TRENDING NOW

All about hacking and cyber security I present ways of hacking over all platforms also trending news & info bugbounty tutorial for penetration testers

 Today we're gonna find out what is a social engineer. So let's get right into it,  So what is social engineering? And How Pro Social Engineers do that.


Who are Social Engineers and what is social engineering attack

A Social engineer is someone who persuades another person to either disclose confidential information or perhaps provide access to restricted areas, such as a company server room by pretending to be someone they're not. And this act called Social engineering.

This is how social engineering defines or social engineering Definition.

How Social Engineering Done by Pro Social Engineers



    Well, a social engineer might pretend to be from a maintenance company, or here to deliver a package, or they may pretend to be the CEO's new assistant, so they're pretending to be someone who would normally have access to the information or locations that they're looking for. 


    There are many different ways to conduct different types of social engineering. Let's imagine an attacker who wants to gain physical access to a server that's located in a corporate office building, the attacker might pretend to be from the company's internet provider, and tell the receptionist at the front desk that they need access to the server room to replace the modem. 


    They could also pose as the maintenance manager of an office and request access to a restricted area under the disguise that something like the heating or cooling system needs to be repaired. But social engineering doesn't always have to be in person. 


    Sometimes social engineers will call employees pretending to be from the help desk and request remote access, or call someone pretending to be a bank employee asking for account information. 


    But probably the most common type of social engineering that we see is email phishing or sending an email pretending to be from a trusted source.


     You can see examples of social engineering  For instance, in the popular television show, Mr. Robot in season one, Episode Five the main character Elliott uses social engineering tactics to gain unauthorized access to the steal backup facility.

    • Social engineering attacks rely on which of the following?

     Let's look at a few reasons why social engineering works as well as it does

    • Trusting to anyone

     The first reason is simple. We as humans tend to have a trusting nature. We don't want to believe that everyone is out to harm us. If someone calls or approaches us claiming that they want to help, our instinct is to take them at face value. This doesn't always mean we will fall for these tricks. But when paired with other tactics on this list, it certainly makes social engineering more effective. 

    • Urgency

     we have urgency. humans tend to throw caution to the wind when faced with urgency. This is probably the number one reason why phishing campaigns from so-called executives are effective. When a high-level executive in the company tells you they need something done immediately. You tend to just do it. And this is because you don't want to let them down. Even if the request seems odd.

     I can't tell you how many times in my career, I've seen financial teams set up wire transfers, because the CFO told them to do it immediately, only to later find out it wasn't the CFO at all.

    • Fear

     Along with urgency comes fear. When you're afraid of failing someone important or losing your data, you may not think your actions all the way through fear affects our mind in an interesting way, and we're more likely to make a mistake.  

    fear of having the company find out that they got a virus to impair judgment, embarrassed and feared being reprimanded for it. This lowered people's judgment and in the end, they ended up allowing themself and the company's computer to become a victim to a social engineering attack. 

    • Ignorance

    Finally, and in my opinion, the most obvious reason is simply ignorance. A lack of understanding is the most dangerous thing. Perhaps you aren't someone who would fall for a scam. But what about your elderly grandparents? If someone who isn't extremely familiar with how the technology works, or familiar with these types of scams receives a call like this, they might not even think twice before doing whatever they're asked. 


    Now that we've discussed the human elements that make social engineering so successful, let's look at some of the factors that leave companies vulnerable to social engineering attacks.

    •  lacked security policies

     First up, we have lacked security policies, or in some cases, no security policies at all. There should always be some policy in place that makes users aware of what information they're allowed to share via email or over the phone. If there's a policy in place that states that the help desk will never ask for your password via phone or email, then the end-user might think twice when they get this request from a social engineer.


    • Poor permission regulation

     Another factor is poor permission regulation. The more information a user has access to the more information that the company risks losing if that user is a target of a breach. Not all users in the company should have access to sensitive data. It's best to practice the concept of least privilege and only have access to a resource to those users who will absolutely need it.

    • Minimal to no security Awareness Training.

     Last but certainly not least, minimal to no security awareness training. How can a company get upset with their employees for clicking on a phishing email when they've never been told what one looks like? We discussed that ignorance and a lack of understanding is a huge reason why show social engineering attacks are so successful.

     If companies are able to roll out a successful security awareness training program, their employees are much more likely to spot a scam before those who have never attended a security training at all. security awareness training can vary from company to company, but it's usually a combination of online learning modules and phishing tests in which a company will send phishing emails on purpose to gauge their employee's awareness. 


    • Social Engineering Phases

     I should point out that not all social engineering attacks will go through all of these phases. Sometimes social engineering attacks aren't targeted. They just send a bunch of phishing emails to a lot of people. But this article is going to cover the phases of a targeted and focused social engineering attack.

     There are four main phases of targeted social engineering attacks. So we'll look at each one of them.

    • Recon and Information Gathering

    So the first thing that an attacker will need to do when carrying out a social engineering attack is to research their target company. This is just like the first step of the cyber kill Chain you need to do your recon. The more information that you have about the company, the better prepared, you'll be to fool them into giving you the information that you need. There are many different ways to do recon on a target company.

     The first and easiest way is to look through the company's website. The website will provide an overview of the company and if they have any blogs, they might have posted about recent events, promotions, or things of that nature. And this can all be really helpful information to a social engineer. by searching for the company's name online, you might be able to find them mentioned on local news sites or in press releases.

     Sometimes when companies have large events or a new CEO or president is starting it ends up in the media. Employment websites and job postings can also be a treasure trove of information to a social engineer. organizations may not always send out emails to the entire staff when a new hire is starting.

     So a social engineer could potentially go into a company pretending to be a new employee there, and the company's receptionist might be none the wiser and let them right in through the front door.

     like dumpster diving, Dumpster diving is exactly what it sounds like. Organizations there are a lot of documents away and if there isn't a shredding policy in place, you'd be surprised at the type of information you can find just due to what people will carelessly throw away. 

    • Choosing an employee at the target organization

    Once the research aspect is complete, the social engineer will choose an employee to target specifically, while it is possible to simply target the entire organization and send out emails to the full mailing list. Any experienced social engineer knows that they'll be much more successful if they choose one or two people to target.

     When it comes to cybersecurity humans are always the weakest link. Sometimes targeting a new employee of the company can be helpful. They may not know every single person in the company so it might not faze them when they don't recognize your name or face.


     Another target could be a disgruntled employee, they are already at the end of the road with their company and they just simply don't care what happens. careless employees are social engineer's best friend. These types of employees are not going to do extra work to follow protocol, they will always choose the easiest solution. 

