Saturday, December 26, 2009

Importance of Availability in computer security

Computer security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction. The most important goal of the computer security is protecting the confidentiality, integrity and availability of information. The availability of the information when it is needed, is a main objective of any computer system which is functioning properly. The computing systems are used to store and process the information and the security controls are used to protect that information from various kinds of misuse. To ensure the availability of the information, which in turn allow information systems to serve its purpose is lead to the concept of the fair use.

Fair use is a legal principle that provides certain limitations on the exclusive rights of secured data and information. To give all users optimum service, irrespective of network demand and the limitations of the system, the Fair Usage policy has come in to action. Fair Usage solution gives service providers and network operators the ability to dynamically manage system resources by enforcing fair usage policies and up-selling additional usage to subscribers or users who reach their thresholds. The solution allows network operators to control network congestion with opportunities to increase ARPU by up-selling services to heavy users. The Fair Usage solution, ensure profitability of the data services by enforcing limits on subscriber usage volume, while allowing subscribers to purchase or use additional volume when limits are reached and to have a fast, reliable and a superior quality service.

While allowing the users to access the networks or the computer systems, it is necessary to maintain the information and resources in secured way. So the users of the computer systems must respect the rights of other users, respect the integrity of the systems and related physical resources and observe all relevant laws, regulations and contractual obligations. Since electronic information is volatile and easily reproduced, users must exercise care in acknowledging and respecting the work of others through strict adherence to software licensing agreements and copyright laws. Users may not make unauthorized copies post, distribute or modify material protected under copyright law without the express written permission of the copyright owner. To achieve all of the above security and availability aspects, there should be well defined guidelines or policies which ensure the fair usage of the system.

Fair usage policy is a set of rules applied by the owner or manager of a network, website or large computer system that restrict the ways in which the network, site or system may be used. It is also known as Acceptable Usage Policy. The fair usage policy must be written in very clear and precise way in order to understand by all the users of the system. It should cover all the important points about the users such as who are the authorized users of the system, what are the legal ways to access the system, what are allowed and not allowed to users to do with the system. Also it should refer users to the more comprehensive security policy where relevant. Another important area of the fair usage policy is the clear definition of what sanctions will be applied if some user breaks the rules in the policy. Compliance of the users and their actions against the system with this policy can be measured by the regular audits of the system.

References:
[1] Computer Security : Art and Science By Matt Bishop

http://books.google.lk/books?id=pfdBiJNfWdMC&dq=Computer+security:+art+and+science++By+Matt+Bishop&printsec=frontcover&source=bl&ots=zYept8x6nF&sig=o8ASx_ADYsRls59ScBbWdX2O7Gw&hl=en&ei=i3jCSp2nEpaUnwOB94WuBg&sa=X&oi=book_result&ct=result&resnum=3


[2] SAMPLE FAIR USE STATEMENT

http://www.cogsim.com/idea/fair_use/fair_use_short.htm


Friday, December 25, 2009

Rotor Machines

Rotor machines electro-mechanical implementation of polyalphabetic substitution ciphers in which the substituted letter is chosen electrically from huge number of possible combinations. Since one or more of the disks rotated mechanically with each plaintext letter enciphered, with 5 disk rotor machine for the English language, the number of combinations is large as 265. Rotor machines are easily implement in hardware, requires a little amount of memory and fast. Although rotor machines have these advantages, there are some security issues in them. In the following section I discuss some of the major advantages of this kind of rotor machine for the language English and some weaknesses of the machine when considering the design of it.

Advantages:

  • Most of the ciphers which are built using pen and paper alone can be easily broken using the cipher text only cryptanalysis. But this kind of rotor machine gives large number of possible mappings which make it difficult for cipher text only attacks.
  • Frequency analysis of the characters and the brute force type (which tries all possible keys) of analysis is much more difficult since there are large number of mappings with 5 disk rotor machine for English.
  • Because of the constant alternation of the electrical paths, there it produces a very long period before the key sequence or substitution alphabet repeats and it makes it difficult to do cryptanalysis since it is difficult to detect the repetition.

