By opening ports from the Internet to your raspberry pi (ssh, http, ftp, https etc.), you are automatically becoming a victim of many hacker’s attempts. Hackers are seeking exploits and trying to get access to your server. To protect you against such attacks, there is a tool called Fail2Ban. It supports a lot of services (sshd, apache, qmail, proftpd etc.) and can be integrated directly with your IPTables. By this tutorial, we will guide you via the whole process of how to protect against such attacks.   

Who is trying to access my raspberry pi?

If you think that your raspberry pi is safe and you do not need any tool to be installed, please check the content of the following file:

cat /var/log/auth.log | grep 'Failed'

As you can observe above, there are many password failures. Usually, the hacker bots are seeking exploits.  Each attempt consumes resources as your raspberry pi needs to evaluate each request. It is known as DoS attack. 

Hackers can try also a brute-force attack.  Such an attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing a combination correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found. 

What is Fail2Ban and how does it work?

Fail2Ban is a daemon that scans access log files and it bans IP addresses that show malicious signs. It protects you against too many password failures as shown above. 

It is a must have tool to protect your from intruders to your server or network especially if you allow outside SSH traffic or any traffics from an outside network to your Raspberry Pi. Fail2Ban tool supports many different services (sshd, apache, qmail, proftpd, sasl, asterisk, etc) and can be integrated with your IPTables.

Installation of Fail2Ban is very easy to install and basic setup will drastically improve security on your Raspberry Pi. Fail2Ban works by checking your access logs for failures and depending on the settings you setup, it will ban or timeout an IP Address for a certain amount of time. Fail2Ban tool can easily protect your raspberry pi against very known brute-force and DoS attacks.

How can I protect myself?

Very easy, by installing of Fail2Ban on your raspberry pi. We will first install Fail2Ban by typing the following commands:

sudo apt-get update
sudo apt-get install fail2ban

By doing that, you have Fail2Ban already installed. The configuration file is located at ‘/etc/fail2ban/jail.local’. If you want to change some parameters, you can simply modify this file and restart the service to take immediate effect.

Let’s edit our SSH Fail2Ban configurations. Open up the ‘/etc/fail2ban/jail.local’ file with the following command:

sudo nano /etc/fail2ban/jail.local

Your jail.local file should already contain some pre-defined config. We will need to tweak it a little bit. Find a section in the file called [sshd] and paste/modify accordingly:

[sshd]

enabled = true
filter = sshd
port = ssh
logpath = /var/log/auth.log
bantime = 86400
banaction = iptables-allports
findtime = 900
maxretry = 3
backend = %(sshd_backend)s

sudo service fail2ban restart

sudo fail2ban-client set sshd unbanip <IP-YOU-WANT-TO-UNBAN>

sudo iptables -L -n --line

The post How to install Fail2Ban on the Raspberry Pi/Unix server appeared first on ITBlogSec.com.

The oldest, biggest, sturdiest cryptocurrency still rules over the crypto world however even the digital giant felt something when the Covid-19 pandemic began in March 2020. Charts swayed and some of the biggest Bitcoin enthusiasts were filled with doubt but don’t fear, Bitcoin is well.

For those of you who are considered experts in the Bitcoin community and everyone following Bitcoin’s price fluctuations for the sake of your own coin’s future, you probably already know at least some of the information pictured below. To get a better grasp of what was going on with Bitcoin during the pandemic and where Bitcoin is now, see the following infographic: Bitcoin vs. Covid-19 – Bitcoin’s journey through the Covid-19 pandemic.

Bitcoin vs Covid 19

The post Bitcoin’s journey through the Covid-19 pandemic appeared first on ITBlogSec.com.

Enjoy and stay tuned for the next episodes  

What you can learn 

If you want to start with hacking, first you need to have some hacking tools available. The best option for that purpose is using Kali Linux what is linux distribution specially designed to be used for hacking activities. As the part of our hacking tutorials for beginners, we are starting with the #1 where you can find exact steps how to install Kali linux on MacOS using Parallels Desktop or Virtual Box. Of course, you can use any virtualization platform you want, even there is ARM Kali Linux image available for rapsbperry PI, you can download it here. 

1: Download kali linux image

– use official webpage https://www.kali.org/downloads/

2: Import Kali linux image

– here is example by using Parallels Desktop – choose Debian GNI/Linux (the same applicable for for Virtual Box)

3: Choose name and location 

4: Select type of installation (Graphical install)

5: Select language for installation

6: Wait for installation 

7: Type hostname of your Kali linux system

8: Type domain name

– if you do not use domain, just leave it blank

9: Set-up user and password

– (always use strong password)

10: Select your time-zone 

11: Partition and format your virtual disk

– please select: Guided – use entire disk

12: Select software you want to install

– of course later you can install any kind of software you want

13: Install GRUB boot loader

14: Wait for installation to be finished

15: Congratulations! We are done.