    Whenever possible, social engineers will choose a target that either has access to what they want or has direct access to someone who does. Social engineers don't want to try to go through 10 people to get to their goal, the least amount of people they have to trick the easier their job is.

    • Gaining the trust of that person

    Once the social engineer has chosen an employee to target the next step is to gain the trust of that person and build a relationship with them. social engineering really depends on the victim trusting the social engineer completely. If there is a hint of doubt, the attack might not be successful.

     In order to gain the trust of the employee, the social engineer might provide fake credentials. Through research done in phase one, they might have been able to see what an employee badge looks like and forge a recreation of one themselves.

     knowing a lot about the company and recent events or functions helps to clear any doubt that the target might have about whether or not the social engineer can be trusted. This is why it's really important for social engineers to do extremely thorough research on the organization as a whole.

     Before beginning their attack, the more that the social engineer knows the higher likelihood of them succeeding in gaining people's trust. Finally, social engineers will always have to be confident. When people sound like they know what they're talking about. Others tend to believe them. 

    Even if it goes against their better judgment. The moment a social engineer starts to sound unsure of themselves, the trust they built will be completely shattered. Once the social engineer builds trust or a relationship with the target employee,

    • Exploit the weakest link

      This is the final step for the social engineer as this is when they are going to try and gain access to what they were looking for. One thing a social engineer could be looking to gain is access to a particular restricted area. They could exploit their target by telling them that they normally have access there but they left their keys at home. If the target trusts the social engineer enough, they might help them out.

    Some Social Engineering Attack Example

    Another scenario is someone posing as an employee who just started the company. Perhaps they're trying to access a door With a key code, they could pretend they forgot the passcode since their first day and the target might actually be willing to give it to them.


     Perhaps the social engineer's goal is to get a piece of malware installed on the network, they could tell the target they are trying to get a file off of the USB drive to open but it's not showing up when they plug it in, they'll ask the target to plug it into their machine and see if they can open it. However, when the trusting target clicks on the file from the USB, they are unknowingly infected with malware.


     Another scenario could be that the social engineers' one and only goal is to simply gather Intel that isn't publicly available. It could be a case of corporate espionage, the social engineer could be trying to steal intellectual property or trade secrets. If they befriend the right target in the organization, that person might tell them all about how the company is run and how the products are, and how the products are produced.


     Just a quick recap, the four phases of social engineering that we discussed in this Article are phase one researching your target organization. Phase Two, choosing an employee at the target organization, phase three, gaining the trust of that employee, and phase four exploiting that employee's trust.


    • Social Engineering Techniques

     social engineering techniques, there are tons of techniques that social engineers use, and we're going to cover a lot of them in this article. So in order to make things a little bit easier, I've broken them up into different categories, social engineering attacks that occur in person, social engineering attacks that occur via computer, and finally social engineering attacks that occur over the phone.

    Top Social Engineering Techniques


    • In-person social engineering

     Let's begin with in-person social engineering. When I talk about in-person social engineering attacks, I'm referring to any attack that isn't done over the phone or using a computer. This type of social engineering can't be done by an attacker who is sitting in their home, they have to go out and actively attempt their techniques on a person. Here are some techniques I consider to be in-person social engineering, eavesdropping, shoulder surfing, dumpster diving, tailgating, piggybacking, and finally impersonation.


    • Eavesdropping

     Eavesdropping is a social engineering technique in which the attacker will attempt to listen in on private conversations to gain information.

     An example of eavesdropping would be listening in while a helpdesk technician reads off a password to a user that had forgotten it.

     Well, Eavesdropping can be as simple as being in the right place at the right time to listen to a conversation. Some attackers will take it one step further by creating their own listening devices. 


    • Shoulder Surfing

    Shoulder Surfing is similar to eavesdropping, but instead of gathering information with their ears, attackers try to gather information with their eyes.

    Shoulder Surfing is the act of spying on an unknowing user while they're entering private information

    One example of shoulder surfing would be an attacker watching a user type their username and password into their computer. While Another example would be watching a person type in their pin number into a banking system or ATM.


    • Dumpster Diving

     Dumpster diving is a social engineering technique in which the attacker will find personal information about an individual or organization in their trash. 

    People are often careless in terms of what they throw away and even junk mail could be potentially useful to an attacker.

     Imagine an office worker who throws away an old list of user phone numbers because they received an updated list. Although the list they threw away might not be entirely accurate anymore, it's found has some phone numbers that are still relevant. If a social engineer finds us in the trash, they now have a semi-complete list of users and their phone numbers. This can be very useful to a social engineer.


    • Piggybacking

     When you hear the word piggyback, you might think of someone riding on another person's back. However, in terms of cybersecurity piggybacking means something else.

     piggybacking is a social engineering technique in which the social engineer has tricked their target into allowing them to use or piggyback so to use or speak onto their credentials.

     In this example

    imagine a social engineer trying to gain access to a locked building. When a person comes over Along with a valid badge that grants them access to the building. The social engineer might say something along the lines of 

    ' I forgot my badge. Do you mind letting me in ' 

    and they're speaking to the good nature and people and a lot of folks will help them out.


    • Tailgating

     tailgating is somewhat similar to piggybacking, so it's easy to confuse the two. But in a tailgating situation, the social engineer follows after the target without speaking to them

    Let's imagine a scenario in which a social engineer is carrying a large box. There may or may not be anything in the box, but to everyone else, it looks like they have their hands full. In order to be polite, the target may hold the door open for them. Or perhaps they don't even hold the door open for them, but they're probably not going to pay any mind if the social engineer sticks his foot out and keeps it open.

     The main difference between piggybacking and tailgating is that in piggybacking, the social engineer has the person's consent to follow them in or use their credentials. In a tailgating scenario, the user did not give the social engineer explicit consent to enter the building.

     If it's hard to remember, just think of it this way. When more than one person tailgates a car, it's done without consent. When a person gives another person a piggyback ride, though, it's something that's typically agreed on by both parties. 


    • Impersonation

    And the last in-person social engineering technique that I'm going to cover also happens to be the most common in-person social engineering attack.

     Impersonation is exactly what it sounds like the social engineer is pretending to be someone they are not in order to gain access to something they should not have access to.

     The person may pretend to be from the company's telecommunication provider requesting access to the server room, or the social engineer might pretend to be a potential client asking for a tour of the facility.

     Either way, impersonation is a very popular and very effective technique used by social engineers. And impersonation isn't technically just an in-person technique. impersonation is used in all of the categories it's used in person. over the phone on the computer by email, impersonation is really the bread and butter of social engineers. 


    • Phone and Mobile Social Engineering

    So that brings us into our next category, which is phone and mobile. These are attacks that are done either with a landline or through a cell phone. This category includes things like vishing, and smishing.


