File transfer using SFTP in C#

Before we delve into how we accomplish this, let's first find some common ground on what S-F-T-P means. In wikipedia, you'll get a longer than expected list of links for this acronym. The technology we want to utilize is SSH File Transfer Protocol. It is alternately known as Secure File Transfer Protocol, but to avoid confusion (hopefully) we will refer to it as SFTP henceforth. Please don't get it confused with "FTP over SSH" as it is a completely different protocol. SFTP runs on TCP port 22, the port commonly used for Secure Shell - SSH. "FTP over SSH" uses the standard TCP ports 20/21.

At this point, your boss asks you to send a file over to a vendor's [S]FTP server. After you do some research and figure out that he really means SSH File Transfer Protocol, the battle is half won. You can simply send that file using most ftp programs available. I had no idea. I personally use CoreFTP and was pleasantly surprised to find a nice little SSH/SFTP checkbox in the bottom right corner of the connection screen.



Now you want an api. SharpSSH is such a library that does SFTP along with a host of other things. Download demos and source files here.

Here is how simple it is to encrypt a file by using PGP.  I decided to go with the open source route.  Gnu Privacy Guard provides a simple wrapper class that makes it easy to encrypt/decrypt messages:

StreamReader reader = new StreamReader(readFromFile);
StreamWriter writer = new StreamWriter(writeToFile);
string output = "";

// Begin encryption
GnuPGWrapper wrapper = new GnuPGWrapper();

wrapper.homedirectory = "C:\\gnupg";
wrapper.passphrase = "";
wrapper.originator = "";
wrapper.recipient = "blah@blah.com";
wrapper.command = Commands.Encrypt;
wrapper.verbose = VerboseLevel.VeryVerbose;
wrapper.ExecuteCommand(reader.ReadToEnd(), out output);

writer.Write(output);

Video Game Programming

The following is a description of one of the courses I will be taking in my final semester of graduate school.

CMP 717: Video Game Programming. 4 hours, 4 credits.
General game architecture, asynchronous input, animated sprites, action oriented a.i., collision detection, scrolling, sound clips, 3D Graphics. Student projects involving development of several video games, both individually and in teams.
PREREQ: CMP 338 and a strong foundation in object oriented programming techniques.
COREQ: MAT 226
NOTE: Students should expect to devote a great deal of time working both individually and in teams to produce several video games written in Java. This is a “Programming Intensive” course.

Notice the text in bold. I can't wait....

Stop H*Commerce

Stop H*Commerce. Go there. Please.

It's a documentary revealing the business of hacking. It gives an inside look into the lives of a white-hat hacker and a victim of the Nigerian email scam. You know, the one about a lawyer or banker having no way of transferring a large sum of money and he needs YOUR help. This scam is also known as the 419 scam whose name four-one-nine was given from the Nigerian penal code for scamming.

H*commerce (Hacker Commerce) is a term coined for an industry unlike any industry that happens all around the world. The people involved are hackers and thieves and what they trade is your data. It can be anything, but the most popular item on the black market menu is called the "dump" - the data on the magnetic strip on the back of credit cards. Read all about it here.

Cookie Poisoning

I wanted to talk a little bit more about Cookie Poisoning as it is something that a lot of people seem to be interested in. Basically, a cookie saves information on the client's machines that websites want to store. Typically, they would store a session id - essentially a unique identifier.

A typical Amazon Cookie.

Cookies can store other information as well. "Other information" may be as harmless as a user name that your favorite website remembers so you don't have it type it in every time you login. It can also be non-trivial like an account number, shopping cart total, social security number and any other personal information. I wish this wasn't the case, but I'm sure there are some websites that do this. The problem does not stop here. Anyone can edit a cookie and change their shopping cart total. Who wouldn't want to buy a brand new TV for a hundred bucks? Wouldn't you also get the store warranty that they always try to sell you but no one buys?

How to edit cookies? Download and install Add N Edit Cookies (a Firefox Add-on).

There are a number of ways to protect yourselves from this vulnerability.

• Do not save sensitive information in cookies.
• Try to utilize server side sessions where possible.
  
• Encrypt your cookie data.
  
• Set an expiration that makes sense.

Note that cookie security should entail using SSL for your website AND encrypting the data in your cookie. If your site transmits any personal information, securing your site with SSL is a must. Packet sniffers can pick up cookie data in plain sight. Furthermore, anyone that has access to your local hard drive can view cookie data. Secure your data using strong encryption!

A Malware Story

Pedro Bueno of McAfee makes a thought provoking statement, "I don’t really know which is worse: a dumb or a smart malware writer" in his blog post. Apparently, a variant of the PWS-Banker trojan was written by a "dumb malware writer." The trojan steals the usual gamut of banking information using the popular cookie poisoning exploit and sends it to a remote SQL database. However, the credentials for that database were hard-coded in the malware for everyone to see. What are the implications of this? Disaster. Any fellow evil-minded script kiddie could get theirs hands on bank account, user name and passwords and sell it out on the market. IT'S PAYDAY. Until, of course, you get caught.

Orphaned Users in SQL Server

It happens all the time - orphaned users. Often times you are required to restore a database for testing purposes and you go back to your land of semicolons, butterflies and ponies and all of a sudden BAM: Login failed for user 'dbuser'.

In SQL Server, Database Users and Server Logins are two different entities. Users are associated to the database level, and logins are associated to the Server level. Every User must be mapped to a Login. Otherwise, you get a dreaded orphan.

In SQL Server 2008, run sp_change_users_login @Action='REPORT' to detected orphaned records. I actually just ran this and there are three orphaned users in one of my databases right now. Slacker!

To resolve an orphaned user, run sp_change_users_login @Action='update_one', @UserNamePattern='DatabaseUserName',
@LoginName='ServerLoginName';

And there you have it. Happily reunited.

My Stackoverflow Flair

This is my stackoverflow flair. It isn't much by any means. It pales in comparison with others on the site by wide margins. To give you an idea, the leading user at the time of this writing is John Skeet with 68.5k reputation score. It's not like he's had an unfair advantage besides the obvious intellectual one. He's been a member of the site for 8 months. I've been a member for 10. Anyone that is a part of stackoverflow will know the mental fortitude necessary to stay atop the leaderboard. A hat tip goes out to you John Skeet.