– Now your Kali linux system is ready to be used for your hacking practice 

Conclusion

At this point, you have the system which is ready to learn new hacking practice by yourself. In our next tutorials, we will try to bring you step-by-step guides how to learn ethical hacking practices. Stay tuned, like us on facebook and soon there will second part of Hacking for Beginners available. 

The post Hacking for beginners #1 – Install the Kali Linux appeared first on ITBlogSec.com.

The common mindset when it comes to considering a website’s success is that owners need only worry about the type of content they want to publish. However, times have changed drastically, and so have consumers. There are now several factors that determine the success of a website. One of those is website speed.

Website speed is essentially the time in which an entire page loads after being clicked. At this age, when internet speeds are reaching new heights, consumers won’t accept websites that take more than a few seconds to load. For image or media-heavy websites, increasing movement speed is a hard task. However, with a few simple tips, load times can be reduced dramatically.

Please check also a very interesting article Web server performance benchmark for free.

Avoid Auto-Play Videos

Auto-play videos are despised by people for two reasons. The first is that it’s annoying to have a video pop up when you open a page. Another reason is that these videos hinder page loading time, as it takes a lot of resources and bandwidth to start the video. While Google and Apple cracked down on such videos last year, they are still present on some websites.

It’s best to avoid adding auto-play videos to satisfy the visitors of a website and to keep the website’s performance in top condition all at once. It’s best to give the visitors the option of watching a video instead of forcing them to watch it immediately.

Use Appropriately Sized Images

What most new website owners don’t know is that each website has its own proper dimensions for an image. For instance, there are some websites that use 900x1800px images whereas their website can only handle 300×600 images. This forces the website to load more than it can handle, thus greatly affecting the speed.

The right way to change the dimensions of an image is through the server-side of the website. Once done, those changes will be applied directly on the front-end. Understandably, some images may suffer from the smaller dimensions but visitors will prefer a lighting speed website over one with large images.

Use the Right Image Format

The most common image formats online are JPG and PNG. However, most web developers now prefer the new WebP format as it takes the best out of both JPG and PNG.

In terms of compatibility, WebP is available for Chrome and Opera users, but it isn’t technically a universal format yet. Compared to PNG, WebP offers 26% smaller file sizes without sacrificing quality. Compared to JPG, it offers 25-35% smaller file sizes on the same image quality. That means WebP images will load faster than both of these formats every time.

Optimize for Mobile

A lot of web developers also forget to optimize their website for mobile platforms. Whenever a user visits a website that’s not optimized for mobile devices, that page will begin loading a desktop version which will take more time to load.

Most web development platforms now have a feature that automatically optimizes a website for mobile use. These are great, as it takes a considerable amount of time to create a mobile version of a website. When mobile optimization happens, images are reduced drastically to accommodate the smaller screens of smartphones.

Pick the Right Media

In most cases, web developers have to make sacrifices regarding content. One of the sure ways to reduce loading speed is to simply reduce the amount of content that needs to load in a website. Website owners should carefully sift through their images and videos to see which ones aren’t exactly needed and could be removed to make way for loading speed.

It’s also important to browse through the website to see if there are any images or videos that load several times on one page. Each piece of unnecessary media removed results in better loading times even if it’s just a fraction of a second.

These tips combined will radically improve the loading speed of a website.

But why is it important?

According to recent statistics, people leave websites that take over three seconds to load. This basically means that a website loses profit if it continues to perform slowly. This is just one figure that dictates the importance of website speed. These statistics show the eye-opening figures regarding how speed affects a website’s overall performance.

Please check also interesting article: 10 of the best plugins to keep your WordPress site safe.

source: https://hostingtribunal.com/

The post Improving the Website Speed of a Media-Heavy Website appeared first on ITBlogSec.com.

Speed is essential. There is no denying that a quick, nimble web page trumps a slow site. Both users and search engines know that. Website load time statistics from numerous studies clearly show that if the average page load time exceeds 3 seconds, the abandonment rates soar. High bounce rates telegraph to search engines that visitors don’t find the website useful, which affects the ranking directly.

The most remarkable 1-second stats:

• 1 second delay reduces page views by 11%
• 1 second delay decreases customer satisfaction by 16%
• 1 second delay eats away 7% of the coveted conversion rate
• On annual basis, 1 second delay can lead to $2.5 million in missed revenue if your shop generates $100,000 per day

What Is a Good Page Load Speed?

