Archive for October, 2009

Google says Seo and Seo is. (Search Engine Optimization)

Saturday, October 24th, 2009

Google says Seo and Seo is.
Recently Google Services has released an interesting presentation about Search Engine Optimization (SEO), the process of improving the volume or quality of traffic to a web site from search engines, explaining a lot of criteria followed by Google algorithm to index sites.
This presentation’s very interesting and provides useful tips and information about indexing techniques used by the first search engine in the world. You can find the presentation here, provided by Google’s Service.
So, based on my experience in the seo optimization , I have summarized the arguments of the Google’s presentation in this article, have fun.

The first questions you’d ask to yourself about your website:

- Is site discoverable and does Google know your pages exist?
- Are your pages crawlable, or have you inadvertently put a big KEEP OUT sign on your virtual lawn?
- Can Google understand what your pages are about?
- Are your pages optimally showing up in search results?
- People can understand how to move on your site? (personally my most fun is not do this, using h4×0red expressions like “weird”, “meh”, but you know, I’m a bit silly)
- Is your site optimized for Google’s bot? (You have to think about this like the Lynx browser, so flash/ajax and 3.0 sucks too)

Exchange links for better indexing by Google, you use a stated page rank.
Once you’ve built a great site and you’re ready to have it indexed in Google, you’ll want to ensure that Google knows about your site’s pages. In many cases, Google may already be aware of your pages because one or more quality sites have included a relevant link to your site on theirs.  Indeed, naturally acquiring such links is a great way for Google to learn about your site’s pages. If you’d like Google to know about a brand new site of yours, however, you’re welcome to jumpstart the process by submitting your site via the AddURL link here.  No need to list all your pages; just the top level one, like www.example.com, is sufficient.

Use of XML sitemap in your site.
Whether your site is old or new, it’s highly recommend that you create an XML sitemap, which can help Google and other search engines better find and understand pages on your site.  These are especially useful for sites that feature dynamic content or a large set of new and updated pages, or have few incoming links.  You can create a general XML sitemap in minutes, as well as XML sitemaps for other types of information like video; learn more from the links listed here.  Note that this isn’t the same thing as an HTML, or user-visible sitemap.  HTML sitemaps can complement XML sitemaps, and can help people quickly discover and navigate to content deep within your site.

Use of robots.txt or noindex metatag.
For pages that you don’t want access, you can use one of two reliable methods for blocking Google and Googlebot from this content:  a “Disallow” line in your robots.txt file or a noindex meta tag on each you don’t want indexed.

Make your site accessible to ensure a good users experience.
An important way is making the appropriate content on your site accessible to users and Google. Accessible, in this context, means that both Googlebot and users, including those using screen readers or mobile devices, can navigate from page to page and, within reason, enjoy the core content throughout your site.  It’s important to make your site accessible, to ensure a good experience for your users and also to help Google understand and list more of your pages.
In striving to make your pages accessible, it’s helpful to understand what Googlebot can and cannot most effectively tackle. HTML files and other document types comprised mostly of text are pretty straightforward for Googlebot.  Music, images, and movies are harder for Googlebot to understand.  So, too, are dynamic pages,those pages with frequently changing or on-the-fly-generated content, potentially problematic. You can see your site almost as Googlebot does by viewing your site in a text browser, like Lynx, or in a different browser with images, JavaScript, and Flash turned off.
To help Google better understand the images on your site, you can also annotate your image in alt text, as shown above, and optionally in plain visible text near your image.  Your visible comment before or after the image can be whatever you like, but it’s best to stick with a concise version for the alt-text; no need, for instance, to include the word “image” or “photo,” since Googlebot already sees the image tag. Using descriptive filenames can be helpful to Google, and also for your users who may download your images.  “googlebot.jpg,” for instance, instead of “photo.jpg.” By annotating your images in these ways, you’re not only helping sight-impaired users who may be accessing your site with a screen reader, but you’re also giving Google a better understanding of the images and improving the chances of your images showing up for relevant queries in Google Image Search.
Along with images, many web designers like to integrate rich-media or interactive aspects into their site, often using technologies like Flash or AJAX.  While these can provide an engaging experience for users, Googlebot may have trouble discovering or following links on these sites.  For example, textual content is sometimes stored in Flash as images, making it difficult for Google to capture the words, much less understand the meaning of the pages. With careful planning, however, sites can include dynamic and media-rich elements while still remaining reasonably accessible to users and Googlebot.  Consider structuring your site so that these elements are “extras,” with your site’s core information and navigation rendered in plain text for Googlebot AND all users without Flash.

