Extended Queueing of Handover (EQH) Scheme
In a handover process, a UT with unfulfilled handover request will have its call terminated once it leaves the present cell i.e. when the signal strength of the present beam drops below an acceptable level. Under the proposed Extended Queueing of Handover (EQH) scheme [5], the policies of queueing and early channel reservation also apply to handover calls. In addition to them, the queueing process of an initially unfulfilled handover is allowed to be continued in the destination cell and thus lasts longer, promising a higher chance of obtaining a free communication channel. In this case, since the UT has left the present cell and has not reserved a channel from the destination cell,
its call has to be discontinued until either a free channel is available on which the call can be resumed on,or until the tolerable suspension period is over which the call has to be permanently terminated,whichever comes first. Although this suspended call is prioritised over new call in getting a channel, it does not significantly affect the blocking rate of new call because the probability that a call get suspended is very small. From the viewpoints of the two involved communicating parties in an initially unsuccessful handover call,
the discontinuity can be notified through a special tone / message. In terms of quality of service (QoS), a suspended call that eventually gets terminated is better than a disruptive and uninformed drop call. On the other hand, if the call is able to be resumed upon the availability of an idle channel, the short term discontinuity makes it worth than having the call terminated and followed by setting up a new call again, which is harder because new call is less privileged. Hence regardless of the outcome EQH scheme promises a higher QoS.
Friday, August 27, 2010
General aspects of mobile satellite systems
General aspects of mobile satellite systems
Differences between satellite and terrestrial systems exist in spite of common objectives for high quality services and excellent spectrum efficiency. Some differences arise because:- user costs are closely related to satellite transmit power the satellite propagation channel is highly predictable satellite paths introduce significant propagation delays and Doppler shifts frequency co-ordination has to be on a global basis frequency re-use options are more limited, hence bandwidth is a tight constraint satellite beam shaping and sizing opportunities are limited.The first two points lead naturally to the emphasis placed on the line-of-sight satellite link budget when establishing the system design. The base link budget is derived from theoretical path losses to which link margins are added to
compensate for inevitable impairments in equipment and propagation characteristics. All impairments, even if not directly calculable in terms of signal loss (e.g. group delay and rate of change of Doppler shift), are converted accurately to dB so that the compensating increase in transmit power can be established. The total margin over the theoretical ideal
path is only a few dB and precision in calculating the contributory impairments is essential. The resulting link budget then allows the availability and quality of service to be estimated over the coverage area.Large link margins have a major impact on system build cost and operating tariffs simply because of the impact of additional power requirements on spacecraft size — a 3dB excess margin would almost double user charges. For this reason, mobile satellite communication systems have lead the way in very power-efficient modulation formats and low bit rate voice codecs (2,4 kbit/s and 4,8 kbit/s) as well as adaptive power control. The drive for efficient use of satellite power is noticeably reflected in terminal equipment design with:
- very low loss antennas coupled with very low loss receive filters;
- very tight transmit/receive filter specifications;
- very low noise amplifiers;
- excellent carrier/signal acquisition in presence of Doppler, noise and interference;
- power-saving and spectrum-efficient forward error correction;
- multi-path discrimination techniques might facilitate low signal-to-noise demodulator operation
The satellite-mobile uplink and downlink are inevitably more fragile than the corresponding feeder links (land earth station-satellite). However the feeder link itself needs a very substantial link margin in order that the aggregate up/down performance may be largely determined by the mobile link. These feeder links operate in higher frequency bands where Doppler and atmospheric/meteorological disturbances can become even more significant. The following clauses of this TR focus on particular characteristics, capabilities and limitations of mobile satellite systems together with typical values for key parameters where possible. However it must be recognised that most parameters are inter-dependent and will also vary with architecture of the ground infrastructure, the satellite orbital arrangement, and the user terminal configuration.
Differences between satellite and terrestrial systems exist in spite of common objectives for high quality services and excellent spectrum efficiency. Some differences arise because:- user costs are closely related to satellite transmit power the satellite propagation channel is highly predictable satellite paths introduce significant propagation delays and Doppler shifts frequency co-ordination has to be on a global basis frequency re-use options are more limited, hence bandwidth is a tight constraint satellite beam shaping and sizing opportunities are limited.The first two points lead naturally to the emphasis placed on the line-of-sight satellite link budget when establishing the system design. The base link budget is derived from theoretical path losses to which link margins are added to
compensate for inevitable impairments in equipment and propagation characteristics. All impairments, even if not directly calculable in terms of signal loss (e.g. group delay and rate of change of Doppler shift), are converted accurately to dB so that the compensating increase in transmit power can be established. The total margin over the theoretical ideal
path is only a few dB and precision in calculating the contributory impairments is essential. The resulting link budget then allows the availability and quality of service to be estimated over the coverage area.Large link margins have a major impact on system build cost and operating tariffs simply because of the impact of additional power requirements on spacecraft size — a 3dB excess margin would almost double user charges. For this reason, mobile satellite communication systems have lead the way in very power-efficient modulation formats and low bit rate voice codecs (2,4 kbit/s and 4,8 kbit/s) as well as adaptive power control. The drive for efficient use of satellite power is noticeably reflected in terminal equipment design with:
- very low loss antennas coupled with very low loss receive filters;
- very tight transmit/receive filter specifications;
- very low noise amplifiers;
- excellent carrier/signal acquisition in presence of Doppler, noise and interference;
- power-saving and spectrum-efficient forward error correction;
- multi-path discrimination techniques might facilitate low signal-to-noise demodulator operation
The satellite-mobile uplink and downlink are inevitably more fragile than the corresponding feeder links (land earth station-satellite). However the feeder link itself needs a very substantial link margin in order that the aggregate up/down performance may be largely determined by the mobile link. These feeder links operate in higher frequency bands where Doppler and atmospheric/meteorological disturbances can become even more significant. The following clauses of this TR focus on particular characteristics, capabilities and limitations of mobile satellite systems together with typical values for key parameters where possible. However it must be recognised that most parameters are inter-dependent and will also vary with architecture of the ground infrastructure, the satellite orbital arrangement, and the user terminal configuration.
Who will use satellite communications systems?
Who will use satellite communications systems?
Global roamer
The first type of satellite user will be the global roamer. The global roamer consists mainly of business travelers who want to have the ability to make and receive calls anywhere in the world. Iridium has conducted extensive analysis of this market and concluded that this market will consist of 42 million people by the year 2002.
Cellular extension
The second type of user will be individuals who wish to extend their cellular coverage to areas where no service currently exists. Both Globalstar and Iridium plan to offer dual mode phones which will work with GSM/TDMA/CDMA cellular systems and satellite communications systems. An example of a dual mode user would be would be an individual who lives in Chicago and travels to upstate Montana for a hunting trip. The
person would normally have cellular service from Ameritech but that coverage does not include upstate Montana where no cellular coverage exists. To be able to receive service on their Ameritech system (same phone number) in Montana, the individual would sign up with Iridium for dual mode service. Signing up would mean that once the
individual got out of the range of their Ameritech systems, they could hit a switch on their Iridium phone and make or receive calls outside of their Ameritech coverage zone routed through the Iridium satellite system. This would allow for ubiquitous service for cellular users even when they are out of range of their current cellular system.
Landline extension
The third type of satellite user will an individual who wants landline extension. In this instance a satellite company would install a fixed telephone booth in a rural area (e.g. in the outskirts of India). This would enable a rural town, which currently has no means of voice communications, to communicate with an urban area where medical, police or other services exist. The rural town could also use the phone to call suppliers of staple products. Fixed satellite service would mostly be used when a landline system is uneconomical or technologically incapableor serving a particular location. Vodaphone has been using fixed wireless phone booths in South Africa and has averaged 800 minutes of use per booth.
Global roamer
The first type of satellite user will be the global roamer. The global roamer consists mainly of business travelers who want to have the ability to make and receive calls anywhere in the world. Iridium has conducted extensive analysis of this market and concluded that this market will consist of 42 million people by the year 2002.
Cellular extension
The second type of user will be individuals who wish to extend their cellular coverage to areas where no service currently exists. Both Globalstar and Iridium plan to offer dual mode phones which will work with GSM/TDMA/CDMA cellular systems and satellite communications systems. An example of a dual mode user would be would be an individual who lives in Chicago and travels to upstate Montana for a hunting trip. The
person would normally have cellular service from Ameritech but that coverage does not include upstate Montana where no cellular coverage exists. To be able to receive service on their Ameritech system (same phone number) in Montana, the individual would sign up with Iridium for dual mode service. Signing up would mean that once the
individual got out of the range of their Ameritech systems, they could hit a switch on their Iridium phone and make or receive calls outside of their Ameritech coverage zone routed through the Iridium satellite system. This would allow for ubiquitous service for cellular users even when they are out of range of their current cellular system.
