Who is using linux?

Running Linux

Matt Welsh

Life time of Malware and complex malware - authors...supposed

Test-net address

Link-Local addresses are assigned automatically by the OS environment and are located in the block 169.254.0.0/16. The private addresses ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. TEST-NET addresses belong to the range 192.0.2.0/24. The addresses in the block 240.0.0.0 to 255.255.255.254 are reserved as experimental addresses. Loopback addresses belong to the block 127.0.0.0/8.

Virus Definition

Signature-Based Detection Definition

Socially Intelligent Computing

Socially Intelligent Computing

·         By: Daniel Goleman; Clay Shirky

Goleman: The way I understand that is that when we're talking to someone face to face when we're with someone in real time, and in real life, the social brain is in its natural ecological niche. It's picking up information that it wants, moment to moment. It's reading porosity invoice, it's reading emotions, it's reading non-verbal cues. And it's doing it invisibly and constantly out of awareness, and then telling us what to do next to keep things smooth, to keep things in sync, to keep things on track, so that we can get to where we want to go. The problem from my point of view with the design and maybe the hardware itself of the web is that is it has no channel for the social brain to attend to. You have no emotional signal in real time. You have nothing for the orbital frontal cortex, which is dying to get this information to latch onto, and one of the main functions of that part of the social brain is to inhibit impulse. To say, 'no, don't do that, do this. And it has nothing to go on so we're flying blind and as far as I can see, the web is actually designed to optimize flaming.

Shirky: That's exactly right. In fact I've often joked that if you looked at the software for supporting, say, a mailing list, you would never find anywhere in the code something that said 'this next bit of code ensures that people will get into huge vituperative arguments that last weeks and weeks and involve lots of name calling'. And yet when the software is deployed in the field, reliably that's the effect. And so plainly there is something social going on. Flaming, interestingly, is, in fact, one of the most social effects and one of the earliest ones to be commented on, because it's much more severe in groups than it is in two-person exchanges. Famously, one of one of the antidotes to flaming is to contact the flamer personally by email and very often people find that you have a much more reasonable conversation. When you take them out of the social part of the conversation where they're performing in front of an audience, and address them as an individual, they become much less prone to the kind of name-calling and vituperation. But in the group setting, designing software that actually inhibits flaming has proved to be fantastically difficult. And as a design challenge, something I keep looking for is what principles would you try to engage if you wanted to create an environment that was more convivial to group agreement and conversation, rather than just altercation and disconnect.

Goleman: Well I remember a conversation years ago with Mitch Capo about this very problem, and what he was suggesting was re-engineering the web itself so that there was real time, basically so that it's a conference call with the picture. If you have a video conference, you at least know what the person who's not saying anything is feeling about what you're saying. You can see how the group moves, by posture even, whether there's consensus or dissent, who wants to speak next or not. You don't have it on the web. Frankly, I don't see that happening anytime soon, so we're left with the dilemma of how to reverse-engineer what we have now to make it work better. Do you have any ideas?

Shirky: I think that sense of reverse engineering is absolutely right. The Internet has had truly major upgrades only two or three times in its entire history. It's a very difficult proposition to change the basic structure. But it's had lots and lots of changes, which involve what David Weinberger calls 'small pieces loosely joined': some additional piece of software. And I think that essentially opening up the channel for communal awareness, somehow adding that channel, is a big is a big design challenge, and I think a huge opportunity. You alluded earlier to our inability to get the sense of the room, the read of a room. If you're in a meeting and someone is saying something you can immediately tell whether or not there's basic agreement, basic disagreement, whether people are rapt or bored. On the net, for instance if you're on a mailing list, not only is that not possible but if someone posts something that captures the mood of the crowd and someone else follows up that message by saying, 'oh yes, me too' or 'I agree', that's actually considered rude. So it's actually both social and technological pressures that are suppressing a lot of that kind of emotional awareness. One of the things that instant messaging has shown us is that awareness of someone else in real time, if I'm instant messaging with you, I have a different sense than if we're emailing, simply because of the acceleration of time. There's been a lot of looking at whether or not presence can be made more general. And presence can start to convey things more than just 'I am here and breathing and attending to the computer' but 'I am here and I agree'. 'I am here and I disagree'. So in a number of pieces of relatively novel chat software, there's one wonderful piece of chat software called a really simple chat. It's just an open source tool but it works in pretty much any web environment. In addition to type what you would like to say here, there's also red, yellow, and green buttons. If you click a red button after someone says something, it just shows up with your name meaning I disagree. Its not 'I'm going to construct a whole written disagreement' it's just 'I disagree'. The green button is 'yes, absolutely I agree with that'. And there are ways that people can convey those emotional senses that make those chats in that environment emotionally rich, or socially richer, than in the more tenuated text only environments.

