Category: technology


A memory leak is an unintentional form of memory consumption whereby the developer fails to free an allocated block of memory when no longer needed. The consequences of such an issue depend on the application itself. Consider the following general three cases:

Case Description of Consequence
Short Lived User-land Application Little if any noticable effect. Modern operating system recollects lost memory after program termination.
Long Lived User-land Application Potentially dangerous. These applications continue to waste memory over time, eventually consuming all RAM resources. Leads to abnormal system behavior
Kernel-land Process Very dangerous. Memory leaks in the kernel level lead to serious system stability issues. Kernel memory is very limited compared to user land memory and should be handled cautiously.

Memory is allocated but never freed.

Memory leaks have two common and sometimes overlapping causes:

* Error conditions and other exceptional circumstances.
* Confusion over which part of the program is responsible for freeing the memory

Most memory leaks result in general software reliability problems, but if an attacker can intentionally trigger a memory leak, the attacker might be able to launch a denial of service attack (by crashing the program) or take advantage of other unexpected program behavior resulting from a low memory condition

Advertisements

Google has announced a new tool that makes public the government requests it receives for data and content removal. It’s called Government Requests, and it currently shows requests that Google received between July 1 and December 31, 2009.

FYI India has asked

  • 1061 data requests
  • 142 removal requests (see pic & link)

Google admits that these numbers are imperfect and may not provide a complete picture of these government requests in a very detailed FAQ.

Google says it will update the tool with new data in six-month increments, and that the company intends to “provide more detail about our compliance with user data requests in a useful way” in the future.

Here is the link

Google is implementing a new policy to help you know if your account may have been compromised. It uses the general location and timing information to see if it is likely someone else is signing on. It will not help if the hacker locks you out of your account, but could save you if the person is ‘ghosting’ under the radar.

http://gmailblog.blogspot.com/2010/03/detecting-suspicious-account-activity.html

“You may remember that a while back we launched remote sign out and information about recent account activity to help you understand and manage your account usage. This information is still at the bottom of your inbox. Now, if it looks like something unusual is going on with your account, we’ll also alert you by posting a warning message saying, “Warning: We believe your account was last accessed from…” along with the geographic region that we can best associate with the access.

To determine when to display this message, our automated system matches the relevant IP address, logged per the Gmail privacy policy, to a broad geographical location. While we don’t have the capability to determine the specific location from which an account is accessed, a login appearing to come from one country and occurring a few hours after a login from another country may trigger an alert.

By clicking on the “Details” link next to the message, you’ll see the last account activity window that you’re used to, along with the most recent access points.

If you think your account has been compromised, you can change your password from the same window. Or, if you know it was legitimate access (e.g. you were travelling, your husband/wife who accesses the account was also travelling, etc.), you can click “Dismiss” to remove the message.”

Previously when someone in China used to type 法輪功 or “Falun Gong” into Google’s search engine from Beijing (www.google.cn), then suddenly his Web browser becomes unresponsive for about a minute…
Now thanks to google for switching its search engine operations from mainland china to HongKong there is no censorship on this spiritual movement banned by the Chinese government and many other search phrases like Tibet and searches for missing Chinese activist lawyer Gao Zhisheng, jailed Chinese dissident Liu Xiaobo, Chinese President Hu Jintao and “June 4 incident” — known elsewhere as the 1989 Tiananmen Square crackdown.
Now when you open http://www.google.com.cn it redirects to http://www.google.com.hk/

Recent searches for taboo topics from Beijing generally produced “page cannot be displayed” errors. The user’s browser stops working for about a minute, longer if one tries to access forbidden sites in quick succession. In other words, it’s not just the links to those sites that don’t work; the results don’t come back at all.

Yet the filters aren’t exact, and English-language sites have a greater chance of slipping through, partly because the government is more concerned about the vast majority of citizens who speak only Chinese. And even as the Great Firewall blocks Twitter and sensitive blog postings, excerpts do show up on Google’s search results page.
Before Google killed its mainland search service Monday and redirected “Google.cn” traffic to its existing Hong Kong-based site, Google returned censored results with a note explaining that some items had been removed. Google needed to comply with Chinese laws, but it wanted users to know about the omissions in hopes they would pressure their government to lift restraints.

But Google announced January 12 that it was no longer willing to censor those results after it discovered it was the target of hacking attacks originating from China. Unable to reach agreement with the ruling party on running an uncensored search service, Google decided to send mainland users to Hong Kong, a Chinese territory that is semi-autonomous because of its past as a British colony.

While looking for a freeware tool or plug-in to check current session level cookies I found a firefox extension that allows me to watch selected cookie in a statusbar.
It is a simple extension. It helps testing web applications – it quickly can wipe ‘session’ cookie or it helps to identify cluster node in clustered environments using cookie value.

Download it here.

~Himanshu~

Here is one Security Testing Checklist that may help you
1. Are all the Internet-facing servers within the system registered with the corporate web office?
2. Do the test plans for the system include tests to verify that security functionality has been properly
implemented?
3. If the system is rated high on the business effect assessment or if it is Internet facing, has the
company security office been consulted to determine whether or not additional security testing
is required?
4. Has the security test covered the following?
a. application testing
b. back doors in code
c. denial of service testing
d. directory permissions
e. document grinding (electronic waste research)
f. exploit research
g. firewall and application control list
h. intrusion detection systems
i. manual vulnerability testing and verification
j. network surveying
k. password cracking
l. PBX testing
m. port scanning
n. privacy review
o. redundant automated vulnerability scanning
p. review of IDS and server logs
q. security policy review
r. services probing
s. social engineering
t. system fingerprinting
u. trusted systems testing
v. user accounts
w. wireless leak tests

Regards,

Himanshu

Upgraded to WordPress 2.7.1

I have today upgraded my blog to WordPress 2.7.1 which is a a maintenance release, upgrade was very easy as WordPress 2.7 gives you an option to do it automatically whenever a new update is available.

In the release Sixty-five files were modified with 68 bug and feature fixes and improvements.

Some of the fixes and feature improvements include:

Some additional security measures were taken in this release to make protect it from future vulnerabilities as part of the ongoing work by WordPress to make it as safe and secure as possible.

According to the WordPress Download Counter, WordPress 2.7 has been downloaded 1,872,184 times since December 10, 2008