Length Tight
Living in the Information World - Walking on the Tight Rope For Security
Any technological advancement comes over a price but admist fierce advancements and pressures to trim down time to market leaves so many loopholes which sooner or later come out and damage significantly before remedies are done. The world of web seems to be still plagued by it and its surprising to see that the smart brains are sitting on the other side of the bench. How is that possible? Proofs? What can be done to Mitigate the risks.
The Iframe Code Injection in WebServers: The deadliest of the crowd. There is a vulnerability being exploited on Linux hosted web servers. There is an iframe tag injected on one of the HTML pages. The Iframe has got "0" co-ordinates and hence is hidden while invoking the browser and links to spamming site. There is no virus scanner in the world which would detect it as a virus which is the way it is supposed to be as it is indeed not a virus. On the other hand when any user at the client side invokes the same page, in the background it triggers the link which downloads malicious content without the content of the user. It is only when the trojan gets downloaded and starts infecting, the scanner detects and cleans it. Which merely cleans it temporarily and the same process continues in loop.
Mobile Bluetooth messaging: The design of stack of bluetooth has a loophole in the manner in which it is implemented at the protocol. The 3 way handshaking has got a flaw because of which when a user using the messaging function of the adapter sends a message to a cellphone user. There is no way the receiver will be able to find out the sender's details.
The Players on the line of Ethics: Many security organizations in the world propagate viruses themselves and then offer solutions for their self created exploits. Not only viruses, it is common w.r.t. spam, malware, trojans, spyware and so on. Even if one has the proofs, there is no Central Organization (in the whole world), where in one could submit the proofs and complaints against the said vendors. A more very common problem is that they actually propagates viruses on the client machine in case the client does not extend subscription (This is very common problem seen in most of the vendors.
The Banks and Financial Institutions: The Banks and other Financial Institutions lose millions of dollars in terms of online frauds and scams but there is no news in the media. Reason being the end users will stop trusting the bank and most of the banks avoid leaking out the information absorbing the facts as well as the loss.
The Browser Wars: Most of the browsers have security implementations and underlying technologies which have loopholes. Although there is a standardized governing body (w3c.org), but its upto the vendors whether they conform or they don't.
Syn Flooding..
Whenever a client is sending a ' Syn ' to the server, the server knows that someone wants to connect to him. It means the client who is trying to connect and is asking for permission to do so. The TCP IP stack has to send this client a ' Syn Ack '. For this purpose he needs to know a few things about the client like it's IP address, port number, Sequence number of the ' Syn ', etc. To store this information, the TCP IP stack has to allocate some memory. When the TCP IP stack sends the client a 'Syn Ack ', it blocks a connection for the client, and allocates some memory till he receives an ' Ack ' from the client. Until the server receives an ' Ack ' from the client, the connection is known as a ' half-open ' connection. Allocating memory or resources is an expensive process. The more the memory that the TCP IP stack allocates for half-open connections, the lesser the memory it has for executing other programs. Earlier on, the TCP IP stack would allocate only enough memory, to store 8 half-open connections.When the TCP IP stack received an ' Ack ' it would declare the connection to be no longer a half-open connection but a live connection. In other words this is now an open connection.
Assume that a TCP IP stack can have 8 half open connections. Suppose all the 8 half-open connections are occupied. When a 9th ' Syn ' packet arrives, the TCP IP stack would not be able to accommodate it. And therefore this 9th ' Syn ' packet would be rejected. No one else would now be able to connect to that machine. Obviously the stack is not like us, the kind of people who patiently wait for hours at length for the next bus to arrive. If an ' Ack' from the client does not arrive within a specified period of time, the TCP IP stack terminates this half-open connection.
We could write a program, that will keep on sending a forty byte header with the ' Syn ' flag on. Thus, we would be sending only the ' Syn ' packets without sending any ' Ack ' packets. We would thus occupy all the eight half-open connections that were available on that TCP IP stack. We also know that the TCP IP stack sets a predefined timer after which it will terminate each of our half-open connections. Let's assume that we know that the timer is set to sixty seconds. Since we know that our half-open connection will be terminated after 60 seconds, will it not be possible for us to keep sending ' Syn ' packets every sixty seconds so that all the half-open connections are always occupied by our ' Syn ' packets. This method, used to prevent other clients from connecting to a server is known as ' Syn Flooding '.
