Programming – II

Programming is a vast field. Even after years of experience a programmer is always bumping into new things. That’s part of what makes it so exciting, you can always find something new to do, possibilities are endless. So, here we try to answer another question in the mind of wannabe programmers: How to start?
Programming can only be caught, never taught. Learning programming encompasses two main things, reading and doing, with greater emphasis on the latter. You can only know what to do by reading, but you can learn only by doing. Even when you may get stuck somewhere or not fully understand something, doing it yourself will always clear all your doubts. I myself learned most of the programming I know through different sources on the internet and tons of books. Below are some of the best ones, I’ve come across yet: (categorized by languages) (Note: Most of these are completely free, but some may offer paid packages and features too. Also, try enlarging the text from the menu button if the links are hard to click. Lastly the websites are mainly designed for computers and may or may not work properly on mobile phones.)
Before starting, a few special mentions:
► http://www.w3schools.com/
Without a doubt, this is one of the best websites out there to learn programming. If you want to get into web development, there’s no better place to start than W3Schools. HTML, CSS, JavaScript, SQL, PHP, XML, JQuery – You name it, this website has an abundance of learning material for vast number of programming languages and it’s tailor made for beginners.
► http://www.learnstreet.com/
A relatively young website, but it has a lot to offer. It has highly interactive free online courses on Python, Ruby and JavaScript (yet). Again, a great place for beginners to start. It presents examples and questions that the user has to actively participate in and solve problems in the browser itself.
► http://teamtreehouse.com/
A very well made website, it has tons of “projects” in different programming languages. Each of these projects are a compilation of videos in which a person commentates or teaches you about completing the project, what all you need to do and how to do it. Clearly, they’ve put a lot of effort into it and it did come out great.
Other than these, there are many more websites which offer great courses and material for learning programming. A few of these are mentioned below according to languages:
►Multiple Languages:
• https://www.bitcast.io/
• https://www.udacity.com/
• http://www.codecademy.com/
• https://www.codeschool.com/
►Java
• http://www.learneroo.com/
• http://funprogramming.org/
►Javascript
• http://codehs.com/
• http://jsdares.com/
►Ruby
• https://rubymonk.com/
• http://hackety.com/
• http://tryruby.org/
►HTML, CSS, JAVASCRIPT
• http://css-tricks.com/
• http://www.codeavengers.com/
• https://tutsplus.com/
►Other / Uncategorized
• https://www.codeeval.com/
• http://quackit.com/
• https://www.khanacademy.org/
• https://www.udemy.com/
• http://net.tutsplus.com/
• http://projecteuler.net/
• http://webdesign.tutsplus.com/
• http://wp.tutsplus.com/
• http://www.webtechlearning.com/
• https://www.coursera.org/

