Showing posts with label Cyber Threat Intelligence. Show all posts

Tuesday, 10 May 2016

Investigation Report: Email Works

How E-mail Works?

Every day, the citizens of the Internet send each other billions of e-mail messages. If you're online a lot, you yourself may send a dozen or more e-mails each day without even thinking about it. Obviously, e-mail has become an extremely popular communication tool.

Have you ever wondered how e-mail gets from your computer to a friend halfway around the world? What is a POP3 server, and how does it hold your mail? The answers may surprise you, because it turns out that e-mail is an incredibly simple system at its core. In this article, we'll take an in-depth look at e-mail and how it works.

An E-mail Message:

According to Darwin Magazine: Prime Movers, the first e-mail message was sent in 1971 by an engineer named Ray Tomlinson. Prior to this, you could only send messages to users on a single machine. Tomlinson's breakthrough was the ability to send messages to other machines on the Internet, using the @ sign to designate the receiving machine.

An e-mail message has always been nothing more than a simple text message -- a piece of text sent to a recipient. In the beginning and even today, e-mail messages tend to be short pieces of text, although the ability to add attachments now makes many messages quite long. Even with attachments, however, e-mail messages continue to be text messages -- we'll see why when we get to the section on attachments.

E-mail Clients:

You've probably already received several e-mail messages today. To look at them, you use some sort of e-mail client. Many people use well-known, stand-alone clients like Microsoft Outlook, Outlook Express, Eudora or Pegasus. People who subscribe to free e-mail services like Hotmail or Yahoo use an e-mail client that appears in a Web page. If you're an AOL customer, you use AOL's e-mail reader. No matter which type of client you're using, it generally does four things:

Shows you a list of all of the messages in your mailbox by displaying the message headers. The header shows you who sent the mail, the subject of the mail and may also show the time and date of the message and the message size.
Lets you select a message header and read the body of the e-mail message.
Let's you create new messages and send them. You type in the e-mail address of the recipient and the subject for the message, and then type the body of the message.
Lets you add attachments to messages you send and save the attachments from messages you receive.

Sophisticated e-mail clients may have all sorts of bells and whistles, but at the core, this is all that an e-mail client does.

A Simple E-mail Server:

Given that you have an e-mail client on your machine, you are ready to send and receive e-mail. All that you need is an e-mail server for the client to connect to. Let's imagine what the simplest possible e-mail server would look like in order to get a basic understanding of the process. Then we will look at the real thing.
If you've read How Web Servers Work, then you know that machines on the Internet can run software applications that act as servers. There are Web servers, FTP servers, telnet servers and e-mail servers running on millions of machines on the Internet right now. These applications run all the time on the server machine and they listen to specific ports, waiting for people or programs to attach to the port. The simplest possible e-mail server would work something like this:

It would have a list of e-mail accounts, with one account for each person who can receive e-mail on the server. My account name might be mbrain, John Smith's might be jsmith, and so on.
It would have a text file for each account in the list. So, the server would have a text file in its directory named MBRAIN.TXT, another named JSMITH.TXT, and so on.
If someone wanted to send me a message, the person would compose a text message ("Marshall, Can we have lunch Monday? John") in an e-mail client, and indicate that the message should go to mbrain. When the person presses the Send button, the e-mail client would connect to the e-mail server and pass to the server the name of the recipient (mbrain), the name of the sender (jsmith) and the body of the message.
The server would format those pieces of information and append them to the bottom of the MBRAIN.TXT file. The entry in the file might look like this:

From: jsmith To: mbrain Marshall, Can we have lunch Monday? John

There are several other pieces of information that the server might save into the file, like the time and date of receipt and a subject line; but overall, you can see that this is an extremely simple process.
We'll look at the SMTP server in the next section.

More Complex Servers:

As other people sent mail to mbrain, the server would simply append those messages to the bottom of the file in the order that they arrived. The text file would accumulate a series of five or 10 messages, and eventually I would log in to read them. When I wanted to look at my e-mail, my e-mail client would connect to the server machine. In the simplest possible system, it would:

Ask the server to send a copy of the MBRAIN.TXT file
Ask the server to erase and reset the MBRAIN.TXT file
Save the MBRAIN.TXT file on my local machine
Parse the file into the separate messages (using the word "From:" as the separator)
Show me all of the message headers in a list

When I double-clicked on a message header, it would find that message in the text file and show me its body.
As you can see, this is a very simple system. Surprisingly, the real e-mail system that you use every day isn't much more complicated than this.

