TechnoChat

Ethical Hacking !!! OWASP TOP 10 | SANS TOP 20

noreply@blogger.com (Angad Singh) — Sat, 19 Dec 2009 07:06:00 +0000

One of the questions which comes to my mind when ever i visit any website is "Are We Secure?"

We meet people day in day out who still run there business in traditional way failing to realize the importance of security, security is just a cost burden which is not a revenue generator for them. Be it a developer, manager, a corporate head what it matters to them is money and the end result i.e. software, a website.

When we see attacks happening around us on TV all we have to say is that administration is not effectively protecting us, failing to realize that we ourselves have neglected the same while we were carrying out our jobs.

As a responsible citizen i take this forum to introduce all to the mindset of an hacker further we also go on to talk about the Web attacks happening around us.For all developers developing solutions it becomes really important to know what is the vision of an hacker and keep it in mind while designing there solutions.

Stage 1 :-Information Gathering

What does a robber looks for when he choices for a home to rob?
He looks to gather information about the home, people, what valuables will he get ?
Similar to robber an hacker always thinks the same way he try's to gather information about the website or software from the various available online forums to know more about the solution and the weak areas.

Stage 2:- Scanning

What does robber looks for once he has choice his target?
Robers always try to rob a house which are easy to break in he always asks this How easy is it for him to break in?. Similarly hackers targets the system which are weak he try to scan the networks and website to know the known open ports and access.

Stage 3:- Discovery

What does robber need once he knows the entry points?
He will try to identify the tools which will help him in executing his job, similarly hacker always try to look for available exploits or customize exploits from available online forums such as milw0rm, osvdb etc.

Stage 4:- Exploit

Now the robber/hacker is ready to rob your home!!! He will try to exploit the vulnerabilities/weakness in your home or software to gain access into it.

Stage 5:- Covering Tracks

Once he has done the theft he will always try to do it in such a manner that there is no evidence to prove his doings. Similar an hacker will try to perform similar act by trying to removing all his occurrence of attacks.

What can we do to ?

Well be aware of what is happening across the online forums, there are forums which provide information about exploits for various software weakness. Also we much try to incorporate best practices such as OWASP Top 10, SANS etc.

Some of the security layers which we must have are
1. Application Layer Defense.
2. Session Layer Defense.
3. Network Layer Defense.

The attackers are now moving from traditional network layers attacks to application layer. Following are some of the top defects which are easy to find and exploited by attackers.

1. Input Validation.
Possible Attacks :-SQL Injection,Cross Site Scripting, Cross Site Request Forgery, HTTP Response Splitting.

Cause & Impact:-
SQL injection:- The website does not validate the input parameters i.e. all the request parameters sent by an enduser.An attacker can exploit this vulnerability to query the database and can lead to creating a replica of the database. If the application contains customer sensitive information then an attacker can use this information for spamming or could sell the information to competitor firm.

Cross Site Scripting:- The website does not validate the input/output parameters i.e. all the request parameters sent by/ an enduser. An attacker can use this to redirect the response of the user to his choice of servers whereby leading to transfer of sensitive information such as user credentials, account information. This attack could can be used to defame a website whereby impacting the brand image of the company.

Cross Site Request Forgery:-The website does not assign a dynamic IDs to the post request parameters i.e. all the request parameters sent by enduser are static page Ids.This attack can be used general data manipulation in the name of others.

HTTP Response Splitting:-The website does not validate the user input and response from the server contains invalidated user input. This attack could lead to redirecting user response to the server of attackers choice .

2. Authorization Bypass
Possible Attacks:- Horizontal Authorization Bypass, Vertical Authorization Bypass using URL/Parameter Manipulation and Packet replay.

Cause & Impact:-
URL/Parameter Manipluation:- The website does not validate the authorization privilege of a user before serving any content. An attacker could use this to gain acccess to administrator roles and privalges.

Packet Replay:- The website does not map the session ID of an user with the user uniquely defined parameters. An attacker could use this to gain acccess to administrator roles and privalges by replying the packet in case the website is over insecure channel i.e. HTTP.

There are couple of other important issues which will be covered in the upcoming post such as Session layer attacks, Configuration Management issues, Log Management issues, In- Secure Channels and Network layer attacks.

Hope this post would be informative to you and would like to hear your comments on the above highlighted problems.

Security Practices Asp.Net

noreply@blogger.com (Angad Singh) — Sat, 19 Dec 2009 06:12:00 +0000

First thing which comes to mind when one connects to internet is am i secure.....?... Is somebody watching me? .Nobody has an answser to it but all one can do is use best practices to be on a safe edge of the wall. Listed below are some of the security misconfigurations, and demonstrates their potential impact on your applications.

1. Web.Config

Web.config files operate in a hierarchical inheritance manner. All Web.config files on the system inherit from the global configuration file called Machine.config located in the .NET framework directory. The effect of this is that the runtime behavior of your application can be altered simply by modifying a configuration file in a higher directory .

To keep your application-specific settings from being unexpectedly modified, the solution is to never rely on default setting values. For example, debugging is disabled by default in configuration files. If you're examining the configuration file for your application and you notice that the debug attribute is blank, you might assume that debugging is disabled. But it may or may not be disabled—the applied value depends on the value in parent configuration settings on the system. The safest choice is to always explicitly set security-related values in your application's configuration.

1.1 Custom Errors Disabled

When you disable custom errors as shown below, ASP.NET provides a detailed error message to clients by default.

Looking at the error page, an attacker can see that the application is using the .NET framework version and ASP.NET version Knowing that, he can search the Web for known security advisories concerning these specific product versions. The hacker can also determine that the application is using Microsoft SQL Server as its database, because the exception type thrown was a SqlException, which is specific to Microsoft SQL Server. The more information a hacker can gather about a Web site, the more likely it is that he will be able to successfully attack it.

You can prevent such information leakage by modifying the mode attribute of the element to On or RemoteOnly. This setting instructs the Web application to display a nondescript, generic error message when an unhandled exception is generated.

