My dad told me that it’s best to invest on real estate like a house or a condo unit because its value appreciates as time goes by. Yes, I agree. And because people like me who’s not born rich, starts from the bottom going up the ladder. If that’s the case then it means that the state of being rich is low when you start working and it goes up as time flies. This concludes that the hindrance for abundance is ‘time.’ That’s because everything takes time yet life is short.
Anyway, another thing my dad told me was that investing in cars and technology (i.e. expensive cellphones/laptops) is bad because its value depreciates in a short span of time. As Moore’s Law applies in essence, the value of a gadget is half after less than a year in parallel with a technology that is double the power of the current one. Also, the value of a car depreciates drastically while its maintenance is very expensive. So, it’s still impractical to get one when you have a lot of other more important priorities that you support financially.
A couple of weeks ago, my dad gave my a new Toyota Innova J series (Diesel). It’s the cheapest among the Innova series but I would agree that the differences vary very slightly like accessories and such. But the important thing is the engine, which is good because it has the same engine as the Fortuner. It also has comfortable seats good for 8 people and a compartment at the back. So, the mission given to me is to survive a life with a car. My philosophy always says “practicality and simplicity.” At first I don’t really like having a car because it’s expensive etc. But now that I have one already, then it’s time to use it in the most practical and simplest way possible.
I did a lot of changes in my car style when I handled the Innova. Vast changes occurred and that’s because it’s my responsibility now:
I don’t rush when I drive. Never anymore. When there’s a jeepney trying to cut my way even if the driver counter flowed, I’d still give him the space. That’s because I know it’s a pain in the ass if the jeep bumps on me and I would to pay for the repairs.
I always try my best to drive in the coolest way possible. My average speed in the highway is just 60kph. I don’t race with other cars even if they’re provoking me to. I don’t speed up when it’s Yellow in the traffic light. Instead, I start slowing down and hit the brakes even if it’s not turning fully stop yet.
I don’t try to play with vehicles who are very careless. I sound the horn very loud so they would know that somebody is beside or near them even if they get annoyed.
I don’t rush on bumpy and moon-styled roads. I drive slowly to avoid all those holes and other road texture problems. I don’t mind anymore even if the car behind me is rushing (unless it’s an ambulance) and keeps on sounding the horn so I would rush.
I clean the car very often both external and internal. I do the cleaning or sometimes the car wash boys do it. But I have my own stuff as well. I don’t want the car look dirty.
I want the car to be safe. My dad started it with an centralized lock with an alarm. I do have my own security by putting lock on the steering and the brake pedal. I also invest in putting the car in a safe parking lot with a roof even it costs quite expensive. And everywhere I go, before I bring the car to the destination, I make sure that there’s a secured place for the car to stay.
And I learn how to look for the cheapest gasoline stations in the area to maximize my money. I also learn how to look, study and measure all the routes when going to office, Cavite etc. to be able to maximize the gas. It makes me learn a lot actually. I get exposed to shortcuts and alternative roads.
In the end, even if it’s just a month old, I feel like I’m already raising a child. Taking care of a car is so expensive. But it makes you more responsible and mature. At the same time, you get the comfort that some don’t experience.
Understanding Ecatel
By Justin David Pineda
Some people have been visiting to websites hosted in Europe which are part of the Ecatel network. Seclist says that the Ecatel network is the source of a rootkit callesd Zero Access, “…purpose of this rootkit is to set up a stealthy, undetectable and un-removable platform to deliver malicious software to victim computers.” [1] As of writing, the Elcatel Network is rated second, in the Top 10 Hosts Bad for the 1st quarter of 2011. [2]
A malware site has only one goal: to do something bad to you like getting confidential/private information and doing something harmful to your computer. Considerably, many sites under the said network are considered harmful but of course, we cannot generalize that all of them are. But since it’s coming from the same network, then we might consider it as suspicious.
The Ecatel Network is part of the Russian Business Network (RBN) which is known for cybercrime activities since 2007. News also say that Russian authorities don’t give enough attention to the cybercrimes made.