    • Vishing

     Vishing stands for voice phishing, and it's the process of trying to trick a user into disclosing personal information over the phone.

     You hear this all the time on the news channels regularly talk about individuals who have received a phone call from people claiming to be with the IRS. Those people end up sharing all their information. And next thing you know, they have their identity stolen or elderly people who receive a phone call saying that their grandson is in jail and they have to send bond money.

     These are all examples of vishing attacks. vishing attacks occur when a social engineer calls a user and pretends to be someone else in order to steal their private information or to steal their money. 


    • Smishing

    Smishing, on the other hand, is very similar except that it occurs using text messages. Have you ever received a text message that you just didn't think was legitimate?

     I once received a text message asking me to log into my Amazon account using a link in the text message to check the status of an order. Lucky for me, I was able to spot the fake message right away. I knew I didn't have any packages coming from Amazon at the time. And even if I had I probably would have checked it by logging into my account from the computer and not using that text message link. 

    But let's say for the sake of examples that I did click on that link in the text message. Most likely it would have taken me to a site that looked like Amazon was actually a fake created by the attacker. After I enter my login credentials, I might be redirected to Amazon but it would be too late. The attacker would already have my username and password. This is an example of SMS phishing, also known as smishing.


    • Computer-based social engineering attacks

    And the last category of social engineering attacks that we're going to talk about in this Article, are computer-based social engineering attacks. Obviously, computer-based social engineering attacks are going to be any of those social engineering attacks that initiate from a computer.

     So this includes things such as pop-up messages, spam, spamming, and phishing. Pop Up messages from the web browser are a really easy and common way for social engineers to trick users into calling them and giving them personal information.

     I honestly cannot tell you the number of times in my career, I have received a frantic call from an end-user panicking because they believe they've gotten infected with malware. I'll log into their computer remotely to see a giant frightening message plastered across the web browser, you have a virus, it will say the exact wording of the pop up might vary every time but the core of it stays the same. 

    This computer has been infected with malware, and the only way to resolve it is to call this number. Now 99.9% of the time messages like this are not actual viruses. Instead, when a user accidentally navigates to the wrong URL or allowed to get notifications from an untrusted source, they get that scary popup.

     The purpose isn't to infect the user with malware at all. It's to get the user scared enough to call the number listed. Once the user calls the number, then the attacker on the other end works to take advantage of them.

     However, in every case that I've personally seen a pop-up like that, go into the task manager and ending the task fixes it immediately or disable the notification in the browser that causing that popups can work also. But it's not always meant to be frightening. 

    Sometimes users will receive a message saying they won something like an iPad. And they'll have to call a number email or click something that fits into the pop-up social engineering category as well

    as instant messaging scams are messages that are received through some type of instant messaging platform. This could be Gmail, chat service, Skype, or even Facebook Messenger.

     Have you ever received one of those Facebook messages from a friend that says "hey man, I saw this video of you, I can't believe this is you" with a link video from some weird source If you don't click on it, you may find out later that your friend's account was compromised and started out sending out all these spam messages.

     If you do click on it, well, then you might be the one sending out spam next. This is also considered a type of social engineering attack. So it's always best that if something looks suspicious, just don't click on it, and maybe call that friend and double-check with them actually meant to send that to you.


    • Phishing

     And that brings us to our final type of social engineering attack that we're going to talk about, and that is phishing. And I know that you all already know what phishing is. 

    It's the act of sending emails that appear to come from a trusted source in order to convince a user to disclose information. 

    Phishing is becoming such a huge problem in our world today, it seems like every single day, thousands of getting sent phishing emails. 

    So I will Cover How to do Phishing Attacks and Prevention in another Article.


    All about hacking and cyber security I present ways of hacking over all platforms also trending news & info bugbounty tutorial for penetration testers

     

    Best Programming Languages To Learn For Hacking


    Before I get into this article, it's very important to recognize that hacking can be dangerous. Don't do it unless you know what you're doing. And you know that what you're doing is legal. Whenever practicing hacking, it should be done responsibly and ethically, or else you could end up in prison, or worse financial turmoil, then you'd be in debt. Like the government. 

    There are three fundamental types of hackers white hat, black hat, and grey hat. 

    A white-hat hacker is somebody who hacks ethically and responsibly and they use their skills to help catch other hackers. They're also often hired by companies to handle security measures, and build anti-hacking software, which is really important and vital work in the world of information technology, especially now that everything is becoming attached to the Internet of Things. 

    Then, of course, we have the Black Hat Hackers, people who use their skills for malicious intent things like creating viruses using keyloggers to steal your information, hacking banks, and even hacking servers, their goal is to break in steal information, and sell it for money. 

    Really, nobody likes those guys, because they negatively affect everyone for the benefit of themselves. 

    Last but not least, we have the grey hat hackers, people who find themselves somewhere in between. These are usually people that don't have malicious intent. But everything they do is usually self beneficial. 

    In general, they auction their abilities to the highest bidder, a gray hat hacker will often look for backdoors and security problems with the system, and then they'll sell the solution to the company for the price. 

    Before I can really talk about what language is the best for hacking, you first have to understand that there are different types of hacking, the language, and system you use for a server is not necessarily the same that you'd use for a personal computer before you look for any absolutes is what you should or shouldn't be using, you should recognize that there are many different types of hacking because there are many different types of computer systems. 

    Because of this, there are many different languages you could utilize to hack any individual system. There's really two different levels of hacking, high-level hacking, and low-level hacking. 

    on the high end of the spectrum, we have the easier to use languages often interpreted or intermediate, Python, Ruby, JavaScript, Java, C#. Because these languages aren't compiled, they're much easier to work with. 

    Because everything is compiled on the fly. a language like Java is both interpreted and compiled. This allows it to be incredibly easy to work with. That's why a lot of hackers prefer it, not to mention most of the world servers run on it. 

    However, Java is really only useful if you're hacking servers and people's back-end computer systems. Let's say you want to hack a robot, or an electronic device, maybe even a car, the only way to do that is with a lower-level language. 

    On the lower end of the spectrum, we have compiled languages like C and c++. And although they're not as easy to use, they are more powerful.

    There's very little you can't do with C or c++.

    what I wanted to show you were a hierarchical ladder, from the hardware all the way up to the highest level of abstractions. Here we have the CPU or the hardware itself, which obviously runs on electricity and hardware components using electricity since zero and five volts signals to determine what to do internally. 

    The 0 in machine language or binary represents false which is nothing in the one represents true or five volts on top of binary and just a little bit abstracted from it is assembly it's really the lowest level human-readable writable language assembly or assembler is a platform-specific language designed for a certain architecture. 

