What is Secure Sockets Layer (SSL) and How it Works

 Posted by Nishanth Singamala

Secure Sockets Layer (SSL) is the most widely used technology for providing a secure communication between the web client and the web server. Most of us are familiar with many sites such as Gmail, Yahoo etc. using https protocol in their login pages. When we see this, we may wonder what’s the difference between http andhttps.

In simple words, a HTTP protocol is used for standard communication between the Web server and the client. HTTPS is used for a “Secure communication”.

How Secure Sockets Layer Works?

Before we understand the concept of SSL, let us first learn what a “Secure Communication” means. Suppose there exists two communicating parties: Say A (client) and B (server).

Working of HTTP:

When A sends a message to B, the message is sent as a plain text in an unencrypted manner. This is acceptable in normal situations where the messages exchanged are not confidential. But, imagine a situation where A sends a PASSWORD to B. In this case, the password is also sent as a plain text. This has a serious security problem because, if an intruder (hacker) can gain unauthorized access to the ongoing communication between A and B , he can easily obtain the PASSWORDS, since they remain unencrypted. This scenario is illustrated using the following diagram:

Now let us see the working of HTTPS:

When A sends a PASSWORD (say “mypass“) to B, the message is sent in an encrypted format. The encrypted message is decrypted on B‘s side. So, even if the Hacker manages to gain an unauthorised access to the ongoing communication between A and B he gets only the encrypted password (“xz54p6kd“) and not the original password. This is shown below:

How is HTTPS implemented?

HTTPS is implemented using Secure Sockets Layer (SSL). A website can implement HTTPS by purchasing an SSL Certificate. Secure Sockets Layer (SSL) technology protects a Web site and makes it easy for the site visitors to trust it. It has the following uses:

1. An SSL Certificate enables encryption of sensitive information during online transactions.
2. Each SSL Certificate contains unique and authenticated information about the certificate owner.
3. A Certificate Authority verifies the identity of the certificate owner when it is issued.

How Encryption Works?

The whole concept of Secure Sockets Layer is implemented on the basis of RSA algorithm where each SSL Certificate consists of a Public key and a Private key. The public key is used to encrypt the information and the private key is used to decrypt it. When your browser connects to a secure domain, the server sends a Public key to the browser to perform the encryption. The public key is made available to everyone but the private key(used for decryption) is kept secret. So, during a secure communication, the browser encrypts the message using the public key and sends it to the server. This message is decrypted on the server side using the Private key(Secret key).

How to Identify a Secure Connection?

In the Internet Explorer and most other browser programs like Firefox or Google Chrome, you will see a lock icon  in the Security Status bar. The Security Status bar is located on the right side of the Address bar. You can click the lock to view the identity of the website.

In high-security browsers, the authenticated organization name is prominently displayed and the address bar turns GREEN when an Extended Validation SSL Certificate is detected. If the information does not match or the certificate has expired, the browser displays an error message or warning and the status bar may turn RED.

So, the bottom line is, whenever you perform an online transaction such as Credit card payment, Bank login or Email login always ensure that you have a secure communication. A secure communication is a must in these situations. Otherwise there are chances of a Phishing attack using a fake login page.

I Hope you like the information presented in this article. Please pass your comments.

What is MD5 Hash and How to Use it

 Posted by Nishanth Singamala

In this post, I will discuss about one of the interesting cryptographic algorithm calledMD5 in a very simple and easy to follow manner. In addition to understanding what is MD5 hash, you will also learn how to make use of this algorithm in your daily life.

What is MD5 algorithm?

MD5 which stands for Message Digest algorithm 5 is a widely used cryptographic hash function that was invented by Ronald Rivest in 1991. The idea behind this algorithm is to take up a random data (text or binary) as an input and generate a fixed size “hash value” as the output. The input data can be of any size or length, but the output “hash value” size is always fixed. Here is an example of MD5 Hash function at work:

As you can see from the above example, whatever the input size you give, the algorithm generates a fixed size (32 digit hex) MD5 hash. You can even try this on your own using the MD5 hash generator tool here.

Applications of MD5 Hash:

Before I tell you about how to use MD5, I would like to share one of my recent experience which made me start using MD5 algorithm.

Recently I made some significant changes and updates to my website and as obvious, I generated a complete backup of the site on my server. I downloaded this backup onto my PC and deleted the original one on the server. But after a few days something went wrong and I wanted to restore the backup that I downloaded. When I tried to restore the backup, I was shocked! The backup file that I used to restore was corrupted.

