#10 CYBERLAW

CYBERLAW

Malaysia has set a vision to move towards a knowledge-based society and economy
 National Vision - where ICT as driver for restructuring of economy and employment.
 Prerequisites include access to infrastructure and development of Information, knowledge and applications.
Licenses for Certification Authorities (CA)
 Controller and the governing body which issued:
Malaysian Communications and Multimedia

 Company that already licensed certification authorities (CA) in Malaysia
Digicert
MSC Trustgate

 Digital Signature Act


What the Act is about:

 Provides for the regulation of the public key infrastructure
 The Act makes a digital signature as legally valid and enforceable as a traditional signature
 Copyright serves to protect the expression of thoughts and ideas from unauthorized copying and/or alteration
 With convergence of Information and Communication Technology (ICT), creative expression is now being captured and communicated in new forms (example: multimedia products, broadcast of movies over the Internet and cable TV). These new forms need protection.


 Copyright (Amendment) Act

What the Amended Act is about:

The Copyright (Amendment) Act amends the Copyright Act 1987 to extend copyright law to the new and converged multimedia environment
 There is now clear protection accorded to multimedia works.
 The transmission of copyright works over the Internet now clearly amounts to infringement
 Technological methods of ensuring works (and authorship info) are not altered or removed is also protected.

 Telemedicine Act
Why the Act exists:

 Healthcare systems and providers around the world are becoming interconnected. People and local healthcare providers can thus source quality healthcare advice and consultation from specialists from around the world, independent of geographical location. Conversely, interconnectivity also allows for non-quality healthcare advice and consultation from around the world. The Act serves to regulate the practice of teleconsultations in the medical profession.


 Computer Crimes Act
Why the Act exists:

 As computing becomes more central to people’s life and work, computers become both targets and tools of crime. This Act serves to ensure that misuse of computers is an offense.

What the Act is about:
The Act makes it an offense to:
 Enter or attempt to enter into computers and computer systems without authorization;
 Damage or alter data/information in computers or computer systems by planting viruses or other means;
 Aid others in committing the above two offences;
 Give passwords to people who are not authorized to receive it.
 Communications and Multimedia Act
Why the Act exists:
 Convergence of technologies is driving convergence of telecommunications, broadcasting, computing and content.
 Previously, each of these industries was regulated by several different pieces of legislation
 The old regulatory framework cannot cope with convergence and inhibits the growth of the new converged industry.
 Communications and Multimedia Act
What the Act is about:
 The CMA provides for a restructuring of the converged ICT industry.
 Creates a new system of licenses and defines the roles and responsibilities of those providing communication and multimedia services
 Provides for the existence of the Communication and Multimedia Commission, the new regulatory authority
 Policy Objectives of CMA


To establish Malaysia as a major global hub for C&M information and content services;
To promote a civil society where information based services would enhance the quality of life.

To grow and nurture local information resources and cultural representation that facilitate national identity and global diversity.

To regulate for the long-term benefit of the end user

Future Cyberlaws must recognise the people development component and crucial for a K-Economy.The existing Cyberlaws created the necessary impact but constant review is necessary.

#9 Legal and ethical issues in Computing

Legal and Ethical Issues in Computer Security

Why Laws
The laws of computer security affect programmers, designers, users, and maintainers of computing systems and computerised data banks.
These laws provide protection, but they also regulate the behaviour of people who use computers.

Before recommending change, however, professionals must understand the current state of computers and the law.

Objectives of Understanding Legal Section

Therefore, there are three motivations for studying the legal section
– to know what protection the law provides for computers and data;
– to appreciate laws that protect the rights of others with respect to computers, programs, and data; and
– to understand existing laws as a basis for recommending new laws to protect computers, data, and people.
Protecting Programs and Data

• Copyrights
Copyrights are designed to protect the expression of ideas. Thus, a copyright applies to a creative work, such as a story, photograph, song, or pencil sketch. The right to copy an expression of an idea is protected by a copyright.

Copyright gives the author/programmer exclusive right to make copies of the expression and sell them to the public. That is, only the author can sell copies of the author’s book (except, of course, for booksellers or others working as the agents of the author).

Copyrights for Computer Works

Can a computer program be copyrighted?
YES. The algorithm is the idea, and the statements of the programming language are the expression of the idea.
Therefore, protection is allowed for the program statements themselves, but not for the design: copying the code intact is prohibited, but reimplementing the algorithm is permitted.


Patents
Patents are unlike copyrights in that they protect inventions, not works of the mind.

The distinction between patents and copyrights is that patents were intended to apply to the results of science, technology, and engineering, whereas copyrights were meant to cover works in the arts, literature, and written scholarship.
Patents - Computer Objects
The patent has not encouraged patents of computer software.
For a long time, computer programs were seen as the representation of an algorithm was a fact of nature, which is not subject to patent.
There was a case on a request to patent a process for converting decimal numbers into binary. The Supreme Court rejected the claim, saying it seemed to attempt to patent an abstract idea, in short, an algorithm. But the underlying algorithm is precisely what most software developers would like to protect.

Trade Secret

A trade secret is information that gives one company a competitive edge over others. For example, the formula for a soft drink is a trade secret, as is a mailing list of customers, or information about a product due to be announced in a few months.
The distinguishing characteristic of a trade secret is that it must always be kept secret. The owner must take precautions to protect the secret, such as storing it in a safe, encrypting it in a computer file, or making employees sign a statement that they will not disclose the secret.

Comparisons

Employers hire employees to generate ideas and make products. Thus, the protection offered by copyrights, patents, and trade secrets applies to the idea and products.
However, considering the issue of who owns the ideas and products is much more complex.


Why Computer Crime is Hard to Define?


Understanding
Neither courts, lawyers, police agents, nor jurors necessarily understand computers.
Fingerprints
Polices and courts for years depended on tangible evidence, such as fingerprints. But with many c omputer crimes there simply are no fingerprints, no physical clues.
Form of Assets
We know what cash is, or diamonds, or even negotiable securities. But are 20 invisible magnetic spots really equivalent to a million dollars?
Juveniles
Many computer crimes involve juveniles. Society understands immaturity and can treat even very serious crimes by juveniles as being done with less understanding than when the same crime is committed by an adult.


Type of Crimes Committed

Telecommunications Fraud

It is defined as avoiding paying telephone charges by misrepresentation as a legitimate user.
Embezzlement
It involves using the computer to steal or divert funds illegally.
Hacking
It denotes a compulsive programmer or user who explores, tests, and pushes computers and communications system to their limits - often illegal activities.
Automatic Teller Machine Fraud
It involves using an ATM machine for a fraudulent activity - faking deposits, erasing withdrawals, diverting funds from another person’s account through stolen PIN numbers.
Records Tampering
It involves the alteration, loss, or destruction of computerised records.
Acts of Disgruntled Employees
They often use a computer for revenge against their employer.
Child Pornography and Abuse
They are illegal or inappropriate arts of a sexual nature committed with a minor or child, such as photographing or videotaping.

What are Ethics?
Society relies on ethics or morals to prescribe generally accepted standards of proper behaviour.

An ethic is an objectively defined standard of right and wrong within a group of individuals.
These ethics may influence by religious believe. Therefore, through choices, each person defines a personal set of ethical practices.

A set of ethical principles is called and ethical system.


Differences of The Law and Ethics


Firstly, laws apply to every one, even you do not agree with the laws. However, you are forced to respect and obey the laws.
Secondly, there is a regular process through the courts for determining which law supersedes which if two laws conflict.
Thirdly, the laws and the courts identify certain actions as right and others as wrong. From a legal standpoint, anything that is not illegal is right.
Finally, laws can be enforced, and there are ways to rectify wrongs done by unlawful behaviour.

#8 WIRELESS SECURITY

WIRELESS SECURITY

WLANs allow greater flexibility and portabulity than do tranditional wired local are network (LAN). Unlike a tranditioanl LAN, which requires a wire to connect a user computer to the network, a WLAN connect computer and other components to the network using an access point device.

