On this page

Finding the true enjoyment of a process
Lost in Polymorphism world
Wrapping Unhandled exceptions from a WinForm application
Static objects in aspx page - Bad idea
Hasty hiring makes the project go very long.
Session hijacking - prevention oriented
A White-Hat hacker - moral issues
Israeli Bloggers dinner - 21.02.07
A new blog on the web.
PDF document - vulnerability out of the box.

Ads

Navigation

Search

Categories

Clouds

Sql Server (5) .Net (16) .Net 2.0 (2) C# (3) @ff Topic (5) Architectural solutions (9) ASP (1) BDD (5) Blog related (8) database (2) Development process (8) Facebook (1) job interviews (1) Lessons (5) Life (12) Microsoft (5) IIS 6 (2) SPS (sharepoint server) (3) Drivers (1) Internet Explorer (2) Windows 2003 server (1) NightDuck (2) Performance (5) Security (9) Sql Server 2000 (4) Study (2) TDD (1) Threading (3) Under the hood (1) Web (1) Web services (1) XSS (6)

Archive

Blogroll

Disclaimer
The opinions expressed herein are my own personal opinions and do not represent my employer's view in anyway.

RSS 2.0 | Atom 1.0 | CDF

Send mail to the author(s) E-mail

Total Posts: 63
This Year: 0
This Month: 0
This Week: 0
Comments: 33

Sign In
Pick a theme:

 Saturday, April 21, 2007
Saturday, April 21, 2007 8:00:50 PM (GMT Standard Time, UTC+00:00) ( Life )

just to be clear, I'm not talking about computer process .
I'm talking about the daily processes that we do every day.
have you ever stopped for a second to wonder, what are the things that you enjoy the most ?
i mean what are the daily processes do you enjoy the most, what defines them ?

think about that for a second, a person spends a great part of his time @ work (if not most of his time),
so it is imperative to do something that you enjoy from,
otherwise you'll suffer most of the month to accomplish things with your paycheck at the end of the month.
this kind of deal is not such a great bargain, not for me anyway.

so, i began thinking, what sort of things i like or dislike.
to be honest, i thought about this for a long time (couple of months to be exact), and came with some sort of list of things.

i want to share this list with you.

  • Playing on the guitar - OK, i know this is a vast subject, I'll try to be more specific...
    - i enjoy creating my own songs(although most of them not really worth hearing them).
    - i enjoy improvising as a lead guitar or just as a solo.
    - i really don't like playing other people songs (even if those songs are really good, scorpions for example).
  • Do some hacking (Ethical only), and finding solutions to various security problems.
  • Building computer systems (Hardware), i know this sounds a little bit stupid,
    but new hardware stuff and creating some systems with it to meet some user demands does the trick for me.
  • Designing software systems.
  • Finding solutions to problems that no one could solve ( not necessary software problems).
  • Creating a software infrastructure architecture.
    - knowing that your design/creation will be used by many of your colleagues.
    - knowing things will work efficiently,oriented by performance, flexibility and even security.
  • Giving lectures about subjects i like to do and have some expertise in it.
  • I hate doing repeatable work, I'll give some examples :
    - solving lots of math problems of the same kind.
    - writing software programs that require the same solutions over and over.
    - working at a factory like jobs
  • I like reading about new stuff on the web - i guess that updating yourself is a must for everyone.

here is some conclusions after looking over and over on this list :

  • i like to preform creative tasks that stimulate the brain
  • i like doing things that i can express my self.
  • i like receiving a positive feedback and a respect from the society ( who does not ?).

now, all i have to do is finding a job that suits the mentioned above :)

what do you think about the subject ?
how would you summerize does list of things ?

btw,
i've added a file of a record i've done with a friend just before i got drafted to the army.
anjoy


prototype1.mp3 (682.45 KB)
Comments [0] | | # 
 Monday, April 16, 2007
Monday, April 16, 2007 11:12:18 AM (GMT Standard Time, UTC+00:00) ( .Net | C# )

ok, this is the point where all the OOP guru's can contribute some of thier knowledge.
i'm facing some strange problem maybe someone can point the solution.

i'm having this code :

public class Father
{
}

public class Son:Father
{
}

public class Tester
{
    public void TestFunc(Father a)
    {
    }

    public void Test()
    {
        Son aSon = new Son();