    So Mac and Windows may not necessarily have the same assembler because their architecture usually differs. 

    But we're not going to get into the different types of assembly and assemblers because that's really beyond the scope of this Article. 

    From here we go up to what is likely the lowest level language still in common use today. And that C, C is really close to the hardware for practical language. 

    But it doesn't offer many abstractions that people often desire today, such as object-orientation. Because it doesn't offer many of these modern features, the language is more streamlined. 

    And one might even argue easier to grasp at first, mostly because it has less bloat. It's strange because C is really easier to learn than most languages in some respects, but it's harder to master. 

    And there's sometimes more to know about it, especially because the systems we control with it are generally a lot more complex. However, these days there's not really a lot of languages other than C that retain that low-level ability to program micro-controllers and things of the sort. 

    C is a procedural language, and it was really the first language I ever learned. I'm glad I started with C though and if you have a good mind, plus, enjoy reading and studying things for yourself, then I do highly suggest starting there. 

    There's really no language on a computer that comes even close to being as supported on as many devices as C and its use is still just as relevant today as it was years ago when I was first introduced. 

    It's wild to think how much hardware has changed in that time. But language is really really haven't evolved much at all C is still the world's fastest compiling language supported on multiple systems due to that really low overhead, 

     

     

    then we shift a little from here to c++, which is basically c but with object-orientation added to it. And a ton of features. 

    Nobody really uses c++ is a wonderful language. But many people who use it especially for lower-level microcontroller engineering, or game hacking will tell you a lot of the features it has come with cons that kind of outweigh the benefits.


    C++ is great if you need low-level control, and also that object orientation and extra abstractions. But if you're just looking for something that compiles fast, and has the smallest package possible, you're definitely looking for See, it's funny because the design of a virus or hacking actually has many of the same requirements as traditional programming and development. 

    So ordinarily, packaging something really small means quicker delivery to a customer. Well, when you're designing a virus, you take the same exact things into consideration, you want something that's really small and fast and easy to pass over packets over the internet. 

     

    Then we get to the intermediate hybrid languages, which are compiled, but they've also interpreted languages like C sharp, and Java. And we get Apple's new wonderful, high-level protocol-oriented language Swift. 

    And of course, this list wouldn't be complete without the high-level abstracted languages that basically everybody is learning and using right now for almost everything. 

    These are designed for ease of use, but at the expense of control, like JavaScript, Python, Ruby, and so on. Don't get me wrong, these are still very powerful, real programming languages that can do some serious business. 

    They're just not designed for low-level micro-controller engineering and programming. 

    At the very top here we have HTML and CSS, which contrary to what many people will tell you are absolutely programming languages, they may not use logic to the same extent as a lower-level programming language. But effectively, they're designed for ease of use on the web. 

    And they do meet every criteria to be considered a programming language, which is really just a set of instructions telling the computer what to do. 

    In short, don't be a fool. Every language has its use, I just think C has the most uses. Some people obsess over what language to use for hacking. 

    And although it is important, the operating system is just as important. Most hackers use Linux for good reason. Linux is highly modular and portable by nature. And it supports a vast array of tools for hackers. 

    That probably helps if you're not yet familiar with the Linux operating system, that might be a good place to start before you get into programming. The biggest part of being a hacker isn't even knowing a programming language. 

    But it's simply understanding how the systems work underneath the scenes, once you understand how things work below, you can break in from above, being a hacker is all about trial and error. 

    Sometimes you have to try many things until you get something that works. And often you never do. But this process of trial and error is precisely why so many people love it. It's an incredibly rewarding experience. When you break code that somebody else has made. In many ways, it's competitive like a sport. 

    Many people would think that hacking isn't that useful. But the truth is, it's fundamentally necessary to the electronic environment. If we didn't have white hat hackers, and even gray hat hackers, we wouldn't have the ability to defend ourselves against the black hat hackers. 

    It's extremely important that every time you're on your phone and you take a selfie or picture, it's safeguarded. And only you can see it. Oh, yeah. Yeah, right there. Yeah, just like that. This is only possible because of the talent and amazing skills of ethical hackers. 

    It's of my opinion that if you're new to programming, C is probably the best place to start. Not only is C cross-platform and used on almost every system in the world, but it's also the foundation of almost every programming language today, whether you go on to learn c++, swift, or Java, almost every modern language in the world is heavily influenced by C. 

    Even JavaScript, which is now the most used and popular language in the world takes a huge amount of influence from C. That's why we refer to most languages as C style languages. C teaches you the foundations that you need to do whatever it is that you want to do. Hacking included. 

    Most servers and systems today are designed on software that's written in modern languages, such as Java, and C sharp, but most of the microcontrollers and hardware running those systems and software are designed on C. 

    So if you really want to get low and close to the hardware, C is the best place to be. Even if your goal is to be a general-purpose programmer. Learning C can look incredibly good on your resume, I highly suggest checking c out. 

    And if it's not for you to try a different language, something higher level, we live in an age where the security of your information is more important than ever. As the world around us becomes more and more digitized. 

    It's more important than ever to safeguard our information and identity. When we see hacks like the Equifax hack that have been recent, we know just how dangerous hackers can be from birth certificates to banking information and even your social security number. Black hat hackers are a reality of life. You cannot escape it. 

    Where there is information. There are people trying to steal it. So the only way to control it is to fight fire with fire and find hackers that are willing to do it for ethical purposes. It's because of the hard work of ethical hackers that security measures are even possible to summarize, learn C. And if you can't learn Python or JavaScript,

    All about hacking and cyber security I present ways of hacking over all platforms also trending news & info bugbounty tutorial for penetration testers

    People are using smartphones more than ever and this trend isn't slowing down anytime soon whether you're new to smartphones or not you should know that they can be a huge target for hackers smartphones contain a lot of your personal information which can give someone else all they need to steal your identity or your digital data. 

      17 Tips To Secure Your Mobile Phone From Hackers

      Smartphone hacking is a profitable enterprise because hacking into smartphones is simple it's because it's so deserving your phone is an integral part of your life with so much anything before its passage into your phone is access into your mind.


      1.Strengthen your password

      Some of us might look back at the good old days  when having a password was a few  characters long it was easy to remember  and you didn't need something that  looked like it spilled out from the  matrix unfortunately these days it's too easy to guess a standard password so it  needs to be uncrackable here are some  tips for making your password a little stronger.

      • combine old passwords with a  new one to get super charged passwords  you can add the name of your favorite animal or food with the year you first  knew that add that on to the end of any  password you already have to make your password uncrackable  since most social media sites allow up to 15 characters for passwords keep your login original characters and numbers are fine but adding symbols and other special characters can really take your password up a notch.
       

