by Teffin Varghese | Jul 20, 2018 | Android, Howtos, JavaScript, Linux, Mac, Networking, News, OS, Programming, Python, Review, Security, Servers, Windows
Blockchains are incredibly popular now a days.
What is a block chain how do they work what problems do they solve and how can they be used.
Like the name indicates a blockchain is a chain of blocks that contain information, this technique was originally described in 1991 by a group of researchers and was originally intended to time stamp digital documents so it’s not possible to backdate them or to tamper with them,almost like a notary.
However it went by mostly unused until it adapted by Satoshi Nakamoto in 2009 to created a digital crypto currency called bitcoin.
Now a blockchain is distributed ledger that is completely open to anyone they having interesting property, once a data has been recorded inside a blockchain it becomes very difficult to change it.
So how does that works!!!
Well take a closer look at a block. Each block contains some data, the hash of the block and the hash of the previous block.
The data that is stored inside the blocks defines the type of blockchain, the Bitcoin blockchain for example solves the details of the transactions such as the sender, the receiver and the amount of coins.
A block also has a hash, you can compare the hash to a fingerprint it identifies a block and all it’s contents and it is always unique just as a finger print.
Once the block is created it’s hash is being calculated. Changing something inside the block cause the hash to change, to another words hashes are very useful when you want to detect the changes to the block. If the fingerprint of the block changes it’s no longer the same block.
The third element inside of each block is the hash of the previous block and this effectively creates a chain of block and it’s the technique that makes the blockchain so secure.
Here we have a chain of three blocks and each block has an hash of the block and the hash of the previous block.
The block number three points to the block number two and the number two points to number one.
Now the first block is little bit special, it cannot points to it’s previous block, because it is the first block we call this block the Genesis block.
Now let’s say if we tamper with the second block, this causes the hash of the block to be changed as well, in turn that will make block 3 and all following blocks invalid, because they no longer store a valid hash of the previous block.
So changing a single block will make all following blocks invalid.
But using a hash is not enough to prevent tampering. Computers these days are faster and calculate hundred of thousands of hashes per second, you can effectively tamper with the block and recalculate all the hashes of other block to make the blockchain valid again.
Proof of Work
So to mitigate this blockchain has something called proof of work. it’s a mechanism that slows down the creation of a new block.
In bitcoins case it take about 10 minutes to calculate the required proof of work and add a new block to the chain, this mechanism makes it very hard to tamper with one block you need to recalculate the proof of work of all the following block.
So the security of the blockchain comes from creative use of hashing and the proof of work mechanism, but there is one more way that the block chain secured themselves and that is by being distributed. Instead of using a central entity to manage chains, blockchains use a peer to peer network and every one is allowed to join.
When someone joins this network he gets a full copy of the blockchain the node can use this to verify that everything is in order.
Now lets see what happens if some one creates a new block, that the block is sent to everyone on the network, each node then verify the blocks to make sure that the block is not tamper with and if everything checks out each node add the block to their own blockchain. All the nodes in this network creates consensus, the agree about what blocks are valid and which aren’t.
Blocks that are tampered with will be rejected by the other nodes in the network. So to successfully tamper with a blockchain, you need to tamper with all the blocks on the chain, redo the proof of work for each block and take control of more than 50% of the peer to peer network.
Only then when your tampered block becomes accepted by everyone else, so this is almost impossible to do.
Blockchains are also constantly evolving and one of the most recent development is the creation of smart contract.
The contracts are simple programs that are stored on the blockchain and it can be used to automatically exchange coins based on certain conditions.
The creation of blockchain technology peek the lot of peoples interest. Soon others realize that the technology can be used for other things likes
> Storing medical records.
>> Creating digital notary.
>> Collecting taxes.
