පරිඝනක වෛරස සමග ඔට්ටු වීම (1 කොටස )

©2012 masror.com 

• කොම්පුටරේ හරිම ස්ලෝ බං ප්‍රෝග්‍රෑම් එකක් දෙකක් ඇරිය හැටියේ වෙන කිසි වැඩක් කරන්න බැරි වෙනවා
• බ්‍රවුසරේ ඉස්සර වගේ නෙවෙයි හරියට ක්‍රෑෂ් වෙනවා... මොකද දන්නේ නැහැ 
• මගේ නෙට් පාවිච්චිය එක පාරටම ඩබල් වෙලානේ බං .. මුකුත් බෑවේ නැති වෙලාවටත් හිටු කියල ට්‍රැෆික් උඩ පහල යනවා .. මොකද්ද කියල හිතා ගන්න බැහැ
• ඊයේ ප්‍රෝග්‍රෑම් එකක් ඩවුන් ලෝඩ් කරලා ඉන්ස්ටෝල් කරා .. මං සයිට් එහෙකට ගියහම මගේ කොම්පුටරේ ඉන්ෆෙක්ට් වෙලා කියුව. ඒගොල්ලන්ගේ ප්‍රෝග්‍රෑම් එක දාල ඒව ඉවත් කර ගන්න කියල කියුව. එයිට පස්සේ ඒ ප්‍රෝග්‍රෑම් එකෙන් හරි වදේ. වින්ඩෝස් ඕපන් කරනවයි. ස්කෑන් කරන්න කියනවයි එක විකාරයි. මට පෙන්නේ ඒක වෛරසයක් වගේ. අයින් කරන්න දෙන්නෙත් නැහැ ඒක...

මේ ඉතාම සුලභ නිතර දෙවේලේ පරිඝනක භාවිතා කරන්නන්ගෙන් අසන්නට ලැබෙන වාක්‍ය කිහිපයකි. ලිනක්ස් (Linux) , මැක් ඕ.එස් (Mac OS X), යුනික්ස් (UNIX) ආදී කොච්චර ඔපෙරෙටින් සිස්ටම් තිබ්බත් තවමත් බොහෝ දෙනා පාවිච්චි කරන්නේ වින්ඩොව්ස් ය. ලංකාව වැනි රටවල බොහෝ පරිඝනක වල ඇත්තේ හොර වින්ඩෝස් කොපිය. ඒවා හට මයික්‍රොසොෆ්ට් ආයතනය මගින් නොමිලයේ හෝල් සෙල් නිකුත් කරන අප්ඩේට් කිසිවක් ලබා ගත නොහැක. ඒ නිසා ඒවායේ මෙහෙයුම් පද්ධතියේ ඇති වාර්තාගත වූ බොහෝ අනාරක්ෂිත ස්ථාන (recorded security vulnerabilities ) එලෙසින්ම පවතින අතර ඒ අනාරක්ෂිත ස්ථාන ඉලක්ක කොට නිපදව ඇති වෛරස (virus) , මල්වෙයාර් (malware) , ස්පයි වෙයාර් (spyware) ආදී හානිකර මෘදුකාංග වලට හිතේ හැටියට ඉන්ස්ටෝල් වී වැඩ කිරීමට පසුබිමක් ලෙහෙසියෙන් සැකසී ඇත්තේය.

ඇයි මෙච්චර වෛරස වින්ඩෝස් වලට විතරක් ?
එයට හේතු කීපයකි. වින්ඩෝස් මෙහෙයුම් පද්ධතියේ ඇති සෙකියුරිටි මොඩලය සරලය. ලෙහෙසියෙන් නොසලකා හැර තමන්ට අවශ්‍ය පරිදි කටයුතු කර ගත හැක. එමෙන්ම බොහෝ දෙනෙකුන් පාවිච්චි කරන නිසා ද , වෛරසයක් නිෂ්පාදනය කිරීමෙන් වැඩි පැතිරීමක් බලාපොරොත්තු විය හැකි නිසාද , ඉතා සුළු දැනුමකින් වුවද වෛරසයක් නිපදවීමට හැකි නිසාද බොහෝ වෛරස ලියන්නෝ වින්ඩෝස් මෙහෙයුම් පද්ධතිය ඉලක්ක කරගෙන වෛරස නිපදවති. වින්ඩෝස් 7 කෙතරම් දියුණු යයි කීවද , XP මෙන්ම එයද අඩුවක් නැතිව වෛරස වල ප්‍රහාරයට ලක්වේ . උඩින් පෙන්නන දැඩි ආරක්ෂාකාරී ස්වභාවය (tight security model) ඇතුලත නැත.