Another way to circumvent the problem is to create your own custom error page and redirect users to that page when errors occur.

1.2 Leaving Tracing Enabled

The trace feature of ASP.NET is one of the most useful tools that you can use to debug and profile your applications. When the element is enabled for remote users (localOnly="false"), any user can view an incredibly detailed list of recent requests to the application simply by browsing to the page trace.axd .

An hacker would find the form variables, request and response and various other useful information; these might include email addresses that could be harvested and sold to spammers, IDs and passwords that could be used to impersonate the user, or credit card and bank account numbers. Even the most innocent-looking piece of data in the trace collection can be dangerous in the wrong hands. For example, the APPL_PHYSICAL_PATH server variable, which contains the physical path of the application on the server, could help an attacker perform directory traversal attacks against the system .

The best way to prevent a hacker from obtaining trace data is to disable the trace viewer completely by setting the enabled attribute of the element to false. If you must have the trace viewer enabled, either to debug or to profile your application, then be sure to set the localOnly attribute of the element to true. This setting allows users to access the trace viewer only from the Web server and disables viewing it from any remote machine.

1.3 Leaving Debugging Enabled

Deploying a Web application in debug mode is a very common mistake. If you have enabled debugging and disabled custom errors in your application, then any error message displayed to an end user will include not only the server information, a detailed exception message, and a stack trace, but also the actual source code of the page where the error occurred .

To disable debugging, set the value of the debug attribute of the element to false. This is the default value of the setting, but as we will see, it's safer to explicitly set the desired value rather than relying on the defaults.

1.4 Cookies Accessible Through Client-Side Script

In Internet Explorer 6.0, Microsoft introduced a new cookie property called HttpOnly. While you can set the property programmatically, you can set it generically in the site configuration.

Message board or forum pages are also often vulnerable to cross site scripting. An attacker, rather than posting about the current topic, will instead post a message such as script code in its page code—and the browser then interprets and executes it for future site visitors. Usually attackers use such script code to try to obtain the user's authentication token (usually stored in a cookie), which they could then use to impersonate the user.

When cookies are marked with the HttpOnly property, their values are hidden from the client, so this attack will fail .

1.5 Cookieless SessionState Enabled

In the initial 1.0 release of ASP.NET, you had no choice about how to transmit the session token between requests when your Web application needed to maintain session state: it was always stored in a cookie. Unfortunately, this meant that users who would not accept cookies could not use your application. So, in ASP.NET 1.1, Microsoft added support for cookieless session tokens via use of the "cookieless" setting.

Web applications configured to use cookieless session state now stored the session token in the page URLs rather than a cookie. For example, the page URL might change from http://mysite/default.aspx to http://mysite/(123456789ABCDEFG)/default.aspx. In this case, 123456789ABCDEFG represents the current user's session token it had the side effect of making those applications much more vulnerable to identity theft whereby using a network monitoring tool (also known as a "sniffer") or by obtaining a recent request log, hijacking the user's session becomes a simple matter of browsing to the URL containing the stolen unique session token and hence impersonates a legitimate user by stealing his session token.

The most effective way to prevent these session hijacking attacks is to force your Web application to use cookies to store the session token. This is accomplished by setting the cookieless attribute of the element to UseCookies or false. But what about the users who do not accept cookies? By setting the cookieless attribute to AutoDetect, the application will store the session token in a cookie for users who accept them and in the URL for those who won't. This means that only the users who use cookieless tokens will still be vulnerable to session hijacking.

1.6 Cookieless Authentication Enabled

Just as in the "Cookieless Session State Enabled" vulnerability discussed above, enabling cookieless authentication in your application can lead to session hijacking.

Session hijacking has far more serious consequences after a user has been authenticated. For example, online shopping sites generally allow users to browse without having to provide an ID and password. But when users are ready to make purchases, or when they want to view their orders, they have to login and be authenticated by the system. After logging in, sites provide access to more sensitive data, such as a user's order history, billing address, and credit card number. Attackers hijacking a user's session before authentication can't usually obtain much useful information. But if the attacker hijacks the session after authentication, all that sensitive information could be compromised.

The best way to prevent session hijacking is to disable cookieless authentication and force the use of cookies for storing authentication tokens. This is done by changing the cookieless attribute of the element to the value UseCookies.

1.7 Failure to Require SSL for Authentication Cookies

Web applications use the Secure Sockets Layer (SSL) protocol to encrypt data passed between the Web server and the client. Using SSL means that attackers using network sniffers will not be able to interpret the exchanged data. Rather than seeing plaintext requests and responses, they will see only an indecipherable jumble of meaningless characters.

Disabling cookieless authentication is just the first step towards securing the authentication token. Unless requests made to the Web server are encrypted, a network sniffer will still be able to read the authentication token from the request cookie. An attacker would still be able to hijack the user's session.

By setting the requireSSL attribute of the element to true, the ASP.NET application will use a secure connection when transmitting the authentication cookie to the Web server.

1.8 Sliding Expiration Used

All authenticated ASP.NET sessions have a timeout interval. The default timeout value is 30 minutes. After 30 minutes of inactivity, the user will automatically be timed out and forced to re-authenticate his credentials

The slidingExpiration setting is a security measure used to reduce risk in case the authentication token is stolen. When set to false, the specified timeout interval becomes a fixed period of time from the initial login, rather than a period of inactivity. Attackers using a stolen authentication token have, at maximum, only the specified length of time to impersonate the user before the session times out. Because typical attackers have only the token, and don't really know the user's credentials, they can't log back in as the legitimate user, so the stolen authentication token is now useless and the threat is mitigated. .

To avoid this altogether, you can disable sliding expiration by setting the slidingExpiration attribute of the element to false.

1.9 Non-Unique Authentication Cookie Used

As strange as it seems, an improperly chosen cookie name can create a security vulnerability just as dangerous as an improperly chosen storage location.

