Nokia shows off Aeon 'wearable' concept phone

Nokia has unveiled its latest concept phone, designed to highlight the company's focus on products that allow users to more readily stamp their personality on their gadgets.

The concept phone, dubbed Aeon, combines two touch-sensitive panels mounted on a fuel-cell power pack. The handset's connectivity and electronics are built into the panels to allow them to be used independendently. When assembled, one panel would operate as the display, the other as the keypad. Since the buttons are entirely virtual, Aeon can flip instantly between a numeric pad for dialling, a text-entry pad for messaging, or a media-player controller.

It's a cute idea and one that ties in with Nokia's expectation that phones will become essentially "wearable" devices - if foresees users removing one of Aeon's display panels and mounting it on a watch-like strap or worn as a badge.

More than a phone, Aeon might tap into local wireless networks to transmit data acquired from sensors such as devices that monitor the user's health signs - which is the kind of application the company has in mind for its Wibree personal-area network technology.

Summary of WiFi hacking tools

Air Crack
Aircrack is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, thus making the attack much faster compared to other WEP cracking tools. In fact, aircrack is a set of tools for auditing wireless networks.

Air Decap
decrypts WEP/WPA capture files. Part of the aircrack suite.

Air Replay
802.11 packet injection program. Part of the aircrack suite.

Airpwn
Airpwn requires two 802.11 interfaces in the case where driver can't inject in monitor mode (lots of chipsets do nowadays, see HCL:Wireless for a list). It uses a config file with multiple config sections to respond to specific data packets with arbitrary content. For example, in the HTML goatse example, we look for any TCP data packets starting with "GET" or "POST" and respond with a valid server response including a reference to the canonical goatse image.

AirSnarf
Airsnarf is a simple rogue wireless access point setup utility designed to demonstrate how a rogue AP can steal usernames and passwords from public wireless hotspots. Airsnarf was developed and released to demonstrate an inherent vulnerability of public 802.11b hotspots snarfing usernames and passwords by confusing users with DNS and HTTP redirects from a competing AP

Airsnort
AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

CowPatty
Cowpatty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol. A while back, Robert Moskowitz published a paper titled "Weakness in Passphrase Choice in WPA Interface" that described a dictionary attack against wireless networks using the TKIP protocol with a pre-shared key (PSK). Supply a libpcap file that includes the TKIP four-way handshake, a dictionary file of passphrases to guess with and the SSID for the network

FakeAP
Black Alchemy's Fake AP generates thousands of counterfeit 802.11b access points. Hide in plain sight amongst Fake AP's cacophony of beacon frames. As part of a honeypot or as an instrument of your site security plan, Fake AP confuses Wardrivers, NetStumblers, Script Kiddies, and other undesirables

Genpmk
genpmk is used to precompute the hash files in a similar way to Rainbow tables is used to pre-hash passwords in Windows LANMan attacks. There is a slight difference however in WPA in that the SSID of the network is used as well as the WPA-PSK to "salt" the hash. This means that we need a different set of hashes for each and every unique SSID i.e. a set for "linksys" a set for "tsunami" etc

Hotspotter
Hotspotter passively monitors the network for probe request frames to identify the preferred networks of Windows XP clients, and will compare it to a supplied list of common hotspot network names. If the probed network name matches a common hotspot name, Hotspotter will act as an access point to allow the client to authenticate and associate. Once associated, Hotspotter can be configured to run a command, possibly a script to kick off a DHCP daemon and other scanning against the new victim

Karma
KARMA is a set of tools for assessing the security of wireless clients at multiple layers. Wireless sniffing tools discover clients and their preferred/trusted networks by passively listening for 802.11 Probe Request frames. From there, individual clients can be targetted by creating a Rogue AP for one of their probed networks (which they may join automatically) or using a custom driver that responds to services can then capture credentials or exploit client-side vulnerabilities on the host.

Kismet
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic. Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.

Wep_crack
WepAttack is a WLAN open source Linux tool for breaking 802.11 WEP keys. This tool is based on an active dictionary attack that tests millions of words to find the right key. Only one packet is required to start an attack.

Wep_decrypt
a program for decrypting captured 802.11 traffic that is protect with WEP traffic. It reads in a pcap capture file, such as that generated by prismdump, and outputs another pcap capture file with decrypted packets. By default it will read from stdin and ouput to stdout. The key to decrypt with can be specified as a string of hex characters, optionally seperated by spaces or colons, or as a text string. If a text string is specified, the actual keying material will be generated by the string in the (ad hoc) standard fashion used by many drivers.

