Beware from Check in/geo tagging | Twitter | Foursquare | Flickr

I'm sure many people who know me personally or follow me on Twitter will be surprise to see Gaurav Thorat saying 'Beware from Check ins'! Well, I being a newbie product of Symbiosis's Information Security MBA happened to study a subject called, 'Vulnerability Analysis and Penetration Testing'. Sounds very techie isn't it? But frankly speaking this subject needs a lot of common sense along with good technical understanding of Networks and Information Systems.

Foursquare, as many of you must be knowing is a wonderful mobile application by which you can find near by places like hotels, malls, theaters and what not. It's like where ever you go, you just take out your phone and Check in to the place. Let's say I go to Esquare Multiplex in Pune to watch movie, so the moment I go there I'll take out my mobile. Open foursquare app, it'll find my current location with the help of GPS. It'll show me the nearby places along with Esquare Multiplex, I'll just Click on Equare and it'll notify my friends on Foursquare and Twitter/Facebook (if you have allowed foursquare and twitter/facebook integration). So whats the use of it? Well personally, I use Foursquare because It tells my friends about my where about. So if anybody is around me can just drop by for a quick meetup! Secondly, many a times merchants register with Foursquare and give away some really nice offers/discounts. So you check in to merchant's shop and you get discount on your shopping. More the check ins, you unlock Foursquare badges to flaunt within the community!

So whenever I used to Check in, it used to appear like this on twitter

As part of our VAPT subject's assignment we were told to search some security assessment tools and present it infront of students. I being more interested in Social Media, wanted to present a tool which is unique that no body else can think of! And just as I expected all the students choose hardcore technical tools like snort, sniffers and network analyzer. Nobody thought that something called as 'Social Engineering' should also be considered which is comparatively less technical but if used against the targets, can cause huge loss! I find people are still very ignorant about 'Social Engineering' which exploits the weakest link in security that is Human/User behavior.

Tool which I'm going to discuss over here is one, which can help hacker/cracker to perform passive type of Social Engineering attack which often seek to acquire seed information for further active social engineering or network-based attacks.
Active Social Engineering attacks are more of Direct kind which may involve direct interaction with target to obtain security relevant information, gain access privileges, persuade someone to commit a policy violation or act as a proxy on attacker’s behalf. While Passive as described earlier is more of Indirect type of attack which involves eavesdropping, observation and subsequent analysis of the results.
Tool which may allow an hacker/cracker in Passive Social Engineering attack is called Creepy Tool which is developed in python that allows you to gather geo location related information about users from social networking platforms and image hosting services.
Details
Website  : http://ilektrojohn.github.com/creepy/
Platforms  : Linux, Windows
License  : GPLv3
Author  : Yiannis Kakavas
Contact Email  : jkakavas@gmail.com

So what does application do?
If you Check in to Foursquare which redirects it to Twitter. Or if you take photos with geo tagging allowed in it, chipping in the data about where have you taken the pictures you are vulnerable for a passive Social Engineering attack with the help of Creepy tool.
Hacker/cracker all they need is your username on twitter/flickr and they can track you down. With the help of you check ins they can study the pattern/routine of your day like when do you leave from home to office, where is your home & office located. What do you generally do on weekends, which places to do you visit. Some people also supply information like what food/drink they love the most along with the Hotel's Check in. You may not realize that why would  somebody need and find this information important but let me remind you this why Social Engineering attacks are more risky and cause more damage than any other hacking attack because we are tend to be ignorant about Social Engineering attacks, most of us never worry about all these simple information.

So Creepy tool can integrate all these check in/ geo tagging related information at a one place, supplied with a map, google map! So hacker/cracker might not be knowing Pune city very well but with the help of Google maps within the Creepy tool can easily supply them with necessary information for a further strong Social Engineering attack.


