Ethical Hacking and Information Security Workshop

Hosted by the IEEE Student Branch of MIT(Feb. 29 2012 and Mar. 1 2012

Virscent Technologies Pvt. Ltd. in association with IIT-Kharagpur E-Cell is proud to present D_Code – the Ethical Hacking Workshop. The course focuses on giving hands on training to all the participants in the field of Ethical Hacking.
The modules of the workshop are:

  1. Introduction to Ethical Hacking
  2. Cyber Forensics
  3. Web Based Email Attacks & Security
  4. Windows OS Hacks
  5. Understanding Malware Working & Detection
  6. Networking Attacks & Security
  7. Wi-Fi Attacks & Security
  8. Web Server Attacks & Security
  9. Hacking Using Google
  10. Software Reverse Engineering
  11. VOIP & Mobile Hacking

IEEE Software issue on ‘Algorithms for Today’s Practitioner’

I am reading the Jan/Feb 2012 issue of IEEE Software that should strike a chord with Software engineers in the offshore industry. Even financial application developers are oblivious to the need for algorithms that are not always part of the J2SE kit or an astronomically priced tool that the management here favors.

The awareness is lacking and the motivation to read about and experiment with code and algorithms is missing.

I also read the interesting interview with David Chaiken, Chief Architect of Yahoo who visited the Chennai IIT and spoke about his work in Yahoo. I was in the audience and remember that he pointed out a particular bug ID that caused some Yahoo servers in the production data centre to mishebave after he deployed a release.

My question to him was about the testing procedures that Yahoo uses for such large-scale deployments and I was looking for some tips about testing distributed applications. He just replied that Yahoo tries to use agile testing principles in some cases.

I have to rememeber to urge the local IEEE chapter to invite such speakers more frequently and also involve the developer community. There were faculty and students on that day amongst the sparse audience.

Apache ZooKeeper

I don’t know why management of firms that deal with financial data tend to be very conservative about new
technology in my part of the world. There are varied reasons for this but the lack of experience of executives is high on the list. The vision to support large-scale deployments of mission critical software is just not there.

Company honchos should read Joel Spolsky’s opinion about the role of the executives in shaping the technology roadmap of the company.

I recently explored options to monitor and operate a simple cluster of Java socket programs and came across ZooKeeper. It is not strictly a requirement for a distributed application but these individual socket programs need to be managed and some may need to be restarted.

Initially I thought of using Google protobuffer and send simple information about the number of messages and load to the centralized ZooKeeper instance so that some decision can be taken based on it. This idea is not fully explored yet but the sample program that uses ZooKeeper nodes and proto buffer messages is shown below.

The messages sent and received from ZooKeeper nodes can be serialized in any way and here proto buffer is used for that.

Producer stores messages in the node


import com.google.protobuf.InvalidProtocolBufferException;
import message.Message;
import org.apache.zookeeper.KeeperException;
import org.apache.zookeeper.ZooKeeper;
import org.apache.zookeeper.data.Stat;

import java.io.IOException;

public class DistributedProducer {

    private ZooKeeperCoordinator zkc;

    private String root = "/Protocol Buffer";

    {
        try {
            zkc =
            new ZooKeeperCoordinator( "localhost:2181",
                                      root );
            zkc.connect();
            zkc.setUpRoot();
        } catch (InterruptedException e) {

            System.out.println( "InterruptedException" );

        } catch (IOException e) {

            System.out.println( "IOException" );
        }

    }

    public void send() throws IOException, InterruptedException, KeeperException {

        if( null != zkc ){
            ZooKeeper zk = zkc.getZookeeper();
            Stat stat =
            zk.setData( root + "/protocolbuffer",
                       getData(),
                       -1
                      );
            System.out.println( "Stat is  [" + stat + "]");
        }
    }

    private byte[] getData() throws InvalidProtocolBufferException {
        Message.Load message = Message.Load.newBuilder().setType(
                                 ( Message.Load.LoadType.HIGH)).build();
        Message.Load message1 = Message.Load.parseFrom( message.toByteArray() );
        System.out.println( "Distributed value is [" + message1.getType().toString() +"]");
        return message.toByteArray();
    }
}

Consumer consumes it.