        TestFunc(aSon);
    }    
}

this code will compile with no problems.

but if i want to pass the object by reference, it will cause a compilation error.

public class Father
{
}

public class Son:Father
{
}

public class Tester
{
    public void TestFunc(ref Father a)
    {
    }

    public void Test()
    {
        Son aSon = new Son();

        TestFunc(ref aSon);
    }    
}

the error i'm getting is something like : "can not convert 'ref son' to 'ref Father' "
does someone knows why ?
Comments [0] | | # 
 Sunday, March 04, 2007
Sunday, March 04, 2007 6:35:22 PM (GMT Standard Time, UTC+00:00) ( .Net | Architectural solutions | Threading )

couple weeks ago, my friend and co-worker, shani raba, presented me a problem.
they have some sealed application as an .exe file that throws some exceptions and crashes their application.

So, i Thought that is a good idea to wrap the targeted application with reflection, and catch the unhandled thrown exceptions.

to demonstrate this,
I've created an application with a button that throws an exception.

private void button1_Click(object sender, System.EventArgs e)
{
    throw new Exception("my Exception, need to be wrapped");
}

the next thing that we need to create is the wrapper.

so, creating a console application with this code should have solved the problem:

[STAThread]
static void Main(string[] args)
{

    Assembly assembly = Assembly.LoadFrom ("cashTester.exe");

    Type t = assembly.GetType("cashTester.Form1");
    object o = Activator.CreateInstance(t);
    try
    {
        Application.Run((Form)o);
    }
    catch(Exception ex)
    {
        Console.Write("exception was thrown : " + ex.Message);
    }
}

running this code in debug mode successfully catch the exception from the winform.
but, for some reason, in a normal run, this code won't catch the exception.

makes you wonder, huh ?

so i did some thinking, what on earth can make this phenomena ?
The answer is : Threads.
Yes, like it or not, but this is the subject that everyone tries to avoid it.
everyone knows it exists, and no one really likes it,
but we can't run from the problem, we need to confront it.

So, what can we do ?

since Application.Run launches a new thread, we can add to the Application.ThreadException event handler, an exception handling method.

like this class :

 

/// <summary>
/// The Wrapper class
/// </summary>
public class Wrapper
{

    /// <summary>
    /// Public cunstructor
    /// </summary>
    public Wrapper()
    {
    }

    /// <summary>
    /// This function will initialize the exception handling
    /// </summary>
    public void Init()
    {
        // define handlers for unhandled exceptions
        AppDomain.CurrentDomain.UnhandledException += new UnhandledExceptionEventHandler(this.exp);
        Application.ThreadException +=new System.Threading.ThreadExceptionEventHandler(this.ThreadExp);
    }

    /// <summary>
    /// This method is for the threads exceptions
    /// </summary>
    /// <param name="o">the object</param>
    /// <param name="args">Thread exception args</param>
    void ThreadExp(object o, System.Threading.ThreadExceptionEventArgs args)
    {
        // Write the message to the console
        Console.Write("Unhandled thread exception was thrown : " + args.Exception.Message);
    }

    /// <summary>
    /// This method is for the unhandled exceptions from the main thread
    /// </summary>
    /// <param name="o">the object</param>
    /// <param name="args">exception arguments</param>
    void exp(object o,System.UnhandledExceptionEventArgs args)
    {
        // Write the message to the console
        Console.Write("Unhandled exception was thrown : " + ((Exception)args.ExceptionObject).Message);
    }

    public void Run()
    {
        // Load the assembly
        Assembly assembly = Assembly.LoadFrom ("cashTester.exe");

        // get the type of the object
        Type t = assembly.GetType("cashTester.Form1");

        // invoke it
        object o = Activator.CreateInstance(t);

        // Run the application - note that this line starts an additional thread
        Application.Run((Form)o);
    }
}

 

now, all we need is to launch it :

/// <summary>
/// The main entry point for the application.
/// </summary>
[STAThread]
static void Main(string[] args)
{
    Wrapper w = new Wrapper();
    w.Init();
    w.Run();
}

 

now we got an exception wrapper for launching applications.