ලිනක්ස් , මැක් ඕ.එස් ආදී අනිත් මෙහෙයුම් පද්ධති සකසා ඇත්තේ හැත්තෑ ගණවල මුලින් සැකසු හද්ද පරණ යුනික්ස් මොඩලයට අනුව නමුත් මොලේ ඇති මිනිසුන් පිරිසක් විසින් සැකසු හෙයින් ඒවායේ අරක්ශාකාරිත්වය ඉතා ඉහල මට්ටමක පවතී. ඒවායේ ෆයිල් පද්ධතිය සකසා ඇති ආකාරය අනුව වෛරසයකට හිතු සැටියේ ස්ථාපිත වී තව දුරටත් පැතිරීමට , පධතිය තම ග්‍රහණයට ගැනීමට ඇති හැකියාව අඩුය. එමෙන්ම භාවිතා කරන පිරිස අඩු නිසාත් වෛරසයක් ලිවීමට ඉතා ඉහල තාක්ෂණික දැනුමක් අවශ්‍යවන නිසාත් , බොහෝ මහන්සි වී ලියුවත් එහි පැතිරීම අවම වීමට ඇති ඉඩත් නිසා මේ මෙහෙයුම් පද්ධති වලට වෛරස වලින් වන විපත් අඩුය. ඇත්තේම නැතයි කිව යුතුය. 

මං ඇන්ටි වෛරසයක් දාල තිබ්බේ. එත් මට වෛරස ආවනේ!
වියදම් කිරීමට මුදල් ඇති බොහෝ දෙනාද පරිඝනකයක් ගත් පසුව , පළමුවරට වයිරසයකින් බැට කෑමට පෙර, ඇන්ටි වෛරස මෘදුකාංගයකට මුදල් වියදම් කිරීමට මැලි වෙති. වෛරසයක් පැමිණ එහි ආදීනවය හොඳින් විඳ නන්නත්තාර වුවාට පසුව නම් කීයක් ගියත් කමක් නැත කියා හොඳ ඇන්ටි වෛරසයක් සොයා දමති. ඇන්ටි වෛරස මෘදුකාංගයක් නොමැතිව නම් වින්ඩෝස් පරිඝනකයකින් අන්තර්ජාලයේ සැරිසැරීම නිකරුනේ සියදිවි නසා ගැනීමට කමිකාසේ මෙහෙයුමකට යනවා වැනිය. අද නැත්නම් හෙටම ජම්බු ෂුවර්ය. ඒ නිසා බොහෝ දෙනා කරන්නේ නිකන් දෙන Avast , AVG , Avira ආදී ඇන්ටි වෛරස මෘදුකාංගයක් භාවිතා කිරීමය. 

මේවා භාවිතයේ ඇති අඩු ලුහුඬු කම් බෙහෙවකි.

• නිකං දෙන එඩිෂණයේ ඇත්තේ සිමිතම කොටස් කීපයක් පමණකි (limited features). එහි බොහෝ විට අඩංගු වන්නේ වෛරස හසුකර ගන්නා පද්ධතිය (scan engine) හා එය පාවිච්චි කරන්නාට එම පද්ධතිය මෙහෙයවීමට සැකසු සරල වින්ඩෝව (user interface) පමණකි. මෙය ස්ථාපිත කරගෙන සම්පුර්ණ ආරක්ෂාවක් බලාපොරොතු වුවත් එය එසේ සිදු නොවේ. මුදල් ගෙවා ලබාගත යුතු අනිකුත් කොටස් සියල්ල ස්ථාපිත කර ගත් පසුව පමණක් යම් පමණක ආරක්ෂාවක් බලාපොරොතු විය හැකිය.