WifiTap
Wifitap is a proof of concept for communication over WLAN networks using traffic injection. Wifitap allows direct communication with an associated station to a given access point directly, whilst not being associated ourselves or being handled by access point.

The Hidden Downside of Wireless Networking

Wi-Fi can cause big trouble--and you may not even know it. Here's how to keep the hackers at bay.

Going wireless offers a panoply of attractive benefits to school districts. Because you don't have to run cables to every classroom, it's cheaper to deploy a wireless network than an old-fashioned wired network. Wireless makes it more convenient for administrators, teachers and students to connect.

But there's a perilous downside: A wireless network is easier for hackers to break into. Without the proper security measures, going wireless means opening a gaping hole in your computer systems' defenses.

Worse, you may already have a wireless security problem-even if your technology staff hasn't deployed a single wireless access point. At many school districts, parents and teachers have installed unofficial Wi-Fi hotspots that connect to the school's existing wired network. (Wi-Fi, short for "wireless fidelity," is the trade name for a family of wireless networking standards.) In so doing, they may have inadvertently compromised the school's network, and your district's IT staff may be none the wiser.

Rogue Hotspots
Charlie Garten, the former chief information officer for the Poway Unified School District in southern California, says his district's struggles with Wi-Fi security began as early as 2002. "We weren't surprised that there were ways to jump over our firewall using wireless," says Garten, who retired in 2005. "We were caught a little bit by surprise by the number of rogue access points that had been plugged in." In some cases, his staff would receive complaints about network slowdowns at a school; on investigating, they would find as many as 10 Wi-Fi hotspots that had been installed without the IT department's knowledge. "Well-meaning people wanted to get more access for the kids, but they didn't understand all the consequences of just throwing in a bunch of wireless access points," adds Garten.

In the Palo Alto (Calif.) Unified School District, the security holes introduced by rogue hotspots had a much more public and embarrassing effect. Located in the heart of tech-savvy Silicon Valley, Palo Alto's parent community includes many people who work for companies that supply Wi-Fi equipment. As a result, these parents brought wireless networking into their children's schools at a very early stage.

"We had open networks. When they were first installed, folks could sit in the parking lot if they wanted to get some access," says Marie Scigliano, the director of technology for the district. Scigliano's staff was aware of the security problem but hadn't been able to address it completely when, in the summer of 2003, a local reporter found that she could access the district office's network through an unsecured Wi-Fi connection. Worse, the reporter was able to log on to the student information system and download students' grades, phone numbers, home addresses, medical information, psychological evaluations and even full-color photos.

The district quickly took the network offline and began correcting the problem, according to Scigliano. "We came back up with secure networks, logons, authentication and so forth," she says. However, the story received wide national coverage-thanks in part to the severity of the breach-causing a significant public relations problem for the school.

While the reporter didn't publish or alter student records, press reports noted that it would have been easy for her to do so, if she had been a more malicious hacker. That in turn would have exposed the district to serious liability problems and could possibly have put its students in danger.

Steps for Safer Wi-Fi Wireless doesn't have to be a security nightmare. Here are some tips from Brian Hernacki, an architect with Symantec Research Labs, on how you can keep your Wi-Fi network safe and sound: Turn on encryption Set your network to use Wired Equivalent Privacy or even stronger Wi-Fi Protected Access encryption, which encodes every transmission on the network, making it harder for hackers to "sniff" the data as it goes by. Neither form of encryption will keep hackers out entirely, but they set the bar a lot higher. If you use WEP, make sure you use a 128-bit key, which requires a 26-character pass phrase. WPA is harder to crack and uses easier-to-remember passwords for access, so it's a better choice if your equipment supports it. Limit access Wi-Fi networks can be configured to accept connections only from certain computers, using those computers' Media Access Control addresses, a unique number that's attached to the network adapter in every piece of networked equipment. MAC addresses are difficult to spoof, so limiting access to certain MAC addresses helps you ensure that you control who's on your network.

