Shivam's World

February 18, 2010

A tale of a security flaw, its discovery, disclosure to authorities and their indifference.

Filed under: Uncategorized — Shivam @ 12:39 pm

I do not believe in full disclosures. I think they do more harm than good. But lately I had an experience which helped me understand the reasons people are often forced to do a full disclosure of a software vulnerability.

There is only one ‘argument’ for a full disclosure – that it ’forces’ the organization to act swiftly and fix the vulnerability. And believe me there are many organizations that are lazy enough to fix a problem reported to them.

Lately, I chanced to visit the website of National Institute of Design, Ahmedabad. NID happens to be one of the premier institute of design in India. The website has a portal (called Kportal) aimed to provide unified login for students, staff and alumni for various institute related functions. It has monthly pay-slips for employees and library records for students and many more Institute specific features.

This portal has several security vulnerabilities. It is a great example of a ‘poor design’. By design I mean the design of their web architecture rather than their user interface. I was curious to know how deep can one get into their systems and it took me a couple of hours to verify that a sophisticated attack can actually give one access to their database. And guess what do you find in their database. You find pay slips, marks of students and passwords (very unfortunately in plain text). This was horrifying.  More horrifying was the fact that updating records in the database was just a matter of firing some update queries using a specific channel. I wish I were a student there ;-)

Immediately after, I sent an email to the top officials of NID explaining them about the vulnerabilities that their portal has. Since, I did not know the right person to talk to regarding this, I went to their ‘Director and Deans’ page and emailed their Director (Shri Pradyumna Vyas), Activity Chairperson (Shri Akhil Succena),  Acting Dean, R&D Campus (Dr. S Ghosal). I also emailed Ms. L Padmavati Bet, a person I believe to be closely related to development of this portal. I specifically wrote about the vulnerability and the amount of data that can be leaked in case one is successful in his attempt. I sent a separate email to Ms. Padmavati explaining in detail a typical hack which makes her account is especially vulnerable. By the nature of the design of Kportal, her account was ‘most prone’ to a very popular class of attack (I am not mentioning the names of techniques for obvious reasons).

Guess what the response was!! I heard nothing back from them. They read the emails and didn’t bother to take any action on it. The portal still poses a big threat to the personal data of all the students/staff of NID. I volunteered to give specific inputs to harden their portal in case they need it but they don’t want any.

The downside of all this is that the students of NID are continually exposed to attacks leading to privacy invasion and data loss. I may not be the first person to discover this. Maybe there are many others who are snooping into accounts of these students without their knowledge.  Even worse, many people tend to keep their passwords same for various online accounts that they have. In such a case, getting a password from the NID portal will enable any attacker to login to the other accounts of users.  There are many more lateral attacks possible than I can enumerate here. Think about the secret question. What if you have different passwords for different accounts but you keep the same secret question-answer for all of them. As of today its fairly easy to get any of these detail of any NID student/staff.

There is an urgent need for NID to let the students know about the weakness that they had and send emails to all the 1848 students/staff registered on their portal to do the following:

  • Change passwords of all other online accounts which had the same password as the one they used for K portal.
  • Change the secret question/answer of all other online accounts that have the same secret question/answer pair as used on K portal.

I wish I could force them to do this. I wish they were a little more responsible. If you are running an organization this big, isn’t it your responsibility to protect your users data ??

February 12, 2010

From a Website to a Webserver !

Filed under: Uncategorized — Shivam @ 3:33 am

I still remember the day when I launched my first website. It was a couple of years back. Although I had developed many sites before that as class projects or hobby but they were all limited to localhost. Win-98 PWS (okay so now you have some idea of the time period I am talking about) was ‘sufficiently robust’ to handle my ‘dynamic’ websites written in ASP. But things changed and I got a chance to host a website on Internet.

So this fine night, I was struggling to make ‘upbazar.com’ live. I had been working really hard on this project since past couple of weeks and I was very excited about it. upbazar.com had a interesting story behind it. My computer vendor came up with this excellent idea of creating a ‘online marketplace’ which would provide a interface where users can search for businesses based on keywords. We would categorize local businesses (think dmoz) and also provide advanced search features to find local shops that sell the items or provide the service one is looking for. A kind of online yellow pages on steroids. The idea was to hire a bunch of sales executives who will visit local businesses (shops, restaurants etc.) and pursue them to buy one of our ‘silver’, ‘gold’ or ‘platinum’ packages which were priced at Rs. 250, Rs. 500 and Rs. 850 respectively. These were essentially their entries into our database. A silver package was just a listing on our website, a gold package was a highlighted entry and a platinum package also included a dedicated web page for that business (wow !).