      2.Device encryption


      This one is apparently authorized by default to double-check research for encrypt device in your Settings app and follow directions on the protection when more traditional Android gadgets you should have your gadgets charged and plugged in during encryption and set and remember password

      2.Device encryption
       

      You should additionally arrange your device to delete all the data on your phone after too several improper tries this protects your device from facing brute-force attacks when somebody gets physical access encrypting your phone does not protect you from malware or remote exploitation device it only works if a phone gets stolen.



      3.Be smart on social media Sites

      Social isn't nearly as private or protected as you may think in the old days you could easily block people from looking at your information but with the size of Facebook, it's rare that your profile is truly private to maximize your safety always click the settings that only allow your friends and family to see your posts and pictures unless you know someone who wants to be your friend.

      Be cautious about accepting friend requests fake profiles can fool you into thinking you know that person a quick look at their friend list and recent posts tell you if they're active in a group or not never look at a message to a friend requests with links that look and feel fishy some sneaky hackers can copy friends emails and send messages with link s hoping you'll press the link by the time you do you'll be suckered into giving up the info you didn't want to be stolen worse yet you could be locked out of your own profile account if they steal your password too so always be on the lookout for suspicious messages.

       

      4.Enable 2FA (Two Factor Authentication)


      Enabling 2FA can double your Security and if combine with strong password Always Enable 2FA for your Social Media and Important sites so if your Password Gets compromised you have OTP to secure your account from hackers.
       

       

      5.Don't use open or Public  Wi-Fi


       Free High-speed WiFi is something that only a few can resist but this WiFi lurking with some very serious dangers you should need to aware of.

      5.Don't use open or Public  Wi-Fi

       

       Clicking on a link or popup from free WiFi can be very serious if a hacker is also using that WiFi he can hijack sessions of yours and do whatever he wants from your accounts. or us tools to find credentials

      This can be used as identity theft and your all information is being used by the wrong person. Disable your WiFi and network also for safety and use password of course.

      Using VPN and TOR can also work they hide your identity from ISP and Browsers


      6.Add more protection


      Just like your home computer you need a good firewall to protect your internet connection luckily new phones do a bit more than that every phone has its own firewall though you can always add more security apps to be double sure and this is a measure.

      Some apps work better for Android than they do for iPhone but there's plenty of software available a quick look through the Apple Store or Google Play app list will get you started some app names such as Norton Avast and McAfee are your best 

      It doesn't hurt to add this extra protection to your phones firewall apps protect you from select dangers to help keep your ID and info safe while others just target viruses when it comes to overall coverage find an app that offers complete packages choose what's best for you

      7.Add more protection


      7. Don't answer fishy and scammy unknown numbers


       The only scams we used to encounter were rudimentary email scams that were incredibly obvious who would fall for that these days well to say it's still happening to those who own a smartphone - 

      Did you ever get a missed call with an area code you don't recognize while most of these get blocked by your phone automatically some can slip through chances are if you call back that number you'll be sorry you did the trick to this is that your call is routed through an international premium rate number and can charge you way more than your monthly bill and it's more common than you think if you call back that number the cost of the call gets paid to the hackers these one-ring calls are the typical signs of this scam so you'll think you missed an important call don't be sucked into losing your money just erase or block the number you won't be called by that number ever again hopefully your smart phone will block other calls from that same area code as well. 

       

      8.Use cloud storage 

       cloud storage allows you to store important information and files in a location that's not on your phone this can be smart because it means the files aren't located on your phone if your phone is lost stolen or damaged you won't lose any of the data in cloud storage.

      Most importantly this means your information can be kept out of the hand of hackers cloud accounts are pretty hard to crack so even if you have an account on your device it'll be safe these accounts often have double password encryption so no to login attempts are the same you might need a second login code sent to your mobile number to complete a cloud login this keeps hackers from getting the information you want to keep private while it might seem odd to put private information into cloud storage.

      10.Use cloud storage

      It's not such a bad idea having a mobile device clutter-free when you use it for business means you don't have to worry about misplacing files or running out of storage this also helps you travel light wherever you go and you won't have to worry about losing your pen drive that could fall into the wrong hands.

      Secure backup cloud and syncing if you're using backups or syncing make sure they are encrypted as well cloud backups are oftentimes an easy target to steal your private data secure your accounts with 2fa if you use Google Drive or iCloud your cloud backups use the same 2fa as your remained Google account or Apple ID connected to your phone if you decide to trust your default providers you're not in control of the security of your data  people holds or decryption keys and they can access your data in the iCloud  any time they want and I think only you should be able to decrypt your data crypto matter allows you to create encrypted vaults and automatically sync your secure backups to the cloud surveys of your choice if you don't pay for the service you are so I would recommend to go for next cloud you can  get between two to five gigabytes of cloud storage for free but it might not be enough for those of you taking plenty of high-resolution photos but next cloud is free and open-source and many providers even offer instant encryption  so this is the is the cloud service that  you should go for .


      9.Check app permissions 

      All apps of settings that allow app permissions tell the app what it can and can't do when it's connected to the Internet some of the common options include whether an app can access your photos contacts our camera and microphone.

       this is really important that you might not want your audio or visual gadgets to be used by other people these settings also control the amount of info given about your self and the information that's stored on your phone if these app settings are set up to your approval then you won't have to worry about that info being leaked often some hackers target certain apps that don't have secure internet connections your live images could be stolen through your phone or tablet and you never know where they could end up after that worse yet is that your
      private info can be sold to marketing agencies who will target you just from your mobile search history no it's not just Facebook that does it numerous third-party app pirates like to sell your private info too this can be avoided by checking your app permission settings on every app you decide to download.


      10.watch out for phishing apps 

      By now you have a good idea what phishing means and those who get hooked weren't being careful online game apps look attractive and have lots of flashy advertising which is a bit like a worm on a hook.

      12.watch out for phishing apps

       

      If you ever knew someone who likes sport fishing they use special bait to lure and catch their fish the same works for game apps that tempt you with flashy graphics before taking your information you'll know when you set these apps because they aren't on the official app sites such as Google Play or the Apple Store often they're traps that show up on rabbit-hole web sites.

      This is where you click on a link to a second web site which takes you through a string of different web sites you never actually get to the web site that you're looking for it can seem endless at times and this is where you start to see very familiar app game links these are usually copycat games that look just like the official ones but they're not they trick you into giving up all sorts of information to play the game they can also hack your phone giving them access to your private info for them to exploit don't ever fall for this kind of fishing bait.