On the down side, you need to maintain an up-to-date list of permitted machines. Require usernames and passwords Configure your network so that users can gain access only with the proper username and password. If you issue unique usernames to each student, teacher and administrator, you'll be able to track any misuse of the system. Because people may share passwords with each other, be sure to change these every month or every quarter. Keep the network inside By carefully locating Wi-Fi routers and using directional antennas (which focus the signal in a particular direction), you may be able to limit the accessibility of your network outside school grounds. This will make it harder for hackers to do their dirty work unobserved. Turn it off at night Turning off the Wi-Fi network after-hours means that hackers will need to make their intrusion attempts during the day, when they're more likely to be noticed by staff or students. Educate your staff Make sure teachers and administrators are aware of the security risks of using Wi-Fi. For the maximum security, permit access to student information systems (such as grades databases) via wired networks only, and ensure that computers connecting to these systems do not also have Wi-Fi capability.

Read more »

Benchmarking the MacBook Pro

Like us, you may be considering the purchase of an Apple MacBook Pro as a way to bring deadline-friendly processing speed to a Mac-based field workflow. For several years, certain models of Apple's Powerbook line have represented a superb blend of features, screen quality and portability; in fact, the overall design of the company's mobile machines has far eclipsed computers we've used from mainstream PC vendors in all key areas, except one: speed. A PowerPC G4-equipped Mac laptop simply can't keep up to a Windows laptop powered by an Intel or AMD processor.

For intensive tasks such as RAW conversion, applying beefy filters like Smart Sharpen in Photoshop CS2 and previewing folders overflowing with 8+ megapixel photos, a Powerbook doesn't keep pace. For example, processing a 16-bit EOS-1Ds Mark II file with Noise Ninja takes about 44 seconds on a Powerbook with a 1.67GHz G4 processor. The same operation on the same file zips by in under 15 seconds on a Toshiba A70/A75 armed with a 3.33GHz Pentium 4. It's this sort of real-world performance difference that has resulted in site co-editor Mike Sturk relying almost entirely upon a Pentium 4-equipped Dell laptop for on-site work, despite the fact he is at heart a Mac guy.

As we noted in an article introducing the MacBook Pro last month, we hope that the switch to Intel processors by Apple will close the speed gap between Mac laptops and laptops from everyone else. But it's really too soon to address whether an Intel-equipped Mac will perform comparably to an Intel (or AMD)-equipped PC, since so few Mac pro imaging applications have yet been turned into versions optimized for the Intel architecture of the latest Macs. For months to come, the majority of Mac applications we rely on to get photo work done will be PowerPC versions, and will operate on an Intel Mac only through the assistance of the Rosetta emulation technology built into the Mac OS.

MacBook Pro 

It's also really too soon to benchmark a MacBook Pro specifically, since they aren't yet shipping and we don't have one. What we do have on hand is a close cousin to the MacBook Pro: an early 2006 iMac with a 2GHz Intel Core Duo processor. As fans of Stephen Colbert's Colbert Report, we applied his standard of truthiness in coming up with the headline for this article. We really wanted to benchmark a MacBook Pro, but couldn't, so we got hold of an iMac instead and having been calling it a MacBook Pro.

There's a method to our madness: prior to Apple's new laptop hitting the streets, we wanted to get a sense of whether - when running Universal Binary versions of an application - the MacBook Pro is going to deliver anything close to the promised 4.5x+ speed increase (using benchmarking software) relative to a Powerbook G4. And whether PowerPC applications pumped through the seamless but speed-robbing Rosetta will perform at least as well as they would on a Powerbook G4. The Intel Core Duo version of the iMac makes for good stand-in, since it contains similar components, including the all-important Intel Core Duo processor and X1600-series graphics card from ATI. So, without further ado, here's what we tested, and the results:

The Hardware

• 15-inch Powerbook G4/1.67GHz with 2GB RAM, ATI Mobility Radeon 9700 graphics with 64MB memory, 1280x854 pixel display, 80GB/5400 RPM hard drive and OS X 10.4.4. This a mid-2005 model.
  
• 20-inch iMac with Intel Core Duo 2GHz, 2GB RAM, ATI Radeon X1600 graphics with 128MB memory, 1680x1050 pixel display, 250GB/7200 RPM hard drive and OS X 10.4.4. This is an early 2006 model.

As of this writing, the MacBook Pro's Intel Core Duo processor tops out at 1.83GHz, so our 2GHz iMac will almost certainly be a few percentage points faster than a MacBook Pro in tests that exercise the CPU. The hard drive in the MacBook Pro, however, is not at all the same as that found in the iMac. To neutralize that as a performance variable, we used an external 100GB/5400 RPM laptop drive in a FireWire 400 enclosure as the file source or destination, as well as constructed the tests so that there was a minimum of big-file reading and writing. All of that said, we spot-checked several of the tests using the iMac's internal drive as the file destination and saw almost no difference in the results.