The default value for the name of the authentication cookie is .ASPXAUTH. If you have only one Web application on your server, then .ASPXAUTH is a perfectly secure choice for the cookie name. In fact, any choice would be secure. But, when your server runs more than one ASP.NET application, it becomes critical to assign a unique authentication cookie name to each application. If the names are not unique, then users logging into any of the applications might inadvertently gain access to all of them.

The best way to ensure that each Web application on your server has its own set of authorized users is to change the authentication cookie name to a unique value.

1.10 Hardcoded Credentials Used

A fundamental difficulty of creating software is that the environment in which the application will be deployed is usually not the same environment in which it is created. In a production environment, the operating system may be different, the hardware on which the application runs may be more or less powerful, and test databases are replaced with live databases. This is an issue for creating applications that require authentication because developers and administrators often use test credentials to test the system. The question is: Where do the test credentials come from

For convenience, to avoid forcing developers from spending time on creating a credential store used solely for test purposes (and which would subsequently be discarded when the application went to production), Microsoft added a section to the Web.config file that you can use to quickly add test users to the application. Storing login credentials in plaintext in a configuration file is simply not secure. Anyone with read access to the Web.config file could access the authenticated Web application. It is possible to store the SHA-1 or MD5 hash of the password value, rather than storing the password in plaintext.

The most secure way to store login credentials is to not store them in the configuration file. Remove the element from your Web.config files in production applications.

Blocking Skpye in a Network

noreply@blogger.com (Angad Singh) — Sat, 21 Feb 2009 04:16:00 +0000

One of the challenges which are faced by many administrator's is to block software's which create a Http tunnel. Skype is one of the software which works on similar principles. Lets first understand how it works.

How Skype Works?

When ever we install skype on any computer, it has a default list of server's to which it tries to connect, firstly it will try to connect using port 80 with P2P protocol. All the corporate houses have content and protocol filtering software's such as Websense, with which p2p protocols can be easyly be blocked, but skype is something which tries to sneek through these Content and policy based software's. If skype fails to connect through port 80 then it tries to connect using port 443 and creates a secured tunnel, once it creates a tunnel it tried to connect to supernode, which then inturn connect it to Skype login Server.

How to Block Skype?

If you try to trace the Ip's of the supernode and try to block them you will notice that it will still not block the skype, since the list of supernodes grows long.

One of the best ways to block Skype is to block the Ip based connectivity through your proxy. Here are some of the changes which can you would need to make in proxy server configuration file.

# Prevent Skype connecting HTTPs using CONNECT requests to IP addresses (those not using domain names)
acl numeric_IPs url_regex ^[0-9]+.[0-9]+.[0-9]+.[0-9]+
http_access deny CONNECT numeric_IPs all

# Prevent Skype connecting http
acl Skype_UA browser Skype
http_access deny Skype_UA

# Prevent anyone to download anything from skype website
acl Skype_domain dstdomain skype.com
http_access deny Skype_domain

Gameeeee.vbs Windows Script Host Error..........!

noreply@blogger.com (Angad Singh) — Mon, 08 Dec 2008 11:12:00 +0000

This is new variant of the old Chinese virus, If you see file name they using this team looks like gamers team in china. What they looking for? Spoofing your log! get your financial information, get your sensitive information, etc.

Symptoms that your computer is infected with it

->Gettings pops while browsing like windows script host error "gameeeee.vbs" "ags.vbs" and any other ends with vbs extension.
->Presence of "gameeeee.vbs" and "gameeeee.pif" in the "Temp" folder of your computer.
->Presence of "Thunder.cmd" in "Startup" folder of your computer.
->Presense of "ihhh.html" file in the "Temproray internet files"
->Internet browsing gets slow brower seems to hang, in status bar you see going to a particular website like "u.cruze3.cn"

If you observe any of the above mentioned symptoms then your computer seems to be infected with this virus. Actually its not a virus its a spyware which tries to steel information from your computer. This spyware has the capability to spreed itself over the network, if you see any computer infected with this then first step should be to remove this computer from the network else pretty soon all the system in the network will be infected with it.

Now let us start with troubleshooting.......

Step 1

Some of the files which are actually malicious files but would be showing as folders.

=> The folders that were found are as follows:

C:\WINDOWS\System32/{iifgfgf.dll ,vcmgcd32.dll and systems.txt}
C:\WINDOWS\{logo1_.exe, rundl132.dll, rundll16.exe and zts2.exe}

The above files are malicious but they were converted into folders. Deleted the above folders.

C:\WINDOWS\System32 \{spider.exe,winmine.exe and DSndUp.exe}
C:\WINDOWS\System32 or \drivers\{asyncmac.sys,beep.sys,aec.sys and
WDF01000.SYS}
C:\WINDOWS\{Lic.xxx,R.COM and WMSysPr9.prx}

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
\thunder.exe

Apart from the above mentioned files look for these files also which
were used by previous varient of the same spyware.

-system.exe
-HBBO.dll, HBCHIBI.dll, HBQQFFO.dll, HBmhly.dll, HBZHUXIAN.dll,
HBZG.dll,HBSO2.dll, HBQQSG.dll, HBSOUL.dll
-AcSpecf.sdb, AcXtrnel.sdb, AcSpecf.dll
-HBKernel32.sys, eth8023.sys

Delete the all mentioned files & also delete all the files from temp and temporary internet files folder.

You might not be able to delete some of the above file for that use Unlocker.

Step 2

After deleting the above mentioned files next step would be to block the url which you notice in the status bar of your screen. for example in the address bar i write google.com but notice u.cruze3.cn or i try to go to yahoo.com and notise the same url then block this url in the Proxy or in the firewall.

Step 3

Now run norman malware cleaner. This will remove all the infected files from your computer.

Step 4

Now we have to repair winsock for that go to registry.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

Delete the above mentioned folders then restart your machine.

Now you are free from this spyware enjoy your browsing..............................

I will be looking forward towards your feedback about this post..............