      11.activate your phone's security features 


      New mobile devices give you lots of choices to protect you from getting hacked there isn't a smartphone out there today that doesn't have software filters that spot apps or files with dangerous malware.

       this is similar to software and computers which will prevent you from installing software that is detected to be unsafe antivirus blockers for apps are easy to turn on inside your smartphone settings they're specifically designed to look for malware and app games if a game doesn't download chances are the app could be harmful to install.

      This is also great for kids who might not fully understand the apps they're clicking on or downloading once again if your device thinks it's not good for downloading you don't want to risk being hacked make sure you stick with official games that come from sources that have already screened their app games but even Google Play and Apple Store apps can have malware that's hidden somewhere so always activate your virus app blocker to be on the safe side.


      12.Go beyond passwords 


      Having your smartphone stolen is about the worst thing you can imagine then again if they can get into your phone because you don't have a password set up you're in real trouble fortunately there are some innovative things you can do to prevent thieves from getting your information too easily 

      New apps and models now allow fingerprint identification to unlock a phone for it to work you press a touch screen window holding your finger down if your print doesn't match the exact image that's stored in the phone's memory it won't open this can also be combined with a two-step process that uses a fingerprint and a password in addition you should also install a mobile tracker.
      this can be activated as soon as you notice your phone is missing an owner can then track their phone via the app and catch whoever is carrying your stolen goods some apps will even allow you to delete the info that's stored on the phone in an emergency but as long as you can get your phone back in one piece that's probably the best solution better call the police for help once you finally track down your phone.

      All about hacking and cyber security I present ways of hacking over all platforms also trending news & info bugbounty tutorial for penetration testers

      In this article, I'll be discussing a series of lessons on Cyber Security, with today's topic focusing on malicious code, which is also known as malware.

        What is Malicious Code (Malware Definition)?

         Malicious code or what malware is software that is written for the purpose of intentionally causing some sort of unanticipated or undesirable effects

         

        Note that the terms malicious code, rogue program, and malware all refer to the same underlying concept, and I will hence use these terms interchangeably. 

        From a conceptual perspective, one of the most critical things to understand about malicious code is that it is only distinguished from other types of software programs by the intent of its developer

        If a developer writes a software program, with the goal of causing harm to other people or systems, or at least problems for other people or systems, then we can classify that software program as malicious

        Since the only conceptual difference between malicious software programs and non-malicious software programs is the intent of the developer, it's important to realize that malicious programs can do anything that a normal non-malicious program can do. 

        Just as with a normal non-malicious program, malicious software programs can access and use system resources and can alter both data and other programs residing on a system if that's what they've been designed to do. 

        Although many people have the impression that malicious code is a relatively new concept. 

        In fact, researchers have been aware of malware threats for many many decades. virus behavior, for example, was described by Willis were as a threat to computing systems in his 1970 study for the defense Science Board. Remarkably, many of the concerns and threats that were documented in this early report are still perfectly valid even today.

        Malware (Malicious Code) Full Guide (Viruses,worms,etc)


        Many different types of software programs can be classified as malware, with some of the most common types of malware being viruses, worms, Trojan horses, zombie programs, logic bombs, time bombs, rabbits, trap doors, and script attacks.


        Perhaps one of the most well-known types of malware is a virus. 

        What is Virus?

        In the context of information security. A virus is a hidden, self-replicating computer program that propagates itself by infecting other programs or system memory. 

         Note that viruses can be broadly classified into two groups, transient viruses, and resident viruses. 

         

        transient viruses are those viruses that are active only when their host programs are executing.

         While resident viruses are those viruses that establish themselves in system memory and have the ability to remain active even after their host programs have been terminated. 

        We'll examine viruses more closely a bit later. 

        What are worms?

         Although a worm and a virus have many similarities, a malware worm is distinguished from a virus by its ability to propagate a complete working version of itself onto another machine or device by means of a network. 

         

        What is a Trojan Horse?

         Trojan horse is a computing program that appears to have a useful function, but which also has a hidden and malicious purpose. 

        Trojan horses are commonly able to evade security mechanisms by exploiting the legitimate authority of the user who runs the program. 

        Imagine, for example, that you downloaded a game app for your smartphone. When you launch the app, you're able to play the game. But unbeknownst to you, the app has secretly made a copy of all of the information in your contacts list and has transmitted that information to a remote server. 

        Aside from viruses, worms, and Trojan horses, several other types of malicious code exist as

        What is zombie?

        for example, is a malicious program that is designed to allow a computer to be controlled remotely by a master machine. 

        computers that have been turned into zombies are often used by malicious parties for purposes such as launching a distributed denial-of-service attack against a target organization or network. 

        What is the Logic Bomb?

         a logic bomb is a type of malware program that is designed to activate itself when certain conditions are met.

         One of the most popular types of logic bombs is called a time bomb, which is a logic bomb that activates at a specified date or time.

         Time bombs can be used by malicious parties for purposes such as launching a distributed denial-of-service attack, on a holiday, or on the anniversary of some event. 

        What are Rabbits?

        With respect to viruses and worms, a rabbit is a virus or worm that replicates itself without limit for the purpose of draining or exhausting system resources. 

        In the real world, rabbits are well known for their productivity to reproduce in large numbers. If the population of rabbits is constrained to an area with a limited supply of resources, eventually the rapidly growing number of rabbits will consume all of the available resources. 

        One of the characteristics of computer systems is that they also have limited resources. And I hope this example makes it clear why a virus or worm that replicates itself without limit is known as a rabbit. 

         What are Trap doors or Backdoors?

         Trap doors, which are also known as backdoors are hidden software devices that are installed by a malicious party in order to gain surreptitious access to a computer system while avoiding or circumventing the system security mechanisms. 

         

        What are Script attacks?

         Script attack refers to malicious code that has been written in a scripting language such as JavaScript that is designed to be downloaded and executed

        When a user loads a webpage. Script attacks capitalize on browser vulnerabilities, or the web's same-origin policy in order to gain access to sensitive or private information. Script attacks are quite popular and have been found by recent research to account for at least 80% of the security vulnerabilities on the web. 

        There are, of course, many other varieties of malicious code. But the nine types of malware described previously provide a solid representative sample of current malicious code based threats.

         Although many malware programs are indiscriminate, that is, they are not selective in the people or systems that they attack. It's important to realize that there are also many targeted malicious programs that have been written for a very specific purpose. 

        What is a Targeted Malicious Code?

        Targeted malicious code might be designed to attack a particular system, organization, application, or network, or to carry out a very specific malicious task. 

        An excellent example of targeted malicious code is the Stuxnet worm, which was specifically designed to infect the programmable logic controllers on the Siemens industrial control systems that we're being used by the Iranian government in its efforts to enrich uranium. 

