Tuesday, December 25, 2012

Cloud Computing

Cloud computing is a combination of multiple traditional technology developments, including distributed computing, parallel computing, utility computing, network storage, virtualization and load balancing. It has become a popular term in recent years, and many experts believe that cloud computing will change the technical foundation of the Internet, and even affect the pattern of the IT industry as we know it. After super computers, personal computers (PC) and the world wide web (WWW), cloud computing is the third wave of computer evolution. As a result, many large enterprises such as Amazon, Google, Microsoft, IBM, SUN, and Apple are researching ways in which cloud computing technology can expand their market share.

The fundamental concept of cloud computing is similar to that of water and electricity supply. Each user connects to a single pipe and shares the same resources. This evolution changes our lifestyle, business model and operations. It successfully evolves from built in IT systems, to save costs and boost business revenue. Below are examples that may help us understand how cloud computing works:

1. Server A - 50GB storage

2. Server B - 100GB storage

3. Server C - 150GB storage

Traditionally, each server is a stand alone and none of the servers can store 200GB of data. To do so, a business owner would have to spend additional money to upgrade the hardware. With the cloud system, the three servers can share their capacity without any upgrades, and achieve 300GB storage.

In another scenario, if a single PC downloads 1MB of antivirus definitions to a local drive, it causes the main server to lose 1MB of bandwidth. When 10,000 PCs makes the same download, it will cause the main server to lose 10GB of bandwidth. With cloud antivirus, all virus updates refer to the main server and no downloads are required. It saves server cost and user time.

Similarly, in an Apple game center for example, each user’s game score is stored in a remote location. When the user needs the data, it can be accessed through any Apple device and not necessarily a personal device.

Wednesday, December 5, 2012

Google Being Hacked?

Recently, Google being hacked in Romania and Pakistan became a popular topic for discussion. "Real" hacking would mean someone successfully broke into Google's server, changed the server permission, and stole Google data. So in actual fact, Google was not hacked, but instead had a DNS redirection problem.

For example, to visit lns.com.my, we need to memorize the specific IP address 103.3.72.5. To make it easy for users to remember a website, DNS (Domain Name System) is responsible for translating Internet domain and host names to IP addresses. So when a user types lns.com.my in a browser, the DNS will automatically direct the user to visit the 103.3.72.5 website.

In Google's case, someone has taken advantage of the conversion tool (DNS), and switched off google.com.pk by pointing it to a different IP address. As a result, millions of users saw the hacker message instead of the usual Google landing page

If you find a page with an error message or non-common landing page, don't linger or click anything. Leave the site and let the administrator solve the problem, because syncing DNS to the correct IP address is a process that may take up to a few hours.

Tuesday, November 6, 2012

Trojan Horse Virus

The name "trojan" comes from the ancient Greek legend of the trojan horse. The "trojan horse" program is a popular virus file. It is not self-propagating to infect other files. Usually, trojans are disguised to attract users to download them. Once a user opens the particular file, it plants a trojan virus. Hackers can then use the security hole to remote access users' computers, monitor user behavior and even transfer data.

Trojans work in a way that is similar to remote access, the difference is trojan horses can obtain the permission of the computer, without users' right. The program capacity is very light and small, and runs with resources and bandwidth. It is difficult for computers without anti-virus software to detect it, and stop its actions. It automatically runs each time Windows loads, immediately changes the file name, can even be invisible, or immediately auto copies to another folder, stopping users from running the antivirus.

In order to prevent detection of the trojan, hackers usually encrypt the packet file. When the trojan runs and connects to the user's computer, the hacker is able to get most of the server operating authority, such as copying files, deleting files, modifying the registry, and changing the system configuration of the user's computer. There are two types of trojans - universal and transitive. Universal trojan horses can be controlled, but you cannot control transitive ones.

Trojan technology develops rapidly, mainly because of youngsters who are curious or eager to show their skills. So far, trojans have gone through six generations of improvements:

The first generation is the most original. Simple password theft by sending a trojan via e-mail and waiting for users to respond to the e-mail.

Second generation trojans have made great progress in technology. Glacier is one of the typical representatives of China's trojans.