Landline extension
The third type of satellite user will an individual who wants landline extension. In this instance a satellite company would install a fixed telephone booth in a rural area (e.g. in the outskirts of India). This would enable a rural town, which currently has no means of voice communications, to communicate with an urban area where medical, police or other services exist. The rural town could also use the phone to call suppliers of staple products. Fixed satellite service would mostly be used when a landline system is uneconomical or technologically incapableor serving a particular location. Vodaphone has been using fixed wireless phone booths in South Africa and has averaged 800 minutes of use per booth.
Friday, August 20, 2010
1 smartcard
11. Applications on Linux
In this section there will be applications that uses smart cards for some reason on Linux environment. If you are a developer of a software and your development environment is Linux please let me know. I will add you in the list.
11.1. scas
SCAS is a simple program that checks the code inside the card with the code inside the computer. As an example of showing a way of authentication with memory cards scas is very good.
11.2. smartcard
smartcard is a general smart card utility in Linux which uses CT-API. With smartcard utility you can read/write data from/into smart cards. As long as your reader can be accessed via CT-API, smartcard can be used to control the reader. Currently smartcard could only be used with memory cards using I2C or 3W protocols. There is also a GTK+/Gnome graphical front end which support all functions of smartcard utility.
11.3. ssh-smart
ssh-smart is a basic proof-of-concept of ssh identity on smart card, as the author says. ssh-smart uses smartcard utility to communicate with the smart card. Basically, ssh-smart-add tool (perl script) call ssh-keygen to generate RSA public and private keys. Than puts the private key on the memory card. Later the ssh-smart-addagent tool can be used to extract the private key from the card to use with ssh-agent.
11.4. smarttools-rsa
This is another PAM Module for Unix systems but supports RSA authentication through your private key on the smart card. You must have a Schlumberger Cyberflex Access card or Schlumberger Cryptoflex for Windows Card and a working reader to use this tool.
11.5. smartsign
This utility is some-complete PKI integration with the smart cards. To use you must establish a working OpenCA and have Schlumberger's "Cyberflex Access 16K" smart cards. During the certification process of OpenCA, private key and public certificate can be stored on the smart card and private key, later, could be used with Netscape to sign outgoing mails and news. Also smartsign supports authentication of local users via a PAM Module through a public key authentication. Smartsign comes with gpkcs11, a PKCS#11 implementation, smastsh, a command line shell that allows browsing smart card contents, sign_sc/verify_sc to sign and verify any file with smart card.
11.6. CITI Projects
At CITI, Center for Information Technology Integration of Michigan University, there are some new projects. For example, Webcard is a web server running on a Schlumberger Cyberflex Access Java Card. Features a stripped TCP/IP stack that supports HTTP only. The system is designed to have a router which frames IP packets in ISO7816 and a Java Virtual Machine in the card. Detailed technical report can be found at
In this section there will be applications that uses smart cards for some reason on Linux environment. If you are a developer of a software and your development environment is Linux please let me know. I will add you in the list.
11.1. scas
SCAS is a simple program that checks the code inside the card with the code inside the computer. As an example of showing a way of authentication with memory cards scas is very good.
11.2. smartcard
smartcard is a general smart card utility in Linux which uses CT-API. With smartcard utility you can read/write data from/into smart cards. As long as your reader can be accessed via CT-API, smartcard can be used to control the reader. Currently smartcard could only be used with memory cards using I2C or 3W protocols. There is also a GTK+/Gnome graphical front end which support all functions of smartcard utility.
11.3. ssh-smart
ssh-smart is a basic proof-of-concept of ssh identity on smart card, as the author says. ssh-smart uses smartcard utility to communicate with the smart card. Basically, ssh-smart-add tool (perl script) call ssh-keygen to generate RSA public and private keys. Than puts the private key on the memory card. Later the ssh-smart-addagent tool can be used to extract the private key from the card to use with ssh-agent.
11.4. smarttools-rsa
This is another PAM Module for Unix systems but supports RSA authentication through your private key on the smart card. You must have a Schlumberger Cyberflex Access card or Schlumberger Cryptoflex for Windows Card and a working reader to use this tool.
11.5. smartsign
This utility is some-complete PKI integration with the smart cards. To use you must establish a working OpenCA and have Schlumberger's "Cyberflex Access 16K" smart cards. During the certification process of OpenCA, private key and public certificate can be stored on the smart card and private key, later, could be used with Netscape to sign outgoing mails and news. Also smartsign supports authentication of local users via a PAM Module through a public key authentication. Smartsign comes with gpkcs11, a PKCS#11 implementation, smastsh, a command line shell that allows browsing smart card contents, sign_sc/verify_sc to sign and verify any file with smart card.
11.6. CITI Projects
At CITI, Center for Information Technology Integration of Michigan University, there are some new projects. For example, Webcard is a web server running on a Schlumberger Cyberflex Access Java Card. Features a stripped TCP/IP stack that supports HTTP only. The system is designed to have a router which frames IP packets in ISO7816 and a Java Virtual Machine in the card. Detailed technical report can be found at
2 smartcard
12. Smart Card Uses
Literally, billions of smart cards are already in use. Worldwide smart card sales could reach 1.6 billion units in 1998, up 23% from 1.3 billion units in 1997. Western Europe accounts for about 70% of the current smart card uses, followed by South America and Asia with about 10% each, while North America languishes at less than 5%. However, most smart cards issued today are memory cards (see Table) with limited processing capabilities. Still, hundreds of millions of processor cards are already in use today.
Smart Cards Issued in 1996 (in million units)
____________________________________
Phone cards 605
Health cards 70
Banking 40
ID/access cards 20
Pay TV cards 20
GSM cards (mobile phone) 20
Transportation 15
Metering/vending 10
Others 10
------------------------------------
Total 810
____________________________________
Source: Smart Card Industry Association
Phone cards have become ubiquitous in Western Europe and Asia where coin-operated public phones are becoming nearly obsolete. These pre-paid cards increase payphone operator revenues, allow more sophisticated transactions via public phones, and have become advertising devices as well as collector's items. Although the popularity of phone cards contributed to a widening acceptance of smart cards by consumers, however, processor cards are projected to be the fastest growing smart card uses by the year 2000.
Literally, billions of smart cards are already in use. Worldwide smart card sales could reach 1.6 billion units in 1998, up 23% from 1.3 billion units in 1997. Western Europe accounts for about 70% of the current smart card uses, followed by South America and Asia with about 10% each, while North America languishes at less than 5%. However, most smart cards issued today are memory cards (see Table) with limited processing capabilities. Still, hundreds of millions of processor cards are already in use today.
Smart Cards Issued in 1996 (in million units)
____________________________________
Phone cards 605
Health cards 70
Banking 40
ID/access cards 20
Pay TV cards 20
GSM cards (mobile phone) 20
Transportation 15
Metering/vending 10
Others 10
------------------------------------
Total 810
____________________________________
Source: Smart Card Industry Association
Phone cards have become ubiquitous in Western Europe and Asia where coin-operated public phones are becoming nearly obsolete. These pre-paid cards increase payphone operator revenues, allow more sophisticated transactions via public phones, and have become advertising devices as well as collector's items. Although the popularity of phone cards contributed to a widening acceptance of smart cards by consumers, however, processor cards are projected to be the fastest growing smart card uses by the year 2000.
3 smartcard
13. Technology and Players
For smart cards to carry out applications, several components must come together. The technology of smart cards include four critical segments.
13.1. Card Manufacturers
A smart card begins with a micro-controller produced by semiconductor manufacturers such as Siemens, Motorola and Thomson. This integrated circuit chip is attached to an electronic module by inserting into a cavity on the module. Then, terminals between the chip and the electronic module are interconnected. Finally, the chip-embedded electronic module is glued to a plastic card. The global leader in card manufacturing is Schlumberger who sold about half of all smart cards in use in 1997. A close second is Gemplus followed by Bull and De La Rue of France.
13.2. Card Terminals and Readesr
Smart cards may be read by conventional card reader or by wireless terminals. New devices similar to a floppy disk allow smart cards to be read by PC disk drive. Suppliers of POS and ATM card readers have expanded into smart card readers for their product lines, where some worldwide consolidation is occurring. For example, a market leader Grupe Ingenico is buying another player De La Rue of France.
13.3. Interface between Card and Terminal (API)
Electronic modules embedded in smart cards have contacts by which messages are exchanged between the card's IC chip and the card reader. International standards such as ISO 7816 have specified which contact handles what type of data but applications must be programmed to manage message exchanges that can be used by networked processors. An interoperable and multi-platform application programming interface (API) is critical for smart cards to carry out diverse functions. Open standards such as Java smart card API provides one of several proposed interfaces. Java Card API in particular offers a development tool for flexible, multi-platform applications–"Write Once, Run Anywhere"–for devices ranging from Network Computers, Web TV, smart phones and other consumer appliances. The industry leader Schlumberger, for example, has introduced EasyFlex and FastOS based on Java API.