• වෛරසයක් , නිෂ්පාදකයා විසින් පිටට නිකුත් කල පසු එය වාර්තා වීමටත් , ඉන්පසුව එය හසුකර ගෙන ඉවත් කර දැමීමට අවශ්‍ය සැලසුම් නිපදවීමටත් යම් කිසි කලක් ගත වේ. මේ කාලය තුලදී එම වෛරසය නිදැල්ලේ සැරිසරන අතර කිසිදු ඇන්ටි වෛරස මෘදුකාංගයකට අසු නොවේ. වෛරසය හඳුනා ගත හැකි කේතයන් (virus definishion updates ) ඒ ඒ සමාගම් විසින් නිකුත් කලද ඔබ ඔබගේ ඇන්ටි වෛරස මෘදුකාංගය අප්ඩේට් නොකළේ නම් , එසේ කරන තෙක් එම වෛරසය හඳුනාගැනීමට ඇන්ටි වෛරස මෘදුකාංගය අසමත් වෙයි. මේ හේතුව නිසා සියලුම ඇන්ටි වෛරස මෘදුකාංග වල පාහේ දැන් , මෘදුකාංගයක් ක්‍රියාකාරී වන ආකාරය අධ්‍යයනය කර එහි හොඳ නරක , විනාශකාරී බව සොයාගැනීමට හැකියාව ඇති අනු පධතියක් (Heuristic analysis engine ) ක්‍රියාත්මක වෙයි. මගේ පෞද්ගලික අත්දැකීම් අනුව මෙය බොහෝ ඇන්ටි වෛරස මෘදුකාංග වල හරිහැටි ක්‍රියාත්මක නොවේ. හොඳින් ක්‍රියාත්මක වන ඇන්ටි වෛරස මෘදුකාංග වල වුවද හරිහැටි කොන්ෆිගර් කිරීමට නොදන්නා කම නිසා මෙයින් උපරිම ප්‍රතිපල බොහෝ දෙනා නොගනිති.


• ඇන්ටි වෛරස මෘදුකාංග වල වෛරස හඳුනා ගත හැකි හැකියාව ප්‍රශස්ත මට්ටමකින් නොපවතී. බොහෝ ඇන්ටි වෛරස මෘදුකාංග වල අලුත් වෛරස හඳුනා ගැනීමේ හැකියාව 40% මට්ටමේ පවතින බව නිර්කිෂකයෝ පවසති. ඔබ ළඟ සැකකටයුතු ෆයිලයක් ඇත්නම් එය virustotal සයිටය මගින් පරික්ෂා කර එහි ඇත්ත නැත්ත බලා ගත හැක.


• මුදල් ගෙවා හොඳම තත්වයේ ඇන්ටි වෛරස මෘදුකාංගයක් දමා ගතද , ඒ බන්ඩලයේ ඇති නානාප්‍රකාර මෘදුකාංග , සියල්ල ක්‍රියාත්මක වීම නිසා ද , ෆයිලයක් භාවිතා කරන වාරයක් පාසා එය පරික්ෂා කිරීමට පටන් ගැනීම නිසාද අලුත් ම අලුත් පරිඝනක පද්ධතියක වුවද වේගය 30 % කින් පමණ අඩාල වීම බලාපොරොත්තු විය යුතුය. ඒ නිසා ඇතැම්හු ඇන්ටි වෛරස මෘදුකාංගයේ ඇති සමහර කොටස් අක්‍රිය කර දමති. මෙය ද පහසුවෙන් වෛරස ඒමට හේතුවක් වේ.

මේ හේතුන් නිසා ඇන්ටි වෛරස මෘදුකාංගයකින් සම්පුර්ණ ආරක්ෂාවක් නොලැබේ. සැම විටම අන්තර්ජාලයේ සැරි සැරිමේදී තමන්ගේ ව්‍යවහාර බුද්ධියද යම් පමණකට පාවිච්චි කල යුතුය. බැනර් ඇඩ් , පොප් අප් වින්ඩෝස් ආදිය නොසලකා හැරීම හෝ බ්ලොක් කර දැමීම , සැකකටයුතු ෆයිල්ස් ඩවුන්ලෝඩ් නොකිරීම , නොදන්නා අමුතු සයිට් වලින් දෙන මෘදුකාංග ඉන්ස්ටෝල් නොකිරීම , පිළිගත් සයිටයකින් පමණක් මෘදුකාංග ඩවුන්ලෝඩ් කිරීම , සැකකටයුතු මෘදුකාංග , ෆයිල්ස් සමග දිනපතා කටයුතු කිරීමට තිබේ නම් ඒ සඳහා වචුවල් මැෂිමක්  භාවිතා කිරීම මගින් තමන්ගේ පරිඝනකයට වයිරස මගින් සිදුවිය හැකි හානි බොහෝ දුරට වලකා ගත හැකිය.