Goleman: Do you think that kind of patch, so to speak, might help move away from what the current myth is - that social software as it exists now actually supports group decision-making, actually supports business function, and actually supports meetings? People tend to believe that what they get is what they need, but what you're saying is that there are implicit omissions in the software that we use to, for example, try to come to a collaborative decision. Or if you're the WHO or Accenture and you have a global team trying to work on how to eradicate HIV in Africa or you're trying to roll out a new product in Shanghai and Berlin and you've got people who never see each other, but who operate together via the web, what they don't realize is that the very mechanism they're using has blind spots. And the kind of thing you're suggesting is a way to correct that.

Shirky: That's right, I often say that social software is not better than face-to-face contact, it's only better than nothing. There was a period that people wanted to believe that this as a channel was essentially better than face-to-face contact, or somehow superior. In a handful or circumstances its virtues work well enough, for instance if you're trading source code. If you're trading source code, you'd actually like a kind of asynchronous and logic-heavy environment. But if you're really trying to get a group to come to a decision that they don't just have to agree to rationally, but they also have to emotionally buy into - a business that's starting, a risky new enterprise, or a group of people that's going to set out in some direction as explorers, whether physical or intellectual in any medium, what internet tools now will help you do is come to some rational listing of pros and cons. But it won't help the group attain that emotional core of agreement that keeps people together.

Goleman: Well there's a real flaw there, and it has to do with how the brain makes decisions. Antonio Damasio, who is an expert on what I'm calling the social brain and the emotional centers, tells this story and this is a very important case in point of a brilliant corporate lawyer who had a pre frontal brain tumor that was discovered early and operated on successfully. During the operation they disconnected the links between the brain's pre-frontal cortex, the brain's executive center, and the emotional centers. And after surgery it was quite intriguing, because this guy who had been brilliant was still brilliant. He had no loss of memory, no deficit of attention, but he couldn't do his job anymore. And Damasio was completely puzzled because on every neuropsychological test he was perfectly fine. And then one day he gets a clue as to what was wrong with this guy, he says 'when should we have our next appointment?' And he realizes the guy can give him every rational pro and con for the next two weeks, but he doesn't know which is best. Damasio argues that in order to make a good decision individually, we need to attune to our emotional centers, because a vast amount of information processing goes on out of awareness. And our entire life wisdom on the current topic, the current decision, you know, 'should I adopt this business strategy?' 'Should I leave my job?' Who should I marry?' Whatever the decision, it isn't made purely rationally, it's made because the emotional centers valence information for us, and give us a gut sense of what's right and what's wrong. Lacking that, he says, we have no moorings, and what you're describing in the collective situation is software that will help people make the emotional decision without any emotional valencing. When you're face-to-face and you're in a room, you can see people's expressions, you can tell their tone of voice, you pick up a multitude of non-verbal signals that tell you in every moment how we collectively feel about what's being said. So here's the question, it seems that there is huge power in information processing collectively to be had in web discussions, but if you're functioning as a group, when do you need to get together? When do you need to have that conference call? When do you need to be together for two days to get to know each other as people and establish trust? Do we have any good rules of thumb?

Rules of Thumb for Online Collaboration

Shirky: That’s a really interesting question, and in fact you've just covered one of the big 'aha' moments for me in social intelligence. I've often told my students that emotion is your best tool for traversing large decision spaces. They will get very worked up about breaking down the variables exactly like the guy in the Damasio story. And the fact that it ultimately has to come down to a very narrow set of decisions means that they have to find some way to compress that huge number of variables. And we greatly overlook emotion as a decision-making tool in favor of doing things like decomposing, ranking, and adding, as has often been taught in business schools. Just before I came to this meeting I was having a conference with a former student who now taken his thesis research and is launching a business out of it. And as happens the collaboration with the department once it's gotten out into the real world is under stress because one of his business partners is also working on a different idea at the same time. And so he's absolutely torn about how to structure this because this person is both a key collaborator in the business and also a long time friend. And he was going back and forth and back and forth and clearly not coming to much of a decision and I finally said look just take out a coin. Heads you're going to try and work with the guy, tails your going to not try and work with him. Flip the coin in the air, and the minute it's in the air, figure out which side you hope it comes down on, and do that. Throw the coin away.

In terms of when you should meet face-to-face, there are two different models I call them the umbrella model and the banyan model, although since those are such different objects I need better words for it. But the umbrella model is you periodically close together and then spread out. Close together and then spread out. I've been the chair of two large-scale distributed network design efforts over the last five years. One was for the Library of Congress's Digital Preservation Network, which involved a consortium of research libraries talking about how we're going to share this material. The other, more recently, which I still have, is the chair of the technical sub-committee of a clinical data exchange network, a medical network. And my rule of thumb is your first face-to-face meeting should be as soon as you can possibly make it. In practice we've ended up having that meeting be after an introductory phone call which sets the themes, but the earlier you can have face-to-face contact, the sooner you can take advantage of the kind of remembered valence of personality and so forth. I think everyone has had the experience of emailing back and forth with someone, whether it's a new friend or someone you meet online, or someone in your business. Then meeting in person. Afterwards, the email takes on a very different tone. And this is really bad news for much of the business communications world, who have from the mid 1960's with the AT&T videophone been pushing the idea that communication will be a substitute for travel. In fact communication's a spur to travel. When people meet and talk in mediated environments like the Internet, eventually they want to meet and talk face to face.

