Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website,
instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Many popular guestbook and forum programs allow users to submit posts with html and javascript embedded in them. If for example I was logged in as "john" and read a message by "joe" that contained malicious javascript in it, then it may be possible for "joe" to hijack my session just by reading his bulletin board post. MORE HACKS: Hacktips, Network hacking, Twitter Hacks, windows hacks, wireless hacking
Today I stumbled upon a great website which check who is invisible in yahoo called Yinvisible.com:- is a fast or .With Yinvisible.com, you can detect whether a user is online, offline or invisible!You can do this all without the user knowing! Yinvisible.com allows you to keep track of what other Yahoo Messenger! users are doing,even if they are in Invisible or Stealth Mode. MORE HACKS: E-mail Hacking, Network hacking
The first thing you should do, after getting a new PC or reformatting, is to run Windows Update.
In my household, I have 4 computers running Windows XP, Windows Vista, Windows 7, Ubuntu 9.04, Xubuntu 9.04. Some dual-boot while one triple-boots etc.
Whichever operating system you are using, make sure to update them frequently. Especially if you're running Windows, I recommend that you turn on the auto-update in 'Windows Update' if not already done so. Microsoft releases frequent vulnerability and security fixes.
Keeping your operating system up to date is the first step in keeping your computer safe. To check if you're covered (in Windows), open up your control panel and click on Windows Update. If you see the automatic update option selected, you're all set. If not, either choose the full auto update or the option that gives you the chance to choose which updates to install yourself. Just don't turn it off. If you must turn it off for whatever reason, manually check the Windows Update website at least once a week.
Recommended: Try out Ubuntu, the most popular Linux distro. Using a Linux OS may sound too nerdy for some, but the level of user-friendliness has gotten a lot better over the years. It has all the pretty GUI, too. And, if you're having problems, a huge online community is waiting to help you. It's FREE and SAFE.
2. Install Anti-Virus and Keep the Virus Definitions Up-to-Date
An anti-virus software is a MUST. If you don't have one, you are almost guaranteed to get infected; it's only a matter of time.
It is amazing how many people don't have an updated anti-virus running on their computers. Especially if you bought a pre-assembled PC from Dell or HP or Acer etc., your computer may come with a free trial period of 30 days to 1 year. Be mindful of this when you purchase a new PC.
When your subscription period runs out, you will need to either pay to continue using the anti-virus you currently have or get a different anti-virus software. Shop around.
Recommended: There are tons of options out there. But Avast and AVG are two of the best. Why? Because they're free and very effective. Now, if you want more features and protection, you can move up to a paid anti-virus software. I know Symantec and Mcafee are two of the dominant players, but I don't recommend them as they take more resources to run and there are others with better detection rates. Full list of recommended antivirus.
3. Anti-Spyware / Adware
Many times when a PC user complains about a sluggish computer or a slow startup, it is due to a presence of ad/spyware. Most common ones are mostly cookies from your browser as you surf the web and are not very dangerous, while some spywares are very malicious in nature. One example is a key-logger that can log your key strokes to steal your credit card numbers and passwords.
There are also adwares that hijack your browser's homepage to display their content every time you load up your browser and toolbars that won't go away.
These days, a lot of anti-virus softwares are able to protect your PC from spy/ad-wares, too. But if you want to be extra safe, install a couple of anti-spyware programs that will more aggressively block various malwares.
Recommended: Free: Spyware Blaster, Windows Defender, SuperAntiSpyware
You can get started with just a couple of those. If you have Windows Vista or 7, you will have Windows Defender by default. So, you might as well use it. I recommend Spyware Blaster in all cases. You simply run it, update, and protect. It doesn't need to run in the background. It adds black lists to your browsers, and provides an effective prevention. SuperAntiSpyware is a complete suite with real-time protection.
4. Secure Your Home Network
In today's typical household, multiple computers share a single internet connection. Usually, a router is used to share that connection.
What many people forget is that router is not only an internet sharing device, but a firewall to protect your whole network as well.
Setting up your router's firewall is the first thing you need to do when setting up a network. Make sure that the firewall feature is turned on in the router settings.
What's more concerning is that, with the gaining popularity of wireless (WiFi) networks, people are leaving the door wide open to potential hackers and your neighbors (who's accessing your wireless network right now). You need to protect your computers not just from threats on the internet but also from threats close to your house.
If you have a wireless network enabled in your router, please look at your security settings. If you've never touched it, it is very likely that your neighbors had a peek inside your network a few times.
Set it up so that you are using WPA or (preferably WPA2 if supported) with AES encryption (or TKIP if your device doesn't support AES). WEP is no good. It can be cracked within a couple of minutes. Even WPA is not all that safe these days, but you might not have the option to use WPA2.Create a shared key (password) that's impossible to guess.
My key is 60+ characters long with numbers and lower/upper case letters randomly generated by the router.