An access point communicates with devices eqquipped with wireless network adaptrs. it connect to a wired Ethernet LAN via an RJ-45 port. Access point devices typically have coverage areas of up to 300 feet (approximately 100 meter). This coverage area is called a cell or range. Users move freely within the cell with their laptop or other network device. Access point cells can be linked together to allow users to even 'roam' within a building or between buildings.

- IEEE ratified 802.11 in 1997.
~Also known as Wi-Fi.
- Wireless LAN at 1 Mbps & 2 Mbps.
- WECA (Wireless Ethernet Compatibility Alliance) promoted Interoperability.
~Now Wi-Fi Alliance
- 802.11 focuses on Layer 1 & Layer 2 of OSI model.
~Physical layer
~Data link layer

802.11 Components
- Two pieces of equipment defined:
~Wireless station
-A desktop or laptop PC or PDA with a wireless NIC.
~ Access point
- A bridge between wireless and wired networks
- Composed of
- Radio
- Wired network interface (usually 802.3)
- Bridging software
- Aggregates access for multiple wireless stations to wired network

802.11 modes
- Infrastructure mode
- Basic Service Set (BSS)
- One access point
- Extended Service Set
-Two or more BSSs forming a single subnet.
- Most corporate LANs in this mode.
-Ad-hoc mode
-Also called peer-to-peer.
- Independent Basic Service Set
- Set of 802.11 wireless stations that communicate directly without an access point.
- Useful for quick & easy wireless networks.

Infrastructure mode


Ad-hoc mode

802.11 Physical Layer
1. Originally three alternative physical layers
~ Two incompatible spread-spectrum radio in 2.4Ghz ISM band
-Frequency Hopping Spread Spectrum (FHSS)
- 75 channels
- Direct Sequence Spread Spectrum (DSSS)
- 14 channels (11 channels in US)
~ One diffuse infrared layer
~ 802.11 speed
- 1 Mbps or 2 Mbps.

802.11 Data Link Layer
~Layer 2 split into:
~Logical Link Control (LLC).
~Media Access Control (MAC).
~LLC - same 48-bit addresses as 802.3.
~MAC - CSMA/CD not possible.
~Can’t listen for collision while transmitting.
~CSMA/CA – Collision Avoidance.
-Sender waits for clear air, waits random time, then sends data.
-Receiver sends explicit ACK when data arrives intact.
-Also handles interference.
-But adds overhead.
~802.11 always slower than equivalent 802.3

RTS / CTS
1. To handle hidden nodes
2. Sending station sends
- “Request to Send”
3. Access point responds with
- “Clear to Send”
-All other stations hear this and delay any transmissions.
4. Only used for larger pieces of data.
- When retransmission may waste significant time.

802.11b
1. 802.11b ratified in 1999 adding 5.5 Mbps and 11 Mbps.
2. DSSS as physical layer.
- 11 channels (3 non-overlapping)
3. Dynamic rate shifting.
- Transparent to higher layers
- Ideally 11 Mbps.
- Shifts down through 5.5 Mbps, 2 Mbps to 1 Mbps.
- Higher ranges.
- Interference.
- Shifts back up when possible.
4. Maximum specified range 100 meters
5. Average throughput of 4Mbps


Joining a BSS
~ When 802.11 client enters range of one or more APs
- APs send beacons.
- AP beacon can include SSID.
- AP chosen on signal strength and observed error rates.
- After AP accepts client.
-Client tunes to AP channel.
~Periodically, all channels surveyed.
-To check for stronger or more reliable APs.
-If found, re-associates with new AP.


Roaming and Channels
~Re-association with APs
-Moving out of range.
-High error rates.
-High network traffic.
-Allows load balancing.
~Each AP has a channel.
-14 partially overlapping channels.
-Only three channels that have no overlap.
-Best for multi cell coverage.


802.11a
~802.11a ratified in 2001
~Supports up to 54Mbps in 5 Ghz range.
-Higher frequency limits the range
-Regulated frequency reduces interference from other devices
~12 non-overlapping channels
~Usable range of 30 metres
~Average throughput of 30 Mbps
~Not backwards compatible

802.11g
• 802.11g ratified in 2002
• Supports up to 54Mbps in 2.4Ghz range.
- Backwards compatible with 802.11b
• 3 non-overlapping channels
• Range similar to 802.11b
• Average throughput of 30 Mbps
• 802.11n due for November 2006
- Aiming for maximum 200Mbps with average 100Mbps



Open System Authentication
• Service Set Identifier (SSID)
• Station must specify SSID to Access Point when requesting association.
• Multiple APs with same SSID form Extended Service Set.
• APs can broadcast their SSID.
• Some clients allow * as SSID.
- Associates with strongest AP regardless of SSID.


MAC ACLs and SSID hiding
• Access points have Access Control Lists (ACL).
• ACL is list of allowed MAC addresses.
- E.g. Allow access to:
~ 00:01:42:0E:12:1F
~ 00:01:42:F1:72:AE
~ 00:01:42:4F:E2:01
• But MAC addresses are sniffable and spoofable.
• AP Beacons without SSID
- Essid_jack
~ sends deauthenticate frames to client
~ SSID then displayed when client sends reauthenticate frames
Interception
• Wireless LAN uses radio signal.
• Not limited to physical building.
• Signal is weakened by:
-Walls
-Floors
-Interference
• Directional antenna allows interception over longer distances.
• Directional antenna provides focused reception.
802.11 Wireless LAN
- Three basic security services defined by IEEE for the WLAN environment
~ Authentication
-provide a security service to verify the identity of communicating client stations
~ntegrity
- to ensure that messages are not modified in transit between the wireless clients and the access point in an active attack
~ Confidentiality
- to provide “privacy achieved by a wired network”


802.11 Authentication
The IEEE 802.11 specification defines two means to validate wireless users attemping to gain access to a wired network, open system authentication and shares key authentication. One means, shared key authentication, is based on cryptography, and the other is not. The open-system authentication technique is not truly authentication, the access point accepts the mobile station without verifying the identity of the station. It should be notes also that the authentication is only one-way; only the mobile station is authentication. The mobile station must trust that it is communicating to a real AP. Taxonom of the tavhniques for 802.11 is depicted in above figure:-


802.11b Security Services
• Two security services provided:
- Authentication
- Shared Key Authentication
- Encryption
- Wired Equivalence Privacy


Wired Equivalence Privacy
• Shared key between
-Stations.
-An Access Point.
• Extended Service Set
-All Access Points will have same shared key.
• No key management
-Shared key entered manually into
-Stations
-Access points
-Key management nightmare in large wireless LANs


RC4
• Ron’s Code number 4
-Symmetric key encryption
-RSA Security Inc.
-Designed in 1987.
-Trade secret until leak in 1994.
• RC4 can use key sizes from 1 bit to 2048 bits.
• RC4 generates a stream of pseudo random bits
-XORed with plaintext to create ciphertext.


WEP – Sending
• Compute Integrity Check Vector (ICV).
-Provides integrity
-32 bit Cyclic Redundancy Check.
-Appended to message to create plaintext.
• Plaintext encrypted via RC4
-Provides confidentiality.
-Plaintext XORed with long key stream of pseudo random bits.
-Key stream is function of
-40-bit secret key
-24 bit initialisation vector
• Ciphertext is transmitted.

WEP – Receiving
• Ciphertext is received.
• Ciphertext decrypted via RC4
-Ciphertext XORed with long key stream of pseudo random bits.
-Key stream is function of
-40-bit secret key
-24 bit initialisation vector (IV)


• Check ICV
-Separate ICV from message.
-Compute ICV for message
-Compare with received ICV


Shared Key Authentication
• When station requests association with Access Point
-AP sends random number to station
-Station encrypts random number
-Uses RC4, 40 bit shared secret key & 24 bit IV
-Encrypted random number sent to AP
-AP decrypts received message
-Uses RC4, 40 bit shared secret key & 24 bit IV
-AP compares decrypted random number to transmitted random number
• If numbers match, station has shared secret key.


