2/15/11

COMPARATIVE ANALYSIS OF PREVENTION TECHNIQUES OF EMAIL SPOOFING

1. Introduction

Spoofing is the action of making something look like something that it is not in order to gain unauthorized access to a user's private information. The idea of spoofing originated in the 1980s with the discovery of a security hole in the TCP protocol. Today spoofing exists in various forms namely IP, URL and Email spoofing.

Email Spoofing:

Email spoofing may occur in different forms, but all have a similar result: a user receives email that appears to have originated from one source when it actually was sent from another source. Email spoofing is often an attempt to trick the user into making a damaging statement or releasing sensitive information (such as passwords).

Examples of spoofed email
• email claiming to be from a system administrator requesting users to change their passwords to a specified string and threatening to suspend their account if they do not do this
• email claiming to be from a person in authority requesting users to send them a copy of a password file or other sensitive information
• E-mail spoofing is e-mail activity in which the sender address and other parts of the e-mail header are altered to appear as though the e-mail originated from a different source. Because core SMTP doesn't provide any authentication, it is easy to impersonate and forge emails. It is usually fraudulent but can be legitimate. It is commonly used in spam and phishing e-mails to hide the origin of the e-mail message. By changing certain properties of the e-mail, such as the From, Return-Path and Reply-To fields (which can be found in the message header), ill-intentioned users can make the e-mail appear to be from someone other than the actual sender. The result is that, although the e-mail appears to come from the address indicated in the From field (found in the e-mail headers), it actually comes from another source.
• Occasionally (especially if the spam requires a reply from the recipient, as in advance-fee frauds), the source of the spam e-mail is indicated in the Reply-To field (or at least a way of identifying the spammer); if this is the case and the initial e-mail is replied to, the delivery will be sent to the address specified in the Reply-To field, which could be the spammer's address. However, most spam emails (especially malicious ones with a trojan/virus payload, or those advertising a web site) forge this address too, and replying to it will annoy an innocent third party.
• Prior to the advent of unsolicited commercial email (spam) as a viable business model, "legitimately spoofed" email was common. For example, a visiting user might use the local organization's SMTP server to send email from the user's foreign address. Since most servers were configured as open relays, this was a common practice. As spam email became an annoying problem, most of these "legitimate" uses fell victim to antispam techniques.

How to Avoid Email Spoofing??????
1. Strong Website Authentication:

This approach would require all users of legitimate e-commerce and e-banking sites to strongly authenticate themselves to the site using a physical token such as a smart card.



The positive aspects of this approach are:
• Even if a user falls for a phishing attack, a phisher can’t log into real site without the right physical token.
• Users are given a stronger sense of trust in their transactions with business web site.
The downsides of this approach are:
• User education
• Set up time delays
• Desktop software installation
• High management costs
• Potentially high cost per user

2. Mail Server Authentication

The Anti-Spam Research Group (ASRG) and the Anti-Spam Alliance have been investigating solutions to the growing spam problem based on authenticating sending mail servers. There are numerous technical proposals such as RMX for how this will work.




The positives of this approach are:
• Easy to configure at senders mail servers
• Makes it harder for phishers to be anonymous
• Legitimate business email can be better identified – lower spam false positives

The downsides of this approach are:
• Requires sender and recipient gateways to both use these methods
• SMTP sender is not visible to recipient
• From: address still can be spoofed and users can be fooled
• Will be a problem for anyone using a 3rd party emailing service
• Doesn’t accommodate email forwarding


3. Digitally Signed Email With Desktop Verification


This approach is based on the use of the existing industry standard S/MIME, which is a secure email standard supported by most email client software that is in use in corporations today. Companies who are vulnerable to phishing attacks, such as financial institutions, payment processors and e-commerce vendors, would send their emails with a digital signature attached. Note that the digital signature would be attached at the outbound gateway, rather than requiring the individual sender to apply the digital signature. This automation at the gateway would further increase the adoption rate of such a solution. When users receive these digitally signed emails, their business email clients (e.g. Microsoft Outlook, Lotus Notes, Novell Groupwise, etc) will automatically verify the signature for authenticity. If an email arrives to a user that is either not signed, or the signature can not be verified, the user would know that it is not a genuine email from the sending bank or ecommerce provider.