Goleman: Let me give a perspective from the social brain because what you're saying really is that social brains need to attune before they can before they can use a shorthand. Because what happens face-to-face is you come to know the person in a very deep way which actually builds representation in your own brain of that person - of who they are, of their style, of their feelings, and your feelings about them. Lacking that, you don't know how to take things that are said. I got a very interesting email from a women that works for my publisher and she and I had been in a meeting once but not spoken and then we had an email exchange and at one point she sent me the following email. She said: "It's difficult to have this conversation by email. I sound strident and you sound exasperated." Now what's intriguing to me is that I had no idea that I sounded exasperated, nor that she was strident. But once she named it, I realized that there was something really off. And the problem with email alone is that you can be off and not know it, and a small seed of off grows into a big misunderstanding. I was just in Europe and I was talking to someone who is consulting to two big European telecoms who have a business alliance, and he said the whole thing was a great business idea, great business plan, great business projections, but it is stalled from the get go because two sets of engineers are flaming at each other. And his solution was to get them together for two days and let them know each other as people, and on top of that to work out norms for how they're going to communicate online together going into the future.

Shirky: The engineering model is another way to approach the problem, and that's the thing I'm calling the banyan model, which is not the whole group gets together all at once periodically. Very often in large distributed businesses you can't do that. But you put down little roots of face-to-face contact everywhere. I had someone who was the head of a global IT department for a bank. Talking about the design of social software he said 'what can we do to replace face-to-face?' and I said, 'you can't. What you should be doing is using face-to-face to sort of strategically augment electronic communications. The bank is global, the security people in Singapore are going to stay in Singapore the security people in London are going to stay in London, and you've got to have the distributed 24/7 communication of the internet as a piece of that, but you should periodically eat the expense of flying those people someplace where they can get together from time to time.

Goleman: Let me add to that because it's not just that you want people to have a business meeting - you want people to get to know each other.

Shirky: Absolutely, in fact one of the design principles that I try to run is when you get a bunch of people together looking at a theme from different angles, you must have dinner. Even if you're doing a day of work, it's better to break it across two half days where you have a dinner and an overnight, where people sleep on it and re-synthesize. The first day is where the information comes up, but the second day is where the work gets done. And carving out some social space for people to just hang out and talk to each other is essential.

Goleman: The fact that Wejung in Shanghai knows Carlos in Barcelona has four daughters and his wife is an opera singer. And Carlos knows that Wejung's wife teaches English in a college and he has one son and that bit of knowing you as a person is background, because it builds a foundation of trust and understanding that is a safe container for when things might go awry otherwise.

Shirky: One of the design principles that I think anybody managing groups has to deal with is to realize that the group is a unit that's separate as a unit from the individual. And so much focus has gone on individual employees and career paths and so forth that regarding the group as anything other than an accidental conglomeration too often gets cast by the wayside. One of the things you'd really like to have happen, particularly in the business setting with distributed groups, is not for everyone to know everyone on a large scale, that is simply impossible even in companies that are physically in the same city. But when two groups interact you'd like at least one person in that group to know one person in the other group, because that prevents enemy culture from appearing. There's a wonderful book by Wilfred Bion, the group psychologist of the middle 20th century, who outlined the ways in which the group would silently collaborate with one another and he outlined the things that produced group cohesion. One of the things that he said which has always struck me as indicative for some kinds of businesses is that nothing creates group cohesion faster than an external enemy. And that in cases where a group doesn't really face an external enemy, they will tend to rally around their most paranoid member because that person is best at locating enemies where there are none. And so to defeat enemy culture you really want some strand, that kind of deep knowing, to go across whatever bit of geography or hierarchical separation the company has. And that network works differently than, but strengthens the ability of, hierarchically organized groups to also get things done.

Goleman: You know, since Bion there's been an updating of our analysis of group dynamics and it's a guy who started in the same psychoanalytic T-group tradition that Bion was in, his name was Freed Bales, I had a course with him when I was a graduate student at Harvard years ago. The course was fascinating, because it was two classes at once. I was in the graduate course and there were eight of us behind a one-way mirror and on the other side of the mirror there were thirty Harvard undergraduates who met twice a week in a class that was this group where they were told nothing about what to do or how to do it. And the class was to simply observe what happens in free space when people get together, which is a beautiful analogue of the web. And Bales developed a system to analyze it called Symlog. Symlog its an acronym for systematic, multiple level observation of groups. And the fascinating thing about Symlog is that there are now decades of findings of groups. And the one place that this has not been applied so far as I know is to social dynamics on the web. But let me give you some of the next generation, after Bion, thinking about groups.

