Is your website protected: a quick study to know “unknown doors to your websites?” By Navneet Vishwas & Team

Journal Name : INTERNATIONAL JOURNAL FOR RESEARCH IN APPLIED SCIENCE AND ENGINEERING TECHNOLOGY (IJRASET)
ISSN : 2321-9653
Vol. 2 Issue II, February 2014
By Navneet Kumar Vishwas

Abstract: Website and its related technology started to play a vital role in our life. Infect it has become most important representative of business and provide significant improvements in business operations, banking system, education system, communication system and in the entire human life. Websites has not only brought the world closer together, but it has allowed the world's to access any part of the world in easiest way. It’s provide a smooth and easiest platform through which our prospective client or customer also interacts with our business and huge number of sales happen through this only. But good and bad things always fly together. Same is with websites also. Developers always try to develop best websites and hackers try to destroy it or damage vital information. So, there is a need of extraordinary attention towards protection of websites, especially if we are transferring vital information through it. There is lot of loopholes or we can say that unknown doors by which hackers try to enter in websites and try to damage it. Such as SQL injection, cross site scripting, session management, click jacking, dns caching, symbolic linking etc. So, through this article we want to describe some loopholes by which hackers try to enter in any websites or hacked it. Hence we suggest all website owner to take almost care for making their website as secured as possible. Always tries to secure your database, validate all inputs, encrypt all user name and passwords, end sessions properly and close all possible doors to keep hackers out. 

Keywords: website protection, website safety, is your website protected, hacker’s tools, website hacking technique.

I. INTRODUCTION

Website and its related technology started to play a vital role in our life and became most important thing. Infect it has become most important representative of business and provide significant improvements in business operations, banking system, education system, communication system and in the entire human life.

If we talking about globalization, websites has not only brought the world closer together, but it has allowed the world's to access any part of the world in easiest way. It brings down the barriers of linguistic and geographic boundaries. But most common things are that for all purpose we have needs an online medium which is being possible through websites and its related technology. Suppose if we want socially connected with globe then we have to use social websites as a platform, if we want to try any banking or financial works then respective websites help us. That means from music to rocket science, from banking to knowledge gathering in online medium we are dependent to websites. It’s provide a smooth and easiest platform through which our prospective client or customer also interacts with our business and huge number of sales happen through this only. 

As we know there are always two side of a coin. Same is with websites also. Developers always try to develop best websites and hackers try to destroy it. Nowadays websites are at top priority of hackers list who try to steal or damage vital information. So, there is a need of extraordinary attention towards protection of websites, especially if we are transferring vital information through it. Hence websites must be protected in best possible manner.

II. OBJECTIVE

Through this topic (i.e. “Is your website protected: a quick study to know “unknown doors to your websites”) we try to focus on loopholes of websites and online communication medium which affected by the hacker and crackers. We also summaries some tools by which online website crimes can be taken and some safety jacket to save your websites in effective manner.   

III. UNKNOWN DOORS TO YOUR WEBSITES WHICH AFFECTED IN MANY WAYS

Websites are the platform of online medium and backbone of online business, knowledge and communication. So, it must be protected through below mention threads.[1]

1.  SQL Injection Attacks
2. Cross Site Scripting Attacks
3. Man-in-the-middle attack
4. Broken Authentication and Session Management Attacks
5. Click jacking Attacks
6. DNS Cache Poisoning
7. Social Engineering Attacks
8. Symlinking – An Insider Attack
9. Cross Site Request Forgery Attacks
10. Remote Code Execution Attacks
11. DDoS Attack – Distributed Denial Of Service Attack

SQL Injection Attacks

Generally, this attack occur when there are flaws in website SQL Database, its libraries, or even the operating system itself. Attackers inject some hidden query through webpage’s or websites loopholes. Users open such files with hidden query unknowingly and fill there details, credit card numbers, private information etc. In doing so, they have allowed hackers to gain unauthorized access to private data.