උදාහරණයක් ලෙස මා වින්ඩෝස් මැෂිමක් භාවිතා කල 2006-2010 කාලයේදී කිසිකලක ඇන්ටි වයිරස මෘදුකාංගයක් භාවිතා නොකලෙමි. පධතියේ වේගය අඩුවෙන නිසාත් මෙටාස්ප්ලෝයිට්  සමග ඒවා පිස්සු කෙලින නිසාත්ය. නමුත් කිසි දිනක වයිරසයක් ප්‍රධාන මෙහෙයුම් පද්ධතියට ඇතුල් නොවීය. 


දිග වැඩියි .. 1.00 A.M වෙලාව ..තව කෑල්ලක් පස්සේ ...

WLAN Security Megaprimer by Vivek Ramachandran

Vivek Ramachandran
© 2011 clubhack.tv

This is my second post on Vivek. An outstanding information security expert from India. Unlike other security experts the reason I admire him is the way he share his knowledge  freely with the rest of the world through securitytube.net site . A free video based quality computer security education portal.  since its start in 2011 once in a  while I used to go there to check out materials Vivek has generously put forward. 

Guess what ... This time it  was a sweet surprise indeed. A whole series of videos on  wireless security and  penetration testing on a single DVD. As always he explains things with extreme clarity which I think is a characteristic of all Indian teachers  and  dont try to BS or show off as I have seen among videos done by others. 
Once i had the pleasure of studying in Monash under Dr Shonali Krishnaswamy and she was  as best as Vivek is when it comes to the quality of teaching. One of my all time favourite teachers.

Anyways getting back to the topic , this free DVD is the course material  for  his newly created 
SecurityTube Wi-Fi Security Expert (SWSE) certification.


You can get it from here. It's well worth a look.
You can also watch the extended video series online from here.

Gmail Motion - Is that a joke on April 1st?

© 2011 Google, Google Actions

Google is notorious for playing pranks on poor unassuming souls on April 1^st every year.

When something comes up on Google home page on April 1^st ,that’s why I’m always so skeptical at first.

© 2011 Google , Google Actions

Anyways, this one called Gmail Motion got me by surprise at first. The whole concept was unlike Google and more like Steve Job’s baby. Considering the way technology moves at light's speed and the idle CPUs longing to churn some real cycles on lazy user's computers, even this wouldn’t have been funny if it would have come out on a day apart from April 1^st.  

Only when I saw the pathetic, over worked and depressed face (Ya Ya You can imagine me in his place!) of the demonstrator, that I realised that it is indeed the April 1^st 2011. Too bad for you Tiraj, you are getting old!

Metasploit Mega Primer - A Video Tutorial on vulnerability Testing

Found an unbelievably great set of video tutorials on Metasploit Framework done by an Indian (सारे जहाँ से अच्छा हिन्दोस्ताँ हमारा) instructor named Vivek  Ramachandran , founder of security Tube.

This was the best video  tutorial series till date I have stumbled upon. (Hey don’t make a funny face!  I have gone through all most all of the Nuggets, VTC, Train signal Lynda series etc..  )

After you get over with his accent you will really start appreciating the content he has generously put in to the series. A really great job Vivek.

You can also dig the same site for more videos on computer security and vulnerability testing.

Enjoy!

North Korea’s “Secret Cyber-Weapon”: Red Star OS

© 2010 KFA Forum

North Korea has had its own internet from a long time now. Their internet is free of any American influence and now, they have their own operating system to power that internet. The Red Star OS is a Linux based OS, developed by orders from Kim Jong-il.


The OS has been developed by North Korean IT specialists to meet the needs and requirements of the North Korean people and the government, respectively. News of its release and existence got known, thanks to a student from North Korea’s Kim Il-sung University. The student is a Russian individual and writes a blog from the Russian embassy in Pyongyang.


