javajourn

There are a plenty of browsers available now. But people go only for the best one of the big three: Internet Explorer, Firefox, or Chrome.

But which is best among them ?, stays as an ambiguous question.

Each browser has its own mechanism for its efficient performance.

But Google stands as an highlighted one when coming to security and for a safer browsing.

Google’s Chrome browser is safe for its two reasons:

1. First, it’s the only browser to use sandboxing as its primary defense mechanism. This method combines a JavaScript virtual machine with an OS-level sandbox to prevent successful attacks against the browser’s rendering engine from affecting a user’s file system.

2. Second, Google updates the Adobe Flash and Acrobat Reader modules itself. So if you’re running the latest version of Chrome, you’re running the latest, most secure versions of Flash and Acrobat Reader available.

But we’re just getting started. JavaScript vulnerabilities—including blatant attacks that rely on a user’s cooperation to work—can just as easily affect your browser.

If you’re using Firefox, grab an extension called NoScript, which will allow you to disable a page’s plugin elements (including Java Script and Flash!) by default, unless you trust the site enough to give them a go.

 Chrome doesn’t have an add-on for the same feature, but you can disable Java Script by default in the browser’s Under the Hood settings section.

And if you want to specifically allow a site’s JavaScript to function, just click the associated X icon in the browser’s address bar to set up site-specific trust.

Data centers—how they’re designed and what hardware they run—are generally deeply guarded secrets within a corporation.

Indeed, a particularly efficient data center is considered a competitive advantage.

But secrecy isn’t an objective of Facebook’s Open Compute Project.

There are six basic server types at Facebook, but the two frontline machines are the web server and the memcache server.

The web server is the first machine you connect with when you visit Facebook.com, and it does a lot of heavy lifting and database lookups.

These boxes run Linux and Apache.

Currently, these machines uses Intel Xeon rigs running dual 2.66GHz six-core Xeon X5650s.

These boxes also have a surprisingly low amount of RAM in them: just 12GB of unregistered DDR3.

Once the web server has done your lookup, data is pulled from dual Opteron-based memcache servers running Memcached, an open-source memory-caching system.

These machines are engineered for cost-efficiency.

As such, they run dual octo-core 2GHz Opteron 6128 procs in G34 sockets.

The machines feature 72GB of DDR3/800 RAM to help feed your profile page as quickly as possible.

The next iteration of the memcache servers are expected to double with 144GB RAM.

Since neither server type performs any heavy-duty local storage functions, Facebook opted for the cheapest hard drive available— in this case, a 250GB WD Caviar Blue drive—to boot the OS and store log files.

While the machines may lack a bit in the specs department, when you gang them together, their cumulative firepower is impressive.

Facebook won’t disclose exactly how many machines it uses for running.

The amazing thing is that Facebook’s servers are only a small part of the secret sauce in the company’s new data center.

Advances in cooling, server design, and backup power make Facebook’s Pineville facility perhaps one of the most energy-efficient data centers on the planet.

Here I provide you some best sources where you can find splendid tutorial sites and books that makes newbies to feel easy.

These sites gives beginners a good intro to the language and makes you to understand well with live demos and free source codes to test it ourselves.

Also much useful for developers who need to make their projects more lively and scintillating.

Google these books now and start learning. I suggest you to download free ebooks if you find.

Head First PHP & MySQL

MASTERING PHP 5

PHP Cookbook

PHP Bible

PHP Solutions: Dynamic Web Design Made Easy

PHP for Absolute Beginners

Professional PHP5

Beginning PHP, Apache, MySQL Web Development by WROX

Here are my suggestions for you :

1. Before entering into blogging, my best advice is to learn “Google Blogger For Dummies” book completely to understand what blogging is about.
2. Best tutorial for Blogger:

Google’s Blogger Guide  :  This guides you on how to create,publish,post and edit the blog.

BloggerBuster.com : A must read tutorial on how to build your blog entirely. Gives you a brief guide on various topics needed for a blogger.

When comes to hacking, most of the people think that they are safe now and are aware of many hacking techniques like phishing , key-logging and other amateur hacking tricks.