Fig.1- SQL Injection Attacks [2]

Technical Injection Attack Example:

An Injection Attack could have this command line:

String query = “SELECT * FROM accounts WHERE custID=’” + request.getParameter(“id”) +”‘”;The hacker modifies the ‘id’ parameter in their browser to send: ‘ or ’1′=’1. This changes the meaning of the query to return all the records from the accounts database to the hacker, instead of only the intended customers.

Cross Site Scripting Attacks

These attacks have become the most prevalent and dangerous security issue affecting web applications. XSS vulnerabilities occur whenever an application takes data that originated from a user and sends it to a web browser without first properly validating or encoding it. XSS attacks can be used to hijack user sessions, deface websites, conduct port scans on victims’ internal networks, conduct phishing attacks, and take over users’ browsers.[3]

For example, if www.ebank.com/info.html has XSS script in it, the user might see a popup window asking for their credit card and other sensitive info.

Technical Cross Site Scripting Example:

(String) page += “<input name=’creditcard’ type=’TEXT’ value=’” + request.getParameter(“CC”) + “‘>”;

The attacker modifies the ‘CC’ parameter in their browser to:

‘><script>document.location=’http://www.attacker.com/cgi-bin/cookie.cgi?foo=’+document.cookie</script>’

This causes the user’s session ID to be sent to the attacker’s website, allowing the hacker to hijack the user’s current session. That means the hacker has access to the website admin credentials and can take complete control over it.[4]

Fig.2- Basic Description of stored XSS attack to steal cookies [5]

Man-in-the-middle attack

This attack intercepts a communication between two systems. For example, in an http transaction the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server, as shown in below figure.

Once the TCP connection is intercepted, the attacker acts as a proxy, being able to read, insert and modify the data in the intercepted communication.

Fig.3- Illustration of man-in-the-middle attack [6]

Broken Authentication and Session Management Attacks

Authentication systems involve passwords, key management, session IDs, and cookies that can allow a hacker to access your account from any computer (as long as they are valid). So, if authentication system and session management is weak then hackers definitely take advantage of this.

For Example

Scenario #1: Airline reservations application supports URL rewriting, putting session IDs in the URL:

An authenticated user of the site wants to let his friends know about the sale. He e-mails the above link without knowing he is also giving away his session ID. When his friends use the link they will use his session and credit card.

Scenario #2: Application’s timeouts aren’t set properly. User uses a public computer to access site. Instead of selecting “logout” the user simply closes the browser tab and walks away. Attacker uses the same browser an hour later, and that browser is still authenticated.

Scenario #3: Insider or external attacker gains access to the system’s password database. User passwords are not properly hashed, exposing every user’s password to the attacker.[7]

Click jacking Attacks

It is also known as (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages. It is a browser security issue that is a vulnerability across a variety of browsers and platforms. A clickjack takes the form of embedded code or a script that can execute without the user's knowledge, such as clicking on a button that appears to perform another function. The term "clickjacking" was coined by Jeremiah Grossman and Robert Hansen in 2008.[8]

Fig.4- Illustration of man-in-the-middle attack [9]

Social Engineering Attacks

Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information. A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional "con" in that it is often one of many steps in a more complex fraud scheme.

Fig.5- Social Engineering attack cycle [10]

Symlinking – An Insider Attack

In computing, a symbolic link (also symlink or soft link) is a special type of file that contains a reference to another file or directory in the form of an absolute or relative path and that affects pathname resolution.

A symlinking attack occurs when a hacker positions the symlink in such a way that the user or application that access the endpoint thinks they’re accessing the right file when they’re really not.

If the endpoint file is an output, the consequence of the symlink attack is that it could be modified instead of the file at the intended location. Modifications to the endpoint file could include appending, overwriting, corrupting, or even changing permissions.

Cross Site Request Forgery Attacks

CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.[12]

Technical Example

In this case the hacker creates a request that will transfer money from a user’s account, and then embeds this attack in an image request or iframe stored on various sites under the attacker’s control.

Remote Code Execution Attacks

A Remote Code Execution attack is a result of either server side or client side security weaknesses.