Innovative Designs and Devices

noreply@blogger.com (Angad Singh) — Sat, 31 May 2008 10:28:00 +0000

We all moving towards a fairy tale world where everything looks to be beautiful and perfect from the smallest little non living thing to the more visible creatures. With technology around we are able to live a comfortable life, but is comfortable good enough for us?? don't we wish to live life where everything around us is just like we want it to be?? well i think time is changing technology is advancing we are now moving towards a new world where consumers are having a say in the design, looks and features of every thing being built around us.

Its now end of those fat looking , heavy systems which would only satisfy our technological needs but still lack looks. Now it time for some makeover of devices its been long that we have been seeing things as they are but now we need change we want to get rid of these fat looking heavy device. Here are some new looking devices of 21st century which will change the way how we perceive things.

How about the remote control in shape of Apple??

Well well it gone be one fine experience to play with. Sony is expected to give our old fashioned remote a new look it will look like an apple

How about a Digital Pot Lets Plants tell you their demands???

A new Digital pot is being developed which will automatically tell us about what are the needs of the plant..............

These happens to be only just a few examples of our new devices. If you wish to see more then

Here is the link : smashingmagazine

Nokia 6110 Navigator

noreply@blogger.com (Angad Singh) — Fri, 30 May 2008 16:47:00 +0000

Finnish Mobile handset giant Nokia has unveiled a new smart phone mobile device Nokia 6110 Navigator which has the capability of navigating to a particular location using satellite images with inbuilt magnetic COMPASS & Global Positioning System.
Some of the noticeable features of Nokia 6110 Navigator are:

Voice-guided 3-D GPS Navigation
2 megapixel camera with 4x digital zoom, integrated camera flash.
Suppport for 3G Network.
Video Calling.
FM radio with Visual Radio.
Push email with attachments.

Nokia has the collection of Nokia Maps 2.0 for 170+ countries maps to its database and maps could be used on its GPS enabled cell phones and could be used to browse LIVE streaming GPS navigation on mobile.You can easily track Geo magnetic directions, longitudes & latitudes with help of this mobile. It is also helpful in Drive Directions using one of the available 2 modes "Fastest Path Mode" & " Shortest Path Mode", besides them there is 3rd mode for pedestrians directions. It also provides information about the speed at which you are driving your car.

In INDIA navigator comes with pre-installed maps of eight cities including Delhi and NCR, Jaipur, Ahmedabad, Pune, Mumbai, Chennai,Bangalore and Hyderabad. These maps include the locations and details of roads, restaurants, hotels, banks, ATMs, schools, colleges, petrol pumps, hospitals and medicine shops, and other places of interests.

In India it is costing around Rs.13,500.

After my first experience with this mobile I will say the navigation system is really helpful but it can be dice at times for locations which are under development like Gurgoan. But thats not something to worry for since you can easily do away with this problem by simply downloading the latest maps. I think its a cool and helpful device to have.

Microsoft's Windows7

noreply@blogger.com (Angad Singh) — Sat, 17 May 2008 13:33:00 +0000

As i had predicted few months back when i posted about increasing need for parallel processing will bring in the need for Tabbed Viewing in File System Explorer. Well Finally Microsoft's New Windows7 has implemented it. In my previous post i had mentioned about the advantage of implementing it and also showed snaps from my project in which i had implemented Tab Viewing.

Some of the features of Windows 7 are:

Tabbed Viewing for increasing the support for parallel processing.
A New Disk Usage Analyzer which provide in-dept detailed analysis.
Support for Virtual Drive.
A new Website Blog and Portal Designer.

Here is a video showing how Windows7 would look like......

It gives me a feeling that Microsoft's Windows 7 gives user more power with customizing abilities and its gone be a cool new interface with some lovely new user friendly features....................

Link to some More Video's of Windows 7 : Windows7
Link Previous Post:Future Looks Of MyComputer

The World’s First Zero-Emissions City ....In Oil Rich Abu Dhabi

noreply@blogger.com (Angad Singh) — Mon, 12 May 2008 15:29:00 +0000

World’s first zero-emission city is on its way to be built in oil-rich Abu Dhabi. With this Abu Dhabi is hoping the project will propel the country to become world leaders in renewable energy.

Construction started on a city that will house 50,000 people and 1,500 businesses but use extremely little energy. The city's designers predict that efficiency improvements will result in a 75 percent reduction in energy consumption compared with a conventional city of the same size.

Some of the Design Paradigms which are implemented to make it zero emission are

Thin-film solar panels will serve as the facades and roofing for buildings. High tech sensors will closely monitor energy use to ensure nothing is wasted.
Driverless vehicles will be powered by batteries that make cars obsolete. All you do is type in your destination, and an electric carriage comes to your door to automatically take you to your destination on tracks using magnetic levitation.
To keep people aware of their energy habits, sensors throughout the city will keep residents aware of how much their energy usage will cost them, which serves as a nice little reminder to keep habits reasonable.

The goal of the new city is to set new standards and develop new technology for clean sustainable that can be transferred to other cities around the world.

Source:Dailygalaxy

HTC's Touch Diamond

noreply@blogger.com (Angad Singh) — Sun, 11 May 2008 18:47:00 +0000

It's now HTC coming with a new touch screen phone which seems to be inspired by Apple's iphone in many ways. It is Touch Diamond which will undoubtedly get compared to the iPhone, as the two devices share more than a few similarities.

The on-screen keyboard is one example which looks exactly like the iPhone's. There's even a zoom in / zoom out effect when opening and closing the full programs menu... just like the iPhone. And of course a custom YouTube app... just like you-know-who.

Some of the features which distinguish it are.....

1. It's sleek and smaller

The Touch Diamond is about the size of a deck of cards, but half the thickness and lot smaller than it looks in comparison to iphone. It also manages to squeeze a 640x480 screen into such a small body.

2. Silent your phone by setting the face down

If you get an incoming call that you don't want to answer, you can set the phone face down on your desk to silence the ringer.

3. Auto opening of notepad

If you want to jot something down mid-conversation, pulling the stylus out of the bottom of the phone will automatically open up the note-taking application.