13.4. Applications
The ultimate utility of smart cards is in the functions they carry out–for example, payment process, identification, network computing, health care management, benefits distribution and so on. Application programs handle data read by smart card readers and forward them to central computers located at the other end of the smart card infrastructure such as payment servers in banks, traffic control centers or mobile phone centers, credit card companies, transit authorities, governments, Microsoft and other service providers. Market players and stake holders in this end game for smart cards include a wide variety of firms and institutions including card issuers, content providers, Visa and MasterCard, banks, government agencies, security implementers such as Lucent Technologies, electronics manufacturers such as NEC, and service providers who want to exploit advantages of smart card technologies.
For smart cards to carry out applications, several components must come together. The technology of smart cards include four critical segments.
13.1. Card Manufacturers
A smart card begins with a micro-controller produced by semiconductor manufacturers such as Siemens, Motorola and Thomson. This integrated circuit chip is attached to an electronic module by inserting into a cavity on the module. Then, terminals between the chip and the electronic module are interconnected. Finally, the chip-embedded electronic module is glued to a plastic card. The global leader in card manufacturing is Schlumberger who sold about half of all smart cards in use in 1997. A close second is Gemplus followed by Bull and De La Rue of France.
13.2. Card Terminals and Readesr
Smart cards may be read by conventional card reader or by wireless terminals. New devices similar to a floppy disk allow smart cards to be read by PC disk drive. Suppliers of POS and ATM card readers have expanded into smart card readers for their product lines, where some worldwide consolidation is occurring. For example, a market leader Grupe Ingenico is buying another player De La Rue of France.
13.3. Interface between Card and Terminal (API)
Electronic modules embedded in smart cards have contacts by which messages are exchanged between the card's IC chip and the card reader. International standards such as ISO 7816 have specified which contact handles what type of data but applications must be programmed to manage message exchanges that can be used by networked processors. An interoperable and multi-platform application programming interface (API) is critical for smart cards to carry out diverse functions. Open standards such as Java smart card API provides one of several proposed interfaces. Java Card API in particular offers a development tool for flexible, multi-platform applications–"Write Once, Run Anywhere"–for devices ranging from Network Computers, Web TV, smart phones and other consumer appliances. The industry leader Schlumberger, for example, has introduced EasyFlex and FastOS based on Java API.
13.4. Applications
The ultimate utility of smart cards is in the functions they carry out–for example, payment process, identification, network computing, health care management, benefits distribution and so on. Application programs handle data read by smart card readers and forward them to central computers located at the other end of the smart card infrastructure such as payment servers in banks, traffic control centers or mobile phone centers, credit card companies, transit authorities, governments, Microsoft and other service providers. Market players and stake holders in this end game for smart cards include a wide variety of firms and institutions including card issuers, content providers, Visa and MasterCard, banks, government agencies, security implementers such as Lucent Technologies, electronics manufacturers such as NEC, and service providers who want to exploit advantages of smart card technologies.
4 smartcard
14. Smart Card Advantages
Compared to conventional data transmission devices such as magnetic-stripe cards, smart cards offer enhanced security, convenience and economic benefits. In addition, smart card-based systems are highly configurable to suit individual needs. Finally, the multifunctionality as payment, application and networking devices renders a smart card as a perfect user interface in a mobile, networked economy.
14.1. Customer Benefits
14.1.1 Full Portability of Services
The smart card effectively breaks the link between the subscriber and the terminal, allowing the use of any properly equipped terminal and helping to realize the wireless promise of any-time, anywhere communications. In fact, subscribers need not be constrained to using voice terminals only. A variety of other mobile communications devices such as personal digital assistants (PDAs) and personal intelligent communicators (PICs) are available that may have voice communications added as an integral part of their capabilities. If these other devices are equipped for smart cards, the potential for communications is increased. Similarly, data communications applications could benefit from the security features inherent in smart cards.
14.1.2 International Roaming
Wireless customers often require the ability to place and receive calls when traveling abroad. For these customers, international roaming enabled by smart cards is quite valuable. For example, Ameritech, AT&T, and GTE have all instituted international roaming programs using GSM phones and smart cards. The program uses co-branded smart cards, which corporate customers bring with them when they travel abroad. Customers are given a telephone number from a GSM carrier, which allows them to be contacted in any of the countries that have international roaming agreements.
14.1.3 Intersystem Roaming
The incompatibility of different communications radio interfaces and authentication protocols (time division multiple access [TDMA], code division multiple access [CDMA], GSM, personal digital cellular [PDC], mobile satellite systems, etc.) requires subscribers to make choices that constrain them to use only one particular type of handset that works with only one radio interface. With a smart card, it becomes possible for subscribers to use one handset for different interfaces and protocols. This feature is already implemented among the three frequencies used by the GSM platform (900, 1800, and 1900 MHz). American National Standards Institute (ANSI) telephone industry price index (T1P1).3 has recommended standards for a user identity module, a smart card that can be used with the major radio access methods. Thus, it becomes conceivable to have current GSM smart cards modified so that they can work with a CDMA handset. For example, North American GSM operators have designed a process to which the SIM holds both the GSM and advanced mobile phone service (AMPS) authentication algorithm and data to provide authentication on both networks in interroaming situations.
14.1.4 Multiple Services on a Single Card
As mentioned earlier, maximum value is realized by the subscriber when multiple applications are stored on a single card (see Figure). A multiapplication smart card could provide access to airline reservation and ticketing systems and information networks, as well as a mobile telephone service. Considering the many cards that the average person carries these days (i.e., numerous credit cards, debit cards, employee ID cards), integrating more applications into a single card (or at least fewer cards) has obvious appeal and benefits. It is important to note that there is clear interest on the part other industries to package their services with mobile telephony. For example, research by Citibank indicates clearly that a substantial percentage of the company's customers would like to be able to conduct its banking on a variety of platforms, including wireless. Such services are already available using a standardized toolbox for smart-card application creation.
14.1.5 Separation of Business and Personal Calls
The smart card allows customers to be billed separately for personal and business calls made on a single phone. For example, Airtel, a Spanish GSM operator, uses a SIM card with two sets of subscription information—one for corporate and the other for personal use. Airtel’s dual SIM cards have been well received in the corporate market.
14.2 Enhanced Security Benefits
SIM cards have several features that enhance security for wireless communications networks. Smart-card supporters point to the potential of limiting or eliminating fraud as one of their strongest selling points.
SIM cards provide a secure authentication key transport container from the carrier’s authentication center to the end-user’s terminal. Their superior fraud protection is enabled by hosting the cryptographic authentication algorithm and data on the card’s microprocessor chip. SIM cards can be personal identification number (PIN) protected and include additional protection against logical attacks. With added PIN code security, SIM cards offer the same level of security used by banks for securing off-line payments.
Because the home network–authentication algorithm also resides in the card, SIM cards make secure roaming possible. They can also include various authentication mechanisms for internetwork roaming of different types.
Complete fraud protection (with the exclusion of subscription fraud) can only be provided in the context of a complete security framework that includes terminal authentication, an authentication center, and authentication key management. Smart cards are an essential piece of this environment, but only the complete architecture can allow fraud reduction and secure roaming.
Finally, it should be noted that biometric smart-card applications such as voice or fingerprint recognition could be added to provide maximum fraud prevention. Smart cards could then combine the three basic security blocks of possession, knowledge, and characteristics (see Figure ).
14.3 Convenience
One use of the old fashioned memory cards is to replace various identification cards. Smart cards will combine paper, plastic and magnetic cards used for identification, automatic teller machines, copiers, toll collection, pay phones, health care and welfare administration. Universities, firms and governments rely on smart identification cards since they can contain more detailed data and enable many services to be integrated. Health care cards, for example, reduce document processing costs by allowing immediate access to personalized patient information stored in smart cards. Most other smart card uses combine identification function with specialized purposes as in military PX cards, government's Electronic Benefit Transfer cards, and university ID cards that are also used to pay for food and photocopies.
14.4 Economic Benefits
Smart cards reduce transaction costs by eliminating paper and paper handling costs in hospitals and government benefit payment programs. Contact and contactless toll payment cards streamline toll collection procedures, reducing labor costs as well as delays caused by manual systems. Maintenance costs for vending machines, petroleum dispensers, parking meters and public phones are lowered while revenues could increase, about 30% in some estimates, due to the convenience of the smart card payment systems in these machines.
14.5 Customization
A smart card contains all the data needed to personalize networking, Web connection, payments and other applications. Using a smart card, one can establish a personalized network connection anywhere in the world using a phone center or an information kiosk. Web servers will verify the user's identity and present a customized Web page, an e-mail connection and other authorized services based on the data read from a smart card. Personal settings for electronic appliances, including computers, will be stored in smart cards rather than in the appliances themselves. Phone numbers are stored in smart cards instead of phones. While appliances become generic tools, users only carry a smart card as the ultimate networking and personal computing device.