That means, the backup file that I downloaded onto my PC wasn’t exactly the one that was on my server. The reason is that there occurred some data loss during the download process. Yes, this data loss can happen often when a file is downloaded from the Internet. The file can be corrupted due to any of the following reasons:

• Data loss during the download process, due to instability in the Internet connection/server.
• The file can be tampered due to virus infections or
• Due to Hacker attacks.

So, whenever you download any valuable data from the Internet, it is completely necessary that you check the integrity of the downloaded file. That is, you need to ensure that the downloaded file is exactly the same as that of the original one. In this scenario, the MD5 hash can become handy. All you have to do is generate MD5 hash (or MD5 check-sum) for the intended file on your server.

After you download the file onto your PC, again generate MD5 hash for the downloaded file. Compare these two hashes and if they match, that means the file is downloaded perfectly without any data loss.

A MD5 hash is nothing but a 32 digit hexadecimal number which can be something as follows:

A Sample MD5 Hash

e4d909c290d0fb1ca068ffaddf22cbd0

This hash is unique for every file irrespective of its size and type. For example, two different executable files (.exe files) with the same size will not have the same MD5 hash even though they are of same type and size. So MD5 hash can be used to uniquely identify a file. The same thing applies even for messages where each message that was sent and received can be verified using the MD5 hash.

How to use MD5 Hash to check the Integrity of Files?

Suppose you have a file called backup.tar on your server. Before you download, you need to generate MD5 hash for this file on your server. To do so use the following command:

For UNIX:

md5sum backup.tar

When you hit ENTER you’ll see something as follows:

e4d909c290d0fb1ca068ffaddf22cbd0

This is the MD5 hash for the file backup.tar. After you download this file onto your PC, you can cross check its integrity by again re-generating MD5 hash for the downloaded file. If both the hash matches then it means that the file is perfect. Otherwise it means that the file is corrupt. To generate the MD5 hash for the downloaded file on your Windows PC use the following freeware tool:

MD5 Summer

I hope you like this post. For further doubts and clarifications, please pass your comments. Cheers!

How Windows Product Activation (WPA) Works?

Posted by Nishanth Singamala

Windows Product Activation or WPA is a license validation procedure introduced by Microsoft Corporation in all versions of its Windows operating system. WPA was first introduced in Windows XP and continues to exist in Windows Server 2003, Windows Vista, Windows Server 2008 and Windows 7 as well.

WPA enforces each end user to activate his/her copy of Windows so as to prevent unauthorized usage beyond the specific period of time until it is verified as genuine by Microsoft. How WPA really works was a closely guarded secret until GmbH analyzed WPA using a copy of Windows XP RC1 and published a paper on their findings.

In this post you will find answers to some of the most frequently asked questions about Windows Product Activation.

Why activation?

Microsoft’s intention behind the activation is to limit the usage of its Windows operating system to only one machine for which the retail license is issued. Any other computer which runs on the same license must be disallowed from using the software. Hence, WPA demands for activation of the product within 30 days of its installation so as to ensure that it is genuine.

What does “Genuine Windows” means?

The copy of Windows is said to be genuine only if the product key used during the installation is genuine. It means that a given product key (retail license) must be used to install Windows only on one computer for which the license was purchased. Thus, if the same key is used for the installation on another computer, then it is said to be a pirated copy.

Exactly what information is transmitted during the activation?

When you activate your copy of Windows, you are transmitting an Installation ID code to Microsoft either by phone or Internet depending on the method you choose to activate. Based on this, the Microsoft’s licensing system can determine whether or not the installed OS is genuine. If it is said to be genuine, then the system will receive the Activation ID which completes the activation process. If the activation is done through a telephone, the Activation ID needs to be entered manually to complete the activation process.

What information does the Installation ID contain?

This Installation ID is a 50-digit number which is derived from the following two data.

1. Product ID – It is actually derived from the 25-digit product key (the alphanumeric value that is printed on the sticker over the Windows CD/DVD case) that is entered during the installation of the operating system. The Product ID is used to uniquely identify your copy of Windows.

2. Hardware ID – This value is derived based on the hardware configuration of your computer.

The WPA system checks the following 10 categories of the computer hardware to derive the Hardware ID:

• Display Adapter
• SCSI Adapter
• IDE Adapter (effectively the motherboard)
• Network Adapter (NIC) and its MAC Address
• RAM Amount Range (i.e., 0-64 Mb, 64-128 Mb, etc.)
• Processor Type
• Processor Serial Number
• Hard Drive Device
• Hard Drive Volume Serial Number (VSN)
• CD-ROM / CD-RW / DVD-ROM

Thus, the Installation ID which is a combination of Product ID and Hardware ID is finally derived and sent to Microsoft during the activation process.