So now you know what a blockchain is how it works on a basic level and what problems they solve.
by Teffin Varghese | Jul 8, 2017 | Howtos, Linux, Networking, OS, Security, Storages, Troubleshooting
A Distributed Denial-of-Service (DDoS) attack is an attack in which multiple compromised computer systems attack a target, such as a server, website or other network resource, and cause a denial of service for users of the targeted resource. The flood of incoming messages, connection requests or malformed packets to the target system forces it to slow down or even crash and shut down, thereby denying service to legitimate users or systems.
How DDoS Attacks Work
In a DDoS attack, the incoming traffic flooding the victim originates from many different sources – potentially hundreds of thousands or more. This effectively makes it impossible to stop the attack simply by blocking a single IP address; plus, it is very difficult to distinguish legitimate user traffic from attack traffic when spread across so many points of origin.
Types of DDoS Attacks
There are many types of DDoS attacks. Common attacks include the following:
Traffic attacks: Traffic flooding attacks send a huge volume of TCP, UDP and ICPM packets to the target. Legitimate requests get lost and these attacks may be accompanied by malware exploitation.
Bandwidth attacks: This DDos attack overloads the target with massive amounts of junk data. This results in a loss of network bandwidth and equipment resources and can lead to a complete denial of service.
Application attacks: Application-layer data messages can deplete resources in the application layer, leaving the target’s system services unavailable.
For Linux Servers
1. Find to which IP address in the server is targeted by the DDoS attack
#netstat -plan | grep :80 | awk ‘{print $4}’ | cut -d: -f1 |sort |uniq -c
2. To find from which IPs, the attack is coming
#netstat -plan | grep :80 | awk ‘{print $5}’ | cut -d: -f1 |sort |uniq -c
3. For securing the server against DDoS/Drop Sync Attack
In /etc/sysctl.conf
Paste the following into the file, you can overwrite the current information.
#Kernel sysctl configuration file for Red Hat Linux
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.
# Disables packet forwarding
net.ipv4.ip_forward=0
# Disables IP source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.eth0.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
# Enable IP spoofing protection, turn on source route verification
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
# Enable Log Spoofed Packets, Source Routed Packets, Redirect Packets
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.lo.log_martians = 0
net.ipv4.conf.eth0.log_martians = 0
# Disables IP source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.eth0.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
# Enable IP spoofing protection, turn on source route verification
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
# Disables the magic-sysrq key
kernel.sysrq = 0
# Decrease the time default value for tcp_fin_timeout connection
net.ipv4.tcp_fin_timeout = 15
# Decrease the time default value for tcp_keepalive_time connection
net.ipv4.tcp_keepalive_time = 1800
# Turn off the tcp_window_scaling
net.ipv4.tcp_window_scaling = 0
# Turn off the tcp_sack
net.ipv4.tcp_sack = 0
# Turn off the tcp_timestamps
net.ipv4.tcp_timestamps = 0
# Enable TCP SYN Cookie Protection
net.ipv4.tcp_syncookies = 1
# Enable ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts = 1
# Enable bad error message Protection
net.ipv4.icmp_ignore_bogus_error_responses = 1
# Log Spoofed Packets, Source Routed Packets, Redirect Packets
net.ipv4.conf.all.log_martians = 1
# Increases the size of the socket queue (effectively, q0).
net.ipv4.tcp_max_syn_backlog = 1024
# Increase the tcp-time-wait buckets pool size
net.ipv4.tcp_max_tw_buckets = 1440000
# Allowed local port range
net.ipv4.ip_local_port_range = 16384 65536
Run /sbin/sysctl -p and sysctl -w net.ipv4.route.flush=1 to enable the changes without a reboot.
TCP Syncookies
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
Some IPTABLES Rules:
iptables -A INPUT -p tcp –syn -m limit –limit 1/s –limit-burst 3 -j RETURN
iptables -A INPUT -p tcp –syn -m state –state ESTABLISHED,RELATED –dport 80 -m limit –limit 1/s –limit-burst 2 -j ACCEPT
