Dungeon Works

Amazon smart plug review

2021-11-18T09:55:00.004-08:00

Amazon smart plug Usage - 5 months. Bought it when it was on sale. 500Rs.

So far there is no connection issue. Integration with Alexa works great for voice commands. It works also with just the Alexa app. For me it serves the purpose of controlling the aquarium filter and heater. I have scheduled it to run an hour daily, have not faced any hiccups. Installation is easy. It also has a manual button on the plug, in case you want to override.

Cons:

There are other cheaper alternatives in the market.

Does not work with other smart assistants.

LOB size in SQL DB

2021-11-18T02:39:00.003-08:00

Exception: System.Data.SqlClient.SqlException: Length of LOB data () to be replicated exceeds configured maximum 65536. Use the stored procedure sp_configure to increase the configured maximum value for max text repl size option, which defaults to 65536. A configured value of -1 indicates no limit, other that the limit imposed by the data type.

When a field in the SQL DB is tracked by CDC. You may encounter this error for Varbinary(max) field. The reason being the default size for replication is maximum 65536. Therefore, if you are in a context where your Varbinary fields are being tracked by CDC for some reason - You will need to configure a higher value for the replication size.

EXEC sp_configure 'max text repl size (B)', -1 RECONFIGURE WITH OVERRIDE

-1 indicates that there is no limit or instead of -1 you can set limits in Bytes

Mi Mop bot review

2021-11-08T22:37:00.001-08:00

Mi Mop bot 2021 review (after 3 months usage)

Exceptions\Issues navigating when faced with:

Piano stand\iron stand bottom knobs. The bot is not able to gauge this, so it keeps crashing into it.

Long curtains touching the ground or almost touching the ground. The bot finds it hard to clean near by, as it sees this as an obstacle. So while cleaning you can fold or tie the curtain up.

Cleaning under computer chairs is fairly ok. Again it depends on the height of your chair.

Other small objects like - Papers, leaves, ropes, chocolate wrappers, toothpicks - get stuck inside the vacuum or under the bot, preventing the bot from cleaning properly. It is better to remove such objects before cleaning or pause the cleaning when the these objects are stuck with the bot. Remove and resume the cleaning.

Certain doormats which are thin tend to get moved around by the bot, it is better to have hard and sturdier door mats or to remove them temporarily.

Cleaning the device:

Cleaning the roller is a tough task. Lot of hair strands tend to get caught up in it.

Cleaning the mop cloth is required after every mopping. Do not keep the mop cloth to the bot when not in use.

Cleaning the dust compartment box is a little tricky - there is a trick to open the white box.

The black box with the water compartment requires frequent filling of water when mopping. It needs cleaning too after completion of task.

Jet black colour of the bot - prone to dust build up. Needs to be wiped from time to time.

Clean all three wheels , else it would leave tracks during mopping.

Map Feature:

Requires that you have strong wifi coverage across the house.

Either use Mesh routers or place the wifi router in a place where wifi comes to all edges. (You can use wifi heat map on your mobile to check if wifi connectivity is available on all corners.)

Use the edge cleaning mode to map the house before performing any task.

Later classify the rooms, this will enable you to selectively clean rooms which you want.

While mapping first time, try to map the edge as much as possible.

ex: remove the flower vases \ chairs \ small furniture from the edges.

Make sure you start the mapping from the charging dock.

If you do not follow the above, you will find difficulty in mapping the home and face issues.

UseCases:

During the course of time or when you move your fridge \ bed (which was lined up to the wall) to clean underneath it.

You will have to use selective area cleaning (instead of room cleaning.)If you select room wise cleaning in such a scenario, the bot will use the old map and it will ignore the new space which was got by moving the appliance or furniture.

We are NOT supposed to fill any cleaning solution in the water tank compartment. If required you can sprinkle some diluted cleaning solution on the floor.

Device may find it difficult to navigate to selective areas if there are restricted zones in between.

So it is better to lift the bot and place it where it is required. ex: if there is a spill of sugar on the kitchen floor, when you mark the area to be cleaned via the map. The bot might find it difficult to navigate from the DockingStation to the cleaning area. You can also use the "Manual Navigate" option in the app.

Internet failures during cleaning:

If it is a matter of few secs, there will no issues. If it is more than a minute, the bot looses its context and has issues retaining the map \ cleaning info. In such cases, use "Selective Area Cleaning" to continue cleaning. However this requires some manual supervision.

Note: During the initial edge cleaning for the mapping - make sure the internet stays on.

There is a gap between the intended cleaning area edges and the actual cleaning. So you will have to ensure that you give a bigger cleaning area, so that your intended areas are cleaned correctly.

If you are having trouble mapping the entire house due to some reason. You can either just turn on the sweep \ mop mode.

It will do a complete cleaning on its own. Or you can place it inside a room and lock the door, it will complete the cleaning .

Do not turn off the docking station in the middle of cleaning. The bot will either end up crashing into the device or it will end up roaming about.

You will require to place the bot and docking station in a place where there are no obstacles for 90CM each side.

I would recommend using the vacuum mode separately and then the vacuum and mop mode.

It can clean without a map. It will mark the edges and go about cleaning it.

(There are other competent models in ILife which are cheaper, if you do not want the mapping\selective area cleaning\ restricted area feature.)

Error Message: "Please complete the cleaning task first and make sure remember map is enabled"

If you see the above message, it means that you have to set the Remember Map setting in the app.

Followed by selecting edge cleaning ie "Vacuum along the edges" option in the map. This will map your entire house. After that with the help of Area Editor you can classify various rooms.

Follow the "Map Feature" instructions in this article to solve this problem.

Conclusion:

Good at cleaning under tables, chairs etc where the broom is difficult to fit.