The positives of this approach are:
• S/MIME is a standard in business email clients – would work without any additional software deployment to email users
• Makes the “From:” address impossible to spoof without detection
• Any phisher who digitally signs their email must register with a certificate authority – provides a stronger identity audit trail when prosecuting the phisher
• Legitimate business email can be better identified by end-users – provides better trust ` with customers
The downsides of this approach are:
• Recipients still have to inspect the “From:” address for misleading domains (e.g. a phishing email could have a valid digital signature with the email address of account.update@ebay.custservices.com. The end user would have to know that ebay.custservices.com is not in fact Ebay because ebay.com is not in the domain portion of the address.)
• Not all email clients support S/MIME (e.g. Hotmail, AOL, Yahoo! Mail, Outlook Web Access for Exchange 5.5)
• Recipients may not check certificate revocation status


4. Digitally Signed Email With GatewayVerification



Similarly to Solution 3 proposed above, this approach uses the S/MIME standard for email that is widely available today. Instead of relying on the end user’s email client to verify the signature on the email, a gateway server at the mail relay level would verify the signatures before they were even received by the receiver’s email server. This approach would work well for ISPs and web email providers who wish to support signed email as a way to defeat phishing attacks.

The positives of this approach are:
• S/MIME is a standard today that is supported by many email gateways
• Makes the “From:” address impossible to spoof without detection
• Any phisher who digitally signs their email must register with a certificate authority – provides a
stronger identity audit trail when prosecuting the phisher
• Legitimate business email can be better identified by end-users – provides better trust with customers

The downsides of this approach are:
• Sender and recipient gateways must both understand S/MIME digital signatures
• Doesn’t prevent valid signatures from having misleading From: addresses (e.g. a phishing email could have a valid digital signature with the email address of account.update@ebay.custservices.com. The recipient gateway would likely pass the email on and the end user would have to know that ebay.custservices.com is not in fact Ebay because ebay.com is not in the domain portion of the address.)

Linux based analog to digital converter

What is an ADC, and why do we need one?


In our daily life, anything we deal like sound, pressure, voltage or any measurable quantity, are usually in analog form so what if we want to interface any analog sensor with our digital controllers? There must be something that translates the analog inputs to digital output, and so analog to digital convertors come to play. Let's start with a simple example: suppose we had an outdoor unit where we wanted to monitor the sound, pressure, voltage or any measurable quantity on a regular basis. Obviously, we would put a circuit inside the unit and walk out to read the measurement. We wanted to know the value. This could obviously become a hassle, especially during inclement weather. To make it more convenient, we could put a remote readout inside our home. In order for the remote readout to work, though, we need to convert the measurement reading into an electrical signal that can be read by the remote readout. Usually we call them ADC (Analog to digital convertor). Before going to learn how to interface an ADC with a controller we first take a look at basic methods of analog to digital conversion.
This is a sample of the large number of analog-to-digital conversion methods. The basic principle of operation is to use the comparator principle to determine whether or not to turn on a particular bit of the binary number output. It is typical for an ADC to use a digital-to-analog converter (DAC) to determine one of the inputs to the comparator. So how does a device like the remote readout work?
The answer is actually quite simple. It works on the principle of changing electrical currents and voltages. Some specialized electronics components change the currents or voltages in a circuit with a change in measurement. We simply use these components in a circuit that outputs a voltage that is proportional to a changing measurement. Then we use our ADC to change the voltage (an analog signal) into a digital signal. A device such as the remote readout is programmed to display different values for a given digital signal. Although we've skipped over a lot of the finer details, we can now at least understand the concepts behind analog to digital conversion and why it is necessary.


