Sender Scanner

Sender Scanner

Living in the Information World - Walking on the Tight Rope For Security

Any technological advancement comes over a price but admist fierce advancements and pressures to trim down time to market leaves so many loopholes which sooner or later come out and damage significantly before remedies are done. The world of web seems to be still plagued by it and its surprising to see that the smart brains are sitting on the other side of the bench. How is that possible? Proofs? What can be done to Mitigate the risks.

The Iframe Code Injection in WebServers: The deadliest of the crowd. There is a vulnerability being exploited on Linux hosted web servers. There is an iframe tag injected on one of the HTML pages. The Iframe has got "0" co-ordinates and hence is hidden while invoking the browser and links to spamming site. There is no virus scanner in the world which would detect it as a virus which is the way it is supposed to be as it is indeed not a virus. On the other hand when any user at the client side invokes the same page, in the background it triggers the link which downloads malicious content without the content of the user. It is only when the trojan gets downloaded and starts infecting, the scanner detects and cleans it. Which merely cleans it temporarily and the same process continues in loop.

Mobile Bluetooth messaging: The design of stack of bluetooth has a loophole in the manner in which it is implemented at the protocol. The 3 way handshaking has got a flaw because of which when a user using the messaging function of the adapter sends a message to a cellphone user. There is no way the receiver will be able to find out the sender's details.

The Players on the line of Ethics: Many security organizations in the world propagate viruses themselves and then offer solutions for their self created exploits. Not only viruses, it is common w.r.t. spam, malware, trojans, spyware and so on. Even if one has the proofs, there is no Central Organization (in the whole world), where in one could submit the proofs and complaints against the said vendors. A more very common problem is that they actually propagates viruses on the client machine in case the client does not extend subscription (This is very common problem seen in most of the vendors.

The Banks and Financial Institutions: The Banks and other Financial Institutions lose millions of dollars in terms of online frauds and scams but there is no news in the media. Reason being the end users will stop trusting the bank and most of the banks avoid leaking out the information absorbing the facts as well as the loss.

The Browser Wars: Most of the browsers have security implementations and underlying technologies which have loopholes. Although there is a standardized governing body (w3c.org), but its upto the vendors whether they conform or they don't.

Syn Flooding..

Whenever a client is sending a ' Syn ' to the server, the server knows that someone wants to connect to him. It means the client who is trying to connect and is asking for permission to do so. The TCP IP stack has to send this client a ' Syn Ack '. For this purpose he needs to know a few things about the client like it's IP address, port number, Sequence number of the ' Syn ', etc. To store this information, the TCP IP stack has to allocate some memory. When the TCP IP stack sends the client a 'Syn Ack ', it blocks a connection for the client, and allocates some memory till he receives an ' Ack ' from the client. Until the server receives an ' Ack ' from the client, the connection is known as a ' half-open ' connection. Allocating memory or resources is an expensive process. The more the memory that the TCP IP stack allocates for half-open connections, the lesser the memory it has for executing other programs. Earlier on, the TCP IP stack would allocate only enough memory, to store 8 half-open connections.When the TCP IP stack received an ' Ack ' it would declare the connection to be no longer a half-open connection but a live connection. In other words this is now an open connection.

Assume that a TCP IP stack can have 8 half open connections. Suppose all the 8 half-open connections are occupied. When a 9th ' Syn ' packet arrives, the TCP IP stack would not be able to accommodate it. And therefore this 9th ' Syn ' packet would be rejected. No one else would now be able to connect to that machine. Obviously the stack is not like us, the kind of people who patiently wait for hours at length for the next bus to arrive. If an ' Ack' from the client does not arrive within a specified period of time, the TCP IP stack terminates this half-open connection.

We could write a program, that will keep on sending a forty byte header with the ' Syn ' flag on. Thus, we would be sending only the ' Syn ' packets without sending any ' Ack ' packets. We would thus occupy all the eight half-open connections that were available on that TCP IP stack. We also know that the TCP IP stack sets a predefined timer after which it will terminate each of our half-open connections. Let's assume that we know that the timer is set to sixty seconds. Since we know that our half-open connection will be terminated after 60 seconds, will it not be possible for us to keep sending ' Syn ' packets every sixty seconds so that all the half-open connections are always occupied by our ' Syn ' packets. This method, used to prevent other clients from connecting to a server is known as ' Syn Flooding '.

