• Search for:
    10Jul, 2014
    Hackerdaemon for Windows

    Hackerdaemon, an Intrusion Detection System (IDS) is “for Windows Servers only“.
    If you need protection for your desktop, please check out our HackerTracker System instead.
    IDS is a software application that monitors (network or system) internet/intranet activities for malicious purposes. It helps to discover policy violations and produces reports to a management station.
    IDS comes in a variety of “flavors” and approach the goal of “detecting and identifying suspicious traffic, in different ways”.
    There are network based (NIDS) and host based (HIDS) intrusion detection systems. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. However, our IDS does both, it detects and stops intruders.
    Intrusion detection and prevention systems (IDPS) are primarily focused on “identifying possible incidents”, logging information about them, and reporting attempts. In addition, organizations use IDPSes for other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. IDPSes have become “a necessary addition to the security infrastructure of nearly every organization”.
    Similarly to our HackerTracker System, combining both tools produces a greater defense system against intruders. Our IDS tools typically record information related to observed events, notify security administrators of important observed events and produce reports. Our latest IDS goes one step ahead of all by blocking intruders once for all. Many IDSes can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDS stopping the attack itself, changing the security environment (e.g. reconfiguring a firewall) or changing the attack’s content.
    It runs on Windows Servers only.
    For more information:

    1. Call us at: 713-714-7852

    (Hablamos Español)
    [SPANISH LANGUAGE INFORMATION]
    Nuestro nuevo Sistema de “Detección de Intrusos” (IDS) es una aplicación de software que supervisa las actividades de la red o del sistema que se ha utilizado para fines maliciosos o violaciónes de política, y produce informes a una estación de administración. IDS vienen en una variedad de “sabores” y se acercan al objetivo de “detectar tráfico sospechoso de diferentes maneras”.
    Hay IDSs basados en la RED (NIDS) y anfitriones basados en el sistema (HIDS) para la detección de intrusos. Algunos sistemas intentan detener un intento de intrusión, pero esto no es necesario ni se espera de un sistema de monitoreo. Sin embargo, nuestro IDS no solo que detecta intrusos sino que también los detiene a todos ellos automáticamente y de por vida.
    Un sistema de prevención (PDI) y de detección de intrusos se centra principalmente en “la identificación de posibles incidentes”, registrando la información sobre ellos, y la presentación de informes de intentos. Además, las organizaciones utilizan IDPSes para otros fines tales como la identificación de los problemas con las políticas de seguridad, la documentación de las amenazas reales, y disuadir las personas a que no violen las políticas de seguridad. IDPSes se han convertido en “un complemento necesario a la infraestructura de seguridad de casi todas las organizaciones”.
    Al igual que en nuestro Sistema “HackerTracker”, y combinando ambas herramientas, usted produce un sistema de defensa mucho mayor contra los intrusos. Nuestras herramientas IDS informan típicamente y registran todo lo relacionado a los eventos observados, notifica a los administradores de seguridad de los eventos observados que son importantes, y producen informes relacionados.
    Nuestra última IDS va un paso delante de todos al bloquear a los intrusos “de una vez por todas”. Muchos IDS también pueden responder a una amenaza detectada para tratar de impedir que tenga éxito. Se utilizan varias técnicas de respuesta que implican a los IDS detener el ataque en sí mismo, el cambio del entorno de seguridad (por ejemplo, volver a configurar un servidor de seguridad) o cambiar el contenido del ataque.
    Trabaja en Servidores y estaciones de trabajo Windows solamente.
    Para más información, no dudes en llamar al 713-714-7852 y aprenda más acerca de este producto.

    30May, 2012
    HackerTracker for Windows

    Worried about who is visiting your computer system without your consent?
    Our new HackerTracker System (DHTS) helps you to identify who is accessing your computer system from the Internet, and/or from your own  Intranet.
    It will inform you, in programmable intervals of time, about all incoming connections made by other users residing anywhere in the world. Including your own Intranet!
    You will be alerted as to which ports are being used in your system, together with the name of the corresponding application claiming those specific ports. That way, you can trace any process when your system is being compromised.
    A full report on each connection will be offered for historical and legal purposes, in case you decide to track down and bring to court any hacker attacking your system.

    General Information

    HackerTracker from DAPROSE is specially designed for both, Windows desktops and servers. It works as a regular “desktop application” or as a “TSR” application, (TSR = Terminate and Stay Resident).
    HackerTracker obtains, (in user definable intervals of time), all possible information on every connection made by your computer system with the outside world, or uninvited connections with your own intranet.
    HackerTracker provides all possible pieces of information obtained on each connection:

    • The NICs installed and activated on your computer system.
    • Who and when a hacker is visiting your computer system.
    • The date, time, IP addresses and ports being used by each visitor.
    • The domain names to which any visitor belongs to.
    • The originating country where the connection was initiated.
    • The ports being exposed by your computer system. This is a very valuable piece of information as most people have no idea as to what ports are opened, uncontrolled, or without any defense whatsoever in their computer systems.