Find the best title and description for your site.
After you’ve ensured that your site is both findable and accessible, don’t let your great content languish with uninspired introductions.  Think of the titles and descriptions on your pages together as an advertising billboard: You have just a few words to let people know what each page is about and convince them that it’s worth a visit.   
The title tag of your page is likely to be displayed anytime Google shows your page in its search results, and it’s also what people will typically see in various places in their web browser and even on social sharing sites on the web.  Therefore, it’s important to have a concise, descriptive title for each page on your site. You can use Google’s Webmaster Tools’ “Content Analysis” feature to help you optimize your page titles and descriptions.

The Page Rank.
Yes, how to get pages into Google and how to prevent private pages from appearing in our search results, but webmasters also typically want their pages to rank higher in Google’s search results. The reality is that pages get listed in search results based upon two core principles:  Relevance and importance. A page is deemed relevant if it matches both the query and the interest of the user.  The first is rather intuitive:  if a user searches using the query “swing dancing,” for example, Google’s likely to list resources associated with swing dance venues, shoes, teachers, etc. Queries relevant to the phrase typed.  Personalization also plays a role, however, both in the aggregate and at the individual level.  Google tailor results by geography; for instance, on a search for “Banks,” it’ll show primarily Canadian banks to Canadian searchers and British banks to folks in the UK.  Search results may also be slightly customized to each individuals’ search history. But with so many web pages out there and, for many queries, millions of relevant pages, Google has to further narrow down and prioritize results, and this is done by evaluating the importance of each page.
Google’s original algorithm set that assessed the importance of web pages was dubbed PageRank. It’s now just one of over two hundred components that go into Google’s ranking of web pages; however it does still play a significant role :
- Each page’s score is based upon the quantity, and more important, the quality of pages that link to it. This means that a relevant link from, for instance, a respected online magazine will be likely worth more than a link from a friend’s guestbook.
- Attempting to buy or sell links that pass PageRank is a violation of Google’s webmaster guidelines and could end up harming your site’s presence in Google.
- The best ways to increase your pages’ PageRank are to create great content, participate thoughtfully in relevant communities online and offline, and from this garner quality links naturally.
- If you do buy or sell online advertising, you’ll want to make sure those links don’t pass PageRank by using the nofollow attribute or other means recommended in Google’s Webmaster Help Center.
As Google updates index, rankings do naturally fluctuate, sometimes a little, sometimes a lot, and for a great variety of reasons. In Google’s early days, experts updated index in large, occasional batches, playfully nicknamed “Google Dances.”  Nowadays, however, experts updated index incrementally.  Typically, this results in subtle changes, but some sites can be affected more significantly. And while Google is moving forward, the web is changing at a frantic pace as well.  The changes in site, combined with the constant content and link updates around the web, also can noticeably affect your site’s presence in Google. In some cases, however, a site can fall to a lower ranking because it was determined to violate the Webmaster Guidelines.  In such situations, you and ideally an unbiased friend or expert should carefully evaluate your site, identifying and fixing any issues.  Note that these violations may have been caused by someone who worked on the site previously, or even a hacker who crupulously added sometimes-hidden links to your pages.  Google frequently sends informational notices about webmaster violations through the Message Center in Webmaster Tools, so be sure you’ve signed up for this free service.
Of course, you should provide content designed for users, not search engines, making sure to treat search engine bots as just other users and never sending them different content.  But beyond that, it makes sense to consider how your users are likely to search for this content. Regularly verify that all your links are still pointing to relevant resources that reflect well on you and your organization.

Provide a site interaction with Google’s web and social services.
Your site could benefit from a more interactivity, be sure to explore Google services like YouTube and Picasa for videos and photos, Sketchup for engaging 3D models, Calendar for events listings, Maps and Earth for directions to your business and richly annotated tours, Blogger for the latest announcements, and so on.

Use Google Analytics to know more about your visitors.
Google Analytics provides comprehensive information on where your visitors come from, how they interact with their site, and how often they perform desired actions, such as subscribe to your newsletter or buy one of your products. While Analytics lets you reflect back on site performance, Website Optimizer helps you look forward, enabling you to test out different combinations of content on your site to find out which versions work best with your visitors.