import com.google.protobuf.InvalidProtocolBufferException;
import message.Message;
import org.apache.zookeeper.KeeperException;
import org.apache.zookeeper.ZooKeeper;
import org.apache.zookeeper.data.Stat;

import java.io.IOException;
import java.nio.ByteBuffer;
import java.nio.CharBuffer;
import java.nio.charset.CharacterCodingException;
import java.nio.charset.Charset;
import java.nio.charset.CharsetDecoder;

public class DistributedConsumer {

    private ZooKeeperCoordinator zkc;

    private String root = "/Protocol Buffer";

    {
        try {
            zkc =
            new ZooKeeperCoordinator( "localhost:2181",
                                      root );
            zkc.connect();
        } catch (InterruptedException e) {

            System.out.println( "InterruptedException" );

        } catch (IOException e) {

            System.out.println( "IOException" );
        }

    }

    public void receive() throws IOException, InterruptedException, KeeperException {

        Stat stat = null;

            if( null != zkc ){
                ZooKeeper zk = zkc.getZookeeper();
                if( null != zk ){
                    byte[] value =
                    zk.getData( root + "/protocolbuffer",
                               false,
                               stat
                              );
                    getData( value );
                }
            }
    }

    private void getData( byte[] value ){

        try {
            Message.Load message = Message.Load.parseFrom( value );
            System.out.println( "Distributed value is  [" + message.getType().toString() + "]");

        } catch (InvalidProtocolBufferException e) {

            System.out.println( "InvalidProtocolBufferException" + e.getMessage() );
            e.printStackTrace();

        }
    }
}

A client that connects to and sets up ZooKeeper


import org.apache.zookeeper.*;
import org.apache.zookeeper.data.Stat;

import java.io.IOException;
import java.util.concurrent.CountDownLatch;

public class ZooKeeperCoordinator {
    
    private String host;
    
    private String root;

    private Stat stat;

    public ZooKeeper getZookeeper() {
        return zookeeper;
    }

    private ZooKeeper zookeeper;

    public ZooKeeperCoordinator( String host,
                                 String root ){

        this.host = host;
        this.root = root;

    }

    public void setUpRoot(){

        System.out.println( "Set up root" );
        try {
            stat = zookeeper.exists( root,
                                     false );
            if( null == stat ){
                 zookeeper.create( root,
                                   new byte[ 0 ],
                                   ZooDefs.Ids.OPEN_ACL_UNSAFE,
                                   CreateMode.PERSISTENT);
            }
        } catch (KeeperException e) {
            System.out.println( "KeeperException" );

        } catch (InterruptedException e) {
            System.out.println( "InterruptedException" );
        }
    }

    public void connect() throws InterruptedException, IOException {

        System.out.println( "connect" );
        final CountDownLatch latch = new CountDownLatch( 1 );

        Watcher watcher = new Watcher(){

            public void process(WatchedEvent watchedEvent) {

                if( watchedEvent.getState() == Event.KeeperState.SyncConnected ){
                    latch.countDown();
                }
            }
        };

        zookeeper = new ZooKeeper( host, 1000, watcher );
        latch.await();
        System.out.println( "Awaiting connection" );
    }

    public void close() throws InterruptedException {
        zookeeper.close();
    }
}

The Protocol Buffers documentation has instructions to compile this simple .proto data structure

package message;

message Load {

  enum LoadType {
    HIGH = 0;
    MEDIUM = 1;
    LOW = 2;
  }


  optional LoadType type = 1 [default = MEDIUM];

}

Mac OS Lion freezes too

I realized that the Mac OS freezes too and not for a serious reason. I just tried to install firefox and Finder caused my Laptop to become unusable.

So following the advice in this site I cleaned its preferences but there was no respite.

As a last resort I booted in single user mode and issued rm /var/db/.applesetupdone. I created a new admin. user and deleted my old administrators.

That wasted my Sunday. This has never happened to my Ubuntu desktops.

Sebastian Thrun’s democratic university

I am stumped. Stanford research professor Sebastian Thrun and other professors are planning to organize and teach an entire university course in Computer Science !! I planned to but didn’t take their initial AI course but this is too good to miss. They are following it up with an entire degree course in CS. What attracts me is the open courseware concept and the self-driving car.

As a software developer I have firsthand knowledge of the lack of taste for algorithms/CS and how the entire offshore industry is stuck in a medieval mindset.
I am much obliged.

However you look at this endeavor this proves that if one is set on thinking audaciously action will follow. Shouldn’t this stir up our interest in CS and its application to seemingly mundane software engineering?