Weaknesses:

  • It is possible to do cipher text only cryptanalysis by exploiting insecure protocols which explains the message settings. One such incident happened with earlier rotor machine type called enigma and cryptanalysis was done by Polish cryptographers. This kind of attack can use virtual bank of rotor machines, each testing one possible rotor order. This is the step which has most dominating cost in the attack. Then attacker can find the best ring settings for this message key and the assumed rotor order. Finally has to recover the plugboard settings assuming the correctness of the recovered rotor order, ring settings, and the message key settings.
  • In other encryption mechanisms the key is the most important and should be protected from the enemy. But in rotor machines there is an internal wiring structure which is also important aspect when breaking them by cryptographers by deducing the logical structure.
  • In rotor machines such as Enigma, reflector is a fundamental feature which helps to the cryptanalysts. Reflector ensures that no letter could be encrypted as itself. Cribs are any known plaintext or suspected plaintext at some point of the encrypted message. Cryptanalysts can use the reflector factor along with the knowledge of cribs to perform known plain text kind of attacks. With cribs and the fact that no letter could be encrypted as itself, a corresponding cipher text fragment can be tested by trying every possible alignment of the crib against the cipher text. This procedure is known as the crib-dragging.
  • The plugboard connections of the rotor machines are reciprocal. That means if A is plugged in to H, then H is plugged in to A. That means the encryption is performed identically to the decryption. It makes the task of cryptanalysts easy by considerably reducing the number of scrambler settings that need to consider.
  • Operating short comings or the way that the machine is used can be a major factor other than the design characteristics of the machine. Mistakes of the operators are common and this can lead to related key attacks. Operators sometimes set rotors incorrectly. If the operator then corrected the rotor positions and retransmitted the same plaintext, the cryptanalysts would have a single plain text encrypted in two related keys.

Computer Security Attacks

There are four general types of security attacks.

Interruption Attack :
In an interruption attack, a network service is made degraded or unavailable for legitimate use. They are the attacks against the availability of the network.

Examples of Interruption attacks :
  • Overloading a server host so that it cannot respond.
  • Cutting a communication line.
  • Blocking access to a service by overloading an intermediate network or network device.
  • Redirecting requests to invalid destinations.
  • Theft or destruction of software or hardware involved.
Mitigate the attack:
  • Use Firewalls - Firewalls have simple rules such as to allow or deny protocols, ports or IP addresses. Modern stateful firewalls like Check Point FW1 NGX and Cisco PIX have a built-in capability to differentiate good traffic from DoS attack traffic.
  • Keeping backups of system configuration data properly.
  • Replication.
Interception Attacks :
In an interception attack, an unauthorized individual gains access to confidential or private information. Interception attacks are attacks against network confidentiality.

Examples of Interception attacks :
  • Eavesdropping on communication.
  • Wiretapping telecommunications networks.
  • Illicit copying of files or programs.
  • Obtaining copies of messages for later replay.
  • Packet shiffing and key logging to capture data from a computer system or network
Mitigate the attack :
  • Using Encryption - SSL, VPN, 3DES, BPI+ are deployed to encrypts the flow of information from source to destination so that if someone is able to snoop in on the flow of traffic, all the person will see is ciphered text.
  • Traffic Padding - It is a function that produces cipher text output continuously, even in the absence of plain text. A continuous random data stream is generated. When plaintext is available, it is encrypted and transmitted. When input plaintext is not present, the random data are encrypted and transmitted. This makes it impossible for an attacker to distinguish between tree data flow and noise and therefore impossible to deduce the amount of traffic.
Modification Attack
It is an attempt to modify information that an attacker is not authorized to modify. This type of attack is an attack against the integrity of the information. Basically there is three types of modifications.
  • Change: Change existing information. The information is already existed but incorrect. Change attacks can be targeted at sensitive information or public information.
  • Insertion: When an insertion attack is made, information that did not previously exist is added. This attack may be mounted against historical information or information that is yet to be acted upon.
  • Deletion : Removal of existing information.
Examples of Modification attack:
  • Modifying the contents of messages in the network.
  • Changing information stored in data files.
  • Altering programs so they perform differently.
  • Reconfiguring system hardware or network topologies.

Mitigate the attack :
  • Introduction of intrusion detection systems (IDS) which could look for different signatures which represent an attack.
  • Using Encryption mechanisms
  • Traffic padding
  • Keeping backups
  • Use messaging techniques such as checksums, sequence numbers, digests, authentication codes
Fabrication Attack :
In a fabrication attack, an individual inserts counterfeit information, resources, or services into the network. These attacks are attacks against the authentication, access control, and authorization capabilities of the network.

Examples of Fabrication Attack:
  • Inserting messages into the network using the identity of another individual.
  • Replaying previously intercepted messages.
  • Spoofing a web site or other network service.
  • Taking the address of another host or service, essentially becoming that host or service.
Mitigate the attack :
  • Use of Authentication and authorization mechanisms
  • Using Firewalls
  • Use Digital Signatures - Digital signature scheme is a mathematical scheme for demonstrating the authenticity of a digital message or document.