Programming – I

When it comes to computers and everything related to them, programming is the mind and body, heart and soul. Without software, any piece of hardware is nothing but a random collection of metal and plastic. But with a beautiful stream of 1’s and 0’s it can almost literally be pumped full of life. Everything we see and everything we do on our mobiles and computers and really every fancy new gadgets these days, was created by someone, somewhere who night after night tirelessly wrote a program in code to create something wonderful.
The users often don’t fully comprehend exactly what goes on behind the scenes of any decent piece of software. For this reason, here’s a little reality check before we get to the main topic. A line of code is a single average line in a program and usually contains around 40-50 characters. The Unix 1.0 OS (1970) contained about 10,000 lines of code (LoC). Today, an average iOS or android app has approximately 50,000. That is 50,000 lines typed word by word by someone, and we’re just getting started. Photoshop CS6 clocks in at a freaky 5 million LoC and the Firefox browser? – 10 million. Moving on to the big players, we’ve got Windows 7 at 40 million and guess what? Microsoft office is actually bigger than the parent OS itself (about 45 million LoC). Now that you’re gaining a little perspective, let’s blow it to hell. The website healthcare.gov (reportedly) has an unbelievable 500 million lines of code. To put that into perspective, if a decent and immortal programmer started making this website in the last ice age 10,000 years ago, they’d still be going today, while of course cursing their destiny.
What’s the point of telling you all this?
Programming is not for the faint hearted. It takes effort (but not that much). Truth be told, lines of code is a very poor measure for difficulty. It’s like measuring a person’s success by counting the number of words they’ve spoken, ridiculous and not really related. The point of all that was to prove wrong the ones who overstate and exaggerate the difficuty of learning programming. It’s almost always pictured as something unbelievably boring, dry, dull and plain geeky. According to movies, a programmer is a fat nerdy guy with huge spectacles sitting in front of the computer mindlessly typing away while all that s/he accomplishes is something facetious and laughable. This could not be more wrong. Undoubtedly, programming can only be done by someone who thoroughly enjoys it. Being a programmer myself, I can honestly say there’s simply no way to describe it. It’s different for everyone which is why to truly find out if programming is for you, you will just have to try it out for yourself.
Programming teaches you how to think. It teaches you how to solve any problem, whether it is considered possible or not is irrelevant.
Moving On, let’s take a look at how exactly programming can help a hacker. First of all, it is what differentiates you from script kiddies. If the only hacks someone can do are made by others, then that person really cannot be called a “Hacker”. If you ever tried googling about hacking and gave up soon without finding an answer, you’re not alone. The main reason most hackers are not big on helping others is because they start getting bombarded by noobs asking them to hack (fb) accounts and explain something so basic and silly that they just give up and start ignoring them. Programming helps you understand how everything in your smarter idiot box comes together. It gives you better knowledge about how to identify and solve any problems by yourself. By knowing programming, you get a better understanding about how vulnerabilities and exploits work. Most importantly you can code your own tools, scripts, exploits, shell codes, entire applications and modify existing ones according to your own needs. No need to learn it from others, you can simply make it your own. You get to explore and pioneer in uncharted territory.
What all can you expect to do with programming? Sky’s not the limit, when there are footprints on the Moon. Everything, literally everything you can think of. But that’s the big picture stuff. Let’s take a sneak peek of the programming world with an example of this website itself. Press a button in the sub menu up top, you’ll see a further menu pop up. What I did to make that happen is I wrote a simple function (set of commands) that should be executed when the user presses the menu button. Similarly hovering your mouse over the button changes it’s color. To make that happen I wrote a small JS script that looks for the event of mouse hover over the button and then changes the color.
These were just a couple of examples in an infinite ocean of possibilities. In programming, you can expect to find and identify problems and find your way through them with logical thinking.
So that’s that for an introduction to programming. The next question that comes is where to start?
All you have to do is pick a language and dive in. Which one? There’s simply no right or wrong answer to this question. Fair warning, you’ll have to learn quite a few languages for hacking, preferably as many as possible. Even if you will not need to write in every language, you should know how to at least read it. Nobody is perfect, least of all, programming languages. Each one has it’s pros and cons. You can do the same thing in a million different ways with a dozen prorgamming languages. The time spent analyzing these useless facts could better be spent actually learning something. There is nothing to gain from comparing languages. Knowing quite a few myself, I can tell you the difference between languages is almost like the difference between “Hello”, “Hi” and “Hey”. Although languages like HTML, SQL, Java are used for different things, it really doesn’t matter where you start since you should learn as many languages as you can. For making a webpage you’ll need HTML, for making applications – Visual Basic, for data storage – SQL, for complex programs – C++ (just an example). Clearly, every single one of these and others as well are useful to a hacker. So, for the last time, start wherever you want to (or randomly).
The final destination is the same, below are a few of the different paths (languages) for a programming beginner to follow. It is generally advised to stick to mainstream languages when beginning and these are some of them:
►C++, Java, C# : These are the most used high level general purpose languages. Most of what you’ll ever do on a computer would not be possible without these. Almost every software, tools, applications is made by these. You are bound to run into these one day or another. They require a fair amount of effort but yield the greatest rewards. These are generally not recommended as a first language. My first language was C++, and it made learning every consequent language much easier. Once more, it’s up to you.
►HTML/SQL/XML : These are so easy, they’re almost not even worth learning. But they offer great rewards for very little effort, something you’ll never hear in the rest of the programming world. Actually, you can learn these just to tell people that you know so many computer languages. You can easily absorb the basics of these three, for example, in under a day. SQL is particularly important for hackers as it can, in some cases provide an easy way into a server’s database (SQL injection) – Definitely worth knowing, considering we’re all lazy and proud. (JavaScript also deserves a mention here, but it’s a wee bit bigger and deeper)
►Python, Ruby : These are two more quite powerful languages. Python is pretty much the best and most widely used scripting language out there, although it can be used generally also. Ruby is another general purpose language, MetaSploit is coded in Ruby.
These were just a few examples, there are several languages out there. Check out “Programming-II” for a compilation of the best sources and websites to start learning programming right away. Keep calm and code on.