A lot of articles tell that this particular network is noted for spammers. Spamhaus event named it as “The Most Notorious Spammers.” Further, it listed 15 known sites which were classified as popular for Zeus Botnet Command & Control Activity, Showshoe Spam Sources, Heavily Abused Redirect, Botnet Pharma Spammers and Cybercrime Hosting of Fake A/V Malware. [4] It also plants rootkits on infected machines which can monitor and control personal workstations illegally. Some sites under Ecatel also trick users of Fake Antivirus crimeware. These crimeware resulted to more than 250,000 computers became affected. [5]
To make our measurement of Ecatel Network’s maliciousness quantitative, let’s look at the numbers: [6]
1 Zeus server
3285 malicious URLs
1076 badware instances
846 spam bots
16 spam IPs
Here are also the IP addresses that are considered the “dangerous” as related to Ecatel Network: [7]
62.41.26.0/24
62.41.27.0/24
89.248.160.0/21
89.248.168.0/24
89.248.169.0/24
89.248.170.0/23
89.248.172.0/23
89.248.174.0/24
89.248.175.0/24
93.174.88.0/21
94.102.48.0/20
94.102.49.0/24
94.102.62.0/24
Now that we know some knowledge about Elcatel and how it can affect us then I suggest that we do best practices when doing transactions through the net. Of course, it’s good to have an AV with updated set of signatures. I know that new malwares are emerging everyday but AV will also help somehow. We should also have our personal firewall installed because it will help in classifying rules. For example, there might be site redirection and might bring you to a malicious site. If the firewall has restricted that particular IP/URL to your network, then it can’t enter. And try to avoid going to sites that you are not familar with. Chances are, it may be a malicious site. But when that comes and there’s a pop-up that says that you need to run this kind of AV, you know that it is a Fake AV. So don’t.
Finally, as what I always say when there is an infected workstation, remove it from the network immediately and run an AV with updated set of signatures. But to be sure, it is a best recommendation to re-image the system to completely remove any malware.
References:
[1] Reverse Engineering the source of the ZeroAccess crimeware rootkit from http://seclists.org/pen-test/2010/Nov/33
[2] Top 10 Bad Hosts – 2011 Q1 from http://www.hostexploit.com/
[3] Shadowy Russian Firm Seen as Conduit for Cybercrime from http://www.washingtonpost.com/wp-dyn/content/article/2007/10/12/AR2007101202461.html
[4] The Spamhaus Project Reports Ecatel.net Network Host The Most Notorious Spammers Cybe from http://www.scamfraudalert.com/identity_theft_phishing_spam_blackmails/13773-spamhaus_project_reports_ecatel_net_network_host_most_notorious_spammers_cybe.html
[5] White Hat Hacker Cracks ZeroAccess Rootkit from http://www.informationweek.com/news/windows/security/228300156
[6] AS29073 – ECATEL-AS from http://badhost.info/AS29073
[7] Ecatel: Need more proof of their being crimeware? from http://hphosts.blogspot.com/2010/04/as29073-ecatel-need-more-proof-of-their.html
NETWORKING 101
By Justin Pineda
This article is created to serve as an introduction to basic networking concepts. This involves some discussion about the Internet, network devices, how it works and the like. We will also talk about some technical concepts for us to better understand the networking process (i.e. how a data is transmitted over the network).
Introduction
In today’s world, the Internet plays a vital role in communication. Everything became easier because of the Internet. Distance is not a barrier anymore. Before the arrival of Internet, the popular mode of communication to far places requires time, like when sending a mail for example. Now, it’s just a click away through e-mail. We can also talk to our friends real-time through Instant Messenger (IM). Now, do you know how data is transmitted to your friend when you chat?
A normal flow of communication contains a sender, a receiver and a channel. This also applies to a network. But of course, aside from the humans, devices also play its role. When you chat for example, the data is translated into a series of numbers which we call binary numbers (1 & 0) to be understood by the computer and to be able to send it to its proper channel. There is a process of converting these messages to binary numbers through layers and network protocols.
Elements of a Network
As mentioned, the communication process for computer networking remains the same. What we need to understand now are things that make up the communication for computer networking. There are four elements:
1. Rules
Like when sending a snail mail to a friend, there are procedures on how to successfully send it. This includes putting it in an envelope, writing the address both of the sender and receiver of the mail at the back of the envelope and putting stamps. This is same with networking where rules, which are technically termed as protocols, define how the data is sent.
2. Message
Message is the actual data itself. It is the file that you have sent through email. It is the video you are waiting to view in You Tube. This is the message in the letter you sent. This is self-explanatory.
3. Medium
The medium is the element that says in what way the message is sent. For example in networking, for a typical Local Area Network (LAN), standard workstations are connected through a cable (a straight cable to be exact) while other laptops/net books connect via Wi-Fi (Wireless Fidelity).
4. Device
Of course, the device is an essential element as well. Different devices have their own role. Computers are used by the end users and these are connected to a switch and data are transmitted by a router to another.
These elements comprise the network. We will take a look at each element and give more details to each one of them.
Network Architecture
If you are tasked to create a network, what will your basis be? Will you just buy workstations and connect them in a switch? There are concepts you need to consider in order to build a good network. You need to design your network based on the following key factors:
1. Fault Tolerance
In creating a network, you shouldn’t think of an ideal scenario where everything is all right. You have to think of possible problems which your network might encounter. For example, you put all your workstations connected in one switch. You find it very easy to do, setup and configure. But what happens if the switch goes down? Then your network will go down as well. Fault tolerance refers to the capability of the network to withstand forms of interruptions of its service. So most cases, there are back up servers, generators and network planned topologies in order to cater this particular concern.