Now some genius tried to design a method to prevent these syn floodings. He created a method known as the ' fire wall ', by which, he claimed that syn flooding could be prevented. This method works on a very simple principle. The TCP IP stack never checks the IP address of clients, while accepting or rejecting connections. Since it is possible for the TCP IP stack to know the address of every client connecting to it, you just check the client who keeps giving ' Syn's ' and not responding with the ' Ack '. The ' fire wall ' is a computer which checks the IP addresses of incoming clients. The person who designed the fire wall, merely placed it in front of the TCP IP stack. The ' fire wall ' is then given the IP address of that client and whenever that client tries to connect to the server it would promptly drop the packet. But if the client keeps changing the Source IP address randomly - as the IP address can go upto 4 billion - the ' Syn Acks ' would go to the wrong machine. Thus by sending different and wrong IP addresses, one can easily bypass the fire wall. Hence, at present, there is no solution for ' Syn flooding '.
Land Attack..
The name though it sounds as if there is a war going on, but it is not so. Land attack is just a name given to a method designed by Mr. Land to give some more headache to the servers. He simply passes both the source and destination IP address, with the same address as that of the server. In this case the server is sending itself a ' Syn Ack '. When the poor guy tries to send a ' Ack ' to himself for a ' Syn ' which he has not sent, he invariably hangs.
Reliability..
Now the Internet Protocol in itself is unreliable. This is because there is nothing in IP which tells us whether the packet you have sent has reached or not. There is no mechanism in IP which will tell you whether the packet has reached the destination safely and in order. It does not mean that IP does not send the packets across correctly, it is just that there is no guarantee that the packet will reach. Let's take the example of the Postal Service in India. Suppose you want to send a letter to Tiruvananthapuram by ordinary mail. Now it is not that the mail is always lost, the Postal Department does sometime deliver the letter but there is no guarantee that it will reach the place. It may reach Tiruvananthapuram but then again it may not reach on time. It is also possible that if you send two letters one after another, the second letter may reach first. There is no way in which the Postal Department will come back to you and say that the mail has not reached, or that it has reached late or that the second letter has reached first. So also is the case with the IP Protocol. There is no way by which it comes back and tells you that the packet you had sent has reached or not.
Because of this we can never be comfortable with only the IP protocols. If we want to make additions to the rules of the IP protocol in such a way that IP would come back and inform us whether the packet has reached or not, it will make the IP protocol very complex.
Now the IP protocol deals exclusively with the routers. It's IP's job is to make sure your packet goes from one end to the other in the shortest possible time. IP is the one who informs the router about the location of it's destination, it's source and other such details. The IP protocols primary concern is speed. It has to try and get to the destination as fast as possible and it cares about nothing else. The IP protocol has sacrificed reliability for speed and it shows. So why not allow it to do the job it knows best ? i.e. routing.
If the Internet was to rely exclusively on IP, the result would be absolutely chaotic. It was to combat this problem of unreliability, that the TCP protocol was established. The TCP protocol is the exact opposite of the IP protocol. It's primary concern is reliability. It is the TCP protocol that takes care of checksums and sequencing. To send a packet on the net it is possible that your packet may be broken into two or more packets - depending on the size of your packet. Now each packet may reach the destination port at different times and in different order. Is it not necessary that the packets are received in the order they are sent ? Otherwise the packet may reach the party in a haphazard manner, whereby the message transmitted is completely illogical and garbled. It is the job of the TCP Protocol to make sure that every packet reaches the destination and is put together in the correct order.
Sequencing...
Let us now see how we can send data across from a client to a server. When data is sent across to the server, the ' Sequence number ' and ' Acknowledgment number ' are very important. The client informs the server about it's ' Sequence number '. This number has been generated randomly by the TCP IP stack. Our TCP IP stack will start numbering the data to be sent across to the server from this number. We can explain the concept of a ' Sequence number ' and an ' Acknowledgment number ' in a better manner with the help of the following example. Suppose we are sending the data which is shown below.
A B C D E F G H I J K L
2 3 4 5 6 7 8 9 10 11 12 13
Let's assume that we have agreed with the server on the ' Sequence number ' 2. Therefore, our data has been numbered from 2 onwards. Assume we are sending 3 bytes of data at a time along with the TCP IP header. Thus, the server will receive a packet of 43 bytes. In this packet, the number in the ' Acknowledgement field ' has no meaning.
IP header
20 bytes
TCP header
20 bytes
ABC 3 bytes
The minute the server receives the packet he responds with an ' Ack '. This ' Ack ' is of 40 bytes and has it's ' Ack ' flag on. When the ' Ack ' flag is on it means that now the ' Acknowledgment field ' is valid.