Hacking Facebook

A note for the newcomers – Contrary to popular belief there doesn’t exist some secret software where one can just put in an email id, press “Enter” and all the passwords associated with that account magically appear. Hacking facebook, like any other hack takes time, skill and effort. Also, the methods are much the same for hacking any type of account for that matter.
There are 3 main methods used when it comes to Hacking Facebook accounts. Briefly,They are :
1.Keyloggers : Making the victim open up his account on a system with a keylogger attached/ Sending a remote keylogger to the victim.
2.Phishing : Making a fake login page and having the entered details sent to you.(This has been explained in the beginner section).
3.Social Engineering : This is just a fancy term for making the victim give up vital information in a supposedly casual conversation. The information may be the user’s recovery question’s answer, which can then be used to take over the account via : “Forgot your password? Click Here!” Button.
Some time ago, Facebook developers patched in a new security feature. In a nutshell, if facebook detects that your IP address is different from the usual(previously used) IP addresses, it may stop you from logging in without further identitiy verificiation which may be, for example: an SMS code. Now this can potentially effect every type of hack, but if it is infact possible there is only one way to know- By doing it. Hope for the best, Prepare for the worst.
1.Keyloggers:
A Keylogger is type of software that usually runs in the background, without the knowledge of an innocent victim and secretly records their actions. A wide variety of functionality is offered by various products : Almost all record every keystroke on the keyboard in a simple text file format, some record mouse clicks and pointer locations, some record folders and files opened and some even take screenshots at regular intervals.
Most of the keyloggers provide an option whether to store the text file locally send it to an FTP server or your email id. They can be installed and set up relatively easily like any other program. Once setup, they usually go into hiding as a background process leaving no trace on the surface and starting up automatically when the operating system starts.
For some reason people seem to avoid or look over keyloggers, I can give you my word this is the best and easiest method for hacking any type of account there is, so definitely check this out. In our case, we want the victim to login to their facebook account on a compromised system, one that has a stealthy keylogger installed. There are two ways to go about this :Installing a keylogger on your system and having them use it to login to their FB account, or if you have temporary access to their system- Installing it on their computer and having the log files sent to you by email or FTP.
Whichever way you prefer, the method is the same. Download a keylogger, follow the smooth setup instructions as you would when installing anything, customize settings according to your preference and Let it rip !
I have personally tried and tested the following keyloggers, you can choose any of these randomly since they all seem to do the job :
(i)Actual key-logger – Download from http://www.actualkeylogger.com/download-free-key-logger.html
(ii)Home key-logger – Download from http://www.kmint21.com/download.html
(iii) REFOG Free key-logger – Download from https://www.refog.com/download.html
(P.S- Certain full versions of very good keyloggers are available as torrents from websites like isohunt.com , kickass.to but these torrents are illegal and we shouldn’t use them)
2.Phishing : This method has been described in great detail in the beginner section. Follow the instructions carefully while using facebook.com instead of gmail.com.
3.Social Engineering :
Facebook uses security questions as a recovery method, almost everyone sets it up to a personal question like :
“Where were you born? ”
“What was your first pets name? ”
Social engineering is a term that describes a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures.
A social engineer runs what used to be called a “con game.” For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that compromises the network’s security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires immediate network access.
Appeal to vanity, appeal to authority, appeal to greed, and old-fashioned eavesdropping are other typical social engineering techniques.
For this method to work, you need to know the person whos account you want to hack. In fact, you need to know them well enough, such that it doesn’t seem suspicious when you carefully try to work up their recovery questions into your conversation and get them to answer it casually.
After that,using the “Forgot your password? Click Here!” Button one can simply turn over an account’s user. But even after this, your work is not done yet. Nowadays facebook has implemented a 24 hour delay before recovering the account and logging in, So if the victim happens to log in during that period they can reverse the process in seconds. Not only do you need careful planning, but also careful timing.
Facebook uses a verification method during recovery -if the victim’s email and phone number are no longer functional it asks to put in another phone number. If you can somehow get a hold of their cell phones or email accounts their account is yours, otherwise the process may be slow and fruitless.