5. Use a Firewall
A firewall prevents intruders from getting in. If you have a router, you already have a firewall. Just confirm that it is up and running. A software firewall can increase the level of security, and especially if you don't have a router, you need a software firewall. Windows has a built-in firewall, and should be enabled by default. There are other popular firewalls like Zone Alarm.
What I'd recommend, if you want to keep things simple, is to use a security suite that has both anti-virus and firewall included. Full list of recommended firewall
6. Try Something Other than Internet Explorer
If you are still using Internet Explorer as your main browser, you really need to switch. IE is the most vulnerable and is also the least efficient browser on the market.
Browsers such as Firefox, Opera, and Chrome are much faster and safer. At the moment, Firefox is the most popular alternative. But I encourage you to try out all the browsers and see which one you like the best.
I highly recommend Opera. Opera is faster than Firefox. It has built-in email client, bittorrent client, widgets, mouse gestures and more. Opera has all these features built-in, yet, it is smaller than Firefox. With the new release of Opera 10 with Turbo (speeds up browsing for slower connections), I predict it will gain more market share. I personally use Firefox, Opera, and IE. Firefox is my main browser; Opera is number two. IE is only used when testing website changes and visiting Korean websites. Lots of Korean websites are only compatible with IE, which I really hate.
7. Careful Opening Email Attachments
Even if you receive an email from one of your friends, don't assume it's safe to open file attachments. Some viruses take control of a person's email account and sends viruses to all his contacts.
If an email is from a stranger, most likely the attachment is a virus. Having an anti-virus should protect you from email threats, but still be careful.
Now, if you experience harm because you had replied to a Nigerian email saying you won a $10 million lottery, there's nothing that can help for you other than your common sense.
8. Try OpenDNS
OpenDNS is a free DNS service that can help your browsing experience to be faster and safer. DNS (Domain Name System) "translates domain names meaningful to humans into the numerical (binary) identifiers associated with networking equipment for the purpose of locating and addressing these devices worldwide.
An often used analogy to explain the Domain Name System is that it serves as the "phone book" for the Internet by translating human-friendly computer hostnames into IP addresses. For example, www.example.com translates to 208.77.188.166." - Wikipedia
OpenDNS keeps track of and blocks harmful websites and also has a parental control feature and more.
All you have to do is put these two numbers "208.67.222.222", "208.67.220.220" into your router settings or your computer's network settings.
Instructions for various routers and computers are available on the website.
9. Be Careful about Which Sites You Visit
If you got OpenDNS all set up, you can worry about this a little less. But OpenDNS cannot protect you 100% as news malicious sites keep on popping up.
Warez, crack, and adult sites are the most dangerous categories of websites. Don't visit them unless you know it's safe.
Again, an anti-virus will protect you from this kind of threats as well. See how important an anti-virus is?
10. Keep Your Personal Information Safe
Many of these threats are aimed at getting your personal information. So, keep them safe!
Don't easily give away your name, email, phone, and address to any website.
Don't store credit card and other sensitive information on your computer. Sometimes, you have to store them on your computer. If so, don't save an Excel file with your credit card numbers as "credit card numbers.xls" and put it in a shared folder.
Your neighbor who was sharing your internet connection might be tempted. Playing with files will be of little help. You should encrypt your files with a password, too, if it stores sensitive information.
Overall, be mindful of protecting your personal data.
1990
When a Los Angeles area radio station announced a contest that awarded a Porsche 944S2 for the 102nd caller, Kevin Poulsen took control of the entire city's telephone network, ensured he is the 102nd caller, and took away the Porsche beauty. He was arrested later that year and sentenced to three years in prison. He is currently a senior editor at Wired News.
November 2002
Englishman Gary McKinnon was arrested in November 2002 following an accusation that he hacked into more than 90 US military computer systems in the UK. He is currently undergoing trial in a British court for a "fast-track extradition" to the US where he is a wanted man. The next hearing in the case is slated for today.
1995
Russian computer geek Vladimir Levin effected what can easily be called The Italian Job online - he was the first person to hack into a bank to extract money. Early 1995, he hacked into Citibank and robbed $10 million. Interpol arrested him in the UK in 1995, after he had transferred money to his accounts in the US, Finland, Holland, Germany and Israel.
1990
When a Los Angeles area radio station announced a contest that awarded a Porsche 944S2 for the 102nd caller, Kevin Poulsen took control of the entire city's telephone network, ensured he is the 102nd caller, and took away the Porsche beauty. He was arrested later that year and sentenced to three years in prison. He is currently a senior editor at Wired News.
1983
Kevin Poulsen again. A little-known incident when Poulsen, then just a student, hacked into Arpanet, the precursor to the Internet was hacked into. Arpanet was a global network of computers, and Poulsen took advantage of a loophole in its architecture to gain temporary control of the US-wide network.
1996
US hacker Timothy Lloyd planted six lines of malicious software code in the computer network of Omega Engineering which was a prime supplier of components for NASA and the US Navy. The code allowed a "logic bomb" to explode that deleted software running Omega's manufacturing operations. Omega lost $10 million due to the attack.