The Real E-mail System:

For the vast majority of people right now, the real e-mail system consists of two different servers running on a server machine. One is called the SMTP server, where SMTP stands for Simple Mail Transfer Protocol. The SMTP server handles outgoing mail. The other is either a POP3 server or an IMAP server, both of which handle incoming mail. POP stands for Post Office Protocol, and IMAP stands for Internet Mail Access Protocol. A typical e-mail server looks like this:

The SMTP server listens on well-known port number 25, POP3 listens on port 110 and IMAP uses port 143 (see How Web Servers Work for details on ports).

The SMTP Server:

Whenever you send a piece of e-mail, your e-mail client interacts with the SMTP server to handle the sending. The SMTP server on your host may have conversations with other SMTP servers to deliver the e-mail.

Let's assume that I want to send a piece of e-mail. My e-mail ID is brain, and I have my account on howstuffworks.com. I want to send e-mail to jsmith@mindspring.com. I am using a stand-alone e-mail client like Outlook Express.

When I set up my account at howstuffworks, I told Outlook Express the name of the mail server -- mail.howstuffworks.com. When I compose a message and press the Send button, here's what happens:

Outlook Express connects to the SMTP server at mail.howstuffworks.com using port 25.
Outlook Express has a conversation with the SMTP server, telling the SMTP server the address of the sender and the address of the recipient, as well as the body of the message.
The SMTP server takes the "to" address (jsmith@mindspring.com) and breaks it into two parts: the recipient name (jsmith) and the domain name (mindspring.com). If the "to" address had been another user at howstuffworks.com, the SMTP server would simply hand the message to the POP3 server for howstuffworks.com (using a little program called the delivery agent). Since the recipient is at another domain, SMTP needs to communicate with that domain.
The SMTP server has a conversation with a Domain Name Server, or DNS (see How Web Servers Work for details). It says, "Can you give me the IP address of the SMTP server for mindspring.com?" The DNS replies with the one or more IP addresses for the SMTP server(s) that Mindspring operates.
The SMTP server at howstuffworks.com connects with the SMTP server at Mindspring using port 25. It has the same simple text conversation that my e-mail client had with the SMTP server for HowStuffWorks, and gives the message to the Mindspring server. The Mindspring server recognizes that the domain name for jsmith is at Mindspring, so it hands the message to Mindspring's POP3 server, which puts the message in jsmith's mailbox.

If, for some reason, the SMTP server at HowWorks cannot connect with the SMTP server at Mindspring, then the message goes into a queue. The SMTP server on most machines uses a program called sendmail to do the actual sending, so this queue is called the sendmail queue. Sendmail will periodically try to resend the messages in its queue. For example, it might retry every 15 minutes. After four hours, it will usually send you a piece of mail that tells you there is some sort of problem. After five days, most sendmail configurations give up and return the mail to you undelivered.

The SMTP server understands very simple text commands like HELO, MAIL, RCPT and DATA. The most common commands are:

HELO - introduce yourself
EHLO - introduce yourself and request extended mode
MAIL FROM: - specify the sender
RCPT TO: - specify the recipient
DATA - specify the body of the message (To, From and Subject should be the first three lines.)
RSET - reset
QUIT - quit the session
HELP - get help on commands
VRFY - verify an address
EXPN - expand an address
VERB - verbose

The POP3 and IMAP Servers:

In the simplest implementations of POP3, the server really does maintain a collection of text files -- one for each e-mail account. When a message arrives, the POP3 server simply appends it to the bottom of the recipient's file.

When you check your e-mail, your e-mail client connects to the POP3 server using port 110. The POP3 server requires an account name and a password. Once you've logged in, the POP3 server opens your text file and allows you to access it. Like the SMTP server, the POP3 server understands a very simple set of text commands. Here are the most common commands:

USER - enter your user ID
PASS - enter your password
QUIT - quit the POP3 server
LIST - list the messages and their size
RETR - retrieve a message, pass it a message number
DELE - delete a message, pass it a message number
TOP - show the top x lines of a message, pass it a message number and the number of lines

Your e-mail client connects to the POP3 server and issues a series of commands to bring copies of your e-mail messages to your local machine. Generally, it will then delete the messages from the server (unless you've told the e-mail client not to).

You can see that the POP3 server simply acts as an interface between the e-mail client and the text file containing your messages. And again, you can see that the POP3 server is extremely simple. You can connect to it through telnet at port 110 and issue the commands yourself if you would like to (see How Web Servers Work for details on telnetting to servers).

