μικροblog

Entries categorized as ‘Networking’

When the internet user (YOU!) becomes the victim a…

Οκτωβρίου 19, 2006 · Γράψτε ένα σχόλιο

When the internet user (YOU!) becomes the victim and the accomplice…Cross-Site Request Forgery as high-tech identity theft and misinpersonation

Take a normal Web user who works on the PC who visits sites, buys online, talks online and neglects to erase the cookies tracking the online activity….Mark this as people’s exhibit 1!

The user who visits forums to exchange ideas with others. Forum topics by other users contain text and images…STOP! Images! Mark this as people’s exhibit 2!

Images seem harmless to the eye, but their src attribute can contain whichever resource/site or script snippet the coder wants them to contain…and therefore even a malicious action/request that’s performed against the site – target! Mark this as people’s exhibit 3!

Mix all 3 elements together and you have Cross Site Request Forgery. A misleading act, which involves impersonating another user (the victim) against a site he/she has used, yet for no legitimate use or cause.

And here are the horrifying facts against the 3 elements previously discussed:

- The attacker knows the sites the victim visits, the sites that store cookies for the victim.
- The attacker hopes the target site works on persistent authentication cookies, or the victim has a current session cookie or the victim has neglected to delete/clear his/her cookies when the browser’s session ends or forgot to log off.
- The target site doesn’t perform secondary authentication for advanced transaction, as a precaution to identity theft or misinpersonation.
- The more sites you visit, the more your risk increases.
- The user has no clue as to what’s happening. The user becomes the accomplice. The user becomes the victim.
- That user is you!Me!Everybody surfing oblivious of the dangers, obvious and well hidden that lurk in the universal Internet of 0’s and 1’s.

Perhaps these diagrams can clear things out on how CSRF works
Need more proof? Read on:

http://www.darkreading.com/document.asp?doc_id=107651&WT.svl=news1_6
http://en.wikipedia.org/wiki/Csrf

Κατηγορίες: Developing · Networking

Time to deal with Networking using Windows, the Wo…

Μαρτίου 3, 2006 · 2 σχόλια

Time to deal with Networking using Windows, the WorkGroup way of things (or peer-2-peer if you prefer).

PREFACE-FOREWORD

This thread is not about setting up and establishing the connection since it would require a series of tutorials on hardware (routers, switches, hubs, UTP cabling etc) and protocol aggreement. Post a search on Google and you will find lots of sources on these…

This thread is about common questions regarding the way Windows authenticate users who try to access resources on the Local Network (LAN).

Keywords to remember as we go by: Pass-through authentication (not saying much now but will prove useful later on). Let’s see what’s in store shall we?

USER AUTHENTICATION EXPLAINED – WORKGROUP SCENARIO

You see, when YOU with username: YOU and password: YOUPWD work on a PC, to actually enter the PC you provide these credentials on your LOCAL LOGIN windows-User interface. These credentials are examined against a so-called Security Accounts Manager (SAM) database to ensure correct and secure usage.

Windows need a VALID set of credentials even when you try to access another user’s PC. It all depends on the security settings of the remote machine you try to access.

For example’s sake let’s assume that you browse the LAN using My Network Places and upon double-clicking the corresponding remote PC icon you can view the resources that are shared on that particular machine.

This happens when GUEST account is enabled on the remote machine. GUEST = anyone who hasn’t been approved as an authenticated user for that machine. You can qualify as a guest when username: YOU and password: YOURPWD DON’T MATCH any of the credentials
of the remote PC’s user accounts. In case GUEST was disabled (a good security practise i may add) then you would be presented with a Window asking Username and Password. Pretty straightforward huh? The remote machine doesn’t know you (as a user with
YOU and YOUPWD) and still complains by asking you for credentials. If a user with username: YOU and password: YOUPWD existed on the remote PC then (voilah!) PASS-THROUGH authentication, meaning that NO WINDOW WOULD APPEAR and you would instantly and
transparently be able to access the resources you want on the other machine.

Whenever i mention PASSWORD please try to use a non-blank one. It’s VERY IMPORTANT since as i read somewhere Windows XP don’t allow blank password authentication across the Network yet ONLY for local user login.

