Jalaj P. Jha » Security

Locked Systems are meant to be locked, not rebooted…

Jalaj — Sat, 14 Feb 2009 08:31:23 +0000

If you are working in a office where security is taken seriously, this screenshot should not be new to you. If you are leaving your system, just press ‘ctrl+alt+delete’ and ‘enter’ and your system will get locked to open again only if you put in your password.

Once I was busy with my project nearly finished with the testing phase. Just when I was expecting a call mentioning testing is over, I got to hear something totally different. I was told that testing team is receiving error.

Everything had gone smoothly so far, how could it be possible that it is erring at the last stage. Puzzled I moved to the area where systems that were part of testing environment were located, and found that a guy unable to find hostname of one of the three machines in testing environment, due to machine being locked and showing above message, had forced the machine to shut down. Doing so enabled him to start the system again and get the hostname using his own login password.

I told him not to do such things without informing others in the team, as some time critical tasks may get delayed. Then I got him to log off and sat down to restart all the services that were required for testing to start again, only to find that something had broken down. Next 30-40 minutes I sat there trying to get system up again with anxiety building up as time passed. At last things settled down to normal.

Hope you are not someone bearing resemblance to that guy, who despite knowing the name of the person who locked the system (gets mentioned in the message “only or an administrator can…”) and asking him to unlock, chose other way… Remember “Locked Systems are meant to be Locked” don’t force it to open unless you have the key.

How to Create Private Yahoo Pipes?

Jalaj — Tue, 10 Feb 2009 01:15:48 +0000

Officially there are no Private Yahoo Pipes! All Pipes that you create can be seen and cloned by any other Yahoo Pipes user, if they know about it, that is they know its address or the pipe id associated with each pipe. So if you want to keep a Pipes created at Yahoo Pipes private you can do that by :

Not Publishing the Pipe
You can always use your pipe even if it is not published. Publishing a pipe just means that your pipe becomes the part of the pipes directory which all users can access. If a pipe is published there is every chance that it is discovered by others by search string, modules used in it etc. Using your pipe without publishing keeps you safe on this front.
Embedding RSS feeds online taking care that the Pipes ID is not revealed
If you are embedding RSS feeds created by you Yahoo Pipes, make sure that the pipe id is not revealed as a link or in the source code of the page. For example if you embed RSS feed in RSS module available in Blogger your pipe id doesn’t show up anywhere but on a wordpress.com blog an RSS link reveals the pipe url (and thus id) by which anybody can clone the pipe. Take care when you do that and check source code of generated page too.
Not embedding or linking or using the pipe on other unsecured pipes.
Pipes can be embedded in other pipes or RSS feeds from pipes retrieved in other pipes. Don’t do with the pipe that you want to keep secure. If the pipes that linked to it or embedded it goes into others’ hands your private pipe is exposed. So if a pipe uses your private pipe, it to needs to be kept with same security as with this one.
Not sharing it with anybody else.
Your pipes is just for you. If you want to keep the source code of pipe private but want to share its functionality with others, you have no chance. As soon as you share your pipe with someone you have exposed the source.

Thanks for patiently reading to this point. Now we start with the unofficial way to create a Private Yahoo Pipe. Yes there is a way!

All we need to do is to create one extra pipe for each pipe that you need to publish or share or embed. We would henceforth call this extra pipe as PipeShield. The PipeShield itself can be published or shared or embedded.

Let’s say I want to secure my Google Trends Scraper pipe, which takes one user input and generates output based on it.

We will create a new yahoo pipe, but before that run the above yahoo pipe and get the RSS output url as given in the link ‘Get as RSS’

Create a new Yahoo Pipe and insert a ‘URL Builder’ module. Paste the url that you got from the previous step into the textbox provided alongside label ‘Base:’. As soon as you press ‘Tab’ button all query parameters present in the url will switch their position.

Insert a ‘Fetch Feed’ module and make it to take url from the url builder module and link to output module.

Now since the pipe that we are shielding here took a user input ‘Date’ so we will need to do same here to. So, add a ‘Text Input’ field and wire it to date field in ‘URL Builder’

Now we have a functional pipe that forms a wrapper around original pipe, but the original pipe is still not secure as its pipe id is visible, in the parameter ‘_id’ of the URL Builder. Here is the final step.

Add a ‘Private Text Input’ module, fill its default value from the value in _id field, check the ‘Private’ checkbox, clear the _id field and make it to take value from Private Text Input module.