Instructions for making an ADC


To build the ADC that we used for our project, it is necessary to have some basic knowledge of circuit diagrams and soldering. If you have no prior experience with these items, you may find a basic "do-it-yourself" manual for electric circuitry to be of some assistance.
The first thing you need to do in order to build the circuit is to obtain the necessary electronics components. Most of these components can be obtained from a similar electronics supply store, with the exception of the IC chips, which is also the company that supplied the circuit design. Be sure to read the notes below the parts list regarding some purchasing issues.

Tips on Circuit Construction


1) First and foremost, try to have a layout of how you want to place all the components on the PC board before you begin soldering. Taking this extra step can eliminate a lot of confusion and unnecessary wiring during assembly.
2) If you purchased the PC board from the parts list, use one (or both if you connect them) of the solid strips that runs around the perimeter of the board in order to make all your ground connections. It is much easier to do this than to run an individual ground wire for every ground connection.
3) make sure to orient the diodes correctly in the circuit. The whole point of a diode is to only let current flow one way (like a check valve), so if you get the two ends switched, the circuit will not function because current will not flow through the diode.
4) Also be sure to take note of the proper pin numbering on the IC chips. The circuit diagram has the connections to the chips laid out by pin number, not by visual position. The proper IC chip orientation and pin numbering is as follows:
Note that the semicircle at the "top" of the chip indicates the position of Pin 1. If there is no semicircle, then Pin 1 will be indicated by a dot as shown in the diagrams. Regardless of how Pin 1 is indicated, the numbering remains the same.
5) Be sure to orient the electrolytic capacitors in the proper direction, as they are polar (unless otherwise noted). The negative lead is always the shorter lead and will be indicated by a series of minus symbols on the corresponding side of the capacitor.
6) The numbers for the parallel port terminals are written on the connector itself right next to the pins. The numbers are rather small, so be careful not to confuse them, as the connections to the parallel connector are indicated by pin number on the circuit diagram.
7) The ground connections on the circuit diagram are indicated by a symbol that looks like this: .
8) Any IC pins marked "N.C." are not connected to anything else in the circuit.
9) For the input wires (shown in the lower right-hand corner of the diagram), the positive wire is connected to the resistor "R5", and the negative wire is connected to ground.

Testing the ADC


Once the circuit is built, it can be tested using the program found in ADC circuit description. You simply connect the circuit to your PC using the parallel port, apply an input voltage to the input wires, and the test program will produce a value for the given voltage. A good test for the circuit is to connect the input wires to a function generator running a sine wave, and verify that the output values reproduce a sine wave when graphed. In order to do this, however, the test source program must be modified. Shown below is the graph that we obtained from the ADC test values:

The digital values are divided by 255 because the signal is a 8-bit signal. Since the signal is binary, 8-bits translates to 2^8, or 255. 1 is subtracted from that value for conversion purposes, making it 255. The values are also multiplied by 4.5 to obtain an approximate magnitude for the signal readings. The signal we used was slightly over 4 Volts, so we used 4.5 just to be safe. Once the digital values are converted using the above formula, they should produce a graph something like the one above when graphed vs. time.


Procedure:
Following steps are involved in the procedure to display ADC output at the terminal using Linux environment. We want to read ADC output from parallel port so first we need permission to access parallel port. After accessing parallel port we initialize

parallel data port D0 to D7 to zero. We now that by default we can write data to parallel port if we need to read data from parallel port we need to send control signal to parallel port to make it ready for reading.
After doing all above step we are able to read parallel port. These all steps belong to our program (software) for reading data.
In this project analog source is variable resistance this resistance is connected on analog input of ADC.ADC convert these analog resistances into digital output these output pins of ADC are connect to data pin of parallel port D0 to D7. We know computer only deal with binary so we must give digital data at parallel port.
When we run code output of ADC will appear on output.
The Parallel Port is the most commonly used port for interfacing. This port includes input of up to 9 bits or the output of 12 bits. The port is composed of 4 control lines (i.e. pins 1, 14, 16, 17), 5 status lines (i.e. pins 10, 11, 12, 13, 15) and 8 data lines (i.e. pins 1, 2, 3, 4, 5, 6, 7, 8, 9). It's found commonly on the back of your PC as a D-Type 25 Pin female connector.
Function Generator:


A function generator is a piece of electronic test equipment or software used to generate electrical waveforms. These waveforms can be either repetitive, or single-shot in which case some kind of triggering source is required (internal or external).
Another type of function generator is a sub-system that provides an output proportional to some mathematical function of its input; for example, the output may be proportional to the square root of the input. Such devices are used in feedback control systems and in analog computers.

Description


Analog function generators usually generate a triangle waveform as the basis for all of its other outputs. The triangle is generated by repeatedly charging and discharging a capacitor from a constant current source. This produces a linearly ascending or descending voltage ramp. As the output voltage reaches upper and lower limits, the charging and discharging is reversed using a comparator, producing the linear triangle wave. By varying the current and the size of the capacitor, different frequencies may be obtained.
A 50% duty cycle square wave is easily obtained by noting whether the capacitor is being charged or discharged, which is reflected in the current switching comparator's output. Most function generators also contain a non-linear diode shaping circuit that can convert the triangle wave into a reasonably accurate sine wave. It does so by rounding off the hard corners of the triangle wave in a process similar to clipping in audio systems.
The type of output connector from the device depends on the frequency range of the generator. A typical function generator can provide frequencies up to 20 MHz and uses a BNC connector, usually requiring a 50 or 75 ohm termination. Specialized RF generators are capable of gigahertz frequencies and typically use N-type output connectors.
Function generators, like most signal generators, may also contain an attenuator, various means of modulating the output waveform, and often the ability to automatically and repetitively "sweep" the frequency of the output waveform (by means of a voltage-controlled oscillator) between two operator-determined limits. This capability makes it very easy to evaluate the frequency response of a given electronic circuit.
Some function generators can also generate white or pink noise.
More advanced function generators use Direct Digital Synthesis (DDS) to generate waveforms. Arbitrary waveform generators use DDS to generate any waveform that can be described by a table of amplitude values.

Oscilloscope

An oscilloscope (commonly abbreviated to scope or O-scope) is a type of electronic test instrument that allows signal voltages to be viewed, usually as a two-dimensional graph of one or more electrical potential differences (vertical axis) plotted as a function of time or of some other voltage (horizontal axis). Although an oscilloscope displays voltage on its vertical axis, any other quantity that can be converted to a voltage can be displayed as well. In most instances, oscilloscopes show events that repeat with either no change, or change slowly. The oscilloscope is one of the most versatile and widely-used electronic instruments.

Automatic sweep mode

Triggered sweeps can offer a blank screen if there are no triggers. To avoid this, these sweeps include a timing circuit (millisecond range) that generates free-running triggers to provide a trace. Once triggers arrive, this timer stops providing pseudo-triggers. For observing low repetition rates, this mode can be de-selected.

Recurrent sweeps
If the input signal is periodic, the sweep repetition rate can be adjusted to display a few cycles of the waveform. Early (tube) 'scopes and lowest-cost 'scopes have sweep oscillators that run continuously, and are uncelebrated. Such oscilloscopes are very simple, comparatively inexpensive, and were useful in radio servicing and some TV servicing. Measuring voltage or time is possible, but only with extra equipment, and is quite inconvenient. They are primarily qualitative instruments.


