ahead and beware of phishers, who are stealing identity of another and cheating the educated job aspirants.
Thanking you
Love your Country.
Tuesday, November 16, 2010
Case Studies on Net Banking Hacking
Hi Friends,
I think all of you are well and you have enjoyed a lot in your life in the festive season of India and also in other countries. Today I am going to tell you another style of phishers for your net banking hacking for making you aware from the hackers or cyber criminals. But before learing this you will have to read my earlier posting here. Here you found how they got your URN no. for activating third party in your bank account. But what they are doing that is as follows:- After step 2 of that article ;-
Step 3:- They take attempt to add the bank account of their agents with the hacked bank account. And then as per the banking security system the URN no goes to the mobile no of the person, who actually owns the bank account.
Step 4:- They call the person by claiming that they are from the ...... bank in which the bank of the customer exists and then they ask him/her to give the said number which reached in his/her mobile through sms as they were testing the genuinity of the mobile number of the customer.
Step 5:- The account holder gives the said URN no as he does not know anything about it. Now they get success to transfer the amount to their agent's account.
Thats all.
So my friends be cautious and don't do the mistake in future. I am really very very sorry and beg a pardon from you as I ought to tell you earlier but what to do I was very much busy with my official work so I was absent from my blog so many days.
Wish all of best of luck and thanking you,
Urproblemmysolution Team
I think all of you are well and you have enjoyed a lot in your life in the festive season of India and also in other countries. Today I am going to tell you another style of phishers for your net banking hacking for making you aware from the hackers or cyber criminals. But before learing this you will have to read my earlier posting here. Here you found how they got your URN no. for activating third party in your bank account. But what they are doing that is as follows:- After step 2 of that article ;-
Step 3:- They take attempt to add the bank account of their agents with the hacked bank account. And then as per the banking security system the URN no goes to the mobile no of the person, who actually owns the bank account.
Step 4:- They call the person by claiming that they are from the ...... bank in which the bank of the customer exists and then they ask him/her to give the said number which reached in his/her mobile through sms as they were testing the genuinity of the mobile number of the customer.
Step 5:- The account holder gives the said URN no as he does not know anything about it. Now they get success to transfer the amount to their agent's account.
Thats all.
So my friends be cautious and don't do the mistake in future. I am really very very sorry and beg a pardon from you as I ought to tell you earlier but what to do I was very much busy with my official work so I was absent from my blog so many days.
Wish all of best of luck and thanking you,
Urproblemmysolution Team
Wednesday, June 16, 2010
How to secure your wifi
How To Secure Your Wifi
Dear Friends,
I told you earlier that the final episode of my wifi series is yet to come and that is the most important part of this series as this will tell you how to secure the wifi connections of everybody.
So lets go to that part:-
Wi-fi implementations vary from one application area to another. Like Home to Enterprise to Public Hotspots.
The Above Table summarises the minimum requirements that need to meet in each case in order to ensure adequate security.
I shall explain the terms very briefly to make this table meaningful to the users. Interested users may google these terms to get further detail very easily.
MAC Binding: This technology is used to allow only MAC addresses of few known devices to associate with the Access Point. This is suitable for very small sized network and is not scalable. Also this is prone to MAC spoofing attack.
Hide SSID: SSID is the identification string of a wi-fi network. The default behaviour of any access point is to broadcast SSID in beacon. This helps the users to easily identify the networks available to them. Wireless best practice guidelines suggests to hide SSID so that it is not visible through casual attempts to locate a wi-fi network. However there are plenty of scanners available those can detect hidden SSIDs.
Captive Portal: This is an authentication portal which is kept captive either inside the access point or any user authentication system. If this is implemented, whenever a user tries to use the wi-fi network for internet browsing for the first time, he is challenged with this portal by automatically redirecting his URL request in browser to the authentication portal page. On successful authentication, the originally requested URL is returned to the user's browser and access to the network is granted. However on failure access to the network is denied.
WPA2-PSK: Discussed earlier.
WPA2-802.1x: Discussed earlier. 802.1x implementation would require a RADIUS server and optional directory databases like LDAP/Active Directory/NDS etc.
SSL: SSL in this context is a PKI mechanism clubbed with 802.1x. This will require the presence of one or more digital certificate servers. This is applicable to different variants of EAP authentication - EAP/TLS, PEAP,LEAP etc.
SMS Auth: TRAI has mandated that in any public hotspot the owner must architect the user authentication process to prove the identification of the user against a photo identity card. Now an indirect process of complying this is SMS Auth. In this process an access PIN is system generated and consequently system delivered to the User’s mobile phone number upon successful user authentication. Now this indirectly takes care of the user’s identity verification against any valid photo-identity proof because the same has been done before this mobile phone number was allotted against the user’s name by the service provider.
Logging: Logging is a Facility to generate data and record the same to identify who with what MAC address and IP address had associated with which access point when for what duration. Most of the access points would generate such data. It is not a good idea to store the log data in the device itself. This will allow a hacker to remove all the traces of work very easily. It is required that the logs be stored on a Syslog server.
LWAP: Light Weight Access Points are APs those do not store the configurations locally on the devices. Rather the configurations are done and maintained in a central device called Controller. These are particularly required in a large wi-fi network. Centralised configuration ensures tight security policy enforcement all across.
AAP: Autonomous access points store configurations locally. These should be used in homes and very small office networks only.
I think it will be very helpful for you and please don't forget to say thanks to my friend Sudipto.
Thanking you
Urproblemmysolution team
Subscribe to:
Posts (Atom)