All was set. Now this idea had to be implemented. Let me introduce you to the core team of this expedition. My computer vendor, Sandeep Saxena was the big boss (aka CEO) who would do all the funding for this project. I was the lead developer along with my friend Himanshu Yadav. My another friend Randeep Singh Bedi was the semi sales – semi tech guy. A true arm-twister as he is, he got himself designated as the ‘Director’ of the company and also got ‘company sponsored’ business cards (much to our disgust). A 22 years old director, wow. My yet another friend, Shashi Shekhar joined later and got involved into marketing domain.
So, the couple of things that were needed first were:

  • A website – that was the core product,
  • A office
  • A bunch of sales executives who’d report to the office in the morning, get their areas and targets assigned, go to their designated area and work all day, come back in evening to report their status and deliver data to the dev team that would feed it to the databases.
  • A manager who’d manage all this sales and marketing stuff.

I started the dev work on war scale. I’d spend entire nights to develop a site that was intuitive and which could scale well. Sandeep leased a office at a prime locality in Lucknow. I personally liked that office. Within no time we had telephone, internet and a couple of computers at our office. While on the other hand, we were recruiting for one manager and a couple of sales executives. We had advertized these vacancies in the leading local newspapers.

One rather interesting moment occurred to us one day. I and Randeep were sitting idle at office that day and a lady appears and says she’s come of a walk-in interview that we advertised in the newspaper. Normally we had nothing to do (and no say) in the recruitment process but since Sandeep wasn’t around, we thought to handle the situation. We posed as if we were the right people to talk to and started the interview. The lady ‘L Sri Priya’ was a rather short, dark complexioned south Indian and didn’t look like she was worthy enough for this job. But faces deceive. Our first question was about her work experience and the answer was that she has been a Manager in Standard Chartered bank for a couple of years. Now now now, we were quiet in trouble. We had no idea how to deal with a senior person that she was. Obviously we had no questions to ask. Although we did ask ‘why upbazar.com’ and why did you leave Standard Chartered. It turned out that her husband was transferred to Lucknow and she had to accompany him to this city and now she was looking for some job that won’t have any long term commitment.

She was good in all respect for our needs. Sandeep went by our word and hired her. Very soon we also had half a dozen sales executives. The company was growing fast, you see. However, I was never convinced by the core idea behind the company. Computer penetration in a city like Lucknow was very low. A fraction of people had computers at that time and only a fraction of the people who had computers had Internet. So why would a person log on to computer and visit a website to find out which is the best shop for him. Normally, a person knows where to get his daily stuff.

But I had a different interest in this project. Learning. I couldn’t afford a web space just for experimenting. Web server space was costly and I was just a student. So, I saw this as a big opportunity to play with a web space and know more about how a website is hosted.

So as I said before, I worked really hard to develop the website. And this night I was all set to make the site ‘live’. But the question was ‘How’? I had no idea what do I need to do to make my site run on the server. I didn’t know anything about FTP nor did I know how can I copy files to the server. So I was shooting queries like ‘copy file to server’, ‘run website on server’ on google (so nice that google was there at that time too). So it took a lot of discovery to figure out that we can upload file to a server with the help of something called FTP. Finally a couple of hours later, I could get my files up there and database configured. And lo… if I type upbazar.com on the browser, the website opens… the same one that opens on my localhost. It was a moment of triumph for me. Simply the thought that people can see my creation from anywhere in the world was so exhilarating. It was really a happy moment for me.
The site was up and within some time we had a couple of customers too.

And then we hit the wall. Persuading businesses to advertise with us was a difficult task. While we had customers, but we needed a lot more even to break even. As I look back to it, I feel there were a couple of things that could and should have been done differently.

  • We were paying way too high to our manager. Fine that she was very qualified but she was over-qualified for the job that we had. We were paying her commensurate to her qualifications which was not right. We should have been paying her commensurate to the job requirements that we had.
  • I feel that this project was way ahead in time for Lucknow. Lucknow (or for that matter even metro cities) was not technically advanced to fully leverage the benefits of such a system. People still preferred traditional ways to shop.
  • Technology in general wasn’t at a stage where it could compliment our business. For example, there were no iPhones or smartphones then. I just think of a scenario where people would use PDA’s and our site would then have a mobile version where one could make use of all the facilities via mobile phones. This was much more convenient for a person who is on road and wants to lookup something.

Sandeep tried hard to continue the business. Unfortunately, he suffered huge losses in a years’ time and had to shut down the business. It was really sad. The domain name wasn’t renewed the following year and the site was off the Internet. It has been years since then, but whenever I chance to go alongside the road where that office was, I remember those days and feel bad about the outcome. I still have that website on my computer and it still works. Probably I’ll have it with me for the rest of my life. After all it was my first website that went ‘on air’.

Incidentally, the CEO of a New York based startup yext.com had come to Carnegie Mellon to hire engineers for his company. Yext.com is a ‘the next yellow pages’ company (and hence the name yext). He gave a impressive introduction about his company. Surprisingly, this company has a very similar concept that we had. During his entire address, I kept thinking about upbazar.com. Its a multi-million dollars company already and has only 4 engineers and about a couple of dozens of sales and marketing people. How similar to our setup. Obviously ideas are re-discovered over time and more importantly it’s their implementation that makes them work. Recently the business model of yext was liked by many at Techcrunch50 and he got huge funding.