    If for any reason the information obtained by the HackerTraker System is incomplete, you can use the data obtained by HackerTraker in any other online service, to obtain more information about any intruder, … use any external tool or resource utility available in the Internet to find out more about each particular IP reported.
    Your computere system already counts with several software tools that you would need to be familiar with to take full advantage of the reports provided by the HackerTracker. Your will learn more about them by using this system regularly. Ex: tracert.exe, nslookup.exe, netstat.exe, ping.exe, ipconfig.exe, etc.
    Operating Systems Compatibility List:

    • • Windows 10
    • • Windows 9
    • • Windows 8
    • • Windows Server 2008 Service Pack 2
    • • Windows 7
    • • Windows Server 2003 R2 (32-Bit x86)
    • • Windows Server 2003 R2 x64 editions
    • • Windows Vista Service Pack 1
    • • Windows Vista Service Pack 2
    • • Windows XP Service Pack 3
    • • Windows XP Service Pack 2
    • • Windows XP Service Pack 1
    • • Windows XP
    • • Windows 2000 Servers y Workstations

    For more information:

    15Nov, 2011
    WMIC

    Windows Management Instrumentation Command.
    Read a huge range of information about local or remote computers. Also provides a way to make configuration changes to multiple remote machines.
    Syntax
    Retrieve information about :
    WMIC [global_switches] [/locale:ms_409] [options] [format]
    Interactive mode:
    WMIC
    Aliases:
    ALIAS – Access local system aliases [CALL]
    BASEBOARD – Base board management (motherboard or system board)
    BIOS – BIOS management (Basic input/output services)
    BOOTCONFIG – Boot configuration
    CDROM – CD-ROM
    COMPUTERSYSTEM – Computer system [CALL/SET]
    CPU – CPU
    CSPRODUCT – Computer system product information from SMBIOS.
    DATAFILE – DataFiles [CALL]
    DCOMAPP – DCOM Applications.
    DESKTOP – User&qt;&qt;s Desktop
    DESKTOPMONITOR – Desktop Monitor
    DEVICEMEMORYADDRESS – Device memory addresses
    DISKDRIVE – Physical disk drive
    DISKQUOTA – Disk space usage for NTFS volumes.[SET]
    DMACHANNEL – Direct memory access (DMA) channel
    ENVIRONMENT – System environment settings [SET]
    FSDIR – Filesystem directory entry [CALL]
    GROUP – Group account [CALL]
    IDECONTROLLER – IDE Controller
    IRQ – Interrupt request line
    JOB – Jobs scheduled using the schedule service.[CALL]
    LOADORDER – System services that define execution dependencies.
    LOGICALDISK – Local storage devices [CALL/SET]
    LOGON – LOGON Sessions.
    MEMCACHE – Cache memory
    MEMLOGICAL – System memory, layout and availability
    MEMPHYSICAL – Physical memory management
    NETCLIENT – Network Client management.
    NETLOGIN – Network login information for a particular user.
    NETPROTOCOL – Protocols (and their network characteristics).
    NETUSE – Active network connection.
    NIC – Network Interface Controller (NIC)
    NICCONFIG – Network adapter. [CALL]
    NTDOMAIN – NT Domain. [SET]
    NTEVENT – NT Event Log.
    NTEVENTLOG – NT eventlog file [CALL/SET]
    ONBOARDDEVICE – Common adapter devices built into the motherboard.
    OS – Operating System/s [CALL/SET]
    PAGEFILE – Virtual memory file swapping
    PAGEFILESET – Page file settings [SET]
    PARTITION – Partitioned areas of a physical disk.
    PORT – I/O ports
    PORTCONNECTOR – Physical connection ports
    PRINTER – Printer device [CALL/SET]
    PRINTERCONFIG – Printer device configuration
    PRINTJOB – Print job [CALL]
    PROCESS – Processes [CALL]*
    PRODUCT – Windows Installer [CALL]
    QFE – Quick Fix Engineering (patches)
    QUOTASETTING – Setting information for disk quotas on a volume. [SET]
    REGISTRY – Computer system registry [SET]
    SCSICONTROLLER – SCSI Controller [CALL]
    SERVER – Server information
    SERVICE – Service application [CALL]
    SHARE – Shared resourcees [CALL]
    SOFTWAREELEMENT – Elements of a software product*
    SOFTWAREFEATURE – Subsets of SoftwareElement. [CALL]*
    SOUNDDEV – Sound Devices
    STARTUP – Commands that run automatically when users logon
    SYSACCOUNT – System account
    SYSDRIVER – System driver for a base service. [CALL]
    SYSTEMENCLOSURE – Physical system enclosure
    SYSTEMSLOT – Physical connection points including ports,
    slots and peripherals, and proprietary connections points.
    TAPEDRIVE – Tape drives
    TEMPERATURE – Temperature sensor (electronic thermometer).
    TIMEZONE – Time zone data
