Tunneling

Friday, June 11, 2010

Tunneling is a way in which data is transferred between two networks securely. All the data that is being transferred are fragmented into smaller packets or frames and then passed through the tunnel. This process is different from a normal data transfer between nodes. Every frame passing through the tunnel will be encrypted with an additional layer of tunneling encryption and encapsulation which is also used for routing the packets to the right direction. This encapsulation would then be reverted at the destination with decryption of data which is later sent to the desired destined node.

A tunnel is a logical path between the source and the destination endpoints between two networks. Every packet is encapsulated at the source will be de-capsulated at the destination. This process will keep happening as long as the logical tunnel is persistent between the two endpoints.

Tunneling Protocols

The Windows Server 2003 family supports the following tunneling protocols for secure communication:

• Point-to-Point Tunneling Protocol (PPTP)
  • PPTP employs user-level PPP authentication methods and Microsoft Point-to-Point Encryption (MPPE) for data encryption.
  • PPTP uses TCP1723 and Protocol 47 (GRE).
  • PPTP uses only NTLM authentication.
  • PPTP provides 56 bit or 128 bit Microsoft Point-to-Point Encryption (MPPE).
• Layer Two Tunneling Protocol (L2TP)
  • L2TP is an industry-standard Internet tunneling protocol with roughly the same functionality as the Point-to-Point Tunneling Protocol (PPTP). Based on the Layer Two Forwarding (L2F) and Point-to-Point Tunneling Protocol (PPTP) specifications, you can use L2TP to set up tunnels across intervening networks. Like PPTP, L2TP encapsulates Point-to-Point Protocol (PPP) frames, which then encapsulate IP or IPX protocols, allowing users to remotely run programs that are dependent on specific network protocols.
  • L2TP uses the UDP 1701.
  • L2TP does not provide any encryption by itself.
• L2TP with Internet Protocol security (L2TP/IPSec)
  • L2TP/IPSec employs user-level PPP authentication methods over a connection that is encrypted with IPSec. IPSec requires host authentication using either the Kerberos protocol, shared secret or computer-level certificates.
  • L2TP with IPSec uses UDP 500 = ISAKMP, Protocol 50 = Encapsulated Security Payload (ESP) and possibly Protocol 51 = Authentication Header (AH).
  • L2TP/IPSec uses both Mutual authentication and NTLM authentication.
  • IPSec provides DES (56 bit) and 3DES (168 bit) encryption.

How Tunneling Works

As we know VPN connection are of two type, PPTP (Point-to-Point tunneling protocol) and L2TP (Layer 2 tunneling protocol). Both PPTP and L2TP tunnels are nothing but local sessions between two different endpoints. Incase they have to communicate then the tunneling type must be negotiated between the endpoint, either PPTP or L2TP and then more configurable parameters like encryption, address assignment, compression etc must be configured in order to get the best possible security over the internet based private logical tunnel communication. This communication is created, maintained and terminated using a tunnel management protocol.

Data can be sent once the tunnel is in place and clients or server can use the same tunnel to send and receive data across the internetwork. The data transfer depends upon the tunneling protocols being used for the transfer. For example, whenever the client wants to send data or payload (the packets containing data) to the tunneling server, the tunnel server adds a header to each packet. This header packet contains the routing information which informs the packet about the destination across the internetwork communication. Once the payload is received at the destination, the header information is verified. After which destination tunnel server sends the packet to the destined node or client or server.

Point-to-Point Protocol (PPP)

It is very obvious that the PPTP and L2TP protocoasl arefully dependent upon PPP connection and it is very much important to understand and examine PPP a little more closely. Initially PPP was designed to work with only dial-up connections or dedicated connections. If the data transfer is happening over PPP connection, then the packets going over PPP are encapsulated within PPP frames and then send across or transmitted over to the destination dial-up or PPP server.

There are four distinct phases of negotiation in a PPP connection. Each of these four phases must complete successfully before the PPP connection is ready to transfer user data.