How is the Installation ID validated?

The Installation ID needs to be validated to confirm the authenticity of the installed copy of Windows. So, after the Installation ID is received by Microsoft, it is decoded back so as to obtain the actual product key and the hardware details of the computer involved in the activation process.

The Microsoft’s system will now look to see if this is the first time the product key is being used for the activation. This happens when the user is trying to activate his Windows for the first time after purchase. If so, the Installation ID is instantly validated and the corresponding Activation ID is issued which completes the activation process.

However, Microsoft system will now associate this product key with the hardware ID of the computer and stores this information on their servers. In simple words, during the first use of the product key, it is paired together with the Hardware ID and this information is stored up on the Microsoft servers.

What if a computer running a counterfeit copy of Windows attempts to activate?

The activation fails whenever the copy of Windows installed is not said to be genuine. This usually happens when the product key used for the installation is said to have been used earlier on a different computer. This is determined during the activation process as follows:

During the validation of the Installation ID, the Microsoft’s system checks to see if the same product key was used in any of the previous activation processes. If so, then it looks to see the Hardware ID associated with it. The computer running a counterfeit copy of Windows will obviously have a different hardware configuration and hence the Hardware ID will mismatch. In this case the activation process will fail.

Therefore, for a successful activation, either of the following two cases must be satisfied:

1. The product key must have been used for the first time. ie: The product key should not have been used for earlier activation's on any other computer.
2. If the product key is said to have been used earlier, then the Hardware ID should match. This happens only if the same computer for which the license was genuinely purchased is attempting for subsequent activation.

What about formatting the hard disk?

Each time the hard disk is reformatted and the Windows is re-installed, it needs to be re-activated. However, the activation process will be completed smoothly since the same computer is attempting for subsequent activation. In this case, both the product key and the Hardware ID will match and hence the activation becomes successful.

What if I upgrade or make changes to my hardware?

In the above mentioned 10 categories of hardware, at least 7 should be the same. Thus you are allowed to make changes to not more than 3 categories of hardware. If you make too many changes then your activation will fail. In this case, it is necessary to contact the customer service representative via phone and explain about your problem. If he is convinced he may re-issue a new product key for your computer using which you can re-activate your Windows.

Some things WPA does not do:

• WPA does not send any personal information at all about you to Microsoft. There is still an option to register the product with Microsoft, but that is separate and entirely voluntary.
• If you prefer to activate via phone, you are not required to give any personal information to Microsoft.
• WPA does not provide a means for Microsoft to turn off your machine or damage your data/hardware. (Nor do they even have access to your data). This is a common myth that many people have about Microsoft products.
• WPA is not a “lease” system requiring more payments after two years or any other period. You may use the product as licensed in perpetuity.

I have tried my best to uncover the secret behind the WPA. For further details and more technical information you can read the actual paper by Fully Licensed GmbH at http://www.licenturion.com/xp/fully-licensed-wpa.txt. I hope you like this post. Pass your comments.

Hide Data in Image, Audio and Video Files: Steganography

 Posted by Nishanth Singamala

Ever wondered to know how to hide secret data in image, audio and video files? Well, in this post I will take you through a concept called steganography using which, it is possible to hide your secret information in image files, songs or any other file of your choice. At the end of this post, you can also download free stegnographic tools and start hiding your data.

What is Steganography?

Steganography is a means of obscuring data where secret messages are hidden inside computer files such as images, sound files, videos and even executable files so that, no one except the sender and the receiver will suspect the existence of stealth information in it. Steganography may also involve the usage of cryptographywhere the message is first encrypted before it is concealed in another file. Generally, the messages appear to be something else such as an image, sound or video so that the transfer of secret data remains unsuspected.

The main advantage of steganography over other methods such as cryptography is that, it will not arose suspicion even if the files fall in the hands of a third party. Unlike cryptographic messages, stegnographic messages will no way attract the attention of a third party by themselves. Thus stegnanography has an upper hand over cryptography as it involves both encryption and obscurity.

What are the Applications of Steganography?

Steganography is mainly used to obscure confidential information/data during storage or transmission. For example, one can hide a secret message in an audio file and send this to another party via email instead of sending the message in the textual format. The receiver on the other end will decrypt the hidden message using the private decryption key. In a worst case scenario, even if a third party does manage to gain access to the email, all he can find is the audio file and not the hidden data inside it. Other usage of steganography include digital watermarking of images for reasons such as copyright protection.