Bales had a typology of groups. One is the unified group. This is what I guess Bion called the cohesive group, the well-functioning group, this is the star performing team. This is the group that gets it done on time with everybody in good spirits and celebrates. Then there's a group where people are simply fragmented, where people are off, they're just not working together. And then there's a group that's polarized and that's the enemy group that Bion so brilliantly described. Now Bales went beyond this to talk about typical roles that people tend to fill in a group.

One of the roles, and this is the role you need in every well-functioning group, is a leader who's able to keep people on focus and on target and make sure we're having a good time, and are in harmony and unified. So this leader pays attention both to task and emotion.

Both to task and emotion. Then there's a type which is someone who's very popular - who gets in touch with people, who's outgoing, who's open, who's sociable. But that’s a different function. There is a type who is kind of a nurse, the protector, the one who comes to the defense of people who are attacked, who's very encouraging for example, and who keeps morale up. Then there's the clown. We all remember the classroom clown, well that's one of the types. Someone who just keeps it funny and by the way in Bales' research it suggests that every high-functioning group needs to have fun. Needs to clown around, because it keeps it light, it keeps it playful, it means that you can say things and take risks, put it out there, without it being deadly serious and maybe disastrous. And then, interestingly enough, there's the flamer, there's the person who's insulting, who's exhibitionistic. It's intriguing to me that you say that flaming is a phenomenon of groups. It's the exhibitionist of the flamer that's keeping them going and Bales saw this. There's the rebel, there's the person who's hostile and threatening and obstinate, the problem person of the group. There's someone who's very dictatorial and bossy, and there's someone who is very bureaucratic and business-like and impersonal, and is only task-focused - tuned out of the emotions. What Bales was able to do was to establish not just a typology but a scoring system based on what people say, which is where this becomes possibly applicable to the web. Because if you can computerize a scoring system of every exchange in a group perhaps you could post what's going on in the group at this deep level so that people in the group or designated people in the group perhaps the designated leaders could then take the responsibility to go off line and speak to someone who's starting to flame. Talk to the the bossy person in other words I think you've pointed out that problems in groups on the web are best dealt with one to one.

Shirky: One of the really interesting things about problems in groups on the web is that almost all of our political tradition has us facing in the wrong direction. We have a tradition, from Hobbes, of trying to figure out the relationship of majorities to group as a whole, and we've been enormously concerned about majoritarian tyranny. When can and when can't the group enforce its will on an individual? The tradition of civil liberties, of the bill of rights, all of this comes out of a focus on majoritarian tyranny. On the Internet generally in all group tools the risk is almost the opposite. It's autonomy risk. The risk comes from one individual who wants to slow down or stop or redirect things. There are almost no mechanisms for the majority, even if it is the entirety of the group minus one, to redirect that individual's efforts - to either ask them to remove themselves or to moderate their behavior. And while moral suasion has proved to be an effective tool, more effective than anyone ever thought it would be, its effectiveness is not unlimited. And its reach is also not unlimited. It's really designing environments in which autonomy risk is dealt with on the web that becomes the new problem. And listening to that typology and thinking about things like the rebel and so forth, one of the really interesting things about face-to-face contact is that the warm blanket of consensus will settle over a group. Even if that consensus is relatively thin or relatively false. Just to stay together the group needs to create some wave of living together out of a need for social comfort as much as anything. None of that happens online. And so where a rebel might be brought into the fold as the kind of 'oh he always complains' or 'she's always going on about this particular problem'...

Goleman: By the way, that counterbalancing can be done well by the clown. Rebel speaks, clown jokes, done.

AVOIDING CLASSIC PLANNING MISTAKES

PRACTICAL TIP: 2-1 

As Seattle University's David Umphress has pointed out, watching most organizations develop systems is like watching reruns of Gilligan's Island. At the beginning of each episode, someone comes up with a cockamamie scheme to get off the island that seems to work for a while, but something goes wrong and the castaways find themselves right back where they started—stuck on the island. Similarly, most companies start new projects with grand ideas that seem to work, only to make a classic mistake and deliver the project behind schedule, over budget, or both. Here we summarize four classic mistakes in the planning and project management aspects of the project and discuss how to avoid them:

1. Overly optimistic schedule: Wishful thinking can lead to an overly optimistic schedule that causes analysis and design to be cut short (missing key requirements) and puts intense pressure on the programmers, who produce poor code (full of bugs).

Solution: Don't inflate time estimates; instead, explicitly schedule slack time at the end of each phase to account for the variability in estimates, using the margins of error from Figure 2-19.

