What are two fundamental cryptography principles?

In this article we shall discuss about the two fundamental principles that govern a cryptographic system. 

1. Redundancy

- Some redundancy must be there in all the encrypted messages. 

- By redundancy here, we mean the information that is not required for understanding the message reducing the chances for a passive intruder to make attacks. 

- Passive intruder attacks involve putting the stolen information to misuse without understanding it. 

- This can be more easily understood by an example of a credit card. 

- The credit card number is not alone sent over the internet rather it is accompanied by other side info such as the DOB of the card holder, its validity date and so on. 

- Including such info with the card number cuts down on the changes for making up the number. 

- Adding a good amount of redundancy prevents the active intruders from sending garbage values and then getting it verified as some valid message. 

- The recipient must be capable of determining whether the message is valid or not by  doing some inspection and simple calculation. 

- Without redundancy the attackers would simply send junk message and the recipient will decode it as a valid message. 

- However, there is a little concern also with this. 

- N number of zeroes must not be put at the beginning or the end of the message for redundancy because such messages become easy to be predicted thus facilitating the crypt analysts work.

- Instead of zeroes, a CRC polynomial can be used because it proves to be more work. 

- Using cryptographic hash might be even better.

- Redundancy has also got a role to play in quantum cryptography. 

- Some redundancy is required in the messages for the bob to determine if the message has been tampered. 

- Repetition of the message twice is a crude form of redundancy.

- If the two copies are found to be identical, the bob states that somebody is interfering with the transmission or there is a lot of noise. 

- But such repetition process to be expensive. 

- Therefore, for error detection and correction the methods used are reed Solomon and hamming codes.

2. Update

- Measures must be compulsorily taken for the prevention of the attacks by active intruders who might play back the old messages. 

- The longer an encrypted message is held by an active intruder, the more is the possibility that he can break in to it. 

- One good example of this is the UNIX password file.

- For anybody who has an account on the host, the password is accessible. 

- A copy of this file can be obtained by the intruders and they can then easily de-crypt the password.

- Also, the addition of the redundancy allows the simplification of the messages’ decryption.

- It must be checked whether the message has been sent recently or is an old one. 

- One measure for doing so is including a time stamp of few seconds in the message. 

- This message then can be saved by the recipient for that many seconds and can be used for comparing with the incoming messages and filtering the duplicates.

- Messages which exceed this time period will be rejected as being too old.

Apart from the above two principles the following are some other principles of cryptography:

Ø Authentication: For ensuring that the message was generated by the sender itself and no one else so that no outsider can claim as being the owner of the message.

Ø Integrity: In cryptography, the integrity of the messages must be preserved while sending the message from one host to another. This involves ensuring that the message is not altered on the way. Using cryptographic hash is a way to achieve this.

Ø  Non-repudiation

What is Wifi technology? How does it work?

- Wifi has emerged as a very popular technology. 

- This technology has enabled the electronic devices to exchange information between them and to share the internet connection without using any cables or wires. 

- It is a wireless technology. 

- This technology works with the help of the radio waves. 

- The Wifi is defined as a WLAN (wireless local area network) product by the wifi alliance that is based on the standards defined by IEEE (802.11 standards). 

- Most of the WLANs are based upon these standards only and so this technology has been named as wifi which is the synonymous with the term WLAN. 

- The wifi-certified trademark might be used by only those wifi products which have the complete certification for the wifi alliance inter-operability. 

- A number of devices now use wifi such as the PCs, smart phones, video game consoles, digital cameras, digital audio players, tablet computers and so on. 

- All these devices can connect to the network and access internet by means of a wireless network access point. 

- Such an access point is more commonly known as a ‘hotspot’. 

- The range of an access point is up to 20 m. 

- But it has a much greater range outside.  

- An access point can be installed in a single room or in an area of many square miles. 

- This can be achieved by using a number of overlapping access points. 

- However, the security of the wifi is less compared to the wired connections for example Internet.

- This is so because a physical connection is not required by an intruder. 

- The web pages using SSL have security but the intruders can easily access the non-encrypted files on the internet. 

- It is because of this, that the various encryption technologies have been adopted by the wifi. 

- The earlier WEP encryption was weak and so was easy to break.

- Later, came the higher quality protocols such as the WPA2 and WPA. 