Observations


In Universal Binary applications, functions that are written for multiple processors show the biggest speed gains. For example, Photo Mechanic's Preview mode utilizes both cores in the Intel Core Duo, which leads to a speed increase approaching 3X, relative to the Powerbook G4 tested. Previewing high-resolution pictures in Photo Mechanic 4.4.1 on the Intel iMac is really zippy. In fact, it feels faster than the 3X bump suggests. Exporting a newly-created JPEG from Photo Mechanic utilizes only one of the Intel processor's cores, and yet we still measured about a 2X speed increase over the G4. It looks like each half of the Core Duo is considerably more powerful than a G4, at least for the sorts of functions that are at the heart of what a program like Photo Mechanic does. We didn't encounter - in Photo Mechanic or elsewhere - a 4.5x speed increase, but then it wasn't all that likely that real world measurements would match Apple's synthetic SPEC benchmarks. Encouragingly, however, the Photo Mechanic results do fall within the 1.7x to 4.1x speed bump range Apple touts in their own application performance testing.

If Apple wants to show the Intel Core Duo processor in its best light right now, and the audience is pro shooters, they might want to load a few copies of Photo Mechanic on their demo MacBook Pros. The Intel-native iPhoto 6 feels faster on the iMac than on the Powerbook G4 in basic tasks like scrolling, switching views and navigating around the program's interface. But as the test results show, the performance jump in most instances is significant but not outstanding. The experience of using Photo Mechanic, by comparison, is really transformed by the Intel Core Duo. The more modest iPhoto gains overall may be explained in part by the fact that some of the tests performed are more dependent on the graphics card than on the CPU to get the processing job done.

In PowerPC applications, functions that thread through both cores in the iMac's Intel Core Duo processor are completed about as fast, or in some cases faster, than by the Powerbook G4. That's an impressive feat, given how much translation Rosetta must have to do to make PowerPC code palatable to an Intel processor. For an Intel-based Mac to fly, it must be running Intel native code. But until then, Rosetta emulation on average allows the performance of a single PowerPC G4 processor. And for certain tasks, such as reducing noise with the multi-processor savvy Noise Ninja, Intel Core Duo processing times are quite a bit shorter than those of the G4.

As we've seen in iMac benchmarking elsewhere, something's up with QuickTime export on Intel Core Duo Macs. Over 15 minutes to export the test slideshow as an MPEG-4, 30 fps movie on the Powerbook is already pretty pokey, but over 25 minutes on the Intel iMac for the same export suggests a performance-hobbling bug is lurking in the QuickTime code. We sure hope so, anyway.

Why is Lego Star Wars among the applications tested? A certain 6-year-old employee of Little Guy Media here assesses the usefulness of a computer by whether it will play this game. Fortunately, he rated the performance of the PowerPC application acceptable on the Intel Core Duo iMac, as long as Shadow Mapping is disabled in the game's preferences. Apparently it's okay to not have Qui-Gon Jinn cast a shadow as he light sabres his way through a swarm of battle droids.
Lego Star Wars is one of many PowerPC applications that just works through the magic of Rosetta, though with a performance hit. In addition to the applications listed, we've also installed and been using Startly QuicKeys 3.1, Adobe GoLive CS2, GretagMacbeth Eye-One Match 3.4, Netopia Timbuktu Pro 8.5, applications in Microsoft Office 2004, Roxio Toast 7.0.2 and StuffIt 10. So far, the list of Rosetta-related hiccups has been short:

• Nikon Capture 4.0 - through 4.4.1 wouldn't install on the iMac. The problem was in the installer, not in the application itself. When we dragged the components that make up Capture 4.4.1 from the various locations on another Mac to those same locations on the iMac, the program itself worked fine.
  
• Eye-One Match 3.4. The program slows to nearly a halt at several points in the monitor calibration module (not just when advancing past the monitor-type selection screen, as it can on any computer), but in each case the software rights itself and continues on.

We haven't had occasion to tether a camera to the iMac yet, so we don't know if that will present some troubleshooting fun.