Note: It picks up all the small dust just like your vacuum cleaner. (Explore Karcher Vacuum cleaner for your vacuuming needs)

It serves as a good relief for your cleaning chores , as it does most of the work. Definitely it is not an alternative to the manual work but it does atleast 80% of the actual cleaning.

Mopping - Good enough. (tested for Ceramic Tiles, rubber mat flooring)

Good suction power.

Though this has only one fan\brush, it does a decent job.

Price point is very competitive, during sale season you will find it for 20k INR

S-mode and Y-Mode cleaning. S-mode is quicker. Y-mode is slower but mopping is better. Choose it depending on your need.

Missing:

Dirt sensor is missing in this bot. It is available in Roomba. (You can use targeted cleaning to overcome this.)

Software or App can be refined. It requires a good amount of knowledge to operate. (Use it as a regular cleaning bot without the mapping function.)

Obstacle avoidance can be better. (Supervise the bot for the first few times in your house, understand the objects which the bot finds difficult to navigate - then adjust them accordingly)

Sometimes the map gets adjusted drastically in the app while cleaning, however this does not affect the cleaning. The GPS accuracy can be improved.

If you are using the map feature to clean various rooms, the cleaning requires wifi. It cannot navigate with map alone, though the initial map is done.

Support from MI is not upto mark. Most of the service people do not know the product well. Mi support forums on the web require you to use VPN and proxy sites to access.

Cleaning Algorithm:

It is observed that it breaks the room into smaller parts based on the furniture\ obstacles and cleans the larger area that is emptier and then moves on to small areas.

It is normal for it to find a different pattern every time it cleans or mops.

Remove NsCpuCNMiner.exe or NsCpuCNMiner64.exe manually

2018-02-21T02:57:00.000-08:00

Remove NsCpuCNMiner.exe manually.

These are the steps I followed when one of my colleague's system was infected with this Malware.

What it is ?
It is a process which runs in the background and mines for crypto-currency using your system as the resource.

Symptoms:
Disk utilization & CPU usage will be max. So your system will be slow.
Application will take longer time to open.
In some cases you get some popups in your web-browser.

Steps to Remove:

Step 1 - Stop the process
Goto Task Manager->Services -> select NsCpuCNMiner or NsCpuCNMiner64 -> right click - end process

Step 2 - Remove related extensions from browser
Goto chrome browser extensions and check if any miners are present and remove them.

Step 3 - Disable From startup
Goto Win+R run -> msconfig.exe -> startup -> Disable the NsCpuCNMiner or NsCpuCNMiner64
For win 10
Goto task manager -> startup services -> Disable the NsCpuCNMiner or NsCpuCNMiner64 or Folder (Yes it is the malware and not the WindowsExplorer process)

Step 4 - Delete the source file
Goto Win+R run -> type %AppData% -> Navigate to "Roaming" -> "Images" and delete all the contents of the folder. (This contains the exe :see image)

Step 5 - Delete from registry
Goto Win+R run -> type regedit -> Once the registry editor is opened -> type Cntrl + F
-> search for "NsCpuCNMiner" and delete every occurrence of this.

If you face any issues while removing the malware, do comment below - I shall respond.

TFS workspace problem

2018-02-06T12:41:00.000-08:00

TF400018: The local version table for the local workspace MY-PC;My User could not be opened. The workspace version table contains an unknown schema version.

Click the box labelled "Workspace".
    Click on "Workspaces".
    Delete the corrupt workspace profile, accepting the warning.
    Re-connect to TFS and open "Source Control Explorer"
    Create a new workspace
    One by one, map your projects to the same folder as before
    You will be presented with a list of conflicts, where you have matching writable files in the folder already.
    Choose "Keep local copy" for each file you had checked out before, and "Take Server Version" for any files changed by other members of the team that you didn't have the latest version for. This might take a while depending on the length of the list, but it is worth comparing versions for any file you are unsure of.

    Most of the cs proj files will show contain the files you have added,
    but it wont show up in the solution explorer.

    Click on ShowHiddenFiles, select the files that do not have
    a + sign (add) or a red tick mark (CheckOut) and exclude them from project
    and right click and include them in the project.

    This should solve the problem

WannaCry Ransomware

2017-05-14T22:03:00.003-07:00

Ransomware .
Ransomware - a type of malicious software designed to encrypt all your files, which will not be decrypted by the attacker until a sum of money is paid.

Check out my other post relating to Ransomware Risk Mitigation

WannaCry Ransomware :
This ransomware spreads via known vulnerabilities, which was patched recently by Microsoft MS17-010 . Once the system is targeted the files are encrypted and a countdown appears. The popup demands $300 dollars of payment to be made via bitcoin.

Which files are encrypted?

Almost all common extensions.

What to do if you have been attacked by WannaCry?

For now, do not pay the ransom. Restore the files from your backup.
Most of the previous ransomware attacks have a way to decrypt the files without paying the ransom. However for wannacry at this moment there is no way.

Has the infection been contained?

Yes the infection being spread has been halted for now. Thanks to the good intentions of a researcher called MalwareTech.

but everyone seems sure that another such attack is imminent.

Precautions to be taken:

Windows Update MS17-010
The virus uses ETERNALBLUE exploit, which is closed by Microsoft security update MS17-010 released in March. I recommend that you check update center for presence of such an update (by code) on your computer (for example, code for Windows 7 will be KB4012212 or KB4012215).
If updates are not installed, you can download them from official Microsoft website:
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Close ports 135 and 445
According to the reports of antivirus companies, wcrypt penetrates computers through SMB (Server Message Block) ports. To prevent penetration, we block the ports 135 and 445 through which the virus penetrates (in most cases they are not used by ordinary users).
To do this, open the console with administrator rights (cmd.exe -> run as administrator). And we execute in turn 2 commands (after each command there should be status OK).

netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=135 name="Block_TCP-135"

netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=445 name="Block_TCP-445"

Disabling SMBv1 support
The vulnerability can also be closed by completely disabling SMBv1 support. Run this command in cmd (run as administrator).

dism /online /norestart /disable-feature /featurename:SMB1Protocol

To prevent yourself from future Ransomware Attacks:

Back up necessary data from time to time.