Although Kim Jong-il is willing to go forward with this Operating System, it is not exactly the people’s favorite. It still needs a lot of polishing according to the local populace. For this reason, they still prefer using Windows XP and Windows Vista over this snappy OS.


Red Star is available for $5 and comes in the Server and the Desktop edition. Though, the apps available for the OS are selling at twice the price and need to be bought separately.


The language of the OS is “Korean only” and it takes around 15 minutes to install. The minimum system requirement is 256 MB of RAM and a Pentium III processor coupled with a 3 GB hard-disk space. Ironically, the web browser is named “My Country” which is actually a Firefox fork.


You can give Red Star version 2.0 a test run, provided you take a test flight to North Korea and get hold a copy from the nearest information kiosk.
 © 2010 Kanjilal  C , Red Star OS: Linux distro from North Korea

More Information: 
North Korea’s “secret cyber-weapon”: brand new Red Star OS  by North Korean Economy Watch 

Douro20 says :  "This OS was designed to copy everything the user types in and receives and, upon a backdoor request, transmit this information to the North Korean police. Don't say I didn't warn you."  

Detection of Encrypted P2P File Sharing Traffic - Research Paper

Interesting .... Very Interesting
© Acclaim Images, LLC 

Stumbled upon a nice research paper on  possible ways of detecting encrypted P2P traffic in public / private networks using Snort IDPS.



Title: Towards the Detection of Encrypted Peer-to-Peer File Sharing Traffic and Peer-to-Peer TV Traffic Using Deep Packet Inspection Methods.
Author : David Alexandre Milheiro de Carvalho
Supervised by: Dr. Mário Marques Freire, Full Professor at theDepartment of Computer Science, University of Beira Interior.
Published: August 2009
Link: Click Here

A basic introductory video tutorial on Java CAPS

1. Tech Background - Sun Java CAPS

Explaining Composite applications , Services and WSDL

2.Tech Background - Sun Java CAPS

Explaining Business Process , Service orchestration and BPEL

3. Tech Background - Sun Java CAPS

Composite Application Layers

4. eGate Overview - Sun Java CAPS

5. eInsight Overview - Sun Java CAPS

6. eVision Overview - Sun Java CAPS

Java CAPS Tutorials/Documentation and E-book

Finding Sun/Java related materials has become increasingly hard since the merge of Oracle and Sun. Google is still filled with massive amount of dead links from Sun when clicked goes to the Oracle home page.


I was searching for some materials on JCAPS and after some struggle stumbled upon these resources.
Have no clue how long these will last before giving 404 Errors. 


Enjoy while they are available.


Sun Java CAPS Documentation
JCAPS E book (Direct Download)

SUN SeeBeyond e-WAY™ TCP/IP HL7 Adapter User's Guide

The Sun SeeBeyond eWay™ TCP/IP HL7 Adapter enables the eGate Integrator system to exchange data with an external TCP/IP application, using the HL7 data protocol. eGate with the TCP/IP HL7 eWay utilizes J2EE™ Architecture.

This document describes how to install, configure, and implement the Sun SeeBeyond eWay™ TCP/IP HL7 Adapter, in a typical Sun SeeBeyond Composite Application Platform Suite environment.

HL7 OTD Library 

The HL7 OTD Library provides HL7 files formatted in Java™ syntax for use with the Sun SeeBeyond Enterprise Designer. An Object Type Definition (OTD) library is a compilation of pre-built message structures for industry-standard formats. The HL7 OTD Library is designed to work in conjunction with the Sun SeeBeyond eWay™ TCP/IP HL7 Adapter, to help the user establish and maintain an efficient and reliable HL7 messaging system.

MCTS and Light bulbs

Finally, after about one week of preparation I went and sat on the exam chair to do the MCTS exam in I** Srilanka. Was quite nervous when started but it turned in to a panic when i passed first set of questions (about 10) with out answering and with out having any clue of knowing the correct answer.

Was biting my finger nails and looking at the watch nervously when a guy came in to the exam room and started pulling and messing with chairs looking up and down. It was a small room so there was no escape from this distraction. After making some noise he went out. He might have not heard my sigh while leaving and that explains the second visit of him after about 2 minutes.