Shani, tell me if that helped ...

p.s.
There are more ways to do it, but this is the simplest one

Comments [2] | | # 
Sunday, March 04, 2007 12:17:48 PM (GMT Standard Time, UTC+00:00) ( .Net | Architectural solutions )

Yesterday, good friend of mine, Lev rosenblit, asked me a good question.
what are the life cycle of static objects in an aspx page.
so, at first without any hesitation, i answered that the object will die after the request event ends.
the dude insists that I'm wrong on that matter, so i decided to check it out .

here is some code snippet to check it out :

        private static int myStaticInt = 0;
        private void Page_Load(object sender, System.EventArgs e)
        {
            myStaticInt++;
            Response.Write(myStaticInt);
        }

by theory (which is objects in an aspx page die after the end of the request), this code should print the number "1" on each request.
but the result was different, on each request, the result increased.

digging a little on the web, i found that static objects live inside the App domain and not in the page context.
This interesting fact raised some interesting question, an architectural one:
what would happen if the code run in NLB configuration (Network Load Balancing)?

on that matter their is a session state issue which is solved by getting the session state from a shared database,
but what about the static objects that live inside the App domain ?
what can be done to share those object ?

from my point of view, this is a bad choice in architecture when you choosing to use static objects inside your page.
thus, it won't always work, and will be hardware Dependant system.

Comments [0] | | # 
 Friday, March 02, 2007
Friday, March 02, 2007 11:02:59 PM (GMT Standard Time, UTC+00:00) ( .Net | Life | XSS )

Let me tell you some story thats happening now.
couple month ago i hired some folks to do a part of some project due to time limits that i have.
now, i know those guys personally and checking thier technical backgroung seemed to be irrelevant (mistake no' 1).
i thought, how hard can i be to make some GUI to an application that all the other layers are done (3 tier architecture).

So, instead of 1 month development it turned to more than 3 months already, (30% progress)
god knows how long it will take them to finish it .

and now, when i finally see some progress, i see code like this :

if (!Page.IsValid)
{
}
else
{
    InsertNewCustomer();
    lblClientMessage.Text = NewClientText();
    ClearText();
}

ok, who are does guys ?
you think that a skilled programmer with 3 years of expirience would not write such crapy code like this (those things just get me mad.)
why they think that i allow such code to go on production ?
not speaking about the XSS holes that they made (just by the book....)
looks like they didn't read this guide

i mean look at this thing, how many mistakes you can do as a single code :

        private string NewClientText()
        {
            string strNewClient = txtName.Text + " " + txtFamily.Text + " " + "הוזן בהצלחה";
            return strNewClient;
        }

        private void btnAdd_Click(object sender, System.EventArgs e)
        {
            lblClientMessage.Text = "";

            if (!Page.IsValid)
            {
            }
            else
            {
                InsertNewCustomer();
                lblClientMessage.Text = NewClientText();
                ClearText();
            }
        }

        private void InsertNewCustomer()
        {
            Customers newCustomer = new Customers();

            newCustomer.Name = txtName.Text;
            newCustomer.LastName = txtFamily.Text;
            newCustomer.Notes = txtNotes.Text;
            newCustomer.isStudent = chkStudent.Checked;
            newCustomer.Phone = TxtPhone.Text;
            newCustomer.Cellular = txtCellular.Text;
            newCustomer.Email = txtEmail.Text;
            newCustomer.Address = txtAddress.Text;

            if (txtBirth.Text.Trim() != "")
            {
                newCustomer.BirthDate = Convert.ToDateTime(txtBirth.Text);
            }

            custDal.Add(newCustomer);
        }

  • writing data to the page without validating it first
  • some logical twists - (if page not valid, dont do anything, else do something...), why on earth ? why ?
  • inserting to the database without validating the input (for those who are femilier with my architecture, validating is a single line "entity.Validate();"
  • no exception managment what so ever.
  • no code comments
  • Client side input validations

here is some more goodies from the same author :

lblAddress.Style.Add("text-align","right");

what happened to CSS files ?
thier are lots of lines like this defining the style for every object.
i dont wanna know what are they planned to do when they need to change the style one by one .

man, this is a little piece of code, i'm affraid to see whats going on , on the rest of the code.

this is some lessons that you learn on the hard way....