Vulnerable components may include libraries, remote directories on a server that haven’t been monitored, frameworks, and other software modules that run on the basis of authenticated user access. Applications that use these components are always under attack through things like scripts, malware, and small command lines that extract information.[13]

DDoS Attack – Distributed Denial Of Service Attack

In computing, a denial-of-service (DoS) or distributed denial-of-service (DDoS) attack is an attempt to make a machine or network resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet

[14]

Fig.6- DDoS Stacheldraht  Attack diagram. [14]

IV. PROTECTION FROM UNKNOWN DOORS OF WEBSITE

· Installed software updates and patches of operating system regularly.
· Actually hackers see the weakness of system and take advantages so, always use recent version of software’s.
· Make your database fully authenticated and validated.
· Always close your session after working with website or try to delete history from web browser.
· Never click on seemingly innocuous web pages which save you from Click jacking Attacks.
· See path of the pages before clicking on symbolic link.
· Update your browser also on regular basis.
· Make sure firewall must be installed on your pc and update it regularly.
· Personalize your firewall setting during the setup process which show how much data you want to allow into your system from internet.
· Change your password regularly.
· Always use proper antivirus and scan regularly your pc.
· Make sure anti-virus software updates automatically.
· Install anti-spyware programs onto your system.
· Delete emails from unknown sources.
· Network must be managed with appropriate firewall.
· Check your system software and make sure not any unknown software installed you pc.
· Make your pc password protected.

V. DIFFERENT METHODOLOGIES USED FOR SAFETY FOR WEBSITES

· Keep your operating system updated/patched. Set it to "auto update".
· Use anti-virus and anti-spyware software and keep them updated.
· Do not visit un-trusted websites or follow links provided by unknown or un-trusted sources.
· Secure your transactions. Look for the "lock" icon on the browser's status bar and be sure "https" appears in the website's address bar before making an online purchase. The "s" stands for "secure" and indicates that the communication with the webpage is encrypted.
· Be cautious about all communications you receive including those purported to be from "trusted entities" and be careful when clicking links contained within those messages.
· Do not respond to any unsolicited (spam) incoming e-mails.
· Do not open any attachments contained in suspicious emails.
· Do not respond to an email requesting personal information or that ask you to "verify your information" or to "confirm your user-id and password."
· Beware of emails that threaten any dire consequences should you not "verify your information".
· Do not enter personal information in a pop-up screen. Providing such information may compromise your identity and increase the odds of identity theft.
· Have separate passwords for work related and non-work related accounts.
· Be educated with modern technology.

VI. CONCLUSIONS

At the end of “Is your website protected: a quick study to know unknown doors to your websites” we want to suggest that this type of attack generally done by hacker and cyber criminals. So, there is a need of extraordinary attention towards protection of websites, especially if we are transferring vital information through it. Hence websites must be protected in best possible manner. Hence we suggest all website owner to take almost care for making their website as secured as possible. Always tries to secure your database, validate all inputs, encrypt all user name and passwords, end sessions properly and close all possible doors to keep hackers out.

REFERENCES

[1] http://defencely.com/blog/10-popular-ways-hackers-hack-website/
[2]CiscoReview http://www.cisco.com/en/US/prod/collateral/con netw/ps5719/ps7314/prod_white_paper0900aecd80661ca6.html
[3] Microsoft.com http://www.microsoft.com/security/sir/
trategy/default.aspx#!cross_site_scripting
[4] http://defencely.com/blog/10-popular-ways-hackers-hack-website/
[5] http://www.microsoft.com/security/sir/trategy/default.aspx#!cross_site_scripting
[6] https://www.owasp.org/index.php/Man-in-the-middle_attack
[7] https://www.owasp.org/index.php/Top_10_2013-A2
Broken_Authentication_and_Session_Management
[8] http://en.wikipedia.org/wiki/Clickjacking
[9] http://hackingtech.in/clickjacking-attack-things-you-should-know/
[10] copyright 2002 Gartner G2
[11] http://en.wikipedia.org/wiki/Symbolic_link
[12] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
[13] http://defencely.com/blog/10-popular-ways-hackers-hack-website/