Web Safeguards
- Shares secret key required for associating with an access point, sending data and receving data.
- Message are encrypted for confidentiality.
- Message have checksum for integrity.
- Management static still broadcast in clear containing SSID.


Initialization Vector
• IV must be different for every message transmitted.
• 802.11 standard doesn’t specify how IV is calculated.
• Wireless cards use several methods
- Some use a simple ascending counter for each message.
- Some switch between alternate ascending and descending counters.
- Some use a pseudo random IV generator.

802.11 safeguards
• Security Policy & Architecture Design
• Treat as untrusted LAN
• Discover unauthorised use
• Access point audits
• Station protection
• Access point location
• Antenna design


Security Policy & Architecture
• Define use of wireless network
- What is allowed
- What is not allowed
• Holistic architecture and implementation
-Consider all threats.
-Design entire architecture
~To minimize risk.


Wireless as untrusted LAN
• Treat wireless as untrusted.
- Similar to Internet.
• Firewall between WLAN and Backbone.
• Extra authentication required.
• Intrusion Detection
- at WLAN / Backbone junction.
• Vulnerability assessments


Discover unauthorized use
• Search for unauthorised access points, ad-hoc networks or clients.
• Port scanning
- For unknown SNMP agents.
- For unknown web or telnet interfaces.
• Warwalking!
- Sniff 802.11 packets
- Identify IP addresses
- Detect signal strength
- But may sniff your neighbours…
• Wireless Intrusion Detection
- AirMagnet, AirDefense, Trapeze, Aruba.


Access point audits
• Review security of access points.
• Are passwords and community strings secure?
• Use Firewalls & router ACLs
- Limit use of access point administration interfaces.
• Standard access point config:
-SSID
-WEP keys
-Community string & password policy

#7 Security in Application

Electronic Mail (E-mail) Security

Electronic mail is one of the most heavily used network-based applications. With the explosively growing reliance on e-mail,there grows a demand for security e-mail systems. In an e-mail system, there are a sender and a receiver. However, usually the receiver is not on-line. So in an e-mail system, usually there is no massage interchange when the sender sends an e-mail. On the order hand, some e-mail system (a.g SMTP) only can deliver ASCll codes.

Security provided in E-mail


• Confidentiality
• Data origin authentication
• Message integrity
• Non-repudiation of origin.
• Key management


MIME


MIME = Mutlipurpose Internet Mail Extension.
• Extends the capabilities of RFC 822 to allow e-mail to carry non-textual content, non-ASCII character sets, long message.
• Uses extra header fields in RFC 822 e-mail to specify form and content of extensions.
• Supports a variety of content types, but e-mail still ASCII-coded for compatibility.
• Specified in RFCs 2045-2049.
How e-mail transported?
MUA = Mail user agent (mail client)
MTA = Mail transport agent (mail server)


E-mail Security Threats

Two main group:
• Threats to the security of e-mail itself.
• Threats to an organisation that are enable by the use of e-mail.
Loss of confidentially
• Email are sent it clear over open network.
• Email stored on potentially insecure clients and mail servers.
• Ensuring confidentiality may be important for email sent withi an organisation.

Loss of integrity
• No integrity protection on email, body can be altered in transit or on maul server.

Lack of data origin authentication
• Email could also be altered in transit.
• Sharing of email password common.

Lack of non-repudiation
• Can i rely and act on the content?(integrity)
• If so, can the sender later deny having sent it?Who is liable if i have acted?

• Example of stock-trading via email.


Threats enables by email
• Its easier to distribute information by email than it is by paper and snail mail.
• Disclosure may be deliberate (and malicious) or unintentional.
• Disclosure may be internal or external (email crosses LANs as well as the internet)
• Disclosure may be of personal, inappropriate, commercially sensitive or proprietary information.
• Can lead to loss of reputation and ultimately dismissal of staff.

S/MIME

SEcure/Multipurpose Internet Mail Extension (S/MIME) is another enchaced email system. Similar to PGP which uses sidnature scheme, session key and secret key encryption. S/MIME version 3 message specification is given in RFC2633.

It appears likely that S/MIME will emerge as the industry standard for commercial and organization use, while PGP will remain the choice for personal use.


PGP

Pretty good privary or PGP was developed by Phil Zimmermman. PGP uses public key encryption, signature scheme,hash function, secret key enryption, compression fuction and email compatibility. Functionality similar to S/MIME is an encryption for confidentiality and signature for non-repudiation/ authenticity.
One level of processing only, so less flexible than S/MIME. Sign before encrypt, so signature on unencrypted data. PGP processed data is base64 encoded and carried inside RFC822 message body.

Web Security

Web security included 3 parts:
1. Security of server.
2. Security of client
3. Network traffic security between a browser and a server.


Security pf server and security of client are problems of computer security. Network security can considered at different level , for examples network level: use IPSec, Transport level:Use SSL (Secure socket layer) or TLS (Transport layer security) and Application level: Use PGP,S/MIME,SET(Secure Electronic Transaction).

Secure Socket Layer (SSL)

SSL is develop by Netscape. The main part of SSL contains several protocol:SSL Handshake protocol, SSL change cipher spec protocl,SSL alert protocol, and SSL record protocol.

Secure Shell (SSH)

1. Initially designed to replace insecure SSH, telnel utilities.
2. Secure remote administration (mostly of Unix system).
3. Extended to support secure file transfer and email.
4. Latterly, provide a general secure channel for network application.
5. SSH-1 flawed, SSH-2 better secure security (and different architecture).

Secure Electronic Transaction (SET)
SET is an open encryption and security specification designed to protect credit card transaction on the internet . SSL secures communications between a client and a server.



Set secure issues

Two pairs of PKs parentity
1. One pair for signing.
2. One pair for exchanging keys.

How the web Works-HTTP - Hypertext transfer protocol (HTTP)
- Clients request 'document' through URL
- Server Respons with 'document'
- Document are not interpreted by http
- Stateless protocol, request are indepent.

How the Web works: other elements

-Hyper-text markup language (html).
-Other application specific document.
-E.G., MIME, graphics, video/audio, postscript, Java applets, etc.
-Browsers.
-Display html documents and embedded graphics.
-Run Java program.
-Start helper applications.

How to secure the web
~Athentication
1. Basic (username,password)
- Can be used along with cookie.
2. Digest
~ Access control via address
~Multi layered:
1- S-http(secure http), just for http
- Proposed by CommerceNet,pretty much dead.
2. SSL(TLS),generic for TCP
- https;http over SSl
3. IPsec

HTTP Authentication - Client doesnt know which method
- Client attempts access (GET,PUT) normally
- Server returns
~401 unauthorized
~Realm protection space
- Client tries again with


From Basic Authentication to Forms and Cookies
• Not all sites use basic authentication
• Many instead ask the user to type username/password into a HTML form
• Server looks up the user and sends back a cookie
• The browser (client) resends the cookie on subsequent requests


HTTP Access Control - Digest
1. Server sends www-authenticate parameters:
~ Realm
~ Domain
~ Nonce, new for each 401 response
- E.G. H(client-IP:timestamp:server-secret)
~ Algorithm
- E.G., MD5
2. Client sends authorization response:
~ Same nonce
~ H(A1), where a1=user:realm:password, and other information
~ Steal H(A1)
- Only good for realm

HTTPS

• HTTPS = Secure Hypertext Transfer Protocol
• HTTPS is a communications protocol designed to transfer encrypted information between computers over the World Wide Web (WWW)
• Essentially an implementation of HTTP
• Commonly used Internet protocol using an SSL
• Used to enable online purchasing or the exchange of private information and resources over insecure networks


Why HTTPS combines with SSL and How?
• HTTPS combines with SSL to enable secure communication between a client and a server
• Steps:
- Client requests a secure transaction and informs the encryption algorithms and key sizes that it support (by assessing a URL with HTTPS)
- Server sends the requested server certificate (encrypted server’s public key, list of supported ciphers and key sizes in order of priority)
- Client then generates a new secret symmetric session key basedon the priority list sent by the server. Client compares the certificate issued by CA and confirmed that certificate is belongs to the server intended for communication
• Steps:
- If valid and certificate confirmed, client encrypts a copy of the new session key it generated with the server public key obtained from the certificate. Then, client sends the new encrypted key to server
- Server decrypts the new session key with its own private key.
- Upon completed, both client and server have the same secret session key and use to secure communication and data transport.