This time it was worst. He pulled some chairs out , climbed on to the computer desks (yes one next to me as well) and started changing light bulbs. Jesus.. Wasn’t there any better time to do the maintenance work than this?

Anyways given time was enough to compensate for the distractions and i passed it with out much further drama. My first ever MCTS. Maybe Microsoft keeps/gives some extra time buffer to the candidates as "Exam reading time + Exam time + Extra Light bulb changing time"

Overall it was a good and somewhat peculiar experiance and hope to go back to do more.

Excom shuts its doors.

Its surprising to hear that Excom , one of the largest IT training providers in Australia with so many branches (Melbourne, Sydney, Brisbane, Canberra, Adelaide, Perth, Auckland and Singapore .. phew thats a mouthful ) founded by Paul Koukounaras and Graeme Newe shuts its doors on 25th August 2010.

Maybe the statement by Mr Lakin might provide us some insight in to the growing issue of declining International student numbers on Australian soil.

"Across all the learning agencies, whether they be tertiary, VET or vendor, there has been a general concern that the decline of international students has had a real effect on enrollments, We’ve got this skills shortage and we still haven't got a solution to address it.” - Australian Computer Society CEO, Bruce Lakin

Hmm I wonder what this news meant to the universities across Australia.

Anyways, all students (including international students) who are effected by the closure can enroll in courses provided by Dimension Data Learning Solutions (1800 853 276) with out any extra charge as they says. Well that’s a small relief!

Image is by : Mr Andrew Morison

Mobitel's world class browsing pain.

Thinking that “Siya-rata De Siri Sapa De” I bought Mobitel ‘s Wireless internet Key and a 4 GB Package about 2 weeks back.

Since the day one the service has been a world-class pain.

It's promised speed is 1 MBps which is about 120 Kbp. But this bullock cart hardly does 20-30 Kbps and DNS lookup time take sometimes more than 5-8 Seconds. ( I see from my stupid brain ..... mmmmm sluggish DNS servers and a QOS issue and a fat bellied commiss crow).

On which planet does Google's home page get timed out while resolving its IP address???? . Well theres one country !

While digging a bundle of past news papers , I found the reason and the solution for at least part of the problem. This paper reveals some government tender scam in purchasing IT equipments to a Government telecom network.

Well I don’t know whether it’s true or not. (By the way they had put all relevant documents related to the scam in there ). But observing the slowness in Mobitel's DNS servers(?) I have no doubt that they are running on Celeron Desktop PCs.

Well I have no solution to the snail class line speed provided by Mobitel. But to cut out at least 5-8 seconds of DNS lookup time and to make browsing less annoying you can use googles' public DNS servers.

These are their IP addresses as on 6/4/2010:

8.8.8.8
8.8.4.4

You can get more info from:
http://code.google.com/speed/public-dns/

Last advise:

Avoid Mobitel HSDPA network as it got Bubonic Plague. Go with Dialog Wireless network. Last year I used it and the service and the customer service was 10/10.

Can't connect to local MySQL server through socket '/tmp/mysql.sock'

Since some time I was having troubles connecting to the MySql server running on local machine via command line. First I have to tell you that I’m not a Linux guru. Just started using it because my University forced me do so.
Anyway this was the symptom when I tried to access MySql server via command line interface.
By the way I was using Ubuntu 7. Something.

root@local:~# mysql
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)
root@local:~#


Browsing through more than 1 million search results ( : ) ) brought by Google didn’t bring anything valuable but only to discover that more than half of the world population is faced with the same issue.

Surely something is wrong. Either /tmp/mysql.sock is not in the place mysql utility is looking or it has been locked or something.
When i restarted MySql server (Of cause after brutally killing all by using # killall -9 mysqld) I discovered something interesting.


root@local:~# mysqld
080723 7:38:36 InnoDB: Started; log sequence number 0 43655
080723 7:38:36 [Note] Recovering after a crash using /var/log/mysql/mysql-bin
080723 7:38:36 [Note] Starting crash recovery...
080723 7:38:36 [Note] Crash recovery finished.
080723 7:38:37 [Note] mysqld: ready for connections.
Version: '5.0.45-Debian_1ubuntu3-log' socket: '/var/run/mysqld/mysqld.sock' port: 3306 Debian etch distribution