A Comprehensive Study of Cyber Law and Cyber Crimes : By Navneet Vishwas & Team

Title : A Comprehensive Study of Cyber Law and Cyber Crimes
Journal Name : International Journal of IT, Engineering and Applied Sciences Research (IJIEASR)
ISSN : 2319-4413
Volume 3, No. 2, February 2014
By Navneet Vishwas

ABSTRACT:

Cyber law is a term used to describe the legal issues related to use of communications technology. It covers cyber crime including intellectual property, privacy, freedom of expression, and jurisdiction. In India, The IT Act, 2000 as amended by The IT (Amendment) Act, 2008 is known as the Cyber laws which try to stop crime related to internet as well as cyberspace. To understand cyber law we need to have more focus on the term crime which refers to all criminal activities done using the medium of computers, the Internet, cyber space and the worldwide web. Some cyber related crimes are hacking, Child Pornography, Cyber Stalking, Denial of Service, Malware, Phishing, Information Warfare, various online theft etc. These cyber crimes and cyber criminal are punished by Indian Law i.e. Information Technology Act 2000 and IT (Amendment) Act, 2008. The crime committed by cyber criminals for many reasons such as for monetary gain, some personal benefit, harassing to victim for any reasons, destroying specific systems, data and information theft, information warfare etc. These criminals generally use modern telecommunication technology such as Internet (Chat rooms, emails, notice boards and groups) and mobile phones (SMS/MMS), Phishing, Email spoofing etc. The enhancement of technology the data & information theft also become easy, generally data related crimes committed with USB Media, Bluetooth technology, wireless media as well as data storage devices such as DVD, Pen Drive, Flash Drive, Micro chip etc. Such crimes may threaten a nation’s security and financial health. Issues surrounding these types of crimes have become high-profile, particularly those surrounding cracking, copyright infringement, child pornography, and child grooming. There are also problems of privacy when confidential information is lost or intercepted, lawfully or otherwise. So, best way to protect you from cyber crime is to use common sense, gain IT knowledge, be prepared and take precautions.

Key words:

Cyber law and cybercrime, Different aspects of cybercrime, Cybercrime and its types, An Introduction of cyber crimes, How Can You Stay Safe from cyber criminals, Hacking and cracking.

I. INTRODUCTION

Cybercrime is a criminal activity committed with computers and/or over a network or the Internet. The person who is involved in cyber crime is known as cyber criminals. These criminals generally use modern telecommunication technology such as Internet (Chat rooms, emails, notice boards and groups) and mobile phones (SMS/MMS), Phishing, Email spoofing etc. The enhancement of technology the data & information theft also become easy, generally data related crimes committed with USB Media, Bluetooth technology, wireless media as well as data storage devices such as DVD, Pen Drive, Flash Drive, Micro chip etc.

So, in this topic “A Comprehensive Study of Cyber Law and Cyber Crimes” we focus on details on cyber crime, its types and various law under IT Act 2000 and IT (Amendment) Act, 2008. There are some useful points which make you safety from these frauds.

II. OBJECTIVE

The main objective to discuss on proposed topic i.e. “A Comprehensive Study of Cyber Law and Cyber Crimes” to spread the cyberspace knowledge to the human being and try to provide safety from cyberspace fraud as well as introduce some laws related to cyberspace crime.

III. CYBER LAW AND RELATED CRIME

Cyber law is a term used to describe the legal issues related to use of communications technology, particularly “cyberspace” which is known as Internet. It is different from other laws but it covers cyber crime including intellectual property, privacy, freedom of expression, and jurisdiction. Cyber law is an attempt to apply laws designed for the physical world, to human activity on the Internet. In India, The IT Act, 2000 as amended by The IT (Amendment) Act, 2008 is known as the Cyber law [1]. It has a separate chapter XI entitled “Offences” in which various cyber crimes have been declared as penal offences punishable with imprisonment and fine.To understand cyber law we have to need more focus of the crime which is refers to all criminal activities done using the medium of computers, the Internet, cyber space and the worldwide web.