The IMAP Server:

As you can see, the POP3 protocol is very simple. It allows you to have a collection of messages stored in a text file on the server. Your e-mail client (e.g. Outlook Express) can connect to your POP3 e-mail server and download the messages from the POP3 text file onto your PC. That is about all that you can do with POP3.
Many users want to do far more than that with their e-mail, and they want their e-mail to remain on the server. The main reason for keeping your e-mail on the server is to allow users to connect from a variety of machines. With POP3, once you download your e-mail it's stuck on the machine to which you downloaded it. If you want to read your e-mail both on your desktop machine and your laptop (depending on whether you're working in the office or on the road), POP3 makes life difficult.

IMAP (Internet Mail Access Protocol) is a more advanced protocol that solves these problems. With IMAP, your mail stays on the e-mail server. You can organize your mail into folders, and all the folders live on the server as well. When you search your e-mail, the search occurs on the server machine, rather than on your machine. This approach makes it extremely easy for you to access your e-mail from any machine, and regardless of which machine you use, you have access to all of your mail in all of your folders.
We'll look at IMAP problems and attachments in the next section.

IMAP Problems and Attachments:

Your e-mail client connects to the IMAP server using port 143. The e-mail client then issues a set of text commands that allow it to do things like list all the folders on the server, list all the message headers in a folder, get a specific e-mail message from the server, delete messages on the server or search through all of the e-mails on the server.

One problem that can arise with IMAP involves this simple question: "If all of my e-mail is stored on the server, then how can I read my mail if I'm not connected to the Internet?" To solve this problem, most e-mail clients have some way to cache e-mail on their local machine. For example, the client will download all the messages and store their complete contents on the local machine (just like it would if it were talking to a POP3 server). The messages still exist on the IMAP server, but you now have copies on your machine. This allows you to read and reply to e-mail even if you have no connection to the Internet. The next time you establish a connection, you download all the new messages you received while disconnected and send all the mail that you wrote while disconnected.

Attachments:

Your e-mail client allows you to add attachments to e-mail messages you send, and also lets you save attachments from messages that you receive. Attachments might include word processing documents, spreadsheets, sound files, snapshots and pieces of software. Usually, an attachment is not text (if it were, you would simply include it in the body of the message). Since e-mail messages can contain only text information, and attachments aren't text, there's a problem that needs to be solved.

In the early days of e-mail, you solved this problem by hand, using a program called uuencode. The uuencode program assumes that the file contains binary information. It extracts 3 bytes from the binary file and converts them to four text characters (that is, it takes 6 bits at a time, adds 32 to the value of the 6 bits and creates a text character -- see How Bits and Bytes Work to learn more about ASCII characters). What uuencode produces, therefore, is an encoded version of the original binary file that contains only text characters. In the early days of e-mail, you would run uuencode yourself and paste the uuencoded file into your e-mail message.

Considering its tremendous impact on society, having forever changed the way we communicate, today's e-mail system is one of the simplest things ever devised! There are parts of the system, like the routing rules in sendmail, that get complicated, but the basic system is incredibly straightforward. The next time you send an e-mail, you'll know exactly how it's getting to its destination.

Check out the next page for simple etiquette rules about writing and sending e-mail messages.

Free and Paid E-mail Services

Whether it's for work or keeping in touch with family and friends, people rely on the Internet to send and receive e-mail messages. According to a March 2007 study by the Pew Internet and American Life Project, 91 percent of U.S. Internet users have gone online to send or read e-mail. The same source reports that 56 percent of e-mail users send or read e-mail as part of a typical day [source: Email Marketing Reports].
An October 2007 study by the market research firm, The Radicati Group, reported that 183 billion e-mails were sent daily in 2006. With numbers like that, it's no surprise that there's a large variety of e-mail service providers to choose from. Choices include providers like Gmail or Yahoo! who provide free e-mail service or providers who charge a fee like America Online, Apple or NetZero.