Practicing For DDOS

What we’ll attempt to do in this article is similar to testing a nuclear bomb (okay, not really). But still, there’s no way to tell exactly what will happen, other than to blast the damn thing because more often than not that’s just the way it is with DDOSing.
To refresh your memory, DDOS Attacks involve saturating the target machine with external communications requests (packets) so much so that it cannot respond to legitimate traffic. In most cases, this presents an obvious obstacle – Where to get massive amounts of bandwidth? By definition, servers are designed to handle huge quantities of traffic and when we are trying to attack it with traffic, it’s going to be very difficult (or is it?).
The usual way to DDOS is to slowly build up a botnet for example, by spreading a trojan (or RAT) that installs the DDOSing software and sets up a backdoor listener. When the infection has spread to thousands of systems, the hacker then activates the trojan and the DDOSing begins. Clearly, breaking into several thousand systems is not very legal or ethical, so even if some genuine website administrator wants to perform a dummy DDOS just to see what will happen and what’s the best way to handle it, they won’t be able to do it. This is another reason why small websites particularly are very vulnerable to attack – they don’t practice because apparently the only way to practice is illegal. So, when they are hit by an actual DDOS they simply don’t stand a chance. So, below we take a look at a possible solution that works for both good and bad guys. An alternative practice methods for website admins and a shortcut for DDOSing for hackers.
The method described below is quite unpopular. In a sentence, we use online services to DDOS for us. These are called “stressers” or “booters” and are simply services which provide large internet bandwidth for the purposes of simulating a DDOS attack. Before moving on, some of the websites mentioned below do offer trials but most of them are fully unlocked only after a payment. So, these may be useful mainly for serious networking administrators or website owners only.
Clearly, doing an actual BlackHat DDOS using this is very much possible if done correctly. But that would require using a VPN or TOR browser to hide your identity. Even with that, since you would have to make a payment, it could potentially lead back to you making this a very dangerous alternative if not done exactly right. Hence, I recommend using this method only for what it’s meant for, as simply fooling around can get you into very serious legal trouble.
Below you can see the names of a few well known stressers and booters and the links to their websites.
#1: Power Stresser – http://www.powerstresser.com (60GB/s of Power)(Stop Button)(Instant)(Skype Resolvers)
#2: Titanium Stresser – http://titaniumstresser.net/ (Powerful)(Up for 3 years)(Best Price)(Great Support)
#3: Legion Stresser – http://legion.cm/ (Max Power) (Max Time)
For some reasons, the majority of these websites appear quite dull on first look. Perhaps they don’t want to attract a lot of attention. Anyways, In most of the above websites you’ll simply see a login page with a “Register” option. So, pretty much the only way to get inside is to make an account. Pick anyone and create an account. (Again, this tutorial is mainly for online service/website owners who want to make sure their website is well protected) Once you’ve registered for the first time. You will see several packages of boot time and strength. Whether you’re trying to DDOS someone else (which you shouldn’t) or your own online website or service, I recommend having several (2-3) booters or Stressers with moderate time instead of just 1 large DDOSer.
On The websites you will see a control panel-like window, where you can initiate your DDOS Attacks after selecting a package. To DDOS a home connection or a server, you will first need the (host) IP address. Many Booters Contain a built in Skype resolver and Domain Resolver. For “Port” option, the usual choice is Port 80 (Directed at home modems).
You will then be able to set your Boot time anywhere from 0 to the maximum time you paid for. Generally, UDP(User Datagram Protocol) is used for targeting a PC. For website and larger servers, SSYN attack is usually used which is considerably more powerful. You can think of these as DDOS attacks in which different types of optimal requests are sent for different situations and targets. Anything more than this will get a bit too technical than required here.
So that’s that for configuring and optimizing the DDOS attack. After this you will be able to start your DDOS attack as and when you please. Below you will find some useful relevant information that is frequently required for DDOSing using stressers and/or booters:
Skype Beta Resolver – http://www.iSkypeResolve.com
Other Ports:
(Home Connections)
53 – DNS Port
80 – Default Internet Port
(Xbox Connections)
80 – Default Internet Port
88 – Authentication Port
3074 – Xbox Default Port
(Web Servers)
21 – FTP Port
25 – SMTP/Mail
53 – DNS Port/Nameserver
80 – Default Internet Port
3306 – MySQL Port