Secure File Transfer Protocol (S/FTP)
• S/FTP is an interactive file transfer program
• Similar to ftp
• Performs all operations over an encrypted ssh transport
• Use many features of ssh such as public key authentication and compression
• S/FTP connects and logs into the specified host, then enters an interactive command mode

#6 NETWORK in SECURITY

Computer Network

A computer network is a system in which computers are connected to share information and resources. The connection can be done as peer-to-peer or client/server. This web site reviews the techniques you can use to set up and possibly manage a network for home or a small business.



What is a network can provide?

Logical interface function:
• sending messages
• receiving messages
• executing program
• obtaining status information
• obtaining status information on other network users and their status
• Node
Single computing system in a network.
• Host
A single computing system's processor.
• Link
A connection between two hosts.
• Topology


The pattern of links in a network.

Network Topology

Bus Topology

Bus networks (not to be confused with the system bus of a computer) use a common backbone to connect all devices. A single cable, the backbone functions as a shared communication medium that devices attach or tap into with an interface connector. A device wanting to communicate with another device on the network sends a broadcast message onto the wire that all other devices see, but only the intended recipient actually accepts and processes the message.
Ethernet bus topologies are relatively easy to install and don't require much cabling compared to the alternatives. 10Base-2 ("ThinNet") and 10Base-5 ("ThickNet") both were popular Ethernet cabling options many years ago for bus topologies. However, bus networks work best with a limited number of devices. If more than a few dozen computers are added to a network bus, performance problems will likely result. In addition, if the backbone cable fails, the entire network effectively becomes unusable.

Ring Topology

In a ring network, every device has exactly two neighbors for communication purposes. All messages travel through a ring in the same direction (either "clockwise" or "counterclockwise"). A failure in any cable or device breaks the loop and can take down the entire network.
To implement a ring network, one typically uses FDDI, SONET, or Token Ring technology. Ring topologies are found in some office buildings or school campuses.


Star Topology
Many home networks use the star topology. A star network features a central connection point called a "hub" that may be a hub, switch or router. Devices typically connect to the hub with Unshielded Twisted Pair (UTP) Ethernet.
Compared to the bus topology, a star network generally requires more cable, but a failure in any star network cable will only take down one computer's network access and not the entire LAN. (If the hub fails, however, the entire network also fails.)


Mesh Topology
Mesh topologies involve the concept of routes. Unlike each of the previous topologies, messages sent on a mesh network can take any of several possible paths from source to destination. (Recall that even in a ring, although two cable paths exist, messages can only travel in one direction.) Some WANs, most notably the Internet, employ mesh routing.

A mesh network in which every device connects to every other is called a full mesh. As shown in the illustration below, partial mesh networks also exist in which some devices connect only indirectly to others.

Open Systems Interconnection (OSI)
• Describes computer network communications.
• Developed by the International Standards Organization (ISO).
• Consists of Seven Layers.
• Model describes peer-to-peer correspondence, relationship between corresponding layers of sender and receiver.
• Each layer represents a different activity performed in the actual transmission of a message.
• Each layer serves a separate function.
• Equivalent layers perform similar functions for sender and receiver.


Who can cause security problem?
1. Hacker
2. Spy
3. Student
4. Businessman
5. Ex-employee
6. Stockbroker
7. Terrorist


Network security problem area:
1. Authentication - hacker want to be an autheriza user, so they am this first.
2. Secrecy - In the midle between sender and receiver.
3. Non- repudiation - deal with digital signature.
4. Integrity - Ensure that only authorize user allow to change the data.

Disadvantages of computing network
1. Sharing.
2. Complexity.
3. Unknown paramenter - alot of point on the network that possible to exploite to capture packet.
4. Ananomity - For a big network,we dont even know who at the other point. eg: some one may hack the DNS server before take over the website.
5. Sequrity exposure - Privacy, data integrity, authenticity, convert channel, impersonaty and evesdropping.

Threaten Network
1. Denial Of Service - DOS, DDOS
2. Packet replay - Capture packet that being sent to the AP that using WEP, but it use a lot of time so we use packet replay to dacoy the AP while sniffing the packet without change that packet's content.
3. Packet notification - capture and change the packet's content.

Firewall

A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. It is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all (in and out) computer traffic between different security domains based upon a set of rules and other criteria.


Firewalls can be implemented in either hardware or software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.


There are several types of firewall techniques:

1. Packet filter: Packet filtering inspects each packet passing through the network and accepts or rejects it based on user-defined rules. Although difficult to configure, it is fairly effective and mostly transparent to its users. In addition, it is susceptible to IP spoofing.

2. Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.

3. Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.

4. Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.

Function

A firewall is a dedicated appliance, or software running on a computer, which inspects network traffic passing through it, and denies or permits passage based on a set of rules.

It is a software or hardware that is normally placed between a protected network and an unprotected network and acts like a gate to protect assets to ensure that nothing private goes out and nothing malicious comes in.

A firewall's basic task is to regulate some of the flow of traffic between computer networks of different trust levels. Typical examples are the Internet which is a zone with no trust and an internal network which is a zone of higher trust. A zone with an intermediate trust level, situated between the Internet and a trusted internal network, is often referred to as a "perimeter network" or Demilitarized zone (DMZ).
A firewall's function within a network is similar to physical firewalls with fire doors in building construction. In the former case, it is used to prevent network intrusion to the private network.
In the latter case, it is intended to contain and delay structural fire from spreading to adjacent structures.

Without proper configuration, a firewall can often become worthless. Standard security practices dictate a "default-deny" firewall ruleset, in which the only network connections which are allowed are the ones that have been explicitly allowed.

KERBEROS

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. It is also a suite of free software published by Massachusetts Institute of Technology (MIT) that implements this protocol.

Its designers aimed primarily at a client-server model, and it provides mutual authentication both the user and the server verify each other's identity. Kerberos protocol messages are protected against eavesdropping and replay attacks.
Kerberos builds on symmetric key cryptography and requires a trusted third party. Extensions to Kerberos can provide for the use of public-key cryptography during certain phases of authentication.


DRAWBACK


Single point of failure: It requires continuous availability of a central server. When the Kerberos server is down, no one can log in. This can be mitigated by using multiple Kerberos servers and fallback authentication mechanisms.


Kerberos requires the clocks of the involved hosts to be synchronized. The tickets have a time availability period and if the host clock is not synchronized with the Kerberos server clock, the authentication will fail. The default configuration requires that clock times are no more than 10 minutes apart.

In practice Network Time Protocol daemons are usually used to keep the host clocks synchronized.
The administration protocol is not standardized and differs between server implementations. Password changes are described.

Since all authentications is controlled by a centralized KDC, compromise of this authentication infrastructure will allow an attacker to impersonate any user.

Web Application secure~~

WebGoat


WebGoat is a deliberately insecure J2EE web application designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application is a realistic teaching environment, providing users with hints and code to further explain the lesson.
The primary goal of the WebGoat project is simple which is created a de-facto interactive teaching environment for web application security. In the future, the project team hopes to extend WebGoat into becoming a security benchmarking platform and a Java-based Web site Honey pot.


To learn more about WebGoat, you can visit this link anytime: http://code.google.com/p/webgoat/source/browse/trunk/webgoat/main/project/WebContent/lesson_plans/HowToWork.html
Injection Flaws
Injection flaw like SQL injection will cause web application to run an SQL code that was not intended by the application. Usually user supplied data from an application is sent to an interpreter as a query command. With the knowledge of SQL query syntax the attacker exploit this feature by crafting a special crafted data to execute exploit command to the interpreter. By doing this attacker can create, read, update or delete any data available in the database through the web application.