With major improvements in data transfer technology, third generation trojans are ICMP types that use malformed packet transmission data, increasing the difficulty for antiviruses to identify the software.

The greatly changed fourth generation is a hidden process, using a plug-in kernel to remote and insert threading technology to DLL thread, or articulated PSAPI.

The fifth generation is a hard drive stage trojan. This trojan uses Rootkit technology to achieve hidden depth, then infects the hard drive and attacks the anti-virus software and network firewalls, so they lose their self protection effect. Some hard drive level trojans can lock BIOS, making it more difficult to remove.

Sunday, October 21, 2012

Antivirus Knowledge

1. Antivirus software cannot kill all types of viruses.

2. Antivirus software may find a virus, but may not be able to kill it.

3. Each computer or operating system cannot install two or more antivirus software, unless they are compatible versions.

4. Antivirus software can act on infected files in a variety of ways:
a. clear
b. delete
c. prohibit access
c. isolate
d. do not handle

Once you clear a file that is infected with worms, the file will go back to normal, just as a sick person who is given treatment will recover. If it is a virus file, as opposed to a file infected by viruses, it cannot be cleared and you must delete it.

Users who choose not to clear or delete a virus file, can prohibit access to the file by creating an error dialog box with the message "the file is not a valid Win32 file".

With isolation, the virus is transferred to the quarantine area. Quarantined files cannot run any activity, but users can retrieve files from quarantine.

Do not handle means the user is not sure if it is a virus file, and chooses not to deal with it.

Wednesday, October 17, 2012

About Antivirus Technology

Antivirus installation is used to eliminate computer viruses, hijackers, key-loggers, malicious LSPs, rootkits, spyware, and other malicious software. Antivirus software is usually integrated with monitoring recognition, virus scan, virus removal, and automatic upgrade features. Some antivirus software has data recovery and computer defense systems such as firewalls as well, to ensure that systems work properly.

Through real-time monitoring, signature-based detection can constantly scan for known virus definitions and behavior from the database, compare them with virus attack patterns, and release further executable protection codes. However, it is not possible for an antivirus to identify new or unknown malware. To cover this weakness, some antivirus software groups unknown source files to a sandbox where it further analyzes what they do to see if they perform any malicious action.

Antivirus Technology

1. Shelling technology is very commonly used. It is able to scan and analyze compressed files.

2. Self-protection technology is basically like an immune system. It prevents the virus or malware from stopping antivirus monitoring.

3. Virus corrupted file repair technology can repair files destroyed by viruses. Without this technology, anti-virus software often deletes the infected system files, which makes the computer crash or unable to start properly.

4. Active real-time upgrade technology automatically upgrades server information and virus definitions each time you connect to the Internet. There is also more advanced cloud technology, which uses real-time access to cloud data centers to make virus database comparisons and protect against the latest viruses. Users do not need frequent upgrades.

5. Active defense technology through automatic monitoring of anti-virus system for dynamic simulation of various procedural actions, the logical relationship between the actions of automatic analysis program, integrated application of virus identification rules knowledge to achieve the purpose of active defense.

6. Inspired technology is the original eigenvalue recognition technology based on a summary of the analyses of suspicious program samples, which are transplanted into the antivirus program. When viruses meet the conditions, users will be notified to defend against the unknown viruses or malware. In contrast, conventional antivirus software collects virus definitions, types, or behavior from a huge number of user computers, analyzes the database, then redistributes it as antivirus updates. This method is time-consuming.

7. Using artificial intelligence (AI) algorithms with "self-learning, self-evolution" capabilities, antivirus software can remove packers and variants of viruses without frequent updates to the database, or analyses of virus static characteristics. It uses the intelligent algorithms to discover and learn new virus variations. This leading technology does not have the "do not upgrade the virus database, cannot kill the virus" technical problems that the first two generations of antivirus engines have.

Antivirus Problems

Many antivirus software requires a lot of system resources, such as memory resources and CPU resources, to ensure the safety of the system but this reduces the system speed.

Antivirus technology continues to progress but for now, antivirus software can only kill viruses. If used to kill Trojans, some user data or system files may be destroyed as well, causing system corruption problems.