Now some genius tried to design a method to prevent these syn floodings. He created a method known as the ' fire wall ', by which, he claimed that syn flooding could be prevented. This method works on a very simple principle. The TCP IP stack never checks the IP address of clients, while accepting or rejecting connections. Since it is possible for the TCP IP stack to know the address of every client connecting to it, you just check the client who keeps giving ' Syn's ' and not responding with the ' Ack '. The ' fire wall ' is a computer which checks the IP addresses of incoming clients. The person who designed the fire wall, merely placed it in front of the TCP IP stack. The ' fire wall ' is then given the IP address of that client and whenever that client tries to connect to the server it would promptly drop the packet. But if the client keeps changing the Source IP address randomly - as the IP address can go upto 4 billion - the ' Syn Acks ' would go to the wrong machine. Thus by sending different and wrong IP addresses, one can easily bypass the fire wall. Hence, at present, there is no solution for ' Syn flooding '.

Land Attack..

The name though it sounds as if there is a war going on, but it is not so. Land attack is just a name given to a method designed by Mr. Land to give some more headache to the servers. He simply passes both the source and destination IP address, with the same address as that of the server. In this case the server is sending itself a ' Syn Ack '. When the poor guy tries to send a ' Ack ' to himself for a ' Syn ' which he has not sent, he invariably hangs.

Reliability..

Now the Internet Protocol in itself is unreliable. This is because there is nothing in IP which tells us whether the packet you have sent has reached or not. There is no mechanism in IP which will tell you whether the packet has reached the destination safely and in order. It does not mean that IP does not send the packets across correctly, it is just that there is no guarantee that the packet will reach. Let's take the example of the Postal Service in India. Suppose you want to send a letter to Tiruvananthapuram by ordinary mail. Now it is not that the mail is always lost, the Postal Department does sometime deliver the letter but there is no guarantee that it will reach the place. It may reach Tiruvananthapuram but then again it may not reach on time. It is also possible that if you send two letters one after another, the second letter may reach first. There is no way in which the Postal Department will come back to you and say that the mail has not reached, or that it has reached late or that the second letter has reached first. So also is the case with the IP Protocol. There is no way by which it comes back and tells you that the packet you had sent has reached or not.

Because of this we can never be comfortable with only the IP protocols. If we want to make additions to the rules of the IP protocol in such a way that IP would come back and inform us whether the packet has reached or not, it will make the IP protocol very complex.

Now the IP protocol deals exclusively with the routers. It's IP's job is to make sure your packet goes from one end to the other in the shortest possible time. IP is the one who informs the router about the location of it's destination, it's source and other such details. The IP protocols primary concern is speed. It has to try and get to the destination as fast as possible and it cares about nothing else. The IP protocol has sacrificed reliability for speed and it shows. So why not allow it to do the job it knows best ? i.e. routing.

If the Internet was to rely exclusively on IP, the result would be absolutely chaotic. It was to combat this problem of unreliability, that the TCP protocol was established. The TCP protocol is the exact opposite of the IP protocol. It's primary concern is reliability. It is the TCP protocol that takes care of checksums and sequencing. To send a packet on the net it is possible that your packet may be broken into two or more packets - depending on the size of your packet. Now each packet may reach the destination port at different times and in different order. Is it not necessary that the packets are received in the order they are sent ? Otherwise the packet may reach the party in a haphazard manner, whereby the message transmitted is completely illogical and garbled. It is the job of the TCP Protocol to make sure that every packet reaches the destination and is put together in the correct order.

Sequencing...

Let us now see how we can send data across from a client to a server. When data is sent across to the server, the ' Sequence number ' and ' Acknowledgment number ' are very important. The client informs the server about it's ' Sequence number '. This number has been generated randomly by the TCP IP stack. Our TCP IP stack will start numbering the data to be sent across to the server from this number. We can explain the concept of a ' Sequence number ' and an ' Acknowledgment number ' in a better manner with the help of the following example. Suppose we are sending the data which is shown below.

A B C D E F G H I J K L
2 3 4 5 6 7 8 9 10 11 12 13
Let's assume that we have agreed with the server on the ' Sequence number ' 2. Therefore, our data has been numbered from 2 onwards. Assume we are sending 3 bytes of data at a time along with the TCP IP header. Thus, the server will receive a packet of 43 bytes. In this packet, the number in the ' Acknowledgement field ' has no meaning.

IP header

20 bytes

TCP header

20 bytes

ABC 3 bytes

The minute the server receives the packet he responds with an ' Ack '. This ' Ack ' is of 40 bytes and has it's ' Ack ' flag on. When the ' Ack ' flag is on it means that now the ' Acknowledgment field ' is valid.