"i will never hire people without checking thier technical background"
"i will never hire people without checking thier technical background"
"i will never hire people without checking thier technical background"
"i will never hire people without checking thier technical background"
"i will never hire people without checking thier technical background"
"i will never hire people without checking thier technical background"

i should better get some things to my own hands before it gets to late .
anyone wants a job to create some gui ?

 

Comments [2] | | # 
Friday, March 02, 2007 1:32:40 PM (GMT Standard Time, UTC+00:00) ( .Net | Architectural solutions | Lessons | Security | XSS )

Well,
after months I'm talking about it and couple of sleepless nights to prepare it, here it is.

So, what do have here ?

1 powerPoint presentation that explains what is Session Hijacking and XSS.
1 XSS demo.
0 Session hijacking Demo .... (why you ask ? - I'm planning to do another lecture on the topic for some those who missed it yesterday...)
0 Code included. (like the demos ....will be uploaded some time soon....)

long story short :
this presentation talks about the threats in Session hijacking.
and how to prevent it. - while its not a 100% solution, it certainly raises the bar for hackers to succeed in the session hijacking attack.

some wise man said to me once,
"for every defense that ever made, someone thought how to break it,
 the only thing we can do, is to narrow down the amount of people that is capable to perform it."

enjoy.

comments are welcomed :)

Security.pps (324 KB)

 

Comments [0] | | # 
 Tuesday, February 20, 2007
Tuesday, February 20, 2007 7:50:27 AM (GMT Standard Time, UTC+00:00) ( Life | Security )
Ok, I'm facing a dilemma here.
Many of the site checks I've done returned positive results for security holes.
Now, the question is: what do I do next with this info?

The obvious options are:
•    Not to do anything with this info.
•    Write a full technical report regarding the security hole that found around the web (maybe a video demo?).
•    Open some security site that holds data about security Vulnerabilities
•    Provide some demo's of the hack.
•    Report to the site about the problem they have.
•    Try to make money of it? (This option more suited for a black hat hacker...)
•    Obtain the reputation of a Web security expert by exposing the security holes?
I remind you that there can be consequences for the actions that made (jail is not the favorite option...)

what do you think I should do?
Please comment here...
 
your opinion is very important to me.
Comments [7] | | # 
 Friday, February 16, 2007
Friday, February 16, 2007 1:58:59 PM (GMT Standard Time, UTC+00:00) ( Blog related )
if you have'nt been in such event, and you match the criteria (an israeli blogger...)
i have'nt been  on one of those, but judging by the last event comments (the previews dinner) - this event is something you wanna be there.

check out the post of the organizer :http://blogs.microsoft.co.il/blogs/omer/archive/2007/02/13/8020.aspx

Comments [0] | | # 
 Sunday, February 11, 2007
Sunday, February 11, 2007 10:06:31 AM (GMT Standard Time, UTC+00:00) ( @ff Topic | Blog related )

A new blog surfaced in the last few days.
this one is from Doron Yaacoby.

this dude knows what he's talking about.
i would strongly recommend to pay this guy a visit

Comments [2] | | # 
 Friday, February 09, 2007
Friday, February 09, 2007 7:12:20 PM (GMT Standard Time, UTC+00:00) ( Security | XSS )

Sounds controversial, right ?
well, it is.

actually, on certain conditions, you can execute a javascript on the clients machine using PDF file.
the funny part is that it does not needed to be modified at all.

simply by creating a link at this pattern :

http://yoursite.com/file.pdf#whatever_name_you_want=javascript:your_code_here

there is XSS writen all over the place.
the sad part is that the site owners have nothing to do to prevent it.
this works with :

Firefox 2.0.0.1 win32
Firefox 1.5.0.8 win32
Opera 8.5.4 build 770 win32
Opera 9.10.8679 win32
and i'm sure that with other browsers too.

the subject brought to adobe's attention
http://www.adobe.com/support/security/advisories/apsa07-01.html
Adobe categorizes this as a critical issue and recommends affected users update any affected software.
http://www.adobe.com/support/security/bulletins/apsb07-01.html

how does this work ?(and why ???)

the PDF document gets parameters, the odd thing is that the value of those parameters can be retrieved via javascript.

more info could be found on those sites :
http://ha.ckers.org/blog/20070103/universal-xss-in-pdfs/
http://www.gnucitizen.org/blog/danger-danger-danger/

be carefull when you opening a PDF file next time

Comments [0] | | #