If you see above image is Creepy's interface. I checked one user from flickr who has uploaded photos of Military aircrafts. All I did is put his username in Creepy and you can see where did he take that photo! This is passive social engineering, which a terrorist group may use for destructive and dangerous attack. I hope you are getting the seriousness and why I said Beware from Check ins and geo tagging.

Same is the case with Check ins which appear on Twitter, with all the aggregated information about your daily/weekend check ins hacker/cracker or any person with bad intention can plant more dangerous attack on you/your organization/home.

So how will you save yourself from such type of Passive Engineering attack?
1. Be aware, keep your eyes/ears open.
2. Common Sense
3. If not required disable Geo Tagging feature while you take photos from your smartphone/camera.
4. If you care then stop posting your Check ins on Twitter, you may want to continue using Foursquare but don't integrate it with Twitter.
 
That's all from me, I will be waiting to hear some comments from you!

Diwali Then & now!

One of the biggest festival which is celebrated all over India, right from Kashmir to Kanyakumari! The festival of light, crackers and last but not the least Sweets and namkeens. Hindu, muslim, Christan, Sikh each and every religion in India enjoy this wonderful festival!

I remember Diwali that I celebrated when I was a kid, I was more interested in cracker guns than crackers which makes noise. I always loved shopping cloths, right from my childhood and I still do! For me Diwali used to be about Holidays, lazy holidays. Lots of shopping - Cloths and Crackers. Meeting relatives, exchange of sweets/namkeens. And not to forget, our school used to give us homework that we had to complete before we step back into school.

Then School to College, transition! Interests/choices changed. Total cut off from crackers and mainly from relatives, spent most of the times with friends. Instead of mom's choice, I started buying branded clothes which were meant to flaunt nothing else :-) Unlike school, I never waited for holidays because I hardly cared about lectures. Every day in college was not less than a holiday itself!

Finally got to taste the real Life, when I started working! We used to get hardly 21 days holiday/year, damn it. Especially festival time, I hardly spent it with my friends/family. And no surprise, Diwali was not an exception :-)

Today, after working for almost two years I am back to study. But things have changed, while writing this blog post I'm thinking about the pending project that is opened one my desktop, book of IT Project Management opened right in front of me. Eating Diwali special sweets, listening to the noise that kids and crackers are making right out of the window. Thinking about somebody, dreaming about life :-)

So now what do I like about Diwali? Well shopping but now not just buying cloths but I also enjoy decorating the house (I mean I bring whatever I like, whatever mom/dad wants). I still love eating Diwali sweets/namkeen, but these days you get them in stores all the year so there's nothing called as 'Diwali Special'. I love going out early in the morning during Diwali time to Sarasbaug (Famous Garden) in Pune, India. Where people gather early in the morning, new cloths, fresh faces and fragrance. You get to meet many people, whom you might not have met in years! Everybody ignites diyas, click photos and then head to Vaishali/Vaadeshwar/Rupali for a special breakfast :-)

Wishing you and your family a prosperous Diwali!

Innovative Ideators, platform for B-School students to showcase their Talent!

When I first saw an email stating 'Need Campus Ambassador for Innovative Ideators' in my college's newly created email inbox, I was excited to know what the heck is this 'Innovative Ideators'?

Frankly I always look forward in participating for branding/marketing activities so whenever I see an opportunity to become Campus Ambassador, I jump into it. But this time it was different unlike my previous experience with Microsoft and Naukri.com. 'Innovative Ideators' is not about any product /service but a team of wonderful individuals who have created a platform for B-School students to participate in  management related competitions. Best thing about it is, it's not a one time competition but series of competitions all over the year!