The simplest way to protect against injection is to avoid accessing external interpreters wherever possible. For many shell commands and some system calls, there are language specific libraries that perform the same functions. Using such libraries does not involve the operating system shell interpreter, and therefore avoids a large number of problems with shell commands.
For those calls that you must still employ, such as calls to backend databases, you must carefully validate the data provided to ensure that it does not contain any malicious content. You can also structure many requests in a manner that ensures that all supplied parameters are treated as data, rather than potentially executable content.

The use of stored procedures or prepared statements will provide significant protection, ensuring that supplied input is treated as data. These measures will reduce, but not completely eliminate the risk involved in these external calls. You still must always validate such input to make sure it meets the expectations of the application in question. For more details on how to specifically defend against SQL Injection, please refer to OWASP's SQL Injection Prevention Cheat Sheet.


Malicious File Execution

Malicious File execution is another web application vulnerabilities caused by failing to control application input. In this attack, attacker will exploit the weaknesses by performing remote code execution and remote root kit installation and complete system compromise. On Windows, internal system compromise may be possible through the use of PHP’s SMB file wrappers
In other word this kind of attack will manipulate your web application to become the attacker remote terminal to execute command line instructions such as directory list, dir or displaying
network configuration, ipconfig. It will become more dangerous if the attacker manipulate this vulnerability by executing command that can create a backdoor to your server.

5# Database Security

DATABASE SECURITY

Why Database?
We use database because it is shared access, it will minimal the redundancy data. Moreover it contains Data consistency, Data integrity and Controlled access.


What is Database Secure?

It is the protection that is located in databases from unauthorized access. It is important because information is a critical resource in enterprise and securing data has become a billion dollar industry and people want to secure their confidential information not only from hackers but also from legal, professional direct marketing corporations.

A good database is based on Data independence, Shared access, Minimal redundancy, Data consistency, Data integrity Privacy which signifies that an unauthorized user cannot disclose data and integrity which ensures that an unauthorized user cannot modify data and Availability which ensures that data be made available to the authorized user unfailingly.


There are four levels of enforcing database security that is Physical security which such as storage medium safekeeping and fire protection, Operating system security which such as the use of an access control matrix, capability list and accessory list and DBMS security such as protection mechanisms and query modification and also Data encryption such as RSA scheme and data encryption standard.


There are five basic security requirements for database such as database integrity, element integrity, access control, user authentication and availability.

Database Integrity

Users must be able to trust the accuracy of the data values in database. Updates in database must be performed only to authorized individuals and most important is data must be protected from corruption either by an outside illegal program action and an outside force. One way for database to secure is to make a backup.

Element Integrity

DBMS maintains element integrity in three ways such as Field checks which tests the appropriate values in a position such as null value control, default value. Next is access control is controls the access rights to users such as the authorization to update certain element and at last Change log which maintaining change log for the database (a change log is a list of every change made to the database.

Why we need audit record?

This helps to maintain the integrity of a database or discover who had affected what values and when. It also enables users to build up access to protected data incrementally.


Access Control

In access control we focus on Recall, access control for Operating Systems which deals with unrelated data and with entire files and lastly with access control for Databases which deals with records and fields and also concerned with inference of one field from another.


Availability

We focus on Availability on Arbitration of two users' request for the same record and withholding some non protected data to avoid revealing protected data.

Good Internal Consistency.

To get a good consistency, error detection and code correction is needed. One of the way is Hamming Codes. Hamming code is a linear error-correcting code named after its inventor, Richard Hamming. Hamming codes can detect up to two simultaneous bit errors, and correct single-bit errors thus, reliable communication is possible when the Hamming distance between the transmitted and received bit patterns is less than or equal to one.

The goal of Hamming codes is to create a set of parity bits that overlap such that a single-bit error (the bit is logically flipped in value) in a data bit or a parity bit can be detected and corrected. While multiple overlaps can be created, the general method is presented in Hamming codes.

Other than that, good internal consistencies also depend on shadow fields, recovery such as back up, concurrency and monitor.

Secrecy Vs Precision
Secrecy

It is focus only data that is not sensitive and reject any query which mentions a sensitive field.

Precision

Protect all sensitive data while revealing as much no sensitive data as possible.
Do you know Inference?
It derived sensitive data from non- sensitive data. Three basic paths to controlling the inference problem that is suppressing obviously sensitive information, track what the user knows, and disguise the data.



Multilevel Security in Database.
1) Encryption

If sensitive data is encrypted, a user who accidentally receives sensitive data cannot interpret the data. It is not foolproof since the user can mount a plaintext attack and substitute the encrypted form of his or her data. Thus the solution is to use different encryption for each record and a different key for each field or just cryptographically link fields of a record by using a block chaining method such as Cipher Block Chaining (CBC), Cipher Feedback (CFB).


2) Integrity lock

It is a way to provide both integrity and limited access for a database. Method nicknamed 'spray paint' since each element is painted with a color which denotes its sensitivity. The color is maintained with the element and not in an external table. It can be classify on three way that is unforgeable which malicious subject cannot create a new sensitivity label for an element. Next is unique which malicious subject cannot copy a sensitive level from another element and lastly concealed which a malicious subject cannot even determine the sensitivity level of an arbitrary object.


3) Sensitivity lock

A sensitivity lock is a combination of a unique identifier and the security level. It must not be able to identify two elements having identical security levels just by looking at the security portion of the integrity lock. As a result of the encryption, the lock's contents, especially the security level, are concealed.


4) Trusted Front-End

A trusted front end also known as a guard functions much like the monitor we discussed while we were studying operating system security methods. Many DBMS built and put into use without consideration for multilevel security.

5) Commutative filters

This is an interface with both the user and database manager. The filter reformats query such that DBMS does as much of the work as possible, screening out many unacceptable records and provides second screening to select only data to which user has access.
Thank you for spending time to read this page. =)

Cryptography Extended ~~

Cryptography Extended

Cryptography algorithm used in cryptosystem can be classified into two categories which is symmetric and asymmetric encipherment. In symmetric encipherment, plaintext is encrypted
and decrypts using the same key whereas asymmetric encipherment is using different keys to encrypt and decrypt a plaintext.

Symmetric encipherment can be in form of substitution, transposition or both. In substitution encryption method alphabet in the plaintext is always changed with another alphabet. Each character can be either change with one character or multiple characters.

Transposition encryption method does not substitute character with another character but it changes the location of the characters. The character in the first position might be placed on the fifth position and the fifth position character might be placed in another location in the plaintext.

Asymmetric encipherment involves two keys to encrypt and decrypt. These algorithms allow the key to be publicized, hence anyone can encrypt using the key, and the proper recipient who knows the decryption key can decrypt the message. The encryption key is called public key and the decryption key is called secret/private key. RSA algorithm is use to produce the public and private key.

Symmetric encipherment (Caesar Cipher)

The Caesar Cipher is formed by shifting the letters of the original alphabet. For example by replacing each letter of the alphabet with the letter three places down the alphabet. It is monoalphabetic as only one letter in plaintext is exchanged for one letter of ciphertext.














This is example on how CIPHER CAESAR work

(Vigeneré Cipher)

The cipher text encrypted using Caesar cipher method is easily broken by using a brute force attack. An attacker can easily try every combinations of character to break the code as the number of possibility is just 26. In order to improve the deciphering process we can used the vigeneré cipher method. The Vigenère cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. It is a simple form of polyalphabetic substitution.















This is VIGENERE TABLE

Asymmetric encipherment

RSA Algorithm

Asymmetric encryption or called public key cryptography is a cryptographic approach, employed by many cryptographic algorithms and cryptosystems. Each encryption and decryption process is using a unique pair of key called public and private key. RSA algorithm is one of the algorithms used to produce the private and public key.

Each user generates a public/private key pair by selecting two large primes at random p, q and then compute their system modulus.