Thursday, December 24, 2009

Chinese Room Argument

Chinese room argument is an argument presented by John Searle, against the possibility of true artificial intelligence. It is a thought experiment which attempted to show that a signal processing machines like computers can never be considered as having a mind or understanding. If a machine is intelligent then it must be able to grasps the meanings of the sentences and then it can have beliefs. If the machine can have beliefs then it can also have other mental states, which mean that the machine has a mind. Allan Turing was the first person who presented a test for the machine intelligence and it is called the “Turing Test”. It says that a person does a conversation, with a human and machine each which tries appear as human, where each participants are placed in isolated locations. If that machine can fool the person who did the conversation, into thinking that it was a human, then the machine is said to have passed the test. Searle presented the “Chinese Room Argument” against the Turing Test. The “Chinese Room Argument” is as follows.


A native English speaker who doesn’t know Chinese is locked in a room full of boxes of Chinese symbols (a database) together with a book of instructions for manipulating the symbols (the program). People outside the room send questions in Chinese (the input) to the person inside and the questions are not understand by him. But by following the instructions in the program the man in the room is able to pass out Chinese symbols which are correct answers to the given questions (the output). The program enables the person in the room to pass the Turing Test for understanding Chinese but he does not understand a word of Chinese. From this argument Searle concluded that a computer program carrying out the rules doesn’t understand Chinese and therefore no computer program can understand anything. His conclusion was biology being is necessary for understanding. My arguments regarding the Turing Test along with the Chinese Room Argument are as follows.
  • It is not possible to say exactly that “Biology being is necessary for understanding”. Today it may be because the present computers are too simple or slow to come up with that kind of intelligence. In future computer may be able to intelligent.
  • We can think the English Speaker, boxes of Chinese symbols and the book of instructions as a single system. Although the man can understand English only, the whole system can understand Chinese. So we can’t think of man as a single and the whole system is intelligent enough to understand Chinese.
  • Although the man is locked in a room he is actually connected to the outside world. One way is through the Chinese speakers that he is talking to and the other way is through the programmers who designed the database and the program.

Wednesday, December 9, 2009

GraphEdit

GraphEdit is a visual tool for building and testing filter graphs and it is provided as an executable with the DirectX SDK. GraphEdit can be used to verify the filter arrangement that we are going to implement in code level is working properly. It is possible to use GraphEdit in two ways to verify that. We can test the filter graph with the GraphEdit before write any application code or we can load a filter graph that the application creates to verify that our application is building the correct graph. Using the GraphEdit following basic tasks can be done.
  • Create and modify filter graphs.
  • Run, Pause and seek a filter graph.
  • View the property pages of the filters.
  • View the media types of pin connections.
Following figure shows a simple filter graph created using the GraphEdit to play a video file.


In the GraphEdit filters are displayed as boxes with a text caption inside it, which shows the name of the filter. Pins appear as small squares along the edges of the filters and input pins are shown on the left side of the filter and the output pins are shown on the right side of the filter. The arrows which connects one input pin to another output pin represents the connections between the filters.

Saturday, December 5, 2009

DirectShow Filter Graph

The basic building block of the DirectShow is called Filter and it is a software component that performs some operation on a multimedia stream. Filter Graph is a set of connected filters and an application performs any task by connecting chains of filters together. DirectShow applications don’t need to manage all the data flow within the filters. Application make high level API calls such as run of stop to move or stop data between the filters. There is a high level component which controls the data flow in filters and it is called Filter Graph Manager. It provides methods for the application to build the filter graph by connecting the filters together. All the filters and the Filter Graph Manager are all COM objects.

Filters can be grouped in to several broad categories. But the distinctions between these categories are not obsolete and some filters can put in to several categories. According to the DirectShow MSDN filters can be categorized in to five main categories as below.

  • Source filters – Source filters introduces data in to the graph. The data might come from a file, camera, network or anywhere else. Each source filter handles a different type of data source.
Ex: RTP source filters, Video capture Filter.
  • Transform filters – Transform filters takes an input stream, process the data and creates an output stream.
Ex: Encoders, Decoders, Color Space Converters.
  • Renderer filters – Renderer filters sit at the end of the filter chain of the filter graph and they receive data and present it to the user.
Ex: Video Renderer , Audio Renderer, File Writer
  • Splitter filters- Splitter filters splits and input stream in to two or more outputs.
Ex:AVI splitter- parses a byte stream into separate video and audio streams.
  • MUX filters – MUX filters take multiple inputs and combine them in to a single stream.
Ex: AVI MUX – takes audio and video streams and produces an AVI formatted byte stream.