    UPS – Uninterruptible power supply (UPS)
    USERACCOUNT – User accounts [CALL/SET]
    VOLTAGE – Voltage sensor (electronic voltmeter) data
    VOLUME – Local storage volume [CALL/SET]
    VOLUMEQUOTASETTING – Associates the disk quota setting with a specific disk volume. [SET]
    WMISET – WMI service operational parameters [SET]
    New aliases in Windows 2003:
    MEMORYCHIP – Memory chip information.
    RDACCOUNT – Remote Desktop connection permission [CALL]
    RDNIC – Remote Desktop connection on a specific network adapter [CALL/SET]
    RDPERMISSIONS – Permissions to a specific Remote Desktop connection [CALL]
    RDTOGGLE – Turn Remote Desktop listener on or off remotely[CALL]
    RECOVEROS – Blue Screen Information [SET]
    SHADOWCOPY – Shadow copy management [CALL]
    SHADOWSTORAGE – Shadow copy storage areas [CALL/SET]
    VOLUMEUSERQUOTA – Per user storage volume quotas [SET]
    Options
    By default an alias will return a standard LIST of information, you can also choose to GET one or more specific properties.
    Configuration changes can be made, where indicated above with: [CALL or SET ]
    The CREATE and DELETE options allow you to change the WMI schema itself.
    alias
    alias LIST [BRIEF | FULL | INSTANCE | STATUS |SYSTEM | WRITEABLE]
    [/TRANSLATE:BasicXml|NoComma ]
    [/EVERY:no_secs] [/FORMAT:format]
    alias GET [property list]
    [/VALUE ] [/ALL ] [/TRANSLATE:BasicXml|NoComma ]
    [/EVERY:no_secs] [/FORMAT:format]
    alias CALL method_name [parameters]
    alias SET [assignments]
    alias CREATE
    alias DELETE
    alias ASSOC [/RESULTCLASS:classname] [/RESULTROLE:rolename][/ASSOCCLASS:assocclass]
    For more help
    WMIC /locale:ms_409 /alias /?
    WMIC /locale:ms_409 /alias option /?
    e.g.
    WMIC /locale:ms_409 /BIOS /CALL /?
    WMIC /locale:ms_409 /MEMLOGICAL /SET /?The order of the /FORMAT and /TRANSLATE switches is significant: if /TRANSLATE follows /FORMAT, the output is formatted first and then translated.
    All the options above can be extended with a WHERE clause, best shown by the examples below:
    Format:
    Format defines the layout of the information:
    csv.xsl, hform.xsl, htable-sortby.xsl, htable.xsl texttable.xsl, textvaluelist.xsl, xml.xsl
    All output files are unicode text (convert to ASCII with TYPE)
    Tab Separated Values (.tsv) can be opened in excel Examples
    WMIC /locale:ms_409 OS
    WMIC OS LIST BRIEF
    WMIC OS GET csname, locale, bootdevice
    WMIC /locale:ms_409 NTEVENT where LogFile=&qt;&qt;system&qt;&qt;
    WMIC NTEVENT where "LogFile=&qt;&qt;system&qt;&qt; and Type>&qt;&qt;0&qt;&qt;"
    WMIC SERVICE where (state=”running”) GET caption, name, state > services.tsv
    WMIC SERVICE where caption=&qt;&qt;TELNET&qt;&qt; CALL STARTSERVICE
    WMIC PRINTER LIST STATUS
    WMIC PRINTER where PortName="LPT1:" GET PortName, Name, ShareName
    WMIC /INTERACTIVE:ON PRINTER where PortName="LPT1:" DELETE
    WMIC PROCESS where name=&qt;&qt;evil.exe&qt;&qt; delete
    WMIC /output:"&qt;computername&qt;.txt" MEMORYCHIP where "memorytype=17" get Capacity
    Interactive mode:
    C:>START "Windows Management" WMIC
    wmic:rootcli>/locale:ms_409
    wmic:rootcli>OS get csname
    wmic:rootcli>quit
    Notes
    WMIC is available on Windows XP Professional and Windows 2003. To retrieve WMI information from older remote machines download & install: WMI core for Win 9x / WMI core for Win NT 4
    The availability of WMI information does vary across different versions of Windows
    e.g. ODBC, SNMP, Windows Installer.
    To run WMIC requires administrator rights.
    In Windows 2000, around 4,000 properties can be monitored, and around 40 can be configured.
    In Windows XP around 6,000 properties can be monitored, and around 140 can be configured.
    Windows 2003 offers a few improvements and bug fixes: the global option /locale:ms_409 is not required (it defaults to English US.)
    When you type WMIC for the first time in Windows 2003 all the aliases are compiled. The second, and subsequent times you run WMIC, it will start immediately. Under XP WMIC is slower to initialise, therefore to run several WMI queries it can be quicker to use interactive mode.
    * WMI information for installed software packages (PACKAGE and SOFTWAREFEATURE) is often incomplete and inconsistent for a variety of historical reasons. A more reliable method is to retrieve a list of installed programs directly from the Add/Remove list in the registry, with a WSH script like this from Torgeir Bakken.