Monday, October 8, 2012

Difference Between Hacker and Cracker

There are many definitions of the term "hacker". In most cases, a hacker is defined as having superb programming technology, and a strong desire to solve problems and overcome limitations. If you want to know how to become a hacker, there are two important things - attitude and technical knowledge. Historically, the word "hacker" can be traced back to a few decades ago, to the earliest ARPAnet experiment period, when expert-level programmers and network engineers shared their knowledge through minicomputers.

Hackers built the Internet with the Usenet and Unix operating systems. Hackers allowed WWW. to operate normally. Any individual who participated in the online community automatically became a hacker, as they contributed to building the system.

The hacker spirit is not limited to software applications. Hackers can also be found in other industries such as electronics and music. In fact, we can find hackers in any higher-level science and art field. In this article, we only focus on the skills and attitudes of software hackers, as well as the invention of the word "hacker".

There is another group of people who claim themselves to be hackers, but they are really not. They are intentional destructors of computer and telephone systems. In this century, the actual hackers call these people "crackers". Most real hackers think of "crackers" as irresponsible and lazy people, not a great accomplishment. Setting out for the specific purpose of destroying others' safety behavior does not make a person become a hacker, just as using wire to open a car door does not make one an automotive engineer. Unfortunately, many journalists and writers often use the words "cracker" and "hacker" interchangeably, which angers the real hackers. The fundamental difference is that hackers provide solutions with informative advise, whereas crackers purely create damage.

Hackers solve problems and help people. In order to be a real hacker, the person must have a good attitude and good behavior. The purpose of becoming a hacker is not for public recognition, but more importantly for helping, learning and discovering.

Tuesday, September 25, 2012

Network Security Wiki

Network security refers to the protection of network systems, hardware, software and data, so they are not leaked by accident or due to malicious reasons, and the network service is stable and runs continuously without interruption. Network security involves a comprehensive calculation of computer science, network technology, communication technology, password technology, information security technology, applied mathematics, number theory, information theory and other disciplines.

Key Features:

Confidentiality

Information is not leaked to unauthorized users.

Integrity

Information and data kept in storage or in the transmission process, are not modified without authorization, not destroyed and not missing any features.

Availability

With authorization, data can be used as necessary.

Controllability

The ability to control the dissemination of information and content.

Auditability

Filtration of bad data, prevention of illegal or harmful usage of data such as information involving state or national secrets, and prevention of confidential information leakage.

Typically, system security, performance and functionality have a contradictory relationship. If a network system does not provide any service to (i.e. is disconnected from) the public, the outside world is unlikely to pose a security threat. However, most companies provide online stores and e-commerce services that require a somewhat open network environment, which then opens the gateway for security issues.

The necessary authentication, encryption, monitoring, analyses, and reports affect network efficiency, and reduce the flexibility of the client's application and Internet connection. At the same time, it will increase administrative expenses.

Good network security coverage should have the following features:

1. Check for security vulnerabilities: Perform cycle checks; even if a hacker can reach its target, the system is able to make the attack/s ineffective.

2. Attack monitoring: Real-time detection and attack monitoring; such as auto disconnect network services, recording attack history and log file, and tracking the source of the attack.

3. Encrypt data: With encryption, an attacker cannot understand or modify the information.

4. Authorization: Prevents an attacker from impersonating legitimate users.

5. Backup and recovery: A good backup and recovery mechanism, so as soon as losses occur in an attack, the data service will stop and restore immediately.

6. Multiple layers of defense: When an attacker breaks through the first layer, the system delays or blocks it from reaching the next layer or target.

7. Hide internal information: An attacker will not be able to understand the system.

Tuesday, September 11, 2012

One Internet connection - Two Private LANs

There are times when 2 router sharing same internet connection, the requirement on configuration, each router must be set to a different Class C subnet. Below chart indicate that both router setting with different subnet, which is 192.168.1.1 and 192.168.1.2

Networking Map

Wednesday, September 5, 2012

How Address Resolution Protocol (ARP) Attack VLAN

VLAN (Virtual LAN) is the concept of partitioning a physical network, so that distinct broadcast domains are created. Regardless of server location, VLAN is able to maintain private network communication with each host. It provides users with a separate network segment, with the added benefit of saving bandwidth and equipment usage, thus helping companies save costs.