- The WPS or the wifi protected set up was an optional feature that was added in the year of 2007. 

- This option a very serious flaw which is that it allowed the recovery of the password of the router by an attacker.

- The certification and the test plan has been updated by the wifi alliance for ensuring that there is resistance against attacks in all the devices that have been newly certified.

- For connecting to a wifi LAN, a wireless network interface controller has to be incorporated in to the computer system.

- This combination of the interface controller and the computer is often called as the station. 

- The same radio frequency communication channel is shared by all the stations.

- Also, all the stations receive any transmission on this channel. 

- Also, the user is not informed of the fact that the data was delivered to the recipient and so is termed as the ‘best–effort delivery mechanism’. 

- For transmitting the data packets, a carrier wave is used. 

- These data packets are commonly known as the ‘Ethernet frames’. 

- Each station regularly tunes in to the radio frequency channel for picking up the transmissions that are available. 

- A device that is wifi enabled can connect to the network if it lies in the range of the wireless network. 

- One condition is that the network should have been configured for permitting such a connection. 

- For providing coverage in a large area multiple hotspots are required. 

- For example, wireless mesh networks in London. 

- Through wifi, services can be provided in independent businesses, private homes, public spaces, high street chains and so on. 

- These hotspots have been set up either commercially or free of charge. 

- Free hotspots are provided at hotels, restaurants and airports. 

How can firewalls secure a network?

Firewalls in computer systems are either software based or hardware based. But they have the same purpose of keeping a control over the incoming as well as the outgoing traffic. 

In this article we discuss about how the network is secured by the firewalls. 

- This control is maintained through the analyzation of the data packets. 

- After analyzation, the firewall’s work is to determine whether to allow these packets to pass or not. 

- This decision is taken based up on some set of rules.

- With this set of rules, a barrier is established by the firewall between the external network that is not considered as secure and trusted and the internal network which is secure and trusted. 

- Most of the personal computer’s operating systems come with a built-in software based firewall for providing protection against the threats from external networks. 

- Some firewall components might also be installed in the intermediate routers in the network. 

- Also some firewalls have been designed to perform routing as well.

There are different types of firewalls which function differently.This classification of the firewalls is based up on the place where the communication is taking place i.e., whether at the network layer or the application layer.

Packet filters or network layer: 

- Firewalls used at the network layer are often termed as the packet filters. 

- This firewall operates at low level of the protocol stack of the TCP/ IP and so does not allow the packets to pass through it unless they satisfy all the rules. 

- These rules might be defined by the administrator of the firewall. 

- These firewalls can also be classified in to two categories namely the stateless firewalls and the state-ful firewall. 

- The former kind use less memory and operates faster in the simple filters, thus taking less time for filtering. 

- These firewalls are used for filtering the stateless network protocols i.e., the protocols which do not follow the session concept. 

- These firewalls are not capable of making complex decisions based up on the state of the communication. 

- The latter kind maintains the context of the active sessions. 

- This state info is used by these firewalls for speeding up the packet processing. 

- A connection is described using any of the properties such as the UDP or TCP ports, IP addresses and so on. 

- If a match is found between an existing connection and the packet, it is allowed to pass. 

- Today firewalls have capabilities of filtering the packets based up on attributes like IP addresses of source and destination hosts, protocols, originator’s netblock, TTL values and so on.

Application layer Firewalls: 

- Firewalls of this type work on the TCP/ IP stack’s application level. 

- All the packets traveling in and out of the application are intercepted by this firewall. 

- This leads to blocking of the other packets also. 

- Firstly, all the packets are inspected for any malicious content for preventing the outspread of the Trojans and worms. 

- Some additional inspection criteria might be used for adding some extra latency to the packet forwarding. 

- This firewall determines whether a given connection should be accepted by a process. 

- This function is established by the firewalls by hooking themselves in to the socket calls for filtering the connections. 

- These application layer firewalls are then termed as the socket filters.

- There way of working is somewhat similar to the packet filters except that the rules are applied to every process rather than connections. 

- Also, the rules are defined using the prompts for those processes that have not been provided with a connection. 

- These firewalls are implemented in combination with the packet filters.

Explain how the data is secured in HTTPS?