Protecting Against DDOS

The goal of any DDoS attack is to overwhelm a service to the point where it no longer works. While DDoS has historically been just an annoyance, there is usually a financial impact, such as lost sales or a spike in bandwidth costs. Cloud-hosted services, which charge by usage, are especially financially vulnerable to an onslaught of traffic.
DDoS attacks use large numbers of computers simultaneously targeting a single service. The attack often comes from botnets, which are composed of PCs infected by a virus. Recently, DDoS has been used by political protesters, who crowdsource attackers through downloadable software.
Older DoS attacks like SYN floods used limited numbers of attackers, so it was possible to use automatic per-client rate-limiting, or to block the IPs. Modern DDoS techniques try to avoid large amounts of traffic per attacker, and rely purely on large numbers.
Many sites may think they’re too small to attract attention. However, DDoS isn’t a hard attack to perform. Ironically, DDoS is even available as a service. If your site is big enough to attract any business, it’s big enough to attract a potential attacker.
Reducing the cost of an attack starts with early detection. There are simple techniques you can use to alert yourself to an attack. Run a script on your server that sends a message periodically with the recent traffic count: You’ll get a warning either if the count jumps significantly, or the message doesn’t arrive. Additionally, use a remote monitoring program that periodically checks the service’s availability.
A large DDoS attack may block your management access if the site is remote. Try to make sure there’s a cost-effective out-of-band management solution.
Once you detect a DDoS attack, the first step is to identify its unique characteristics. Despite the availability of cleverer techniques, DDoS usually relies on brute force – which means that the traffic from all of the attackers will have unique similarities. Because large numbers of attackers will be involved, scattered across the Internet, blocking the IP addresses will be nearly impossible.
Instead, do a quick packet capture of the attack. Finding examples will be relatively easy, since most of the traffic will be DDoS traffic. Commonalities can often be found in the URI, user agent, or referrer. What you’re looking for is a pattern that you can block with your firewall, router ACL, IDS, etc. It will often be an ASCII or hex pattern at an offset. Become familiar with the capabilities of your equipment, and try some tests in preparation.
Once you have identified the attack fingerprint, it is time to set up a block within your firewall or router to drop the majority of packets. However, a high-bandwidth attack may simply exhaust your WAN link: You’ll have a clean LAN, but your service will still be unreachable. Contact your carrier now to figure out how to work with them during a DDoS attack, in case they need to do the blocking for you.
Some service providers offer “clean pipe” hosting with automatic DDoS squelching. There are also companies who offer products and services to detect and prevent DDoS. Depending on the specifics of your service, it may make financial sense to pay for one of these solutions. Don’t forget the option of simply hosting the service somewhere large enough to absorb the attack – but remember that DDoS against sites that charge by bandwidth can result in unexpectedly high bills.
During and after a DDoS attack, ask for help. Your regional CSIRT (Computer Security Incident Response Team) should be alerted, as they have expertise and contacts that can not only help you during the attack, but also start the process of figuring out who did it and how. A global list is available here: http://www.cert.org/csirts/national/contact.html
As cyber crimes get more sophisticated, businesses must be able to constantly adapt to these new security threats. While there are no methods or tools that can completely prevent DDoS attacks from happening, having a security “insurance policy” in place is the first step in ensuring that you are completely prepared. The ability to quickly suspend this new level of attack is tantamount to protecting company data as well as your business as a whole.

