Phishing - We are in six month high

A couple of months back, my friend and I spoke at a Conference on Software Testing held at Bangalore on Web Application Security. It was a just few days after one of the famous Indian bank's E-Banking website was attacked. The attacker launched the attack from Asia and the news came in almost all popular dailies.

Roughly after six months, today, I happened to read an article on Phishing which says that Phishing is very active and more than 150 banks globally are targeted. Phishing is at six month high. I am sure the list will contain the bank where I hold an account. There are many fraudulent companies which setup web site simple for grab the data and before the world identifies that it is phishing, the attacker would have stolen enough. However, the security agencies need to protect others from falling prey further.

Though the way the software is built itself is an issue, we cannot the entire blame on the software developers :-(. Each one of us, as the users should have security awareness. But the important thing is that we, the normal human being (layman) never try to understand the techniques used by attackers and we don't even care thinking that the probability being stolen due to phishing is very less. You are absolutely right, the probability is less and not zero. We never really care about the current trends in web attacks and certain basic security awareness is very much crucial.

Here are some of the points that one needs to care
1. Try to avoid logging from public systems like Internet cafe
2. Whenever you log off, delete all the history and cookies
3. Don't not click the images in the web banking sites
4. Do not launch your e-Banking website through a hyper link from an external website.
5. Take time to read the address in the address bar. Check whether the address exactly matches the address of your bank's website. Make sure that first part of the address, the protocol, is "https". These days none of the banks and commercial websites use "http".
6. Do not save passwords in the browser and do not be lazy to key in your password everytime.
7. Periodically, change your passwords and use strong passwords (with alphabets, numbers, special characters)
8. Since most of the phishing takes place through fraudulent emails, ensure that you different between the emails from your bank and the attacker. You can find some ways of identifying phishing email in one of my previous blogs.
9. Above all, if you happen to receive any phishing email, report to your bank as they can sensitize other account holders.

And now, if you have time and energy, just go and read about security and phishing especially. :-)

JVM it too Hot with HotSwap

Right from my first encounter JVM, it amazed me. Before working on Java, I never got a chance to read the internals of any interpreter. I started to read the internals of JVM and roughly three years before I read about Java Platform Debug Architecture. I tried writing simple debugger agent using Java Virtual Machine Tool Interface, Java Virtual Machine Debug/Profile Interface (both deprecated) and Java Debug Interface.

Apart from being specifications and methodologies to write tools, these specification can help you a lot to understand JVM deeply. Recently, I was reading through HotSwap and suddenly wanted to write a simple tool using which I can reload classes in a live remote JVM. I was successful in loading the class. The only disadvantage is that you cannot reload the class if you have added any new members to it. However, this is the limitations of JVM which may be addressed in upcoming Java major release. The rest of this write up gives you, the specification and algorithm (simple steps) used.

Specification
Write a simple tool which let you to reload classes in a running JVM without restarting your application. Also provide a simple user interface (probably using SWING).

Steps
1. Use Java Debug Interface API to connect to remote JVM. In order to connect to remote JVM, you the hostname/ip address of the remote box and port number on which your JVM runs. In order to hotswap the classes, you need start JVM in debug mode and if you start JVM using "socket" debugger.
2. Also subscribe for few important events such as JVM Exit, Disconnect Event. (for more info refer Java Debug Interface API Spec).
3. If the connection is successful, you get an instance of the remote JVM and you can once again use JDI to replace classes.
4. You have to write the logic of reading the class file (flat file) from the file system and give to JDI. JDI pumps the class file to remote JVM which reloads the class after making lot of checks.

Good to see myself scratching my head

I started blogging ambitiously and also had promised myself that I would be reading and writing quite often. Yet again, I broke my promise. Never mind as long as you highest expectations, it is a fair deal. It is always better to have a great failure than mediocre results. The confession is enough and let us get ready straight away.

Let me start with a simple question “In Java, why synchronization is so important and avoiding over synchronization is much more important?” Probably, from a bookish guy one can expect the answer for the first part of the question. But in order to understand and answer the second part, you need to get to your refrigerator and have to gulp of citrus drink. One needs to understand the internals of JVM or should have known little bit on JVM. Believe me, it is thrill to learn the answer for the second part.

I have found the answer and in coming days, you can find a detailed article right here…

Until then, keep exploring. Happy learning

UNIX Process - Learning of a Classic never ends

Learning never stops and if it is a classical subject every becomes teacher in no time and student in no time. With a bit of optimism, let me put my thoughts here. Surely comments are welcome and all comments will be put in the hall of fame of this online magazine.

Today, I got sometime to think :-) and thought that I should start writing on processes. For anyone who is new/old the right place to get a start is process. Before getting started, the objectives of this entire article to discuss on process with sufficient details. Moving forward, this blog will have tutorials/scribblings on Unix Externals/Internals.

1. What is process? How it looks like?
2. As an user how one can see the process in your Unix/Linux System?
3. What are various states of process? How they transition?
4. What are the important terminology and data structure needed to continue my journey?
5. Why I need kernel to run my process? I have written "Hello, World" program, why I need kernel to run and get the output?
6. What are various modes/context?
7. How processes switch between modes and contexts? What is the object of those switches?
8. What are the commonly used commands/utilities that are related to the process/process management?
9. Is it going to be a theory? Can you give me code and explain stuffs? Can you also give me license to use the example as per my wish?

Aspiring journey towards UNIX System programming

It was official hang over with Java for the past three years and within these years the things have changed a lot. I never thought or expected to become a Java programmer however I m successfully traveling in the world of Java for the past three years. Personally, I had a lot of learning and it is in fact most fulfilling learning experience in my life time. Having written bunch of articles in Java Technology (it doesn’t necessarily mean that I m an expert), I m thinking to shift gears. I am planning to enter into Unix System Programming world.

UNIX/Linux as an operating system and a programming environment excites me simply because of being simple. Few years back, I was dreaming that I would become an operating system programmer but ended up being an application developer. But I never felt guilty as I always dedicated my time to read Linux internals. Thanks to the authors of Linux Kernel Development and Understanding the Linux Kernel. Now, I am seriously thinking of learning for heart. Yes, learning what my heart likes.

So my agenda for 2008 is to become a better programmer and learn UNIX System programming, UNIX/Linux Internals and Linux Kernel programming. This seems to be over ambitious goal because UNIX/Linux by know means little operating systems. It really takes considerable of time to understand the internals of the both the operating system. So, let me see how far I come close to my target in 2008. When I say, learn I really mean learning UNIX/Linux as both Art and Science.

Keep watching, suddenly you may find interesting write-ups. It is a matter of time. Unlike the sensex, you will find a lot articles in holidays/weekends :-)

Wishing Everyone, a Very Happy New Year