The server looks at the size of the packet and finds out that we have sent him three bytes of data. He knows that we have sent him data bytes A, B and C which are numbered as 2, 3 and 4. He will take the last byte number i.e. 4 and add 1 to it, to obtain the number 5. The server will place this number as the ' Acknowledgment number ' in the ' Ack ' he sends us to inform us that he has received our packet.
When we receive the server's ' Ack ', we look at his ' Acknowledgment number ' which is 5. We now know that we have to start sending data from byte number 5 onwards. So we place 5 as the ' Sequence number ' of the next packet we are going to send him. Along with this packet, we send three more bytes of data to the server. As our ' Sequence number ' is now 5 the server will now receive D, E and F which are numbered as 5, 6 and 7, as it's next packet. The server will take the last byte number of this packet, i.e. 7 add 1 to it and respond with an ' Acknowledgment number ' 8. On receiving this ' Ack ' packet sent by the server, we now know that we have to send data bytes from 8 onwards. If we do not receive an ' Ack ' for any packet we sent, we have to retransmit that packet after a certain amount of time.
It is a fact, that the server is wasting time by responding with forty bytes of ' Ack ' every time we send a packet of three bytes. Instead of the server sending us an ' Ack ' for every packet it received, it may decide to send us an ' Ack ' after receiving two packets. We are now sending the server two packets one after another, before it responds back with a ' Ack '. Looking at our above example, the server may send us an ' Ack ' with the Acknowledgement number 8 instead of 5 the first time. This means that the server has received the bytes numbered 2 to 7 and wants us to send him the next packet from the 8th byte onwards. This is to shows that ' Acks ' can be bunched together.
It is possible that when we send two packets one after another, the second packet may reach first. But, since our data has been sequentially numbered, the server will arrange our data in the correct order.
TCP is a decent protocol. It is not ill-behaved, unlike other protocols which we shall talk about later. The moment the client receives an ' Ack ' it means that the server has received a packet and responded with an ' Ack ' . We - the client - have to first calculate the total round time i.e. the time from the moment we send a packet to the time we receive an 'Ack' from the server. Suppose we send a packet to the server and we receive an ' Ack ', 1 second later. We now know that the transmission time, one way, is 1/2 a second. After we keep sending packets for 15 minutes, at intervals of 1 second, we may suddenly realise that the server is now responding with the ' Ack ' every 2 seconds. This shows that there is now congestion on the line. So if we receive an ' Ack ' late, we also would be sending our packets late.
Let's assume another case where we are sending a packet to the server. We can't wait indefinitely for the server to respond with an ' Ack '. This may be due to the reason that our packet has not reached the server. It may also be due to the reason that the server may have sent an ' Ack ' but the ' Ack ' did not reach us.
Because of this we have to set a retransmission timer which will inform us that it is time to retransmit a packet. It is possible that we may set the retransmission time too high and we may receive the ' Acks ' at a faster rate. For example, suppose we set our retransmission time to be 5 seconds and the server responds with an ' Ack ' within 2 seconds. Then we are wasting 3 seconds needlessly. Hence we have to dynamically reset our timer to 2 seconds.
If we set the timer for a short retransmission time, it is possible that we may receive an ' Ack ' after we have retransmitted the packet. For example, if we set our retransmission time to 1 seconds and the server responds with an ' Ack ' after 2 seconds. Then we are retransmitting the first packet without waiting for a reasonable time for the ' Ack ' to reach us. Hence we have to reset our timer to 2 seconds. Even if the server received our duplicate packet it is intelligent enough to drop it.
If this was the way the TCP worked, then it would make the whole process of transmission too slow and be more of a liability than an asset to the network. Slow, because the server would have to wait for an ' Ack ' from the client every time it sent some packets. To guard against the slowness of the protocol there is something in TCP known as the window size - which incidentally we had said would be explain later. Well, the time has come when we feel that you should know what a window size means. So let's now learn about the ' window size '.
Let us talk about a case where we are receiving data from a server. The server sets a limit to the number of bytes of data it can send us, without receiving an ' Ack ' from us. This maximum limit is known as the window size. It is not a constant figure, but may vary due to a number of factors like congestion, etc.
Suppose the window size of the packet coming to us from the server is specified as ' 4 , 0 '. The server will keep sending us data up to, 4 * 256 + 0 * 1, i.e.1024 bytes before it demands we send it an ' Ack '. The sever knows that he can keeping sending us data, he will not send us the 1025th byte until we send him an ' Ack '. This increases the rate of flow of data.