Gmail and Yahoo! make money from advertisers who pay them to expose e-mail account holders to their messages. It's also easy to find reviews of various free e-mail services. Here are few descriptions of free e-mail services:

Gmail -- Gmail is Google's free e-mail service. It offers online storage that's practically unlimited. It also provides sorting methods that allows users to quickly organize and sift their inbox efficiently for important messages. As a free service, Gmail exposes users to contextual advertisements, which are based on keywords found in the user's e-mail messages. It's versatile in handling many different attachment types and scans for spam, worms and virus.
Yahoo! mail -- Perhaps one of the most popular free services, Yahoo! offers unlimited online storage as well as text messaging and RSS news feeds. Using more than a dozen filters, Yahoo! files incoming e-mails and automatically sends junk e-mails to a spam folder and allows you to add e-mails to that folder. It features easy-to-use drag and drop organization tools.
MSN Windows Hotmail -- Another well-used free service, Hotmail is supported by Microsoft technology and features 5 GB of online storage space. A versatile desktop design allows users to customize the color and layout of their mail manager. It also offers users the choice of working a classic, familiar format and switching to an updated look with added features when they choose. Microsoft security features coupled with familiar drag-and-drop organization tools add further comfort-of-use for many e-mail users.

E-mail providers who charge a fee may offer additional services such as increased storage space. Sample providers include Juno, EarthLink and Webmail.us.

For example, it's easier to get personalized e-mail addresses -- perhaps incorporating your actual name, for instance - using a paid service. Paid e-mail services often allow users to keep their same e-mail address even if they change their ISP and screen users from advertisers. They often are easier to reach on support issues and special features such as custom spam filters, additional e-mail accounts and mobile access.

Most ISP Internet providers can also serve as an e-mail provider for no additional charge. Other paid e-mail services specialize in small business accounts and can assist businesses in purchasing and maintaining a domain name.

On the next page, we'll offer some etiquette tips for when you write and send e-mail messages.

E-Mail Etiquette:

Most people wouldn't think of being rude or obnoxious when they speak to colleagues, clients or their supervisor. But those rules can fall by the wayside when we use e-mail.

The opportunities for rudeness when using e-mail are plentiful and not always easy to recognize. Most people wouldn't use foul language or derogatory terms in business communication. But what about raising one's voice? Is that possible when using e-mail?

Here, we'll discuss some business writing rules and tips for practicing e-mail etiquette.
People are busy, so:

Use the subject line. You might be tempted to bypass this part of the e-mail, but just remember: everyone is in a hurry, including the recipient of your e-mail. That person will appreciate the clue the subject line provides as to the message content. It helps them prioritize and organize.
Be brief and concise. No matter how clever and entertaining a writer you might be, your message recipients will appreciate brevity and clarity. Save the puns and witty turns of phrase for after birthday cards and toasts. State the message quickly followed by clear requests or instructions for any action needed by the recipient.
Keep it personal. Routinely copying others on e-mails clogs mailboxes and can lead to the main recipient wondering why you're doing so. Unless you have a specific reason for copying someone, keep the conversation between sender and recipient.
Reply quickly. Don't let e-mails sit around in your queue unanswered. Get back to the sender, even if it's to say you need more time to respond.

People are sensitive, so:

Don't over-punctuate. Adding multiple punctuation marks, such as ???? or !!!! after a sentence makes it seem as though you are shouting or frustrated with the recipient. Use normal punctuation rules.
Don't use all capitals. Using all caps MAKES IT SEEM LIKE YOU'RE SHOUTING. Shouting is rude. Use normal capitalization rules. If you need to emphasize something, write "I'd like to emphasize…"
Read it, out loud, before you send it. While you may think you're writing exactly what you mean, it pays to read some e-mails out loud to yourself, putting yourself in the recipient's shoes, before hitting that "send" button. Once it's in writing, it's hard to take back. Also, never forget that the recipient has both a printer and "forward" button. Never write something you wouldn't want to have circulated throughout the company or even beyond.
Don't write when you're angry. Perhaps one of the most common etiquette rules to break is firing off an e-mail to someone when you're angry, either at them or a situation. See "Read it out loud" above. You can't take it back once you "flame" someone, and it can come back to haunt you.

Not everyone is as hip as you are, so:

Keep the symbols to a minimum. Using "smiles" is a trendy way to communicate mood and meaning. But do you know the difference between a sarcastic smile and a mischievous one? And even if you're sure you do, can you be sure your recipient does? It's easy to see the potential to unintentionally offend someone using these symbols. Avoid using them.
Minimize abbreviated phrases. Using abbreviations such as IMHO (in my humble opinion). FWIW (for what it's worth) and ROTFL (rolling on the floor laughing) can frustrate and confuse the recipient.

E-mail is like as a business letter. Ignoring basic rules can show disrespect for the recipient. Don't let informality spoil the recipient's opinion of you.

Investigation Report: How Firewalls Works?