Example:
a) 999 mod 3

= 333 (3) mod 3 ---- (3) mod 3= 0
= 333(0)
= 0


b) 55 mod 57
55 mod 57 = 3125 mod 57
= 47 (baki)


c) Given p=3;q=11,e=7;m=5 ( c=57 mod 33)

n = p * q
= 3 * 11 = 33
Ø = (p – 1)(q – 1)
= (2)(10)
= 20
d = e-1 mod Ø(n)
= 7-1 mod 20

20 = 2(7) + 6
7 = 1(6) + 1
6 = 20 – 2(7)
1 = 7 – 1(6)
1 = 7 – 1(20-2(7))
1 = 7 – 20 + 2(7)
1 = 3(7) – 20

mod 20 = 3(7) mod 20 – 20 mod 20
7-1 mod 20 = 3 mod 20
= 3
d = 7-1 mod 20
= 3

PU = {e,n}
= {7,33}
PR = {d,n}
= {3,33}

C = Me mod n
= 57 mod 33
= 14
M = Cd mod n
= 143 mod 33
= 5


All calculations above are some examples for RSA algorithm. All use formula provided to get all the answers. Hope you get some valuable information here.

Thank you!

#4 Operating system security ~~

Hello..
Let’s talk about security in operating system. There are many items in operating system need to be protected such as memory, I/O devices, sharable data, sharable program and others. In security, there are many level of protection involved such as isolating, share all or share nothing, share via access limitation and others. There also have security method that is separation which includes physical, temporal, logical and cryptographic separation.

Memory Protection
What is memory protection should be? Memory protection is a system that prevents one process from corrupting the memory of another process running on the same computer at the same time. There are some methods involved in this protection such as fence, relocation, base/bound register, tagged architecture, segmentation and paging.
Let’s talk about fence.

Fence is introduced in single-user operating systems to prevent a faulty user program from destroying part of the resident portion of the OS. There are two type of fence that is fixed fence and fence register. Fixed fence is a method to confine users to one side of a boundary which enabling the OS to reside on one side and the user to stay on the other. Fence register contain address of the end of the OS which provide means of code relocation. For example, If (address > fence address), instruction was executed, If (address < fence address), error.

Relocation is a process of taking a program written as if it begins at address 0 and changing all addresses to reflect the actual address at which the program is located. It occurs by adding a constant relocation factor to each address of the program. Usually it used in multi user environment.

Base/ bound Register is one of the methods that also known as variable fence register. All addresses are offset from base register and provide a lower bound but not an upper bound. As it is not provide upper bound, it needs to add second register called bound register.

Tagged Architecture is method that can solve problem in base/bound register. Using Tag Architecture, every word of machine memory has one or more extra bits to identify the access rights to that word. However, there are also problem occur here which effect code compatibility and locked into convention despite low cost of memory.

Segmentation involves the simple notion of dividing a program into separate pieces which each piece has a logical unity, showing a relationship among all of its code or data values. It is developed to produce the effect of the equivalent of an unbounded number of base/bounds registers. Segmentation allows a program to be divided into many pieces which having different access rights.
Here are processes involved in segmentation:

1. A program generates an address of a form (hiding of addresses)

2. The OS looks up name in the segment directory and determines its real beginning memory address

3. OS will add offset by giving the true memory address of the code or data item to that address
– This process called translation

Segmentation provides protective benefits for user which each address reference is checked for protection. Many different classes of data items can be assigned different levels of protection. Other than that, there are two or more users can share access to a segment with potentially different access rights and a user cannot generate an address or access to an unpermitted segment.

Paging is a program that divided into equal-sized pieces called pages and memory is divided into equal-sized units called frames. There are some advantages of paging such as each page is the same size thus fragmentation is reduced. Next, addressing beyond a page is not a real problem since a carry just refers to the next page. The disadvantages for paging is it loss of individual access rights since there is not necessarily a relationship between lines of code in a page unlike program segmentation.
By combining the paging and the segmentation there will be some advantages which it retained the logical unity of the segment and permitted differentiated protection for the segments. Unfortunately it is added an additional layer of translation for each address.

Authentication

Authentication is a process used to verify transmitted data in a computing environment. In authentication, the claimants should present some kind of principal identity to prove themselves and it can be divided into two contexts such as Entity authentication (EA) and Data origin authentication (OA).

There are some threat that damages the authentication such as Spoofing which swindling of information by crackers or hackers, eavesdropping which tapping into the communication line to grab information transferred between two computers, modification which altering or changing information and masquerading which having a fake interface of the system to get information from user input such as passwords and user name.


That’s all for today. =)

# 3 ~ Program Security

Assalamualaikum..
=)

hye there!
today i want to share some new information about program Security.
Here, i will tell you some information about viruses, worms, malicious codes and many more.
But, let's start with Secure Program.

Secure Program
--------------------------------
Different people have different perspective on software quality.
Usually, developer will track faults during design and code inspection.

Fault?
what is fault?

A fault is defined as an abnormal condition or defect at the component, equipment, or sub-system level which may lead to a failure.
Fault - inside view from the developer

Failure?

Failure is refers to the state or condition of not meeting a desirable or intended objective, and may be viewed as the opposite of succes
Failure - outside view from developer and are effect of faults.

Bug

Bugs is common term used to describe an error, flaw, mistake, failure, or fault in a computer program or system that produces an incorrect or unexpected result, or causes it to behave in unintended ways.

What is Flaw?

We use flaw as a synonym for bug, hence (in IEEE terms) as a synonym for fault, except that we include flaws that have been inserted into a system intentionally, as well as accidental ones.

Types of Flaws:
* Validation Error
* Domain Error
* Serialization and aliasing
* Inadequate identification and authentification
* Boundary condition violation
* Other exploitable logic error.

Non-malicious Program Errors?

There are two kind of Nonmalicious Program Errors:
* Buffer overflow
* Incomplete mediation which refer to data exposed or uncontrolled.

There are some attack associated to program error:
* Cross site scripting
* injection Flaws
* Malicious File execution
* Broken authentication and session management
* insecure crypto storage.

Now let's move to a topic called Virus and Other Malicious Code.

Malicious Codes
--------------------------------

Malicious codes can do harm and can also be accidental.

Malicious codes is unanticipated or undesired effects in programs generated on the intent of damage.
Damage could be in form of:
* modification
* stolen data
* unauthorized access
* Damage on system

Example of Malicious Codes:

* Trojan Horse - a program which performs a useful and unexpected function as well.
* Virus - code segment which replicates by attaching copies to existing executable.
* Worm - a program which replicates until it fills all disk space or CPU cycles.
* Logic Bombs - malicious code that activates on an event.
* Trap door or Back door - undocumented entry point that allow unwanted user.
* spyware - can steal your information which done by keystroke logger and even though you use encryption on connection the damage is already done before you can send it. It also can steal your email addresses, can see what Websites you visit, can pop ups ads, slow down computer and crash our computer.

Viruses and Malicious Program
-----------------------------------------------

Computer viruses have the ability to replicate themselves on an ever increasing number of computers. They original spread by people sharing floppy disc. Now they are spread primarily over the Internet.

Malicious Program may be installed by hand on a single machine. They may also be built into widely distributed commercial software package. They are hard to detect before the payload activates.

Malicious program is divided to two part which is 'Need Host Program' and 'Independent'.

Need Host Program contains trapdoors, Logic Bombs,Trojan Horses and Viruses
Independent contains Bacteria and Worms (same species)

Okay, Let's talk about Viruses
------------------------------------------------

Personal computer viruses exploit the lack of effective access control in these systems.
Viruses are divided to two:
* transient which only executes when the program that it is attached to runs.
* Resident which once the program executes the virus stays in memory until it gets triggered again. Terminates and stay Resident (TSR).

There are some characteristics of virus:
* replication
* required a host program
* activated by external actions.
* replication is limited to virtual system.
* designed to attack single platform.

How Virus Attach?
------------------------------------

There are three ways for virus to attach:

1) Append Viruses which is execue first then transfer control tooriginal program.
2) Surround Viruses which has control before and after regular program.
3) Integrated Viruses which replace some of the target program or all of the target and give the effect that the target program worked.

