What is RAID ?

RAID Explanation

 

 RAID is a way to get protected from hard­disk failures.
 An example of RAID ?
Let'simagine the three directors of Coca­Cola company.
 If one of them knows the entire production secrets, he might build his own company. If each of them knows only the third of the secret, as soon as one dies, the product is lost.

So, let's divide the product secret in three: part A, B and C. Director 1 knows secret A, director 2 knows secret B and director 3 knows secret C. 

For redundancy reasons, let's learn to director 1 the secret B too, to director 2 the secret C and to director 3 the secret A.
In this case, none of them knows the entire production method, but any of them might die, the remaining knows what to learn to the newly hired director. 

The only thing we know about hard­disks is: they will die.
But no one's know when.
 If you want your data to survive your hard disk, use RAID (as Linux provides you for free). You will have the opportunity to replace your crashed hard­disk and see the system rebuild the missing data without even stopping you to work !

Cracking the Windows 95 Screen Saver Password

Defeating the Windows 95 Screensaver

While many may consider this a trivial exercise, cracking

the password scheme for Win95 may be useful to some of 

you out there.  Some may even find ways to have phun with

it as well.

To start with, you need to know where to look.  In 3.1, the password was kept in 

the control.ini.  Although 95 also uses the control.ini, it does not use it for

keeping the password information.  Foe 95, you will have to look in each of

the user.dat files.  I say each because if you have multiple users, each user

may have a profile saved on the hard drive.  The default user.dat file is

in the \windows directory.  The other user.dat files can be found in the directory

\profiles\username where username changes.  As you may know, user.dat is one of the two

files used for the registry and its is very important.  User.dat will carry the attributes

"shr" so you will have to look accordingly.  Also, since it is so important, a backup is 

kept, namely user.da0.  This may be the previous user.dat, say when the user changed 

passwords...

Anyway, now that you have the file, where is it?  If you scan the file for passowrd, you

will come up with the setting of whether or not the screen saver is password protected. 

This may be enough for you so you can just change it and be done.  While this little change

will be noticed, it will get you by the password.  If, however, you wish to actually find out

the what the pass phrase is, read on.

Why find out what the pass phrase is, you ask?  Because a lot of times users are stupid, 

lazy, have bad memory or any combination of these and reuse passwords or schemes any time a

key is needed.  This is especially true in network environments and even more so when 95 

is used as the workstation OS.  In such systems, there is the possibility of changing the 

logon password and the screen saver password at the same time.  I wonder how that can be

useful?

Back to finding out what the phrase is.  95 has been rumored to use dual case.  Let me 

clear this rumor.  It does not.  It uses the "all upper" coding for the password like 3.1.  

The maximum length of the screen saver password is 14 characters long.  It will allow

you to enter longer passwords, but 95 will act screwy; it won't require the password from

screen saver, it will hang, etc.

OK, so we have the file.  Look for the string "ScreenSaver_Data".  After this is an even

string of numbres and letters ending in 00.  THere is the encrypted pass phrase.  The 

pass phrase is different from 3.1 in that 95 uses what I call "encrypted-couplets" meaning

that for every character in the phrase, there are two encryption values.

The first encrypted couplet (EC) is the first hex digit of the unencrypted ascii value, and the second

EC is the second hex digit.  For example, say the first two hex digits after the string

"ScreenSaver_Data" are 31 41 (1A in ASCII). The 31 represents (after decryption) 5 and 

the 41, 2.  Put the digits together and you have 52h, R in ASCII.  Keep this concept in

mind while decoding the EC's because the decryption scheme is the same for each value, only

the key changes.

Example of Screen Saver EC's decoded to password.

1AAAA26473D28  <- code in the user.dat

RDPZZA <- Win95 SS password

Good Safety Advice

 Good Safety Advice

There are a number of simple things that you can do in order to minimize your risk to Malware.

• Only download from reputable sources ( that means no W4R3Z, please. )

• Don't open e-mail attachments from people you don't know.