But many would have fallen into a trap called Session Hijacking which they would have never realized so far…..

Websites are prone to Session hijacking when it uses any login system for authentication.

Sessions are usually created on the server side of the web, to hold a status whether a user is currently logged in to the site and he is currently active.

This provision is generally given to all sites by web developers. But, the intruders use this  technique for their favour.

Sessions generally uses cookies to save its information. Cookie is a piece of text stored on user computer by websites visited by the user.

This stored cookie is used by webserver to identify and authenticate the user while login.

So, if this cookie gets stolen by hackers and injected into their browser, they can imitate our identity to web-server and enter our Email account easily. This is called Session Hijacking or Cookie stealing hack of an user ID in a Web application.

Session Hijacking too can be done in Network level which is explained below …

The attacker will wait to find a suitable target and host. He use a network sniffer to track the victim and host or identify a suitable user by scanning with a scanning tool such as nmap to find a target with a trivial TCP sequence prediction.

This is done to ensure that because the correct sequence and acknowledgement numbers are captured, as packets are checked by TCP through sequence and/or acknowledgement numbers.

These will later be used by the attacker in crafting his own packets.

A desynchronized state is when a connection between the target and host is in the established state; or in a stable state with no data transmission; or the server’s sequence number is not equal to the client’s acknowledgement number; or the clients sequence number is not equal to the server’s acknowledgement number. To desynchronize the connection between the target and host, the sequence number or the acknowledgement number (SEQ/ACK) of the server must be changed. This can be done if null data is sent to the server so that the server’s SEQ/ACK numbers will advance; while the target machine will not register such an increment.

The desynchronizing is preceded by the attacker monitoring the session without interference till an opportune moment, when he will send a large amount of ” null data” to the server. This data serves only to change the ACK number on the server and does not affect anything else. The attacker does likewise to the target also. Now both the server and target are desynchronized.

Another approach is to send a reset flag to the server and tearing down the connection on the server side. This is ideally done in the early setup stage. The goal of the attacker is to break the connection on the server side and create a new one with different sequence number.

The attacker listens for a SYN/ACK packet from the server to the host. On detecting the packet, he sends an RST to the server and a SYN packet with exactly the same parameters such as port number but a different sequence number.

The server on receiving the RST packet, closes connection with the target, but initiates another one based on the SYN packet – with a different sequence number on the same port. Having opened a new connection, the server sends a SYN/ACK packet to the target for acknowledgement.

The attacker detects (but does not intercept) this and sends back an ACK packet to the server. Now, the server is in the established state.

The target is oblivious to the conversation and has already switched to the established state when it received the first SYN/ACK packet from the server. Now both server and target are in desynchronized but established state.

This can also be done using a FIN flag, but this will cause the server to respond with an ACK and give away the attack through an ACK storm.

This results due to a flaw in this method of hijacking a TCP connection. When receiving an unacceptable packet the host acknowledges it by sending the expected sequence number and using its own sequence number.

This packet is itself unacceptable and will generate an acknowledgement packet which in turn will generate an acknowledgement packet, thereby creating a supposedly endless loop for every data packet sent.

The mismatch in SEQ/ACK numbers results in excess network traffic with both the server and target trying to verify the right sequence. Since these packets do not carry data they are not retransmitted if the packet is lost.

However, since TCP uses IP the loss of a single packet puts an end to the unwanted conversation between the server and target on the network.

The desynchronizing stage is added in the hijack sequence so that the target host is kept in the dark about the attack.

Without desynchronizing, the attacker will still be able to inject data to the server and even keep his identity by spoofing an IP address. However, he will have to put up with the server’s response being relayed to the target host as well.

Now that the attacker has interrupted the connection between the server and target, he can choose to either inject data into the network or actively participate as the “man in the middle”, and pass data from the target to the server, and vice versa, reading and injecting data as he sees fit.

-Hope this article gave you a clear idea on session hijacking.

Thank you.

Just click check-in the interface yourself……….

Change is difficult for many. It’s like making the switch from Office 2003 to Office 2010, and its impossible now to work with its older version.
In the same way, UEFI is the future and we’re only at the beginning stage.