Quick pages are the standard. 2-3 seconds load time is tolerable, anything beyond the fourth already compromises the end user experience. Like it or not, a whopping 79% of online shoppers state that any performance hiccup will make them stay away from an online store. Worse yet, 44% would share the negative impression with friends online. As is the case with so many other things, the Hitchhiker’s Guide to the Galaxy is spot on about the velocity of bad news.

The post 20+ Website Load Time Statistics [Infographic – How Speed Affects Your Website] appeared first on ITBlogSec.com.

When you are working in a hybrid environment where both on-premises Exchange Server and Office 365 are available, then it becomes beneficial for the Exchange Administrator to migrate some user mailboxes to Office 365 from Exchange Server because it provides much flexibility to access mailboxes from anywhere.

Now there are two methods which you can employ for the migration. First one is using the Exchange Admin Center where you create the migration endpoint and perform the batch migration. The second method is using the Exchange PowerShell command (using the MoveRequest) to migrate the batches mailboxes.

To get the complete information regarding the migration, we will go through the migration process using Exchange Management Shell commands.

Complete process:

1. First, start the Exchange Management Shell.
2. Run the command:
   Set-ExecutionPolicy Unrestricted

The command will allow you to run each kind of script even if it is digitally signed or not. It will ask you to make a choice, click Y.

3. Now, run the next command:
   $livecred = Get-Credential

The command opens a login console where you need to input the Exchange Online credentials of the Administrator account to the $livecred variable.

4. Run the next command:
   $s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection

The command first asks you to input the Administrator credentials, and then input the credential to create a new session.

5. Run the next command:
   $importresults= Import-PSSession $s

The command will import the session to the respective variable. The process will take some seconds to complete. Just wait for a little and let it complete.

6. When you have created a session with the Exchange Online, you can start the move request:
   New-MoveRequest -Identity “Tony” -Remote -RemoteHostName “localmailserver.mydomain.com” -TargetDeliveryDomain mydomain.mail.onmicrosoft.com -RemoteCredential $importresults

7. Monitor the move request using the following command:
   Get-MoveRequest | Get-MoveRequestStatistics  

The command will bring the details of the ongoing move request.

8. After completing the migration from Exchange to Office 365, you can remove the move request:
   Get-MoveRequest | Remove-MoveRequest  

Important parameters:

The MoveRequest command uses multiple parameters which are useful for different move request between a variety of source and destinations. Some of them are present below:

AllowLargeItems
It will allow you to mention the larger mailbox items than the target mailbox limit. You do not need to input value while using the parameter, and the data will be copied with any loss. The parameter is available only in on-premises Exchange Server.

ArchiveOnly
This parameter specifies that the user is moving only the archive folder associated with the mailbox.

BadItemLimit
It is an important parameter when the size of the mailbox or database is quite large; then there are chances that some items not suitable for migration. It specifies the total number of bad items before the move request fails. Missing or deleted items from the source mailbox are also counted as bad items and considered as not suitable for the migration.

CompletedRequestAgeLimit
The parameter notifies the total number of days after which the move request will get deleted automatically. The default limit is 30 days, and you can change it depending on your requirement.

Identity
Identity parameter specifies the name of the mailbox or user. Here, you can use Alias, SMTP address, Distinguished Name, User Principal Name (UPN).

PrimaryOnly
The PrimaryOnly parameter denotes that the move request migrates only the primary mailbox excluding the personal archive. Use this parameter only when there is a personal archive that need not be migrated.

Conclusion

Microsoft provides all the necessary methods to perform a secure Office 365 migration. But the complexity of these methods makes the job of Office 365 Administrator quite tough. But Kernel Migrator for Office 365 saves you from all these difficulties. As its name mentions, Kernel Migrator for Office 365 is migration software for the Office 365 mailboxes, and public folders. It supports every plan of Office 365. You can perform a migration from Exchange to Office 365 or vice e versa. It provides suitable filters and scheduling options to run the migration under your control and provides a clean migration report after the migration.

The post Office 365 Migration Using New – MoveRequest cmdlets appeared first on ITBlogSec.com.

Cybersecurity will be a hot topic for as long as we are using computers and the internet. With the massive expansion of IoT devices, mobile, and technology in general, we can only expect to see this industry growing in the years to come to keep us safe from online thefts and data breaches.

Let’s review some of the most common types of cyber attacks. You’ll be surprised when you see the stats and learn that this issue is much more serious than you probably thought.