HTTP secure or HTTPS can be thought of as an extended version of the regular HTTP. This communication protocol is the widely used one next to the regular HTTP when it comes to having a secure communication path between the user and the server over a computer network. 

The HTTPS finds quite a wide deployment over the internet when compared to deployment over intranet. If we understand it deeply we will come to know that in actual it is not a protocol in itself as it seems so from outside. 

It is actually a regular hyper text transfer protocol (HTTP) simply layered over SSL/ TSL protocol. The SSL/ TSL protocol thus lends its security capabilities to the standard HTTP communications when HTTP is layered up on SSL/ TSL. 

In this article we discuss how the data is secured in HTTPS. As we mentioned above that it is quite deployed in the internet services and it is so because it provides a quite convenient means to authenticate the web site as well as the web server associated with it (with which the connection is being established).

How data is secured in HTTPS

Such an authentication is of much importance as it provides the protection against the man in middle attacks which usually occurs because of eavesdropping between our communications with the server. 

- Moreover, HTTPS provides bidirectional encryption of the communications or the data that is exchanged between the clients and the servers. 

- The ability of the bidirectional encryption by virtue of which it protects against tampering and eavesdropping which otherwise would forge the contents of the communications between the clients and the servers, makes it much necessary. 

- HTTPS comes with a reasonable guarantee that you get to communicate only with the web site which you intended to communicate with and with none else.  - Furthermore, a way to prevent the forgery of the contents of the communication that takes place between the users and the clients cannot be hampered or forged by any of the third parties is ensured by the http secure. 

- In HTTPS, the entire HTTP is levied up on the top of the TSL or SSL thus enabling the total encryption of the HTTP communications content.

- This communications content includes:

1. Request URL which states the particular web page that was requested.
2. Query parameters
3. Headers
4. Cookies containing the identity information about the user and so on. 

Negative Points of HTTPS

Though the HTTPS has got many advantages, its minus point cannot be unseen.

-HTTPS cannot protect the disclosure of the communication content.

-This happens so because the addresses of the host web sites and port numbers form a necessary part of the TCP/ IP protocols that underlie the https. -To be seen practically, it means that the identity of the server can still be inferred by the eavesdroppers even on a correctly configured web server as well as the amount and duration of the communication.

-In the early years, the HTTPS was common to be used in the money transactions over the World Wide Web and other sensitive transitions like e- mails.

-In the recent years it has been known for the following:

1. Authenticating the web pages,
2. Providing security to the accounts,
3. Maintaining the privacy of the user communications, web browsing and identity.

The HTTPS has also come to the rescue of the wi- fi since it is highly prone to attacks being un- encrypted. The importance of https is often more realized when the connections are made over tor or anonymity network.       

How does penetration testing tool emphasize on web application security?

In this internet savvy world, web applications have become an important part of web utilization. Web applications provide a means to utilize or exploit the services offered by the web in a more meaningful manner. 

The earlier years saw less use of web applications, but now it is reaching new heights day by day with a great demand for improving the existing ones along with the introduction of new ones. With such a vast number of users, the application needs to maintain its security from the malicious attackers among these users and so adequate security measures have to be taken.

For this purpose, it is required that the security mechanism of the applications to be checked thoroughly for any vulnerabilities and security leaks via the penetration testing. Penetration testing is perhaps the best testing methodology when it comes to the testing the security different software system components like network security, data base security etc. 

There should be some testing methodology that could dig out all the potential vulnerabilities. Is there an answer? Yes there certainly is! The penetration testing! Perhaps many of us are familiar with this testing methodology. In this piece of writing we have discussed how the penetration testing tools emphasize up on the web application security. 

About Penetration Testing and its emphasis on Web Application Security

- Penetration testing is yet another testing methodology that has been adopted for testing the security of the  web applications against the malicious attacks.

- It provides a way to evaluate the security level of the web application by troubling the application with false simulated attacks as malicious attacks from the outside as well as inside attackers. 

- It also deals with the aliens, foreigners or outside attackers who do not have any authorized access to the computer system or network and inside attackers who do have that access.

- An active analysis is required to be carried out for the penetration testing which carries out an assessment of all the potential vulnerabilities of the web application that are merely a consequence of its poor security level as well as configuration level. 