Save the pipe and distribute it to all you know and those you don’t without fear of exposing the original pipe and the functions/secrets it carried. This pipeshield will show the value in the ‘Private Text Input’ only to you. Everyone else will see the field blank. Others will not be able to run the pipeshield in Edit mode and thus cannot debug the pipe id, they cannot clone the pipeshield otherwise its link with the underlying pipe will break and the pipeshield will become non-functional. Others can just run the pipe and get the results! Once you have distributed your pipeshield you can rest assured that your original pipe is always.

You can check this pipe in edit mode here. Watch my page on Yahoo Pipes for more pipes. All posts on Yahoo Pipes on this blog will share this archive url

Email Forward related to Osama Bin Laden Virus

Jalaj — Wed, 20 Feb 2008 13:29:13 +0000

When will people learn to be careful?

Not long ago I had posted "Email forwarding - All Fun and No Responsibility ?" which carried several examples where people received forwarded mails, which they in their turn forwarded again, not caring to probe if the information contained is true or not.

Today I received yet another mail which began with an extra large heading (all in CAPS) "Please read below and pass on as soon as possible." Don't ever do that... take time... verify the information... and then if you feel like forwarding, pass it on.

Below it was a letter with a logo and address of Australian Federal Police advising not to open attachment contained in certain email moving around the net bearing picture of Osama Bin Laden being hanged. It later says that if the attachment is opened the system will crash and cannot be fixed. All this was followed by a request to forward this mail to everyone you know "as soon as possible". The shocking thing here was that all the content mentioned here was not in text form but in the form of a single image (this prevents the mail from being filtered by mail servers as spam are identified by checking the text content and cannot read text from images).

Now what you could have done to identify if the mail is real or spam. Check for "Australian Federal Police" on Google and you would know that www.afp.gov.au is their official site. Now fire query "site:www.afp.gov.au osama virus", idea behind this is that if "Australian Federal Police" actually sent the mail with "forward asap" priority then the same should also be available on their site. Doing so you will get to know that no such thing was published. A page (https://www.afp.gov.au/about/publications/platypus_magazine/december_1999/terror.html), however published in 1999 contained words 'Osama' and 'Virus', but that was not the content we are searching for.

Now you can fire a generic query for "Osama Virus" and you will get to know from various pages that the mail in circulation is just a Hoax and even the authority varied in some mail (Israeli Police instead of Australian Federal Police)...

Now if yuou knew all these things will you forward the mail?

Tweaking Registry for Windows Media Center

Jalaj — Tue, 04 Dec 2007 12:38:09 +0000

Windows Media Center is an application aimed at the Home segment and catering various entertainment facilities as Television, Radio, Streaming Video and so on. It made its first appearance with Windows XP Media Center Edition. Business houses are unlikely to purchase this edition as it's name only suggests that it is unsuitable for business purposes. But what about "Windows Vista Ultimate", it too includes Windows Media Center though this is not apparent from its name.

You got it and now want to disable it? Then move ahead as you can do that with a simple registry tweak.

Open Regedit and browse through to the key as below (or create if doesnot exist)

HKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsMediaCenter

Create a DWORD valuename MediaCenter and set its value to 1 (numeral one). This will not allow Windows Media Center to run for the current user. To regain the original settings either set it to 0 (numeral zero) or delete it.

If you want to implement this setting across all users accessing the particular system then use the key as below instead of the one mentioned above.

HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsMediaCenter

statutory warning : Tweaking registry in irresposible Manner can damage your system settings and can stop your operating system to function properly or stop the functioning. Perform tweaking only if you are sure of what you are doing

Related Links :

Tweaking Registry Series

Tweaking Registry for Task Bar in Vista

Jalaj — Wed, 28 Nov 2007 12:39:12 +0000

This post comes a long time after earlier post Tweaking Registry for Start Menu - XP & Vista in "Tweaking Registry" series.

You can modify the task bar in Windows Vista by applying certain Registry tweaks that we will discuss here.

Open Regedit and browse through to the key as below (or create if doesnot exist)

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer

Creating a DWORD valuename (names as below) and setting its value to 1 (numeral one) will have effect as mentioned corresponding to it. To regain the original settings either set them to 0 (numeral zero) or delete them.

