A loop hole in social networking sites security

Hey readers, I wanted to share with you a loop hole that I've found with social networking sites and their security. Please note, I'm not a hacker and I've found this using my own account. Last night I was trying to access my MySpace account and I forgot my password. I requested to retrieve my password by clicking on the 'Forgot your password' link, this is a link that all social networking sites provide just in case if you forget your password, see Figure 1. Next I was taken to another page where it would ask me to provide my email address that I used when creating my MySpace account, see Figure 2. Remember when signing up for MySpace, they would required you to put in a contact email address? Well  this is the reason why, so they can send you information on how to change your , instead of posting your password a separate page. Hackers could easily retrieve your password if MySpace just posted your password on a separate page by supplying your email address and clicking the submit button.

Next, I provided my email account and click submit and I got a message back stating that my password information was sent to my email address, then the light came on. I had deleted this email account months ago, so MySpace sent an email message to an email account that no longer exists. I went back to the provider where I had created my email account from before and I checked to see if that email account was still available, and it was. I re-created the account and went back to MySpace, clicked on the 'Forgot your password' link, supplied my old email address which has now been recreated and active to accept email messages, clicked the submit button and then went back to my now recreated email account inbox and I saw the email message to change my MySpace password was there.

Figure 1                                                                

 










Figure 2

The moral of this story, if you have email accounts tied to social networking sites or any online account, I suggest changing deleted email address tied  on your social networking sites as well as any other online accounts that you may have. If you have any questions or comments regarding this post, please provide your comments in the 'Comments' section for this post.

Thank You,

Two ways to access a WCF RESTful service from a client

Hey readers, I want to show you two ways to access a WCF RESTful service from the client. Let's dive in!!!.

First let's take a look at the service implementation. This service a RESTful service which provides product information and returns the data  in a JSON format. In this service I have an interface named IProduct which  defines my service contact and two operation contracts. GetAllProducts returns a generic lits of product objects, and GetProductByID returns a single product object based on a product id. The attributes that appear on top of each method defines the details of how the service will accept and respond to service calls. For more information on this I suggest reading "How to: Create a Basic WCF REST service". Figure 1 shows you the interface definition, Figure 2 shows you Product data contact definition and Figure 3 shows you the code implementation for each operational method .

Figure 1

Figure 2

Figure 3

There's one thing to note here in Figure 3, at the top of the class I have an attribute called "ServiceBehavior" and that sets the InstanceContextMode to PerCall. The InstanceContextMode specifies the number of service instances available for handling calls.By using the PerCall enumeration we're saying that an InstanceContext object is created before and destroyed after each call is made. Its important to set the InstanceContextMode to PerCall to increase performance when accepting incoming requests. The other options are PerSession and Single which can be used for scenarios where a services that accepts a lot of incoming requests, you would want to keep the InstanceContext  session alive until the session has expired. Be careful because you can have a situation where you have a boat load of sessions existing on server which could hurt your server and service performance. Next, let's take a look how to access this service using jQuery and Sys.Net.Request


Using jQuery or Sys.Net.WebRequest to access a WCF RESTful service
First, lets take a look at the interface. Just as a note, the interface will be the same for both the jQuery and Sys.Net.WebRequest examples. Figure 4 shows the browsers view, the interface is divided into two sections, the first section shows a listing of all products and the second section shows a single product based on a product id.

Figure 4

jQuery:

Now that we defined our interface let's take a look at the code behind. First we need to add a script reference to the jQuery library so we can invoke our service operational methods, see Figure 5.

Figure 5

Next we need to implement code to retrieve all products, by invoke the "GetAllProducts" method, see Figure 6. "ShowAllProducts()" function uses the  jQuery's $.ajax method to make an ajax request using the service url value which is the url to our web service, request type which is a GET , the type of data that we're expecting back from the server,which is JSON and then finally we need to register functions to call when the web request has ran successfully or unsuccessfully. If no errors has been thrown, "OnSuccessGetAllProducts" is called which returns a 'GetAllProductsResult' array object. The 'GetAllProductsResult' is the name of the JSON array object which I use to display all products to the browser.