        A useful way of studying and classifying malicious software programs is to evaluate those programs from four different perspectives. 

        • we can consider the extent to which a malware program causes harm. And we can accomplish this by determining how the program negatively impacts users or systems with respect to harm. Remember that malware programs often run with the full authority of the user. And if a user has high-level system access, malware programs can hence cause essentially unlimited harm to a system.  
        • we can consider the way in which a malware program transmits or propagates itself. And we can accomplish this by determining how the program replicates and spreads. malicious programs can potentially transmit and propagate themselves in many different ways, including via files, downloads, documents, scripts, networks, and so forth. 
        • we can consider the ways in which a malware program becomes active. And we can accomplish this by determining how the program establishes itself and gains control of system resources. Many different activation vectors exist for malicious programs. And most of these exploits some sort of system vulnerability.
        • we can consider the stealth characteristics of a malware program by determining how the program hides itself to avoid detection. In order for a malicious program to survive, it must avoid being detected not only during the installation process but also while it is executing and while it is dormant or inactive. Further, once a malicious program has been detected, instances of the program must be removed faster. The program can propagate itself if we hope to cleanse the infection. 

        As promised, we will now take a closer look at how computer viruses work. 

        Recall that a virus is a hidden self-replicating computer program that propagates by attaching itself to other programs. This means that the host program to which a virus is attached must be executed at least once in order for the virus to spread. Recall also that a certain type of virus known as a resonant virus, can establish itself in system memory and can remain active without its host.

        For this reason, even a single execution of the host program can be sufficient to spread the virus widely. 

        Let's consider a few examples of virus propagation. 

        First, imagine that a virus is attached to a program installer file. A user will hence activate the virus when he or she runs the installer program. After being activated, the virus might install itself in all of the programs currently executing in the system's memory. From this point, the virus will spread further whenever any of the infected programs is executed. 

        As another example, imagine that a virus is contained in an attachment to an email message. In this case, the user might activate the virus simply by opening the attachment. From this point the virus can install itself and spread throughout the user's machine.

        Classification of Viruses

         viruses can be classified into four different categories according to the ways in which they attach themselves to their host programs. 

        Classification of Viruses

         

        • Appending viruses

         Appending viruses and appending virus attaches itself either to the beginning or to the end of a host programs code. 

        Most often, appending viruses insert themselves into an executable host program in front of the first legitimate program instruction. In this way, the virus code will run whenever the program is executed. 

        • Surrounding viruses

         A surrounding virus attaches itself to its host program in such a way that it will execute both before and after the host program executes

        developers of surrounding viruses often use this strategy in order to allow the virus to cover its tracks. That is, the component of the virus that runs after its host program has finished executing can be used to mask the presence of the virus. 

        • Integrating viruses

         Integrating viruses incorporate themselves into the middle of host programs legitimate program instructions, thus defeating antivirus software that looks for virus signatures at the beginning or end of an executable program file. 

        • Replacing viruses

         Replacing viruses, which are designed to entirely replace the real, legitimate code of the infected program file

                                                        --------    

        The Perfect Virus...

        From the perspective of someone wishing to design a virus, there are several highly desirable virus characteristics that the designer can seek to incorporate into his or her virus. 

        An ideal virus should be difficult to detect, not easy to destroy or deactivate, and should propagate itself widely and rapidly. 

        Further, an ideal virus should be able to reinfect programs that have previously been infected and should be machine and operating system independent. 

        With respect to the latter of these considerations, imagine how effective a virus would be if it had the capacity to infect any type of device, including smartphones, tablets, PCs, and servers, running any type of operating system, be it Windows, Mac OS, Linux, Unix, iOS, Android, or so forth.

         

        Now that we know a bit about how computer viruses attach themselves to their host programs, we can consider the question of 

        where to hide a virus?

        • viruses can be hidden in many places on a computer system, including the boot sector, in the system's memory, in application programs, in library files, and in many other widely shared files and programs. arguably the best place for a virus to be hidden is in a machine's boot sector.


        • A boot sector is a region of a storage device that contains program code, which allows a computer to load its operating system. When a computer is powered on the BIOS loads the program code from the boot sector into the computer's memory. The computer then executes To this program code in order to initialize its operating system and complete the boot-up process. 
        • Since virus-detection programs are application programs, the operating system must be running in order for a virus detection program to be running. by hiding a virus in the computer's boot sector, then, the virus may be able to avoid detection, since it will have been activated before any virus detection programs were activated. 
        • Another common place for viruses to be hidden is in system memory. on modern computing devices, it is common for hundreds of programs to be executed upon system startup. 
        • If any of these programs are infected with a virus, the virus might propagate by attaching itself to the other programs currently contained in the system's memory. In this way, even if the original host program is terminated, the virus will continue to be active.

         Operating System programs or common user programs are good targets for this type of virus since such programs are likely to be activated often. In addition to hiding viruses in the boot sector or in system memory, viruses can also be hidden in application programs. 

        There are certain applications that allow users to write and execute macros, and these macro-enabled applications have proven to be common targets for viruses. 

        • Since clever virus developers have been able to exploit security flaws in those applications in order to propagate and run malicious code. library files such as DLL files are also a common target for viruses because they are used by or shared by many different programs. When any of the programs that rely upon one of these shared library files are activated, the virus in the infected library file will also become active, thus allowing it to rapidly propagate. Other widely shared files and programs may also be good targets for a virus. 

        It's possible for example, for a virus to be hidden inside of a data set that is shared by many users, thus allowing the virus to spread quickly. 

        • Another interesting place to hide malicious code is inside digital images such as JPEG files. There is in fact an entire science, known as steganography, which examines how information can be concealed. Many methods and tools have been developed in recent years, which allow malicious code and other information to be secretly hidden inside common types of computer files. And these files are thus good targets for viruses. 
        • Finally, and amusingly, a good place to hide a virus might be inside of a disreputable virus detection program. Users who acquire and activate such a program in the hopes of preventing a viral infection may by doing so, actually cause their system to become infected. 

        Virus Signatures and its Pattern

        In order to understand how viruses are detected, we first need to understand that viruses leave behind a unique signature, which can be defined by one or more patterns. 

        If a virus is to survive a hard reboot, that is a reboot in which the power to the computer is switched off and then switched back on, it must be stored somewhere on the computer's non-volatile storage device, such as a hard disk or a solid-state drive. 

        This creates a storage pattern for the virus. Further, a virus interacts with system resources in a particular way while the virus is running. 