IV. TYPES OF CYBER CRIME

Following are the some activities which come under cyber crime i.e.
1. Hacking
2. Child Pornography
3. Cyber Stalking
4. Denial of Service
5. Dissemination of Malicious Software (Malware)
6. Phishing
7. Information Warfare
8. Data Theft
9. Identity Theft
10. Email Spoofing
11. Network Related Wrongs [2]



Hacking:

Hacking in simple terms means an illegal intrusion into a computer system and/or network. There is an equivalent term to hacking which is known as cracking, but from Indian legal perspective there is no difference between the term hacking and cracking. Every act committed towards breaking into a computer and/or network is hacking. Hackers write or use ready-made computer programs to attack the target computer. Some hackers hack for personal monetary gains, such as for stealing credit card information or transferring money from various bank accounts to their own followed by withdrawal of money. They also indulge in extortion based on information received while hacking a particular network of computer system.
Law applicable under Information Technology (Amendment) Act, 2008, Section 43(a) [3] read with section 66 is applicable and Section 379 & 406 of Indian Penal Code, 1860 also are applicable.



Child Pornography:

Child pornography is pornography that involves a child [4]. Pornography may use a variety of media including writings, magazines, photos, sculpture, drawing, cartoon, painting, animation, sound recording, film, video, and video games. Child pornography may be simulated child pornography or produced with the direct involvement of the child (also known as child abuse images Abuse of the child occurs during the sexual acts which are recorded in the production of child pornography [5].
Legal definitions of child pornography generally include sexual images involving prepubescents, pubescent or post-pubescent minors and computer-generated images that appear to involve them. Most possessors of child pornography who are arrested are found to possess images of prepubescent children; possessors of pornographic images of post-pubescent minors are less likely to be prosecuted, even though those images also fall within the statutes [6].



Cyber Stalking:

The term is used to refer to the use of the internet, e-mail, or other electronic communications devices to stalk another person. Stalking generally involves harassing or threatening behavior that an individual engages in repeatedly. It can be done using phone calls, leaving written messages or objects, or vandalizing a person’s property. Cyber stalking can be also defined as the repeated acts of harassment or threatening behavior
of the cyber criminal towards the victim by using internet services. A study says most stalkers are using following methods for cyber stalking:
a. Collect personal information about the victim. If the stalker is a stranger to victim, he collects the information from internet resources such as various profiles the victim may have filled in while opening a chat or e-mail account or while signing an account with some website.
b. The stalker may post information on any website related to sex-services or dating services, posing as if the victim is posting this information and invite the people to call the victim on her telephone to obtain sexual services.
c. Some stalkers subscribe the e-mail account of the victim to innumerable pornographic and sex sites, because of which the victim starts receiving indecent soliciting e-mails.
d. Some stalkers send repeated e-mails asking for various kinds of favors or threaten the victim [7].



Denial of Service:

This is a technology driven cyber intrusion, where by the influencer floods the bandwidth or blocks the user’s mails with spam mails depriving the user, access to the Internet and the services provided there from. A DoS Attack can be done using
a. Consumption of computational resources, such as bandwidth, disk space, or central processing unit (CPU) time.
b. Disruption of configuration information, such as routing information etc.
c. Disruption of physical network components.
Dissemination of Malicious Software (Malware):
Malware, short for malicious software, is software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. It can appear in the form of code, scripts, active content, and other software. In all countries it is a serious criminal offence to create and distribute malware, but it continues to be produced for various reasons, such as demonstrating a capability or making money.
Malware includes computer viruses, ransomware, worms, trojan horses, rootkits, keyloggers, dialers, spyware, adware, malicious BHOs, rogue security software and other malicious programs which is very dangerous for Information technology [8].



Phishing:

It is the act of attempting to acquire information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication.
Phishing is typically carried out by email spoofing or instant messaging and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Phishing is an example of social engineering techniques used to deceive users [9] and exploits the poor usability of current web security technologies.
Information Warfare:
It is a kind of warfare where information and attacks on information and its system are used as a tool of warfare. Information warfare may include giving the enemy propaganda to convince them to give up, and denying them information that might lead to their resistance.
It is the strategy for undermining an enemy’s data and information systems, while defending and leveraging one’s own information edge. This type of war has no front line; potential battlefields are anywhere networked systems can be accessed-oil and gas pipelines, electric power grids, telephone switching networks, etc [10].