Aha …. Mysql server creates its socket in ‘socket: '/var/run/mysqld/mysqld.sock' ... Not the place mysql utility is looking for it.
Anyway since all got cleared now I had 2 paths. Mucking with some configuration file buried deep with in or compiling MYsql with
some wired flags set to change its default sock path. I had time to chose none. Hell I just wanted to run some damn small query on the database and say ta to MySql for good. So this is the final option I choosed.
In MySql utility there is a option called --protocol. I just used that.


root@local:~# mysql --protoco TCP -u root -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.0.45-Debian_1ubuntu3-log Debian etch distribution
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql>

Bye Bye stinky Sock ... Welcome TCP Socket. Problem not solved but successfully overlooked. Well that’s enough for me at the moment.

How secure RSA is in practice?

Brute force attacks

Even though it is possible to try every possible value for d (Decryption key) till we find the correct value, for larger keys it is highly inefficient process for any practical usage.

Another way to break RSA is to factor n. The security of RSA depends on the problem of factoring large numbers. Attacker having the public key e and modulus n has to factor n to find d. Even though brute force attack can be successfully deploy against RSA encrypted message if the key lengths are not long enough using the modern day factorising algorithms and faster machines it is still harder and impractical to break RSA using brute force attacks on larger (E.g. 1024 or more bit key sizes) keys.

On the other hand keys once considered impractical to break have become vulnerable in recent years.

For example even though Rivest predicted that it will take about 40-quadrillion years to factorize 129 bit long key , in reality it took only about 8 months to determine it with the help of an world wide distributed system. [Riele H, 1995, Factoring Large Numbers]

This suggests us that even larger key sizes are not 100% secure in the long run.

Implementation flows, constraints and bugs

Hybrid architecture

Encrypting bulk messages using asymmetric ciphers such as RSA is extremely slow and processor intensive process compared to the other encryption methods using symmetric ciphers such as AES. This makes it using pure asymmetric ciphers to encrypt messages impractical in everyday applications. In software implementations, encryption/decryption using asymmetric ciphers such as RSA is 100 times slower than using symmetric ciphers such as AES to do encryption/decryption operations.

To circumference this limitation in practice, applications use symmetric ciphers to encrypt the bulk messages and then encrypt the session key using the asymmetric ciphers for secure exchange between communicating parties. These are called hybrid cipher systems. The issue with this method is that the system is strong as its weakest link. If the application make use of vulnerable symmetric ciphers or use less than adequate key lengths for the session key , attack can be deploy against the message directly with out being bothered to decrypt the session key encrypted using the asymmetric cipher.

This vulnerability can be addressed by choosing keys with satisfactory length to encrypt messages when using symmetric ciphers.

Not so random number generators

Sometimes even if long enough RSA keys are used, a known flows in the random number generator or not having enough entropy while calculating p and q may make the system vulnerable to attacks. This will give an opportunity to the attacker to simulate/guess and check p and q with out going through a full brute force method to factor n to find p and q.

Attacks against choosing common e

In practical algorithms, to make modular exponentiation operation faster for RSA , encryption exponent e is chosen to be same for all users and one of 3, 17 or 65537 values. This is to simplify the calculation of c = M^e mod n.

When e is chosen as 3 then cube root attack is possible.

When e is chosen as 3 and message (M) is less than n ^1/3

Then modular operation becomes effect less and thus c = M³

In this situation attacker can easily determine message M from the cipher text (c) alone by simply calculating cube root of c.

This security issue can be easily avoided by padding short messages with random bits so that message M is larger than n ^1/3

Key management

Poor key management and signing techniques used by careless users can jeopardise the ability to communicate securely and will weaken the web of trust. It is absolutely essential to verify (Key fingerprint can be used) the identity of the key owner before signing any key. Secondly all public key signatures should be verified before using it to ensure secure communication.

Threats posed by network/password sniffing applications are virtually eliminated by using RSA based asymmetric cryptographic systems. Shared secrets do not need to be exchanged insecurely or in a cumbersome way to initiate a secure communication. Using RSA public/private key pares, this exchange of shared secret can be automated and secured.

