DATA CENTER's : THE INDIAN SCENE

1.   The phenomenal growth of data in India is rapidly evolving but where is all that data being stored?.....not a big deal to find out that all your FB profiles,your friends list, Google hangout circle of friends and all the enumerable social networking sites on the web stores your data across the globe but not in India....yes that's the truth...every bit of data that your profile holds is actually residing off shores ...what India might be holding is just logs of transaction via various monitoring eyes like CMS as discussed in last post!!!

2.   But actually what debar's any big company with a global presence to set up a data center in apna India...recently there have a explosion of many posts across the web o sphere citing the query of why is it so?...the reasons cited culminate on one reason and that's known as SECURITY....the non existence of "DATA PRIVACY LAWs" in India.....more over the fact that there is presently no existence of GIS routing of laid OFCs and cables maps though there are always plans and proposals for the future. The problem of underground OFC in and around NCR is such that companies are afraid to commit 100% availability of up time because your OFC can get damaged any time owing to so many under construction sites in NCR with dozers digging out OFC like Hollywood monsters.And these diggings are ever to continue coz still there are no laid down GIS mappings that can accurately predict the route and depth of laid out OFCs....and the most important I feel is the promise of state ELECTRIC POWER supply which is surely unreliable during any season....it is indeed surprising that power is still an issue in NCR towns!!!

3.   The future will always remains bright because we always have plans to remove all these problem areas but how and when remains a futuristic answer.GIS routing of cables is an imminent need and so are the data protection laws.By default as on date most of the data centres are coming up in Singapore.

"Singapore offers an ideal combination of reliable infrastructure, a skilled workforce and a commitment to transparent and business-friendly regulations" is how Google explains its choice of the city. Oracle cites "excellent telecommunications infrastructure and efficient, well-qualified manpower".

Much like India set up software technology parks to nurture its IT services and BPO industry, Singapore is setting up a 13-hectare Data Center Park and inviting companies from across the world. It already has some 20 data centre hubs and offers tax and other incentives.

Source here

Central Monitoring System : Another step in the Wrong Direction ?

1.    The month of "May" has become started with a "Will" from Indian Government.Now after so many still unresolved issues on Facebook posts and similar things in respect of issues of privacy,it has come up now with Central Monitoring System(CMS).The concept was placed in parliament  some time in December 2012 by the then information technology minister Milind Deora on which the government plans to spend Rs 400 crore and this would "lawfully intercept internet and telephone services"

2.  Now this means that everything we say or text over the phone, write, post or browse over the Internet will be centrally monitored by Indian authorities.Every byte of what is being exchanged by you over the net would be monitored.....but is it actually required?I have doubts per-se owing to the amount of further investment it would require.At a time when Big Data analytics is still maturing,investing so much on monitoring and storing some portion of it pan India would be a herculean task.The key points that I found interesting are dotted below :

- With the lack of privacy laws to protect Indian citizens against potential abuse,this would set another example of wrong feather in the cap.

- CMS has been prepared by the Telecom Enforcement, Resource and Monitoring (TREM) and the Centre for Development of Telematics (C-DoT) and is being manned by the Intelligence Bureau. 

- Without any manual intervention from telecom service providers, CMS will equip government agencies with Direct Electronic Provisioning, filter and provide Call Data Records (CDR) analysis and data mining to identify the personal information and provide alerts of the target numbers.

- The estimated cost of CMS is Rs. 4 billion. It will be connected with the Telephone Call Interception System (TCIS) which will help monitor voice calls, SMS and MMS, fax communications on landlines, CDMA, video calls, GSM and 3G networks. Is their any thing on Mother India Earth left to monitor?

3. Now I fail to understand that how Government expects to monitor cyber criminals by this CMS? Does government actually intend to find out the actual potent and dangerous Cyber Criminals or are they only interested in finding love affairs of local boys and girls!!!coz if the intention is former,would the cyber gang do it without tricks?...without encryption?...without spoofing?...when things like stegnography,TOR,Anonymous etc are still to be deciphered....the cyber crime would go on as it is.The focus should have been on analyzing of what is floating around rather then monitoring open text and messages.

4.  For example if a person with malicious intent,uses Whonix or anonymous kind of OS from a local cyber cafe and then places his message vide a steganographed image that is encrypted,is their any way that this can be deciphered?....technology does not exist today to decipher all this quickly ..still time is there when we reach such a stage....few months back in Dec 2012 when torrent was apparently blocked on directives from Govt Of India,anonymous group had given a open letter shared at http://www.geektech.in/archives/9924.

5. Well it is very clear that the decision makers in such moves are unclear on technological reality but also provisions for a scenario like WAR within....each step in such a direction has to be taken carefully because these are really critical.Additionally,outsourcing such moves to unreliable or may be foreign firms may become a serious threat.....