    15Nov, 2011
    WiFi Security Tips

    1. Enable Encryption on your Access Point. Using 128-bit encryption or higher makes your Wireless Network more secure. WEP and WPA are entirely different encryption schemes. WEP has been proven insecure. Using WPA is recommended, but actually no more secure than WEP. WPA is just a little friendlier to use.

    2. Set the &qt;&qt;Administrator&qt;&qt; password on the router. Anybody who gains access can use the &qt;&qt;default&qt;&qt; password to lock you out, or grant themselves more privileges (i.e. disable MAC address filtering or add one more MAC address to the MAC address filtering list so they don&qt;&qt;t always need to &qt;&qt;clone&qt;&qt; your MAC address to get in). If you forget it, most routers have a hardware reset that will restore all of the settings to factory defaults.

    3. Don&qt;&qt;t use easily guessed Keys, such as "ABC123", "Password", or a string of numbers in order. Use something hard to guess that contains both letters and numbers. Special characters such as !@#$&qt; are not supported by most routers. The longer the key, the better. Using the Passwords Page on GRC.com is recommended.

    4. Change your ESSID (Wireless Network Name)from the default to something unique. Don&qt;&qt;t use your phone number, address, or anything that may identify you. If you leave it &qt;&qt;linksys&qt;&qt; (or whatever default) your Windows notebook will automatically connect to every other network it encounters with the same name, and not every wireless network is a good and secure thing to connect to.

    5. Disable the &qt;&qt;ESSID Broadcast&qt;&qt; feature of your Access Point or Router. People will be less likely to pass by and notice your network. On the down-side, it becomes problematic to connect a guest&qt;&qt;s computer to it, as well as many &qt;&qt;devices&qt;&qt;, like printers with wireless networking built in.

    6. Use MAC Address filtering on your Access Point or router. This registers the hardware address (MAC Address) of your networked devices, and prevents unknown devices from joining or accessing the network (unless they clone one of your &qt;&qt;allowed&qt;&qt; MAC addresses after you go to bed).

      15Nov, 2011
      WiFi Security

      Security is one of the first concerns of people deploying a Wireless LAN, the 802.11 committee has addressed the issue by providing what is called WEP (Wired Equivalent Privacy).

      The main concerns of users are that an intruder would not be able to:

      • Access the Network resources by using similar Wireless LAN equipment, and

      • Be able to capture the Wireless LAN traffic (eavesdropping)

      Preventing Access to Network Resources
      This is done by the use of an Authentication mechanism where a station needs to prove knowledge of the current key; this is very similar to the Wired LAN privacy, on the sense that an intruder needs to enter the premises (by using a physical key) in order to connect his workstation to the wired LAN.

      Eavesdropping
      Eavesdropping is prevented by the use of the WEP algorithm, which is a Pseude Randon Number Generator (PRNG), initialized by a shared secret key. This PRNG outputs a key sequence of pseude-random bits equal in length to the largest possible packet, which is combined with the outgoing/incoming packet producing the packet transmitted in the air.

      The WEP algorithm is a simple algorithm based on RSA?s RC4 algorithm, which has the following properties:

      • Reasonable strong: Brute-force attack to this algorithm is difficult because of the fact that every frame is sent with an Initialization Vector, which restarts the PRNG for each frame.

      • Self Synchronizing: The algorithm synchronized again for each message, this is needed in order to work on a connectionless environment, where packets may get lost (as any LAN).