14.6 Multifunctionality
The processing power of a smart card makes it ideal to mix multiple functions. For example, government benefit cards will also allow users access to other benefit programs such as health care clinics and job training programs. A college identification card can be used to pay for food, phone calls and photocopies, to access campus networks and to register classes. By integrating many functions, governments and colleges can manage and improve their operations at lower costs and offer innovative services.
Compared to conventional data transmission devices such as magnetic-stripe cards, smart cards offer enhanced security, convenience and economic benefits. In addition, smart card-based systems are highly configurable to suit individual needs. Finally, the multifunctionality as payment, application and networking devices renders a smart card as a perfect user interface in a mobile, networked economy.
14.1. Customer Benefits
14.1.1 Full Portability of Services
The smart card effectively breaks the link between the subscriber and the terminal, allowing the use of any properly equipped terminal and helping to realize the wireless promise of any-time, anywhere communications. In fact, subscribers need not be constrained to using voice terminals only. A variety of other mobile communications devices such as personal digital assistants (PDAs) and personal intelligent communicators (PICs) are available that may have voice communications added as an integral part of their capabilities. If these other devices are equipped for smart cards, the potential for communications is increased. Similarly, data communications applications could benefit from the security features inherent in smart cards.
14.1.2 International Roaming
Wireless customers often require the ability to place and receive calls when traveling abroad. For these customers, international roaming enabled by smart cards is quite valuable. For example, Ameritech, AT&T, and GTE have all instituted international roaming programs using GSM phones and smart cards. The program uses co-branded smart cards, which corporate customers bring with them when they travel abroad. Customers are given a telephone number from a GSM carrier, which allows them to be contacted in any of the countries that have international roaming agreements.
14.1.3 Intersystem Roaming
The incompatibility of different communications radio interfaces and authentication protocols (time division multiple access [TDMA], code division multiple access [CDMA], GSM, personal digital cellular [PDC], mobile satellite systems, etc.) requires subscribers to make choices that constrain them to use only one particular type of handset that works with only one radio interface. With a smart card, it becomes possible for subscribers to use one handset for different interfaces and protocols. This feature is already implemented among the three frequencies used by the GSM platform (900, 1800, and 1900 MHz). American National Standards Institute (ANSI) telephone industry price index (T1P1).3 has recommended standards for a user identity module, a smart card that can be used with the major radio access methods. Thus, it becomes conceivable to have current GSM smart cards modified so that they can work with a CDMA handset. For example, North American GSM operators have designed a process to which the SIM holds both the GSM and advanced mobile phone service (AMPS) authentication algorithm and data to provide authentication on both networks in interroaming situations.
14.1.4 Multiple Services on a Single Card
As mentioned earlier, maximum value is realized by the subscriber when multiple applications are stored on a single card (see Figure). A multiapplication smart card could provide access to airline reservation and ticketing systems and information networks, as well as a mobile telephone service. Considering the many cards that the average person carries these days (i.e., numerous credit cards, debit cards, employee ID cards), integrating more applications into a single card (or at least fewer cards) has obvious appeal and benefits. It is important to note that there is clear interest on the part other industries to package their services with mobile telephony. For example, research by Citibank indicates clearly that a substantial percentage of the company's customers would like to be able to conduct its banking on a variety of platforms, including wireless. Such services are already available using a standardized toolbox for smart-card application creation.
14.1.5 Separation of Business and Personal Calls
The smart card allows customers to be billed separately for personal and business calls made on a single phone. For example, Airtel, a Spanish GSM operator, uses a SIM card with two sets of subscription information—one for corporate and the other for personal use. Airtel’s dual SIM cards have been well received in the corporate market.
14.2 Enhanced Security Benefits
SIM cards have several features that enhance security for wireless communications networks. Smart-card supporters point to the potential of limiting or eliminating fraud as one of their strongest selling points.
SIM cards provide a secure authentication key transport container from the carrier’s authentication center to the end-user’s terminal. Their superior fraud protection is enabled by hosting the cryptographic authentication algorithm and data on the card’s microprocessor chip. SIM cards can be personal identification number (PIN) protected and include additional protection against logical attacks. With added PIN code security, SIM cards offer the same level of security used by banks for securing off-line payments.
Because the home network–authentication algorithm also resides in the card, SIM cards make secure roaming possible. They can also include various authentication mechanisms for internetwork roaming of different types.
Complete fraud protection (with the exclusion of subscription fraud) can only be provided in the context of a complete security framework that includes terminal authentication, an authentication center, and authentication key management. Smart cards are an essential piece of this environment, but only the complete architecture can allow fraud reduction and secure roaming.
Finally, it should be noted that biometric smart-card applications such as voice or fingerprint recognition could be added to provide maximum fraud prevention. Smart cards could then combine the three basic security blocks of possession, knowledge, and characteristics (see Figure ).
14.3 Convenience
One use of the old fashioned memory cards is to replace various identification cards. Smart cards will combine paper, plastic and magnetic cards used for identification, automatic teller machines, copiers, toll collection, pay phones, health care and welfare administration. Universities, firms and governments rely on smart identification cards since they can contain more detailed data and enable many services to be integrated. Health care cards, for example, reduce document processing costs by allowing immediate access to personalized patient information stored in smart cards. Most other smart card uses combine identification function with specialized purposes as in military PX cards, government's Electronic Benefit Transfer cards, and university ID cards that are also used to pay for food and photocopies.
14.4 Economic Benefits
Smart cards reduce transaction costs by eliminating paper and paper handling costs in hospitals and government benefit payment programs. Contact and contactless toll payment cards streamline toll collection procedures, reducing labor costs as well as delays caused by manual systems. Maintenance costs for vending machines, petroleum dispensers, parking meters and public phones are lowered while revenues could increase, about 30% in some estimates, due to the convenience of the smart card payment systems in these machines.
14.5 Customization
A smart card contains all the data needed to personalize networking, Web connection, payments and other applications. Using a smart card, one can establish a personalized network connection anywhere in the world using a phone center or an information kiosk. Web servers will verify the user's identity and present a customized Web page, an e-mail connection and other authorized services based on the data read from a smart card. Personal settings for electronic appliances, including computers, will be stored in smart cards rather than in the appliances themselves. Phone numbers are stored in smart cards instead of phones. While appliances become generic tools, users only carry a smart card as the ultimate networking and personal computing device.
14.6 Multifunctionality
The processing power of a smart card makes it ideal to mix multiple functions. For example, government benefit cards will also allow users access to other benefit programs such as health care clinics and job training programs. A college identification card can be used to pay for food, phone calls and photocopies, to access campus networks and to register classes. By integrating many functions, governments and colleges can manage and improve their operations at lower costs and offer innovative services.
5 smartcard
15 Marketing Opportunities
In addition to the value-added services they can provide, smart cards provide many marketing opportunities to network operators.
15.1 Brand Recognition
Smart cards provide a means for greater brand exposure and reinforcement. The cards can be considered mini-billboards, providing frequent opportunities for the customer to be exposed to a brand name. Compared to other advertising media, they provide a cost-effective vehicle for achieving a high number of brand exposures to a targeted audience. Network operators with limited brand recognition can co-brand their cards with companies with greater brand equity to strengthen their market positions.
15.2 Customer Loyalty Programs
Smart cards can play an extremely valuable role in a carrier’s customer retention efforts. The data on a smart card is a digital representation of the customer’s habits; i.e., number of calls, services accessed, merchandise purchases, etc. This rich database of customer information makes it possible for network operators to develop highly targeted or one-to-one marketing. Carriers are then able to provide services and offerings particularly suited to their customers, increasing customer loyalty to the carrier.
15.3 Direct Marketing
With their convenient form factor, smart cards can be used in direct-mail campaigns to sell wireless subscriptions, both for prospecting and subscription renewal. Using temporary or prepaid smart cards, network operators have a low-cost channel for selling their services. In addition, subscription changes, renewals, and upgrades are easily handled by sending new cards in the mail (see Figure 4).
Figure 4. A Direct Marketing Scenario
15.4 Advertising
Two services, used in conjunction with smart cards, provide network operators with possibilities for highly targeted advertising. Short message service (SMS) and cell broadcast leverage smart cards to send advertising or informational messages that appear on the handset display to wireless users.
15.5 Trial Subscriptions
Smart cards are an ideal vehicle for trial subscriptions. Programmed as prepaid cards, they can attract new customers to try wireless services with limited, defined financial risk for both the network operator and the consumer.
15.5 Incidental Revenues
Network operators issuing smart cards can generate additional revenue by selling memory space on the card to other companies. For example, available space can be sold to gas stations so that the smart card can also be used as a debit card for gas purchases. The card’s surface can also be used for imprinting the participating company’s brand, for which the carrier can receive fees for space advertising.