6.  Well at the end of the day,it is just my view per-sewhich no body is bothered...but the repercussions are serious to be avoided and ignored

Cloud Forensics:The State as on Date

1.   Cloud Forensics per se has got two powerful terms of today's buzzing IT World..... that's Cloud and Forensics...when traditional computing methods of forensics are still to mature...Cloud itself has a long way to go before the final matured model comes up...this combination actually refers to the world of CLOUD FORENSICS. NIST defines it as follows :

"Cloud forensics is the application of digital forensics science in cloud computing environments. Technically, it consists of a hybrid forensic approach (e.g., remote, virtual, network, live, large-scale, thin-client, thick-client) towards the generation of digital evidence. Organizationally, it involves interactions among cloud actors (i.e.,cloud provider, cloud consumer, cloud broker, cloud carrier, cloud auditor) for the purpose of facilitating both internal and external investigations. Legally it often implies multi-jurisdictional and multi-tenant situations."

2.   Today at NULLs meet,I got an opportunity to give this presentation on Cloud Forensics....the copy is shown below :

  Cloud Forensics

3. About NULL...please read about the community at their website at http://null.co.in/. The team is doing a great job for buzzing IT professionals,students,geeks,script kiddies(like me!!! :-). NULL boasts of an active security community where monthly meets and regular security awareness camps in various Institutions and Organizations are held. Basically a bunch of security phreaks who like to share their technical expertise and hacking skills with each other and spread awareness among the common people about the good, the bad and the ugly side of computers and technology. They believe that sharing the right technical knowledge leads to expertise and innovation.I joined them about 4 months back and have learned a lot in few meets that I attended!!!!!

Virtual Machines : Escape vs Introspection

1.   For last few years playing inside a VM ,I always used to wonder if it actually that safe surfing anything inside a VM...and that hardly anything gets in touch with the Host machine while we work with applications inside.Then I heard of two relative terms that are : Virtual Machine Escape vs Virtual Machine Introspection

2.  New to me but pretty old from point of view of existence....these are briefly explained below :

Virtual Machine Escape

Normally virtual machines are encapsulated, isolated environments. The operating systems running inside the virtual machine shouldn't know that they are virtualized, and there should be no way to break out of the virtual machine and interact with the parent hyper visor  The process of breaking out and interacting with the hyper visor is called a “VM escape.” Since the hyper visor controls the execution of all of the virtual machines an attacker that can gain access to the hyper visor can then gain control over every other virtual machine running on the host. Because the hyper visor is between the physical hardware and the guest operating system an attacker will then be able to circumvent security controls in place on the virtual machine.(Source : http://lonesysadmin.net)

Virtual Machine Introspection

Although virtualization isn’t new, the recent development of x86 virtualization products has revived interest in the virtualization market. This has led to the evolution of Virtual Machine Introspection (VMI) techniques and tools to monitor VM behavior. VMI tools inspect a VM from the outside to assess what’s happening on the inside.This makes it possible for security tools—such as virus scanners and intrusion detection system to observe and respond to VM events from a “safe” location outside the monitored machine. Depth of information is the fundamental benefit behind a concept called Virtual Machine Introspection (VMI). Its use within virtualized environments is absolutely crucial to effective risk mitigation at scale.(Source : |http://www.securityweek.com/vm-introspection-know-your-virtual-environment-inside-and-out)

So the basic difference is I think the route,in case of the former the need is to contact the hypervisor from inside and the latter shows the way out to get to know whats happening inside from outside perspective.....

Self Destructing E Mails : Receiver reads them only Once

1.   It has always remained a question for typical email users like u and me of how to send a self destructing E-Mail...an email that is read once and destroyed that moment like how about your office messages with vendors or love mails with your present Girl Friend/Boy Friend or u can imagine situations for such requirements....

2. Earlier it had been the disposable email solution and now there are many solutions that offer this particular requirement of Self Destructing E Mails.Below are few such sites and solutions :

- http://www.self-destructing-email.com/

Offers free trials last for two weeks or 25 emails (whichever comes first) and u need to register with it.It lets you decide what happens to your email after sending.

- https://privnote.com/


Privnote is a free web based service that allows you to send top secret notes over the internet. It's fast, easy, and requires no password or user registration at all.

Just write your note, and you'll get a link. Then you copy and paste that link into an email (or instant message) that you send to the person who you want to read the note. When that person clicks the link for the first time, they will see the note in their browser and the note will automatically self-destruct; which means no one (even that very same person) can read the note again. The link won't work anymore.(Courtesy : https://privnote.com/ )

- http://www.destructingmessage.com/

DestructingMessage.com is a free service which enables you to send a self-destructing message to someone. This means, once they read the message they will no longer be able to read it again after the timer has reached zero. This ensures your message is read by no one but the reader and all evidence of the message is erased. Messages are also anonymous unless you add any identifiable information to your message.(Courtesy : http://www.destructingmessage.com/)

- https://oneshar.es/

-  Uses HTTPS (SSL; Port 443) to encrypt the data from your web browser to our servers.

-  All data is stored encrypted.
-  When someone views the unique URL that you send them; your encrypted message is deleted from our system.
-  The datacenter maintains the latest security updates and patches on our server.
-  Google Analytics is used on our site for web analytics.