Friday, December 4, 2009

Microsoft DirectShow API

When developing the softphone application I had to use Microsoft DirectShow API to handle multimedia.

Microsoft DirectShow API is the media streaming architecture for streaming media on the Microsoft Windows platform. Working with multimedia is a challenge due to the following reasons.
  • Multimedia streams contains large amount of data and need to process quickly.
  • Audio and video must be synchronized and played at the same rate.
  • Data can be comes from many sources like local files, networks, cameras etc.
  • Data may come with wide variety of formats.
  • The programmer doesn’t have knowledge about the hardware of the end user’s system.
The DirectShow is designed overcome above problems and the main design goal of the DirectShow is to simplify the task of creating digital media applications on the Windows platform by isolating applications from the complexities of the data transports, hardware differences and synchronization.

DirectShow provides the support for high quality capture and play back of multimedia streams and it supports wide variety of formats like ASF, MPEG, AVI, MP3, and WAV. DirectShow is based on Component Object Model (COM) where COM is and interface standard for software componentry introduced by Microsoft in 1993. It is used to enable inter process communication and dynamic object creation in large range of programming languages. So to write a DirectShow application or a component it is necessary to have a understanding about the COM client programming.

DirectShow can be used to development of applications like audio-video capture applications, file players, TV and DVD players, video editing applications, file format converters and many more. IF the programmer needs to write his own DirectShow component to support new formats or custom effects, it provides access to the underlying stream control architecture.

Wednesday, December 2, 2009

Softphone Architecture.

Above diagram shows the basic data and signaling path established during a call between a SIP phone and a 3G phone.

The SIP server is consists of SIP Registrar and the SIP Proxy. The task of the SIP servers is to act on behalf of the two calling parties to facilitate the session establishment. The proxy server receives SIP requests and forwards them on behalf of the requestor. Another task of the proxy server is locating the proxy server of the other calling party by performing a particular type of DNS lookup to find the SIP server which serves that party. In order to do that the proxy server consults a database called location service also. In addition to DNS and location service lookups proxy servers can make flexible routing decisions to decide where to send a request.

Registration is another common operation in SIP and it is a one way that a SIP server can find the current location of the other party. During the initialization and at periodic intervals the SIP softphone send REGISTER messages to the SIP registrar. The registrar writes this location data to the database called location service where it is used by the proxy servers.

The VSDP is the Video Service Delivery Platform and it acts as an interface between the 3G-324M and the IP network. It supports real time bidirectional streaming of video sessions between 3G-324M mobile phones and multiple IP based video applications.

Tuesday, December 1, 2009

Introduction to Softphones

Softphone is a term derived from the Software Telephone and it is a program that enables Voice over Internet Protocol (VoIP). It allows making calls over the internet using a general purpose computer, Laptop or other computing devices like PDAs. Softphones are not using dedicated hardware for it, but it is configured to work with the computer’s external hardware devices like microphone, Web camera, and speakers. Usually the Softphones are behaved like the traditional phones and it may be implemented with a image of real phone with a panel and buttons to use for the interactions with the user.

The concept of the IP telephony has been available from number of years, but they were not popular as today. The world’s first VoIP softphone was VocalTec’s internet phone which was introduced in 1995. But the softphones have become widely spread today with the fast growth of internet usage on homes, businesses and government offices. Usually the Softphones services are provided by an Internet Telephony Service Provider. The types of calls can be categorized as PC to PC and PC to 3G phone calls. Usually the providers allows to make PC to PC calls with free of charge and PC to 3G phone calls and 3G phone to PC calls are charged.

Softphone use open standard IP signaling protocol – SIP (Session Initiation Protocol) that can be used in conjunction with the IP PBX in a enterprise. It converts video and audio to IP packets which contains the RTP data and vice versa in VoIP telephone service. So for the communication with a softphone, the protocols like SIP, SDP (Session Description Protocol) and RTP (Real Time Protocol) are used. In order to establish a successful communication, the both end points should have same communication protocols and at least a single common codec for both audio and video.
There are popular Internet Telephony Service Providers like Skype, Google Talk and Vonage who are provided their own softphones to install in the user’s PC. The problems with these softphones are they are not interoperable and we can’t place a direct call between them.