Does the Intel Core Duo processor best a Quad G5? Not even close. We performed several of the Photo Mechanic and iPhoto tests on a Power Mac Quad G5/2.5GHz, and the G5-based computer performed a lot faster. For example, previewing 100 EOS-1D Mark II photos in Photo Mechanic is accomplished in about 18 seconds on the Quad G5, compared to 42 seconds for the Intel Core Duo iMac. Importing 20 EOS 5D CR2's into iPhoto takes 40 seconds on the G5, compared to 76 seconds on the Intel.

And this is when the applications are running natively on each processor type. Running PowerPC-coded Photoshop CS2 on both machines widens the gap that much more because, as we've noted, of the required on-the-fly Rosetta translation. For example, applying Smart Sharpen to a 16-bit EOS-1Ds Mark II file takes 33 seconds on the Intel, but only 7.5 seconds on the Quad G5. Noise Ninja filtering of the same file clocks in at 30 seconds on the Intel, and 7.1 seconds on the Quad G5.

The introduction of the Intel Core Duo processor into the Apple lineup means a lot more available horsepower for portable Macs and, to a lesser extent, consumer-geared machines like the iMac (which were already running G5 processors before Apple's Intel revolution began). But this particular Intel processor is not going to unseat four G5 cores running at 2.5GHz for those who need maximum photo processing power on the Mac platform. Especially - but not only - when the application isn't Intel-optimized.


The 20-inch iMac with an Intel Core Duo processor seems to be a fine machine for the digital SLR photographerneeding to carefully balance cost with performance, and who can live with G4-like speed in applications that haven't yet been given the Universal Binary treatment. The screen calibrates well and appears to be on par with our Apple 20 inch Cinema Display in quality, the computer has a sprightly feel when running Intel-native applications, it's almost completely silent in operation, has a good complement of USB 2.0 (3) and FireWire 400 (2) ports, plus built-in Airport Extreme Wi-Fi, Bluetooth and even Gigabit Ethernet. The video out port is DVI, supports mirrored and extended desktop modes and drives the aforementioned Cinema Display for a totally usable two-display setup. The built-in iSight video camera and tiny infrared remote for the somewhat-limited but still useful Front Row software round out an impressive package.

We got this machine on loan as a MacBook Pro simulator of sorts. In using it, however, we've come to see that Apple has stuffed a lot of pro photography goodness into the new Intel Core Duo iMac for shooters considering a desktop Mac purchase but without the budget for a Power Mac.


Conclusion
You can draw your own conclusions from the benchmarks here as to whether a MacBook Pro is likely to deliver enough of a performance improvement over a Powerbook G4 to make a machine switch pay off in the short term. Our take is that with an Intel-optimized application like Photo Mechanic, the MacBook Pro is going to be a fast portable computer, but when running PowerPC pro imaging applications - which will be a necessity for months to come - its processing speed isn't going to be all that different than a Powerbook G4 overall. Until there are a few more key Universal Binary applications, and/or it's demonstrated that an Intel Mac can run a modern flavour of Windows, we're inclined to stay on the MacBook Pro sidelines, using our existing Windows laptops for speed and Powerbook G4's for everything else.

Definition of System Vulnerabilities

Vulnerability is flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

Notice that the vulnerability can be a flaw or weakness in any aspect of the system. Vulnerabilities are not merely flaws in the technical protections provided by the system. Significant vulnerabilities are often contained in the standard operating procedures that systems administrators perform, the process that the help desk uses to reset passwords or inadequate log review. Another area where vulnerabilities may be identified is at the policy level. For instance, a lack of a clearly defined security testing policy may be directly responsible for the lack of vulnerability scanning.

Here are a few examples of vulnerabilities related to contingency planning/ disaster recovery:

• Inadequate information system recovery procedures, for all processing areas (including networks)
• Not having alternate processing or storage sites
• Not having alternate communication services
• Not having clearly defined contingency directives and procedures
• Lack of a clearly defined, tested contingency plan • The absence of adequate formal contingency training • Lack of information (data and operating system) backups

Research on Network Architecture and IPv6 Technology

Undertake the National High Technology Development 863 Program of China, key projects of National Natural Science Funds and the projects of National Basic Research Program of China collaborating with the Department of Computer Science of Tsinghua University. Develop the research on (1) next generation Internet architecture, and (2) IPv6 Source Address Validation Architecture .

Develop the research on the architecture and key technologies of next generation routers and switches, and high performance IPv4/IPv6 transition and interoperation methods. Developed the first IPv6/IPv4 dual-stack core router (BitEngine 12000 Series) in China, collaborating with the Department of Computer Science of Tsinghua University and Tsinghua Bitway Networking Co. Ltd.