Description: This class, taught by one of the foremost experts in AI, will teach you basic methods in Artificial Intelligence, including: probabilistic inference, computer vision, machine learning, and planning, all with a focus on robotics. Extensive programming examples and assignments will apply these methods in the context of building self-driving cars. You will get a chance to visit, via video, the leading research labs in the field, and meet the scientists and engineers who are building self-driving cars at Stanford and Google.
Prerequisites: The instructor will assume solid knowledge of programming, all programming will be in Python. Knowledge of probability and linear algebra will be helpful.

Java Path Finder

Java Path Finder(JPF) is a model checker for Java programs and can check concurrent programs for deadlocks and data races which are more serious in muti-core environments. Java threads used by concurrent programs are context switched by the OS scheduler at run-time when we ‘yield’ a thread or due to some other reason. Even though it might be possible to test these scenarios extensively by profiling a few possible combinations of thread interleavings, it is quite tedious. So JPF tests this type of code by exploring all the code using algorithms to find errors.

JPF has quite a number of plug points and gov.nasa.jpf.jvm.VMListener is one such interface. I have implemented it to get data about the number of BLOCKED threads that the System Under Test(SUT) has and the monitor that they are blocked at. The data is still not clear but it is reasonable. I am not able to get clear data showing how many threads are blocked for a particular monitor to be released at a point in time. I think the code has to be refined.

JPF can be downloaded from http://babelfish.arc.nasa.gov/trac/jpf/ by using a mercurial eclipse plugin and it is quite easy to build and use.

I implemented gov.nasa.jpf.jvm.VMListener and added the classpath entry pointing to the class file to jpf-core.native_classpath

gov.nasa.jpf.jvm.VMListener based on JPF source code

public class LockContentionListener implements VMListener{


	@Override
	public void threadStarted(JVM vm) {
		printLocks( vm );
	}


	/**
	 * Thread and lock status.
	 * @param vm
	 */

	    private void printLocks( JVM jvm ){

		StringBuffer locksAndThreads = new StringBuffer();

		for ( ThreadInfo tf : jvm.getThreadList().getThreads()) {

		    ElementInfo ei = tf.getLockObject();
		    if (ei != null) {
		      if (tf.getState() == ThreadInfo.State.WAITING ||
				  tf.getState() == ThreadInfo.State.BLOCKED ) {
			  locksAndThreads.append( "\n");
			  locksAndThreads.append(tf.getStateDescription());
			  locksAndThreads.append(ei);
			  locksAndThreads.append(" \n Lock Count (" +                 ei.getMonitor().getNumberOfBlockedThreads()+ ")");

			    LinkedList locks = tf.getLockedObjects();
			    if (locks.isEmpty()) {
				locksAndThreads.append("  call stack:");
				    for (StackFrame frame : tf){
				      if (!frame.isDirectCallFrame()) {
					  locksAndThreads.append("\tat \n ");
					  locksAndThreads.append(frame.getStackTraceInfo());
				      }
				    }
			    }
				System.out.println( "Locks owned by Threads[ " + locksAndThreads + " \n ]");

		  }
		 }
		}
	    }

SUT

public class LockContention{
	
	private static final int NUM_THREADS = 2;
	
	
	public  static void main( String... argv ) throws InterruptedException {
		
		Thread[] readThreads = new Thread[ NUM_THREADS ];

		Locker locker = new Locker();
		
		for(  int i = 0 ; i < readThreads.length; i ++ ){
			
			readThreads[ i ] = new Thread( new ReadLockContention( locker ) ){
				
				public String getName(){
					return "LockContention (Reader)[ " + getId() + " ]";
				}
				
				
			};
		}

		Thread[] writeThreads = new Thread[ NUM_THREADS ];

		for( int i = 0 ; i < writeThreads.length; i ++ ){
			writeThreads[ i ] = new Thread( new WriteLockContention( locker ) ){

				public String getName(){
					return "LockContention (Writer)[" + getId() + " ]";
				}
				
			};
		}
		
		for( Thread t : readThreads ){
			t.start();
		}
		for( Thread t : writeThreads ){
			t.start();
		}
		for( Thread t : readThreads ){
			t.join();
		}

		for( Thread t : writeThreads ){
			t.join();
		}
		
	}


}

class ReadLockContention implements Runnable{
	
	private Locker locker;
	
	public ReadLockContention( Locker locker ){
		this.locker = locker;
	}

	@Override
	public void run() {
		locker.contendForReadLock();
		