1988
Twenty-three-year-old Cornell University graduate Robert Morris unleashed the first Internet worm on to the world. Morris released 99 lines of code to the internet as an experiment, but realised that his program infected machines as it went along. Computers crashed across the US and elsewhere. He was arrested and sentenced in 1990.
1999
The Melissa virus was the first of its kind to wreak damage on a global scale. Written by David Smith (then 30), Melissa spread to more than 300 companies across the world completely destroying their computer networks. Damages reported amounted to nearly $400 million. Smith was arrested and sentenced to five years in prison.
2000
MafiaBoy, whose real identity has been kept under wraps because he is a minor, hacked into some of the largest sites in the world, including eBay, Amazon and Yahoo between February 6 and Valentine's Day in 2000. He gained access to 75 computers in 52 networks, and ordered a Denial of Service attack on them. He was arrested in 2000.
1993
They called themselves Masters of Deception, targeting US phone systems. The group hacked into the National Security Agency, AT&T, and Bank of America. It created a system that let them bypass long-distance phone call systems, and gain access to the pbx of major carriers.
The term phishing was coined because of the way that criminals try to gain access to personal information – basically, they cast out a bunch of bait in the form of fraudulent emails, and wait to see who bites. Spear phishing, however, is more targeted.
Just a fisherman would use a spear to target a single fish, spear phishing targets individuals. Whereas criminals might send a single, mass e-mail to a couple hundred thousand people in a phishing attack, spear phishing attacks are customized and sent to a single person at a time.
The spear phishing email usually contains personal information such as a name or some tidbit about employment. They are also unique emails, rather than being the mass “your bank account has been compromised,” type emails that are more common in phishing.
For example, one instance of spear phishing targeted corporate executives with personalized emails about a legal case in which the recipient of the message was allegedly being sued. It was a new scam, so it was easy for executives to assume that it was legitimate and click the link provided in the message. And that’s the point at which the spear pierces the target.
How It Works
A spear phishing email usually includes a link that leads to a spoofed, or fake, web site that requests personal information. It all looks very legitimate, and sometimes even the experts are fooled by spear phishing emails. When the recipient of the message clicks through the link they’re taken to a page on the Web that looks so legitimate it can be hard for even seasoned security professionals to tell it’s a setup.
Other spear phishing emails may contain a downloadable file. They’re just as convincing, often appearing to come from an employer or someone else that’s equally legitimate. But the file contains malware of some kind that, once downloaded to your computer, collects your personal information and transmits it to the criminal when you’re online.
Spear phishing is a difficult scam to catch because the criminals that use this method of stealing identities put extra time and effort into the process. It requires research to gain access to enough information to make you believe the spear phishing email is real, plus it takes time to put together the web sites and messages that are used as bait. The pay-off however, is usually much greater than the rewards of a simple phishing attack.
So, how do you protect yourself?
There’s no guarantee that you can protect yourself from a spear phishing attack. The criminals that use this method are intent on gaining access to your identity, and they’re willing to put in the hard work to reach pay-off. And that means that spear phishing emails are very difficult to tell from any other email that might land in your in-box.
There is good news. At this time, spear phishing attacks seem to be limited to corporate targets. Nearly all of the spear phishing complaints that have been investigated have come from corporate employees. That’s no reason to let your guard down, though.
As criminals become more adept at spear phishing attacks, their targeting will widen, and individuals will fall into the target zone. It would not be surprising, however, to find that spear phishing was limited to the upper class and the upper middle class. This group of people typically has more resources available, and that’s ultimately what spear phishers are looking for.
For a criminal to be willing to put forth the effort needed to successfully use a spear phishing campaign, the draw has to be big – far more than the $31,000 average for most identity theft cases. That means that if you don’t fall into that group of people who are in the upper and upper-middle class, your chances of becoming a victim are much smaller.
Of course, all of the standard cautions apply: never open attachments for stranger, never click through a link in an email, never assume that just because you know the address the email was sent from means it’s safe. In this day, with identity theft literally running rampant, criminals will use whatever email address they can gain access to.
Also never open an attachment, even from friends, colleagues, or co-workers unless you’re expecting it. An email with an attachment that arrives unexpectedly could certainly contain malware, even if it’s not spear phishing malware. Simply requesting that your friends and co-workers notify you before they send an attachment will reduce your risk of becoming an identity theft victim.
Don’t take any chances; if you receive a message or a phone call that seems out of place, scan it for viruses and keep a close watch on your credit reports. It will be frustrating in the beginning, but it will become a habit, just like locking your doors when you leave. And the damage to your identity that you can save over time will more than make up for the initial inconvenience.
Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website,
Today I stumbled upon a great website which check who is invisible in yahoo called Yinvisible.com:- is a fast or .With Yinvisible.com, you can detect whether a user is online, offline or invisible!You can do this all without the user knowing! Yinvisible.com allows you to keep track of what other Yahoo Messenger! users are doing,even if they are in Invisible or Stealth Mode. MORE HACKS: E-mail Hacking, Network hacking