Computer Programming

Technically

The algorithm has a greater chance of hash collisions than other, similar hashing algorithms. This means it is less computationally expensive to crack than similar ones (such as SHA-1) and is thus less secure.

For the Layman, briefly:

MD5 is insecure because computer attackers have figured out a way to trick the MD5 security system into verifying that no tampering has occurred, when in fact the attacker has injected malicious code. It's like purchasing a lock for your bike that has a 5 buttons. Pressing one button will open the lock. The criminal can just try every possible combination in a short time, and thus the lock is considered insecure.

Why is MD5 Insecure? Technical answer:

Bob owns some web space on blue host, and he uploads an executable there that he intends other people to download and run so they can install his video game: angry_birds_installer.exe.

Bob uploads angry_birds_installer.exe to blue host and has allowed other people to download it through the browser and install the game so they can install/play it. Bob generates profit by people buying the unlocked version of the game, therefore Bob wants to make absolutely sure that the attacker doesn't use the installer to install malware on the customers who install the game.

Description of the security problem:

Bob's executable is super-insecure now because suppose an attacker breaks in to his blue host account and somehow gets the ability to make a change to angry_birds_installer.exe. The attacker could drop in the new executable, and nobody is the wiser. Now, users who install angry_birds_installer.exe also install Conficker, a malicious bot-net on the customer's computer.

Why would an attacker go to all this trouble?

Answer: profit. The attacker wants to get in between Bob and his customers so he can install Conficker. With that, he can do the following things:

• Do Distributed Denial of Service attacks to take down the Internet in other countries by taking out the name servers and DNS servers.
• Launching trillions of spam emails.
• Acquire credit card numbers and incur charges via identity theft.
• Draining bank accounts of people who don't check their balance often.
• Many other brilliant illegal for-profit ideas to freeze your soul.

Bob has a lot to be worried about on behalf of his customers who don't know the difference between browser security, antivirus software and a hole in the ground.

Bob increases security with MD5 Sums

Bob has a plan, he will protect his executable by taking an MD5 check sum on angry_birds_installer.exe and store the result somewhere else (say on his go daddy web space) that has a different security system. The security conscious users who want to run angry_birds_installer.exe will also run an MD5 check sum against the executable they downloaded, and make sure that the check sums exactly match. If they do match, we can be relatively certain that the attacker has not modified the original angry_birds_installer.exe.

Security problem solved?

No. Mal-ware creators are clever, they were able to figure out that MD5 is insecure. They were able to find a way to break the algorithm for MD5 in order to run trillions of MD5 sums every second and find a "hash collision" between the original angry_birds_installer.exe and the modified: angry_birds_with_malware.exe. The attacker only has to compromise the blue host security and can drop-in the new executable that generates the SAME MD5 sum as the original, and the users who do check sums declare that the executable is safe, when it contains malware to install Conficker.

MD5 sum is insecure because Bob thinks he is protecting the users from evil mal ware creators, but in reality, the mal ware creators have figured out a way to completely bypass the security model. MD5 Sums do not deliver any significant security enhancements as it was originally envisioned to be.

A data user is someone who controls the collection, holding, processing, or the use of the data. As examples:

Collection

1. A Census Enumerator goes into the field and asks residents a series of questions the US Census Bureau needs for population studies.
2. A sociologist or anthropologist (any Social Sciences researcher) goes into the field to study a particular group, say 8th graders and their experiences of bullying.
3. A computer company wants to know who uses their website, which pages they visit, what they buy, and also links a survey to some webpages.

Holding

1. The US Census Bureau collects the forms of census questions that residents filled out.
2. The 'social science researcher' is often doing the study on behalf of an institution or company. For example, Masters and Ph.D. candidates must do a research study to fulfill the requirements of a degree. A pharmaceutical company hires scientists to study the side effects of a particular drug.
3. The computer company collects the data they need through use of cookies, web page analytics, and survey forms.

Processing

• Data may be processed and studied

1. quantitatively - meaning simply counting the numbers, like 100 people visited x webpage showing sweaters; only 1 person bought a sweater. Census data is typically all quantitative data.
2. qualitatively - this is a specific type of studying data that isn't about numbers, but about people and their stories. For example, a sociologist may ask questions about bullying to answer "What do 8th grade students do when bullied".
3. Or Mixed research, which uses Numbers and Stories.