'Innovative Ideators' help students to showcase their talent and at the same time provide amazing and fresh ideas to Corporate Houses. How? Let me give you the idea!
'Innovative Ideators' use a funda called 'Crowdsourcing' well not quite similar to outsourcing but they are similar in some aspects. Consider a Company, 'NeGa Technology' a pune based IT startup who wants to emerge as a Product Based company in near future but they lack in idea generation. They are clueless as in what product they should develop which will help to earn them reputation and revenue! Even being a start up they had angel investors who had faith in the founders, a team of three IT Professionals. So 'NeGa Technology' hired some creative heads to help the founders in developing that 'Unique' product. They launched a website which gives daily information of 'Events happening today in Colleges around Pune'. The website got huge success, NeGa Technology earned reputation as well as revenue but founders were still not satisfied. As they could target only college crowd, they needed something BIG from teenagers to oldies!
One of the founder read an article about 'Crowdsourcing', a new trend in Business World'. They found a money saving way to generate idea for their 'Unique' product!

So the very next day they gave an advertisement in Daily newspaper saying 'Do you have an 'e'-idea but unable to implement it? We'll show you the way! Mail/Call us NOW!'
From very next day, NeGa Technology received hundreds of emails and phone calls. Within a week they had 300 ideas out of which they shortlisted 80 which were unique! All of this with almost no or little money, the only cost was 'Advertisement in Daily'. They finally decided to merge five ideas into one and designed an innovative e-commerce portal. They offered some share of revenue earned in first year with the people whose ideas were used. While rest of the ideas were not scrapped but NeGa Technology informed other start ups that they have some ideas which can be implemented and shared the same to new start ups asking them to give some profit share to the idea generator if his/her idea is implemented. Win - Win situation isn't it?

Now how does 'Innovative Ideators' fit in this example? Well they arrange competitions which are based on the 'Live Case Study' or simply problems faced by the Corporate Houses for which they need help from a common man/consumer/crowd. In 'Innovative Ideators' case the ideas will be generated from talented and creative minds of students studying in prominent B-Schools! If the idea gets selected there are BIG Prizes and wonderful career opportunities that will be offered by the partner companies!

So why to think, just reach out to your 'Innovative Ideators' Campus Ambassador and get the more clear idea about the competitions!
 

How to Set Microsoft Outlook (For SCIT Students)

What do you do when you need urgent access to your old emails and you don't have Internet Connectivity?
Don't you get bored seeing the same Google Email Inbox everyday?

Switch to the Best Email Management Application by Microsoft! It not just manages the email but help you to organize your work. Setting reminders, manage your events/Project Submission deadlines/assignment deadlines with the help of Calender! Don't worry about missing an important email - you get a instant pop up if you get any email! Beautiful integration with other Office applications will actually make your life better :-)

Following are the steps to configure your Outlook with 'associates ID'/ Gmail ID.

1. Open Microsoft Outlook 07/10. You'll see 'Add New Account' Wizard, Select 'Manually configure server settings or additional server types' Click on Next.

2. Select 'Internet E-mail' and Click on Next

3. Fill required details as given below.Tick appropriate option shown it the image.

4. Click on More Settings, do not click on Next! You should see a new Window 'Internet Email Settings',Click on tab - 'Outgoing Server'. Put appropriate tick 

5. Click on Tab - Advanced. Ensure you put only what is shown in image below. Do not tick 'Remove from Server after ---- days' you may loose all your emails, I did it once :-(

 6. Click on Ok, you'll see 'Internet E-mail Settings' Window. Click on Next and you are done!

Congrats you setup your own outlook account, successfully!

Let me know if any issue :-)

Custom Made Laptop - unReal, why?

I always need customized 'things' in my Life let it be food, bikes even I chose my MBA course which is customizable! The only thing that eats my head every time is, Why can't we have 'Complete' Custom Made Laptops? Don't tell me that you consider Dell Online Store, A place for customizable laptop. I hate Dell, because they do not allow you to customize everything in 'your' Laptop!
Consider a 'Subway Melt' sub prepared at Subway outlets, you can customize it right from bread, veggies, sauces anything and everything in the sub.Why can't we have it in Laptops?