Single Sweeps

Some 'scopes offer these -- the sweep circuit is manually armed (typically by a pushbutton or equivalent) "Armed" means it's ready to respond to a trigger. Once the sweep is complete, it resets, and will not sweep until re-armed. This mode, combined with a 'scope camera, captures single-shot events

Digital Trainer

The Vulcan Digital Logic Trainer Full Kit is a great combination of software simulation and hardware tool. The Vulcan is designed to introduce digital logic first via software simulation

Digital Multi meter:

A digital multimeter or DMM is one of the most widely used pieces of test equipment today. DMMs are available very cheaply and these digital multimeters can provide very high degrees of accuracy when measuring the parameters within an electronics or electrical circuit. As a result,A Digital multimeter can be a hand-held device useful for basic fault finding and field service work or a bench instrument which can measure to a very high degree of accuracy. They can be used to troubleshoot electrical problems in a wide array of industrial and household devices such as batteries, motor controls, appliances, power supplies, and wiring systems.

Purpose:

A typical multimeter may include features such as the ability to measure voltage, current and resistance.

How to Use DMM:


When using the meter it is possible to follow a number of simple steps:
1. Turn the meter on
2. Insert the probes into the correct connections - this is required because there may be a number of different connections that can be used.
3. Set switch to the correct measurement type and range for the measurement to be made. When selecting the range, ensure that the maximum range is above that anticipated. The range on the DMM can then be reduced as necessary. However by selecting a range that is too high, it prevents the meter being overloaded.
4. Optimise the range for the best reading. If possible enable all the leading digits to not read zero, and in this way the greatest number of significant digits can be read.
5. Once the reading is complete, it is a wise precaution to place the probes into the voltage measurement sockets and turn the range to maximum voltage. In this way if the meter is accidentally connected without thought for the range used, there is little chance of damage to the meter. This may not be true if it left set for a current reading, and the meter is accidentally connected across a high voltage point!

Measuring Current:

1. Insert the probes into the correct connections - in many meters there are a number of different connections for the probes. Often one labelled common into which the black probe is normally placed. The other probe should be entered into the correct socket for the current measurement to be made. Sometimes there is a special connection for current measurements, and sometimes a separate one for either low or high current measurements. Select the correct one for the current measurement to be made.
2. Set main selector switch on the meter switch to the correct measurement type, (i.e. current) and range for the measurement to be made. When selecting the range, ensure that the maximum range is above the expected reading anticipated. The range on the DMM can then be reduced as necessary. However by selecting a range that is too high, it prevents the meter being overloaded.
3. When the measuring the current, optimise the range for the best reading. If possible enable all the leading digits to not read zero, and in this way the greatest number of significant digits can be read.
4. Once the reading is complete, it is a wise precaution to place the probes into the voltage measurement sockets and turn the range to maximum voltage. In this way if the meter is accidentally connected without thought for the range used, there is little chance of damage to the meter. This may not be true if it left set for a current reading, and the meter is accidentally connected across a high voltage point!


Measuring Resistance:

There are a few simple steps required to make a resistance measurement with a digital multimeter:
1. Select the item to be measured: This may be anything where the resistance needs to be measured and estimate what the resistance may be.
2. Insert the probes into the required sockets Often a digital multimeter will have several sockets for the test probes. Insert these or check they are already in the correct sockets. Typically these might be labelled COM for common and the other where the ohms sign is visible. This is normally combined with the voltage measurement socket.
3. Turn on the multimeter
4. Select the required range The digital multimeter needs on and the required range selected. The range selected should be such that the best reading can be obtained. Normally the multimeter function switch will be labelled with the maximum resistance reading. Choose the one where the estimated value of resistance will be under but close to the maximum of the range. In this way the most accurate resistance measurement can be made.
5. Make the measurement With the multimeter ready to make the measurement the probes can be applied to the item that needs to be measured. The range can be adjusted if necessary.
6. Turn off the multimeter Once the resistance measurement has been made, the multimeter can be turned off to preserve the batteries. It is also wise to turn the function switch to a high voltage range. In this way if the multimeter is used to again for another type of reading then no damage will be caused if it is inadvertently used without selecting the correct range and function.