A = original program
B = Virus B

A + B = AB or BA;
How Virus Gain Control
-----------------------------------------

The virus needs to have the CPU execute it to be in control. One way for them is to overwrite the program on the disk.
Another way is to move the original program and then after the CPU executes it then and then after the CPU executes it then transfer control to the program.
Another way is to install itself in memory and change the pointers of the operating system or interrupt table to point to it.

Home for Viruses
----------------------------------

* Viruses install itself in the boot sector (MBR) master boot record.
* Memory Resident Virus (TSR) which is to terminate and stay resident.
* Application like word processor and spread sheets and even attachment to email.
* Even attachments to vendor distributed programs or games.

The Source of Viruses
---------------------------------------

Virus program can be small so it hides very easily in a large program. It might hide in a compiler, a database manager or file manager.
The number one spot is an attachment to email or some public download file.

Virus Phase
----------------------

* Dormant phase : the virus is idle

* Propagation phase : the virus places an identical copy of itself into other programs.

* Triggering Phase : the virus is activated to perform the function for which it was intended.

* Execution Phase: The function is performed.

There are five types of viruses:
--------------------------------------------

* Parasitic Virus: attaches itself to executable files as part of their code. Runs whenever the host program runs.

* Memory- Resident Virus: Lodges in main memory as part of the residual operating system.

* Boot Sector Virus: infexcts the boot sector of a disc and spreads when the operating system boots up.

* Stealth Virus: explicitly designed to hide from Virus Scanning programs.

* Polymorphic Virus: mutates with every new host to prevent signature detection.

Virus is so dangerous for our computer and files. So, How to prevent Virus Infection?

* Protection against Viruses which we need detection tools such as scanner and vulnerability monitors, then we need identification tools and removal tools such as disinfector.

* Scanner and disinfectors are the most popular classes of antivirus software.

* Personal and administrative practise

* Make a bootable disk with a virus scan program on it and write protected.

* Make and retain backup copies of executable system files.

* scan any downloaded files before runs.

* Updates the virus signatures data files.

* Use only commercial software.

* Do not open attachment without any scanning.

* do not put floppy disc in machines.

Now let's talk about Worm.
-------------------------------------

Worm have some characteristics:
* self-contained which do not required host.
* replication
* activated by creating process.
* replication occurs across communication link (network worm).

How Worm attack?
A = original prograam
B = Worm

A + B = A+B+B;

How to protect files from Worm..?
-----------------------------------------------------

* requires a combination of basic system security and good network security.
* add- on tools which have configuration review tools, checksum and intrusion detection tools.

* network security tools which contains wrapper program and firewall system.

Trapdoors
------------------------------

is often caused by programmers leaving debug routines in the code or failure to check array bounds which lets code overrun the array bounds and get placed on the stack.

Maybe programmer forgets to remove them or intentionally leaves them in for testing.
Maybe programmer also leave it intentionally for maintenance of the finished products.

Pillar of Software Security
--------------------------------------

* Risk Management - Help user to understand what they should do abaout risk and build better software.

* Touchpoint




















* Knowledge which includes principles, guidelines, rules, attack patterns, vulnerabilities and Historical risks.

Okay, i pen off now..

#2 Authentication & Encryption (cont..)

Modern Algorithms

Most modern ciphers use a sequence of binary digits (bits), that is, zeros and ones such as ASCII.
This bit sequence representing the plaintext is then encrypted to give the ciphertext as a bit sequence.

The encryption algorithm may act on a bit-string in a number of ways:

Stream Ciphers where the sequence is encrypted bit-by-bit.
Block Ciphers where the sequence is divided into blocks of a predetermined size.

ASCII requires 8 bits to represent one character, and so for a block cipher that has 64-bit blocks, the encryption algorithm acts on eight characters at once.

Since most modern algorithms operate on binary strings we need to be familiar with a method of combining two bits called Exclusive OR and often written as XOR.

0 + 0 = 0, 0 + 1 =1,
1 + 0 = 1 and 1 + 1 = 0

Message Authentication Codes (MAC)

A MAC is a key-dependent one-way hash function. Only someone with the identical key can verify the hash. They are very useful to provide authenticity without secrecy.
MACs can be used to authenticate files between users. To determine if his files have been altered.

Digital Signatures

The digital signature for a message from a particular sender is a cryptographic value that depends on the message and the sender.
In contrast , a hand-written signature depends only on the sender and is the same for all messages.

A digital signature provides data integrity and proof of origin (non-repudiation).
It can be kept by the receiver to settle disputes if the sender were to deny the content of the message or even to deny having sent it.

Each user has a private key that only they can use and its use is accepted as identifying them.
There is a corresponding public key.

Anyone who knows this public key, can check that the corresponding private key has been used, but cannot determine the private key.This gives the receiver assurance of both the origin and content of the message.

Figure 2:Digital signature Verification process.

Attacks on Digital Signature

-----------------------------------

Suppose digital signatures are being used as a means of identification. If user A wishes to impersonate user B, then there are two different forms of attack:
**A attempts to obtain the use of B’s private key

**A tries to substitute their public key for B’s public key.

RSA

------

** by Rivest, Shamir & Adleman of MIT in 1977 .
** best known & widely used public-key scheme .

RSA Use

** to encrypt a message.

** to decrypt the ciphertext.

RSA Security

There are some possible approaches to attack RSA :
** brute force key search.
**mathematical attacks (based on difficulty of computing)
**timing attacks (on running of decryption)
**chosen ciphertext attacks

Methods of Attack

---------------------

Four general attacks can be perform against encrypted information:

** Ciphertext- only attack guessing the plaintext or using frequency analysis
** Known Plaintext- guess using known pliantext.
** Chosen-plaintext
** Chosen-ciphertext attack

Okay I pen off here. I hope everybody will get some knowledges from my page.

More details, you can refer to others references or ask the expert!

=)

# 2: Authentication & Encryption

Assalamualaikum..

=)

Today i would like to share some knowleges about authentication and encryption..

sounds interesting,huh?

hehe~~

What is authentication?

---------------------------

Based on httpd://apache.org , authentication is any process by which you verify that someone is who they claim they are. In other word, authentication is verification of identity of someone who generated some data.

Identity verification can be classified by:

* something known, e.g: password

* something possessed, e.g: passport

* by physical character, e.g: finger,retina, voice.

We need to make sure that the message comes from apparent or known sources or author, and the content have not been altered at all.

Okay, now let's talk about password. I think most of you are familiar with password, right?

Usually, before we want to log in to other websites such as blogger.com, myspace, facebook or others, we need to insert username and password for security.

That is the most important purpose of password which provide protection to our data. Thus, do not ever keep your password to anybody!

To get a good protection, we need to have a good password which it is hard to guess but easy to remember.

Characteristics of good password:

* not shorter than six character.

* not patterns from the keyboard.

If we have a good password, it is hard for other persons to crack our password.

Do you want to know about time taken to crack password?

If number of characters is One, the total combination of character should be 36 and time taken by human to crack the password is 3 minutes.

If number of characters is four, the total combination of character should be 1700000 and the time taken by human to crack the password is 3 month.

and what about if the number of character is 10 or 12..? count yourself..hehe~~

That is the reason why the password should be in six character and you are encourage to have a combination between number and character in one password so that it will be more secure.

Do You Know?

-----------------

Keylogger allows you to find out what other users do on your computer in your absence. It is designed for the hidden computer monitoring and the monitoring of the computer activity. Keylogger is capable of catching all keystrokes, capturing the screen, logging the programs being run and closed, monitoring the clipboard contents.

Strategies To Select Password

------------------------------------

* User education

* Computer-generated passwords

* Reactive password checking ( occur when user generate a password, then the system will check whether the password exist or not)

* Proactive password checking ( the system will check how strong the password that has been generated.)

Cryptography

----------------

Cryptography is, traditionally, the study of ways to convert information from its normal, comprehensible form into an obscured guise, unreadable without special knowledge.

Encrypted document does not prevent unauthorized people gaining access to it but rather ensures that they cannot understand what they see.