• Phase 1: PPP Link Establishment First step is where PPP uses the LCP or Link Control Protocol to connect to the destination network. Apart from establishing the connection, LCP is also responsible for maintaining and terminating the connection too. Take for example, during this phase 1, LCP connects to the destination and prepares the authentication protocol which will be used in phase 2. Next step would be to negotiate and find out if these two nodes in a PPP connection would agree on any compression or encryption algorithm. If the answer is yes then the same is be implemented in Phase 4.
• Phase 2: A User Authentication Second step is where the user credentials are sent to the remote destination for authentication. There are different secure authentication program. The secure method of authentication must be used to safeguard the user credentials. If you are using PAP (password Authentication Protocol) for authorizing user credential, the user information is passed in plain clear text which can be captured easily. This is the only time when the user must take utmost care in handling his/her credential from any theft. If for any reason these credentials were captured by the intruder, and then once the user connection is authenticate, the intruder will traps the communication, disconnect the original user and takes control of the connection.
• Phase 3: PPP Callback Control The Microsoft implementation of PPP includes an optional callback control phase. This phase uses the Callback Control Protocol (CBCP) immediately after the authentication phase. If configured for callback, both the remote client and NAS disconnect after authentication. The NAS then calls the remote client back at a specified phone number. This provides an additional level of security to dial-up connections. The NAS allows connections from remote clients physically residing at specific phone numbers only. Callback is only used for dial-up connections, not for VPN connections.
• Phase 4: Invoking Network Layer Protocol(s) Once the previous phases have been completed, PPP invokes the various network control protocols (NCPs) that were selected during the link establishment phase (Phase 1) to configure protocols used by the remote client. For example, during this phase, IPCP is used to assign a dynamic address to the PPP client. In the Microsoft implementation of PPP, the Compression Control Protocol (CCP) is used to negotiate both data compression (using MPPC) and data encryption (using MPPE).

Data-Transfer

Once the four phases of PPP negotiation have been completed, PPP begins to forward data to and from the two peers. Each transmitted data packet is wrapped in a PPP header that is removed by the receiving system. If data compression was selected in phase 1 and negotiated in phase 4, data is compressed before transmission. If data encryption is selected and negotiated, data is encrypted before transmission. If both encryption and compression are negotiated, the data is compressed first, and then encrypted.

Point-to-Point Tunneling Protocol (PPTP)

PPTP encapsulates PPP frames in IP datagram for transmission over an IP internetwork, such as the Internet. PPTP can be used for remote access and router-to-router VPN connections.

PPTP or Point-to-Point tunneling protocol works over TCP port which is also used for tunnel management and GRE or Generic Routing Encapsulation protocol to encapsulat any PPP frames which will later be used in sending data through the tunnel. Compression or encryption will depend on the tunnel configuration.

Layer Two Tunneling Protocol (L2TP)

L2TP was first proposed by Cisco Systems Inc which used a combination Layer 2 Forwarding (L2F) with PPTP. The IP frames can be encapsulated by L2TP to be sent over X.25, FR (Frame Relay), ATM (Asynchronous Transfer Mode) networks. And L2TP based IP tunnel over the internet is the safest way of data transfer today which uses the compression and/or encryption as required to protect the data from intruders.

The Top Ten Harmfull Viruses & Anti Viruses

Wednesday, May 26, 2010

In simple terms, a virus can aptly be called a virtual disease which affects a computer system and makes it sick, forcing to act in a manner undesired by the user. No good deed goes unpunished, and with the joys and leisure that were brought by the computer, along came the viruses to ruin all the fun. There are billions of viruses out there, big and small. But there were some that stood out and ruined things for us in a spectacular fashion. Below is a list of 10 of the deadliest virus which create havoc in the virtual as well as the real world.

