Tuesday, February 3, 2009
Instinctive Computing
Saturday, January 10, 2009
MD5 considered harmful today, Creating a rogue CA certificate
We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This certificate allows us to impersonate any website on the Internet, including banking and e-commerce sites secured using the HTTPS protocol.
Our attack takes advantage of a weakness in the MD5 cryptographic hash function that allows the construction of different messages with the same MD5 hash. This is known as an MD5 "collision". Previous work on MD5 collisions between 2004 and 2007 showed that the use of this hash function in digital signatures can lead to theoretical attack scenarios. Our current work proves that at least one attack scenario can be exploited in practice, thus exposing the security infrastructure of the web to realistic threats.
As a result of this successfull attack, we are currently in possession of a rogue Certification Authority certificate. This certificate will be accepted as valid and trusted by all common browsers, because it appears to be signed by one of the root CAs that browsers trust by default. In turn, any website certificate signed by our rogue CA will be trusted as well. If an unsuspecting user is a victim of a man-in-the-middle attack using such a certificate,they will be assured that the connection is secure through all common security indicators:
a "https://" url in the address bar, a closed padlock and messages such as "This certificate is OK" if they chose to inspect the certificate.
This successful proof of concept shows that the certificate validation performed by browsers can be subverted and malicious attackers might be able to monitor or tamper with data sent to secure websites. Banking and e-commerce sites are particularly at risk because of the high value of the information secured with HTTPS on those sites. With a rogue CA certificate, attackers would be able to execute practically undetectable phishing attacks against such sites.
The infrastructure of Certification Authorities is meant to prevent exactly this type of attack. Our work shows that known weaknesses in the MD5 hash function can be exploited in realistic attack, due to the fact that even after years of warnings about the lack of security of MD5, some root CAs are still using this broken hash function.
The vulnerability we expose is not in the SSL protocol or the web servers and browsers that implement it, but in the Public Key Infrastructure. This infrastructure has applications in other areas than the web, but we have not investigated all other possible attack scenarios. So other attack scenarios beyond the web are conceivable, such as in the areas of code signing, e-mail security, and in other areas that use certificates for enabling digital signatures or public key encryption.
The rest of this document will explain our work and its implications in a fair amount of detail. In the interest of protecting the Internet against malicious attacks using our technique, we have omitted the critical details of our sophisticated and highly optimized method for computing MD5 collisions. A scientific paper about our method is in preparation and will be released after a few months, so that the affected Certification Authorities have had some time to remedy this vulnerability.
Read full article here if interested
Saturday, July 12, 2008
Google Code Jam
http://code.google.com/codejam/
About Code Jam.
Do you enjoy solving tough problems and grappling with technical challenges? Then enter Google Code Jam!
Google Code Jam is a coding competition in which professional and student programmers are asked to solve complex algorithmic challenges in a limited amount of time. The contest is all-inclusive: Google Code Jam lets you program in the coding language and development environment of your choice.
Google Code Jam begins in July and continues in August, when you will compete in online rounds against contestants from around the world. The Top 500 participants will advance to onsite competitions at a local Google office to compete against those in their region (Asia Pacific; Europe, Middle East and Africa; and the Americas). The Top 100 will participate in the final round at the Google Headquarters in Mountain View, California on Friday, November 14.
Don't be left out! Make sure to register between June 17 and July 17, and show your coding creativity in Google Code Jam.
Thursday, June 19, 2008
Google Code Jam
Do you find yourself debugging in your sleep? Enjoy solving tough problems and grappling with technical challenges? Then enter Google Code Jam and compete for more than $80,000 in cash prizes!
Google Code Jam is an annual competition in which programmers like you are challenged to solve complex coding problems in a limited amount of time – using any programming language or tools you like.
We began offering Google Code Jam in 2003 – on a platform powered by TopCoder – in order to support competitive programming around the world. This year, for the first time, we're producing the contest on a homemade platform developed by Google's own developers.
Here's how it works: First, you'll need to register from Tuesday, June 17 through Thursday, July 17. Then, you'll compete against global contestants in the online rounds during July and August. The Top 500 will advance to compete in one of our Google offices around the world in September/October for regional competitions. Finally, the Top 100 will compete in the coding showdown on November 14, 2008, at Google Headquarters in Mountain View, California.
To learn more details and to register, please visit - code.google.com/codejam
We hope to see you at the Finals!
Sincerely,
Google's Code Jam Team
Wednesday, May 21, 2008
Monday, March 19, 2007
online lecture sites
http://lecturefox.com links open source lectures from several universities including MIT and UC Berkeley.
Saturday, March 17, 2007
Local news by Yahoo!, MSN in native scripts
I cann't explain the joy of reading MSN Telugu, it is so good to read news in your native language specifically international and information technology news items which are rarely covered by local papers.
