ScreenBoard in AIR

Guys, this is an extension of whiteboard application. there is not much of a difference here in both the thing is here the application is transparent and gives the user a feeling that the application is drawing actually on the screen. Alright so lets see how the thing is being done..I assume the reader have some basic idea about flex/AIR. if not its not a big deal..

Actual code is very simple and hence i am not going to let it get complicated, because every one likes it simple right?

Firstly u can begin with a new AIR project
type the script tag and inside that type the following code.

import mx.core.UIComponent;
import flash.display.*;

private var spBoard:Sprite = new Sprite();

private function init():void
{
var win:NativeWindow = systemManager.stage.nativeWindow;
var cont:UIComponent = new UIComponent();
win.maximize();
win.visible = true;
}

/*In this function the mouse position is taken and the graphics function starts drawing
you can set the line style from 3 to any number u like or u can get it from a UI text
box or anything u like , u can use a colour picker to set the color of the line but i am
using a simple black line with 3 brush points.
*/
private function onMouseDown():void
{
dboard.graphics.lineStyle(3, 0x000000);
dboard.graphics.moveTo(stage.mouseX, stage.mouseY);
}

/*
Here the lines end point is calculated from the x,y of mouse. What this actually doies is draws tiny straight lines to each place u move your mouse
*/
private function onMouseMove(e:MouseEvent):void
{
if (!e.buttonDown)
{
return;
}
dboard.graphics.lineTo(stage.mouseX, stage.mouseY);
e.updateAfterEvent();
}

important to note:

*board is the canvas id and set its attributes as alpha=.08,
*call the onmousedown function on the mouse down event in the canvas (i.e board) and onmousemove on the mousemove event of canvas

* dboard is another canvas over which u are actually drawing set its height and width to 100%
* u cn add a button and on its click event type {dboard.graphics.clear()} to clear the screen.
And DONT FORGET TO SET THE showFlexChrome="false" in your windowedApplication tag
If that even doesnt work under any circumstances u may edit the xml file and set the transparency to true and also the showChrome tag to false Which is inside the "initialWindow" tag
thats it..have a nice time sracthing ur desktop...

Introduction to IP Spoofing.

Guys, this is just an introduction to "IP Spoofing". This is a main form of online camouflage. What happens here is an attacker gains unauthorized access over a user's computer or network by making it believe that some message(malicious) has come from a trusted machine by "spoofing" the IP of that trusted machine. In this article i would try to explain why, how and how it is used and how to defend it.

What is Internet Protocol – IP ?

is a network protocol operating at layer 3 (network) of the OSI model. It is a connectionless model, meaning there is no information regarding transaction state, which is used to route packets on a network. Additionally, there is no method in place to ensure that a packet is properly delivered to the destination.

Examining the IP header, we can see that the first 12 bytes (or the top 3 rows of the header) contain various information about the packet. The next 8 bytes (the next 2 rows), however, contains the source and destination IP addresses. Using one of several tools, an attacker can easily modify these addresses – specifically the “source address” field. It's important to note that each datagram is sent independent of all others due to the stateless nature of IP (just keep in mind as we examine TCP in the next section).

What is Transmission Control Protocol – TCP ?

IP can be thought of as a routing wrapper for layer 4 (transport layer), which contains the TCP. Unlike IP, TCP uses a connection-oriented design. This means that the participants in a TCP session must first build a connection - via the 3-way handshake (SYN-SYN/ACK-ACK) - then update one another on progress - via sequences and acknowledgements. This “conversation”, ensures data reliability, since the sender receives an OK from the recipient after each packet exchange.

As you can see above, a TCP header is very different from an IP header. We are concerned with the first 12 bytes of the TCP packet, which contain port and sequencing information. Much like an IP datagram, TCP packets can be manipulated using software. The source and destination ports normally depend on the network application in use (for example, HTTP via port 80). What's important for our understanding of spoofing are the sequence and acknowledgment numbers. The data contained in these fields ensures packet delivery by determining whether or not a packet needs to be resent. The sequence number is the number of the first byte in the current packet, which is relevant to the data stream. The acknowledgment number, in turn, contains the value of the next expected sequence number in the stream. This relationship confirms, on both ends, that the proper packets were received. It’s quite different than IP, since transaction state is closely monitored.