The Analysis:
1. We the customers have no choice except shelling out money on trying to protect ourselves. Still continue to use and keep upgrading irrespective of the price.
2. Our machines resources are ruled by the so called scanners claiming it to protect us. At the same time absorb the maximum machine resources right from memory/processing power/network bandwidth and so on.
3. In today's world which is supposed to be an IT world is being ruled by Microsoft on one place and the security players on the other. The customers pay for their most expensive services and still their resources are not in their own control as heavily depend on the mercy of the said service providers/vendors.
The Future: Sooner or later the world will migrate to smarter vendors and will be lot more informed about invasive policies/practices of the vendors. they will be lot more proactive and better placed to take informed decisions
About the Author
Test Manager
Pure Testing
 Sexy Shiny Full Length Leggings Tight Pants Punk Rock  US $4.49
|
 Silver Foil Printed Full Length Tight Pants Rock L K2 US $.95
|
 SEXY womens black NET LACE tight leggings 3 4 length US $.01
|
 3 4 Length Black Rhomb Plaid Jacquard Tight Leggings US $.01
|
 Shiny Leopard Print Full Length Leggings Tight Pants US $3.99
|
 Sexy Shiny Silver Leather Like Full Length Tight Pants US $3.99
|
 M L Shiny Black Leather Like Full Length Tight Pants US $3.99
|
 M L Shiny Silver Leather Like Full Length Tight Pants US $3.99
|
 Shiny Blue Wet Look Full Length Leggings Tight Pants US $3.99
|
 Shiny Pink Wet Look Full Length Leggings Tight Pants US $3.99
|
 Sexy Cyber Shiny Metallic Green Full Length Tight Pants US $3.99
|
 M L Shiny Gold Leather Like Full Length Tight Pants US $3.99
|
 Cotton Black Lace Bottom Full Length Tight Pants US $3.99
|
 Spanx Body Shaping Full Length Tights Tight End B C E US $14.99
|
 Sex Shiny Silver Leather Like Full Length Tight Pants US $3.99
|
 Women Paisley PRPL MESH Full Length Legging or Tight S US $19.99
|
 New Snake Print Full Length Leggings Tight Pants US $3.99
|
 New Black Smoky Print Full Length Leggings Tight Pants US $3.99
|
 New Tie Dye Cotton Full Length Leggings Tight Pants US $3.99
|
 New Blk SEXY JEAN CAPRI LENGTH LEGGING Tight Sz One US $6.99
|
 New Blk SEXY FULL LENGTH LEGGING FASHION Tight Sz One US $5.99
|
 Zebra Print Punk Rock Gotic Full Length Tight Pants US $3.99
|
 Leopard Print Punk Rock Gotic Full Length Tight Pants US $3.99
|
 Womens FULL LENGTH sexy tight leggings floral LACE NEW US $6.99
|
| Powered by phpBay Pro |
 |
Bravo-fit Shoe Stretchers - With Stretcher Spray Ladies Large Size 9-11
Sale Price: $24.95 Average Rating:  |
DescriptionTwo Stretchers a Left and a Right Constructed in beautiful wood. It has happened to us all we get those brand new shoes on our feet only to find that they're unbearable to wear. Or we have that pair of shoes that we love but they never seemed to fit correctly... Features
|
 |
Bravo-fit Ladie's Shoe Stretchers - With Stretcher Spray Size 5-8 Width and Length Stretching - Premium Hard Wood - Top Quality
Sale Price: $30.78 |
DescriptionTwo Stretchers - a Left and a Right Constructed in beautiful wood. It's happened to us all - we get those brand new shoes on our feet only to find that they're unbearable to wear. Or we have that pair of shoes that we love but they've never seemed to fit correctly... Features
|
 |
Baldwin making record tight rope walk over gorge, - length, 582 ft. height 555 ft., Eldorado Springs, Colorado, U.S.A. Reprint (15 x 12 inches)
Sale Price: $9.00 |
DescriptionHigh quality reproduction of a photograph from the Stereograph Card Collection of the Library of Congress. 1860-1945, with the bulk being from 1870-1920. Stereo card photographs, featuring sites around the world and popular topics such as expositions, industry, disasters, and portraits of presidents... Features
|
|
Old Dog New Tricks
Sale Price: $7.99 |
|
|
Tasty Tight Tamales List Price: |
|
DescriptionHot Latina Action Features
|
Bustier Corset
Trim Support
Extenders Sewing
Hanky Panky
Tiger Print
Set Bunny
Lady Marlene
Gilly Hicks
Opaque Bodystocking
Womens White