As part of its ongoing dispute with the U.S. over cyber-security, Chinese agencies are suggesting banks in the country stop using IBM servers.

China reportedly is ramping up its cyber-security and spying dispute with the United States by asking banks in that country to remove IBM servers and replace them with systems built by Chinese companies.

Citing four unnamed people familiar with the Chinese government's review on the matter, Bloomberg is reporting that government officials from such agencies as the People's Bank of China and Ministry of Finance are urging banks to make the switch away from IBM systems in favor of local brands.

The recommendation is the latest move by China in a high-stakes back-and-forth between the country and the United States over the issues of cyber-spying and national security that has been going on for several years, with the latest revelations from former National Security Agency (NSA) analyst Edward Snowden and the United States' indictment this month of five Chinese military officers for allegedly hacking into the systems of U.S. companies accelerating the dispute.

According to reports, the Chinese government's review on how dependent the banks are on IBM systems has not been made public, but that the results of the review will be sent to a working group on Internet security led by President Xi Jinping. For their part, IBM officials have said they have yet to hear about any efforts by the Chinese government to ban Big Blue servers.

"IBM is not aware of any Chinese government policy recommending against the use of IBM servers within the country’s banking industry," IBM spokesman Jeff Cross told Bloomberg. "In fact, news reports now state that China’s National Development and Reform Commission has not heard of any alleged directive to that effect. IBM is a trusted partner in China and has been for more than 30 years."

The Chinese government's latest efforts come as IBM continues the process of selling its commodity x86 server business to Lenovo, a Chinese company. The $2.3 billion deal reportedly is getting close scrutiny from the U.S. government.

It also follows China's banning this month of Windows 8 from government PCs.
U.S. lawmakers for several years have pointed to China as a source of cyber-attacks, and have questioned whether the close relationship major Chinese tech vendors like Huawei and ZTE have with their government poses a security threat to the United States. A congressional report in 2012 expressed such concerns and urged U.S. telecommunications companies to avoid buying networking gear from those two companies for fear that they could include backdoors that would give the Chinese government access to U.S. networks and sensitive data, and could become a launching pad for cyber-attacks.

Both vendors and Chinese officials disputed the report, but such suspicions have made it increasingly difficult for Huawei to sell its networking gear in the United States although the company is continuing to try to expand the reach of its U.S. enterprise solutions business. Earlier this year, Huawei officials noted that the European market is more open to its technology, and that in 2013, the company had increased its investments in the region, spending $3.4 billion buying components and services from Europe.

The leaks from Snowden over NSA spying—both domestically and internationally—have given China more of an upper hand, particularly with recent reports that the NSA was intercepting shipments of IT equipment from such U.S. vendors as Cisco Systems to install surveillance technology. The allegations follow a report by German magazine Der Spiegel in January that the NSA had compromised computing systems from U.S. vendors to aid in its spying activities.

The Chinese government responded earlier this month by saying it will take a look at tech companies with operations in the country, which is one of the largest and fastest-growing tech markets in the world. According to the Financial Times, China also ordered that all state-owned companies stop doing business with U.S. consulting firms.
China's actions and its dispute with the United States already are taking a toll on U.S. tech companies. Cisco officials May 14 said the giant networking vendor is seeing continued softness in emerging markets—including China—with sales in the first three months of the year falling off 13 percent over the same period in 2013.

Cisco CEO John Chambers wrote President Obama May 18 asking that the administration rein in the NSA's spying programs, saying it is damaging global confidence in the industry and hampering vendors' ability to sell their products.
"We simply cannot operate this way," Chambers wrote. "Our customers trust us to be able to deliver to their doorstops products that meet the highest standards of integrity and security."

The United States on May 19 indicted five Chinese officers for allegedly hacking into the systems of U.S. companies, allegations that Chinese government officials accused the United States of making up.



source

SEO PowerSuite is the sole one-stop software solution for your whole website optimization campaign. Made up of 4 powerful tools, each dealing with its specific SEO tasks, this most complete set of SEO software covers all basic and adjoin jobs you may ever have to deal with, while pushing your website to search engines' tops.

Download SEO Powersuite 2014 from official page: http://seopowersuite.com

Install your program and follow next steps:

1. Go to 'control panel' -> 'windows firewall'


2. Click 'advanced settings' on the left.


3. Right click 'outbound rules', and click 'new rule'.


4. Select 'custom', click next.


5. On the program step, leave 'all programs' selected, click next.


6. On the protocol and ports step, click next.


7. On the scope step, under the remote ip addresses click the 'these ip addresses' radio, and click the add button.


8. Add the ip address: '208.115.108.42', and click okay.


9. On the action tab, click 'block the connection', and click next.


10. On the profile tab, click next.


11. On the name tab, give it a name and click finish.

Licenses: link assistant
aniket93
LA-98104557165202a5




rank tracker
aniket93
RT-9864164364353745




website auditor
aniket93
WA-98061647350641f2




seo spyglass
aniket93
SSG-9870516003170138




buzz bundle
aniket93
BZ-983474254311545e

Apache Tomcat has a relatively low number of vulnerabilities compared to other web technologies, but to maintain a stable and secure environment you must pay attention to every application server and servlet container, including Tomcat. Here are some tips and tricks to help you improve the security of your organization's Tomcat deployment.