VLAN is suitable for private network connections, however, it is not particularly safe. VLAN builds on the second layer of the OSI data link layer. Although each OSI layer is independent, they are interrelated. If one of the layers has problems, it will also affect the data transfer of other layers. The potential security threats are:

Address Resolution Protocol (ARP) Spoofing
The working principle of ARP is actually the process of turning the third layer IP address into the second layer MAC address.

A malicious user can forge the IP address and MAC address. ARP protocol cannot detect fake information, which causes safety problems. The malicious user will be mistaken as a legitimate user, and will be free to use the network resources and have administrator access. Furthermore, they can even send ARP packets in the VLAN devices.

When the hacker sends an ARP data packet to the targeted victim, the packet cannot be detected because the received ARP table has been forged. The hacker can receive the actual device messages, and can even attempt to receive information from other network devices. The hacker then hides his/her identity by restoring the ARP data table and network equipment back to normal process.

Famous ARP spoofing tools such as rpspoof, Arpoison, Cain and Abel, Ettercap, and Trapper are inspired from Cain.

An effective strategy to deal with ARP attacks is dynamic ARP monitoring (DAI). DAI is an ARP packet network authentication security feature that can remove the IP address and MAC address in the ARP data packet.

Steps to configure the router to prevent ARP attacks:
  1. VLAN DAI status (CISCO DHCP environment)
  2. Enter the global configuration command
  3. Router# configure terminal
  4. Through the use iparp checking VLAN {vlan_id | vlan_range} global configuration allows use in VLAN DAI
  5. Router (config) # iparp inspection vlan {vlan_ID | vlan_range}
  6. Finally, verify the configuration
  7. Router (config-if) # do show iparp inspection vlan {vlan_ID | vlan_range} | begin Vlan

Tuesday, August 28, 2012

Some Causes Of Slow Internet Speed

First make an internet speed check with LNS tool, then identified the slow factor.

1. Virus infection
This situation often manifests in Internet Explorer browsers. Users may try to open a page, but have to wait a long time before it responds. View the process in the Task Manager (press Ctrl + Alt + Del and select Task Manager). If the Performance tab indicates the CPU usage rate is 100% and memory is full, the PC is confirmed to be infected with a virus/viruses. In this case, you do not have available memory to open new programs. It is necessary to find out which application is greedily taking up CPU resources.

Once you find the application in question, end the task. If you cannot end it, you have to restart the PC and run it in Safe mode to delete the application. You also need to shut down the application in the registry dialog box (click Start > Run, then enter "regedit"). Click Edit > Find, enter and find the name of the program, and right click to Delete. Perform the search several times to ensure that it is completely removed. Anti-virus software and security tools are more for the prevention of viruses, but when a PC gets infected, the best solution is to manually delete it.

2. Proxy server connection
For security reasons, some browsers are preset with a proxy server (Control Panel > Internet Options > Connections > LAN Settings > Use A Proxy Server For Your LAN). The proxy server does not affect certain networks e.g. QQ Messenger, because QQ uses 4000 port, and accessing the Internet uses ports 80 or 8080. This is why users can sometimes log-in to messenger, but cannot open a web page. The proxy server is generally not very stable. If the problem continues, it is advisable to turn off the proxy setting.

3. DNS server interprets error
DNS is the Domain Name Server, which is a tool that transitions domain names into the IP addresses that computers recognize. Sometimes the network service provider may be down due to router problems. When the DNS server interprets error, you can call and consult your Intenet Service Provider (ISP), who can reset the router by flushing the DNS.

If the PC's network card cannot search the DNS server address automatically, you can try using a specified address via Network Attributes (Control Panel > Network and Dial-Up Connections > Local Area Connection > The Right Attributes > TCP/IP Agreement > Properties > Use The Following DNS Server Addresses). For example, Google DNS 8.8.8.8 (primary) or 8.8.4.4 (alternate). It may also be a good idea to update the network card software driver or replace the card entirely.