BBM Vs Any other messenger: BBM all the way! 

Bored? In trouble? Want to play? Want to tell something important? Time pass? What comes to our mind? Well none other than "Messaging".

So pick your mobile and type random stuffs and send to your friends :-)

So SMS? Nah! We are in 2013 and using text messages would be an insult to the technology.

Number of people who use smart phones are way higher than the number of engineers graduating every year :D

So what do we do? Install a messenger in our mobile and tell our near and dear to install the same messenger in his/her mobile too.

There are way too many messenger applications available these days but the most famous ones include BlackBerry Messenger aka BBM, Whatsapp, iMessenger etc..

There is a famous proverb "An apple a day keeps the doctor away" but this holds true only for Apple- The Fruit :D

For Apple- Mobile/Computers/Tablets the proverb is "An apple device a month destroys the bank balance" :p So no use discussing about iMessenger :p

Now the battle begins, BBM Vs Whatsapp! ;)

BBM is(was) exclusive only for the BlackBerry Boyz :D If you arent one, dont worry, BBM is soon coming to Android and iOS too.

Whatsapp is a cross platform messenger which is available for Android, Windows Phone, iOS, BlackBerry etc..

Anyday, anytime i would prefer BBM to Whatsapp, dont mistake me to be a person who belongs to the dinosaur era :p Lets first discuss about Whatsapp.

Whatsapp was founded in 2009 by two Yahoo veterans Mr. Brian Acton and Mr. Jan Koum. As i said earlier it is a multi platform messenger. This was the only thing that this messenger could boast of ahead of the BBM which cannot be done after a few weeks because BBM is set to become cross platform is some weeks. Users using Whatsapp must basically be unaware of the spelling of security, privacy etc.. You may be wondering why i am saying so? No no, nothing to wonder, it is as explicit as a grey sky which brings rain in it :p First of all the Whatsapp is not encrypted and the messages are sent as plain text which means that the messages can be easily read if the packet traces are available. Whatsapp later claimed to have cemented this issue but nothing is clear about it as it was just one of the serveral issues that the Whatsapp has. I think people are still aware of the famous website WhatsAppStatus.net :p which took a dig at Whatsapp. With this website one can change the Whatsapp status message of any user by just knowing his mobile number :p .Wow!

Whatsapp later came out to self defend themselves and told that they had patched this issue but all they did was just block the IP address of this website :p, this is a brilliant patch, wow :p

Privacy? Lol! Whats that? Everyone are aware that Whatsapp works based on phone number. So what happens? Lets see a small real life example. I am Mr.X, i want to get connected to Mrs.Y. But X and Y dont really know each other. Y and Z are good friends and X and Z are good friends. Now X gets Y's number from Z and adds her to his contact and X will eventually keep track of what picture Y puts, the status messages that Y puts, when has Y last seen the Whatsapp etc.. This will be a very useful tool for the parents who can secretly monitor their children's secret mobile number with Whatsapp installed :p If you know what i mean :D Coming to the working, a single tick will mean that the message has reached the server and a double click will mean that the message has reached that person. But nobody will know if the person has seen it or not. And many users have complained that sometimes whatsapp messages take donkey years to reach the other person :p Its free only for a year, after that a small fees is needed to keep it alive. Also the "Last seen" feature in Whatsapp which they boast about is a very dangerous thing, it can lead to some break ups in a strong relationship too. Phew! I dont want to use such a messenger for sure :p

Now lets come to my favorite BBM. Well BlackBerry and security have a very strong bonding, isn't it? :D

Though BB sales have hit the ground, there are some people left who still believe that security is the most important thing in a messenger and not the last seen or the ability to set a background image :p

The security provided by BlackBerry is light years ahead of what any other messenger service provides. BBM uses the concept of PIN. Every BBM user is given an unique PIN which he/she can share with another BBM user who they know. The person has to send a request and it has to be accepted before which a person cannot send/receive any chat, he/she can neither see her profile picture nor their status would be visible. Sounds awesome isn't it? :D Also there are different symbols for the step by step action. Three signal brackets will mean that the message is being sent, a check mark would indicate that the message has reached the server, a check mark with letter D will mean that the message has been delivered and a check mark with letter R will mean that the message has been read. Also if you're using WhatsApp and shift/surrender your mobile number, your contacts could be accessed by the new owner of that number, which is a significant breach of privacy.

Whatever said and done, BBM is the best! So trash your other messengers and start using BBM :-)

Internet Protocol Spoofing- A brief run through

INTERNET PROTOCOL SPOOFING

What is an Internet Protocol?

I am sure people would have come across this term called Internet Protocol very often. Just to start with i will just brief about these basic terminologies before we get into the crux. An Internet Protocol (IP) is nothing but a numerical label assigned to each device. The main purpose of using this IP is for communication. There are two main functions assigned to this IP address.

1. It helps to identify the host.

2.It is used for location addressing.

There are two main types of IP address. They are IPv4 and IPv6. The IPv4 which is still being used is a 32 bit number. The IPv6 uses a 128 bit number. An IP address is a binary number but it is stored in text files and displayed in human readable notations such as 172.16.254.1 (for IPv4), and 2001:db8:0:1234:0:567:8:1 (for IPv6). There are a lot more concepts associated with the Internet Protocol but these are the basic things that are meant to be known.

