Nilesh Kumar

I got a message from Mae Bualat about secure implementation of forgot password mechanism. Although, his way also sounded secure to me, I suggested him more alternatives. It's always arguable the approaches, but these are my personal arguments as per my limited knowledge. Following is the communication between us: Hi Mr. Nilesh Kumar, I've come across your blog while looking for some references on the web for a secured password recovery scheme. I suppose, as a security specialist, you may have inputs to help me work on it. Am looking for a secure password recovery implementation. The process that I am looking into is this: user will need to supply email address used on account registration then birthday, then user will need to supply new password, then the system will send a verification link to his registered email to finalize and confirm the process.But aside from this, am still currently looking for some ways to securely implement this process. Any idea will be...

Today my colleague Surendra had a query regarding a weird popup coming up while he was trying to access a website. Although even, I was not very familiar with the kind of message he was getting. All we wanted to know, if it's really anything malicious! He was trying to access some page, and the website was making some weird request to the webserver in order to load some object (here it was a calender) from the server: mhtml:http://abc.com/resources/Calnder.mht The warning message was like this: Even I had not noticed like anything in the past, I did a little research on the topic. The browser was trying to load some MHTML page.MHTML is simply a MIME HTML format, used to combine all the external resources, which are generally loaded as external link, with HTML code into a single file. Generally this file has extension as .mht. So any .mht file contains mix of HTML code and other objects such as, Flash, images, applets, audio files etc. The content of .mht ...

Some times it becomes very necessary to confirm which exe or process is listening upon which port in order to determine the reason behind the running services on those ports. For example, if you find that there is one more web service running over another port, suppose 8082 apart from port 80, you may need to determine, after all which process. To see it type: netstat -anb: If you see the above output, you can see the inetinfo.exe process is running on two ports 80 and 3205 which in turn are http and sapdp05 respectively. Also, the respective PID or processID, which in this case is 2644 for inetinfo.exe. So, if you stop or kill the inetinfo.exe process, these services will stop. I have seen in some PCs, specially in Win7 netstat -ab command does not work. So for determining about the process listening on a specific port you can do like this: type netstat -ano | find "2644" as we know that PID 2644 is responsible for opening the port 80 (http) and 3205 (sapdp05) ...

My Article on reversing exe has got published in Oct issue of "Exploiting Software-Hakin9" magazine. This article is about basic introduction to Reverse Engineering. I have chosen to show reversing of a sample exe file and how to patch it. The article more focuses on showing a practical example of reversing. It could be downloaded here . The article is from Page no. 38 onwards.

In Security profession, you always go with your finding to the people who has technical capabilities so that they may understand, what you want to explain to them. But what in a situation if you need to deal with ordinary, non technical users? They don't understand your security jargon, they only care about their business. I have been dealing with these sort people from long back! And when they are sitting in remote location, it's very tough! The best way is to send them mails explaining the issue, its impact and how to fix them. Sometimes, they will co-operate with you some times, you are disappointed. For example, if you need to deal with users running any Insecure Services (suppose FTP) on their machines, the following ways seem working: 1. First send a communication to them about the issue, eg, what the service is all about, how it could be exploited if not closed or secured. 2. If they respond, well, tell them to stop FTP from Services.msc. 3. Sometimes, they are not sure ...

Today, again I came across the same scenario about which my colleague Sam had asked me once. He asked me about best practices for securing the connection strings. Well, for securing the Database connection string file. The general approach will be-irrespective of technology- its’ best practice to move the credentials out of source-code into a configuration file. It needs to be properly protected, using strong ACLs and strong encryption with properly protected keys. I shall give you an example of .NET which I am aware of and you can suggest developers to use the similar thing for Oracle and jsp pages. Again there are different approaches for different technologies- for ASP.Net you can either use Windows authentication instead of using username/password, database (connection string) name in the source code. But that’s not possible, if you have got to mention the username/password, database name, put them in a separate configuration file such as app.config or web.config and encrypt them ...

An open mail relay is an SMTP server configured in such a way that it allows anyone on the Internet to send e-mail through it, not just mail destined to or originating from known users.This used to be the default configuration in many mail servers; indeed, it was the way the Internet was initially set up, but open mail relays have become unpopular due to their exploitation by spammers and worms. Many relays were closed, or were placed on blacklists by other servers.[Wikipedia] How to test your mail server for open relay: 1. At command prompt type: C:/>telnet mailserver.yourdomain.com 25 220 mailserver.yourdomain.com ESMTP MAIL Service Version 6.0.3894 ready at Tue, 22 Aug 2011 05:22:00 -0700 2. helo 250 mailserver.yourdomain.com Hello 3. mail from: sender@otherdomain.com 250 2.1.0 sender@otherdomain.com....Sender OK 4. rcpt to: recepient@someotherdomain.com 250 2.1.5 recepient@someotherdomain.com 5. data 354 Start mail input; end with . This is a test mail. P...