2. Failing to monitor the schedule: If the team does not regularly report progress, no one knows if the project is on schedule.

Solution: Require team members to honestly report progress (or the lack of progress) every week. There is no penalty for reporting a lack of progress, but there are immediate sanctions for a misleading report.

3. Failing to update the schedule: When a part of the schedule falls behind (e.g., information gathering uses all of the slack in item 1 above plus 2 weeks), a project team often thinks it can make up the time later by working faster. It can't. This is an early warning that the entire schedule is too optimistic.

Solution: Immediately revise the schedule and inform the project sponsor of the new end date or use timeboxing to reduce functionality or to move it into future versions.

4. Adding people to a late project: When a project misses a schedule, the temptation is to add more people to speed it up. This makes the project take longer because it increases coordination problems and requires staff to take time to explain what has already been done.

Solution: Revise the schedule, use timeboxing, throw away bug-filled code, and add people only to work on an isolated part of the project.

Source: Adapted from Rapid Development, Redmond, WA: Microsoft Press, 1996, pp. 29–50, by Steve McConnell.

DevOps Lifecycle

aircrack-ng wordlist - terms

Countermeasures that can be enabled on your wireless access point (WAP)

SQL Injection - XSS

Não persistente (aka reflexivo)

O artigo da wikipedia faz-lhe grande justiça:

A vulnerabilidade de scripts cross-site não persistente (ou refletida) é de longe o tipo mais comum. Esses furos aparecem quando os dados fornecidos por um cliente da Web, mais comumente em parâmetros de consulta http ou em submissões de formulário HTML, são usados imediatamente por scripts do lado do servidor para gerar uma página de resultados para esse usuário, sem higienizar adequadamente a solicitação.

Como os documentos HTML têm um plano, a estrutura serial que mistura as instruções de controle, a formatação e o conteúdo real, quaisquer dados fornecidos pelo usuário não validados incluídos na página resultante sem codificação HTML adequada, podem levar à injeção de marcação. Um exemplo clássico de um vetor potencial é um mecanismo de pesquisa de site: se um procura por uma seqüência de caracteres, a seqüência de caracteres de pesquisa normalmente será reexibida textualmente na página de resultado para indicar o que foi pesquisado. Se essa resposta não escapar corretamente ou rejeitar caracteres de controle HTML, uma falha de script de cross-site irá resultar.

Um ataque refletido é tipicamente entregue via e-mail ou um site neutro. A isca é uma URL de aparência inocente, apontando para um site confiável, mas que contém o vetor XSS. Se o site confiável for vulnerável ao vetor, clicando no link pode fazer com que o navegador da vítima execute o script injetado.

...

Não persistente (aka reflexivo):

Alice muitas vezes visita um site particular, que é hospedado por Bob. O site de Bob permite que Alice efetue login com um par de nome de usuário/senha e armazena dados confidenciais, como informações de faturamento.

Mallory observa que o site de Bob contém uma vulnerabilidade de XSS refletida.

Mallory Crafts uma URL para explorar a vulnerabilidade, e envia Alice um e-mail, seduzindo-a a clicar em um link para a URL falsos pretextos. Esta URL irá apontar para o site de Bob (seja diretamente ou através de um iframe ou Ajax), mas conterá o código malicioso de Mallory, que o site irá refletir.

Alice visita a URL fornecida por Mallory enquanto logado no site de Bob.

O script malicioso incorporado na URL é executado no navegador de Alice como se ele veio diretamente do servidor de Bob (esta é a vulnerabilidade de XSS real). O script pode ser usado para enviar cookie de sessão de Alice para Mallory. Mallory pode então usar o cookie de sessão para roubar informações confidenciais disponíveis para Alice (credenciais de autenticação, informações de faturamento, etc.) sem o conhecimento de Alice.

Tem alguma pergunta sobre isso?

O trabalho de defesa padrão é higienizar entrada de usuário não confiável; por exemplo, apenas deixá-los inserir um pequeno subconjunto de HTML (a partir de uma linguagem de marcação segura limitada) ou passar por um bom sanitizer HTML/purificador, não use padrões inseguros em scripts (por exemplo, eval em JavaScript na entrada do usuário), idealmente usar um navegador com CSP e Sandboxing, etc.

XSS SQL injection review

1.    Why is it critical to perform a penetration test on a Web application and a Web server prior to production implementation?   

So you can find the weakness and fix them before it can be implemented on the server and goes live.

2.    What is a cross-site scripting attack? Explain in your own words.

It is a computer security vulnerability typically found in web applications that enables attacks to inject client-side script into web pages viewed by others.

3.    What is a reflective cross-site scripting attack?

A reflective attack involves the web application dynamically generating a response using non-sanitized data from the client scripts.