What is  IP Spoofing?

IP address spoofing is the creation of Internet Protocol (IP) packets with a forged source IP address, with the purpose of concealing the identity of the sender or impersonating another computing system. This eventually helps in getting unauthorized access. This attack is based on the fact that the communication between distant computers is handled by routers which examines the destination address but ignores the origin address. In the spoofing attack, the middle man sends a message to the computer and tries to indicate that the message has come from a trusted source. First, the middle man must have identified the Internet Protocol address of the trusted system so that he can modify the packet headers and create an illusion that they are really coming from a trusted system. If the destination system is fooled by the middle man he can easily gain root access to the host and he can create a backdoor path to attack the system eventually.

Some attacks involving IP Spoofing:

Man in the middle attack:

This is a very common attack that everyone of us are aware. Let me just brief you about this attack with the typical example.

1. Alice sends a message to Bob, which is intercepted by Mallory:

Alice "Hi Bob, it's Alice. Give me your key"-->  Mallory      Bob

2. Mallory relays this message to Bob; Bob cannot tell it is not really from Alice:

Alice      Mallory "Hi Bob, it's Alice. Give me your key"-->   Bob

3. Bob responds with his encryption key:

Alice      Mallory   <--[Bob's_key] Bob

4. Mallory replaces Bob's key with her own, and relays this to Alice, claiming that it is Bob's key:

Alice   <--[Mallory's_key] Mallory      Bob

5. Alice encrypts a message with what she believes to be Bob's key, thinking that only Bob can read it:

Alice "Meet me at the bus stop!"[encrypted with Mallory's key]-->   Mallory      Bob

6. However, because it was actually encrypted with Mallory's key, Mallory can decrypt it, read it, modify it (if desired), re-encrypt with Bob's key, and forward it to Bob:

Alice      Mallory "Meet me at 22nd Ave!"[encrypted with Bob's key]-->   Bob

7. Bob thinks that this message is a secure communication from Alice.

Router re-direct:

It is almost a part of the man in the middle attack. Here the routing information is redirected from the original host to the hacker's host.

Source routing:

It  allows a sender of a packet to partially or completely specify the route the packet takes through the network.

Blind spoofing:

Attackers usually send several packets to a target in order to predict sequence numbers. Most sequence numbers are randomly generated, so Blind Spoofing is typically only effective if a sequence number is compromised. There is very less chance of an immediate feedback.

Flooding:

A SYN flood is a form of DOS attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.

Basic things to be done:

• The victim must be selected first.
• The attacker must make sure that he is considered to be a trusted source.
• The trusted host must be disabled and the victim's TCP sequence numbers are sampled.
• The sequence numbers are forged and the trusted source is pretended to be.
• A connection is to be made where there is no username or password authentication. If the connection is successful, the backdoor is created.

Why should the root be attacked?

Gaining the root access is the main crux of IP spoofing. Only if the root access is gained in the victim's system can be played with by installing Trojans, modifying some existing data etc..

Why is IP Spoofing called 'BLIND'?

In one line, it is called blind because the victim assumes the middle man to be a trusted source. The IP data grams containing the forged IP addresses will reach the victim with no issues because IP is basically a connection-less protocol which does not need any handshaking. However the datagrams sent from the victim's system ends up in the bit stack which the middle man cannot see. Once the datagrams are routed the message gets demultiplexed in the protocol stack and it will get discarded on reaching the TCP. [The attacker cannot “see” what the target host sends, but based on the handshaking procedure, an attacker can predict what the target host will send in response. Knowing both what has been sent and what the response will be eliminates the need to actually “see” the response. This allows the attacker to work in the “blind” and manipulate the system].

Host disabling:

To pretend to be the trusted host, the middle man must first disable the host and make sure that no traffic goes to the trusted host. The common method used to do this is SYN Flooding.  The attacking host sends multiple SYN requests to the target (in this instance the trusted host) to load up the TCP queue with pending connections. The attacking host must also ensure that the source IP-address is spoofed and select a different, currently unreachable host, as this is where the target TCP will be sending it’s response. The reason that it must be unreachable is to prevent any host from receiving the SYN/ACKS sent by the system under attack. This would result in a RST (resend) being sent back to the system under attack, foiling the attack. The target responds with SYN/ACKS to the spoofed IP address and once the queue limit is reached, all other requests to this TCP port will be ignored. This effectively disables the “trusted host” and allows the attacker to proceed with impersonating the “trusted host”.

Packet Sequence Sampling:

The attacker must next determine where in the 32 bit sequence number space the targets TCP is located. The attacker then connects to a TCP port on the target just prior to starting an attack and completes the three-way handshake, making sure that the initial sequence number  is recorded. This process is repeated several times to determine the Round Trip Time and the final ISN retained. The RTT is necessary to predict the next ISN.

Pretending to be the Trusted Host:

If the intial steps are correct and all the response favours the middle man then the SYN/ACK will be dropped by the  incapacitated “trusted” host. The attacker must then wait to give the “trusted” host

time to send the SYN/ACK. Then the attacker sends an ACK to the target server with the predicted 

sequence number (plus one, to accommodate the ACK). If the calculations are correct,  the target server will accept the ACK. 

The target has been compromised.

References:

Bing, Wikipedia.