Social engineering attack

Vulnerability exists where intercepting party can recover an encrypted message using carefully altered cipertext message and some social engineering techniques. For example Alice send encrypted message to John which get intercepted by Malory. Malory alters the cipher text and sends the message to John as it is coming from him. When John tries to decrypt the altered message it returns garbage. When John notify this to Malory , Malory can request that decrypted garbage to be sent back to him. If John is careless enough to do that, Malory can easily determine/recover the session key by analysing the decrypted data injected by him in to the cipher text. Then this session key can be used to decrypt the original message sent by Alice.

This vulnerability can be easily avoided by practising some common sense and not returning any data from a failed decryption attempt to any one who asks for it.

Mathematics behind RSA private and public keys

Public and private keys are used in asymmetric cryptographic systems to exchange data securely with out sharing a common secret key. Even though the mathematical concept behind each asymmetric cryptographic algorithm differs they all are based on one concept in which two different keys are used in encryption and decryption process. Out of these keys, encryption key is freely distributed (public key) while the other key (decryption key) remains a secret. Out of many asymmetric cryptographic algorithms we will have a look at the RSA algorithm.

In RSA, Private and public key pares are basically two prime numbers which satisfy certain mathematical conditions. In real life situations these two prime numbers need to be large enough to be practically used in a cryptographic system

RSA concept:

The basic steps in deriving key pairs are listed below.

1. Select/generate 2 prime numbers

Get two prime numbers p and q.

1. Calculate the modulus

Multiply to get number n

Modulus = n = p* q

2. determine φ(n)

Lets calculate φ(n) where φ(n) = (p-1)(q-1)

By applying Euler’s totient function we calculate φ(n), which is the number of positive integers less than n that are coprime with n .

3. Calculate the Encryption key(public exponent):

Let’s choose the encryption key (public key) e where e and φ (n) are coprime. Which means the greatest common denominator (gcd) of e and φ (n) is 1. I.e. the largest positive integer that divides both numbers without remainder is 1.

i.e: gcd(e , φ (n)) = 1

In here e should be greater than 1 and less than φ(n)

4. Calculate the decryption key (secret exponent):

Decryption key (Private key) d is derived by calculating the inverse of

e mod (φ(n)) using the extended Euclidian algorithm

d = e^-1 (mod (φ(n)))

In summery:

Public key is (n, e) where

gcd(e , φ(n)) = 1

and

φ(n) = (p-1)(q-1)

Private key is (n, d) where

d = e^-1 (mod (φ(n)))

Practical example:

How this algorithm is used to generate a private and public key pare is shown below by using two small prime numbers.

1. Select 2 prime numbers

Let’s select 2 prime numbers p and q where

p = 31

q = 17

2. Calculate the modulus

Modulus = n = 31 * 17 = 527

3. determine φ(n)

φ(n) = (p-1)*(q-1)

= (31-1)*(17-1)

=30 * 16

φ(n) = 480

4. Calculate the Encryption key:

Lets choose a value for e such that gcd(e , φ (n)) = 1

gcd(e , φ (n)) = 1

gcd(e , 480) = 1

Let’s choose e as 7

Lets ensure that gcd(7 , 480) is really 1

480 = 2⁵ x 3 x 5 x 1

7 = 7 x 1

Which assure us that gcd(7 , 480) = 1

5. Calculate the decryption key:

d = e^-1 (mod(φ (n)))

d = 7^-1 (mod480)

Let’s use a table to calculate the inverse of 7mod480 using extended Euclidean algorithm.

X_i = (X_i-2 - [X_i-1*q_i-2]) (mod b)

Where,

X₀ = 0 and X1 = 1

Step 0:	480 = 68(7) + 4	X0 = 0
Step 1:	7 = 1(4) + 3	X1 = 1
Step 2:	4 = 1(3) + 1	X2 = (0 – (1*68))mod480 = 412
Step 3:	3 = 3(1) + 0	X3 = (1 – (412*1))mod480 = 69
		X4 = (412 – (69*1))mod480 = 343

Thus d = X₄ = 343

Thus according to our chosen prime numbers p and q,

Public key e is (527, 7) and private key d is (527, 343)

In practise, to make modular exponentiation operation faster, e is chosen to be one of 3, 17 or 65537 values. This is to simplify the calculation of encryption, c = m^e mod n where c is cipher text and m is the unencrypted message.

The bit lengths of p and q should be equivalent to the half of the bit length of n where Modulus = n = p* q