Egyptian Hackers

The following post has been published on Eglug (Egyptian Linux Users Group) by printf@drupal.org,

I was just wondering if anybody would be interested in such an event? Basically, it should be something like DEF CON, but with more focus on introducing the concepts of and raising the public awareness about the digital world's (in)security as well as providing some means of legal entertainment for the ones with advanced skills. My initial plan was to organize a 2-3 days event with talk sessions/discussion forums about different topics in computer security and on the side a series of challenging games to test the players skills and knowledge.

It is really nice idea to have such kind of events here in Egypt, but the problem is that it is only few people who know what hacking really is. Most of the people here in Egypt and the Middle East think of hacking as the art of using some software tools to get some credit cards numbers or send zillions of packets to a web server to take it out of service. For me, hacking is the art of pushing a system beyond its limits, or forcing it to do things beyond the normal usage of it. I think we may encourage people to participate in some projects like porting linux to new hardwares (smart phones, play station, DSL modems, etc), writing some kernel modules, finding back-doors in some protocols or standards and create tools to use such vulnerabilities, etc.

However we may arrange for such meetings in parallel. A good starting point is a Call for Papers where people shall send some articles or ideas for topics they may talk about. One more thing is having a wiki, which is already there, but more people are encouraged to participate and share their ideas there.

Tags: Hacking, Linux, Gr33n Data

P2P Web Hosting

I have an idea fo creating a P2P network - like Gnutella, eDonkey2000, or FastTrack - to be used for hosting web pages. This can minimize the cost of getting a dedicated server and domain names. A web site is a group of files (HTML, PHP, images, etc) having the same ID (protocol://site-name.com). A person can initially have thes pages on his PC and allow them to be shared by the P2P Client/Server when someone requests a page from that site the page is downloaded from the initial host, and cached on the requesters machine as well. Further requesters can retrieve the pages from any of them. The more popular the site is the more hosts it is cached on. This may also help in thecase of free-riders. One problem here is generating the site-names as they must be unique across the whole network, but I think that some distributed Naming Service Data Base can help.

*** Added on 28 January, 6:44 PM ***
It came out that there is such thing already, see Freenet Project
http://freenet.sourceforge.net/

Tags: P2P, Internet, Gr33n Data

Cambridge English Dictionary

You are looking for the meaning of an English word, and Google is not very helpful?
Here you are Cambridge Online English Dictionary to search in.

http://dictionary.cambridge.org/
You may also use the following HTML code to add a link to this post on your own blog or web page:
<a href="http://gr33ndata.blogspot.com/2005/10/cambridge-english-dictionary.html"> Cambridge English Dictionary </a>

Tags: English, Dictionary, Gr33n Data

Cross Site Scripting - XSS

Ok, I cannot find any good definition on XSS, so let me write my own one instead.

*** FIXME *** Cross Site Scripting (XSS): Is one of code injection attacks where the attacker inserts some code (or data in general) in a web server in order for that web server (or the victim's web browser) to show or execute that inserted data. *** FIXME ***.

There are three different types of XSS attacks according to wikipedia; however I am going to talk about the third type (Type number 2) here as it is the most interesting and dangerous.

Imagine a web forum where different users can post articles and comments etc. So an attacker can forge his post to contain some HTML tags or JavaScript in stead of clear text. So the result will be the execution of that HTML tags or JavaScript in the other forum visitors' browsers. This can be some HTML tag to redirect users to his own web page, or a JavaScript that can display an annoying message, steal the users session-ID (their logging to that forum), pop-up some window asking them about some info and then sending this info (like credit card number, email address, etc.) to some remote location.

This attack is not limited to web forums only as it can target any sites that takes input from users and displays this input later like blog comments, movies reviews, online web chatting systems, online computer games, etc. Emails can also carry such attacks but it may be called phishing, or Email fraud then.

Many solutions have been used in order to stop such attacks like disabling HTML tags or converting them to normal text before displaying them. Some forums use their own limited tags like [link:"http://www.linux.org"] or [b] and [/b] etc.