Average Adam

Most of you know that I work for the University of Waterloo in IT. Specifically, I work in the Housing and Residences department and am a member of the Housing Technology (ResNet) team. When I started here I did tech support type work and occasionally did some projects to fill certain needs in Visual Basic. During this time I was working out of the “ResNet Office” and the majority of my time was spent making students computer work on our network.

In the weeks before Fall 2003 when the students arrived the W32.Blaster virus was bring down networks all over the world. Our university instituted a policy to have all internet services disabled and only enable them one by one after the students machine was certified clean and was patched to protect against it. Our network stayed up. We started to notice very strange things happening with students’ computers that turned out to be SpyWare/MalWare infections.

Over the summer prior to Fall 2004 I developed a CD which walked the student through the long and arduous task of preparing Windows to run safely on our network. It downloaded windows patches, Symantec Anti-Virus, Anti-Spyware and directed them to turn on a firewall. Some flaws quickly bubbled to the surface. For the most part it worked well for everyone however in certain situations the computer became infected in minutes which is far less time than it takes to install Windows patches. We were still very busy but overall it greatly reduced our workload and we considered this a resounding success. I also attended the ResNet conference at Princeton and was blown away by how helpful it was. Every school seemed to be dealing with the same issues as us.

During the next year we learned more and more about SpyWare/MalWare which was becoming the issue with computers. When a particularly damaged computer was discovered I was called in as the last resort to formatting. In most cases I was successful thanks to the now famous netsh int ip reset. During this period my job shifted toward tools and Linux. I wrote Perl scripts and used various tools to help with the administration of the network and the discovery of problem systems. The summer brought yet another ResNet conference which I attended at Georgia Tech and learned quite a bit.

A new technique was implemented for the students moving in during the summer term. We had them enable the Windows XP firewall and install Symantec Anti-Virus after which time we would enable them and they could update windows freely without fear of infection. It was a great success and cut our issues down to a handful. We have since streamlined the technique with even greater success and for the first time had idle staff during the move in period.

My job working with Linux came to a halt since it was evident that we didn’t need to develop any heavy-handed student computer management software. At this point I started to develop websites (yet another shift). The first project was to replace the Off-Campus Housing Listing Service website with a new friendlier interface. I had very little experience with web programming and so created the first website using ASP which was the language in which the old site was written. After it was finished I looked at ASP.Net for the next project and decided to switch for the increased programming library. It is nearly a year later and I have developed many applications and continue to improve our web presence. Currently I am looking into Web 2.0 techniques for use on internal applications. I imagine this is what I will do for the rest of my time here at UW, web applications are the medium of the future.

Recently I have been learning the basics of PHP with regards to web applications. So far I have touched on MySQL queries, login/password storage and forms authentication, sessions and authenticated user session security.

I am working on a personal project called bookkeeper which is a database for the books that I have read and what I thought of them. It started a ways back as an excel spreadsheet then evolved into an access database and then into a web application in php/mysql. My intention is to eventually make it so others can also use bookkeeper, but that isn’t going to be for a while.

Password storage was the first thing to tackle and turned out to be pretty simple. Storing passwords that have passed through the SHA-1 algorithm is the standard practice but has certain security issues. An improvement suggested it to create a unique random string per user to add to the password before hashing it. This reduces the ability to perform dictionary attacks on the hashed passwords. The random unique string is called a salt value and is stored alongside the final hashed password in the database for later comparison, I use an MD5 hash of a number from rand() cut down to twenty characters.

The next issue was session handling and security for the rest of the pages protected by the login page. The standard seems to be to use session_start() which by default generates a cookie containing a session id which you can check at the start of each script page and redirect to the login. So if you are like me you immediately think, ‘what about malicious users?’. Session hijacking is the default scenario seems very easy to me so some precautions are a good idea.

1. Make sure to call session_regenerate_id() after every user login so that the old session id is discarded. This will prevent a user from changing the session id cookie to look at another user’s information after logging in normally.
2. Don’t trust that the session id stored in the cookie is valid. After the user login store the new session id in the database to be checked at the top of every page before the rest of the session information is trusted. This will prevent a user from changing their session id to become another user while logged in.

That is all I have so far. I would really love to hear how others do this stuff and if there are some issues I haven’t mentioned here that are important to remember. Please send in all your paranoid security methods.

As a side note I am very curious about what web platform and server languages Google uses to write all its applications such as search, gmail, google maps, etc. Currently I assume it is CGI with the back end written in with a C like language or something home-brewed.