Source : tsinghua.edu

Identifying System Vulnerabilities

Vulnerabilities can be identified by numerous means. Different risk management schemes offer different methodologies for identifying vulnerabilities. In general, start with commonly available vulnerability lists or control areas. Then, working with the system owners or other individuals with knowledge of the system or organization, start to identify the vulnerabilities that apply to the system. Specific vulnerabilities can be found by reviewing vendor web sites and public vulnerability archives, such as Common Vulnerabilities and Exposures (CVE - http://cve.mitre.org) or the National Vulnerability Database (NVD - http://nvd.nist.gov). If they exist, previous risk assessments and audit reports are the best place to start.


Additionally, while the following tools and techniques are typically used to evaluate the effectiveness of controls, they can also be used to identify vulnerabilities:

• Vulnerability Scanners – Software that can examine an operating system, network application or code for known flaws by comparing the system (or system responses to known stimuli) to a database of flaw signatures.
• Penetration Testing – An attempt by human security analysts to exercise threats against the system. This includes operational vulnerabilities, such as social engineering
• Audit of Operational and Management Controls – A thorough review of operational and management controls by comparing the current documentation to best practices (such as ISO 17799) and by comparing actual practices against current documented processes.

It is invaluable to have a base list of vulnerabilities that are always considered during every risk assessment in the organization. This practice ensures at least a minimum level of consistency between risk assessments. Moreover, vulnerabilities discovered during past assessments of the system should be included in all future assessments. Doing this allows management to understand that past risk management activities have been effective.

Identifying System Vulnerabilities

Vulnerabilities can be identified by numerous means. Different risk management schemes offer different methodologies for identifying vulnerabilities. In general, start with commonly available vulnerability lists or control areas. Then, working with the system owners or other individuals with knowledge of the system or organization, start to identify the vulnerabilities that apply to the system. Specific vulnerabilities can be found by reviewing vendor web sites and public vulnerability archives, such as Common Vulnerabilities and Exposures (CVE - http://cve.mitre.org) or the National Vulnerability Database (NVD - http://nvd.nist.gov). If they exist, previous risk assessments and audit reports are the best place to start.


Additionally, while the following tools and techniques are typically used to evaluate the effectiveness of controls, they can also be used to identify vulnerabilities:

• Vulnerability Scanners – Software that can examine an operating system, network application or code for known flaws by comparing the system (or system responses to known stimuli) to a database of flaw signatures.
• Penetration Testing – An attempt by human security analysts to exercise threats against the system. This includes operational vulnerabilities, such as social engineering
• Audit of Operational and Management Controls – A thorough review of operational and management controls by comparing the current documentation to best practices (such as ISO 17799) and by comparing actual practices against current documented processes.

It is invaluable to have a base list of vulnerabilities that are always considered during every risk assessment in the organization. This practice ensures at least a minimum level of consistency
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
between risk assessments. Moreover, vulnerabilities discovered during past assessments of the system should be included in all future assessments. Doing this allows management to understand that past risk management activities have been effective.

University research aims at more secure wireless network

Researchers at Carleton University, Ottawa, Canada, have reported positive results for a novel means of securing Wi-Fi and other wireless networks from hackers and other unauthorized intrusion.
The technology depends on the RF signal "fingerprints" or profiles that make every wireless transceiver in the world virtually unique. The RF fingerprints are the result of variations in the silicon and other electronic components that comprise the transceiver.

Although the components all fall within the manufacturing tolerances required by the vendor and generate valid signals, the combinations of their variances create unique signal characteristics, says Jeyanthi Hall, a graduate student at the university who is the lead researcher for the project supervised by professors Michel Barbeau and Evangelos Kranakis.

Variances are most evident in the transient signals created when the transceiver attempts to gain access to the network. In a Wi-Fi network, this means the fingerprint is acquired in approximately 2 microseconds.
A probabilistic neural network is used to compare the fingerprint to others stored in the access point (or some central location in the network) that have been verified by the network system administrator as authentic.


The researchers are also exploring the use of self-organizing map technology and clustering technology to reduce the storage capacity required for the authenticated signatures and to speed authentication.
Algorithms from The MathWorks.com MATLAB technical computing software are tuned and used for the authentication process. During the research phase of the project, the transient RF signals from the transceivers are acquired using Anritsu's Signature High Performance Signal Analyzer.