In addition to the value-added services they can provide, smart cards provide many marketing opportunities to network operators.
15.1 Brand Recognition
Smart cards provide a means for greater brand exposure and reinforcement. The cards can be considered mini-billboards, providing frequent opportunities for the customer to be exposed to a brand name. Compared to other advertising media, they provide a cost-effective vehicle for achieving a high number of brand exposures to a targeted audience. Network operators with limited brand recognition can co-brand their cards with companies with greater brand equity to strengthen their market positions.
15.2 Customer Loyalty Programs
Smart cards can play an extremely valuable role in a carrier’s customer retention efforts. The data on a smart card is a digital representation of the customer’s habits; i.e., number of calls, services accessed, merchandise purchases, etc. This rich database of customer information makes it possible for network operators to develop highly targeted or one-to-one marketing. Carriers are then able to provide services and offerings particularly suited to their customers, increasing customer loyalty to the carrier.
15.3 Direct Marketing
With their convenient form factor, smart cards can be used in direct-mail campaigns to sell wireless subscriptions, both for prospecting and subscription renewal. Using temporary or prepaid smart cards, network operators have a low-cost channel for selling their services. In addition, subscription changes, renewals, and upgrades are easily handled by sending new cards in the mail (see Figure 4).
Figure 4. A Direct Marketing Scenario
15.4 Advertising
Two services, used in conjunction with smart cards, provide network operators with possibilities for highly targeted advertising. Short message service (SMS) and cell broadcast leverage smart cards to send advertising or informational messages that appear on the handset display to wireless users.
15.5 Trial Subscriptions
Smart cards are an ideal vehicle for trial subscriptions. Programmed as prepaid cards, they can attract new customers to try wireless services with limited, defined financial risk for both the network operator and the consumer.
15.5 Incidental Revenues
Network operators issuing smart cards can generate additional revenue by selling memory space on the card to other companies. For example, available space can be sold to gas stations so that the smart card can also be used as a debit card for gas purchases. The card’s surface can also be used for imprinting the participating company’s brand, for which the carrier can receive fees for space advertising.
Sunday, August 15, 2010
Social Networking Website Security Mitigation
Social Networking Website Security Mitigation
The use of social networking site at CDC, such as Facebook and MySpace, increases risk to CDC systems and data via three main mechanisms: 1) Web mail communication, which by-passes enterprise mail filtering, and 2) public comments on blog posts, which are often vulnerable to cross-site scripting (XSS) or blog-phishing attacks, and 3) malicious ‘friends’, whereby those who are accepted as ‘friends’, may change their profiles after being approved to purposely include malicious code, spurious, offensive, inappropriate or political content.
Social networking sites and other Web 2.0 technologies offer health communicators powerful new channels to deliver relevant and targeted health messages, often through trusted sources, when, where and how users want information. Since these technologies are newly emerging and are unfortunately prone to security vulnerabilities and attack vectors, mitigating these risks to protect the CDC network remains paramount to OCISO and the programs alike.
This document aims to outline the steps of risk assessment for individual sites and recommendations for mitigating these known risks when they are present.
OCISO makes two general recommendations1 regarding social networking sites and the first two main vulnerability classes:
Do not use the Web mail portion of these sites.
Disable comments on blogs and other public commenting sections.
OCISO does not offer recommendations regarding the third vulnerability, malicious ‘friends’.
The use of social networking site at CDC, such as Facebook and MySpace, increases risk to CDC systems and data via three main mechanisms: 1) Web mail communication, which by-passes enterprise mail filtering, and 2) public comments on blog posts, which are often vulnerable to cross-site scripting (XSS) or blog-phishing attacks, and 3) malicious ‘friends’, whereby those who are accepted as ‘friends’, may change their profiles after being approved to purposely include malicious code, spurious, offensive, inappropriate or political content.
Social networking sites and other Web 2.0 technologies offer health communicators powerful new channels to deliver relevant and targeted health messages, often through trusted sources, when, where and how users want information. Since these technologies are newly emerging and are unfortunately prone to security vulnerabilities and attack vectors, mitigating these risks to protect the CDC network remains paramount to OCISO and the programs alike.
This document aims to outline the steps of risk assessment for individual sites and recommendations for mitigating these known risks when they are present.
OCISO makes two general recommendations1 regarding social networking sites and the first two main vulnerability classes:
Do not use the Web mail portion of these sites.
Disable comments on blogs and other public commenting sections.
OCISO does not offer recommendations regarding the third vulnerability, malicious ‘friends’.
Web Mail:
Web Mail:
Most functions of social networking sites are usually available even when Web mail is not used or blocked by Websense. When possible, this is the recommended route, not only in terms of security, but also convenience. If possible, have incoming mail automatically redirected to a specific, group CDC account, since it would allow the regular enterprise mail filters to scan the incoming mail traffic.
If Web mail is required to effectively use the site, then a computer off the CDC network will have to be used to manage and maintain the site. This requires separate hardware and connection to the Internet.
Most functions of social networking sites are usually available even when Web mail is not used or blocked by Websense. When possible, this is the recommended route, not only in terms of security, but also convenience. If possible, have incoming mail automatically redirected to a specific, group CDC account, since it would allow the regular enterprise mail filters to scan the incoming mail traffic.
If Web mail is required to effectively use the site, then a computer off the CDC network will have to be used to manage and maintain the site. This requires separate hardware and connection to the Internet.
Public Comments:
Public Comments:
OCISO recommends that comments be disabled. Even moderated comments pose a risk to the CDC network, since each of the comments have to be opened and evaluated by someone on a CDC network computer. There is no way to moderate the comments without the moderator’s system being in jeopardy. However, not allowing comments on blog posts and other content not only is contrary to the very nature of these peer-to-peer communications platforms and thereby reducing the site’s effectiveness, often a negative backlash is encountered, which undermines the effectiveness of our communications efforts.
From a communications perspective, we recommend allowing comments, but having all comments moderated. A special computer off the CDC network will be required to manage and maintain the site. This necessitates the purchase of separate hardware and connection to the Internet.
OCISO recommends that comments be disabled. Even moderated comments pose a risk to the CDC network, since each of the comments have to be opened and evaluated by someone on a CDC network computer. There is no way to moderate the comments without the moderator’s system being in jeopardy. However, not allowing comments on blog posts and other content not only is contrary to the very nature of these peer-to-peer communications platforms and thereby reducing the site’s effectiveness, often a negative backlash is encountered, which undermines the effectiveness of our communications efforts.
From a communications perspective, we recommend allowing comments, but having all comments moderated. A special computer off the CDC network will be required to manage and maintain the site. This necessitates the purchase of separate hardware and connection to the Internet.
Malicious ‘Friends’:
Malicious ‘Friends’:
Once friends are approved on a social networking profile, vigilance is required to make sure that the friend’s profile hasn’t changed to include inappropriate content, an inappropriate profile image or malicious code. The simple act of reviewing proposed friends may make the administrator’s system vulnerable to attack. Although most users of such social networking site already understand this, disclaimers about friends and content on their profiles should be posted. Clear policies about accepting friends should be posted as well. Some sites such as MySpace allow you to control which friends get listed on your main profile page, whereas others such as Facebook randomly place any of your friends on the main page, in which case, care must be taken in approving friends.
This vulnerability is the same as attacks whereby developers work to get a site high in Google or other search engine results, and then changing the content of their pages to purposely introduce attacks.
Again, the main recommendation is to use computer resources off the CDC network to manage and maintain the profile. This requires separate hardware and connection to the Internet.
Once friends are approved on a social networking profile, vigilance is required to make sure that the friend’s profile hasn’t changed to include inappropriate content, an inappropriate profile image or malicious code. The simple act of reviewing proposed friends may make the administrator’s system vulnerable to attack. Although most users of such social networking site already understand this, disclaimers about friends and content on their profiles should be posted. Clear policies about accepting friends should be posted as well. Some sites such as MySpace allow you to control which friends get listed on your main profile page, whereas others such as Facebook randomly place any of your friends on the main page, in which case, care must be taken in approving friends.
This vulnerability is the same as attacks whereby developers work to get a site high in Google or other search engine results, and then changing the content of their pages to purposely introduce attacks.
Again, the main recommendation is to use computer resources off the CDC network to manage and maintain the profile. This requires separate hardware and connection to the Internet.
Primary recommendations:
Primary recommendations:
Since most Web 2.0 technologies are still emerging and secure coding practices are not industry-wide, it is recommended to do a risk assessment for each social networking, Web 2.0 community you wish to use for official CDC communications to determine whether Web mail and public comments are allowed and are necessary. Most times they are either required or greatly preferred, and in those cases the only way to currently protect the CDC network is to manage and maintain these sites on hardware off the CDC network.