4G drives to Indore in Cars and Motors via BSNL

1.   Indore is keeping its surfing grounds ready to welcome the 4G speed @ courtesy BSNL.Likely to be launched in some time May 2013......this will also be the first time some thing known as WiFi based "Internet on wheels" will be launched...but that is scheduled slightly later.

2.   Key features about the same :

 - 8 Mbps speed

-  Wi-Fi-based internet facility to motorists on move

-  Rough payment plans :
   
-   "BSNL's internet-activated car kit would be available in three ranges of one time payment plans that include : 
      - Rs 6500, 
      - Rs 27,500 
      - Rs 29,500

-  This will come along with a standard dial-up plan of Rs 250 per month.

3.  Here you go Indore'ites....all the best....but at the same time what props up is how will the gadgets handle this 4G speed....will the already held 3G mobiles and Tabs be able to take on the new G or are we awaiting new advertisements to lure us buying 4G devices!!!!

Browser Updates

1.   Without emphasizing on the need of why we should always keep our browsers updated,I am briefly bringing out here how to check and update your browsers.These browsers are invariably the most commonly used one's ...so I just updated few of them although the browsers exists in plenty!!!!

Firstly

To check the version of your Web Browser, Open the  Browser 

and do the following actions :

For Opera Browser

Click on “Main Menu > Help > About Opera”.

For Firefox

Click “Main Menu >Help> About Firefox.

For Internet Explorer

Press Alt+H and Click on “About Internet Explorer”.

For Apple Safari

Press Alt+H and Click on “About Safari”.

Secondly

To check whats the latest version doing the surfing....i advise two options...either you can simply ask google or check form the respective websites of the web browser...or another easy(but third party) way out is to check the latest versions available for download at http://www.filehippo.com/software/internet/browsers/

HIT WICKET & OUT- Microsoft Genuine Patch crashes WINDOWS 7

1.     This is some news from the corridors of Microsoft.A genuine MS patch released for Windows 7.The patch in the dispute is "Microsoft Security Bulletin MS13-036"

2.  Redmond from Microsoft's Security Response blog blamed the glitch on conflicts with third-party software:

We are aware that some of our customers may be experiencing difficulties after applying security update 2823324, which we provided in security bulletin MS13-036 on Tuesday, April 9. We’ve determined that the update, when paired with certain third-party software, can cause system errors. As a precaution, we stopped pushing 2823324 as an update when we began investigating the error reports, and have since removed it from the download centre.

Contrary to some reports, the system errors do not result in any data loss nor affect all Windows customers. However, all customers should follow the guidance that we have provided in KB2839011 to uninstall security update 2823324 if it is already installed.

3.   That means Windows 7 users should uninstall the security patch Microsoft issued on Tuesday because some PCs failed to restart after applying the update.....:-).Microsoft has advised users of Win 7 and Windows Server 2008 R2* to roll-back the patch.

4.   More about the patch here.Thanks http://www.theregister.co.uk/security/

GPS SPOOF!!!!

1.   Unlike the regular IT hacks wherein we keep seeing MAC spoofing,IP spoofing etc....what can one imagine if a GPS is spoofed.....:-)...can it make a plane land at a wrong coordinate?...YES!!!if it goes by the claims of a Iranian.

2. A US stealth drone was captured by spoofing its GPS coordinates, a hack that tricked the bird into landing in Iranian territory instead of where it was programmed to touch down...Phew..i bet u will read that again(Source :http://www.theregister.co.uk/2011/12/15/us_spy_drone_gps_spoofing/ )

3.   The 1700-word article cited an unnamed Iranian engineer who said he's studying the inner workings of the American bat-wing RQ-170 Sentinel that recently went missing over Iranian airspace. He said the spoofing technique made the craft “land on its own where we wanted it to, without having to crack the remote-control signals and communications” from the US control center.(Source :http://www.theregister.co.uk/2011/12/15/us_spy_drone_gps_spoofing/ )

4. Thats hell of a HACK...if it actually is!!!!!!salutes to the guy who could do it in real....now i wonder what all could land at forbidden places if it is really possible.....:-)

5. Thanks http://www.theregister.co.uk

FUDUNTU : Ubuntu + Fedora

1.     How about the best from Ubuntu and Fedora into one single OS?... that's rightly heard....the name is FUDUNTU....few things about this mentioned below :

- Website at http://www.fuduntu.org/

- Fuduntu aims to fit somewhere between Fedora and Ubuntu

- Fuduntu is a lighthearted and fun Linux distribution

 - Option to download directly as well as through torrent

- Fuduntu is optimized for on the go computing(good for Laptop and Netbook users )

- Improved battery life of 30% or more over other Linux distributions.

- The latest Fuduntu 2013.2 has LibreOffice, GIMP, Thunderbird, and other software that takes up a lot of space, approximately 10GB of disk space when installed. However, if you don’t need all that, try out the Lite version, where ISO weighs 800 MB and eats up 6 GB when installed.

2.   The download has started and if I feel it worth will show up with something about it...btw the looks are promising!!!!!