Update your OS to the latest. (the recent NSA exploit leaks about OS like XP will trigger more ransomware with different flavors)

Updating Antivirus or having the best, does not provide necessary protection against such attacks.

Do not open any emails from unknown senders.

Close the ports which you do not use.

Check out my other post relating to Ransomware Risk Mitigation

References:
For a detailed view on the attack:
https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/

Removing empty pages in SSRS Report.

2017-04-25T23:52:00.000-07:00

How to get rid of blank pages in PDF exported from SSRS

This issue occurs when you have added some components to your SSRS report and the page width has increased. Mostly it is the right margin of the page.

Resolution: go to the report in design view.

Right Click > view > ruler

Reduce the width now. Your report will now be void of blank pages.

Layoff the Bhim App (For Now)

2017-01-18T22:40:00.002-08:00

BHIM app the UPI payment app introduced by the Indian PM is just another UPI app.

There are far too many competitors of BHIM such ICICI UPI app, HDFC UPI app, Axis Pay, PhonePe, SBI Pay etc.

However, BHIM was hailed as the most secure

“BHIM uses three-factor authentication and hence, is relatively more secure from a consumer point of view. It also combines the convenience of a mobile wallet with the security of net banking,” he said.

When a user opens BHIM application for the first time, the application automatically binds itself to their device ID and phone number — both of which are unique. This means that the same UPI cannot be used from two phones. The BHIM application will also not work on a phone which doesn’t have a SIM card.

“This uniquely identifies not just the device but the active number. If there is some fraud…you have an operational number plus the device ID, which in some cases can be masked, but a combination of both makes it easy to track the cell phone and law enforcement agencies can physically trace the person, if needed.” said a security firm researcher.

“The third factor is the UPI PIN, set by the user, which will be required for every transaction through the application.” No user would be able to do transactions without the UPI PIN, he said.

However after few days after the release of the app, lot of people are complaining about the app being sluggish.

There are other security concerns of the app such as,

The back button is not restricted and you can move back and forth the payment page.
The app is prone to SQL injection attacks.
The app is slow, (in fairness so are majority of the UPI apps)

So it is definitely worth to wait before you jump onto BHIM. The app makers stated that they are working on the issues and will release an update at the earliest.

Uber Tracking your location after completing your Ride.

2016-12-14T03:41:00.000-08:00

Uber has said that it will track your location for 5 mins after completing your ride.
It claims, it will help in better consumer experience as location is key in it's game.

Till now we do not know how long it has been tracking its users after completing their ride. I did happen to read the wired article, which says how Uber has a "God View" and how it is a source of entertainment at parties :|
Yes, Uber app in the background can also track your location.

To disable the tracking, you will need to disable location permission on ur phone;
for all your apps or Uber specific location permission(Android Marshmallow and above)

Rise of the Mirai Botnet

2016-12-09T03:23:00.005-08:00

Mirai Botnet is the one which you might have heard that kicked dyn out of gear.
Thats right it is indeed the recruiter of an army of zombies ie. unsecured Internet Connected devices.

Internet connected devices such as your computer, router, webcam etc are all vulnerable to this malware.

The malware follows a simple strategy of compromising the internet connected devives by

Take Over the Device

using the default username and password of the device to gain access and add it to its army.
It also uses BruteForce Dictionary attack to gain passwords.

Clear the hurdles

Mirai also kills any existing malwares on the devices, so that it maximizes its potential. It also prevents
remote login so that it can not be stopped in the middle of the attack.

Execute

Once Mirai is in control of the device it waits for commands to be executed by the central server.

The Do-Not List: It also has a list which it refrains from scanning.(for unknown purpose or to prevent from gaining attention.)

Once the botnet has enough devices in its army, it begins attacking the target via DDOS.

How to Prevent Mirai.?
Change your default/ weak password of your devices.

Disable remote logging/ wan . (if not used.)

Attack on DYN.
DYN is a DNS management systems which helps in the lookup of the the domain names to the IP addresses.
Since this DNS infra was attacked by mirai botnet the DNS lookupsites like amazon, twitter and many other sites were unable to access to the consumers.

The attack was mitigated by using scrubbing services (the traffic is rerouted to new servers or data centers which identifies fake trafficfrom the real one)
On rebooting the devices, the attack can be stopped.

The source code has been released on one of the hacker forums,
https://github.com/jgamblin/Mirai-Source-Code

Watchout for Gooligan- Check if you are affected now!

2016-12-01T21:53:00.000-08:00

Gooligan is a malware that affects android os phones particularly V4 &5. This malware was reported first mid of 2016. This malware steals the authentication tokens of your google accounts such as drive, mail etc and installs adwares which inturn generates revenue for the installed apps.

More Details:https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi

List of Apps installed by Gooligan: http://blog.checkpoint.com/2016/11/30/1-million-google-accounts-breached-gooligan/

Check here if your account is being compromised
https://gooligan.checkpoint.com/

If you find your account is compromised then it would be safe to do a clean install of the OS on your phone, a factory reset on your phone wont get you that far. Also change passwords immediately of your google accounts. Gooligan does not access user data nor modifies OS/ system files.

Use Google Play Store to download apps and be careful while installing apps from 3rd party websites.

Paytm POS app rolled back on Security Concerns

2016-11-27T05:05:00.000-08:00

Paytm which has been in the news ever since the demonetisation drive in India, had rolled out a POS app. This app has been rolled back citing security concerns highlighted by the concerned parties.

The current app allows payment via QR code. Customer scans the QR code of the merchant via the app to make the payment. Transferring money instantly to the destined account/ wallet. This is a secure way to make a payment because QR code payments use tokens to make the transaction.