As the technology moves into more refined stages, Hall said, the signal analyzer will be replaced by a DSP-based data acquisition board.

The signal fingerprinting technology being researched at Carleton University complements and utilizes traditional security measures such as MAC-address control lists.

With spoofing techniques, hackers can circumvent the effectiveness of a MAC-address control list. With RF fingerprinting included in the security arrangements, however, a transceiver that dishonestly reports itself as having a specific MAC address can be uncovered by checking its fingerprint against the authenticated transceiver's.

Hall's research still has several hurdles to clear before it can appear as commercial product. Chief among them are scalability and the stability of the algorithms employed to create the fingerprint and compare it to other RF fingerprints.

The Script Kiddie

What is Script Kiddie ?

A person, normally someone who is not technologically sophisticated, who randomly seeks out a specific weakness over the Internet in order to gain root access to a system without really understanding what it is s/he is exploiting because the weakness was discovered by someone else. A script kiddie is not looking to target specific information or a specific company but rather uses knowledge of a vulnerability to scan the entire Internet for a victim that possesses that vulnerability.

Script Kiddie also referred to a person who relies on premade exploit programs and files (”scripts”) to conduct his hacking, and refuses to bother to learn how they work. The script kiddie flies in the face of all that the hacker subculture stands for - the pursuit of knowledge, respect for skills, and motivation to self-teach are just three of the hacker ideals that the script kiddie ignores. While anyone can be a script kiddie, generally they are teenagers who want the power of the hacker without the discipline or training involved. Obviously anyone who follows this route aspires to be a blackhat, but most refuse to even dignify them with this term; “blackhat” generally implies having skills of your own.

It is generally assumed that script kiddies are juveniles who lack the ability to write sophisticated hacking programs or exploits on their own, and that their objective is to try to impress their friends or gain credit in computer-enthusiast communities.


From around 1995 on, the widespread use of the Internet in the business and home computer field, and the full disclosure movement’s policy of disclosing working exploitation tools has led to an enormous growth of the script kiddie scene.

Script kiddies often act out of boredom, curiosity or a desire to ‘play war’ on the Internet. There are many organized script kiddie groups, who often meet in anonymous chat channels such as IRC.
Script kiddies are always looking for new exploits which are unknown to the public, and hence particularly effective. Such exploits are leaked from research labs or given to script kiddies by insiders; they are then used to compromise a large number of hosts on the Internet. Script kiddies are often young, and can evolve into honest programmers later in life.

In 1999, NetBus (a software program for remotely controlling a Microsoft Windows computer system over a network as a backdoor.) was used by script kiddie to plant child pornography on the work computer of Magnus Eriksson, a law scholar at Lund University, Sweden. About 3,500 images were discovered by system administrators, and Eriksson was assumed to have downloaded them knowingly. Eriksson lost his research position at the faculty, and following the publication of his name fled the country and had to seek professional medical care to cope with the stress. He was acquitted from criminal charges in late 2004, as a court found that NetBus had been used to control his computer.

Understanding 802.11 Frame Types

When analyzing or troubleshooting the operation of a wireless LAN, you'll likely be using an 802.11 packet analyzer (e.g., AiroPeek or Sniffer Wireless) to monitor the communications between radio network interface cards (NICs) and access points. After capturing the packets, you need to understand the different 802.11 frame types as a basis for deciphering what the network is or isn't doing. In this tutorial, I'll give you an overview of the more common 802.11 frames to help you become more adept at comprehending the operation of a wireless LAN and solving network problems.

General frame concepts

The 802.11 standard defines various frame types that stations (NICs and access points) use for communications, as well as managing and controlling the wireless link. Every frame has a control field that depicts the 802.11 protocol version, frame type, and various indicators, such as whether WEP is on, power management is active, and so on. In addition all frames contain MAC addresses of the source and destination station (and access point), a frame sequence number, frame body and frame check sequence (for error detection).

802.11 data frames carry protocols and data from higher layers within the frame body. A data frame, for example, could be carrying the HTML code from a Web page (complete with TCP/IP headers) that the user is viewing. Other frames that stations use for management and control carry specific information regarding the wireless link in the frame body. For example, a beacon's frame body contains the service set identifier (SSID), timestamp, and other pertinent information regarding the access point.
Note: For more details regarding 802.11 frame structure and usage, refer to the 802.11 standard, which is free for download from the 802.11 Working Group Web site.

