Network Forensic Analysis Tools to Assess Network Vulnerabilities

Friday, October 24th, 2008

Every organization today has some type of a network security policy to protect or secure its systems, but when there is a violation of organization policies with vulnerable attacks then forensic analysis plays a crucial role. The evidence in computer forensics may take many forms with the help of network forensic tools.

Many network analysis tools are available nowadays to create a report containing details of potential problems like monitoring network computers for possible vulnerabilities, checking network for all potential methods that a hacker might use to attack etc. Some of the forensic tools are specially designed for networks.

For example: DNA (Distributed Network Attack) a new approach in computer forensic analysis is one of the most efficient forensic tools in recovery of password protected files. The new tool made major advancements in recovery of distributed network system, which were earlier limited to the processing of single machine.

With installation of the DNA tool on the server it will have access to the network and power to processes on different machines to decrypt the passwords. There by the DNA manager is responsible for coordinating the attack, assigning small portions of key search to machines distributed throughout the network. With the use of this forensic tool the liability of client to commit mistakes can be avoided.

There are other forensic tools, some designed for analysis of network activity and some are intended for log aggregation or analysis. Through these forensic tools you can see the services operating over the network like file openings and closing.

Network security audit helps reduce the possibility of network downtime by discovering the security incidents and the attacks through its LAN, WAN or intranet. In terms of network security concerns you can even go for external and internal security audits to identify and eliminate any security vulnerabilities in your systems.

An External network access will test your network devices and servers for vulnerability to a wide range of exploits, viruses, worms and other common internet attacks. Where as internal security audit starts with threat discoveries which include frequent virus outbreaks, unauthorized access to sensitive e-mail or documents etc.

The domain hijacking, machine break-ins, cracking user passwords, retrieval of sensitive documents, and physical access to sensitive hardware or software can also be analyzed with these audits.

Once the analysis or audit is completed you can easily eliminate the network security problems. These are also applied to the storage area networks and network attached storage. With the help of network forensic tool you can identify and respond to computer crimes and policy violations, not just investigating historical incidents.

www.Datatriage.com, a leading expert in Network Forensic Analysis, Network Security Auditing and Network Vulnerability Services.

Tips To Protect Your Server From Getting Hacked

Monday, September 15th, 2008

Generally as we know that when we visit a web page or when you interact with any web application on internet, some of the information pertaining to us will be stored on the server. When the hackers enter into a hosting server they will try to obtain the root access of your server and will know the confidential database details, which are restricted to the regular visitors. They crack the personal information about the user and steal credit card numbers, which the user submit while making a purchase through the website.

Have doubt on how this hacking on your server takes? Want to know more how the servers are hacked and how we can protect our servers from being hacked?

Being able to run this server-side scripting language or the data in transit is not protected or not encrypted are the reasons to hack, most of the time. Different hackers use different ways, often called white hat hackers and black hat users. These white hat hackers find the security flaw in a script of a website or software and make it public, where as black hat users are malicious hackers, who tamper illegally with software installed in your computers and tell other users about how to do the same.

Finding hackers breaking into your server is difficult to find, as they are not easy to spot. The script kiddies utilize free software hacking programs called “exploits” and distribute them over the internet.
When you suspect malicious software programs, you must be able to react quickly to minimize the outbreak. If your server is prone to an attack by a hacker, here are some tips on how you can protect your server:

1. Disconnect the system from the network

If you suspect your server is infected, then you simply disconnect the system from the network to avoid from any infected programs. Rather than fixing the current problem, leave the system on the network and document this reports in your incident response plan.

2. Discover the method used by the hacker

Know the methods hackers use to overcome the problem, as they use different types of hacking technologies. Using software tools like tripwire, you can identify the files whether any they are uploaded, added or changed on the system. Also find the owner of the files to let you know what is the application used by the hacker to get into server breaking. Investigate the files that were uploaded on the server system which might provide the valuable information about the attack against your server.

3. Information from the running scripts launched by the attacker

Use the lsof (list open files) commands in the system which includes the disk files, pipes, network sockets, the user who owns them, and devices opened by all the processes through which you can find the source of the attack from this information. Also use rootkit detection tools like rkhunter or chkrootkit to scan the possible local exploits to identify and detect the common attacks. It also performs checks to see if commands have been modified, and various checks on the network interfaces.

4. Stop all the attacker scripts and remove the files

Now that when you have identified the cause of the attack on the server you can safely eradicate the running scripts launched by the attacker and remove all the files and save them in a different location for further investigation. Once we know the method used by the hackers, we can stop it and restore the network connection like mail, DNS etc.

These steps are obviously helpful to some extent in restoring the server system from variety of attacks which you might encounter and can be used as a baseline to develop your own plan of actions. Also you can go for the Data Triage Intrusion Detection and Prevention Products, which provide comprehensive and easy to use protection against current and emerging threats at both the application and network layer. www.Datatriage.com, a leading expert in Network Security Auditing and Network Vulnerability Services.