4.Cool Flashing LED

The circular touchpad also has various LED configurations that will flash in different combinations to alert you to missed calls, new e-mails, new text messages, and so forth.

5.New TouchFlo 3D interface

The new TouchFlo 3D interface does completely replace the main programs menu, which is a welcome touch. Now you can easily choose and arrange icons for your most-used applications on a custom menu set up exactly how you like it, and even the list of additional programs has a slick look with finger-touch interaction.

All in all, I think the Touch Diamond will find its way into a lot of people's hands.

Will it be next big hit after iphone? Probably i believe YES.

Source:Phone Scoop

Security flaw turns Gmail into open-relay server

noreply@blogger.com (Angad Singh) — Sun, 11 May 2008 06:19:00 +0000

A recent study by Information Security Research Team(INSERT) has revealed flaws in Google's e-mail service turning Gmail into a highly effective spam machine. According to the INSERT, Gmail is susceptible to a man-in-the-middle attack that allows a spammer to send thousands of bulk e-mails through Google's SMTP service. Despite the fact that Google has identity fraud protection mechanisms and a limit of 500-messages on bulk e-mail but still allows spammers to send a potentially unlimited number of messages .The attack specifically exploits Gmail’s email forwarding functionality.

Situation seems even worse when we consider the fact that E-mail that originates from Google, are well-regarded by both Yahoo and Hotmail. If you try to send spam mails directly to Yahoo and Hotmail from a blacklisted IP, mails don't even necessarily reach the account's spam box, while forged e-mail sent via Gmail always arrived in the intended account's inbox. Hence exploiting the trust hierarchy among Email Servers.

As Spam messages represents 95% of all email communications, it is simply not feasible to apply the full power of spam filtering to every single message that is received by email servers. Thus to tackle this problem Servers do blacklisting of IP addresses of spam ofenders . This way, messages from blacklisted IP's are reject before even entering the system, and whitelisted addresses are granted ' to bypass most of the filters.

Source: Information Security Research Team

Beautiful Pics of Yosemite for Wallpaper

noreply@blogger.com (Angad Singh) — Thu, 01 May 2008 15:19:00 +0000

For a change i decided to post something other than technical for my readers.......

I am a nature lover, like to visit places with open blue sky's, widely spread green fields, deep blue sea's and snow around.....

Here i would like to share pictures of a beautiful place called Yosemite where one of my cousins went and i would definitely visit this place some day..........

These pics will serve as my Wallpaper for next few days. Hope you would like it................

Hidding Files and Folders

noreply@blogger.com (Angad Singh) — Sat, 22 Mar 2008 09:33:00 +0000

Sometimes we need a method to safegaurd are important documents or folders from accidental deletion or we don't want others to read a document. Generally what we tend to do is just change the properties of that files and folder to Hidden. But do u think it's the right way to protect ?? bcoz most of people today know this. So here's a trick which can help you safegaurd your documents............

Steps to safegaurd files and folders.....

Create a new folder.
Delete the name of folder rename it by just pressing the "ALT" button and then on the NUM PAD press "255" and then press enter.You will notice that the file you have just renamed has no name.
Now right click on the folder and click on "Properties"

In the upper tab of the box click on "Customize"
Then in the folder icon section click on "Change Icon"

Here you will see different icons, you will see that some icon spaces are blank.

Select one of the blank spaces and then click "OK"
Then On the "Properties" box click ok.

You will be amazed to see that your file is no longer visible.You can still click on that folder and drag it any where you want.

However if you try to hide this folder by changing its properties, it will result into it being show as the first folder in the directory where you have tried to make this folder... "This will happen Only if you try to select the option of showing hidden documents".

This ALT -255 is known as Hidden Dragon. If you want to read more about it then click here

Please give your opnion about this trick...................

Recovering Deleted Data From Hard Disk

noreply@blogger.com (Angad Singh) — Sun, 16 Mar 2008 16:23:00 +0000

It happens sometimes that we may accidentally delete some precious file or it might be the case where our hard disk might have crashed leading to loss of precious data. When ever such a thing happens, its just that we have deleted a record from the primary table of the hard disk what it means is that we haven't actually lost the data, it is still there on the hard disk its only that its entry gets deleted. We can always possibly recover the data if the location where that file resided hasn't been override by some other file.

To recover data in such case we must follow the following steps.

Do not format the hard disk or try to add any new file.
Download the software to recover data from here.
Now just select the drive where the lost data resided and just scan it.
This software will show you the actual data which is there on the hard disk and now you can recover the file.

Well you may use this technique for hiding important files, what i mean is you may delete files from your PC nobody will be able to see the files.Now when ever you what to view the file its just click away just use the software recover it and see it.............

Show Hidden Files and Folder Not Working

noreply@blogger.com (Angad Singh) — Sat, 15 Mar 2008 11:56:00 +0000

For Past few days i have been battling with viruses of various kinds, first it was Funny UST Scandel.avi now its another heck of a virus which starts printing "++" repeatedly when ever i tried to write in a text field and it also didn't allow me to see hidden files and folders. Well i have battled half way through, now i am atleast able to view hidden files and folders. It was Ravmon which was responsible for hidden files and folders.

Symptoms of Ravmon

If you select the radio button “Show hidden files and folders”, and then press Ok. The changes would just disappear upon opening the dialog again.
Disabled Task manager.

It was probably virus attack after which the Windows registry was not being updated properly. So here is what you need to do to restore it back. Try one of these method.

Method 1

Go to registry editor by running regedit in the run box.
Go to this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\Advanced

In the right hand area, double click hidden and change the value to 1.

Method 2:

If the first method does not works Please download our Smart Antivirus from here:

http://technize.com/2008/01/22/smart-anti-virus/

This antivirus, did restore my Windows settings to default and hence i was able to view my hidden files and folders.

Please spare a few moments from your precious time and tell about your experiences.