The other big advantage is this data can be used to build language models which turn to help to build better speech synthesis and speech recognition, machine translation systems for Indian languages.
The other big advantage I see is to the students of MSIT/IIIT/JNTU. As a part of their soft-skills they can have reading and comprehensive assignments in native languages. This would serve in two folds.
1. Preserve reading, comprehension abilities of the student in native languages
2. Better reading, writing and comprehension in native language could lead better to reading, writing and comprehension in English too.
MSN:
www.msn.co.in/hindi
www.msn.co.in/tamil
www.msn.co.in/telugu
www.msn.co.in/kannada
www.msn.co.in/malayalam
Google:
http://news.google.com/news?ned=hi_in
Yahoo!
http://in.telugu.yahoo.com/
http://in.hindi.yahoo.com/
http://in.gujarati.yahoo.com/
http://in.punjabi.yahoo.com/
http://in.kannada.yahoo.com/
http://in.malayalam.yahoo.com/
http://in.tamil.yahoo.com/
BBC:
http://www.bbc.co.uk/hindi/
http://www.bbc.co.uk/tamil/
http://www.bbc.co.uk/bengali/
http://www.bbc.co.uk/urdu/
Monday, March 12, 2007
Will IITs remain centers for excellence
The problem of education: Prof. Raj Reddy
Part I: http://sramanamitra.com/blog/656
Part 2: http://sramanamitra.com/blog/664
Part 3: http://sramanamitra.com/blog/663
Part 4: http://sramanamitra.com/blog/665
Part 5: http://sramanamitra.com/blog/666
Part 6: http://sramanamitra.com/blog/667
Part 7: http://sramanamitra.com/blog/670
Part 8: http://sramanamitra.com/blog/671
Part 9: http://sramanamitra.com/blog/672
Part 10: http://sramanamitra.com/blog/674
Part 11: http://sramanamitra.com/blog/675
Friday, March 9, 2007
Worksheet for report/proposal writing.
- Introduction with Unique attributes
- What are we trying to do?
- What is the key make-a-difference capability we bring to the table?
- Current Context
- How is it being done today?, How are others approaching the problem?
- What are the limitations of current/proposed approaches?
- The Vision
- What is new in the approach?
- The Plan
- What is the plan for realizing the goal?
- Impact
- If you succeed who will care? What is the impact?
- Financials
- How much will it cost and how long will it take?
- Evaluation
- What are the mid-term and final exams?
Thursday, March 1, 2007
MSIT NET On Ning.com
Would be good to see photos on it from recent MSIT's Kerala trip!
http://www.ning.com (created by Netscape team) allows us to create any number of social networks.
We can use it to create *n* number of networks, one for each course (or for each batch) and thus connect learning centers of MSIT and/or Gurukulam centers. The discussion forums here would be most useful to post queries and seek answers from internal as well as from remote mentors/colleagues across the centers/countries.
PS: It is free with little hassles of infrastructure, setup and maintenance.
Tuesday, February 27, 2007
Friday, February 23, 2007
Why Problem based Learning.
In June of 1994, a Wingspread Conference brought together state and federal policymakers, and leaders from the corporate, philanthropic, higher education, and accreditation communities to discuss quality in undergraduate education. This conference was sponsored by the Education Commission of the States (ECS), the Johnson Foundation, the National Governors' Association, and the National Conference of State Legislatures. The discussion that took place was based on the assertion that substantial improvement in American undergraduate education is needed to prepare students to function successfully in current business and industrial environments.
The Conference developed the following list of important characteristics of quality performance of college and university graduates (Wingspread, 1994):
* High-level skills in communication, computation, technological literacy, and information retrieval to enable individuals to gain and apply new knowledge and skills as needed
* The ability to arrive at informed judgments-that is, to effectively define problems, gather and evaluate information related to those problems, and develop solutions
* The ability to function in a global community through the possession of a range of attitudes and dispositions including flexibility and adaptability, ease with diversity, motivation and persistence (for example, being a self-starter), ethical and civil behavior, creativity and resourcefulness, and the ability to work with others, especially in team settings
* Technical competence in a given field
* Demonstrated ability to deploy all of the previous characteristics to address specific problems in complex, real-world settings, in which the development of workable solutions is required
Survey results (Czujko, 1994) of all physics baccalaureates who were employed in either the private sector or government/national labs confirmed the Wingspread Conference conclusions. With approximately 80 percent response to the question, "What skills have you found to be the most useful in your work?", problem-solving, interpersonal skills, technical writing, and management skills were cited (greater than 60 percent) over physics knowledge.