My Idea about Laptop Customization -
It should start from Laptop's outer body - some people like Laptops to be slim like MacBook Air while some likes it Sturdy like Lenovo Thinkpad.
Another best part is keypad - i prefer a keypad with num keys/pad on right side just like the keyboards that we use for PCs.
Most importantly battery - I have a Gateway ID58 Laptop, it earlier had 6 Cell battery but now as I make heavy use of my Laptop I wanted to go for 9 Cell battery. I asked Acer's Vendor (after sales in India for Gateway) but he said my Laptop doesn't support it.
I have seen some of my female friends who rejected some nice Laptops just because they didn't like the color of the panel, too much huh? But I would say, yes they can demand for it and they should!

Why don't we have a Laptop Vendor who can help us in getting an assembled laptop just like we have it for PCs? I understand it's not easy for a Supply Chain to establish in order to procure different things for a single laptop which can vary a lot from one order to second. But if you see the idea has a lot of potential in it. People would definitely buy a 'Custom' made Laptop which may be or mostly will be 'Heavy on Pocket', but they will buy it, just because they get exactly what they want!

I agree it wouldn't be possible for a Vendor like Dell to allow people choose whatever they want and make their laptop ready for use. But entrepreneurs they can definitely think over it, as I really feel that this unnoticed area can really get you 'Real Money'! And the idea - first of it's kind :-)

Do Let me know your views and opinions about my idea! 

Play Safe with Disgruntled Employees

'Information Security' this word has got a lot of power in it! In my MBA Curriculum (Information Security) at Symbiosis Institute, I often heard terminologies like Threats, Risks, Vulnerabilities and many more.

One of the Threat, i would say the most interesting one is - Disgruntled Employees. The reason i call it as interesting because I wonder how can one predict the intention of a Disgruntled Employee. Definitely it could be a risk for an organization but how can you control them? Just by disabling their access rights and controls? Do you think this would be enough?

Disabling/Revoking the access rights of a Disgruntled Employee can be one of the control measure but according to me the most critical and beyond an organization's control is something different - The Knowledge/insights learn by a Disgruntled Employee during his tenure at the organization. 

Let me take an example: Ajay, a recent college graduate from a Well Known Technical Institute joined Fysat Technology Ltd. a small scale (50-80 employees) IT company into Services. Ajay was interested into Java Development, he also had sound knowledge of Java. But like every other IT Company, he was put into a Support project. Ajay was disheartened but he took interest and started learning things, he was a quick learner so soon he became one of the best knowledgeable resource of his team. But some senior members of the team couldn't digest the fact, they started troubling the newbie. The poor soul couldn't fight back and he fall prey to dirty office politics. 
Time came when the Management announced Yearly Increment, Ajay received least increment, hardly 2%. Reason - His performance was degraded very much, due to some dirty tricks of his seniors Clients escalated many issues about Ajay to Fysat's Management.
Ajay got frustrated within a year though he had good knowledge and technical insights about the work but he couldn't understand and handle managerial things which comes by Experience. 
Finally the day came, one fine morning Ajay put his resignation to his manager. Unaware of the facts manager simply accepted it as he thought Ajay is not worthy resource as he was portrayed by his Seniors to the manager. Even his exit interview was not done properly as the HR felt that this a case of inefficient resource getting kicked out of the company.
Ajay was disheartened, frustrated and angry. But his talent and knowledge that he had gain while working at Fysat helped him to get a decent job at Fysat's competitor Eryat IT Solutions.
Eryat is working into same market where Fysat is operating - South East Asia. Eryat is a market leader but since last few months due to a product launched by Fysat, Eryat was feeling the heat. Fortunately for Eryat, Ajay was the guy who worked extensively in supporting the product for some Big Clients of Fysat.

Now what do you think, by just disabling Ajay's accesses on Client Servers/DBs Fysat will get rid of their 'Disgruntled Employee' ? Can Ajay's knowledge and anger about Fysat help Eryat to beat Fysat?

