Jump to content

Angus Robertson

Members
 View Profile  See their activity

  • Content Count

    2062

  • Joined

  • Last visited

  • Days Won

    38

Posts posted by Angus Robertson

  1. Posted

    Two new zips for Win32 and Win64 versions of OpenSSL 1.1.1j can now be downloadable from the Wiki at: http://wiki.overbyte.eu/wiki/index.php/ICS_Download or https://www.magsys.co.uk/delphi/magics.asp . The latest 1.1.1 DLLs are also included in the ICS distribution SVN and overnight zip.

     

    Beware SVN and the overnight zip for forthcoming V8.66 include is a major clean-up of OpenSSL functions, and may require end user application changes if low level OpenSSL functions have been used,
    hopefully very rarely.   All OpenSSL functions have been renamed to their original names removing ICS f_ prefix so they now have the original OpenSSL names for commonality with other Delphi
    applications.

     

    OpenSSL 1.0.2 and 1.1.0 ceased security fix support over 12 months ago, so ICS now only supports 1.1.1, with 3.0 support due in the next few months. This removes a lot of legacy code and functions, and several old ICS functions needed for backward compatibility.  Two components only used for 1.0.2 have been removed, TSslStaticLock and TSslDynamicLock which may give an error loading forms, until they are removed.  SslContext SslOptions is now ignored, use SslOptions2 instead which has more modern options.  Can not remove SslOptions because it's saved on too many DFMs. Most modern
    applications should not be using SslConext, but IcsHosts for servers or high level client components like TSslHttpRest.

     

    If your application needs to use 1.0.2, you must keep using V8.65 or earlier.

     

    Angus

     

    • Like 1
    • Thanks 1

  4. Posted

    The Whois result is always free text, and varies between registrars.  But usually you'll see something like:

     

    One example:

       Updated Date: 2020-10-30T06:00:11Z
       Creation Date: 2020-10-30T06:00:08Z
       Registry Expiry Date: 2021-10-30T06:00:08Z
       Registrar: NameCheap, Inc.
      

    My own domain (very old): 

        Relevant dates:
            Registered on: before Aug-1996
            Expiry date:  02-Sep-2022
            Last updated:  03-Aug-2020

     

    so you just search for that expiry line and get the date, allowing for various formats.  You need to check several domains for different formats. 

     

    If you manage to collerct all this information and parse it sensibly, we could add it to the component for others.  I'd particular like domain registered date, because most spam comes from newly registered domains.

     

    Angus

     

  5. Posted

    So I guess a hacker testing IPv4 addresses sequentially, and too lazy to convert his numbers to a dotted IP address, except the server is http://3650250390/ which does work from Firefox, but may have been converted by the browser.

     

    One of my hacking tests is for numeric IPs since no real visitor would use them, they go on an immediate 24 hour block list.

     

    Angus

     

  8. Posted

    There are subtle changes with new versions of windows.

     

    Getting the actual windows version is much harder than it used to be since Windows now fakes old versions to keep old applications happy. 

     

    Auto running from the registry is harder if your application has admin rights, since that is something hackers try to do to gain admin rights. 

     

    There must be a list of these things somewhere, these are just two in the old application I'm maintaining today.

     

    But generally, Delphi applications compiled 20 years ago still run today, as do new applications compiled with 20 year old compilers (mostly). 

     

    Never used .net, but I know security holes are fixed every month, and Microsoft keeps breaking Delphi 2007 by regularly deleting the  Borland.*.Targets files from the Framework directory.  I would never sell an application that Microsoft can so easily break. 

     

    Angus

     

     

    • Like 2

  12. Posted

    I was updating the check alive capability of one of my applications to add IPv6 support this week, so created a new ICS component TIcsInetAlive to check for IPv4 and/or IPv6 internet
    connectivity, using Ping and/or HTTP, defaulting to  www.msftconnecttest. com run by Microsoft for Windows 10 alive checking, online and offline check intervals may be set, event when online changes.   In SVN now.  There is a demo in OverbyteIcsHttpRestTst.dpr.

     

    It is also a sample for using TSslHttpRest, needing only a few lines of code for HTTP requests. 

     

    Angus

     

  13. Posted

    I've just written a new TIcsInetAlive component, will be in SVN shortly, it measures the round time for ping and HTTP requests, and these are my results from Windows 10 over FTTC to a London data centre where Microsofts hosts this domain. 

     

    08:31:24  Check Alive Ping to www.msftconnecttest.com (13.107.4.52) took 5 msecs
    08:31:24  Check Alive to http://www.msftconnecttest.com/connecttest.txt (13.107.4.52) took 16 msecs
    08:31:49  Check Alive Ping to ipv6.msftconnecttest.com ([2a01:111:2003::52]) took 5 msecs
    08:31:49  Check Alive to http://ipv6.msftconnecttest.com/connecttest.txt ([2a01:111:2003::52]) took 15 msecs

     

    Note HTTP is the complete lookup DNS, connect, get a page, close cycle, not just send and receive a packet. I'm only timing with ticks, not performance counter, but I believe ticks are reasonably accurate in modern versions of Windows.

     

    Angus

     

  21. Posted

    Rather than accessing Google, you should check http://www.msftncsi.com/ncsi.txt and http://ipv6.msftncsi.com/ncsi.txt  which are the Microsoft Network Connectivity Status Indicator web pages used by almost all Windows installations every few seconds for many years to detect network connectivity for IPv4 and IPv6 (one or other may not work). They are designed for heavy use, and return a two word text page.

     

    While you can use TCP to open a web page, there is a long timeout trying to connect, 30 seconds or more, so it's faster to use ICMP ping, to www.msftncsi.com, look at the OverbyteIcsPingTst.dpr sample, with ping you can set a five second (or less) timeout to get a quick response.

     

    Angus

     

  23. Posted

    Quote

    It is impossible for a server to detect middle man when the secure connection is TLS/HTTPS with only server side certificate authentication

    Which is why many servers insist on using JOSE technologies such as Json Web Signing which means the headers are signed with a password or private key before being sent, so can not be changed without the server knowing, this is how Let's Emcrypt and OAuth1/2 work.  Or Json Web Encryption if you don't want the headers read. 

     

    Angus

     

    • Like 1
×