THE GUEST FACTOR

There have been many to say the least tutorials on the GUEST account feature of Windows and how it can affect the security model: the Classic Security Model or the one with the descriptive name: Simple File Sharing.

Just remember that on Windows XP Home Ed. Simple File Sharing is always ON and has to do with PERMANENT usage of GUEST account for network access to the PC’s local resources.
On Windows XP Pro you can accept or deactivate Simple File Sharing when working on a Workgroup and (goes without saying) you can forget the whole thing when working on a domain (see EPILOGUE below on the benefits of working on a domain).

The chapter “GUEST” account can get more complicated and my intention is not to make things complicated. Just thought it would be appropriate to mention it so as to have a clear picture… :)

EPILOGUE

So, bear in mind the workaround of identical pair of username and password co-existence on both the local and target-remote PC’s on the LAN. Of course, when the LAN consists of >2 entities-PC’s you have to apply the same technique throughout the collection of PC’s. And you ask my friend: how can i bypass this cumbersome (yet practical in it’s right) approach? Make the move to a DOMAIN-client/server topology instead of a WORKGROUP. Active Directory (AD) technology will take on the burden of user/password management and REPLICATION of info across the LAN.

Again, search, search, search on Google (or any other search engine to your liking) for more info and remember that access and rights on the remote machine depend highly on the control & security settings thereby set (especially when you are dealing with W2K/WinXP machines and NTFS formatted disks-partitions).

Hope the above was fun for you reading as it was for me writing and explaining.Links to respective sources on the WEB will be posted soon….

Κατηγορίες: Networking · Software

Search(ing) engines the visual way

Ιουνίου 1, 2005 · Γράψτε ένα σχόλιο

since the previous post was about Google and since search engine talk is all the rage nowadays feel free to have a look at some alternative, visually speaking, search engine implementations based on Flash technology:

http://amaztype.tha.jp
(Powered by Amazon)

and

http://www.kartoo.com/

Enjoy…!

Κατηγορίες: Networking

Google and it’s labs are, no doubt about that, uni…

Μαΐου 12, 2005 · Γράψτε ένα σχόλιο

Google and it’s labs are, no doubt about that, unique at what they develop and offer to the wide – ever yearning for info – public. Innovators and trail blazers would be the words i am trying to find here…

Yet, developers proceed with extreme caution…Here is an excellent link on what actually hides beneath the surface of Google’s WebAccelerator, which scours pages you visit for links and quietly preloads them in the background in case you decide to click one of them.

If you combine the above functionality with the…design trend of using hyperlinks in Web Apps instead of (form) buttons with POST actions, then things can get messy…”Hyperlinks and forms that use the HTTP GET method of submission should only be requests for content or information (such as a search). Actions–and especially actions for which the user will be held accountable–should always be performed using HTTP POST requests, which in most cases means clicking a submit button, not a hyperlink. ” (Sitepoint Editor Kevin Yank on GET and POST issues). In layman’s terms, POST carries valuable info and should (must?!?) be triggered by an submit button press event, which actually makes it more difficult to forge in comparison to a mere hyperlink, which can be clicked (invoked) automatically…

Worth reading are posts and valuable information on XSS (Cross Site Scripting) & CSRF (Cross Site Request Forgery), which delve into server side technical – indespensible – info, as well as W3C’s official guidelines on POST and GET and OWASP’s Top Ten Most Critical Web Application Security Vulnerabilities.

Enjoy the new set of toys powered by Google but thing twice if you belong in the developer (dark) side…May the force be with u!

Κατηγορίες: Networking

i have tried WinRSS and it seems that it doesn’t s…

Απριλίου 15, 2004 · Γράψτε ένα σχόλιο

i have tried WinRSS and it seems that it doesn’t support ATOM….

i suggest downloading one of these fine software titles

one of them (Tristana) is surely worth downloading (freeware, only 864KB, works like a charm!)

Get is here!

When you install it go: File -> Add a content channel and input my feed’s link:

http://dvrazos.blogspot.com/atom.xml

Stay connected…

Κατηγορίες: Networking