I love you

The three words that can at most motivate you to cross the seven seas - or at least tempt you to open en email. This very temptation was the downfall of many computer users when this multipurpose- multi skilled virus hit the web. It had the ability to replicate itself via IRC chat and email, transfer and hide itself in different files and folders, and infect the registry keys once you opened an email in you inbox declaring “I Love You”. The virus thought to be originated somewhere in the Philippines, caused damage which was estimated to be around $8-10 billion.

Melissa

The creator of this virus received a 20 month jail sentence and a $5000 fine. Generated over a decade ago, this clever piece of virtual disease operated through Microsoft Outlook. This is how it worked: you receive an email titled “Here is the Document you asked for” from an unknown sender, you got infected as soon as you opened the email, and the virus would replicate and delivers itself to the top 50 people on your list without you getting a hint of it. Some major US government departments were hit and the damage is thought to be around $1 billion at least. A 20 month jail sentence well deserved.

MyDoom

MyDoom was instigated somewhere in mid 2004 and it actually prompted US senator to propose the creation of a “National Virus Response Centre”. The virus attacked in two phases; the first phase infected different Operating Systems, creating inroads and backdoors and making them vulnerable to external users. Once this problem was sorted out, the MyDoom struck again after few months, this time targeting the Search Engines like Google, slowing them down considerably, and crashing a few.

Nimda

Spell it backwards and you will understand its prime targets: yes, the ‘Admin’ and servers. It was basically a worm and has the record of being the fastest ever virus to spread; it took only 22 minutes to break into the list of top ten most deadly viruses of all times. It basically targeted internet servers and websites, creating a mass crater through which thousands of computers were affected at the same time. Once infected, the systems became exposed to open attacks by the outsiders.

Code Red

Damages of almost $200 million a day, and affecting the computers inside the White House are the degree of achievements of this virus. It subjugated the Windows by acting as a buffer overflow, sending humongous amount of information to the computer so that it spilt over, eventually forcing a shut down by overlapping the memory of the computers. The problem wasn’t solved until Microsoft issued a revival package to cater for this virus.

SQL Slammer/Saphire

Another swiftly spreading virus, it hit 75,000 computers in the first 10 minutes of its inception, taking down and severely damaging numerous American Banks, Security systems and organizations, and Airline networks. And the virus wasn’t just privy to the US; it ruthlessly damaged the internet capacity of South Korea for at least half a day. The damage was estimated around at least a billion dollars.

Storm Worm

One of the latest and most recent viruses to strike the internet, the Storm Worm employed a similar strategy to the one used by the Melissa; the mail’s title mentioned a current natural disaster like an earthquake (but most often a storm). Once the email was opened, the virus spread around like wild fire, affecting registries and documents across the hard disk. It turned out to be a mother-virus, instigating numerous hidden programs in the background which made the PC vulnerable and enticing to hackers.

Klez

With the mix characteristics of a virus, worm and a Trojan horse, Klez gave the antivirus programs a real headache by simply disabling them and making them look like a joke. However this is only the beginning of its trickery; after it was thought it be defeated, it was taken over, decoded and customized by black hat hackers (hackers who specialize in unauthorized penetration) . Its ability was enhanced by providing it with the capability to "spoof" from the user's address book and make it look like that an email came from them, increasing the chances of the receiver opening the email and becoming the next casualty.

Sasser

Damaging the computer through network ports, Sasser mostly targeted Windows 2000 and XP. It’s main casualties were the news agency Agence France-Presse (AFP) which had all its satellite communications jammed for hours , U.S. Airlines which had to reschedule its flights because of the worm had depleted their computers, a Finnish insurance company which was forced to close down 130 of its offices on emergency basis, Goldman Sachs, and Deutsche Post were all badly affected as well. However its unique feature was that it did not spread through emails, but rather observed computers and kept a look out for their vulnerabilities. On the basis of its knowledge, it would scan random IP addresses from the database and send itself to the next victim.