Use of Data

• Use of data may be restricted, especially to protect privacy. For example, the public does not see census data for 70 years. However, during that time, many researchers and social scientists work with that data, compiling it into meaningful units of information.
• Data by itself or numbers by themselves offer little meaning without contexts. We want to know what people are doing, for example, census might show a city has 3% less population than 10 years ago. We want to know why people do what they do. We want to know what others do that impact people, and what factors make people do what they do.
• For social change, researchers might want to apply a study's data to creating a theory that applies to many or most people. For example, The Stages of Death and Dying originated from a study of people who lost a loved one; the data was then generalized to 'most people' and how humans react to death.
• Data should always have a purpose; if not, why collect it.

To bring this down to an everyday experience, let's talk about a 10th grade student assigned to write a 15 page term paper on the fall of the Berlin Wall. The student:

1. Reads and Collects "data" from books, journal articles, and popular magazines. He might copy short quotes from these authors. He writes notes on index cards. When he is finished with his "research", he has 35 index cards and 12 notebook pages written with pieces of "data".
2. Because the student has a term paper due, she "holds" or holds onto this data she collected. She might throw it all away in 6 months, but for now, she is "holding" a select set of "data".
3. The student must now "do something" with the data collected. This is called processing. During processing, we review each piece of "data". For example, "This author argued that the Berlin Wall was a peacekeeping tactic." Another author said, "The Berlin Wall robbed people of their freedom." These are 2 pieces of "data". Processing involves thinking about how our data fits together. Then, we must think about how we think about the data. For example, even before data collection, a student believed the Berlin Wall interfered with individual freedoms. She found 2 author quotes that say this; and 2 authors disagreed. How will she include both "sides" in her term paper is part of processing the data.
4. Lastly, every researcher -- even a 10th grade student -- makes detailed decisions about how the data will be used. Let's say the student read 3 books, 24 articles, and 2 popular magazines. He realizes he can't include all the data. He picks 2 books, 2 articles, and both popular magazines that both support and oppose his thesis. He decides how he will write about (use) the data. Who's voice comes first; which "side" takes prominence; how will he show opposing data. "Use of data" in the real world is both short and long term. A HS student can throw away her data after she writes the paper. However, professional research may go on in longitudinal studies over many decades, so protecting the data as it is being used is even more important.

You don't need boolean logic, you simply add 0x30 (48 decimal) to the digit to obtain its ASCII character value. The digits 0 to 9 have ASCII codes 0x30 to 0x39 (48 to 57 decimal), respectively. Therefore adding 48 to any value in the range 0 to 9 will reveal the character code for that value.

Thus the following are all equivalent to obtaining the ASCII character code for the digit '8':

8 + 48 = 56

8 + 0x30 = 56

8 + '0' = 56

56 decimal is 0x38 hexadecimal, or 00111000 in binary.

Note that some programming languages may not support all forms of the above. The last form (8 + '0') is the preferred method where supported as it makes it perfectly clear what the intent is: to add a value to the ASCII code '0'.

Most programming languages permit you to format the underlying binary value as decimal or hexadecimal for printing purposes, so there's usually no need to manually convert to hexadecimal. E.g, for a given value, the following will print the value in both hex and decimal:

printf("Decimal: %d, Hex: %x\n", value, value );

In the interest of completeness, the algorithm for converting any given decimal value to its hex equivalent is as follows (in pseudocode):

1. Let the output string be an empty string.
   1. Let ch be value % 16 (modus, or remainder of division).
   2. If ch is less than 10, add 48 to ch, otherwise add 65 to ch.*
   3. Prepend ch to the output string.
   4. Let value be value / 16.
2. While the value is non-zero...
3. end while
4. Print the string.**

*65 is the ASCII character code for 'A'. For lower case, add 97 instead (character code for 'a').

**You must prepend characters. If you append them, you must reverse the string before printing.

system-config-firewall (FEDORA) or system-config-securitylevel (RHEL), "that is where you build you firewall"

the netfilter component is a set of tables that hold rules that the kernel uses to control network packet filtering. "Fedora and RedHat Enterprise Linux... fifth edition"