What was the problem with the new POS app?

This new feature would require the customer to key in his card number and PIN into the Paytm app of the merchant.

As we are aware of key loggers and other screen grabbing softwares which can be installed by the merchant in his device, the unaware customer keys-in his card details into the Paytm app of the merchant while being unaware that it is being recorded by the key logger app thus the customer's card data is compromised.

Paytm has said repeatedly that it is a PCI-DSS (Payment Card Industry Data Security Standard ) and conducts several security audits. One of the main requirement to comply to PCI DSS is that the merchant should not hold card data of its customer in it's systems. While it might be true that Paytm does not hold customer card data, but this new feature in this application would allow the customer to pay by entering his card details just like any other e-commerce site's payment page. The same risks you would face while entering the card details online, you would face the same here except the added risk that the payment you do is not on your device but that of the merchant.

As many would agree that the same type of attack can be performed on the POS by installing some malware / malicious code. It is true that such an attack can be performed but it requires some deep knowledge of the working PED/ POS device and being able to post / transmit the data. There are encrypted PED/ POS devices but even they can be fused with malicious code. But the hack (if you would like to call it that) is not universal to all devices. There are many vendors of POS devices in the market and each have different set of instructions/operations, thus hacking such a device actually needs extensive knowledge of the device and the system it is placed inn.

But in case of the POS that was in the Paytm app it is vulnerable to key-loggers and performing a keylogging attack doesnt need an expert. It is fairly easy to install an app from the app store and set the keystrokes entered on the device to be mailed every set period of time.

Paytm has said that it will rollout the app after getting additional certifications.

https://blog.paytm.com

BlackNurse - A new variant of DDOS

2016-11-23T04:02:00.000-08:00

This new attack was discovered by TDC engineers. http://www.blacknurse.dk/

The attack falls on the lines of an ICMP flood attack. The ICMP flood attack involves flooding the target with large amount of traffic whereas black nurse attack requires a very minimal ping traffic while leveraging on ICMP Type 3 Code 3 ( Destination Port Not Reachable ) .

An attack from a laptop can go upto 180 megabits per sec and bring down the firewall effectively. The attack is effective and Cisco and Palo Alto and a few more. This attack is possible only if you have allowed ICMP Type 3 Code 3 to outside interfaces.

http://soc.tdc.dk/blacknurse/blacknurse.pdf

Test your system with this Proof of Concept Code to check if you are vulnerable.
https://github.com/jedisct1/blacknurse

If vulnerable check with your vendor website to mitigate the risk.

Worst case- your router crashes and after the flooding, your router comes back up.

Load testing on single server - Jmeter

2016-11-12T22:03:00.000-08:00

Application: w3wp.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.AccessViolationException

at System.Threading.Thread.InternalCrossContextCallback(System.Runtime.Remoting.Contexts.Context, IntPtr, Int32, System.Threading.InternalCrossContextDelegate, System.Object[])

at System.Runtime.Remoting.Channels.CrossContextChannel.SyncProcessMessage(System.Runtime.Remoting.Messaging.IMessage)

at System.Runtime.Remoting.Proxies.RemotingProxy.CallProcessMessage(System.Runtime.Remoting.Messaging.IMessageSink, System.Runtime.Remoting.Messaging.IMessage, System.Runtime.Remoting.Contexts.ArrayWithSize, System.Threading.Thread, System.Runtime.Remoting.Contexts.Context, Boolean)

at System.Runtime.Remoting.Proxies.RemotingProxy.InternalInvoke(System.Runtime.Remoting.Messaging.IMethodCallMessage, Boolean, Int32)

at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(System.Runtime.Remoting.Proxies.MessageData ByRef, Int32)

at .....followed by application exception

When I was running my load tests using JMeter against a single server (usually against a load balancer but for some reason wanted to know the)I happened to get this weird error repeatedly with 100% error rate in Jmeter. The application I was testing was a WCF service hosted on IIS.

My first instinct was to check if the error had occurred because of my recent changes, I checked the event viewer which told me that this error was occurring very rarely.

It took a lot of googling and ended up with nothing, so I decided to check on the IIS 7 configuration.

I found the root cause of the failure, it was due to few configurations that had to be changed in IIS.

Configuration:

IIS Queue Length: The default value is 1000, so after 1000 active connections any new connections will be served a 503 Error.

IIS rapid fail protection: By default the value is set as true. So after 5 application errors, the app pool goes down.

To sum it up, since I ran the load test for 'n' Users. The default IIS Queue size is overloaded with many requests crossing the default 1000 queue size which returns application errors our and the other config “Rapid Fail Protection” pulls down the app pool.

This error has occurred only because I load tested on a single server with a connection limit of 1000 in the IIS.

I increased the queue size to the max value of 9000 and disabled the Rapid Fail Protection and Ran the same LOAD TEST. It FIXED the problem and worked well as I saw a error rate of less than 0.3% for a very large sample and the above error never occurred again. Turns out it only occurred because I ran the load test against a single server. But it did point out to me that all the servers had a default value of 1000 Queue size and in case of an actual load all the servers would have gone crashing down.

So to conclude the above error was a memory error I believe. If you faced the same error please post below on what you did to fix it.