- Apart from this the known and unknown flaws form both the hardware as well as software components of the application contribute to these vulnerabilities rather than only operational weaknesses.

- A proper active analysis is achieved only if it is carried out from the view point of a malicious attacker and involves the active exploitation of the recognized vulnerabilities.

- The web application security depends up on the effectiveness of the testing.

- The testing in turn is largely affected by the effectiveness of the tools that are employed in the testing.

- The tools indeed affect the web application security, since if the tools are reliable and efficient in searching for the vulnerabilities, obviously there will be more stringent checking of the security mechanisms. 

- The identification and recognition of the vulnerabilities is always the first step in penetration testing.

- A required number of penetration tests are then carried out on that particular system with the coupling of information with the active assessment of the risks associated with the computer system or network using the penetration testing tools. 

- A whole lot of effective tools are designed to reduce the affect of the identified potential vulnerabilities. 

- Penetration testing tools have been recognized as important component of the web application security audits. 

What is meant by penetration testing?

The term “penetration testing” is not so rare and perhaps many of us familiar with this type of testing. In this piece of writing we have discussed the penetration testing in more detail. 

About Penetration Testing

- Penetration testing is another testing methodology adopted for testing the security of a computer network or system against the malicious attacks. 

- Penetration testing evaluates the security level of the computer network by bombarding the network with false simulated attacks as malicious attacks from outside as well as inside attackers.

- The outside attackers do not hold any authorized access to the computer system or network but the inside attackers do have than access but only to a certain level. 

- The whole process of the penetration is based on an active analysis.

- This active analysis assesses all the potential vulnerabilities of the computer network or system that are merely a result of its poor security level as well as configuration level.

- Apart from this, the known and unknown flaws form both the hardware as well as software system contribute to these vulnerabilities rather than only operational weaknesses. 

- This active analysis is carried out from the view point of a malicious attacker and is all about the active exploitation of the recognized vulnerabilities. 

Steps in Penetration Testing

- First step in the penetration testing is always the identification of the vulnerabilities. 

- The identified issues and vulnerabilities are then brought to the notice of the whole development team.

- A number of penetration tests are then carried out on that particular system along with the coupling of the information with the active assessment of the risks associated with the computer system or network. 

- A whole lot of effective procedures are designed to reduce the affect of these vulnerabilities. 

Advantages of Penetration Testing

There are several other reasons why the penetration testing holds good:

1. It is effective for the determination of the feasibility of the similar vectors of attack.
2. Helps in the identification of the vulnerabilities which possess a very high risk when the exploitation of a combination of low level risks is done following a particular sequence.
3. Proves quite effective in the determination of the vulnerabilities that cannot be detected with the help of application vulnerability scanning software or automated testing processes.
4. Assists in the assessment of the measure of the operational and business impacts of the attacks on the computer network or system.
5. Successfully tests the effectiveness of the network defenders in detecting and responding to the attacks.
6. Provides the evidences in support of the investments that need to be made in the security field of the computer system or network.

Penetration testing has been recognized as an important component of the security audits. The penetration testing can be carried either way round i.e., either through the black box testing route or through the white box testing route. 

The path to be taken is decided by the amount of knowledge that the tester has about the system or network under testing. If the tester has got a brief knowledge then the black box testing route is followed else the white box testing techniques are preferred. 

Another thing to be determined before starting the testing is the location of the system that has to be tested and also its extent. 

Penetration testing if carried through white box testing

For following the white box approach to penetration testing, the testers needs:

- to have the full knowledge of the system infrastructure,

- to have the full knowledge of the source code, 

- to have the full knowledge of the IP address and

- to have the full knowledge of the network diagrams etc. 

In some cases the grey box approach to penetration testing can also be followed based on how much information is available. Black box approach is useful for simulating an outsider attack whereas the white box approach can simulate and insider attack.  

Explain the concepts of Directory traversal attacks?

Another name for directory traversal attack is path traversal attack and there is quite unfamiliarity among people regarding this security threat. We have dedicated this entire article to make you aware of this security threat.

What is meant by Directory Traversal Attacks?