• Don't leave macros enabled by default in your applications.

• Keep your OS and applications up to date with patches.

• If downloading and installing software with a checksum – check the checksum.

Building Secure Web Applications

Guidelines for Building Secure Web Applications

While there are many opinions and most of the details to building with security in mind come
from the logic of the programmer and their skill with the programming language, these basic
guidelines   are   also   derived   from   materials   available   from   the  OSSTMM
(http://www.osstmm.org).

1. Assure security does not require user decisions.

2. Assure business justifications for all inputs and outputs in the application.

3. Quarantine and validate all inputs including app content.

4. Limit trusts (to systems and users).

5. Encrypt data.

6. Hash the components.

7. Assure all interactions occur on the server side.

8. Layer the security.

9. Invisible is best- show only the service itself.

10. Trigger it to alarm.

11. Security awareness is required for users and helpdesks.

Protection from Password Cracking

Protection from Password Cracking

Here are some suggestions on how to keep your passwords from being cracked:

1. Use strong passwords that cannot be determined by a dictionary attack.

2. Don't post your passwords near your computer.

3.Limit wrong attempts to three tries, then lock the account. The password must then be reset.
(This does not apply to documents or password protected zip files – they do not have lock out
options.)

4.Change passwords regularly.

5. Use a variety of passwords for different computers. Does this mean that you need to create
a unique password for everything? Absolutely not. Maintain a master password for things that
don't matter to you (perhaps the account you were required to create for TheSIMS.com or for
your account on the  local  newspaper).  But  use good passwords  for  anything that  actually
needs to be secure.

Password Recovery

Password Recovery

Password  cracking  for   illegal   purposes   is   illegal.   But   if   it   is   your   password,   then   it's your information. Once you password protect something, and then forget your password, you are
stuck. Hence password recovery.

Password cracking consists of a few basic techniques
“Looking around”: passwords are often taped to the bottom of keyboards, under mousepads,
posted on personal bulletin boards.

Brute force: just keep trying passwords until one works

Automated dictionary attacks:   these programs   run  through a  series  of  possible dictionary
words until one works as a password.

There   are  many   programs   available   on   the  web   to   assist  with   password   recovery   on
documents. However, newer versions of programs are becoming more and more secure, and
therefore, more and more difficult to obtain passwords using the techniques above, or using
password recovery software.

Password Encryption

Password Encryption

People don't usually discuss password encryption, because there seems to be no options to
discuss – passwords are, by definition, encrypted. While this is usually true, encryption is not a
simple yes or no proposition.
The effectiveness of encryption, usually described as its strength, ranges from very weak to extremely robust.

At   its  weakest,  we   have   passwords   that   have   been   simply  encoded.  This   produces   a
password that is not readable directly, but, given the key, we could easily translate it  using a
computer, pen and paper, or a plastic decoder ring from a cereal box. An example of this is
the ROT13 cypher. ROT13 replaces every letter in a text with the letter that is 13 places away
from it in the alphabet. For example 'ABC' becomes 'NOP'.

Even when using algorithms that can more accurately be called encryption, the encryption is
weak, if the key used to generate it is weak. Using ROT13 as an example, if you consider the 13
place differential   to be  the key,   then ROT13 has  an extremely weak key.

 ROT13 can bestrengthened by using a different key. You could use ROT10, replacing each letter with the one  ten places   forward,  or  you could use ROT-2,   replacing each  letter  with  the one  two places before it. You could strengthen it even more, by varying the differential, such as ROTpi,
where the first letter is shifted 3 places;
 the second, 1 place; the third, 4 places; the fourth, 1 place; and so on, using pi (3.14159265...) to provide a constantly varying differential.

Because of these possible variations, when you are encrypting any type of information, you
must  be sure  that  you are using a  reliable method of  encryption and  that   the key your contribution to the encryption – will provide you with a robust result.
You must also remember that a good system of encryption is useless without good passwords,
just as good passwords are useless without good encryption