How Firewalls Work?

If you have been using the Internet for any length of time, and especially if you work at a larger company and browse the Web while you are at work, you have probably heard the term firewall used. For example, you often hear people in companies say things like, "I can't use that site because they won't let it through the firewall."

If you have a fast Internet connection into your home (either a DSL connection or a cable modem), you may have found yourself hearing about firewalls for your home network as well. It turns out that a small home network has many of the same security issues that a large corporate network does. You can use a firewall to protect your home network and family from offensive Web sites and potential hackers.
Basically, a firewall is a barrier to keep destructive forces away from your property. In fact, that's why its called a firewall. Its job is similar to a physical firewall that keeps a fire from spreading from one area to the next. As you read through this article, you will learn more about firewalls, how they work and what kinds of threats they can protect you from.

What Firewall Software Does?

A firewall is simply a program or hardware device that filters the information coming through the Internet connection into your private network or computer system. If an incoming packet of information is flagged by the filters, it is not allowed through.

If you have read the article How Web Servers Work, then you know a good bit about how data moves on the Internet, and you can easily see how a firewall helps protect computers inside a large company. Let's say that you work at a company with 500 employees. The company will therefore have hundreds of computers that all have network cards connecting them together. In addition, the company will have one or more connections to the Internet through something like T1 or T3 lines. Without a firewall in place, all of those hundreds of computers are directly accessible to anyone on the Internet. A person who knows what he or she is doing can probe those computers, try to make FTP connections to them, try to make telnet connections to them and so on. If one employee makes a mistake and leaves a security hole, hackers can get to the machine and exploit the hole.

With a firewall in place, the landscape is much different. A company will place a firewall at every connection to the Internet (for example, at every T1 line coming into the company). The firewall can implement security rules. For example, one of the security rules inside the company might be:

Out of the 500 computers inside this company, only one of them is permitted to receive public FTP traffic. Allow FTP connections only to that one computer and prevent them on all others.

A company can set up rules like this for FTP servers, Web servers, Telnet servers and so on. In addition, the company can control how employees connect to Web sites, whether files are allowed to leave the company over the network and so on. A firewall gives a company tremendous control over how people use the network.

Firewalls use one or more of three methods to control traffic flowing in and out of the network:

Packet filtering - Packets (small chunks of data) are analyzed against a set of filters. Packets that make it through the filters are sent to the requesting system and all others are discarded.
Proxy service - Information from the Internet is retrieved by the firewall and then sent to the requesting system and vice versa.
Stateful inspection - A newer method that doesn't examine the contents of each packet but instead compares certain key parts of the packet to a database of trusted information. Information traveling from inside the firewall to the outside is monitored for specific defining characteristics, then incoming information is compared to these characteristics. If the comparison yields a reasonable match, the information is allowed through. Otherwise it is discarded.

Firewall Configuration

Firewalls are customizable. This means that you can add or remove filters based on several conditions. Some of these are:

IP addresses - Each machine on the Internet is assigned a unique address called an IP address. IP addresses are 32-bit numbers, normally expressed as four "octets" in a "dotted decimal number." A typical IP address looks like this: 216.27.61.137. For example, if a certain IP address outside the company is reading too many files from a server, the firewall can block all traffic to or from that IP address.
Domain names - Because it is hard to remember the string of numbers that make up an IP address, and because IP addresses sometimes need to change, all servers on the Internet also have human-readable names, called domain names. For example, it is easier for most of us to remember www.howstuffworks.com than it is to remember 216.27.61.137. A company might block all access to certain domain names, or allow access only to specific domain names. Protocols - The protocol is the pre-defined way that someone who wants to use a service talks with that service. The "someone" could be a person, but more often it is a computer program like a Web browser. Protocols are often text, and simply describe how the client and server will have their conversation. The http in the Web's protocol. Some common protocols that you can set firewall filters for include:

IP (Internet Protocol) - the main delivery system for information over the Internet
TCP (Transmission Control Protocol) - used to break apart and rebuild information that travels over the Internet
HTTP (Hyper Text Transfer Protocol) - used for Web pages
FTP (File Transfer Protocol) - used to download and upload files
UDP (User Datagram Protocol) - used for information that requires no response, such as streaming audio and video
ICMP (Internet Control Message Protocol) - used by a router to exchange the information with other routers
SMTP (Simple Mail Transport Protocol) - used to send text-based information (e-mail)
SNMP (Simple Network Management Protocol) - used to collect system information from a remote computer
Telnet - used to perform commands on a remote computer

A company might set up only one or two machines to handle a specific protocol and ban that protocol on all other machines.