TCP/IP Design

Now that you have got an idea about the TCP/IP format, lets examine what can be the consequences. It can now be understood that how easy it is to mask a source address by manipulating the IP header. This technique is used for attacks and in TCP the sequence numbers can be predicted and this can lead to session hijacking and impersonating host.

Spoofing Attacks

There are many kinds of spoof attacks of which some are described below, some are outdated and some are still good enough causing security concerns.

Non-Blind Spoofing

This type of attack takes place when the attacker is on the same subnet (in TCP/IP networks, subnets are defined as all devices whose IP addresses have the same prefix. For example, all devices with IP addresses that start with 100.100.100. would be part of the same subnet.) as the victim. The sequence and acknowledgement numbers can be sniffed, eliminating the potential difficulty of calculating them accurately. The biggest threat of spoofing in this instance would be session hijacking. This is accomplished by corrupting the datastream of an established connection, then re-establishing it based on correct sequence and acknowledgement numbers with the attack machine. Using this technique, an attacker could effectively bypass any authentication measures taken place to build the connection.

Blind Spoofing

This is a more sophisticated attack, because the sequence and acknowledgement numbers are unreachable. In order to circumvent this, several packets are sent to the target machine in order to sample sequence numbers. While not the case today, machines in the past used basic techniques for generating sequence numbers. It was relatively easy to discover the exact formula by studying packets and TCP sessions. Today, most OSs implement random sequence number generation, making it difficult to predict them accurately. If, however, the sequence number was compromised, data could be sent to the target. Several years ago, many machines used host-based authentication services (i.e. Rlogin). A properly crafted attack could add the requisite data to a system (i.e. a new user account), blindly, enabling full access for the attacker who was impersonating a trusted host.

Man In the Middle Attack

Both types of spoofing are forms of a common security violation known as aMan in the Middle Attack. In these attacks, a malicious party intercepts a legitimate communication between two friendly parties. The malicious host then controls the flow of communication and can eliminate or alter the information sent by one of the original participants without the knowledge of either the original sender or the recipient. In this way, an attacker can fool a victim into disclosing confidential information by “spoofing” the identity of the original sender, who is presumably trusted by the recipient.

Denial of Service Attack

IP spoofing is almost always used in what is currently one of the most difficult attacks to defend against – denial of service attacks, or DoS. Since crackers are concerned only with consuming bandwidth and resources, they need not worry about properly completing handshakes and transactions. Rather, they wish to flood the victim with as many packets as possible in a short amount of time. In order to prolong the effectiveness of the attack, they spoof source IP addresses to make tracing and stopping the DoS as difficult as possible. When multiple compromised hosts are participating in the attack, all sending spoofed traffic, it is very challenging to quickly block traffic.

Misconceptions of IP Spoofing

While some of the attacks described above are a bit outdated, such as session hijacking for host-based authentication services, IP spoofing is still prevalent in network scanning and probes, as well as denial of service floods. However, the technique does not allow for anonymous Internet access, which is a common misconception for those unfamiliar with the practice. Any sort of spoofing beyond simple floods is relatively advanced and used in very specific instances such as evasion and connection hijacking.

Defending Against Spoofing

There are a few precautions that can be taken to limit IP spoofing risks on your network, such as:

Filtering at the Router - Implementing ingress and egress filtering on your border routers is a great place to start your spoofing defense. You will need to implement an ACL (access control list) that blocks private IP addresses on your downstream interface. Additionally, this interface should not accept addresses with your internal range as the source, as this is a common spoofing technique used to circumvent firewalls. On the upstream interface, you should restrict source addresses outside of your valid range, which will prevent someone on your network from sending spoofed traffic to the Internet.

Encryption and Authentication - Implementing encryption and authentication will also reduce spoofing threats. Both of these features are included in IPv6, will eliminate current spoofing threats. Additionally, you should eliminate all host-based authentication measures, which are sometimes common for machines on the same subnet. Ensure that the proper authentication measures are in place and carried out over a secure (encrypted) channel.