	}

}

class WriteLockContention implements Runnable{
	
	private Locker locker;
	
	public WriteLockContention( Locker locker ){
		this.locker = locker;
	}

	@Override
	public void run() {
		locker.contendForWriteLock();
		
	}

}

class Locker{
	
	private final String lock = new String();

	/**
	 * Consider this as a read lock
	 */
	void contendForReadLock(){
			synchronized( lock ){
				try {
					Thread.sleep(50000);
				} catch (InterruptedException e) {
					System.out.println( "InterruptedException" );
			    }
				
			}
	}
	
	/**
	 * Consider this as a write lock
	 */
	void contendForWriteLock(){
			synchronized( lock ){
				
			}
	}
	
}

Output

The command

jpf +listener+=LockContentionListener LockContention.jpf

produces

Threads blocked on Locks[
thread id=2,name=Thread-2,status=BLOCKED,priority=5,lockCount=0,suspendCount=0java.lang.String@137
Lock Count (1) call stack: at
Locker.contendForReadLock(LockContention.java:97) at
ReadLockContention.run(LockContention.java:67)
]
Threads blocked on Locks[
thread id=1,name=Thread-1,status=BLOCKED,priority=5,lockCount=0,suspendCount=0java.lang.String@137
Lock Count (1) call stack: at
Locker.contendForReadLock(LockContention.java:97) at
ReadLockContention.run(LockContention.java:67)
]

The monitor is shown in bold. I want to know how many threads are blocked for a lock to be released.
It seems that these messages indicate that two threads(Thread-1,Thread-2) are blocked on the same monitor but I think this has to be investigated further. There is no reply to my forum question about this.

Sangam 2011

I recently visited bangalore to speak about Java Concurrency and a different set of problems like ‘False Sharing’, CAS instructions etc. Even model checkers like Java Path Finder was in the agenda. I spent quite a number of hours on the slides and the white paper. On the whole it was enlightening to investigate how Java programs are affected by multiple cores and shared memory and cache coherency.

The turnout for the conference was extremely poor but this affected only the Java tracks. It seems that the Java user groups in India are sometimes at loggerheads with each other and oneupmanship is not uncommon among the JUG’s.

I was mainly interested in the way Java problems perform on multi-core systems because there are so many tutorials on the net that show examples of other more common Java API’s. Hard problems like concurrency have their own attraction because we do not generally profile and investigate our commercial applications using Java Path Finder.

I am happy that I learnt quite a lot about relaxed memory models, java.util.concurrent and many other such topics. There is more to write about later in the blog about all this.

Fork Join

These are simple programs that might help one understand how to use java.util.concurrent.RecursiveAction which uses the ForkJoin framework. I am trying to analyze how this framework employs the work stealing algorithm so that the programs use multiple cores more efficiently.

The innards of this algorithm and its variataions do not seem to be so simple and I did not find any cheap tools that will help me understand how the cores are more efficiently used. I am looking for a way to visualize this algorithm in a simpler way. JavaFX looks appealing but the problem is that the actual algorithm should drive the UI instead of a visually appealing show that does not reveal the way the code behaves in a certain multi-core environment. So I am trying to manipulate the UI exactly when a task is stolen but how this type of code interacts with the framework is not known at this time.

MergeSort

 

public class SortTask {
	
    long[] aux = new long[ 40 ];

    static long[] list = new long[ 40 ];

    private void mergeSort( int lo, int hi){
 
    	if( lo < hi ){
    		
        	int mid = ( lo + hi )/ 2;
        	
        	mergeSort( lo, mid );
        	
        	mergeSort( mid + 1, hi );
        	
        	merge( lo, mid, hi );
    	}
    	
    }
    
	private void merge( int lo,
    		            int mid,
    		            int hi ){
    	 int i = lo, j = mid + 1;
    	 
    	 int k = lo;
    	 
    	 for( ; k <= hi ; k ++ ){
    		aux[ k ] = list[ k ];
    	 }
    	 k = lo;
    	 while( i <= mid && j <= hi){
    		 if( aux[i] < aux[j]){
    			 list[k++] = aux[i++];
    		 }else{
    			 list[k++] = aux[j++];
    		 }
    	 }
    	 while( i <= mid ){
			 list[k++] = aux[i++];
    	 }
     }
     
     private static long[] getArray(){
   	 
    	 Random random = new Random();
    	 
    	 for( int i = 0 ; i < list.length ; i ++ ){
    		 list[ i ] = random.nextInt(1000);
    	 }
    	 
    	 return list;
    	 