Figure 6

Take a look at Figure 7, both figure 6 & 7 are almost identical with the exception that the GetProductByID function requires a product id. We now retrieve this product id from text input made by the user. Now that we have the product id, we need to append the product to the service url to satisfy the URLTemplate property requirement. If you remember when we created the GetProductByID operation method, the URLTemplate property was define as "/GetProductByID/{ProductID}", if defined in any other way when making a request to that method, will result in an error. Here is the service url value that we will use to retrieve the requested single product," url: "http://localhost:3284/CSWS/Services/ProductServices.svc/GetProductByID/"+productID+"" ". All we have to do now is to display the product to the user which is handle by  "OnSuccessGetProductByID" function and display the single product to the user. The results are stilled return as JSON array with the name of GetProductByIDResult, but since the array has only one element we don't need to use a loop to display the  contents.

Figure 7

To get more information about jQuery, please check out this link, JQUERY.

Sys.Net.WebRequest

Sys.Net.WebRequest provides you the ability to make web request on the client. For more information, check out the Sys.Net.WebRequest documentation. Before we being, we must add a ScriptManager control to the page, its required in order to invoke web requests with the Sys.Net.WebRequest object.  Figure 8 shows you the full implementation for retrieving all products.

Figure 8

Take a look at the ShowAllProducts function. As you can see that I have created a Sys.Net.WebRequest object, but before we can make our request we need to provide some information to this object. The first thing we need to provide is the url by setting the set_url property. This tells the Sys.Net.WebRequest instance where to send the request to using your service url. The next item that we need to provide is the type of request that we're making, by setting the set_httpVerb property which in my example I set value to do a "GET" request. Next, I'm going to skip over the set_body and .get_headers()["Content-Length"] properties, since they really don't have any significant value in my example, but just for your knowledge, the set_body property allows you to set the body part of a  request and the .get_headers() property allows you to set custom headers for a request. The last property that I'm setting is the add_completed which registers a handler for the completed request event of the Web request object, its similar to the "success:" element that I used in my jQuery example. In this example I set this value to GetAllProductsHandler. Finally we  use invoke method which beings the web request. Let's see how I processed the response results by using the GetAllProductsHandler function.

GetAllProductsHandler function is pretty simple, we first check to see if we have a response  by checking if the executor.get_responseAvailable value is true. If true, then we need to use the executor.get_responseData to retrieve the response results and store them into a local variable called serviceResults. Next we need to transform the response results into a format we can process using plain old javascript code, in this case I'm using the eval function.. Now that we have the results into a format that we can use, we can work with data in the same way as we did with jQuery example. First, we make a call to the GetAllProductsResults JSON array which contains a list of all products, then we use a for loop  to display all products. That's it. Figure 9 will show you the implementation for retrieving a single product based on a product id. I'll skip the details on this since the code is almost identical to how we retrieve all products with one exception, the _set_url property value appends a product id.

Figure 9

In summary, both using jQuery and Sys.Net.WebRequest provide valuable options to access web resources. In my opinion, I think using the Sys.Net.WebRequest class is easier to use because the classes and syntax are familiar to me as if I was writing server side code with C#. Even though its required to have an instance of the ScriptManager control on the page before you can use the Sys.Net.WebRequest object, but the same is true for jQuery, before you can make any Ajax calls you need to include a script reference to the jQuery library. Maybe in a future article I go over the difference between the two and see which is better. 

I hope you enjoy this article. Below is a link to download the sample code used in this post. Please post your comments and let me know what you think. Thank You

IP Law and Third Party Software Licencing usage in IT orginzations

Today, I had an interesting conversation about intellectual property law and third party software licencing usage in IT shops. An IT shop purchases a third party software product with a developer licence which means you can only use this software in a non-production/commercial server. If the IT shop decides to use this software on their production/commercial server without buying a commercial licence, then the company can be liable for patent infringement. Has anyone experience this before? Please share, I'm interested in hearing your comments.

National Society of Black Engineers

Hey readers, is anyone a member of NSBE? If you do, can you please provide some incite to this organization? I'm thinking of joining.

National Society of Black Engineers

Court bars Microsoft from selling Office 2007

Hi Readers,
 I wanted to share with you a post that I have found regarding a court ruling against Microsoft for patent infrigement with XML support in their Word Office 2007 product. The article summarize the results from the court ruling which forced Microsoft to either remove the xml support  or stop selling their Word Office 2007 product and the company is required to pay a $290 million dollar fine. The company that filed the suit was  i4i, and they claimed that company owns the custom XML editing technology.  You can view the entire article here Court bars Microsoft from selling Office 2007. I'm curious to see how this ruling will affect Microsoft existing customers that have already implemented their applications to use the XML support features coming from Word Office 2007.