4.    Which Web application attack is more likely to extract privacy data elements out of a database?

Character scrambling and masking numeric variance and nulling.

5.    If you can monitor when SQL injections are performed on an SQL database, what would you recommend as a security countermeasure to monitor your production SQL databases?

SQL Inject Me allows you to test for SQL injection vulnerabilities that hackers can use to hijack your data and modify the contents of a database.

6.    What can you do to ensure that your organization incorporates penetration testing and Web application testing as part of its implementation procedures?   Well coordinated and regularly audited security checks are a great way of doing this.

7.    Who is responsible and accountable for the CIA of production Web applications and Web servers?   The C-I-A pf production web application and web servers are the responsibility of certified information systems security personnel.

Claim Higher College

Claim Higher College has disposed of an open source blog package. This package uses a database backend and allows users to create user IDs, sites, and their own content to post it. Recently, the service has had off-campus users who have posted links that appear to be directed towards University resources but they are getting redirected toward off-campus malware sites.

I would suggest that the application administrator perform a scan of the application.  I would suggest that they use a product called WebInspect.  WebInspect is a commercial tool that tests Web applications and servers.  Some of the advantages of WebInspect is  1. it saves time when dealing with a large application, 2. it simulates the attack and shows detailed reports on the outcome, and 3. it is not dependent on the underlying language.  The application administrator does not need to rely only on this one tool.  They should also perform a Nikto scan.  A Nikto scan will scan the server for dangerous configurations, files, and Common Gateway Interface (CGI) scripts.  They could also restrict the use of the application to on-campus only by putting it behind a firewall and blocking all off-campus traffic.

A developer for Claim Higher College is planning a Web server form for submission of calendar events to the College’s event calendar.  The main protective measures I would suggest is that the developer needs to make sure that they have added input validation to the coding so that a hacker could not perform what is called a Structured Query Language (SQL) injections.  A SQL injection is where a hacker inputs SQL commands in the data fields and it returns useful information for the hacker to use to hack the server.  Adding input validation would mitigate this by not allowing the hacker to input commands into the data fields.  SQL injection could also lead to data malformation or even deleting the data altogether.

A scan of Claim Higher College’s primary Web server from using a Nikto shows a large number of default configuration files and sample files on many of the older servers.  After the security team performed a Nikto search it showed that there were default configuration files and sample files showing up on many of the older servers.

I would suggest that the security team first update and patch all existing servers.  Then they would need to evaluate all of the default configuration files.  They would need to change all of the defaults to non-default names and delete the default files that were not needed.  They would also need to uninstall all default applications that are not needed.  This would help close some security holes.  I would also suggest that they delete all sample files as this would further close holes that hackers could take advantage of.

Como achar broadcast storm in Wireshark?

https://www.udemy.com/curso-profissional-sobre-wireshark/?instructorPreviewMode=guest

Adicionando as capacidades do Wireshark para encontrar os principais operadores das conexões (ou pacotes de multicast que também podem afetar a atividade da rede), o seguinte pode ser feito:

1. Configure um novo "filtro de captura" como tal:

Nome do filtro: Broadcast e Multicast

Filtro Cadeia ou string: broadcast and multicast

2. Selecione o botão da barra de ferramentas "Mostrar as opções de captura".

3. Selecione o botão "Filtro de captura" e clique duas vezes no filtro "Broadcast and Multicast".

4. Selecione "Iniciar" e depois vá para "Estatísticas", "Conversas" e selecione a aba "IPv4".

5. Finalmente, classifique a lista por bytes e tente encontrar o Ip e Arp responsavel pelo broadcast.

--

Procure por um grande número ou pacotes RST (vermelho). Isso indica que os pacotes devem ser reenviados. Pode indicar ruído em outras questões.

Transmissão

Qualquer pacote destinado a todas as estações em um segmento de rede é considerado tráfego de transmissão (Broadcast Storm). Os endereços de transmissão geralmente são usados ​​por ARP, DHCP e outros protocolos que fazem algum tipo de descoberta.

para Ethernet (e outras redes 802.x)

Ethernet designou o endereço all-ones (ff: ff: ff: ff: ff: ff) para o tráfego de transmissão; Isso também é usado para outras redes 802.x.

para IPv4

Da mesma forma, o endereço IP de todos (255.255.255.255) é transmitido. Se a porção do host de um endereço IP é 255 (por exemplo, se o endereço for 192.168.0.255 e a máscara de rede for 255.255.255.0), esse endereço também é um endereço de broadcast. Então você pode facilmente monitorar o destino do tráfego para ff: ff: ff: ff: ff: ff ou 192.168.0.255

Outros pontos a se considerar são:

Com uma tempestade de transmissão, você veria o mesmo pacote ARP cerca de 500-10000 vezes por segundo, dependendo da sua infra-estrutura. Isso é causado por um loop de comutação. O que voce pode fazer para verificar isso é digitar broadcast storm em qualquer buscador e verificar as imagens de preferencia vindas do site do wireshark, aí voce vai ter uma ideia de como são muitos dados por segundos e que feitos também pelo packet tracer da cisco mostram talvez em mais detalhes como funciona os layers quando recebemos uma storm.