Programs must work with OCISO to develop appropriate Rules of Behavior (ROB) for those who will use the special hardware to manage these profiles. These ROB will include provisions of not connecting the hardware to the CDC network, trying to reenable ports if OCISO has blocked them, or moving files from the system to the network directly in any way. Special connections to the Internet must be acquired, which is usually a wireless Internet card. If DSL, cable or T1 connections are required, then the program must also include ITSO in on the discussions at an early stage.
Programs should develop a system to regularly and systematically review the URLs in any comment for XSS on the destination. Those who do the scanning and review should be trained on how to look for suspicious XSS type of code in a page. The use of automated tools are generally restricted by license agreements.
Programs should also develop a system to regularly and systematically review the profile pages of friends as well, to ensure that content has not changed since initial acceptance and that those profiles have not been compromised.
Programs should also routinely scan the security environment and vulnerabilities databases to stay breast of the changing security landscape associated with these sites.
Since most Web 2.0 technologies are still emerging and secure coding practices are not industry-wide, it is recommended to do a risk assessment for each social networking, Web 2.0 community you wish to use for official CDC communications to determine whether Web mail and public comments are allowed and are necessary. Most times they are either required or greatly preferred, and in those cases the only way to currently protect the CDC network is to manage and maintain these sites on hardware off the CDC network.
Programs must work with OCISO to develop appropriate Rules of Behavior (ROB) for those who will use the special hardware to manage these profiles. These ROB will include provisions of not connecting the hardware to the CDC network, trying to reenable ports if OCISO has blocked them, or moving files from the system to the network directly in any way. Special connections to the Internet must be acquired, which is usually a wireless Internet card. If DSL, cable or T1 connections are required, then the program must also include ITSO in on the discussions at an early stage.
Programs should develop a system to regularly and systematically review the URLs in any comment for XSS on the destination. Those who do the scanning and review should be trained on how to look for suspicious XSS type of code in a page. The use of automated tools are generally restricted by license agreements.
Programs should also develop a system to regularly and systematically review the profile pages of friends as well, to ensure that content has not changed since initial acceptance and that those profiles have not been compromised.
Programs should also routinely scan the security environment and vulnerabilities databases to stay breast of the changing security landscape associated with these sites.
System Definition and Boundaries:
System Definition and Boundaries:
Until these sites can be made more secure across the board, it is not recommended at this time to treat the information published to these systems as information of record or official. Disclaimers should be made on the profiles of each of these sites to state that official CDC information can be found at CDC.gov and that in the case of any discrepancies that the content on CDC.gov be considered correct. Even though clear system boundaries are established, programs participating in the spaces must assume the risk that content may be subject to attack and change, since ITSO and OCISO do not maintain these systems.
It is not recommended to use these social networks to gather personal information or to be used for private or secure communications.
Until these sites can be made more secure across the board, it is not recommended at this time to treat the information published to these systems as information of record or official. Disclaimers should be made on the profiles of each of these sites to state that official CDC information can be found at CDC.gov and that in the case of any discrepancies that the content on CDC.gov be considered correct. Even though clear system boundaries are established, programs participating in the spaces must assume the risk that content may be subject to attack and change, since ITSO and OCISO do not maintain these systems.
It is not recommended to use these social networks to gather personal information or to be used for private or secure communications.
Social Networks Site Analyses:
Social Networks Site Analyses:
MySpace: Since this site relies on Web mail to solicit and accept friends and the blog moderating functions have been known to have XSS vulnerabilities in the past, it is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
Facebook: Since this site allows blog posts and there is limited or no control over which of your friends appear on your home page, it is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
Twitter: An interesting site in terms of social networking in that comments and posts are allowed, but are limited to 140 characters with no HTML or JS allowed. Hyperlinks are allowed and are automatically converted to the actual HTML code by the system. Eg – http://www.cdc.gov becomes http://www.cdc.gov automatically. Comments are designed to be sent by SMS messaging, which is text based. Requests for followers come through email and can be accepted without Web mail. Whereas it does seem to be secure against XSS exploits, the site does rely on AJAX technologies and can be used to post links to malicious sites. In order to vet these links, they must be followed, which would put the system at risk. It is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
DailyStrength: This site relies on Web mail to solicit and accept friends, allows blog comments and has limited to no control over which of your friends show up on your main profile page. It is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
YouTube: This site allows comments on videos and has limited to no control over which of your friends show up on your main profile page. It is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
Flickr: This site allows comments and has limited to no control over which of your friends show up on your main profile page. It is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
MySpace: Since this site relies on Web mail to solicit and accept friends and the blog moderating functions have been known to have XSS vulnerabilities in the past, it is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
Facebook: Since this site allows blog posts and there is limited or no control over which of your friends appear on your home page, it is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
Twitter: An interesting site in terms of social networking in that comments and posts are allowed, but are limited to 140 characters with no HTML or JS allowed. Hyperlinks are allowed and are automatically converted to the actual HTML code by the system. Eg – http://www.cdc.gov becomes http://www.cdc.gov automatically. Comments are designed to be sent by SMS messaging, which is text based. Requests for followers come through email and can be accepted without Web mail. Whereas it does seem to be secure against XSS exploits, the site does rely on AJAX technologies and can be used to post links to malicious sites. In order to vet these links, they must be followed, which would put the system at risk. It is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
DailyStrength: This site relies on Web mail to solicit and accept friends, allows blog comments and has limited to no control over which of your friends show up on your main profile page. It is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
YouTube: This site allows comments on videos and has limited to no control over which of your friends show up on your main profile page. It is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
Flickr: This site allows comments and has limited to no control over which of your friends show up on your main profile page. It is recommended that to use this site for CDC communications, it be done so from specially designated hardware off the CDC network following guidelines developed in conjunction with OCISO.
Wednesday, August 11, 2010
CALL FORGING:
CALL FORGING:
Caller ID Forging the practice of causing the telephone network to display a number on the recipient's caller ID display which is not that of the actual originating station; the term is commonly used to describe situations in which the motivation is considered nefarious by the speaker. Just as e-mail spoofing can make it appear that a message came from any e-mail address the sender chooses, caller ID forging can make a call appear to have come from any phone number the caller wishes. Because people are prone to assume a call is coming from the number (and hence, the associated person, or persons), this can call the service's value into question.
To use a typical service, a customer pays in advance for a PIN allowing them to make a call for a certain amount of minutes. To begin, the customer dials from any phone the toll free number given to them by the company and enters their PIN. They are then asked to enter the number they wish to call and the number they wish to appear on the caller ID. Once the "customer" selects the options, the call is then bridged and the person on the other end assumes someone else is calling them.
Many Caller ID forging service providers also allow customers to initiate spoofed calls from a web-based interface in addition to calling a toll free number and entering the ten digit number you want to display followed by the ten digit number you want to call. Some providers allow you to enter the name you would like to display along with the spoofed Caller ID number but in most parts of the United States for example, whatever name the local phone company has associated with the spoofed Caller ID number is the name that shows up on the Caller ID display.
Using a web-based spoofing form involves creating an account with a provider, logging in to their website and completing a form. Most companies require the following basic fields:
1: Source number 2: Destination number 3: Caller ID number
Once the user completes this form and clicks a button to initiate the call, the source number is first called. Once the source number line is picked up, the destination is then called and bridged together.
Some providers also offer the ability to record calls, change your voice and send SMS text messages.
Methods:
Caller ID is forged through a variety of methods and different technology. The most popular ways of spoofing Caller ID are through the use of Voice over IP or PRI lines.
Another method of spoofing is that of emulating the Bell 202 FSK signal. This method, informally called orange boxing, uses software that generates the audio signal which is then coupled to the telephone line during the call. The object is to deceive the called party into thinking that there is an incoming call waiting call from the spoofed number, when in fact there is no new incoming call. This technique often also involves an accomplice who may provide a secondary voice to complete the illusion of a call waiting call. Because the orange box cannot truly spoof incoming caller ID prior to answer, and relies to a certain extent on the guile of the caller, it is considered as much a social engineering technique as a technical hack.
Other methods include switch access to the SS7 network, and social engineering telephone company operators into placing calls for you from the desired phone number. Another method that is not used as often is VXML which was gaining popularity before VoIP took over.
History:
Many people do not realize that Caller ID Forging has been around since Caller ID was created. For over a decade Caller ID forging was used mainly by businesses with access to expensive PRI (Primary Rate Interface) telephone lines provided by local telephone carriers. A single PRI line can provided businesses with up to 23 telephone lines and all of these lines are capable of having unique telephone numbers. Caller ID forging, in it’s most basic form, was typically used by businesses to display one main telephone number on all outgoing calls, even though those calls were not really originating from those numbers.