     }
     
     private void printArray(){
    	 for( int i = 0 ; i < list.length ; i ++ ){
    		 System.out.printf( "%2s ", list[ i ]);
    	 }
   		 System.out.printf( "%n");
     }
     
     public  static void main( String... argv ){
    	 list = SortTask.getArray();
    	 SortTask st = new SortTask();
    	 st.printArray();
    	 st.mergeSort( 0, list.length - 1 );
    	 st.printArray();
     }
     
}

MergeSort using ForkJoin

 

 
public class ForkJoinSortTask extends RecursiveAction{
	
	private static final long serialVersionUID = 1070860898589424509L;

	long[] aux = new long[ 40 ];

	private int lo;

	private int hi;

    long[] list = new long[ 40 ];

    public ForkJoinSortTask( long[] list, int lo, int hi ){
    	this.list = list;
    	this.lo = lo;
    	this.hi = hi;
    }
    
	public ForkJoinSortTask() {
   	    this.list = getArray();
    	this.lo = 0;
    	this.hi = list.length - 1;
	}

  
	private void merge( int lo,
    		            int mid,
    		            int hi ){
    	 int i = lo, j = mid + 1;
    	 
    	 int k = lo;
    	 
    	 for( ; k <= hi ; k ++ ){
    		aux[ k ] = list[ k ];
    	 }
    	 k = lo;
    	 while( i <= mid && j <= hi){
    		 if( aux[i] < aux[j]){
    			 list[k++] = aux[i++];
    		 }else{
    			 list[k++] = aux[j++];
    		 }
    	 }
    	 while( i <= mid ){
			 list[k++] = aux[i++];
    	 }
     }
     
     private long[] getArray(){
   	 
    	 Random random = new Random();
    	 
    	 for( int i = 0 ; i < list.length ; i ++ ){
    		 list[ i ] = random.nextInt(1000);
    	 }
    	 
    	 return list;
    	 
     }
     
     private void printArray(){
    	 for( int i = 0 ; i < list.length ; i ++ ){
    		 System.out.printf( "%2s ", list[ i ]);
    	 }
   		 System.out.printf( "%n");
     }
     
     public  static void main( String... argv ){
    	 ForkJoinSortTask st = new ForkJoinSortTask();
    	 st.printArray();
    	 ForkJoinPool fjp = new ForkJoinPool();
    	 fjp.invoke( st );
    	 st.printArray();
     }

	@Override
	protected void compute() {

    	if( lo < hi ){
    		
        	int mid = ( lo + hi )/ 2;
        	
            invokeAll( new ForkJoinSortTask(list, lo, mid),
                       new ForkJoinSortTask(list, mid + 1, hi));
        	
        	merge( lo, mid, hi );
    	}

	}
     
}

The dilemma called management

I read this in John rose’s blog but this Feynman quote is appropriate to describe the dilemma that the technical team faces when confronted by a project manager who sends the dreaded email.

The problem is not just to say something might be wrong, but to replace it by something — and that is not so easy. As soon as any really definite idea is substituted it becomes almost immediately apparent that it does not work.

The second difficulty is that there is an infinite number of possibilities of these simple types. It is something like this. You are sitting working very hard, you have worked for a long time trying to open a safe. Then some Joe comes along who knows nothing about what you are doing, except that you are trying to open the safe. He says ‘Why don’t you try the combination 10:20:30?’ Because you are busy, you have tried a lot of things, maybe you have already tried 10:20:30. Maybe you know already that the middle number is 32 not 20. Maybe you know as a matter of fact that it is a five digit combination… So please do not send me any letters trying to tell me how the thing is going to work. I read them — I always read them to make sure that I have not already thought of what is suggested — but it takes too long to answer them, because they are usually in the class ‘try 10:20:30’.

(“Seeking New Laws”, page 161 in The Character of Physical Law.)

Traditional iron triangle

How many times have we heard the same old musty argument about the iron triangle ?

Iron triangle

Don’t be deceived by this project management technique.

Here are two arguments(Jim HighSmith and Steve Denning ) against it that I like. My opinion is that they are against using this technique if other more agile values are being ignored.

I am actually collecting evidence to disprove some of these old project management techniques.

Follow

Get every new post delivered to your Inbox.