Worm removal - Funny UST Scandal.avi.exe

noreply@blogger.com (Angad Singh) — Tue, 11 Mar 2008 03:11:00 +0000

One of the viruses which i have tackled off late is Funny UST SCandal.avi.exe

Some of the Symptoms Of Funny UST SCandal.avi.exe are

A orange icon with image of a Foot.
Files missing, Not able to view hidden files.
Every time you click on My Computer opens a new instance of it.
Task Manager automatically disappearing after few seconds, not able to view process.
System deadly slow
Installations not occurring.

If your case can be matched with the conditions given above, in all probability, you’ve got the Autoit.BD worm, better known by Funny UST Scandal.avi.exe. AVG, Norton, Avast! - all don’t detect the virus.

This Virus replicates itself on the various disk partitions. So even if you have deleted it from C:\ or formated your PC it will still persist in some other partition leaving you in the same dilemma again. So one of the best ways to tackle this is.....

Steps to Follow in order to remove it

Download and install TaskKiller. TaskKiller forcefully kills the task and hence stops virus from replicating. Run Task Killer, and a red skull icon will appear on the system tray.Left click it, and click Processes
Select to kill these processes -
- killer.exe
- lsass.exe
- smss.exe
Now open up Command Prompt (Start>Run>command). Type each command and press Enter to run it -
- cd\
- attrib -h -s smss.exe
- attrib -h -s autorun.inf
Open My Computer and go to "C:\", then "C:\Windows\System32" and "C:\Windows\System".
Delete the following files -
- smss.exe
- autorun.inf
- Funny UST Scandal.avi.exe
Now, go to C:\Documents and Settings\All users\Startmenu\Programs\Startup and delete the file lsass.exe.
Open Registry Editor (Start>Run>regedit)
Delete the key HKEY_LOCAL_MACHINE\Software\
Microsoft\WindowNT\CurrentVersion\Winlogon=shell(killer.exe
Delete the key HKEY_CURRENT_USER\Software\
Microsoft\windows\Currentversion\Run=runonce(c:\windows\smss.exe)
Check For the virus in the other root partitions and remove the Funny UST Scandal.avi.exe

If you want to read about other method's click here.

Web 2.0 : Interactive Visualization, Social Networking

noreply@blogger.com (Angad Singh) — Mon, 03 Mar 2008 16:50:00 +0000

We have entered the new era of Rich Internet Applications (RIAs), as more application on Web 2.0 i see, more i belief it's going to be style and user power that will dominate the Internet in future. I belief the endorsement of Web 2.0 is going to happen via RIAs.

The core value of RIAs is to develop Web Applications with users pleasant experience and interactive visualization. In comparision to old client-server technology which demanded high cost and lacked flexibility RIAs lowers the total cost significantly. RIAs also offer scalability, reliability, performance, and security on par with what they are used to with old client-server technology.

Some of the Important Characteristics of Web 2.0 which will play a central role in its wide spread adoption are

1. Ajax

One ingredient of Web 2.0 is certainly Ajax, basically what "Ajax" means is that web-based applications can now be made to work much more like desktop ones.

An Ajax application eliminates the start-stop-start-stop nature of interaction on the Web by introducing an intermediary — an Ajax engine — between the user and the server. It seems like adding a layer to the application would make it less responsive, but the opposite is true.

2. Democracy

The second big element of Web 2.0 is democracy. Wikipedia may be the most famous examples of democracy.

Generally when ever we try searching on a topic we end up looking for the relevant material on more than single site because it happens that the owner of single static blog or a website is not able to cover the topic from all perspectives. With the coming up of Wikipedia this concept of shared workspace on web was first introduced, where any user could add on his or her valuable knowledge on a given topic. This concept has been a great success, now when ever we are looking for info on any topic our first destination happens to be Wikipedia.

Let us look at some of the existing applications based on Web 2.0

Are you a real dance maniac then here's a You Tube like site DanceJam . It is all about dance, an effort to create an online community around amateur dancers. At the site, people can upload their dance videos and share them, watch videos that others have uploaded, learn dance moves, and even take part in "dance battles". This seems to be based on the Democracy characteristic of Web 2.0.

For visiting the site click here

Here is a new another interactive E-mail engine Webtop beta comes with a very familiar interface. It is a Web 2.0 application built with flash technology.

For visiting the site click here

Although it will take some time for wide spread adoption of the web 2.0 but eventually it will happen.

Multiple Boot Removal Issue

noreply@blogger.com (Angad Singh) — Wed, 27 Feb 2008 15:52:00 +0000

Do you have multiple boot of XP and other Operating System on PC, but want to remove anyone of them from start up login?

Steps To Follow.............................

Right Click on My computer go to properties.
Go to Advanced Tab.
Then Startup and Recovery setting.
Under System Startup> "Edit Start up options manually".This will open Boot.ini file, you can now remove manually one of the boot up/Operating system options from the multiple boot. Boot file with mutiple boot will look something like this...........

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional-set up" /noexecute=optin /fastdetect

Now in the above Boot.ini there are 2 boot options one is the Xp and other is a set setup of Xp this could have been any other operating system which ever is loaded. You just need to delete the option of operating system which you do not want to use any more or is invalid................

After removing the option of set up XP Boot .ini will look like.........

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

If you want to read More about it then clich here

Microsoft Pulls Plug on HD DVD Players

noreply@blogger.com (Angad Singh) — Mon, 25 Feb 2008 05:29:00 +0000

Only thing which comes to mind when i think of this long Format War as rightly stated in science is "Survival of the fittest". With Microsoft taking of its support from HD DVD it seems obvious that Format War is over now.

Microsoft was one of HD DVD's main backers, along with Intel Corp. and Japanese electronics maker NEC Corp., and its support for the format was seen as a big win for Toshiba's format. But HD DVD lost it's ground when big players such as Walt Disney, News Corp.'s Twentieth Century Fox ,Warner Bros and Wal-Mart Stores. picked Blu-ray to distribute high-def DVDs.

For now Microsoft would continue to provide standard warranty support for its HD DVD players.