Here, we use idea of cipher system which disguise information in such a way that its meaning is unintelligible to an unauthorized person.

In encryption, we need to be familiar with some terminologies such as plain text, ciphertext, cipher, key, encipher and decipher.

plaintext = original message

ciphertext = coded message

Cryptoghraphy Algorithms

Do you know about this kind of operation?

Cryptography algorithms is a type of operations used for transforming plaintext ( original message) to ciphertext (coded message).
The number of keys used is symmetric (single key or private-key encryption) and asymmetric (two-keys, or public-key encryption).This is the way in which the plaintext is processed.

Methods use in Cryptography Algorithm

Substitution

There are two types:

** Monoalphabetic substitution.
It formed by shifting the letters of the original alphabet.

**Polyalphabetic substitution
Extension of monoalphabetic substitution system which use Vigenere Tableau.

Transposition

This method also has two types:

** Unkeyed transposition
Rearrange letters by using matrix
**Keyed transposition
Rearrange letters by using matrix where the size of matrix is determined by the length of the key used.

Caesar Ciphers

In this cipher each of the letters A to W is encrypted by being represented by the letter that occurs three places after it in the alphabet. Although Caesar used a ‘shift’ of 3, a similar effect could have been achieve using any number from 1 to 25.

The encryption key and decryption key are both determined by a shift but the encryption and decryption rules are different.

For example: : Encryption with shift 8 is the same as decryption with shift 26 - 8 =18.

This enable us to use the same rule for encryption and decryption with the decryption key 18 corresponding to the encryption key 8.

Let's Play!

Find The message behind this cipher text:

YMJ KPJQ UWNHJ BNQQ NSHWJFXJ YT WH KTZW GD SJCY BJJP

=)

-------------------------------------------------------------------------------------------------Simple Substitution Ciphers

For a Simple Substitution Ciphers (or monoalphabetic ciphers), we write the alphabet in a randomly chosen.

The encryption and decryption keys are equal.
The encryption rule is ‘replace each letter by the one beneath it’ while the decryption rule is the opposite procedure. For example:

A B C D E F G H I J K L M
D I Q M T B Z S Y K V O F

N O P Q R S T U V W X Y Z
E R J A U W P X H L C N G

The number of keys for a Simple Substitution Cipher is equal to the number of ways in which the 26 letters of the alphabet can be arranged.

Vigenere Cipher

The Vigenere Cipher (the best known of the manual polyalphabetic cipher) uses a Vigenere Square to perform encryption.
The left-hand (key) column of this square contains the English alphabet and for each letter, the row determined by that letter contains a rotation of the alphabet with that letter as the leading character.
So each letter in the left-hand column gives a Caesar Cipher whose shift is determined by that letter.
Example: the letter g gives the Caesar Cipher with shift 6.

Figure 1: Vigenere Table - Vigenere Tableau

Virtualization & VMWare

Assalamualaikum..
=)


Virtualization
------------------

Dear friends...
Do you know about Virtualization?
Let's start our lesson...

Hardware was the first part to be designed in a computer system. It is followed by the software
part. Each hardware was specially designed with its own instruction set and developed with its own specific software.

The need of software that is compatible with any hardware becomes an important consideration in developing a new computer system.

This can be achieved by producing hardware that has a standard feature. One way to achieve this is by defining and controlling the interface between hardware and software. This is where the concept of Instruction Set Architecture (ISA) was introduced.

A new problem arises following the introduction of ISA. The operating system developed was only compatible with the hardware from the same vendor. Due to this reason many operating systems were developed for particular system architecture only and cannot be implemented in other machines that have different architecture. For example, Windows application binaries will not directly execute on PowerPC processor.

Virtualization eliminates these constraints and enables a much higher degree of portability and flexibility. Software is added to an execution platform to produce virtualization to give it the appearance of a different platform.

Virtualization supports an operating system, instruction set, and computational resources which differ from those available on the underlying software. One of virtualization environment created by such software is called virtual machine.

Virtual Machine -----------------------

Virtual machine is defined as an efficient and isolated duplicate of a real machine. This environment is created by using Virtual Machine Monitor (VMM) which provides a second layer on a machine for another operating system to run on it.

VMM reproduces everything from the CPU instruction to the I/O devices in software of operating system which it run on. Virtualization in VM involves mapping of virtual resources, for example, the register and memory to real hardware resources and it also use the host machine instruction to carry out the actions specified by VMM. This is done by emulating the host ISA.

The underlying operating system is called the host operating system. VMM runs on top of the host operating system, thus it can hold a second or more operating system on it. The operating system which runs on VMM is called the guest operating system.

The host operating system and the guest operating system can either be of the same or different type of operating system. For example, Windows can runs as the host operating system and Linux as the guest operating system.

VMWare, Connectix, UMLinux and Xen are some examples of a more recent VMM that has been developed. Another close environment which also provides virtualization is called emulator. The difference it has when compared to VMM is that it only let one guest operating system to run on the host system.

Installation of VMWare -----------------------------

VMware Workstation can be downloaded from http://www.vmware.com/download/ws/

1. Double Click on the VMware launcher to start the installation Wizards.

2. Click on [Next].

3. Choose Typical setup type.

4. Choose the location for VMware Workstation installation, example: C:\Program Files\WMware\VMware Workstation\

5. Click on [Next].

6. Configure the shortcuts for the VMware Workstation and click [Next].

7. Click on [Install], this will take several minutes to finish.

8. Enter the Serial Number for the VMware workstation.

9. Click [Finish], and restart the Computer.

VMware Workstation makes it possible for PC user to use Multiple Operating Systems concurrently on the Same PC.
User can create and run multiple virtual machine on desktop or laptop computer. VMware Workstation let you create a virtual machine that can be installed with different kinds of Operating System.

Virtual machine residing on a disk image that can be cloned and copy from one host to another host by simply drag and drop thus providing mobility to user.

Another advantage of VMware Workstation is that on the same host user can run multiple virtual machines containing different OS side by side and by just a click of a mouse you can switch to different OS and share files by just drag and drop. User can even create their own Local Area Network (LAN) inside the VMware Workstation by using several virtual machines.

The ability to preserves the state of virtual machine by taking a “snapshot” make it easier for user to do testing on virtual machine without worrying that the system will crash or corrupt. The snapshot ability let user to revert back to the OS previous state if there is any crash or corrupt occur during the testing.

Creating Disk Image -------------------------

How to create disk image in virtual machine?

1. From the home tab click on [New Virtual Machine], to open the virtual machine wizard.

2. Click [Next] to continue.

3. Choose the typical configuration, click [Next]

4. Choose the type of OS to be installed on the virtual machine. As the next task the virtual machine will be installed with Windows Server 2003, select [Microsoft Windows] as the guest. In the version list, select Windows Server 2003 Standard Edition. Click [Next].

5. Name the virtual machine and specify the location where the disk image for the virtual machine will be stored in the hard disk. Name the virtual machine as winserv03.

6. For the network type select [Use host-only Networking], this selection will create LAN between the other virtual machine. In order to make the virtual machine connected to the real
network select [Use bridged networking]. This setting can be changed once the virtual machine is created. Click [Next].

7. Specify the disk capacity of the virtual machine. This option will let user to specify the maximum storage capacity of the virtual machine. Select [Allocate disk space now] and click
[Finish] to start creating your virtual machine. This will take several minutes.

How to Install Window Server 2003 on virtual machine? -------------------------------------------------------------------

1. Place the Windows Server 2003 installer CD in your cdrom drive.

2. Click on [start the virtual machine] or you can click on the start button on the toolbar, your virtual machine is starting and will be booting from your cdrom drive.

3. Once the winserv03 booting you will see the familiar windows server 2003 installation page, from this point onward you can follow the windows server 2003 installation step.

4. After the installation process is finish, you will see the windows server 2003 login page.

------------------------------------------------------------------------------------------------

I hope you will get some informations from my page. If you have any questions, please leave me some comment then.
I pen off now..Thank you..
=)