Secure Tomcat installation
Tomcat's installation is simple and straightforward – you just need to extract the installation package, and the only prerequisite is to have Java (JRE or JDK) installed. However, you should be aware of a few important security points for the installation.

First, ensure that you always have the latest Java version. Even if you are using an older Java branch, you should make sure that you use its corresponding latest version. Many developers prefer to use Oracle's proprietary JDK for compatibility reasons, even though it is not supported by any distribution's repository. If you do that you have to check for updates and download and install them manually. Alternatively, OpenJDK is included in most Linux distributions repositories, including CentOS, which makes it easier and faster to update Java through package managers such as yum.

Second, ensure that Tomcat runs under its own unprivileged user. You can create a suitable user with a command like groupadd tomcat && useradd -s /sbin/nologin -g tomcat tomcat. Not only is this user is unprivileged but it is also not allowed to log in to the system, so its password cannot be compromised, nor can the account do much harm on your system unless a hacker finds a vulnerability that escalates its privileges. To start Tomcat with this user you can use the command /bin/su -s /bin/sh tomcat $CATALINA_HOME/startup.sh, where $CATALINA_HOME is the path to Tomcat's startup script.

One peculiarity about having Tomcat running with an unprivileged user is that Tomcat will not be able to bind to the standard HTTP port, port 80, because ports below the first 1024 ports are reserved for privileged users. That's why by default Tomcat is configured to listen on TCP port 8080. You can easily redirect requests from port 80 to port 8080 with iptables or your firewall or router, but it's better to place a web server such as Apache in front to proxy requests. Integrating Tomcat and Apache not only allows you to serve traffic on the standard HTTP port but also adds another layer of security.

Secure Tomcat configuration
Once you have Tomcat installed, the first thing you should do is remove its default web applications, which are not needed in a production environment. You can safely delete all contents inside the directory webapps in Tomcat's root, including the hostmanager, test applications, and documentation, because they could pose a security risk and disclose information about your setup.

The next thing to consider is connectivity from outside. In an ideal world your firewall should not allow any direct connection to Tomcat. Access from outside should be possible only through a reverse proxy. If you cannot limit external access then you should leave open only the connector you need. By default connectors are defined for ports 8080 (HTTP) and 8009 (AJP). You should comment out the one you don't need in the server.xml configuration file in Tomcat's conf directory.

While you're tweaking the connector settings, adjust the connectionTimeout value, which defines how long Tomcat waits for the URI line to be presented after accepting a connection. The default value is 20000 miliseconds, or 20 seconds. If you run Tomcat behind a proxy this value is fine, but if you allow external access to the HTTP connector you should consider the threat this number could pose by allowing an attacker to open a large number of connections which are to be closed only after 20 seconds. Even if you are not able to decrease the timeout because of slow connectivity concerns or other reasons, you should note this option and consider decreasing it in times of problems and overloads.

The last important option to change for the connector is the server value. By default, Tomcat shows Server Apache-Coyote/1.1 in the HTTP headers. This information could be used by an attacker, so instead specify server="IIS" in the connector settings to make your Tomcat pretend it's an ISS server, at least in the HTTP headers.

You should also remove jsessionid from URLs. The value of jsessionid in a URL is meant to provide session support for browsers that do not support cookies. However, an attacker can create a link with a specific jsessionid and send it to a potential victim. If the victim logs in the site with this jsessionid, then the attacker is also logged in. To avoid this kind of threat, edit the web.xml file inside Tomcat's conf directory and ensure that only cookies are supported for session tracking by specifying:


    COOKIE


Encryption and SSL
Enabling encryption can also help with security. By enabling SSL encryption in Tomcat connectors you can secure the traffic either between end users and Tomcat or between a reverse web proxy and Tomcat. For internal use (for example between Tomcat and a reverse proxy) you can use a free self-signed certificate with the command keytool -genkey -alias tomcat -keyalg RSA -validity 1826 -keysize 2048 -keystore tomcat.jks. This creates a new self-signed certificate under the alias tomcat in a new keystore called tomcat.jks. This new certficate will be valid for five years (1826 days) and uses a strong private key (2048 bit) for encryption.

To install and configure your new certificate in Tomcat, edit server.xml and create a connector similar to this one:


    protocol="HTTP/1.1"
    port="8888" scheme="https" secure="true" SSLEnabled="true"
    keystoreFile="/srv/tomcat/conf/tomcat.jks" keystorePass="changeit"
    clientAuth="false" sslProtocol="TLS"/>

Then configure your reverse proxy to use this Tomcat connector by pointing it to port 8888 of your Tomcat server's IP address, as with the commands ProxyPass / https://tomcat_ip:8888/ and ProxyPassReverse / https://tomcat_ip:8888/ in Apache's configuration file (/etc/httpd/conf/httpd.conf in CentOS). If you're using Apache, don't forget to add SSLProxyEngine On to its configuration in the same file when changing from an HTTP to HTTPS back-end server to enable SSL support in the proxy functionality.

Once you restart Tomcat, traffic between your reverse proxy and Tomcat will be encrypted. This server-to-server encryption is especially important if you have your reverse proxy and Tomcat running on different servers, as is recommended by many best practices and security standards, such as the PCI SSC Data Security Standards.

The foregoing are the most important steps you can take to help run Tomcat securely. All it takes is a little bit of work and a few minor reconfigurations.



source