For reading More on Format War click here

Open Source Goes Mainstream

noreply@blogger.com (Angad Singh) — Sun, 24 Feb 2008 07:28:00 +0000

This Question has been there for many year's now and most of the people will agree on this, that Open Source Environment as the most disruptive force in technology. With chain of events happening over the past month it seems we are inching closer to it.

First Sun Microsystems Announces Agreement to Acquire MySQL, Developer of the World's Most Popular Open Source Database for approximately $1 billion. Follow this with news from Microsoft that it would provide access to documentation for its major software products, including Windows Vista, Office 2007 and Exchange Server 2007.

Let's first take Suns move of acquiring MySQL.

Called the largest open-source software deal ever, the merger makes Sun the owner of a critical part of the popular LAMP open-source software stack. It reaffirms Sun's position as the leading provider of platforms for the Web economy and its role as the largest commercial open source contributor.

This acquisition accelerates Sun's position in enterprise IT to now include the $15 billion database market. Sun's strategic partners Facebook, Google, Nokia, and China Mobile will bring synergies that will change the landscape of the software industry and that will allow MySQL Open Source Database to grow more rapidly with its new adoptions in more traditional applications and enterprises. The complementary product with MySQL's database are expected to bring new markets for Sun's systems, virtualization, middleware and storage platforms.

Sun has been involved in the development of the rival open-source database, PostgreSQL, this acquisition will raise some questions over its future . Although Sun for now shows commitment to reaffirm its commitment to PostgreSQL.

Another important fact worth mentioning is that Oracle is as also one of the strategic partners of Sun for years. MySQL is one of the most competitive and threats to Oracle Corp., just because it's cheaper, and in many applications, more practical. What it means by bringing two rivals together is weakness of one would be used as a strength of other and bringing in fruitful results for both. Which means for lower-tier database applications, MySQL can offer the core functionality and with the advanced features list Oracle could serve the needs as it continues to have the edge over MySQL in this field.

Let's Now take a look at Microsoft's interoperability promise

It seems as an acknowledgment that Microsoft can't ignore the open-source community's impact on its business and prominence in the industry any longer.With its move to provide access to documentation for its major software products, including Windows Vista, Office 2007 and Exchange Server 2007, it could repair its tarnished reputation in the technology industry and help the company get out of its own way to compete more effectively with Google.

Microsoft has been anti-Open Source for a long time but this sudden change in mood is certainly attributed to the growing trend and wide spreed adoption of Open Environment . Now what one can look forward from this move is an restrained access to Microsoft APIs and some interfering from Microsoft.

Some of the restrictions one could expect to see are, one might require license or developer id from making any changes to Microsoft Products and these IDs would be offered at some suitable registering cost. Another restriction could be developers won't be allowed to share there changes openly, which means one has to first submit modified product to Microsoft which will then finally be offered to customers under the label of Microsoft.

If one looks from the point of view of intellectual knowledge which the Microsoft's product will bring to open market these restrictions might seem worth to be under.

Moral of the Story is Open Source will rule the world one day.................

Issuu - Turn's PDF files into online books

noreply@blogger.com (Angad Singh) — Sat, 16 Feb 2008 09:43:00 +0000

Issuu is a Web 2.0 service which can convert any PDF files to Flash based online books.

Convert your documents into a compatible PDF format. Your PDF must be Version 1.0-1.5 , 100 mb max , 500 pages max and about 100 dpi resolution. When you upload a PDF to Issuu, you are asked to select 'Target area' for better listing of your document in search results.

After Converting your document into a online format using Issuu you can view your document using a Flash player to open it in a neat magazine-style viewer format, you can also post (embed) your Issuu documents on any external site, profile or social networking websites such as MySpace, Facebook, Friendster, Blogger, and etc. Users are able to customize the viewer’s background color and the dimension.The interesting feature is it enable user who doesn’t install PDF plugin to view the book.

Readers can click the OPEN PUBLICATION button to view the full-screen of the document.

Microsoft Bids For Presidential Hold of Internet

noreply@blogger.com (Angad Singh) — Wed, 06 Feb 2008 08:42:00 +0000

One of the biggest competition which everybody is looking forward these days is the Presidential elections of USA, another war of simila scale is going on between the Microsoft and Google over the supremacy of internet.

Last week Microsoft a dominant player of desktop PCs showed its interest in acquiring the sinking ship of Yahoo by offering 31$ per share this has led to a mixed response from Internet fraternity. Google one of the prominent stake holders of internet has shown its concern over this issue. They believe the Microsoft will destroy the concept of openness of internet and innovation and will try to monopolize it.

The potential impact of this Joint venture if it took place could be that, it will make Microsoft one of the major forces of Chatting and Mailing services. Well I have always seen Microsoft as one of the major trend setters in desktop market and Google as force to recon when it comes to internet, I think the competition between the two companies would definitely be fascinating and will be beneficial for the Internet Users and Bloggers as it might open more options to earn while we surf the net.

Do You think the same as i do on this issue? please post your opnion on this issue.....................

Global Warming a New Challenge For Mr.Ratan Tata

noreply@blogger.com (Angad Singh) — Fri, 11 Jan 2008 19:37:00 +0000

As a Citizen of India i have some social responsibilities although this is a technical blog but i have decided to use it alongside as a stage to speak out on some social issues.Yesterday a new Tata car "nano" was launched this post is definitely not about its features and accessories, its about is it really what India wants?

After every car launch we hear this phase "Environment friendly" but do you really think it means what is said? well i don't think so as the number of cars are increasing the pollution is definitely going to increase whether you say it is EURO 3 or EURO 4 compliant. We always see the impact of single car on environment but now with TATA launching Rs. 1 Lakh it will definitely mean more cars on roads and if you see the total combined effect of all the new cars on roads its effect will be devastating .

These are the Euro norms

	Euro 1	Euro 2	Euro 3	Euro 4
	1992	1995	2000	2004
Nox	8	7	<5>	<3
CO	4.5	4	2.5	1
HC	1.1	1.1	0.7	0.5
PM	0.36	0.15	<0.10	<0.10

Tata has expressed its desire to sell 2.5 lakh in next year or so now if you analyze the combined effect of all these vehicles considering it to be EURO3 compliant it will contribute Nox: 1000 K units CO: 625K units HC :175 k PM: 225k . Now what do you think about these figures aren't these figures going to worsen the already choke environment? Isn't this going to trigger the extinction of Life on earth?