A Glance at the Statistics

Botnets
Robot networks or botnets are groups of computers acting much like an army with the aim of attacking one specific computer or groups of computers.

Think in terms of the inverse proportion examples you saw in school. If you have one hacker trying to target a network, it may take her a year or more. If you have hundreds of computers sending multiple attacks, it will take much less time. Experts from TechJury contend that botnet use rose to 34% in Q1 of 2018.

Facebook Attacks
If you use social media, then the chances are you use Facebook. By Q4 of 2018 alone, it had around 2.32 billion users. The sheer number of users is a huge call for online hackers. In September 2018, about 50,000,000 accounts were affected by an attack.

Financial Statistics
Estimates peg the cost of malware and phishing attacks as well as virus attacks on households at about $4.55. That is more than the GDP of a number of small countries.

Although that is a lot of money, the amount shouldn’t be too surprising because some of that cost comes from charges you only catch after a transaction. In a survey conducted in 2016, three years ago, 48% of participants actually responded that they had seen charges on their bank accounts that they weren’t privy to.

In the first half of 2018 alone, it is estimated that 15% of the attacks were to gain financial access be it through a virus, malware, ransomware and so on and so forth. Just take a look at the infographic below that reveals some pretty startling statistics.

What’s Next?
An integral part in solving any type of problem is knowing the root cause of the issue because that allows us to set up actions to combat the problem at hand. That is the absolute basic starting point of problem-solving.

What the statistics show are the areas where we are most vulnerable or have become more vulnerable. For example, the 33% increase in mobile ransomware in 2018 tells us that mobile attacks are definitely an area we need to continue to look at.

Overall diligence, an understanding of vulnerability and continuing to search for better security protocols are strategies that look to be necessary for the long haul.

cybersecurity 2019

The post The Cyber Security Periscope at a Glance 2019 (INFOGRAPHIC) appeared first on ITBlogSec.com.

source: https://bitcoinfy.net/

The post Facts About Crypto Mining and Transactions Easily Explained 2019 (INFOGRAPHIC) appeared first on ITBlogSec.com.

Netflix is one of the best resources for entertaining content today, as it offers a subscription to one of the largest libraries of movies and series. Everybody wants to watch Netflix, everybody wants to get the newest and the best content and enjoy their winter evenings with the favorite series characters. However, not everything is so simple. 

Netflix offers their services in a range of countries, and citizens of both Europe, America, and other places enjoy this resource. But the company has contracts with the relevant authorities in each country, and promotes only certain content to users. In other words, in addition to some universal content available via Netflix, the users are offered specific movies and series created by the country they are located in. It means that users from other states cannot watch a local series sometimes, or local users cannot watch a series of a different state. For these cases, VPN for Netflix is a solution.

Netflix is a cool resource, but the limitation it puts on content by the geographical principle makes many users mad. To manage this problem, you can find more info on what software is the best to unlock Netflix for you. Since the world becomes more globalized, it is weird that an entertainment resource limits access from different countries to local content. Therefore, to enjoy Netflix to its fullest, download and use VPN solution. 

When you travel abroad and one evening decide to have a good time with a glass of wine and new episode of your favorite series that you have waited for a whole week, even a more stupid situation can occur. Since you are not in your home country, your Netflix subscription may not work the way to expected, and you cannot reach the local content of your home country from a different country! So, your evening is spoiled and you end up watching something random on YouTube. To avoid such fails, check Bestvpnrating.com for software that suits you, and enjoy your Netflix wherever you travel. 

source: https://latesthackingnews.com

The post Watch Netflix content from wherever appeared first on ITBlogSec.com.

As people are leaning more and more towards the digital world, cybercrime is becoming an issue that cannot be ignored. Although many individuals and businesses are doing all they can to prevent such attacks, a big risk of them still persists. There are various types of attacks that could occur and for many reasons, but one thing is certain – you don’t want to be the victim of cybercrime.

The more creative cyber criminals get – the more resources are spent on cyber security. It is estimated that, by 2020, around $101.6 billion will be spent on cybersecurity software, services and, hardware.

In case you run a small or middle-sized business – the most common recommendations are:

1. Organize cyber security awareness trainings for employees.
2. Keep computer and operating system software up-to-date.
3. Use spam filtering for your mail accounts.
4. Create backups of your data.
5. Limit access to corporate information.
6. Organize cyber security awareness trainings for employees

source: https://www.everycloudtech.com/awesome-cyber-security-facts

The post Awesome cyber security facts 2018 (INFOGRAPHIC) appeared first on ITBlogSec.com.