Ports - Any server machine makes its services available to the Internet using numbered ports, one for each service that is available on the server (see How Web Servers Work for details). For example, if a server machine is running a Web (HTTP) server and an FTP server, the Web server would typically be available on port 80, and the FTP server would be available on port 21. A company might block port 21 access on all machines but one inside the company.

Specific words and phrases - This can be anything. The firewall will sniff (search through) each packet of information for an exact match of the text listed in the filter. For example, you could instruct the firewall to block any packet with the word "X-rated" in it. The key here is that it has to be an exact match. The "X-rated" filter would not catch "X rated" (no hyphen). But you can include as many words, phrases and variations of them as you need.

Some operating systems come with a firewall built in. Otherwise, a software firewall can be installed on the computer in your home that has an Internet connection. This computer is considered a gateway because it provides the only point of access between your home network and the Internet.

With a hardware firewall, the firewall unit itself is normally the gateway. A good example is the Linksys Cable/DSL router. It has a built-in Ethernet card and hub. Computers in your home network connect to the router, which in turn is connected to either a cable or DSL modem. You configure the router via a Web-based interface that you reach through the browser on your computer. You can then set any filters or additional information.

Hardware firewalls are incredibly secure and not very expensive. Home versions that include a router, firewall and Ethernet hub for broadband connections can be found for well under $100.

Why Firewall Security?

There are many creative ways that unscrupulous people use to access or abuse unprotected computers:

Remote login - When someone is able to connect to your computer and control it in some form. This can range from being able to view or access your files to actually running programs on your computer.
Application backdoors - Some programs have special features that allow for remote access. Others contain bugs that provide a backdoor, or hidden access, that provides some level of control of the program.
SMTP session hijacking - SMTP is the most common method of sending e-mail over the Internet. By gaining access to a list of e-mail addresses, a person can send unsolicited junk e-mail (spam) to thousands of users. This is done quite often by redirecting the e-mail through the SMTP server of an unsuspecting host, making the actual sender of the spam difficult to trace.
Operating system bugs - Like applications, some operating systems have backdoors. Others provide remote access with insufficient security controls or have bugs that an experienced hacker can take advantage of.
Denial of service - You have probably heard this phrase used in news reports on the attacks on major Web sites. This type of attack is nearly impossible to counter. What happens is that the hacker sends a request to the server to connect to it. When the server responds with an acknowledgement and tries to establish a session, it cannot find the system that made the request. By inundating a server with these unanswerable session requests, a hacker causes the server to slow to a crawl or eventually crash.
E-mail bombs - An e-mail bomb is usually a personal attack. Someone sends you the same e-mail hundreds or thousands of times until your e-mail system cannot accept any more messages.
Macros - To simplify complicated procedures, many applications allow you to create a script of commands that the application can run. This script is known as a macro. Hackers have taken advantage of this to create their own macros that, depending on the application, can destroy your data or crash your computer.
Viruses - Probably the most well-known threat is computer viruses. A virus is a small program that can copy itself to other computers. This way it can spread quickly from one system to the next. Viruses range from harmless messages to erasing all of your data.
Spam - Typically harmless but always annoying, spam is the electronic equivalent of junk mail. Spam can be dangerous though. Quite often it contains links to Web sites. Be careful of clicking on these because you may accidentally accept a cookie that provides a backdoor to your computer.
Redirect bombs - Hackers can use ICMP to change (redirect) the path information takes by sending it to a different router. This is one of the ways that a denial of service attack is set up.
Source routing - In most cases, the path a packet travels over the Internet (or any other network) is determined by the routers along that path. But the source providing the packet can arbitrarily specify the route that the packet should travel. Hackers sometimes take advantage of this to make information appear to come from a trusted source or even from inside the network! Most firewall products disable source routing by default.

Some of the items in the list above are hard, if not impossible, to filter using a firewall. While some firewalls offer virus protection, it is worth the investment to install anti-virus software on each computer. And, even though it is annoying, some spam is going to get through your firewall as long as you accept e-mail.
The level of security you establish will determine how many of these threats can be stopped by your firewall. The highest level of security would be to simply block everything. Obviously that defeats the purpose of having an Internet connection. But a common rule of thumb is to block everything, then begin to select what types of traffic you will allow. You can also restrict traffic that travels through the firewall so that only certain types of information, such as e-mail, can get through. This is a good rule for businesses that have an experienced network administrator that understands what the needs are and knows exactly what traffic to allow through. For most of us, it is probably better to work with the defaults provided by the firewall developer unless there is a specific reason to change it.