The server looks at the size of the packet and finds out that we have sent him three bytes of data. He knows that we have sent him data bytes A, B and C which are numbered as 2, 3 and 4. He will take the last byte number i.e. 4 and add 1 to it, to obtain the number 5. The server will place this number as the ' Acknowledgment number ' in the ' Ack ' he sends us to inform us that he has received our packet.

When we receive the server's ' Ack ', we look at his ' Acknowledgment number ' which is 5. We now know that we have to start sending data from byte number 5 onwards. So we place 5 as the ' Sequence number ' of the next packet we are going to send him. Along with this packet, we send three more bytes of data to the server. As our ' Sequence number ' is now 5 the server will now receive D, E and F which are numbered as 5, 6 and 7, as it's next packet. The server will take the last byte number of this packet, i.e. 7 add 1 to it and respond with an ' Acknowledgment number ' 8. On receiving this ' Ack ' packet sent by the server, we now know that we have to send data bytes from 8 onwards. If we do not receive an ' Ack ' for any packet we sent, we have to retransmit that packet after a certain amount of time.

It is a fact, that the server is wasting time by responding with forty bytes of ' Ack ' every time we send a packet of three bytes. Instead of the server sending us an ' Ack ' for every packet it received, it may decide to send us an ' Ack ' after receiving two packets. We are now sending the server two packets one after another, before it responds back with a ' Ack '. Looking at our above example, the server may send us an ' Ack ' with the Acknowledgement number 8 instead of 5 the first time. This means that the server has received the bytes numbered 2 to 7 and wants us to send him the next packet from the 8th byte onwards. This is to shows that ' Acks ' can be bunched together.

It is possible that when we send two packets one after another, the second packet may reach first. But, since our data has been sequentially numbered, the server will arrange our data in the correct order.

TCP is a decent protocol. It is not ill-behaved, unlike other protocols which we shall talk about later. The moment the client receives an ' Ack ' it means that the server has received a packet and responded with an ' Ack ' . We - the client - have to first calculate the total round time i.e. the time from the moment we send a packet to the time we receive an 'Ack' from the server. Suppose we send a packet to the server and we receive an ' Ack ', 1 second later. We now know that the transmission time, one way, is 1/2 a second. After we keep sending packets for 15 minutes, at intervals of 1 second, we may suddenly realise that the server is now responding with the ' Ack ' every 2 seconds. This shows that there is now congestion on the line. So if we receive an ' Ack ' late, we also would be sending our packets late.

Let's assume another case where we are sending a packet to the server. We can't wait indefinitely for the server to respond with an ' Ack '. This may be due to the reason that our packet has not reached the server. It may also be due to the reason that the server may have sent an ' Ack ' but the ' Ack ' did not reach us.

Because of this we have to set a retransmission timer which will inform us that it is time to retransmit a packet. It is possible that we may set the retransmission time too high and we may receive the ' Acks ' at a faster rate. For example, suppose we set our retransmission time to be 5 seconds and the server responds with an ' Ack ' within 2 seconds. Then we are wasting 3 seconds needlessly. Hence we have to dynamically reset our timer to 2 seconds.

If we set the timer for a short retransmission time, it is possible that we may receive an ' Ack ' after we have retransmitted the packet. For example, if we set our retransmission time to 1 seconds and the server responds with an ' Ack ' after 2 seconds. Then we are retransmitting the first packet without waiting for a reasonable time for the ' Ack ' to reach us. Hence we have to reset our timer to 2 seconds. Even if the server received our duplicate packet it is intelligent enough to drop it.

If this was the way the TCP worked, then it would make the whole process of transmission too slow and be more of a liability than an asset to the network. Slow, because the server would have to wait for an ' Ack ' from the client every time it sent some packets. To guard against the slowness of the protocol there is something in TCP known as the window size - which incidentally we had said would be explain later. Well, the time has come when we feel that you should know what a window size means. So let's now learn about the ' window size '.

Let us talk about a case where we are receiving data from a server. The server sets a limit to the number of bytes of data it can send us, without receiving an ' Ack ' from us. This maximum limit is known as the window size. It is not a constant figure, but may vary due to a number of factors like congestion, etc.

Suppose the window size of the packet coming to us from the server is specified as ' 4 , 0 '. The server will keep sending us data up to, 4 * 256 + 0 * 1, i.e.1024 bytes before it demands we send it an ' Ack '. The sever knows that he can keeping sending us data, he will not send us the 1025th byte until we send him an ' Ack '. This increases the rate of flow of data.

The Analysis:

1. We the customers have no choice except shelling out money on trying to protect ourselves. Still continue to use and keep upgrading irrespective of the price.

2. Our machines resources are ruled by the so called scanners claiming it to protect us. At the same time absorb the maximum machine resources right from memory/processing power/network bandwidth and so on.