Here are the configurations for IIS 7.0 as suggested by Microsoft. Be careful in whatever you need for your application, not all is good for you.

https://technet.microsoft.com/en-us/library/cc745955.aspx

SoapUI hosting on Tomcat error

2016-11-07T22:28:00.000-08:00

06-Nov-2016 14:18:34.624 SEVERE [http-nio-9092-exec-2] org.apache.catalina.core.ApplicationContext.log StandardWrapper.Throwable
java.lang.NoClassDefFoundError: Could not initialize class com.eviware.soapui.impl.wsdl.support.http.HttpClientSupport
at com.eviware.soapui.DefaultSoapUICore.initSettings(DefaultSoapUICore.java:361)
at com.eviware.soapui.DefaultSoapUICore.init(DefaultSoapUICore.java:129)
at com.eviware.soapui.DefaultSoapUICore.<init>(DefaultSoapUICore.java:114)
at com.eviware.soapui.mockaswar.MockAsWarServlet$MockServletSoapUICore.<init>(MockAsWarServlet.java:317)
at com.eviware.soapui.mockaswar.MockAsWarServlet.init(MockAsWarServlet.java:71)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1183)
at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1099)
at org.apache.catalina.core.StandardWrapper.allocate(StandardWrapper.java:779)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:133)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:108)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:784)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:802)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1410)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Unknown Source)

This is the error I happened to get on SOAPUI 5.2.1 on trying to deploy a war file containing mock service on Apache Tomcat 8.5.

This issue is caused because the hosting service is unable to find some jar files required to host the service. This can be FIXed by ensuring soapUI has internet access. Once I ran this on a system having internet access, it worked fine.

If you have a system without internet access, you can use the SOAPUI itself to host the mock service and disable logging, it is good enough to run a Load Test on it. Response time I saw was 0.1ms .

Managing VirtualBox Better

2016-11-04T21:40:00.000-07:00

Getting the better out of the painful VM – Virtual Box

After struggling a long time with VM with slow speed and frequent crashes. I found few tips from various websites which helps the VM run in a better way.

This post contains the following.

· Tweaks for a better VM
· Installing Ubuntu or any other Linux/OS on Oraclebox.
· Misc

Below are a few tweaks that can be done to prevent VM from getting crashed and to make it perform better.

(It would be better if you have the fresh vmdk file before applying the following settings.)

Go to

machine-> settings-System.

Set Base Memory to the max green level.

Switch to Processor Tab

Set the CPU as 2 or the green level.

Set the execution Cap below it to 100%

Switch to Acceleration Tab

Set both Option in Hardware Virtualization to checked.

Go to Display

set Video memory to 128 mb in the video tab

Other things to do:

· Take a snapshot of the fresh install (initial install) – You can restore to any previous snapshot and prevent the loss of your entire vm
· Run Disk Defragmenter every week on your VM.
· Save the machine state, do not shutdown everytime.
· Always choose fixed disk size to prevent space and performance issues.

In case of network issues:

Go to machine -> settings -> Network

Change Adapter 1 to Attached to : Bridged (works sometimes- this is due to network issues.)

Installing a linux VM on your own.

Download Ubuntu or any linux distro iso file .

http://linuxlookup.com/linux_iso

· Start VMware.

· From the File menu select "Create a New Virtual Machine"

· Choose to install the operating system later. Click "Next".

· Select Linux as the "Guest Operating System" and then choose Ubuntu as the "Version". Click "next".

· Provide a "Virtual machine name" and "Location" where the machine will be stored on the Windows host. The defaults are fine here. Click "Next".

· For "Maximum disk size (GB)" it is good to start with 40G if possible. This means that it will take up 40G on the Windows host. Make sure that the Windows host has at least this much before proceeding. It is also a good practice to tell VMware to split the virtual disk into 2G files. This will makes the image easier to copy and transport if necessary. Click "Next".

· Click "Finish" to complete the creation of the virtual machine.

settings -> Storage -> Select the disk Icon
On the right select Attributes browse the ISO you downloaded.Click OK.
Now boot up Ubuntu VM ware - install normally like you do any OS installation.
After installation, you will be prompted for reboot.
Go to Machine ->Settings -> Storage -> Select the disk Icon
On the right select Attributes Disk image and select remove the iso.
Now boot up your VM again. You can use Ubuntu .

MISC:
Cloning:

When you want to clone the VMDK file. (Time consuming, do not do it unless extremely necessary)

Grouping Boxes:

Group -> group (for better classification)

Secure your site using Cloudflare for free

2016-10-25T23:53:00.000-07:00

Want to secure your site immediately due to the rise in DDOS attacks?
Use Cloudflare

what is cloudflare?

It is a CDN - Content Delivery Network, with added security measures.

In short it caches your website content across all its servers around the world. So that it can serve your website consumers at a quicker pace.

While preventing your site from a DDOS attack / Spam Bot/ SQL Injection. There are many players in CDN which is led by Akamai.

Usage of cloudflare is known to improve the performance of your website and the security.

The process is fairly simple. Try it out.

https://support.cloudflare.com/hc/en-us/articles/201720164-Step-2-Create-a-CloudFlare-account-and-add-a-website

Ransomware Risk Mitigation

2016-10-17T11:37:00.000-07:00

RANSOMWARE:

Malware that locks/encrypts your system / files and requires you to pay a ransom amount to decrypt/unlock your system/files.

RANSOMWARE is a serious issue addressed by all the AV companies and the security agencies like the FBI.

The average ransom demand is now $679

RANSOMWARE targets end users and targets on enterprise users is on the rise usually by spear phishing emails.

Stages of RANSOMWARE:

Infection: The script / program / exe file that contains the code to encrypt all your system files.

Search & Encrypt: Most of the times, the file type is configured. The script searches for system files / .docx xlsx and other specified files and starts encryption.

Notification: The affected system is notified that the system is locked and a ransom needs to be paid.

Along with a countdown timer indicating the time left to pay ransom after which you will never be able to recover the data.

Something like this:

RANSOMWARE is not a Virus.

RANSOMWARE informs the user after the attack and requires you to pay up to free your data which is held ransom.

Why isn’t your antivirus/ security suite not enough?

AV’s work on signature recognition of a file / program to detect whether it is a good egg or a bad one.

There are quite a few famous RANSOMWARE such as TesCrypt, Locky, Waltrix etc. But the main problem is that there are many types of custom RANSOMWARE. Which renders the signature recognition useless.