In the early 2000’s phone hackers, also known as “phone phreaks” or “phreaks”, began using Orange boxing to attempt to spoof Caller ID. Orange boxing is done by using a device, usually special computer software, to send a series of tones down the line during the first few seconds of a phone call, attempting to emulate the Caller ID signal sent from the telephone office. Orange boxing is very crude and unreliable, as it has to be done within a short timeframe at the beginning of a call. Phone phreaks, without access to PRI lines or blind line services at the time, thought the technique was clever.
In late 2003 and early 2004 the same phone phreaks began to explore a relatively new platform for developing voice applications, known as VoiceXML or VXML, which was offered by companies such as Voxeo.
In 2005 a handful of new sites allowing you to spoof your Caller ID were quietly launched. Some of the sites were PiPhone.com, CallNotes.net, SecretCalls.net, StayUnknown.com, SpoofTech.com, SpoofTel.com, and SpoofCard.com.
Towards the end of May, another site, TheZeroGroup.com, launched offering Caller ID spoofing, amongst it's other phone related services. TheZeroGroup's site claims they are hosted off-shore to avoid any legal issues that may arise.
On June 13th the U.S. House of Representatives passed the "Truth in Caller ID Act of 2007" which would make it "unlawful for any person within the United States, in connection with any telecommunications service or VOIP service, to cause any caller identification service to transmit misleading or inaccurate caller identification information with the intent to defraud or cause harm." A similiar bill was passed onto the Senate in April, but the Senate hasn't acted on either of the bills yet.
In India,we do not have any law which is related to the crime made by hoaxters by spoofing caller id.
Orkut Server Side Session Handling Problems:
Overview:
1. Orkut fails to expire the orkut_state session cookie from the server side even when the
user logs off from Orkut upon clicking "Sign-Out" from the application. The cookie is
cleared from the client side (browser), but is not cleared from the server side. If reused,
it provides access to the user's Orkut account.
2. Upon logging in again, a new orkut_state session cookie is created, but the old session
cookies still stay active on the server side. Therefore, any session cookie can be reused
to gain access to the user's Orkut account.
Details:
When any user logs into “orkut.com” . data of cookie will be generated on server and it will be sent back to user after successful authentication process on server. If I come to know about cookie data of any victim remotely then I can access victim’s account without password ( and even user id).
After an access to victim's account, I can edit his/her social,personal,professional,contact profiles,i can also have an access to his/her albums,videos,testimonials.i can even stop victim to access his/her account by editing the contact email.
My aim is not to hack the orkut account and damaged any victim's data, but to create awareness among the people about the security risks over social networking websites.
Recently I had been interviewed by HEADLINES TODAY and I have proved live that any orkut account can be hacked. I am also going to do half an hour live show on AAJTAK.
More Details will be covered in LIVE demonstration.
Gmail Server Side Session Handling Problems:
Overview:
1. Gmail fails to expire the GX session cookie from the server side even when the user
logs off from Gmail upon clicking "Sign-Out" from the application. The cookie is
cleared from the client side (browser), but is not cleared from the server side. If reused,
it provides access to the user's Gmail account.
2. Upon logging in again, a new GX session cookie is created, but the old session cookies
still stay active on the server side. Therefore, any session cookie can be re-used to
gain access to the user's Gmail account
More details will be covered in LIVE Demostration.
plz contect +919766928955
Caller ID Forging the practice of causing the telephone network to display a number on the recipient's caller ID display which is not that of the actual originating station; the term is commonly used to describe situations in which the motivation is considered nefarious by the speaker. Just as e-mail spoofing can make it appear that a message came from any e-mail address the sender chooses, caller ID forging can make a call appear to have come from any phone number the caller wishes. Because people are prone to assume a call is coming from the number (and hence, the associated person, or persons), this can call the service's value into question.
To use a typical service, a customer pays in advance for a PIN allowing them to make a call for a certain amount of minutes. To begin, the customer dials from any phone the toll free number given to them by the company and enters their PIN. They are then asked to enter the number they wish to call and the number they wish to appear on the caller ID. Once the "customer" selects the options, the call is then bridged and the person on the other end assumes someone else is calling them.
Many Caller ID forging service providers also allow customers to initiate spoofed calls from a web-based interface in addition to calling a toll free number and entering the ten digit number you want to display followed by the ten digit number you want to call. Some providers allow you to enter the name you would like to display along with the spoofed Caller ID number but in most parts of the United States for example, whatever name the local phone company has associated with the spoofed Caller ID number is the name that shows up on the Caller ID display.
Using a web-based spoofing form involves creating an account with a provider, logging in to their website and completing a form. Most companies require the following basic fields:
1: Source number 2: Destination number 3: Caller ID number
Once the user completes this form and clicks a button to initiate the call, the source number is first called. Once the source number line is picked up, the destination is then called and bridged together.
Some providers also offer the ability to record calls, change your voice and send SMS text messages.
Methods:
Caller ID is forged through a variety of methods and different technology. The most popular ways of spoofing Caller ID are through the use of Voice over IP or PRI lines.
Another method of spoofing is that of emulating the Bell 202 FSK signal. This method, informally called orange boxing, uses software that generates the audio signal which is then coupled to the telephone line during the call. The object is to deceive the called party into thinking that there is an incoming call waiting call from the spoofed number, when in fact there is no new incoming call. This technique often also involves an accomplice who may provide a secondary voice to complete the illusion of a call waiting call. Because the orange box cannot truly spoof incoming caller ID prior to answer, and relies to a certain extent on the guile of the caller, it is considered as much a social engineering technique as a technical hack.
Other methods include switch access to the SS7 network, and social engineering telephone company operators into placing calls for you from the desired phone number. Another method that is not used as often is VXML which was gaining popularity before VoIP took over.
History:
Many people do not realize that Caller ID Forging has been around since Caller ID was created. For over a decade Caller ID forging was used mainly by businesses with access to expensive PRI (Primary Rate Interface) telephone lines provided by local telephone carriers. A single PRI line can provided businesses with up to 23 telephone lines and all of these lines are capable of having unique telephone numbers. Caller ID forging, in it’s most basic form, was typically used by businesses to display one main telephone number on all outgoing calls, even though those calls were not really originating from those numbers.
In the early 2000’s phone hackers, also known as “phone phreaks” or “phreaks”, began using Orange boxing to attempt to spoof Caller ID. Orange boxing is done by using a device, usually special computer software, to send a series of tones down the line during the first few seconds of a phone call, attempting to emulate the Caller ID signal sent from the telephone office. Orange boxing is very crude and unreliable, as it has to be done within a short timeframe at the beginning of a call. Phone phreaks, without access to PRI lines or blind line services at the time, thought the technique was clever.
In late 2003 and early 2004 the same phone phreaks began to explore a relatively new platform for developing voice applications, known as VoiceXML or VXML, which was offered by companies such as Voxeo.
In 2005 a handful of new sites allowing you to spoof your Caller ID were quietly launched. Some of the sites were PiPhone.com, CallNotes.net, SecretCalls.net, StayUnknown.com, SpoofTech.com, SpoofTel.com, and SpoofCard.com.
Towards the end of May, another site, TheZeroGroup.com, launched offering Caller ID spoofing, amongst it's other phone related services. TheZeroGroup's site claims they are hosted off-shore to avoid any legal issues that may arise.
On June 13th the U.S. House of Representatives passed the "Truth in Caller ID Act of 2007" which would make it "unlawful for any person within the United States, in connection with any telecommunications service or VOIP service, to cause any caller identification service to transmit misleading or inaccurate caller identification information with the intent to defraud or cause harm." A similiar bill was passed onto the Senate in April, but the Senate hasn't acted on either of the bills yet.
In India,we do not have any law which is related to the crime made by hoaxters by spoofing caller id.
Orkut Server Side Session Handling Problems:
Overview:
1. Orkut fails to expire the orkut_state session cookie from the server side even when the
user logs off from Orkut upon clicking "Sign-Out" from the application. The cookie is
cleared from the client side (browser), but is not cleared from the server side. If reused,
it provides access to the user's Orkut account.
2. Upon logging in again, a new orkut_state session cookie is created, but the old session
cookies still stay active on the server side. Therefore, any session cookie can be reused
to gain access to the user's Orkut account.
Details:
When any user logs into “orkut.com” . data of cookie will be generated on server and it will be sent back to user after successful authentication process on server. If I come to know about cookie data of any victim remotely then I can access victim’s account without password ( and even user id).
After an access to victim's account, I can edit his/her social,personal,professional,contact profiles,i can also have an access to his/her albums,videos,testimonials.i can even stop victim to access his/her account by editing the contact email.
My aim is not to hack the orkut account and damaged any victim's data, but to create awareness among the people about the security risks over social networking websites.
Recently I had been interviewed by HEADLINES TODAY and I have proved live that any orkut account can be hacked. I am also going to do half an hour live show on AAJTAK.
More Details will be covered in LIVE demonstration.