Even though steganography has many useful applications, some may use this technique for illegitimate purposes such as hiding a pornographic content in other large files. Rumors about terrorists using steganography for hiding and communicating their secret information and instructions are also reported. An article claiming that, al-Queda had used steganography to encode messages in images and transported them via e-mails, was reported by New York Times, in October 2001.

How do Steganography Tools Work?

Stegnography tools implement intelligent algorithms to carefully embed the encrypted text messages or data inside other larger files such as an image, audio, video or an executable file. Some tools will embed the encrypted data at the end of another file so that there will be enough room for storing larger data.

There are many steganography tools available online but only a few are able to work flawlessly. I did not find any tool that worked perfectly on both small and large data. However, I have  managed to develop my own tool that can work perfectly on all types of files and all size of data. The tool is called “Stego Magic“. You can download it from the following link.

Download StegoMagic.zip

The zip file contains two versions of Stego Magic: One for encrypting the text messages and the other for encrypting binary files. StegoMagic_TXT can be used to hide text messages in other files such as an image or a sound file. StegoMagic_BIN can be used to hide one binary file in another such as an executable file inside an image or an image inside a video file.

With Stego Magic, there is no limitation on the size and type of the file that you are intending to hide. For example, you can hide a video of size 1 GB in an image of size 1 MB or hide an executable file inside a WORD document. The tool is pretty straightforward to use and requires no special understanding of the concept.

At the end of the encryption process, a secret decryption key will be generated and the same is required during the decryption process.

How to Use Stego Magic?

Suppose you want to hide a text message inside a JPG file:

1. Place the JPG and the text file (.txt) in the same folder as that of StegoMagic_TXT.exe
2. Run StegoMagic_TXT.exe and follow the screen instructions to embed the text message inside the JPG image.
   Please note that if you’re using Windows 7/Vista, right-click the file and select “Run as Administrator”. Otherwise the tool may fail to work properly.
3. Note down the secret decryption key.

Now you can send this image to your friend via email. To decrypt the hidden message, your friend should load this JPG file onto the Stego Magic tool and use the secret decryption key.

I hope you’ve now understood what is steganography and how to use it to hide your secret data. For queries and feedback, please pass your comments.

Ways to Encrypt Data to Store in Cloud

Posted by Nishanth Singamala

For very many people, security is one of the most important issues when it gets to sending their files into the cloud. They worry that their files will be seen or even compromised by other persons because that is what took place in the past. The user accounts used to be hacked, cloud storage systems failed and personal files and data were exposed. Therefore, how can you successfully prevent that from ever happening even when the account gets hacked or something happens to your provider of cloud storage?

The answer to that question is encryption

Encryption can be defined as the process of making one’s files unreadable with a pass phrase or an encryption key so that even when another person gains access to the files, it does not matter because the intruder will only be able to see gibberish. To be able to see very properly what is in the file, one must have a key.

This article contains the two different ways through which one can make his or her files secure and be able to safely use cloud storage without any worries.

Available options

Essentially, when it gets to encrypting files in the cloud, one has two options from which he or she can choose, that is:

• He or she may choose the cloud storage with a built in encryption.
• Make use of a service which encrypts folders and/or files for him or her.

Cloud storage service with built-in encryption

Regardless of your choice, both of the ways to encrypt data to store in cloud have advantages and disadvantages. If you decide to go with the dedicated secure cloud service, you might be required to change the entire setup of transferring files to that specific service, familiarize yourself with the way it works and probably give up on a certain third party support, mainly if you come from the most well-liked cloud storage and syncing service, that is “Dropbox”. Alternatively, you have got everything under one hood and you do not have to worry any more about file security and integrity.

Service for encryption only

If you are using a service which is dedicated to encrypting your files, you will be having more control over which files you would like to encrypt and where you would like them to be stored. For instance, you may choose Dropbox, if at all you like the service; and not give up after encrypting the files properly. Conversely, your files might take longer to be properly synced in case you are getting them encrypted using third party apps.

Conclusion

Either way, it is believed to be very necessary to protect one’s files using the most proper encryption, most especially if he or she is using Dropbox for managing his or her critical files such as contracts, password databases, or any other personal or business files which may be considered to be very important.

Depending on an individual, some would like to install another software on their computers just for the purpose of encryption, while others not. Those who don’t may take advantage of the idea of signing up for a dedicated cloud solution which has built-in local encryption for all the files. Some of such solutions available include SpiderOak, Wuala and Cubby. If online viruses are among the things troubling you, you may also consider making use of the Norton Contact Phone number so as to inquire about how you can be helped.