Firebase secures its real-time back-end service


A must read …for the network gurus

Gigaom

Firebase, the San Francisco startup behind a popular backend for real-time apps, is adding an API which should make those apps more secure. Firebase’s service is s a real-time analog to mobile backends-as-a-service from Parse, Stackmob, Kii and Kinvey. It’s gained traction among developers who want to build apps quickly with immediate feedback — they write code in one window and it renders in another. Developers says this provides an elegant way to build apps without having to mess with servers. But that model poses some security concerns, which Firebase says its new API will address.

firebasescreenAs Firebase Co-Founder James Tamplin described it, the company built a JavaScript-like rules system that assigns every piece of data in Firebase with one or more rules. “Eg. ‘Only let a user use the app if they’re logged in or ‘only allow 5-digit numbers entered in a field,'” Tamplin…

View original post 260 more words

Scanning


 

Computernetwork
Computernetwork (Photo credit: Wikipedia)

 

 

 

Network switch
Network switch (Photo credit: digilink)

 

Port Scanning :- Port scanning is carried out to determine a list of open ports on the remote hosts that have certain services or daemons running. In port scanning, the attacker connects to various TCP And UDP ports and tries to determine which ports are in listening mode.

 

1). TCP Ports scanning :- Almost all ports scans are based on the client sending a packet containing a particular flag to a target port of the remote system to determine whether the port is open.following list contains the list of flags a TCP packet header can contain.

 

URG = This flag tells the receiver that the data pointed at by the urgent pointer required urgently .

 

ACK = This flag is turned on whenever sender wants to acknowledge the receipt of all data send by
the receiving end.

 

PSH = The data must be passed to the application as soon as possible.

 

RST = There has been a problem to the connection and one wants to reset the connection with
another

 

SYN = If system X wants to establish TCP connection with system Y, then it sends its own
sequence number to Y,requesting that a connection be established.Such a packet is known
as SYN packet

 

FIN = If system X has finished sending all the data packets and wants to end the TCP/IP
connection that it has established with Y, then it send a packet with FIN flsg to system Y.

 

A typical TCP/IP has a three-way handshake as,
1) The client sends a SYN packet to the server .

 

2) The server replies with a SYN packet and acknowledge the client’s SYN packet by sending an
ACK packet.

 

3) The client acknowledges the SYN sent by the server .

 

Different techniques TCP port Scanning are ,
1) TCP connect port scanning .
2)TCP SYN scanning (half-open scanning )
3)SYN/ACK scanning
4) TCP FIN scanning
5)TCP NULL scanning
6)TCP Xmas scanning

 

2). UDP port scanning :- In this scenario a packet is sent to each port on the target host one by one .If remote port is closed, then the server replies with a port unreachable ICMP error message.
If the port is open then no such error message is displayed.

 

3).FTP bounce port scanning:- This technique was developed by Hobbit. He discovered an interesting loophole that allowed users to connect to the FTP service of a particular system to connect to any port of any system.This loophole allows anonym port scanning.

 

Recommended Tools
1) Nmap
2)Superscan