One of the best things about a firewall from a security standpoint is that it stops anyone on the outside from logging onto a computer in your private network. While this is a big deal for businesses, most home networks will probably not be threatened in this manner. Still, putting a firewall in place provides some peace of mind.

Proxy Servers and DMZ:

A function that is often combined with a firewall is a proxy server. The proxy server is used to access Web pages by the other computers. When another computer requests a Web page, it is retrieved by the proxy server and then sent to the requesting computer. The net effect of this action is that the remote computer hosting the Web page never comes into direct contact with anything on your home network, other than the proxy server.

Proxy servers can also make your Internet access work more efficiently. If you access a page on a Web site, it is cached (stored) on the proxy server. This means that the next time you go back to that page, it normally doesn't have to load again from the Web site. Instead it loads instantaneously from the proxy server.
There are times that you may want remote users to have access to items on your network. Some examples are:

Web site
Online business
FTP download and upload area

In cases like this, you may want to create a DMZ (Demilitarized Zone). Although this sounds pretty serious, it really is just an area that is outside the firewall. Think of DMZ as the front yard of your house. It belongs to you and you may put some things there, but you would put anything valuable inside the house where it can be properly secured.

Setting up a DMZ is very easy. If you have multiple computers, you can choose to simply place one of the computers between the Internet connection and the firewall. Most of the software firewalls available will allow you to designate a directory on the gateway computer as a DMZ.

Once you have a firewall in place, you should test it. A great way to do this is to go to www.grc.com and try their free Shields Up! security test. You will get immediate feedback on just how secure your system is!

Investigation Report: Secure Your Home Network

How to Secure Your Home Network?

We've been treated to some pretty entertaining feats of espionage courtesy of Hollywood. Who can forget the way Tom Cruise dangled from the ceiling as he attempted to crack into a computer security system in "Mission Impossible?" Or how about the mysterious hacker who seems to slip past every security to corrupt the Rossum Corporation's data in the "Dollhouse" television series? Hacking into a network must require superhuman skills and knowledge, right?

You might be surprised to learn how easy it is for someone to hack into a computer network. The fact is that many computer networks are practically defenseless to intruders. In the early days of home computer networks, the people who put the networks together were experts and enthusiasts. They put their systems together knowing how computers can communicate with each other and built in protective measures to prevent other computer users from snooping.

Today, home computer networks are popular among a broad range of consumers. User knowledge spans from expert to newbie. Some users may be unaware of the dangers they can encounter if they don't properly secure their network. Others may think home network security is too complicated or confusing. But network security is more important than ever and it's worth the effort to learn more about it.

An unprotected network could allow malicious hackers -- known as crackers -- access to your data. It might even allow someone to take control of your computers and use them to commit crimes like a distributed denial of service attack (DDoS). Even if no one snoops on your information or controls your computer, someone might use your network to access the Internet. As more ISPs begin to place caps on how much data you can download, it becomes even more important to control your network. You don't want to get slapped with a huge bill for Internet services you didn't even use.

With the right tools and knowledge, you can minimize your chances of having your security compromised by malicious hackers or computer viruses. Let's get started.

Network Security Hardware:

When we talk about home networks, we generally mean a system composed of at least two devices connected to each other. Usually, these devices also connect to the Internet. Technically, if you have only one device connected to the Internet, it's part of a larger network. But you wouldn't have a network of your own.
Computers running on the Windows operating system are more at risk of security invasions than Mac computers. That's to be expected -- the Windows operating system dominates the computer market. That means the Windows platform is a big target for people who want to exploit computers -- they've got a much larger target and potential payoff.

Other devices that can comprise a home network include routers, firewalls, cable or DSL modems, printers, video game consoles, smartphones and voice over Internet protocol (VoIP) phones. Depending upon the protocols you use, you may have even more devices linked to your network. For example, Bluetooth gadgets can sync with each other when they come within range of the network.

From a security standpoint, the pieces of hardware that will help provide security are firewalls and routers. Firewalls come in two varieties: hardware and software. You can purchase a physical firewall device or run a firewall application. Many routers have firewall software built into them.