- Directory traversal attacks involve the exploitation of the insufficient sanitization or validation of the security regarding the input data supplied by the end user.
- This results in the passing of the characters representing the traverse to parent directory to the API files.
- The directory traversal attacks are aimed at accessing a computer file that is not intended to be accessible by ordering an application to do so.
- The application acts to the commands of the attacker.
- Here, in such situations there is no fault in the program code and it works perfectly fine but, it lacks in security and that is what that is taken advantage of by the attackers.
- He/ she takes an advantage of the lack of the security of the software system or application.
- This is completely opposite to the exploitation of the bugs of a code.
- Some times directory traversal attacks are also denoted as the “_ _ / attack” (pronounced as dot dot slash attack).
- One common form of such attacks is the canonicalization attacks.
- Some other rare forms are back tracking and directory climbing etc.
- In every operating system there exists a common file that is often used by the hackers to crack the passwords.
- In some operating systems like UNIX, no such password file exists.
- Rather the passwords are stored in some shadow file which is not accessible to the users that are recognized as the unprivileged by the machine. - Password  files are useful in another way also i.e., for enumeration of the accounts on that particular machine and displays whatever are the user accounts present on the system.
- Many variations are observed in the directory traversal attacks based on the directory traversal attack strings used in different operating systems.
- Directory traversal attacks create quite a menace these days which becomes quite difficult to manage.

How to prevent directory traversal attacks?

Software engineers have formulated an algorithm for the prevention of directory traversal attacks which is like this:
- Process URI requests such that they do not invoke any file request. For example, execution of a hook in to the code.
-  Always specify the full path to the directory or file if any exists while normalizing all the characters whenever you have to process a URI request. For example, normalize %20 to spaces.
-  Assume the length of the string to be N and a normalized path exists for a document root that is fully qualified and that no files outside this are accessible.
-  Ensure that the first n characters of the string match exactly with the document root of the requested file.
-  If the above condition proves to be true allow the file to be served.
-  If the above condition is proved false, an error should be returned since the requested file is inaccessible.

An efficient control over the accessing of the web content is highly required for the effective running of the web server in a secure mode. Mostly the web servers employ either of the two security mechanisms listed below: 

1. Root directory:
This directory keeps the users bounded to the specific limits outside which nothing can be accessed. It is created in order to avoid the unauthorized access of the files containing sensitive data by unprivileged users.
2. Access control lists (ACLs): 
These lists find their use in the process of authorization.  The lists contain the information of the users who can legally access the files.

What are different aspects of DBMS specific SQL injection attack?

DBMS specific SQL injection attack is one of the different types of the SQL injection. Some of the SQL injection attacks that are carried out today on web sites are based up on the DBMS specific SQL injection. 

About DBMS specific SQL

- DBMS specific SQL is employed for sending the certain specified statements to the engine of the data base for its execution. 

- Unless the connection is not specified, the default cursors for the default connections are used by the prolific. 

- For the DBMS specific SQL, the statements can fed to the data base engine in any format that it supports. 

- Such a privilege grants you the access to all the features of the data base.

- SQL injection attacks are quite well known vectors for the data base management systems because they fail to cleanse or sanitize the input supplied by the users. 

- Like in the web based applications, the passing SQL commands (these commands are the parameters of some stored procedure and functions) are exploited by the SQL injection attacks. 

- These malicious commands are then executed in the context of the component through which the required function is called. 

- This whole process is carried out via the system components as well as the administrator’s privileges.

- This process results in what is called the privilege escalation. 

Example to illustrate Privilege Escalation

- Suppose some component provides the backup functionality and is run at higher privilege.

- A function injected with the malicious SQL statements is called. 

- This allows the user become a DBA by escalating their privileges which then helps them to overtake the data base. 

- By keeping the data base patches up to date, many of the SQL injection attacks can be effectively avoided. 

- Though the classic SQL injection attack had become outdated and the inference SQL injection still continues to prevail as great security threat, the DBMS specific SQL injection attack is still considered to be supportive regardless of how the classic SQLIA, inference SQL and other types of SQLIAs are utilized. 

- The permissions to log in the data base that belongs to some web application can be limited to only what is required. 

- This may prove to be effective in reducing the affect of the SQL injection attack that may further exploit any bugs and errors present in the web application or site.

- Like bugs and errors the severity of the SQL injection attacks also ranges among low, medium and high levels.

- Following a successful SQL injection attack, the attackers can very easily execute the arbitrary SQL commands.