2. Scalability
So you have created the fault tolerant network that is good for the users in it. But is your network ready for a dynamic environment? Have you considered that the network may grow and will require more space, bandwidth etc? Scalability refers to the capability of the network to adjust in changes in the components of the network, may it be the number of users or devices.
3. Security
When you design your network, considerations must be made in order to group workstations based on security importance. What is security in this context? Security refers to giving access that is only needed by a particular type of user. For example, company reference materials should only be available within the company’s network. External users should not be able to access these files. These particular privileges of access should be determined in the network design. The example I gave is what we call Intranet, which means access only “inside” the local network. You have to consider which part of the network should be given Admin access, User access and Guest access.
4. Quality of Service (QoS)
The demands for network bandwidth vary from the type of work that people have. Which is more likely to consume more network bandwidth, the cashier or the web developer? You need to give priority over the ones who need more. In the field like IT Security, Security Analysts like me need more bandwidth because we are all connected to the Internet and all our work relies on having good network connection access.
Network Communication
So let’s say that you try to send an e-mail through http://mail.yahoo.com. The first thing you do is to type the Uniform Resource Locator (URL) of the website which is – http://mail.yahoo.com. The URL is equivalent to an Internet Protocol (IP) address which is represented by numbers. We have URL’s so that we don’t need to remember numerical forms of addresses. Instead, we just type it based on the name that we associate with it like “mail” and “yahoo.” A particular protocol which is the Domain Name System (DNS) resolves the URL to its corresponding IP address. So think of the IP address a Website ID and the URL as the Website name.
The image above shows how the personal workstation travels going to http://mail.yahoo.com with IP address – 203.84.219.114.
I just showed you how data travels to the domain Yahoo. Anyway, when the website appears in a web browser like the Internet Explorer or Mozilla Firefox, the data from the Yahoo site goes to your network and displays it. So from data understandable by the user, it goes through different layers which translate this data understandable by machines that can travel through different media (such as cables, atmosphere etc). A reference model is used for protocol classification per layer. We call it the Open Systems Interconnection (OSI) model. The OSI model has 7 layers which defined to sort of give us an understanding of how data is transmitted and retransmitted.
So going back to the Yahoo mail site, the user interface that we see in the web browser is in the Application Layer of the OSI model. This is the topmost layer of the OSI model. This is quite easy to understand since the Application Layer gives interface of the data to the user. For this example, the protocol used is Hyper Text Transfer Protocol (HTTP). HTTP is a protocol used to be able to browse web pages. There are a lot of Application Layer protocols aside from HTTP.
The next layer is the Presentation Layer. Its main responsibility is to do compression/decompression, coding, conversion and encryption/decryption. For example, when you load an HTTP, when we try to save images, there’s a default “Save As” to type of image which the site dictated what it should be like .jpg, .gif etc. Same is true with video types and media files. Sometimes for proprietary sites they have their own extensions.
After the data is compressed, converted and coded, it checks the status of the data and connection. Did the data go to the correct destination? Is the connection active or not? Is the device idle or has been receiving information?
Let’s now go to the next layer called the Transport Layer. This layer is responsible for determining the kind of services the client/server are running and directing this particular service to the right port. For example, when you visit the site http://mail.yahoo.com, you go to a particular IP address 203.84.219.114. This particular domain might be running different services. Like for example, if you open its site through HTTP, it actually connecting to Yahoo’s domain through port 80. If you are trying to send an e-mail through Yahoo mail, a connection is made through port 25 which is Simple Mail Transfer Protocol (SMTP).
There are two popular protocols under the Transport Layer- User Datagram Protocol (UDP) and the Transmission Control Protocol (TCP). The former is connectionless while the other is connection-based. There are services that are considered very essential to have an established first to make that the communication of data is received successfully. The three way handshake is a process used by TCP to ensure that connection is established before transmitting data. For example, in SMTP, the sure way to send an e-mail is to established a connection between the client and the server. Otherwise, we are not sure whether the data is sent properly or not.
Basically, we learned how services are connected through ports. But before we’re able to send the data to the right service, we have to send the data to the right network. This what makes the IP address necessary. This next protocol is called the Network Protocol. An IP address can be private or public. A private IP is an address given by a router used for local network. These include IP families from 192.168.x.x, 172.x.x.x and 10.x.x.x. Any IP addresses under those mentioned families are considered to be private. Public IP’s are numbers otherwise and doesn’t exceed 255.255.255.255. There are other conditions though. But for simplicity sake, public IP’s are those that host a site for a particular organization.
Each Local Area Network (LAN) has a gateway. When a particular host tries to send a data to another IP, it first checks whether the said destination IP is found within the network. If it finds it, then it is send directly to it. However for most cases, the destination is outside the LAN. Now, a target IP that is not found on the LAN is directly sent to the default gateway. This gateway passes the data to other routes in order to find the right destination. The router has three processes: forward the packet to the next route, deliver the packet to the destination or drop the packet. There are mechanisms through routing protocols used on how to determine best paths for data routing.