Ransomware has gained a lot of steam in the past year. It has even evolved to “Ransomware as a Service”, it is being sold on the market like any other software service. One might also witness a very immense competition between rival groups, with each group sharing the decrypting keys of its rival.

Preventing a RANSOMWARE Attack:

Employee Training: Most of the employees working in enterprise / Health Industry are not aware of RANSOMWARE. They need to be made aware and trained in how to prevent and report such an occurrence.

Phishing: Beware of phishing emails. RANSOMWARE can also be disguised in macros and sent across via email stating “2016 Store Rollout Plain.xlsx” (something that looks genuine) Macros have unlimited ability to execute a program or script. Disable macros when not required.

Click Bait: Many links are leached with RANSOMWARE infections causing the script / payload to download via JavaScript and other means and affects the system

Internet: If you are aware that files are being encrypted, shut down the internet immediately and also power off the system. This will help you in preventing the infection spread. Disconnect any network drives connected to the system. As RANSOMWARE has a tendency to go after it too.

Backup: Have a scheduled backup taken often. In case of RANSOMWARE infection system can be restored using the backup/ windows restore. Beware some RANSOMWARE even encrypt the shadow/ backup files.

Public Wi-Fi: Beware of public wifi’s best if you prevent using public Wi-Fi for official work. Using man in the middle attack via a pineapple router the attacker can easily move the infection to your system.

Update: Keep updating your system via patches and the softwares, applications which you use regularly to safeguard against the latest vulnerabilities.

Show Hidden File Extensions: This could prevent the user from running an exe file disguised as a video or picture file.

Misc: You will need a behavior driven detection system that looks out for malicious activity of a program or a user. Since RANSOMWARE attack can be unique every time, having such a detection system will truly serve the purpose. Ex: https://www.barkly.com/

In case you are attacked:

· Inform the authorities.

· Isolate the system from network.

· There are many free tools out there that might help you unlock. You may try them. Ex: Trend Micro Crypto-RANSOMWARE File Decryptor Tool

· Paying the Ransom should be your last option. Many organizations have ended up paying. Many cases the decrypter key is not provided even after the payment of the ransom.

References: Osterman Research

JMeter Memory error

2016-10-12T23:39:00.000-07:00

As I was running a load test on an WCF service for the first time with JMeter, once the samples reached 30k the JMeter UI froze up and I had to close JMeter abruptly. I happened to check on the JMeter logs and found that this was the last entry
jmeter.threads.JMeterThread: Test failed! java.lang.OutOfMemoryError: Java heap space

As usual I turned to google and found out that this error can be forgone by increasing the Java heap space.

This line in jmeter.bat or jmeter.sh script which tells the launching instance of JMeter how much heap size it should use.

JVM_ARGS="-Xms512m -Xmx512m" jmeter.sh

I changed it to -Xms1024m at both places and relaunched JMeter. (Please Note that your system that has JMeter setup has sufficient RAM )

It FIXed the problem.

I am able to test the application now, crossing the previous 30k sample and going beyond till I stop the test manually.

Also I found the below article with a couple of more fixes that you might need in case you are facing the above error still.

https://www.blazemeter.com/blog/9-easy-solutions-jmeter-load-test-%E2%80%9Cout-memory%E2%80%9D-failure

The decoration of objects

2016-09-01T01:52:00.000-07:00

This is an image of tree rings. As you know the rings indicate the age of the tree.

Now coming to our example of Decorator pattern, the "first year of growth is our original object and the rest of the rings are the decorators"

Decorator pattern is used as an alternative for subclassing when we need the functionality to be extended. It is also an example of the Open- Closed Principle where we are allowed only to extend instead of modify.

When do we used decorator pattern?

When we have a set of large combination of two or more different sets of logic to be performed, instead of having a nightmare of derived classes we would rather bind the required logic dynamically.

Consider a web cam device that rotates and takes a photo everytime it senses motion of object in front of it.

Pseudo Code

InstructionCode ActionPerformed

CC Check if device is awake/Powered on

SS Check if sensor is functional

TT Take a snapshot

RR Rotate towards object of movement

DD Detect motion

MM TimerControl

Scenario 1:
The workflow will be such as

CC- Check if device is awake >> SS- Check if sensor is functional >> DD- Detect Motion >> RR- Rotate towards motion >> TT - Take Snapshot.

So the code you would need to write would be
CC SS DD RR TT

Scenario 2:
Now if the functionality of the device is changed to take pictures at every interval of time.

The workflow will be

CC- Check if device is awake >> MM- Timer Control >> TT- Take Snapshot.

So the code you would need to write would be

CC MM TT

If you considered the above scenario writing without a decorator pattern and having derived classes etc, it would have taken a lot of time modifying the codebase to fit in scenario 2 and violating the open closed principle of SOLID. Instead on using decorator we leave the scenrario 1 code untouched while we implement the scenario 2 logic.

In the above example we have limited number of instructions, consider writing a code for a IOT device which has numerous instruction sets all that need to be constructed to interact with a device. In such a scenario you would definitely prefer writing less code and opt for decorator pattern.

Below is a basic code example of an Ice Cream Preparation using decorator pattern.