Gmail Server Side Session Handling Problems:
Overview:
1. Gmail fails to expire the GX session cookie from the server side even when the user
logs off from Gmail upon clicking "Sign-Out" from the application. The cookie is
cleared from the client side (browser), but is not cleared from the server side. If reused,
it provides access to the user's Gmail account.
2. Upon logging in again, a new GX session cookie is created, but the old session cookies
still stay active on the server side. Therefore, any session cookie can be re-used to
gain access to the user's Gmail account
More details will be covered in LIVE Demostration.
plz contect +919766928955
SMS FORGING:
SMS FORGING:
SMS forging is a relatively new kind of high-tech felony, which uses the short message service (SMS), which is available on most mobile phones and personal digital assistants, to spoof or impersonate another user. The spoofing is often used to send viruses that can be carried from phone to phone and which can cause destructive behavior.
SMS spoofing became possible after many mobile/cellular operators had integrated their network communications with/in the Internet. So anybody could send SMS from the Internet using forms at the websites of mobile operators or even through e-mail. Unfortunately, the Internet forms designed to send SMS may have vulnerabilities that could lead hackers to be able to break the tunneling protocol that links the phones with the Internet.
Surprisingly, one can use legitimate SMS tools available on the market for spoofing. For instance, Clickatell, a provider of carrier-grade bulk SMS messaging solutions and applications that can be integrated and used immediately within a global environment, developed various software allowing users to send bulk and personalized SMS messaging to existing databases, Lotus Domino and other integrated SMS solutions. Therefore any person can purchase or even download evaluation software that would allow the individual to send a spoof SMS. Other providers such as FakeMyText and CloakText actually sell an anonymous texting service as their main service which can be used to spoof a SMS message from any international number.
There is also dedicated Open Source tool called SMS Spoof, which is a Palm OS application that allows individuals to send spoofed SMS messages. It uses a dialup connection to any EMI/UCP-compatible short message service center (SMSC) which supports the EMI/UCP protocol, as long as no authentication is required.
Details:
Every SMS sent from sender to receiver is in PDU format which is of 7bit .
07917283010010F5040BC87238880900F10000993092516195800AE8329BFD4697D9
Octet(s)Description:-
07Length of the SMSC information (in this case 7 octets)
91Type-of-address of the SMSC. (91 means international format of the phone number)
72 83 01 00 10 F5Service center number(in decimal semi-octets). The length of the phone number is odd (11), so a trailing F has been added to form proper octets. The phone number of this service center is "+27381000015".
04First octet of this SMS-DELIVER message .
0BAddress-Length. Length of the sender number (0B hex = 11 dec)
C8Type-of-address of the sender number
72 38 88 09 00 F1Sender number (decimal semi-octets), with a trailing F, By changing this format at the sender side,we can spoof sender ID of the SMS.
SMS forging is a relatively new kind of high-tech felony, which uses the short message service (SMS), which is available on most mobile phones and personal digital assistants, to spoof or impersonate another user. The spoofing is often used to send viruses that can be carried from phone to phone and which can cause destructive behavior.
SMS spoofing became possible after many mobile/cellular operators had integrated their network communications with/in the Internet. So anybody could send SMS from the Internet using forms at the websites of mobile operators or even through e-mail. Unfortunately, the Internet forms designed to send SMS may have vulnerabilities that could lead hackers to be able to break the tunneling protocol that links the phones with the Internet.
Surprisingly, one can use legitimate SMS tools available on the market for spoofing. For instance, Clickatell, a provider of carrier-grade bulk SMS messaging solutions and applications that can be integrated and used immediately within a global environment, developed various software allowing users to send bulk and personalized SMS messaging to existing databases, Lotus Domino and other integrated SMS solutions. Therefore any person can purchase or even download evaluation software that would allow the individual to send a spoof SMS. Other providers such as FakeMyText and CloakText actually sell an anonymous texting service as their main service which can be used to spoof a SMS message from any international number.
There is also dedicated Open Source tool called SMS Spoof, which is a Palm OS application that allows individuals to send spoofed SMS messages. It uses a dialup connection to any EMI/UCP-compatible short message service center (SMSC) which supports the EMI/UCP protocol, as long as no authentication is required.
Details:
Every SMS sent from sender to receiver is in PDU format which is of 7bit .
07917283010010F5040BC87238880900F10000993092516195800AE8329BFD4697D9
Octet(s)Description:-
07Length of the SMSC information (in this case 7 octets)
91Type-of-address of the SMSC. (91 means international format of the phone number)
72 83 01 00 10 F5Service center number(in decimal semi-octets). The length of the phone number is odd (11), so a trailing F has been added to form proper octets. The phone number of this service center is "+27381000015".
04First octet of this SMS-DELIVER message .
0BAddress-Length. Length of the sender number (0B hex = 11 dec)
C8Type-of-address of the sender number
72 38 88 09 00 F1Sender number (decimal semi-octets), with a trailing F, By changing this format at the sender side,we can spoof sender ID of the SMS.
Saturday, August 7, 2010
Conclusion
Conclusion
Plasma Display Panel is today’s technology that had made human dream come true. Altogether Future world will be the one which will make human happiest living being on earth.
Plasma Display Panel is today’s technology that had made human dream come true. Altogether Future world will be the one which will make human happiest living being on earth.
Advantages & Disadvantages
Advantages & Disadvantages
• Advantages
• Slim profile
• Can be wall mounted
• Lighter and less bulky than rear-projection televisions
• Achieves better and more accurate color reproduction than LCDs (68 billion/236 versus 16.7 million/224)
• Produces deep, true blacks allowing for superior contrast ratios (up to 1:2,000,000)
• Far wider viewing angles than those of LCD (up to 178°); images do not suffer from degradation at high angles unlike LCDs
• Virtually no motion blur, thanks in large part to very high refresh rates and a faster response time, contributing to superior performance when displaying content with significant amounts of rapid motion
• Disadvantages
• Earlier models are susceptible to screen burn-in and image retention (however, newer models have green phosphors and built-in technologies to eliminate this, such as pixel shifting)
• Phosphors in older models lose luminosity over time, resulting in gradual decline of absolute image brightness (newer models are less susceptible to this, having life spans exceeding 60,000 hours, far longer than older CRT technology)
• Susceptible to "large area flicker"
• Generally do not come in smaller sizes than 32 inches
• Susceptible to reflection glare in bright rooms
• Heavier than LCD due to the requirement of a glass screen to hold the gases
• Use more electricity, on average, than an LCD TV
• Do not work as well at high altitudes due to pressure differential between the gases inside the screen and the air pressure at altitude. It may cause a buzzing noise. Manufacturers rate their screens to indicate the altitude parameters.
• For those who wish to listen to AM radio, or are Amateur Radio operators (Hams) or Shortwave Listeners (SWL) , the Radio Frequency Interference (RFI) from these devices can be irritating or disabling.
• Advantages
• Slim profile
• Can be wall mounted
• Lighter and less bulky than rear-projection televisions
• Achieves better and more accurate color reproduction than LCDs (68 billion/236 versus 16.7 million/224)
• Produces deep, true blacks allowing for superior contrast ratios (up to 1:2,000,000)
• Far wider viewing angles than those of LCD (up to 178°); images do not suffer from degradation at high angles unlike LCDs
• Virtually no motion blur, thanks in large part to very high refresh rates and a faster response time, contributing to superior performance when displaying content with significant amounts of rapid motion
• Disadvantages
• Earlier models are susceptible to screen burn-in and image retention (however, newer models have green phosphors and built-in technologies to eliminate this, such as pixel shifting)
• Phosphors in older models lose luminosity over time, resulting in gradual decline of absolute image brightness (newer models are less susceptible to this, having life spans exceeding 60,000 hours, far longer than older CRT technology)
• Susceptible to "large area flicker"
• Generally do not come in smaller sizes than 32 inches
• Susceptible to reflection glare in bright rooms
• Heavier than LCD due to the requirement of a glass screen to hold the gases
• Use more electricity, on average, than an LCD TV
• Do not work as well at high altitudes due to pressure differential between the gases inside the screen and the air pressure at altitude. It may cause a buzzing noise. Manufacturers rate their screens to indicate the altitude parameters.
• For those who wish to listen to AM radio, or are Amateur Radio operators (Hams) or Shortwave Listeners (SWL) , the Radio Frequency Interference (RFI) from these devices can be irritating or disabling.
Plasma Display Manufacturers
Plasma Display Manufacturers
• Panasonic Corporation (formerly Matsushita)
• Samsung Electronics
• LG Electronics
• ProScan
• Fujitsu
• Sanyo
• Funai
• Panasonic Corporation (formerly Matsushita)
• Samsung Electronics
• LG Electronics
• ProScan
• Fujitsu
• Sanyo
• Funai
Subscribe to:
Posts (Atom)