Autorun

This virus primarily targeted USBs and flash drives and established them as its major source of movement and propagation. It affected networks and all the computers present on them. Once affected, the folder options would be disabled, the task manager too would be unavailable and the virus itself would become the system administrator. The virus would replicate itself in all the folders, therefore eating up useful space on the hard disk and making it eventually extremely slow. The loss was in terms of useful data on millions of computers across the world.

What is Database

Friday, April 16, 2010

One of the technology terms that most people have become accustomed to hearing either at work or while surfing the internet is the database. The database used to be an extremely technical term, however with the rise of computer systems and information technology throughout our culture, the database has become a household term.

The definition of a database is a structured collection of records or data that is stored in a computer system. In order for a database to be truly functional, it must not only store large amounts of records well, but be accessed easily. In addition, new information and changes should also be fairly easy to input. In order to have a highly efficient database system, you need to incorporate a program that manages the queries and information stored on the system. This is usually referred to as DBMS or a Database Management System. Besides these features, all databases that are created should be built with high data integrity and the ability to recover data if hardware fails.

Types of Databases

There are several common types of databases; each type of database has its own data model (how the data is structured). They include; Flat Model, Hierarchical Model, Relational Model and Network Model.

The Flat Model Database

In a flat model database, there is a two dimensional (flat structure) array of data. For instance, there is one column of information and within this column it is assumed that each data item will be related to the other. For instance, a flat model database includes only zip codes. Within the database, there will only be one column and each new row within that one column will be a new zip code.

The Hierarchical Model Database

The hierarchical model database resembles a tree like structure, such as how Microsoft Windows organizes folders and files. In a hierarchical model database, each upward link is nested in order to keep data organized in a particular order on a same level list. For instance, a hierarchal database of sales, may list each days sales as a separate file. Within this nested file are all of the sales (same types of data) for the day.

The Network Model

In a network model, the defining feature is that a record is stored with a link to other records - in effect networked. These networks (or sometimes referred to as pointers) can be a variety of different types of information such as node numbers or even a disk address.

The Relational Model

The relational model is the most popular type of database and an extremely powerful tool, not only to store information, but to access it as well. Relational databases are organized as tables. The beauty of a table is that the information can be accessed or added without reorganizing the tables. A table can have many records and each record can have many fields.

Tables are sometimes called a relation. For instance, a company can have a database called customer orders, within this database will be several different tables or relations all relating to customer orders. Tables can include customer information (name, address, contact, info, customer number, etc) and other tables (relations) such as orders that the customer previously bought (this can include item number, item description, payment amount, payment method, etc). It should be noted that every record (group of fields) in a relational database has its own primary key. A primary key is a unique field that makes it easy to identify a record.

Relational databases use a program interface called SQL or Standard Query Language. SQL is currently used on practically all relational databases. Relational databases are extremely easy to customize to fit almost any kind of data storage. You can easily create relations for items that you sell, employees that work for your company, etc.

Accessing Information Using a Database

While storing data is a great feature of databases, for many database users the most important feature is quick and simple retrieval of information. In a relational database, it is extremely easy to pull up information regarding an employee, but relational databases also add the power of running queries. Queries are requests to pull specific types of information and either show them in their natural state or create a report using the data. For instance, if you had a database of employees and it included tables such as salary and job description, you can easily run a query of which jobs pay over a certain amount. No matter what kind of information you store on your database, queries can be created using SQL to help answer important questions.

Storing a Database

Databases can be very small (less than 1 MB) or extremely large and complicated (terabytes as in many government databases), however all databases are usually stored and located on hard disk or other types of storage devices and are accessed via computer. Large databases may require separate servers and locations, however many small databases can fit easily as files located on your computer's hard drive.

Securing a Database

Obviously, many databases store confidential and important information that should not be easily accessed by just anyone. Many databases require passwords and other security features in order to access the information. While some databases can be accessed via the internet through a network, other databases are closed systems and can only be accessed on site.