|
I will sonn start a big Client/Server project and I have a question about backdoors (if you know what I mean?).
How to prevent them? It's a difficult question but is there any documentation on the net which the most common backdoors is?
I want to write a safety server with no leaks!
------------------------------------
Rickard Andersson, Suza Computing
ICQ#: 50302279
I'm from the winter country SWEDEN!
------------------------------------
|
|
|
|
|
ummmm it totally depends on what server platform you use
if you use iis there are known holes and fixes and whatnots
linux / unix the same
if you were to write your own say web server you could make it hack proof to a large extent a) because you know exactly what does what and b) cos the hackers dont know the system
its kinda a vague answer to a vague question 
situations to avoid #37:
"good morning ... how many sugars do you take in your coffee ... and what was your name again?"
coming soon: situations to avoid #38: "...and the dog was there too?"
|
|
|
|
|
lauren wrote:
its kinda a vague answer to a vague question
Well, I predicted it wouldn't be easy to answer.
I building a TCP/IP server in Win32 API and it's gonna be a server that handle unlimited connections and it's a chat server. Is there any leaks that can take a hacker into the system if I run the server on:
1) WinXP
2) Linux
3) Win9x
4) Win2000
I know as I said before that this isn't an easy question to answer, but I just want to know if there is any specific leaks or something that I might know!
------------------------------------
Rickard Andersson, Suza Computing
ICQ#: 50302279
I'm from the winter country SWEDEN!
------------------------------------
|
|
|
|
|
Buffer under/over runs, though people accidently , or even maliciously passing strings/streams of data, that can cause your custom protocol to fail. This is largely seen in C++ imlpementation though the use of pointers or unchecked arrays, that can go below or above the array boundaries. Not only could data become corupted like this, clever malicous programmers can exploit these weakneses, and inject there own binary code that executes correctly and allows then to execute thier own code on the server, quite often as a worm or virus - e.g. Nimida, or what ever it is called.
Where as with a langage like VB this kind of thing is less likley to happen. With VB for example there are still weaknesses that can be exploted with poorly implemented code. But then you don't often write severs in VB that handle multimepl connections.
The clasic example is for a web server. A user passes a URL of a page to be served e.g. http:\\localhost\index.htm
A bad implementation would just chop off the http and host name and convert it to the currect webroot folder, so that a malformed address such as http:\\localhost\..\..\a_file.txt
would be transalated to extract a file two folders above the webroot folder though the .. in the path!!
Think about ways in which someone implementing a custom client for your server could accidently malform the protocol or data passed, and how the server would handle it. e.g. The first 4 bytes of your custom protocol indicate how many bytes are in the buffer, when in fact more have been passed. Validate everything.
Hope this helps,
Giles
|
|
|
|
|
If I always check what data my server recevies and check if it's a valid command and then do something. If a string that is unrecognized will be sent to the server it just ignoring that string and keep call recv()....
shouldn't it be pretty impossible for Nimba viruses to execute their self??
I mean, I check what kind of string that my server receves and so...
if my custom protocoll on my server has commands like:
MSG Hello developers out there! MSGEND\t\t
FIL file_data_goes_here FileName.exe
you see that each command have 3 letters. And if I check the string that receves if the 3 first letters is MSG or FIL then I keep going and handle the commands, but if the 3 first letters is unrecognized by the server it just ignore the receved string and keep listening...and if it repeates too many times you could close the connection to to the client...
Isn't that good enough, Giles?
------------------------------------
Rickard Andersson, Suza Computing
ICQ#: 50302279
I'm from the winter country SWEDEN!
------------------------------------
|
|
|
|
|
I building a TCP/IP server in Win32 API and it's gonna be a server that handle unlimited connections and it's a chat server.
Perhaps you should have a look at the existing IRC servers? From what you wrote it seems you're trying to reinvent the wheel.
|
|
|
|
|
Hi,
How can i check whether a directory exists or not..
suppose i want to check for a directory
"C:\ABC\DATA"
"C:\ABC\MAM"
|
|
|
|
|
use the findfirstfile() thingy and set the win32_find_data dwAttributes member to have the FILE_ATTRIBUTE_DIRECTORY included
situations to avoid #37:
"good morning ... how many sugars do you take in your coffee ... and what was your name again?"
coming soon: situations to avoid #38: "...and the dog was there too?"
|
|
|
|
|
Thanx for the help
|
|
|
|
|
You can also use the _access C runtime function.