Python command to install the path to Windows.

Seven by Seven -

https://www.lynda.com/Business-Skills-tutorials/Developing-Mentoring-Program/578061-2.html?srchtrk=index%3a2%0alinktypeid%3a2%0aq%3amentoring%0apage%3a1%0as%3arelevance%0asa%3atrue%0aproducttypeid%3a2

Bluetooth assignment

Just today we are seeing the “BlueBorne, as the researchers have dubbed their attack, is notable for its unusual reach and effectiveness. Virtually any Android, Linux, or Windows device that hasn't been recently patched and has Bluetooth turned on can be compromised by an attacking device within 32 feet. It doesn't require device users to click on any links, connect to a rogue Bluetooth device, or take any other action, short of leaving Bluetooth on. The exploit process is generally very fast, requiring no more than 10 seconds to complete, and it works even when the targeted device is already connected to another Bluetooth-enabled device.

It has never been a bad idea to keep Bluetooth turned off by default and to turn it on only when needed—at least on Android phones, the large percentage of which still broadcast privacy-compromising MAC addresses for anyone within radio range to view. The vulnerabilities reported by Armis now reinforce the wisdom of that advice.” (GOODIN, 2017)

Thus two things we can get from this attack, turned off and patch the device.

“NFC is a short-distance radio signal that often requires physical contact. Payment systems such as Apple Pay, Android Pay, and Samsung Pay all use NFC to make fumbling for quarters a thing of the past. Let’s say you have an NFC-enabled phone with an app from your local transit authority installed. The app will want a connection to your bank account or credit card so that you can always board any bus or train or ferry without worrying about a negative balance on your account. That connection to your credit card number, if it is not obscured by a token, or placeholder, number, could reveal to the transit authority who you are. Replacing your credit card number with a token is a new option that Apple, Android, and Samsung offer. That way the merchant—in this case the transit authority—only has a token and not your real credit card number. Using a token will cut down on data breaches affecting credit cards in the near future because the criminal would then need two databases: the token, and the real credit card number behind the token.” (Mitnick, 2017)

There are creating new methods to preventing this, like screen-locking software that uses Bluetooth to verify if you are near your computer. In other words, if you go to the bathroom and your mobile phone goes out of Bluetooth range of the computer, the screen is immediately locked. There are also versions that use a Bluetooth device like a wristband or smartwatch and will do the same thing. (Mitnick, 2017)

References

GOODIN, D. (2017, 09 12). Billions of devices imperiled by new clickless Bluetooth attack. Retrieved from Ars Technica: https://arstechnica.com/information-technology/2017/09/bluetooth-bugs-open-billions-of-devices-to-attacks-no-clicking-required/

Mitnick, K. (2017). The Art of Invisibility: The World's Most Famous Hacker Teaches You How to Be Safe in the Age of Big Brother and Big Data. Little, Brown and Company.

Bluetooth attacks and defense

CCNA Interview Questions and Answers

CCNA Interview Questions and Answers

Question:1 What is Routing? Answer: Routing is the process of finding a path on which data can pass from source to destination. Routing is done by a device called routers, which are network layer devices.

Question:2 What is routing on a network? Answer: This might seem like a basic question, but the interviewer might ask it just to see if you know the basics. Routing is done by routers. Routers have a routing table that send network traffic from one location to another location or segment on the network. Routers reduce network traffic compared to regular hubs. When a user sends network traffic across the network, a hub broadcasts to all segments of the network. With a router, the device analyzes the TCP/IP packet, sees the destination location, and then uses its lookup table to route the packet to the right network segment and destination. Switches also route traffic in a similar fashion.

Question:3 What is 100BaseFX? Answer: This is Ethernet that makes use of fiber optic cable as the main transmission medium. The 100 stands for 100Mbps, which is the data speed.

Question:4 Is it better to add a network segment to a growing network or continue to use the same subnet mask? Answer: Growing networks start to suffer from network congestion. When you segment the network, routers are better able to route traffic to specific parts of the network without broadcasting signals across only one segment. When you reduce broadcasting, you lower congestion,
which speeds up your network. With a growing large network, it’s better to start segmenting the network and create subnet masks for different segments.


Question:5 What is the purpose of the Data Link? Answer: The job of the Data Link layer is to check messages are sent to the right device. Another function of this layer is framing.

Question:6 What is network congestion? Answer: With all of the streaming applications and peer to peer software, network congestion is common on a large network. Network congestion occurs when too many people are trying to use limited bandwidth. Most companies have a limited amount of bandwidth they can use before they pay extra, which is why companies limit bandwidth by blocking streaming and peer to peer applications using firewalls.