Only solution what according to me is the best way to deal with this situation is that their should be a check on the total number of vehicles which a particular manufacturer could make and also phasing out the delivery of the cars, fixing the number of cars which could be sold in a particular area depending on the environment conditions of the area.

Few days back i read a report from NASA which said Mumbai is one of the cities which will drown by 2012 due to the effects of global warming. I think one of the major contributors to pollutions are the use of private vehicles, with increase in purchasing power of people their is a growing trend of purchasing cars. This trend could only be stopped if the people are provided with an alternate public transport system which offers them some acceptable comfort level . I think its time to call in Private Public Participation in the Public transportation here i call Mr. Ratan Tata this is a New Challenge for you.

Flash web desktop Jooce

noreply@blogger.com (Angad Singh) — Sun, 06 Jan 2008 19:53:00 +0000

Jooce is something really amazing web desktop i came across. have you ever heard about online operating system well although it doesn't exist now but this system made me belief that in near future this could be the next big thing coming our way.

Jooce is an web desktop which provides you with all the options of storing and organizing files. Not only this it provides something similar two 3d viewing.It also offers you to save in your contacts from Yahoo, Msn, and Aim . It also has a unique Control panel which helps you set wallpapers, effects, Avtar, and reset password.

Now coming to 3d part well you can switch over from your desktop to your friends desktop and during the switch over it shows something similar to what a 3d browser does. The main thing of importance is that you can easily share files among your contacts.This operating system is of use for users who are always traveling and may need any files in there PC back home to be at their place of reallocation.

This according to me, Jooce will add new dimensions to the way people like to store or share data. Please share in your opinion on this............................

If you intend to read more about Jooce or want to experience it then here is the link

http://www.jooce.com/

Steps to Increase Traffic on Blog :RssHugger

noreply@blogger.com (Angad Singh) — Sun, 06 Jan 2008 18:10:00 +0000

As i am just 3 months old in blogging i am on the lookout to increase traffic on my blog.I have read many blogs many suggestions some say one has to have quality in posts and some believe you must be frequent in blogging, but as a new blogger what i realize after 3 months of working on the above said principles is that, these things can only come into picture when a blog is reachable to a larger audience. For that it means definitely there should be more websites which refer to your website and you must be frequent in giving out your opinion and appreciating other bloggers for there work.

So now to work on the new principle which i have suggested two questions which directly comes to my mind is that Firstly Is there anyone who would refer my site and help me in bringing my blog to an global exposure?? and secondly why would any body refer to my site ??.........well well now the answer to my first question I found after a lot of research and it lies in RssHugger.I found that many bloggers who are successful are opting for it to increase traffic.

Now i would answer for Why? which is my second question. I have figure out that the principles that many blogs which I had read and followed were the answer. For this you need to have some quality posts and frequent posts. Now I would be submitting this review post link about RssHugers to RssHuggers which is one of the conditions laid by them, then they will review my blog and if my blog is good enough then my blog may get some more readers. RssHuggers also provide with another option that is instead of writing a review you can pay them $20.

RssHugers is a new website that brings bloggers and readers together. Not only rsshuggers help in getting traffic, but it also provide value in building backlinks for search engine optimization. RSS Hugger is the conecpt from Collin LaHay an search engine optimizer, and internet marketer. A recent contest on shoemoney.com inspired Collin to develop this unique concept.

There are already 577 RSS feeds from various blogs at the time of writing this post. If you want to add your blog, go to rsshugger.com, register and write a review about it. I have given out my opinion now let’s see how much traffic it sends!

HD DVD vs Blue Ray war Over, Blue Ray ready to became a Standard

noreply@blogger.com (Angad Singh) — Sat, 05 Jan 2008 04:11:00 +0000

With the beginning of a New Year comes the good news for consumers, Blue Ray has taken another step towards victory, with it giving us the hope of ending the long battle between HD DVD of Toshiba and Blue Ray disk of Sony.

Time Warner's Warner Bros. studio has stopped supporting the HD DVD format and will now work exclusively with Sony's Blu-ray.With this it seems likely that the balance has tipped permanently in favor of Sony.Warner Bros CEO Barry Meyer contend that the competing formats create confusion that is keeping either format from mass acceptance. But, they say Blu-ray has been the clear consumer winner so far and going with that format makes the most sense going forward.This is a good news for Hollywood, as it will end the confusion of consumers and will enable them to go with next-gen DVDs.

Let me try to brief about the differences the two technologies

Capacity

	Blu-Ray	HDDVD
ROM single layer:	25GB	15GB
ROM dual layer:	50GB	30GB
Highest test:	100GB	45GB
Theoretical limit:	200GB	60GB

Cost

The 0.65 aperture for HD DVD vs. 0.85 aperture for Blu-ray—thus also making the two pickups technically incompatible despite using lasers of the same type.Blue Ray is definitely costlier than HD DVDs as a special hard coating must also be applied to Blu-ray discs, so their surface is sufficiently resilient enough to protect the data a mere 0.1mm beneath. The added benefit of keeping the data layer closer to the surface, however, is more room for extra layers.

I always believed that HD DVD was of no competition with Blue Ray , it was just a corporate fight between two old rivals Toshiba and Sony which i knew will end with the technology which has the potential to be a future technology. As things are getting computerized there will be always an ever increasing need for more storage space which clearly means one must support a technology which has the potential to expand to max which will definitely rate Blue Ray ahead.

Another silent reason which caused this battle was that Blue Ray is developed in Java which lead the rival company Microsoft supporting HD DVD and even today it is still standing by it. Well Well i don't see Microsoft changing its view point by any means but still i believe as the other big corporate house are in favor of Blue Ray it will end soon with Blue Ray standing a WINNER !