Cyber Security Related News

Hey everyone, I wanted to share with you two cyber security related news articles. They're pretty interesting and the most interesting part about both articles are the methods that both attackers used to commit their crimes.

• Hackers Stole IDs for Attack
• Three Indicated in Largest Corporate Identity Theft Case In History

Feel free to post your comments, I'm interested in your reactions to the articles.

Search and filter items of an ASP.NET GridView control using jQuery

Hey everyone, today I wanted to share with you how search and filter items of an ASP.NET GridView control using jQuery. Lets begin with the reason why I decided to right this post. Every fall , a co-worker and myself provides technical support for a firm-wide application where we manage individual attorney profiles which consists of their security rights and language setting. The main module we use to manage attorney profiles is an aspx page that has a GridView control filled with a list of all attorneys within the firm, which is close to 2000 employees. On a typical day we get requests to change an attorney's language setting or modify their security rights, which at first can be tedious because we need to scroll down the page just to find one user out of 2000. So after a while, I got tired of doing this and came up with a way to search for users easily within a GridView control. Let's take a look on how I did this.

Some of code for this post comes from a previous article that I read called 'Search and Filter Items of ASP.NET Drop Down List using jQuery', I encourage to check it out when you can. Let's begin with the interface. Take a look at 'Figure 1', in my example I'm using the Northiwind database where I'm displaying all product information including the supplier names. Pretty simple interface, a TextBox and GridView control. The TextBox is used to type in the product name that you're looking for.

Figure 1
When a user begins to type into the TextBox, the application filters the GridView to show products where the product name contains or beings with the prefixed text typed into the TextBox control .Look at Figure 2.

Figure 2
Notice that the GridView has shrunk based on the prefixed text in the TextBox control. Notice at the top of the GridView appears text that displays the number items that matched your keyword search. Look at Figure 3.

Figure 3
Now that we have seen the interface, let's take a look at the code behind. Take look at 'Figure 4' where it shows the page's html markup. As you can see I have a GridView and SqlDataSource controls. The GridView.DataSource property uses to the SqlDataSource control as its data source to retrieve product information and the SqlDataSource.SelectCommand property has a select statement that retrieves all product information from the Northwind.Products table.

Figure 4

Let's move onto the jQuery code. Take a look at 'Figure 5', the first half of this code retrieves references to all controls on the page. The $gridView variable contains a reference to the GridView control and the $employeeTextBox variable contains a reference to the TextBox control. Next, we have a $headerItems variable which contains the GridView header row and the $employeeItems variable is all rows besides the GridView header row,which includes the product name. Just as a side note, I'm using the 'filter' method in jQuery for both the $headerItems and $employeeItems variables to retrieve rows that have a 'scope' attribute value of 'col' for the $headerItems variable and retrieve rows that have an anchor control with a 'id' attribute value of 'lnkBtn' for the $employeeItems variable . As you can see the anchor controls displays the product name which I will use for filtering. I have to do it this way because the GridView control is represented as an html table through the browsers, so by using jQuery I can take advantage of jQuery's DOM functionality to extract the 'tr' rows that I need from the GridView. 'Figure 6' shows you the 'View Source' view of a GridView how it displays in your browser.The next line set's the focus to the TextBox control and then finally I'm attaching a keyup event where I'm calling the searchGV function, so every time the user types in a character, the searchGV is called.

Figure 5

Figure 6
The searchGV function performs the filtering based on the text coming from the TextBox control. Figure 7 shows the entire implementation. The first line removes all rows from the GridView control, then we're using regular expression to provide a search term to find all matching product names within the $employeeItems variable. The .grep function bascially finds all matching text and returns them to an array. Next we build the GridView header row since it was removed by the first line and re-add it back to the GridView control, then we check if the arr.length is greater then zero.If true, then we display the number of items found to a span element, then using the .each function we can iterate through the arr object and append each item to the GridView control.

Figure 7

That's it. I hope you enjoy this post and let me know if you liked it or not. Below is a link to the sample solution for you to download.

Thank You Again,