The Ice Cream comes with a base Cone and with one scoop of ice cream.
It can be topped with chocolate sauce, sprinkles, gummy bears or all the above.

using System;

namespace IceCreamDecoration
{
public abstract class BaseCone
{
protected double myPrice;

public virtual double GetPrice()
{
return this.myPrice;
}
}

public abstract class IceCreamToppingsDecorator : BaseCone
{
protected BaseCone basecone;
public IceCreamToppingsDecorator(BaseCone baseconeToDecorate)
{
this.basecone = baseconeToDecorate;
}

public override double GetPrice()
{
return (this.basecone.GetPrice() + this.myPrice);
}
}

class Program
{

static void Main()
{

OneScoop basecone = new OneScoop();
Console.WriteLine("Just one scoop : " + basecone.GetPrice().ToString());

SprinklesTopping sprinkles = new SprinklesTopping(basecone);
SprinklesTopping moresprinkles = new SprinklesTopping(sprinkles);
Console.WriteLine("single scoup with sprinkles: " + moresprinkles.GetPrice().ToString());

GummyBearsTopping gummyBears = new GummyBearsTopping(moresprinkles);
Console.WriteLine("single scoup with more sprinkles and gummy bears: " + gummyBears.GetPrice().ToString());

ChocolateSauceTopping chocolateSauce = new ChocolateSauceTopping(gummyBears);
Console.WriteLine("single scoup with more sprinkles and gummy bears and chocolate sauce: " + chocolateSauce.GetPrice().ToString());

Console.ReadLine();
}
}

public class OneScoop : BaseCone
{
public OneScoop()
{
this.myPrice = 6.99;
}
}

public class Dessert : BaseCone
{
public Dessert()
{
this.myPrice = 7.49;
}
}

public class SprinklesTopping : IceCreamToppingsDecorator
{
public SprinklesTopping(BaseCone baseconeToDecorate)
: base(baseconeToDecorate)
{
this.myPrice = 0.99;
}
}

public class GummyBearsTopping : IceCreamToppingsDecorator
{
public GummyBearsTopping(BaseCone baseconeToDecorate)
: base(baseconeToDecorate)
{
this.myPrice = 1.49;
}
}

public class ChocolateSauceTopping : IceCreamToppingsDecorator
{
public ChocolateSauceTopping(BaseCone baseconeToDecorate)
: base(baseconeToDecorate)
{
this.myPrice = 2.49;
}
}
}

Web Watcher - Why you need to crawl the web for confidential data leaks of your company?

2016-08-22T07:55:00.000-07:00

Abstract: Understanding the need to crawl notorious sites of the World Wide Web for Leaked/Compromised/Hacked data and to place a mechanism in place to report such findings so that the necessary action may be taken at a quicker pace to minimize the impact of the attack.

Why?

As we know in today’s world no amount of security can assure a system impenetrable, the least we can do is step up our guard and place a mechanism in place that minimizes damage in case of a worst case scenario.

Hackers have perfected few techniques to exploit money from their plunders of hacked data.

Hacked Data may contain email credentials, credentials of social networks, API keys, Subnet IPs, Password hashes, Machine configuration info etc. They sell the data to the victim’s rivals/competitors or in certain cases they end up blackmailing the victim.

Hackers /cyber criminals tend to share the results of their data heist on the open web on sites such as pastebin, slexy, reddit, 4chan and many other loosely moderated sites. They often share glimpses of the hacked data in order to gain attention and to pull up some interested buyers for their entire data dump.

This makes it evident that we need to be on the constant lookout for such data leaks in various forums, text sharing sites, social media etc. Since the data to be monitored is large it would be impractical to do it manually, hence we need a system/application in place to do the same. Once the data that is leaked comes through to us, it is upto the security team to take the necessary action which may be anything from changing the passwords/api keys or suspending the accounts etc or whatever action is apt for the situation.

Scope

To define a monitoring system which identifies data leaks of a specific Individual/company along with plausible data sources and tools which generate reports. The action to be taken on the data leak completely depends on the type of the system/data which is not in the scope of this

Everyone Else is doing it?

Yes! A lot of the big companies do have a system in place for the sole purpose of looking for data leaks of their respective companies on the open web. Ever since the infamous hack “50 days of Lulz” everyone is rushing towards this approach. Cyber Security related companies constantly do this.

Overview of the system that needs to be in place to look for data leaks.

Data Source 1: As you can see in the above diagram, the data from text sharing sites are pulled up for analysis via their API and using regular expressions in our Pattern matching engine we shall pull up any leaked data.

Data Source 2: There are few twitter bots out there such as @dumpmon which monitor hacker’s playgrounds, forums and their popular sharing platforms and tweet in case of any leaks detected.

Data from such bots can be useful as it provides a defined amount of data to search, passing it to our PR-Engine will do the rest of filtering.

Data Source 3: Using custom search engine searches and using tools such as scumblr and integrating it with our system would help us get the leaked data at a quicker rate.

The key thing to be considered here is how quick we can get the data that interests us and make sure it is attained with minimum resource consumed.

Tools: There are no fully fledged commercial tools for this purpose. On exploring I found a few good tools.

Scrumblr & Sketchy: This is a tool developed and open sourced by Netflix. The purpose of the tool is to collect information on the web that interests you/ your company. This tool is currently being used by Netflix Security team.

HaveIBeenPwned: This is a online tool where you can search for a keyword it shows you if your account is compromised. It has API support too.

Amazon also monitors the web; there have been multiple instances where users are alerted that their API keys of their instances are on the open web. We are not aware which tool they use for this purpose.

However there is an open source tool called Security Monkey which monitors policy changes and alerts on insecure configurations in an AWS account.

Pystemon

I happened to try out pystemon which is an open sourced tool built using python.

Below are the results.

Step 1: I posted a test email Id with some data to the text sharing site called slexy.

Step 2: I configured my system to be able to run pystemon.

Step 3: I set up the regular expression I was looking for in the tool configuration.

Step 4: Run the program

Step 5: Within a minute, I managed to find the text which I had shared in step 1 downloaded along with all the information surrounding it into the Alerts folder.

This is just a simple demonstration on how humongous data can be mined easily with the tools available, on customizing such tools we can set the path to effective monitoring of the web for confidential data leaks. The thing common in all tools is that they have used python. Python is usually used to scrape data from large dumps and it is effective in doing so.