Management Frames

802.11 management frames enable stations to establish and maintain communications. The following are common 802.11 management frame subtypes:

• Authentication frame: 802.11 authentication is a process whereby the access point either accepts or rejects the identity of a radio NIC. The NIC begins the process by sending an authentication frame containing its identity to the access point. With open system authentication (the default), the radio NIC sends only one authentication frame, and the access point responds with an authentication frame as a response indicating acceptance (or rejection). With the optional shared key authentication, the radio NIC sends an initial authentication frame, and the access point responds with an authentication frame containing challenge text. The radio NIC must send an encrypted version of the challenge text (using its WEP key) in an authentication frame back to the access point. The access point ensures that the radio NIC has the correct WEP key (which is the basis for authentication) by seeing whether the challenge text recovered after decryption is the same that was sent previously. Based on the results of this comparison, the access point replies to the radio NIC with an authentication frame signifying the result of authentication.
• Deauthentication frame: A station sends a deauthentication frame to another station if it wishes to terminate secure communications.
• Association request frame: 802.11 association enables the access point to allocate resources for and synchronize with a radio NIC. A NIC begins the association process by sending an association request to an access point. This frame carries information about the NIC (e.g., supported data rates) and the SSID of the network it wishes to associate with. After receiving the association request, the access point considers associating with the NIC, and (if accepted) reserves memory space and establishes an association ID for the NIC.
• Association response frame: An access point sends an association response frame containing an acceptance or rejection notice to the radio NIC requesting association. If the access point accepts the radio NIC, the frame includes information regarding the association, such as association ID and supported data rates. If the outcome of the association is positive, the radio NIC can utilize the access point to communicate with other NICs on the network and systems on the distribution (i.e., Ethernet) side of the access point.
• Reassociation request frame: If a radio NIC roams away from the currently associated access point and finds another access point having a stronger beacon signal, the radio NIC will send a reassociation frame to the new access point. The new access point then coordinates the forwarding of data frames that may still be in the buffer of the previous access point waiting for transmission to the radio NIC.
• Reassociation response frame: An access point sends a reassociation response frame containing an acceptance or rejection notice to the radio NIC requesting reassociation. Similar to the association process, the frame includes information regarding the association, such as association ID and supported data rates.
• Disassociation frame: A station sends a disassociation frame to another station if it wishes to terminate the association. For example, a radio NIC that is shut down gracefully can send a disassociation frame to alert the access point that the NIC is powering off. The access point can then relinquish memory allocations and remove the radio NIC from the association table.
• Beacon frame: The access point periodically sends a beacon frame to announce its presence and relay information, such as timestamp, SSID, and other parameters regarding the access point to radio NICs that are within range. Radio NICs continually scan all 802.11 radio channels and listen to beacons as the basis for choosing which access point is best to associate with.
• Probe request frame: A station sends a probe request frame when it needs to obtain information from another station. For example, a radio NIC would send a probe request to determine which access points are within range.
• Probe response frame: A station will respond with a probe response frame, containing capability information, supported data rates, etc., when after it receives a probe request frame.

Control Frames

802.11 control frames assist in the delivery of data frames between stations. The following are common 802.11 control frame subtypes:

• Request to Send (RTS) frame: The RTS/CTS function is optional and reduces frame collisions present when hidden stations have associations with the same access point. A station sends a RTS frame to another station as the first phase of a two-way handshake necessary before sending a data frame.
• Clear to Send (CTS) frame: A station responds to a RTS with a CTS frame, providing clearance for the requesting station to send a data frame. The CTS includes a time value that causes all other stations (including hidden stations) to hold off transmission of frames for a time period necessary for the requesting station to send its frame. This minimizes collisions among hidden stations, which can result in higher throughput if you implement it properly.
• Acknowledgement (ACK) frame: After receiving a data frame, the receiving station will utilize an error checking processes to detect the presence of errors. The receiving station will send an ACK frame to the sending station if no errors are found. If the sending station doesn't receive an ACK after a period of time, the sending station will retransmit the frame.

Data Frames

Of course the main purpose of having a wireless LAN is to transport data. 802.11 defines a data frame type that carries packets from higher layers, such as web pages, printer control data, etc., within the body of the frame. When viewing 802.11 data frames with a packet analyzer, you can generally observe the contents of the frame body to see what packets that the 802.11 data frames are transporting.