ValueName	Description
HideSCABattery	Remove the battery meter icon that is displayed in the system notification area (previously called the "system tray").
HideSCANetwork	Remove the networking icon from the system notification area
HideSCAVolume	Remove the volume control icon from the system notification area
TaskbarLockAll	Prevents the user from making any changes to the taskbar settings through the Taskbar Properties dialog. If you enable this setting the user cannot access the taskbar control panel, unlock, resize, move or rearrange items on their taskbar.
TaskbarNoAddRemoveToolbar	Prevents users from adding or removing toolbars. If you enable this policy setting the user will not be allowed to add or remove any toolbars to the taskbar. Applications will not be able to add toolbars either.
TaskbarNoDragToolbar	Prevents users from rearranging toolbars. If you enable this setting the user will not be able to drag or drop toolbars to the taskbar.
TaskbarNoNotification	RTurn off all balloon notifications
TaskbarNoRedock	Prevent users from moving taskbar to another screen dock location
TaskbarNoResize	Prevent users from resizing the taskbar
TaskbarNoThumbnail	If you enable this setting the taskbar thumbnails will not be shown, and the system will use standard text for the tooltips.

Related Links :

Tweaking Registry Series

The Blog Revisited – 9

Jalaj — Fri, 23 Nov 2007 11:49:05 +0000

This is the last part on "The Blog Revisited" before going ahead with regular posting. All posts that appeared June onwards (number was comparatively low) are covered here.

Google Webmaster Tools - A Tutorial describes all features of Google Webmasters tools.

WinAPI saw last two posts (I just can't leave this subject... it always bounces back) WinAPI : More on Font Object & Which Hindi / Devnagari Unicode font is installed on the system?. The latter one describes application that enumerates all installed fonts to see if a particular script (here Devnagari/Hindi) is supported or not.

What if you published a post and then found that the url that wordpress generated is not appropriate. You can just change it follwing this article Wordpress : Change Post URL after it’s Published

Pass Google Verification to use Analytics for your Wordpress.com Blog was an experiment that though I succeeded in a little but all my expectations did not fulfill.

This blog is hosted at wordpress.com with two premium upgrades Custom CSS & Domain Mapping. Both of these functionalities can be obtained free at blogger.com. See a comparison between the two at Wordpress.com Vs Blogger.com

Browser market has never been stable. First it was in Netscape's hand which it later lost to Internet Explorer and now Firefox is fast emerging with Safari making debut in PC browser market. So if you are developing with a single browser in mind your page may fail to display properly in others. Read a bit on how to check cross browser compatibility of your design at CSS Design - Cross browser compatibility

Internet is full of information both valuable and junk. While you need to visit a site to see valuable information junk information find many readers though mail forwarding. Read Email forwarding - All Fun and No Responsibility ?

Tweaking registry series saw a lot of new posts as listed below.

I am unaware of why people shy away from adopting Microsoft standards (sometimes Microsoft too is guilty). Conditional Comments in Internet Explorer is a feature that all browsers can adapt but unfortunately it never went ahead of Internet Explorer (just like MARQUEE tag).

Wordpress.com saw a few enhansements. Read about them through below links

There were two posts on Indian languages. Bhomiyo.Com - Indic Transliteration on the Fly describes a service that transliterates between various Indian Scripts on the fly. Google came out with the standalone Hindi transliteration web application. This facility was earlier available with only Blogger.com. Read about it at Google Hindi Transliteration spreads out

The Blog Revisited – 8

Jalaj — Wed, 21 Nov 2007 13:23:37 +0000

Three of the posts in May were related to MS Project, discussing scheduling of tasks and setting deadlines and constraints.

With my previous insight on how Technorati fails to detect pages from same blog, I got prepared to go deeper into it's perceived algorithm and just then Technorati saw some changes (not the expected ones) and I dropped my plans to go ahead. There is Something about Technorati and Technorati Rank is Dead (It rose again from undead...) were two posts on Technorati.

May saw a very good event for me, getting verified by Google for Webmaster Tools, which I later found it to be undocumented on web and thus came up the post Get your Wordpress.com Blog Google Verified which saw a large number of views, and is still referred.

It was then that I decided to get my own domain. The decision was sudden as is documented at Wordpress.com Domain Upgrade... though later I felt regretting the decision as the Toolbar update get unexpectedly delayed which also disturbed the traffic to the blog and later in posting frequency.

Below are some more posts on Google reviewing it's new features.

May also saw last posts on WinAPI (though I have not given up yet)

Social Engineering was a post that details how anyone can get cheated by someone, who not even need to be a pro hacker.

Many of you might have frequently received powerpoint PPS files in mails as attachement. Many a times you might have felt prompted to edit a file to your own convenience but alas... PPS files are not editable... Don't worry see how you can easily Convert PPS to PPT