Cheers,
Tom Archer
Author, Inside C#
Please note that the opinions expressed in this correspondence do not necessarily reflect the views of the author.
|
|
|
|
|
You can also use the _access C runtime function.
But please don't do it. Either use ANSI C functions, ISO C++ functions or native functions. Mixing in POSIX (which is a half-breed in Win32 land - fits like a foot in a glove) makes no sense.
|
|
|
|
|
You're going to have to do a lot better than that. Exactly why does it make "no sense"?
Cheers,
Tom Archer
Author, Inside C#
Please note that the opinions expressed in this correspondence do not necessarily reflect the views of the author.
|
|
|
|
|
CString strDirectory = "...";
CFileStatus fileStatus;
if (CFile::GetStatus (strDirectory, fileStatus)) {
if (fileStatus.m_attribute & CFile::directory) {
...
}
}
/ravi
"There is always one more bug..."
http://www.ravib.com
ravib@ravib.com
|
|
|
|
|
This was quite handy! Thanks.
J
"I am wise enough to therefore not spout my ill informed opinion as if it were remotely related to fact." - Christian Graus
|
|
|
|
|
Glad to help, Jamie. Actually I'm working on a CP article that will collect all file/dir handling methods into a single class. Stay tuned!
/ravi
"There is always one more bug..."
http://www.ravib.com
ravib@ravib.com
|
|
|
|
|
Dear Buddies,
Do you have any experience of programming two kind
of common dialog boxes: PageSetup dialog and Print
dialog? My problem is about the margin Rect retrived from
PageSetup dialog, I don't know how to apply this rect
to Print dialog box because of the unit. I have tried
"milimeter" or "inches", but they don't work. Does anyone
know how-to or the relative sample codes? thanks!
--------------
Ask the experts always.
|
|
|
|
|
Have you tried "mm" or "in"?
|
|
|
|
|
How can I get the net adapter address?
all the adapter is validate, but at some machine, I can get the adapter address,
at some machine, I cann't (address is all Zero).
The codes:
-----------------------------------------------------------
#include <nb30.h>
typedef struct _ASTAT_
{
ADAPTER_STATUS adapt;
NAME_BUFFER NameBuff[30];
} ASTAT;
void getNetID()
{
NCB ncb;
UCHAR ch;
memset(&ncb,0,sizeof(ncb));
ncb.ncb_command = NCBRESET;
ch = Netbios(&ncb);
// at some machine, ch = NRC_BRIDGE 0x23 // ncb_lana_num field invalid
memset(ncb.ncb_callname,' ',sizeof(ncb.ncb_callname));
ncb.ncb_callname[0] = '*';
//lstrcpy(ncb.ncb_callname,"* ");
ncb.ncb_command = NCBASTAT;
ASTAT AST;
ncb.ncb_lana_num = 0;
ncb.ncb_length = sizeof(AST);
long *pASTAT;
pASTAT = (long *)HeapAlloc(GetProcessHeap(), HEAP_GENERATE_EXCEPTIONS | HEAP_ZERO_MEMORY, ncb.ncb_length);
if ( pASTAT == 0 )
{
AfxMessageBox("memory allocation failed!");
return;
}
ncb.ncb_buffer = (unsigned char *)pASTAT;
ch = Netbios(&ncb);
CopyMemory(&AST, ncb.ncb_buffer, sizeof(ASTAT));
CString str( _T("") );
for(int i=0; i<6; i++)
{
if( i > 0 )
str += ' ';
unsigned char c = (unsigned char)AST.adapt.adapter_address[i];
unsigned char m = (c>>4)&0xf;
unsigned char n = c&0xf;
str += (m>=10) ? (char)('A'+(m-10)) : (char)('0'+m);
str += (n>=10) ? (char)('A'+(n-10)) : (char)('0'+n);
}
HeapFree(GetProcessHeap(), 0, pASTAT);
AfxMessageBox( str );
}
---------------------------------------
What's wrong?