Conclusion: Using the information in this document as a precursor and setting up an effective system or an application consisting of multiple inbound data sources, to monitor the wide web and minimize the impact on the customers/victims thereby adding more Trust towards the brand which would not only be essential but pivotal in today’s world where security can be an illusion.

References:

https://securosis.com/blog/my-500-cloud-security-screwup

http://techblog.netflix.com/2014/08/announcing-scumblr-and-sketchy-search.html

http://www.infosecisland.com/blogview/15547-Pastebin-Security-Risks-Monitoring-with-Rollyo-Searchrolls.html

https://github.com/cvandeplas/pystemon/blob/master/README.md

Setting up OTP Auth for your application with Google Auth

2016-08-16T05:02:00.000-07:00

Two factor authentication has become a necessary evil these days. Unlike the olden days where people carried a RSA token generator with them, these days we use apps such as Google Authenticator.

Below are the steps for helping you get started with it.

1. Get nugget package GoogleAuthenticator

2. Add the following code

TwoFactorAuthenticator tfa = new TwoFactorAuthenticator();

var setupCode = tfa.GenerateSetupCode("issuer", "accountTitle", "poiuytrewq123456", 300, 300);

string qrCodeImageUrl = setupCode.QrCodeSetupImageUrl;

string manualEntrySetupCode = setupCode.ManualEntryKey;

Console.WriteLine(manualEntrySetupCode);

Use any key in place of "poiuytrewq123456"
On execution of this code you will get a Manual Entry Setup Code.

3. Install GoogleAuthenticator on your phone from Google Play.
Open App Goto
Options >> Setup Account >> Enter Provided Key >> Enter the alphanumeric displayed by the above program and enter the same "accountTitle" given in the code above in the "Account Name" field.

Now your account is setup.

4. Add the following code to validate the OTP in your mobile.

Console.WriteLine("Enter OTP ");
string enteredOTP=Console.ReadLine();

bool isCorrectPIN = tfa.ValidateTwoFactorPIN("poiuytrewq123456", enteredOTP);
if (isCorrectPIN)
{
return true;
}
else
return false;

That's it you are done.

Run the Program
Enter the OTP in the console as shown in your mobile.
If the OTP matches you will get authenticated.

Will share the Github repo link.

Beware of Apps caching unwanted images

2016-07-20T07:38:00.001-07:00

When you surf certain apps, the images are cached in your phone to help load the application fast next time.
While some applications delete them or make them non readable it is still accessible and readable with some searching and tweaking, without any root access.

I found this in the previous versions of tumblr and twitter using "Ess file Manager"

Browse to the sdcard/Android/data ( In this directory you will find all apps which cache data. )

Further browse to sdcard/android/data/com.tumblr or com.twitter.android you will find lot of files with alphanumeric names.

Select all and proceed to rename all with option provided by "Ess file Manager" and in the extension field give ".jpg"

You will now see most of the images that you had browsed in the app.

So be careful next time, remember to clean up such folders. You may choose to clear the cached data of all the apps as given in this link http://lifehacker.com/clear-all-cached-app-data-at-once-on-android-1443937040 . But it will also erase your login details making you reenter your credentials the next time you log into tumblr/insta/ or any app that requires your credentials. Hence be wise and clear the data of only that apps, that you desperately want to.

Whatsapp has a separate sent folder, which never appeared in my gallery for some reason.
It contains all the videos and pics which you forward to others.

using "Ess file Manager" browse to /sdcard/WhatsApp/Media/WhatsAppImages/Sent and /sdcard/WhatsApp/Media/WhatsAppVideos/Sent

Delete the contents of these folders if you want nothing to do with those images/videos.

Tackling "Phone storage full"

2016-07-16T01:57:00.000-07:00

When you don't have an extendable memory slot and you thought that 16 gb /less was enough for your needs, you might find yourself in a shock when you get this problem.

Other than the fact that you managed to fill up your phone with data most of which you don't need, you might still be able to create some space by clearing up some of the junk you never use or which is created by your phone.

Below are a few quick ways to free up some space on your android phone. (no root)

Disable apps which you do not use.

For example, you may not be using google+ . Go to application manager, select the app and force stop it before hitting the disable button.(you can always enable it again) Also before doing this, you can uninstall the updates of such apps that come with the phone. Incase your phone does not come with this app disabling feature, then you would have to install some app of the playstore, such as "disable bloatware" or "app Freeze"

Uninstall apps that you never use.

Apps keep getting heavier after each update, so if you have not being using an app for a long time, you can uninstall it. If you still feel like you may use the app in the near future, back up the apk file using an app like "Ess file Manager" and then uninstall the apps.

Delete Big Files / duplicated files

Use " Big File Locator " to find the large files in your phone and delete them if they are of no use to you.

Backup your files.

You can use "dropbox "or "box" or any reliable backup service that suits your needs. I use dropbox, it has 2 GB free storage available.(Box has 10gb) You can move your pictures or files to it and clear up the space on your phone.With some settings in such app, you can schedule your uploads or folder that you want to back up at certain intervals.

Misc: Few common tips.

You can always root your phone if you want to get rid of the apps, that come bundled in your phone.
Turn auto update app feature OFF. You can select the apps that you want to update.
Use websites instead of app, wherever possible. (All websites promote their apps, but not all apps are good for you)
Do not use apps like clean master or apps with such functionalities, they may do more damage than good.

Listing Dependencies of Stored Procedure in MS SQL

2016-02-18T10:07:00.000-08:00

When you want to check the dependencies of a stored procedure as in which tables are being used,
you can use the below query

SELECT DISTINCT p.name AS proc_name, t.name AS table_name
FROM sys.sql_dependencies d

INNER JOIN sys.tables t ON t.object_id = d.referenced_major_id
INNER JOIN sys.procedures p ON p.object_id = d.object_id

ORDER BY proc_name, table_name

Below is the result on execution of the above query on the Northwind Database

You can also try

sp_depends Procedure_Name