More recently, the Carnegie Foundation's report, Reinventing Undergraduate Education: A Blueprint for America's Research Universities (1998) stated that "traditional lectures and note-taking were created for a time when books were scarce and costly and lecturing to large numbers of students was an efficient means of transferring knowledge."
Lecturing is still efficient and has persisted as the traditional teaching method largely because it is familiar, easy, and how we learned. It does little, however, to foster the development of process skills to complement content knowledge.There are teaching practices, however, that do foster such skill development without forsaking content.
Quoting John Dewey's observation that "true learning is based on discovery guided by mentoring rather than the transmission of knowledge," (Boyer, 1998, p. 15) the Boyer report urged universities to facilitate inquiry in such contexts as the library, the laboratory, the computer, and the studio, with the expectation that senior learners, that is, professors, will be students' companions and guides.
The research university's ability to create such an integrated education will produce a particular kind of individual, one equipped with a spirit of inquiry and a zest for problem solving; one possessed of the skill in communication that is the hallmark of clear thinking as well as mastery of language; one informed by a rich and diverse experience.
It is that kind of individual that will provide the scientific, technological, academic, political, and creative leadership for the next century. (Boyer, 1998)Student-centered, inquiry-based instruction, particularly problem-based learning, falls right into line with this philosophy; indeed, the Boyer Commission pointed to the PBL efforts at the University of Delaware as one example of how to help students reach the important goals highlighted in the report.
What is Problem-based learning?We believe that problem-based learning (PBL) provides a forum in which these essential skills will be developed. The basic principle supporting the concept of PBL is older than formal education itself; namely, learning is initiated by a posed problem, query, or puzzle that the learner wants to solve (Boud & Feletti, 1991).
In the problem-based approach, complex, real-world problems are used to motivate students to identify and research the concepts and principles they need to know to work through those problems. Students work in small learning teams, bringing together collective skills at acquiring, communication, and integrating information.
Problem-based instruction addresses directly many of the recommended and desirable outcomes of an undergraduate education: specifically, the ability to do the following:
* Think critically and be able to analyze and solve complex, real-world problems
* Find, evaluate, and use appropriate learning resources
* Work cooperatively in teams and small groups
* Demonstrate versatile and effective communication skills, both verbal and written
* Use content knowledge and intellectual skills acquired at the university to become continual learners.
The PBL Cycle in the sciences traces its roots to the medical school setting where small groups of intellectually mature, highly motivated medical students work in small groups with a dedicated faculty tutor to learn basic science concepts in the context of actual clinical cases.
The process of problem-based instruction (Boud & Feletti, 1997) follows:
* Students are presented with a problem (case, research paper, videotape, for example). Students working in permanent groups organize their ideas and previous knowledge related to the problem and attempt to define the broad nature of the problem.
* Throughout discussion, students pose questions called "learning issues" that delineate aspects of the problem that they do not understand. These learning issues are recorded by the group and help generate and focus discussion. Students are continually encourage to define what they know and-more importantly-what they don't know.
* Students rank, in order of importance, the learning issues generated in the session. They decide which questions will be followed up by the whole group and which issues can be assigned to individuals, who later teach the rest of the group. Students and instructor also discuss what resources will be needed to research the learning issues and where they could be found.
* When students reconvene, they explore the previous learning issues, integrating their new knowledge into the context of the problem. Students are also encouraged to summarize their knowledge and connect new concepts to old ones.
They continue to define new learning issues as they progress through the problem. Students soon see that learning is an ongoing process and that there will always be (even for the teacher) learning issues to be explored.
PBL fosters the ability to identify the information needed for a particular application, where and how to seek that information, how to organize that information in a meaningful conceptual framework, and how to communicate that information to others. Use of cooperative working groups fosters the development of learning communities in all classrooms, enhancing student achievement (Johnson, Johnson, & Smith, 1991).
Students who learn concepts in the context in which they will be used more likely to retain that knowledge and apply it appropriately (Albanese & Mitchell, 1993). They will also recognize that knowledge transcends artificial boundaries since problem-based instruction highlights interconnections between disciplines and the integration of concepts.
___________________
M.A. & Mitchell, S. (1993). Problem-based learning: A review of literature on its outcomes and implementation issues. Academic Medicine, 68, 52-81.
Boud, D., & Feletti, G. (1997) The challenge of problem-based learning (2nd ed.). London: Kogan Page.
Johnson, D. W., Johnson, R. T., & Smith, K. A. (1991). Cooperative learning: Increasing college faculty instructional productivity. (ASHE-ERIC Higher Education Report No. 4). Washington, DC: George Washington University.
Thursday, February 22, 2007
Google Maps for MSIT/Gurukulam Monitoring
It would be nice to see a monitoring system for MSIT and Gurukulam labs spread throughout AP, and to see what's happening in any of these labs by just clicking on Google-Maps.