Use Google Trends to compare keywords and Google Reader to be updated.
Use Google Trends to compare the prevalence of searches and news articles for different keywords, evaluating which product has captured more attention or which issue excites more of your potential customers. Google Reader enables you to stay on top of the latest articles without having to manually jump from site to site.  You can follow specific topics or keywords from popular news papers, insightful bloggers, even your favorite photo or video sites.

HP-UX On Tomcat Servlet Engine, Remote Denial of Service (DoS), Unauthorized Access

Saturday, October 24th, 2009

HP-UX On Tomcat Servlet Engine, Remote Denial of Service (DoS), Unauthorized Access
Potential security vulnerabilities have been identified with HP-UX running Tomcat-based Servlet Engine. The vulnerabilities could be exploited remotely to cause a Denial of Service (DoS) or unauthorized access. Tomcat-based Servlet Engine is contained in the Apache Web Server Suite.

Affected Versions:
HP-UX B.11.23, B.11.31 running Apache-based Web Server versions before v2.2.8.05
HP-UX B.11.11, B.11.23, B.11.31 running Apache-based Web Server versions before v2.0.59.12

Updates:
HP has provided the following upgrades to resolve these vulnerabilities.The upgrades are available from the following location:
http://software.hp.com

References:
Hewlett-Packard Company, HP Software Security Response Team

IE, Chrome, Safari SSL Insecurity

Saturday, October 24th, 2009

IE, Chrome, Safari SSL Insecurity
Ie,Chrome and Safari are not safe browsers to conduct money or confidential transactions, like PayPal, is more secure the Firefox alternative.

It has been published a secure sockets layer certificate that exploits a gaping hole in a Microsoft library used by all three of those browsers. Although the certificate is fraudulent, it appears to all three to be a completely legitimate credential vouching for the online payment service. The bug was disclosed more than nine weeks ago, but Microsoft has yet to fix it.
PayPal and thousands of other financial websites use the certificates to generate a digital signature that mathematically proves login pages aren’t forgeries that were set up by con artists who are sitting in between the user and the website he’s trying to view.
The certificate exploits a security hole in a Microsoft application programming interface known as the CryptoAPI, which is used by the IE, Google Chrome and Apple Safari for Windows browsers to parse a website’s SSL certificates. Even though the certificate is demonstrably forged, it can be used with a previously available hacking tool called SSLSniff to cause all three browsers to display a spoofed page with no warnings, even when its address begins with “https.”
The certificate is the latest to target a weakness that causes browsers, email clients, and other SSL-enabled apps to ignore all text following the \ and 0 characters, which are used to denote the end of a string of characters in C-based languages. Attackers can exploit that weakness by registering a normal SSL certificate for a site under their control and then inserting the domain name and the null character immediately following the name of the site they want to impersonate.

An example of this:

www.paypal.com\0ssl.secureconnection.cc

The take-away from all of this is that if you use IE, Chrome or Safari for Windows to browse SSL-protected parts of PayPal, there’s no way to know if they are genuine – at least until Microsoft gets around to fixing the bug. And because it’s entirely possible null-prefix certificates for other sites have been issued more quietly, there’s no way to rely on SSL at all for those browsers.

References:
Microsoft Security Bulletin
Black Hat Security
TheRegister Security

HP-UX On Apache-based Web Server, Remote Denial of Service (DoS) & Cross-Site Scripting (XSS) Unauthorized Access

Saturday, October 24th, 2009

Remote Denial of Service (DoS), cross-site scripting (XSS), unauthorized access

Potential security vulnerabilities have been identified with HP-UX running Apache-based Web Server. The vulnerabilities could be exploited remotely to cause a Denial of Service (DoS), cross-site scripting (XSS) or unauthorized access. Apache-based Web Server is contained in the Apache Web Server Suite.

Affected Versions:
HP-UX B.11.23, B.11.31 running Apache-based Web Server versions before v2.2.8.05
HP-UX B.11.11, B.11.23, B.11.31 running Apache-based Web Server versions before v2.0.59.12

Updates are available:
http://software.hp.com

References:
SUPPORT COMMUNICATION – SECURITY BULLETIN from HP (HP Unix)

Facebook Malicious Redirection

Saturday, October 24th, 2009

Facebook Malicious RedirectionExample of phishing and malicious data stoling on Facebook social network.

Facebook uses an open redirection for applications or games, like this :

http://apps.facebook.com/quizzname/?next=[Redirection]

It can be used for malicious hacking (PoC) :

http://apps.facebook.com/h4x/?next=http://infosec.sealckers.org/weird