Data Theft:

According to Wikipedia, Data Theft is a growing problem, primarily perpetrated by office workers with access to technology such as desktop computers and handheld devices, capable of storing digital information such as flash drives, iPods, digital cameras and even Mobile Phones. The damage Caused by data theft can be considerable with today’s ability to transmit very large files via e-mail, web pages, USB devices, DVD storage and other hand-held devices.
According to Information Technology (Amendment) Act, 2000, crime of data theft under Section 43 (b) [11] is stated as - If any person without permission of the owner or any other person, who is in charge of a computer, computer system of computer network - downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium, then it is data theft.



Identity Theft:

Identity theft is a form of fraud or cheating of another person’s identity in which someone pretends to be someone else by assuming that person’s identity, typically in order to access resources or obtain credit and other benefits in that person’s name. Information Technology (Amendment) Act, 2008, crime of identity theft under Section 66-C [12], whoever, fraudulently or dishonestly make use of the electronic signature, password or any other unique identification feature of any other person known as identity theft.
Identity theft occurs when someone uses another's personally identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes.



Email Spoofing:

It is e-mail activity in which the sender addresses and other parts of the e-mail header are altered to appear as though the e-mail originated from a different source [13]. E-mail spoofing is sending an e-mail to another person in such a way that it appears that the e-mail was sent by someone else. A spoof email is one that appears to originate from one source but actually has been sent from another source. Spoofing is the act of electronically disguising one computer as another for gaining as the password system. It is becoming so common that you can no longer take for granted that the e-mail you are receiving is truly from the person identified as the sender. Email spoofing is a technique used by hackers to fraudulently send email messages in which the sender address and other parts of the email header are altered to appear as though the email originated from a source other than its actual source. Hackers use this method to disguise the actual email address from which phishing and spam messages are sent and often use email spoofing in conjunction with Web page spoofing to trick users into providing personal and confidential information.



Network Related Wrongs:

This type of cyber crime mainly harms network system. Due to this activity that causes the operation of a computer network to be temporarily disrupted. Interference implies something momentarily such as Denial of Service Attacks that causes delays in data transmission by using up all available bandwidth. Distributed denial of service, ping of death and smurf attacks also fall under this category. Data Security Network sabotage - causing permanent damage to a computer network such as deleting files or records from storage [14].



V. LAW AGAINST CYBER CRIME AND CYBER CRIMINAL

• Hacking - Law applicable under Information Technology (Amendment) Act, 2008, Section 43(a)
• According to Information Technology Act, 2000, data theft criminal punished under Section 43 (b)
• Identity theft comes under Information Technology (Amendment) Act, 2008, crime of identity theft under Section 66-C
• Email Spoofing tricks used by Hacker for hacking and it is a cyber crime under IT Act 2008, Section 43(a)
• Child pornography is a cyber crime which is prevented under Child Pornography Prevention Act of 1996 (CPPA)
• Prior to February 2013, there were no laws that directly regulate cyber stalking in India.
• India's Information Technology Act of 2000 (IT Act) was a set of laws to regulate the cyberspace. However, it merely focused on financial crimes and neglected interpersonal criminal behaviours such as cyberstalking (Behera, 2010; Halder & Jaishankar, 2008; Nappinai, 2010).
• In 2013, Indian Parliament made amendments to the Indian Penal Code, introducing cyberstalking as a criminal offence.