- Such vulnerability can be exploited by the remote authenticated users for injecting the malicious SQL statements and commands. 

-  A successful SQL injection can steal the sensitive data from the data base or modify it as he/ she desires.

- The attacker can even carry out the administrative operations on the data base like issuing a command to shut down the whole data base, recover a deleted file etc.

Approaches to avoid malicious SQL injection in database

Any of the two below mentioned approaches can be followed for avoiding the malicious SQL injections in to the data base:

1.  Parameterized queries: 

      - This approach involves the use of bounded queries. 

    - Out of the two, this is easier to follow and work in an almost similar way in many languages including java, .NET, PHP, Perl etc. 

      - In the parameterized queries the data and the query is kept separate from each other by bounds.

2.  Parameterized stored procedures: 

     - Though being a little difficult to implement, it proves to be more effective than the previous one in avoiding many types of SQL injection attacks.

Avoiding the use of dynamic table names and even if you are, don’t accept the names from the users since on using these measures it is very unlikely that your application will fall victim to the SQL injection attack. 

What are different kinds of security threats?

Security vulnerabilities and security threats are one of the biggest issues of today in the field of software engineering. As more sophisticated is the today’s software is, the more critical security issues it struggles with.

Any software is bombarded with one compulsory question that how safe and secure it is? Does it have any possibilities of keeping the attackers at bay from interfering with the security of the software system or application? Has any effective strategy been designed for dealing with any possible security issues and keep sensitive data out of the reach of the attackers and strengthen the security programs of the software system or application? 

Today as the technology is advancing; it is being misused in the creation of new methods or strategies for breaking out in to the security system of a system or application. Attackers are being influenced by the chances of financial gain and are always involved with the exploitation of the various software systems and applications over the years. This article gives a glance about all such security threats that our software systems and applications face today.

How are security threats categorized?

The security threats are categorized in to many categories:

1.        Validation of input: It faces threats like:

(a)      cross site scripting

(b)      SQL injection attacks

(c)       buffer overflow

(d)      Ccnonicalization

2.        Authentication:

(a)      Brute force attack

(b)      Network eavesdropping

(c)       Dictionary attacks

(d)      Credential theft

(e)      Cookie repay

3.        Authorization:

(a)      Disclosure of confidential data

(b)      Elevation of privilege

(c)       Luring attacks

(d)      Data tempering

4.        Configuration management: It faces following threats:

(a)     Unauthorized access to interfaces

(b)      Retrieval of configuration data

(c)      Over privileged process

(d)      Lack of individual accountability

5.        Session management:

(a)      Man in the middle

(b)      Session hijacking

(c)      Session replay

6.       Sensitive information:

(a)      Network eavesdropping

(b)      Access of sensitive data in the storage

(c)       Data tempering

7.        Cryptography:

(a)     Weak encryption

(b)      Poor key management

8.        Parameter manipulation:

(a)      Form field manipulation

(b)      Cookie manipulation

(c)      Query string manipulation

(d)      HTTP header manipulation

9.        Exception management:

(a)     Denial of service

(b)     Information disclosure

10.     Auditing and logging:

(a)      User denial for performing an operation

(b)      Exploitation of an application without trace

(c)      Covering of the attacks by the attacker

Usually security is often either thought of as an operational IT issue that is concentrated up on building defending systems or strategies for the softwares to protect them from the malicious security breaches and attackers or as an issue concerned with the protection of the personal, critical and sensitive data.  

Importance of Security

- Lack of security is what makes a software vulnerable to such issues.

- The security needs to be addressed in some more elaborate way since the attackers are far more ingenious and creative people.

- A software security must be aimed at building a defect free software system or application.

- Out of all the defects of the software system, few tend to become the source of security vulnerabilities. 

- Softwares that have been built with more concentration on the system security are found to be more resistive to the security threats and if in case they are struck with some security issue they have the capability of recovering as soon as possible. 

- It is important to incorporate security in to the software systems are from the initial phase to the last and final phase.

- This can start right from implementing secure software coding and testing methodologies. 

- The software developers, programmers and testers can be trained to implement language specific secure coding practices.

- Conducting a risk based security testing yields greater benefits. It adequately highlights the weaknesses of the software system or application.