Upbazar.com came to a end. But we all kept moving. Some in that team moved really far. I completed my engineering and moved to USA. Himanshu, the other developer, has moved to UK. Sandeep is doing fine with his primary business and Randeep is now a commercial pilot and flies Airbus A320(don’t be surprised – he is a sardar, he is bound to do crazy things.)

My technical skills have bettered since then and I have developed and hosted a lots of sites since then. Fortunately I landed up at Carnegie Mellon University where my learning curve has been exponential. With so many websites running on various collocated servers, lately recurring payments to web hosting companies was becoming a pain and so I thought – ‘time has come to have my own webserver’.

I had been searching for some hardware to turn it into a webserver. I found good enough box at craiglist and was all set to do the magic. So last night, there was a lot of resemblance in what I was doing a couple of years back. But my queries were a bit different though. This time they were ‘apache vs IIS’, ‘best linux disto for webserver’ and ‘chrooting for FTP’. After a couple of hours of configurations and installations, I had my webserver up, running and live. Running a webserver when you don’t want to make ‘any’ investments is a big Jugad. I am running my server on my home connection. So, I had to find and configure a free dynamic DNS, a free and robust dynamic DNS client, proper port forwarding and correct configurations. I specially stress on correct configuration for the reasons mentioned below.

Well, I am specializing in Information security and have taken many security/computer forensics classes. In more than one class, the professors told that it is common for a machine (specially server) to get attacked and compromised within hours once it gets connected to a wild wild internet. I always wondered how could that be

I don’t wonder anymore. Within hours after the DNS was set up to route traffic to my server, I got my first attack. A brute-force attack on FTP. I was very excited to see the attack happening right before my eyes. I quickly fired up wireshark and could see the passwords that the attacker was trying to access the FTP account. The pattern of passwords indicated a dictionary attack. My excitement did not last long as soon I realized that getting attacked is now the order of the day. I get almost 4-5 FTP attacks per day. The attacking computers are from all over the world- China, Korea, Germany.. you name it. For almost all the cases, the attacking computers are themselves compromised. It is the bot on that machine that is attacking my server and the owner of that computer doesn’t know it. Poor owners of those computers don’t even know that their computer has port 80 (http), 21(ftp) opened on their systems and that they are serving porn to the world and attacking other computers.

However, I’ll take a moment to clarify that although I get attacked many times a day, my server hasn’t been compromised on any of those attacks. I have set up sophisticated triggers that ban IP’s on 15 invalid attempts of FTP logins and other such security primitives. And for those who didn’t know, companies like google, facebook, amazon face huge attacks from around the world every hour and survive them. The internet is a very hostile environment – ask any system administrator and he’ll tell you the tales of horror.

My next action item is to make the server really secure. It will indeed be a shame if my server gets hacked. Currently it is on a Windows/Apache platform, I plan it to move it to Linux/Apache pretty soon. Currently my old school project http://mocktest.net runs on it. It’s a ASP website running on Apache so obviously isn’t functional but the point is that I can host php/mysql websites now.

Before I end my gigantic blog, a note to all my special friends: Come on, stop paying to your webhosts, your friend just got a ‘world class’ server. Gimme your code and I’ll host it for free !

So, this is the story of two triumphs of my life. Although the first triumph was much more special but nevertheless it is a great feeling to have my own webserver. It feels great whenever the server’s hard disk starts churning every now and then. I know that someone, somewhere in the world has clicked my website :-)

Oh by the way.. here’s what my server looks like:

I and my Web Server !!

January 31, 2010

Remebering Randy Paush

Filed under: Uncategorized — Shivam @ 3:01 am

It is such a pleasure and honor to be at a place where professors like Randy Pausch have spent their lives. He inspired students when he was with us and he continues to inspire us after he’s gone.
The Randy Pausch Bridge connects the fine arts buliding, Purnell Center, with the Gates & Hillman Centers, the home for computer science at Carnegie Mellon.

The bridge’s railing consists of 7000 programmable LED’s that animate to represent 6 different metaphors from his book “The Last Lecture”. The 6 animated sequence represent:

  • Fun with Crayons
  • Outer Space
  • Make the Most of Each Day
  • Be the First Penguin
  • The Elevator in Randy’s Room
  • Disney and the Circus

A beautiful video on the various sequence can be seen below.

This bridge will stand forever and keep inspiring generations of students who’ll walk on it. We’ll always miss him.
This picture was taken on 6 December 2009

October 27, 2009

Pittsburgh Downtown

Filed under: Uncategorized — Shivam @ 11:30 pm

Pittsburgh Downtown
Pittsburgh has one of the most picturesque downtown of all the cities I have seen.  You won’t find many cities where 2 rivers meet to form a third right at the heart of the town.

Two rivers, Allegheny and Monongahela meet here to form the Ohio river. The place of confluence is called the Golden Triangle (between Allegheny and Monongahela) and there is a nice park at this place.

The beauty of this is accentuated by surrounding hills which present make the view even better. If you want to admire its real beauty, take a fun ride on Duquesne Incline to reach the top of Mt. Washington and start clicking

About this Picture:
This picture was taken from Mt. Washington on 19 Dec 2008.

Powered by WordPress