VI. DIFFERENT METHODOLOGIES USED FOR SAFETY IN CYBERSPACE

• Keep your operating system updated/patched. Set it to "auto update".
• Use anti-virus and anti-spyware software and keep them updated.
• Do not visit un-trusted websites or follow links provided by unknown or un-trusted sources.
• Secure your transactions. Look for the "lock" icon on the browser's status bar and be sure "https" appears in the website's address bar before making an online purchase. The "s" stands for "secure" and indicates that the communication with the webpage is encrypted.
• Be cautious about all communications you receive including those purported to be from "trusted entities" and be careful when clicking links contained within those messages.
• Do not respond to any unsolicited (spam) incoming e-mails.
• Do not open any attachments contained in suspicious emails.
• Do not respond to an email requesting personal information or that ask you to "verify your information" or to "confirm your user-id and password."Beware of emails that threaten any dire consequences should you not "verify your information".
• Do not enter personal information in a pop-up screen. Providing such information may compromise your identity and increase the odds of identity theft.
• Have separate passwords for work related and non-work related accounts.
• Be educated with modern technology.



VII. CONCLUSION

At the end of “A Comprehensive Study of Cyber Law and Cyber Crimes” we want to suggest that this type of crime and criminals must be stopped. But this is not so easy; our judicial system must be providing more strong law to stop the crime related to cyberspace. So, we want to suggest that be educated with modern technology and follow above tips to fight with cyber crime.



VIII. REFERENCES

[1] IT Amendment Act 2008, Registered No –DL –(N)04/0007/2003-09 http://deity.gov.in/sites/upload_files/dit/files/downloads/itact2000/it_amendment_act2008.pdf

[2] IGNOU PGCCL (Post Graduate Certification in Cyber Law) Program, MIR-014 Block No.2, Unit No-5, Page No - 8 to12

[3] IT Amendment Act 2008, Registered No –DL –(N)04/0007/2003-09 http://deity.gov.in/sites/upload_files/dit/files/downloads/itact2000/it_amendment_act2008.pdf, Page No -06, Point No-22

[4] Finkelhor, David. "Current Information on the Scope and Nature of Child Sexual Abuse.". Future of Children. v4 n2 (Sum–Fall 1994): p31–53.Source - http://en.wikipedia.org/wiki/Child_pornography

[5] Hobbs, Christopher James; Helga G. I. Hanks, Jane M. Wynne (1999). Child Abuse and Neglect: A Clinician's Handbook. Elsevier Health Sciences. p. 328. ISBN 0-443-05896-2. Source - http://en.wikipedia.org/wiki/Child_pornography.

[6] http://en.wikipedia.org/wiki/Child_pornography - [17]. Wells, M.; Finkelhor, D.; Wolak, J.; Mitchell, K. (2007). "Defining Child Pornography: Law Enforcement Dilemmas in Investigations of Internet Child Pornography Possession" (PDF). Police Practice and Research 8 (3):269–282. doi:10.1080/15614260701450765.Retrieved 2008-07-01.

[7] IGNOU PGCCL (Post Graduate Certification in Cyber Law) Program, MIR-014 Block No.2, Unit No-5, Page No – 9

[8] http://en.wikipedia.org/wiki/Malware-[4]. Microsoft active malware threats". Malware Encyclopedia. Microsoft Malware Protection Cnter. Retrieved 2013-08-26 [9] http://en.wikipedia.org/wiki/Phishing -[7]. Jøsang, Audun et al."Security Usability Principles for Vulnerability Analysis and Risk Assessment." (PDF). Proceedings of the Annual Computer Security Applications Conference 2007 (ACSAC'07). Retrieved 2007. [10] IGNOU PGCCL (Post Graduate Certification in Cyber Law) Program, MIR-014 Block No.2, Unit No-5, Page No – 11

[11] http://deity.gov.in/hindi/node/1210 : IT Act 2000, Registered No –DL –33004/2000, CHAPTER - IX PENALTIES AND ADJUD1CATION Page No - 15

[12] IT Amendment Act 2008, Registered No –DL –(N)04/0007/2003-09 http://deity.gov.in/sites/upload_files/dit/files/downloads/itact2000/it_amendment_act2008.pdf, Page No -10, Section- 66C

[13] http://en.wikipedia.org/wiki/Spoofing_attack

[14] IGNOU PGCCL (Post Graduate Certification in Cyber Law) Program, MIR-014 Block No.2, Unit No-5, Page No – 11&12.