Thanks
|
|
|
|
|
Are you trying to get the MAC address of the Ethernet Adapter or the IP address?
|
|
|
|
|
Just want to get the adapter unique id!
Thank you
|
|
|
|
|
Ok ... I want to have Tabs
on all my MDIClients of my
application so all I need to
do is this ....
In my CMainFrame::OnCreateClient method I add the lines
...
tab = new MyTab();
tab.AddItem(this)
...
right?
Wrong of course.
What should I be doing?
I have looked at all the examples
on TabControls none of them
are what I need and I really don't
understand MFC.
Please help you might "win" a convert.
(pardon the pun)
|
|
|
|
|
check out the doc/view section here on cp
there are a few very good articles / frameworks for what you want
situations to avoid #37:
"good morning ... how many sugars do you take in your coffee ... and what was your name again?"
coming soon: situations to avoid #38: "...and the dog was there too?"
|
|
|
|
|
Thanks for the info ... but the examples there
are pretty much the same. They have MDI "client"
brought to the front by clicking on a tab in the
MDI "main frame". I would like to have the
tabs inside the "client".
I can see that having the tab on the "main frame"
has its advantages but that is not what my user
wants.
Here's what i am trying to do ...
http://www.codeproject.com/useritems/newtomfcneedhelp.asp
Thanks
|
|
|
|
|
I embedded the WebBrowser control in my app... couple questions:
In Internet Explorer whenever the user navigates to a new page,
the logo up in the top right hand corner (on the same level as the
menu) rotates between a globe and the start symbol. How can I add
something like that to my app? Would I use the CAnimateCtrl or whatever
it's called? How doe I get it on the same level as the menu bar in
my app? I have a dialog based app... in case that's important.
When I run my app and browse to a page, it loads fine. But then
whenever I hit the Escape key on the keyboard, the whole WebBrowser
control disappears. If I enter a new URL in my ComboBox and hit the
Go button, then the WebBrowser control reappears. How can I make it
so the Escape key does not make the WebBrowser control disappear?
thanks,
thundercatzlair
|
|
|
|
|
Hi, folks,
I got some problems for multi-threading/multiple instances with one thread function. What's wrong with the following code segment.
In some cases, I got wrong instance as showed below. The case is: if I have 2 jobs triggered, say Job 1 and Job 2, Job 1 is triggered first but Job 2 would be done first (i.e, done prior to Job 1). Then, when Job 2 Set event (i.e, set to signaled state), I found in Master Thread Function,
in the line of WaitForSingleObject(..), what I got is Job 1's instance and Job 1's event ? Could anyone tell me how to solve this problem ? Anything wrong ? Thanks in advance.
PS> I do need to wait for events, because I have more than one tasks to do and I need to wait until all tasks are done, although in this small code, it seems just one task.
/// JOBINST: my job instance
DWORD WINAPI StartJob( JOBINST pJobObj )
{
pJobObj->hMasterThread( 0, 0, MasterThreadFunc, pJobObj, 0, &( pJobObj->dwMasterThreadID ) );
}
DWORD WINAPI MasterThreadFunc( LPVOID lpParam )
{
JOBINST pJobObj = (JOBINST) lpParam;
pJobObj->hMailEvent = CreateEvent( 0, FALSE, FALSE, "Mail Thread Event" );
pJobObj->hMailThread = CreateThread( NULL, 0, MailThreadFunc, pJobObj, 0, &( pJobObj->dwMailThreadID ) );
WaitForSingleObject( pJobObj->hMailEvent, INFINITE );
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
///<------ In some cases, I got wrong pJobObj and wrong pJobObj->hMailEvent here
CloseHandle( pJobObj->hMailEvent );
ExitThread( 0 );
}
DWORD WINAPI MailThreadFunc( LPVOID lpParam )
{
JOBINST pJobObj = (JOBINST) lpParam;
//// do something here...
//// when finished with something, set event; set to signaled state
SetEvent( pJobObj->hMailEvent );
ExitThread( 0 );
}
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