Question:7 Differentiate User Mode from Privileged Mode Answer: User Mode is used for the regular task when using a CISCO router, such as to view system information, connecting to remote devices, and checking the status of the router. On the other hand, privileged mode includes all options that are available for User Mode, plus more. You can use this mode in order to make configurations on the router, including making tests and debugging.


Question:8 What are data packets? Answer: Data packets are the encapsulation units that transmit information across a network. A data packet contains the sender’s information, the recipient’s information, and the data contained. It also contains the numeric identification number that defines the order and packet number. When you send data across the network, that information is segmented into data packets. The recipient then puts these packets together to be able to read the information. Basically, data packets contain the information and routing configurations for your transferred message.

Question:9 What is the key advantage of using switches? Answer: When a switch receives a signal, it creates a frame out of the bits that was extracted from that signal. With this process, it gains access and reads the destination address, after which it forwards that frame to the appropriate port. This is a very efficient means of data transmission, instead of broadcasting it on all ports.

 Question:10 What is the difference between RIP and IGRP? Answer: When you send traffic on a network, the router (default gateway in Windows computer terminology) determines how to route the traffic. RIP determines where to send the traffic by determining the shortest amount of “hops.” A hop is a next router in the traffic’s path. Each router is considered a hop. With IGRP, several more factors are considered. IGRP takes into consideration the bandwidth availability, MTU, reliability and a number of hops.

Question:11 What is the function of the Application Layer in networking? Answer: The Application Layer supports the communication components of an application and provides network services to application processes that span beyond the OSI reference model specifications. It also synchronizes applications on the server and client.

Question:12 Define bandwidth in terms of network architecture Answer: While the term bandwidth is thrown around for most basic networking speeds and capacity, bandwidth is technically the data capacity of a network. It measures the volume of data for a transmission connection. Bandwidth is measured in kilobits per second or “Kbps.”


When does network congestion occur? Answer: Network congestion occurs when too many users are trying to use the same bandwidth. This is especially true in big networks that do not resort to network segmentation.

Question:14 What is the Application Layer in network connectivity? Answer: The Application Layer is what your developers and software use to send traffic across the network. The Application Layer is especially important for synchronizing software between the server and the client machine.

Question:15 What is BootP? Answer: BootP is a protocol that is used to boot diskless workstations that are connected to the network. It is short for Boot Program. Diskless workstations also use BootP in order to determine its own IP address as well as the IP address of the server PC. Question:16 What is subnetting on your network? Answer: Subnetting is a way to segment your network into smaller “groups.” Subnetting is accomplished by manipulating the subnet mask, which is distributed to desktop computers and routers. Subnetting allows you to create smaller networks within your network, which then reduces congestion on larger networks.


Question:17 What is a Window in networking terms? Answer: A Window refers to the number of segments that is allowed to be sent from source to destination before an acknowledgment is sent back.


Question:18 What is the difference between user mode and privileged mode on a Cisco router?
Answer: These two modes are somewhat self-explanatory. The user mode allows the user to view router status and basic system information. With privileged mode access status, the router can be configured and all status messages and errors can be viewed. User mode and privileged mode separates standard users on the network and network administrators who need to not only view router status but also make changes to the router’s configurations.


Question:19 What are the different memories used in a CISCO router? Answer: NVRAM stores the startup configuration file DRAM stores the configuration file that is being executed Flash Memory – stores the Cisco IOS.

Question:20 What is network latency? Answer: Network latency refers to the performance of one device when it communicates with another. Network latency is affected by bandwidth speeds, network card performance, cabling, and congestion. High latency can also mean users won’t be able to properly communicate with applications, which will “time out” if latency is too high.


Question:21 Does a bridge divide a network into smaller segments? Answer: Not really. What a bridge actually does is to take the large network and filter it, without changing the size of the network.

Question:22 What does MTU stand for? Answer: MTU stands for “Maximum Transmission Unit.” When you configure a router, a default MTU is set. MTU determines the maximum size of a packet that is sent across the network. You can increase MTUs across the network, but this setting generally slows down the network compared to smaller MTU settings. Some network applications require larger MTU sizes, and that’s when you need to manually configure MTU sizes on your routers.


Question:23 How does RIP differ from IGRP? Answer: RIP relies on the number of hops in order to determine the best route to a network. On the other hand, IGRP takes consideration many factors before it decides the best route to take, such as bandwidth, reliability, MTU and hop count.


Question:24 What is the difference between full duplex and half duplex devices? Answer: A full duplex device is preferable because a full duplex device can send and receive data packets simultaneously. However, with a half duplex device, the device must finish receiving a message before it can then send a message. This can lead to slower transmission speeds and increase network latency.