Launching DOS Attack

Most servers are built to handle a fairly large bandwidth and even the smaller ones can give maximum speeds to several hundreds of clients. Keeping this in mind, it is very difficult and for the most part impossible to actually bring down a website using DOS from a single computer. Where your internet speed might be 1Mbps, your target server might have several 100Mbps. This is the reason that most DOS attacks are actually DDOS,that is Distributed-Denial of Service.
DDOS attacks can easily bring down majority of websites. In DDOS, Botnets are used which are just a bunch of compromised systems who have been infected with a virus or trojan. A simple trojan can be sent out as a public download, and if the unsuspecting victims download it the trojan may silently settle down somewhere deep in the system and start up in the background without the user or the system ever knowing. When enough systems have been compromised in this way the master of the Botnet, the hacker who wants to DDOS a website may send out a message to the dormant trojans on several systems around the world, which may then indivisually begin attacking a server. This can be very harmful to the website, which due to lack of resources, may shut down for a long time and even get corrupted due to overloading. Further, since the requests for transactions are coming from seemingly random IP addresses all at once(the botnet), the victim may never find out the identity of the mastermind.
Although I won’t get into the technical details, here is an example of a fairly popular DOS tool – HULK. Hulk is just a simple python script that continuously sends out large packets from randomly generated IDs so as to fool the server. Again, using it from just one computer may not actually do anything to any big websites, but it may be able to bring down a small website, for example your school’s website in about a minute.
To perform this attack you need two things:
1. The python Engine (v2.x) – To run and compile the hulk script. You can get it here :
http://www.python.org/getit/
NOTE : Download the 2nd version only (for example the current one is 2.7.6), this script does not work with the 3.x version of python.
2. Hulk.py script – This will run like a normal cmd.exe window. It’s a small zip file,Get it here :http://packetstormsecurity.com/files/download/112856/hulk.zip
For technical details, The official website is :
http://www.sectorix.com/2012/05/17/hulk-web-server-dos-tool/
When all is done, you should have python installed, and hulk.py file extracted. It would be easier if you installed Python to a root directory, for example :
C:\\PYTHON27.
Also, put the hulk.py file which you just extracted in the same root directory alongside the PYTHON27 folder(In my case, I put the hulk.py file in the C:\ directory).Again, both python folder and the hulk.py file are now in the C:\ ). With all that done, let’s launch our DOS attack !
1. Open Run, type cmd to start cmd.exe window.
2. Change directory to where you installed PYTHON and put hulk.py , Type ‘cd’ then the directory (Case sensitive) (cd= change directory)
cd C:\\PYTHON27
3. Now start up the hulk.py script as follows :
C:\\hulk.py http://www.google.com
(Write the directory of the hulk.py file followed by a space followed by the website you want to attack (Don’t actually try this with google, since they tend to block IPs with weird requests like the ones we are sending. You may be blocked from google for some time. If you want to try it out, consider setting up a small website on your own, or ask someone’s permission.)
You should now see something like:
HULK ATTACK STARTED
Give it a few seconds then it will show how many requests it has sent. A few more seconds and if the attack was succesfull you will see something like: ‘Response Code 500’
As soon as you spot this, try opening the website which may say : ‘Resource Limit Reached’ or ‘Service Unavailable’ meaning you have successfully brought down the website.
Technically, most servers may temporarily deny all requests from your ISP (internet service provider) and hence your IP address meaning that you’ve not actually brought down the website for the world but only for yourself(The website banned you). This is why DOS isn’t as effective as DDOS. When the server has to repeatedly deny several IP addresses, it truly runs out of resources for anyone wanting to open the website.

Introduction to DOS

A distributed denial of service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users.
In a typical DDoS attack, the assailant begins by exploiting a vulnerability in one computer system and making it the DDoS master. The attack master, also known as the botmaster, identifies and identifies and infects other vulnerable systems with malware. Eventually, the assailant instructs the controlled machines to launch an attack against a specified target.
There are two types of DDoS attacks: a network-centric attack which overloads a service by using up bandwidth and an application-layer attack which overloads a service or database with application calls. The inundation of packets to the target causes a denial of service. While the media tends to focus on the target of a DDoS attack as the victim, in reality there are many victims in a DDoS attack , the final target and as well the systems controlled by the intruder. Although the owners of co-opted computers are typically unaware that their computers have been compromised, they are nevertheless likely to suffer a degradation of service and not work well.
A computer under the control of an intruder is known as a zombie or bot. A group of co-opted computers is known as a botnet or a zombie army. Both Kaspersky Labs and Symantec have identified botnets – not spam, viruses, or worms – as the biggest threat to Internet security.