I feel it's responsibility of Ajay's Manager at Fysat to understand the issues faced by Ajay instead of relying on opinions/view given by senior members of Ajay's team. At least HR should had identified the problems faced by the trainee and if possible change his mind to retain him. But as the person was just a year old at Fysat, HR didn't bother about it.
(I have seen IT industry not much but at least for two years such things happen at many of the IT Companies all over the globe)

For Eryat, Ajay might not prove to be the expert to beat Fysat's special product but his knowledge will definitely be used by Eryat to develop something better than Fysat, something which lacks in Fysat's product.

Disgruntled Employee can potentially impact a lot on the companies, I feel there has to be done something more than just worrying about the Access Control of the Disgruntled Employees. 
What do you think should be done to prevent such losses which may impact organizations terribly!  Do comment to respond :-)

[NOTE: Company names and character name in the above post is fictitious.]

Learning Phases

I remember when my dad used to tell me, how his friend's son can mug up everything, remembers everything and off course better than me! Since my childhood I'm fan of selective learning ;-) I used to hate to mug up the things but thanks to our Traditional Indian Education System which teaches us - more the marks, better you are! I always used to like practical things - science, never got attracted towards mathematics because I never met a teacher who could taught me why the hell do i need to learn it, how I will be able to use it in my life.I used to hate mathematics because it was more of a mechanical thing for me - you remember the formula fill in the values and get the answer.I never liked it and I still don't like it, thanks to my Statistics Professor at B-School - he make sure only people who 'know' statistics only those will be able to learn the subject which he teaches, rest of us - we just look at the whiteboard!

When I was in Higher Secondary School, I used to love Biology, IT and Chemistry. I used to hate physics too, because it belongs to the same family that of Mathematics! Biology because I used to actually see the things (Botany+Zoology), understand them and used to relate them with day to day life. IT because I used to write HTML, VB code and get something meaningful. Chemistry because I used to enjoy the Lab practicals of mixing different things in each other and get something out of it, it was fun! :)

Somehow I couldn't go for medical studies as I performed worst in my Higher Secondary School Exams.Then came the 'Actual' College life - Graduation period.I had decided that I will either dissect human bodies by doing medical studies or I would go for computer studies, and finally I choose computers rather I had to choose Computers :)

In my graduation, I realized that apart from technology I am good at interacting with people. Thanks to Microsoft Student Partner Program that I got the opportunity to mix both People + Technology and I started evangelize Microsoft's Technologies within students communities. Got appreciation from many people, it boosted my confidence. In my graduation college I never had to explicitly study because I choose something which I loved to do - playing with Technology.

Then came the professional life, where in I explored myself more! I knew that I'll enjoy working in IT industry but I wanted to be on the business side - where in I can gel up with business yet work on technical aspects of it.After spending two years in amdocs, I choose to join the Business Administration program with specialization in IT Business Management.This was the phase when I realized that I actually want to Learn something, not for the sake of earning money but for a better life, new goals and completely new responsibilities!

I feel the change in myself, I was completely different earlier - relaxed, care free (not careless!), had limited aspirations and short term goals. But then came a phase where I realized that I need something bigger and better, I need to attain new professional and personal heights! In my MBA I won't and I don't study for getting good grades, I'm studying for understanding things in different aspects. I'm more focused about learning than grading. I still enjoy subjects like Information Security, ERP than Statistics & Accounts ;) I want to be a Techno managerial IT Professional and not a manager who will sit in his Air Conditioned cabin playing with excels. I want to be a manager who will understand how it works at grass root level than worrying about how to climb the professional ladder fast!

I feel good that I can think about all these things at the age of 23 and I'm sure at the end of two years - once I'm done with my MBA, I'll be completely new person with quality knowledge & new ideas, innovations to implement in the IT industry!

At this moment, I'm clueless of what I have written because I scribbled whatever was there on my mind :)