3. In today's world which is supposed to be an IT world is being ruled by Microsoft on one place and the security players on the other. The customers pay for their most expensive services and still their resources are not in their own control as heavily depend on the mercy of the said service providers/vendors.

The Future: Sooner or later the world will migrate to smarter vendors and will be lot more informed about invasive policies/practices of the vendors. they will be lot more proactive and better placed to take informed decisions

About the Author

Test Manager
Pure Testing

HP 9250C Digital Sender/Scanner. Each $3356.55 Manufacturer: HP. Each. Customers also search for: HP 9250c Digital Sender Sheetfed Scanner, 882780801028

HP 9250C Digital Sender Flatbed/Sheetfed Scanner 600x600dpi CB472A $3074.35 HP 9250C Digital Sender Flatbed/Sheetfed Scanner 600x600dpi CB472A

Digital Sender 9250c - document scanner $3129.99 HP Digital Sender 9250c - Document scanner - Duplex - Legal - 600 dpi x 600 dpi - up to 55 ppm (mono) / up to 33 ppm (color) - ADF ( 50 sheets ) - up to 60000 scans per month

The Sender $9.49 The Sender

HP 9250c Digital Sender Sheetfed Scanner 600x600dpi Usb 2.0pc Mpn: CB472A $3092.68 HP 9250c Digital Sender Sheetfed Scanner 600x600dpi Usb 2.0pc Mpn: CB472A

HP Digital Sender 9250c - Document Scanner. Each $3368.1 Manufacturer: HP. Each. Buried in paper? HP can help. The 9250c Digital sender makes it easy to create electronic copies of your paper documents so you can distribute them easily, store them efficiently, and organize them right along with your other elect

HP Digital Sender 9250C Document Scanner. Each $3368.1 Manufacturer: HP. Each. Buried in paper? HP can help. The 9250c Digital sender makes it easy to create electronic copies of your paper documents so you can distribute them easily, store them efficiently, and organize them right along with your other elect

HP Digital Sender 9250c $2879.99 1 Year 1 x EIO 230 V AC 33 45 lb 5.80" x 8.20" 50 Sheets 55 600 dpi 600 x 600 dpi 9250c Digital Sender 9250c Power cord User's Guide Documentation CD Mylar kit Cable Hard disk: 40 GB HP high-performance hard disk Supported file formats: PDF, TIFF, MTIFF, JPEG Monthly duty cycle: up to 60,000 Standard features: Send to E-mail Send to Folder LDAP or local address book e-mail addressing Kerberos and LDAP authentication Group 1/Group 2 PIN authentication Buried in paper? HP can help. Our 9250c Digital sender makes it easy to create electronic copies of your paper documents so you can distribute them easily, store them efficiently, and organize them right along with your other electronic files. HP DSS 4 AC Supply CB472A#201 Card Digital Sender Digital Sender 9250c Fast Ethernet Flatbed Scanner HP Hewlett-Packard Label Legal Legal 8" x 14" Letter PC Plain Paper Transparency Yes www.hp.com

Return To Sender $6 Return To Sender - Ricky Skaggs

Pressure Sender $103.99 Pressure Sender; Replacement For PN[2489/2490/2491/2500/2501];

Sender $12.99 Foreign Exchange:2

SENDER, THE $4.1 Rated: NRSynopsis: NA

Sender The $8.75 Rated: NASynopsis: When a young man attempts suicide, he is committed to a mental hospital. The staff soon begins to suffer nightmarish visions - with the power to kill. Things take an even stranger turn when the patient's mother arrives at the ward, convinced that her son is the second coming. Disturbing special effects sequences mix with truly creepy performances as the movie builds towards its final nightmare. Oscar® winner Roger Christian (Star Wars, Alien) directs this unnerving psychological thriller.

Scanner, Photo Digitizer Scanner, $85.99 SCANNER, PHOTO DIGITIZER SCANNER,

Return to Sender $89.99 Alfred Gockel Return to Sender - Framed Art Print

Autometer Fuel Pressure Sender $120.99 Replacement Sender For 60 PSI.

Auto Meter Replacement Sender $30.99 Low Temperature Replacement Sender

Back To Sender Revisited $12.49 Back To Sender Revisited

10 Years Sender $12.49 10 Years Sender

Fuel Pressure Sender $127.99 Fuel Pressure Sender; Replacement Sender For 15 psi; Nascar;

Hopeful Letter Sender $24.99 Hopeful Letter Sender - Photographic Print

Eye Scanner $10 Eye Scanner

Neon-Scanner $10 Neon-Scanner