        And these interactions create an execution pattern for the virus. Finally, a virus spreads or propagates itself in a particular way, thus creating a distribution pattern for the virus.

         virus scanning programs use one or more of these types of patterns in order to detect viruses. Such software programs may scan the system's memory, or its hard disks or solid-state drives, including the boot sector in an effort to detect any virus activity on the machine. Additionally, virus scanners can use techniques such as file checksums, in order to detect changes to important files.

        Virus Scanning and Removing Programs...

        Virus Scanning and Removing Programs.

         

        When a virus scanning program finds a virus, it will typically try to remove it by extracting all of the pieces of the virus from its host programs and from the system's memory. 

        One of the major challenges faced by virus scanning programs is polymorphic viruses, which are designed to modify their signatures as they execute in order to avoid detection. 

        Note that there are typically hundreds of new viruses identified every day. And as such a virus scanner and its database of virus signatures must be kept up to date in order to be effective. 

        Virus Removal and Post-infection Recovery

        fixing a system after it has been infected by a virus might be accomplished in a number of different ways, depending upon the virus and the nature of the damage that it is done to the system. 

        Ideally, we would want to disinfect the system by removing the virus from any infected programs without damaging the programs themselves. Unfortunately, this can only be accomplished if the virus code can be separated from the program code. And if the virus did not corrupt the program.

        If the virus cannot be separated from the program file, then the file must be permanently deleted. If one or more files is deleted by the virus itself or are deleted in the process of disinfecting the system, then restoring the system to its original state will require that we recover or replace all of the deleted files. 

        This emphasizes the need to maintain file backups, especially of important files. Without backup copies of the files that have been deleted either by the virus itself or as a consequence of the disinfection process, it will be extremely difficult to restore a system to its original state. 

        identifying a digital object has been modified by malware

        Among the most important tools that we have available for identifying when a digital object has been modified by malware, our error-detecting codes there are several varieties of these error detecting codes, including parody bits, checksums, and cryptographic checksums, which, when used properly, can help us to detect when a program or file has been surreptitiously altered by a malware program. 

        A parity bit or a check bit is the simplest form of error detecting code. The process involves appending a single bit of data, either a zero or a one to a string of binary data, in order to indicate whether the number of ones in the string is even or odd. 

        If the binary data in the string has been altered, and there is a 50% chance that the parity bit will detect the modification, a checksum is a value that is computed by running a file through a hash function or a checksum algorithm

        Because the hash function or checksum algorithm will produce different values for different combinations of input data. the integrity of a file can be verified by computing the file's checksum and comparing the result to a known checksum value. If the two values differ, then we can be reasonably sure that the file has been modified.

         The developers of malware are, of course, generally quite clever, and many of these clever developers have found ways of modifying programs or files, such that they generate the same checksum value as the unmodified program or file, thus making it appear as if the program or file has not been altered. 

        For this reason, a cryptographic hash function can be used to generate a checksum value that has an extremely low probability of being duplicated after a file has been modified. It is also important to note that, under certain circumstances, error-correcting codes can be used to restore programs or files that have been surreptitiously altered to their original state without requiring a clean, unmodified copy of the original object.


        Reducing Harm from Malware Infections

        Reducing Harm from Malware Infections

         

        In addition to checking whether digital objects such as programs or files have been surreptitiously modified, there are also several mechanisms that can be used to reduce or contain the harm caused by a malware infection. 

        First among these is the principle of least privilege. This principle states that users should have access to the minimum number of digital objects and system capabilities necessary in order to perform the tasks that they need to perform. 

        A malware program that runs with the authority of a system administrator has the potential to cause much more harm than if the same malware program were run with the authority granted to a low-level user account. 

        Second among these mechanisms is the principle of complete mediation. This principle states that we should check whether a user is allowed to use a digital object each and every time. Access to the digital object is requested. 

        Finally, we have the mechanism of memory separation. When implemented properly, memory separation ensures that each user's digital objects are isolated in memory from other users' objects, thus preventing cross-contamination. It is important to realize that most single-user systems, such as home computers, laptops, tablets, and so forth, are not properly configured to capitalize on hierarchical code sensitivity and capability. 

        Since most people use a single user account on their personal computing devices, which has high-level administrative access to the system. 

         

        How to Be Secure from Malware..? 

        How to Be Secure from Malware

         

        Just as with Malware infections, adopting proper malware hygiene can help us to substantially improve our chances of avoiding a malware infection. 

        •  It's good practice to use up to date anti-malware software that has been supplied by a trustworthy vendor.
        • New or unknown software programs should always be tested on an isolated device if possible, especially if the software is to be used in an organizational environment. 
        •  Users should be trained to recognize and open only safe attachments and data files. 
        • Users should be made aware that any website might be harmful, even if the website has been safe in the past.
        •  If restoration of the system becomes necessary, it's important to keep a recoverable system image in a safe place and to have backup copies of executable system files available. 
        Even with all of these hygienic precautions, there are still no absolute guarantees that we can avoid a malware attack. By following these steps, however, we can vastly reduce our chances of acquiring a malware infection

        Interesting facts about Malware

        As food for thought in our consideration of malicious code, I would like to discuss some truths about malware. 

        • Malware can infect any platform. 
        For many years, there has been a persistent belief that devices running Mac OS or iOS operating systems are immune to malware attacks. This belief is absolutely false. All computing systems can be affected by malware. 
         
        • Malware programs can modify hidden and read-only files. 
        Many people believe that if a file is hidden or marked as read-only, then it will be immune to modification by malware. Remember that malware programs often run with elevated privileges, and can easily change whether a file is hidden or read-only. 
        •  Malware can appear anywhere in a system. 
        Many of the developers of malicious programs are extremely intelligent and extremely talented. And there are hence no dark corners anywhere in a computer system that is immune to malware. 
         
        •  Malware can spread anywhere where file or data sharing occurs. 
        Malware programs have many ways to propagate themselves, and we should therefore not expect any communications channel to be safe from malware.
         
        • It is not possible for malware to remain in volatile memory after the power to a system has been completely switched off. 
        Nevertheless, if a malware program is saved on a disk or a solid-state drive, for example in the boot sector, then it may reappear when the power is restored. 
         
        • It is possible for malware to infect the software that runs hardware devices. 
        firmware viruses do exist. 
         
        • Malware can be malevolent, benign, or benevolent. 
        Although the vast majority of malware is written with malicious intent. The same techniques that are used to develop malware programs, such as viruses and worms can be used to achieve positive or munificent objectives. 
         
        As an example, consider this question. Would you mind having a  virus living on your system? 
         
        Well, This ends our overview of malicious code. I hope that you learned something interesting in this lesson. 
         have a great day.

        and Happy Hacking...