Firewalls act like filters. They help you monitor data traffic between your network and the Internet. If you detect unusual traffic, that's a potential sign that someone has compromised your home network's security. Most firewalls have several security settings to choose from. The most restrictive settings are generally the safest, but they also limit your options. Most firewalls will allow you to create a list of Web addresses that are off limits.

If you use a wireless router, you should make sure you set a password and enable encryption. Unprotected wireless networks are a bad idea. Most routers have either Wireless Encryption (WEP) or Wi-Fi Protected Access (WPA) encryption options. Some have both. WPA is more secure than WEP. Enabling encryption and choosing a strong router administrator password are two steps that will help keep your network secure.

Network Security Software

On the software side of the security issue are several important applications. As we mentioned earlier, firewalls come in both hardware and software varieties. If you don't have a hardware firewall, you can use a firewall application to help protect your network. You can even use both a hardware and software version if you like.

There are several firewall programs available on the market. Some of them are free. Many are part of a larger software package that includes other important applications.

Almost as important as a firewall is anti-virus software. While you may be able to avoid most computer viruses, Trojans and other forms of malware through careful Web surfing habits, the truth is sometimes things slip through. All it takes is one mistake and you'll end up with an infected computer. A robust anti-virus program can help keep your computer safe.

Anti-virus software isolates and neutralizes malware. Most anti-virus software searches for viruses by comparing the applications on your computer against a huge database of malware. If something matches, the software alerts the user and attempts to neutralize the program. For anti-virus software to remain effective, it's important that you keep it up to date. Many programs have an auto-update feature that will download new virus definitions on a weekly basis.

Other useful applications to look into are anti-spyware or anti-adware programs. Like anti-virus software, these programs search your computer for applications that can affect your network's security. Spyware and adware can track your online activities and send information to another computer.

Many of these programs have active scan modes that will help you keep an eye on your computer in real time. Others may require you to set up a scanning schedule or run a scan manually. It's a good idea to run scans on a regular basis -- at least once a week.

Detecting Wireless Network Intrusions

A strong firewall should help you keep an eye on attempts to contact your computer. It should also alert you if an application on your machine is attempting to contact another computer. Keep a close eye on these messages. Some are harmless or even beneficial -- you wouldn't want to block your anti-virus program from downloading the latest updates. But others can be signs that someone is trying to access your information or control your machine from a remote location.

Most Web browsers have security settings that can help you keep your network safe. Several will warn you if you are about to visit a site known to host malware. You can also adjust settings such as whether or not your browser will accept cookies or run Java applications. Disabling cookies, Java and other options will help keep your network safe but it will also affect your browsing experience. You may not be able to interact with sites the way the webmaster intended if you turn off these options.

Administrators of commercial computer networks sometimes rely on special software and hardware called intrusion detection systems (IDS). These systems monitor data traffic across host computers and networks. A good IDS can compare this data against known malware patterns and alert the administrator if there's a problem. But that's a solution for a much larger computer network than your typical home network.

Most anti-virus software won't detect an intruder. But you might discover a malware application that makes intrusions possible. Run anti-virus software frequently to make sure your system is safe. You should also be sure to install updates and patches for your operating system as they become available. These patches may help seal up vulnerabilities on your computer.

Tips on Safe Wireless Networks:

Setting up a secure network is one thing -- keeping it secure is another. All your hard work will go to waste if you aren't careful about how you use the Internet. But if you follow a few guidelines, you'll greatly reduce your chances of compromising your network's security.

The first tip is to avoid clicking on hyperlinks in e-mail or instant messages, particularly if you don't recognize the name of the person sending it to you. The link may lead you to a site hosting malware. It might even initiate a malware download. Tell your friends and family that you avoid clicking on hyperlinks unless you are sure they lead to a safe destination.

Sometimes links on Web pages can also lead to malware. You might click on a link thinking you're going to one site when you're really going to another. Some malware designers will go so far as to create a copy of a legitimate Web page and use it to host their malware. It's called spoofing. Fortunately, it's not that common -- most legitimate sites are quick to take action when they discover a spoofed version.

If you want to make sure you're visiting the right Web site, you shouldn't rely on hyperlinks at all. The most reliable way to reach the site you want is to type the URL into your browser's address bar. Even this method isn't completely foolproof, but it's the most reliable way to make sure you go to the site you want to visit.
Another thing to watch out for are peer-to-peer services. These services allow you to download files hosted on other users' computers. Most of these services rely on users to share files. Usually, the service will create a shared folder. Any file within that folder is fair game -- other users of the service can download a copy of it. If you aren't careful, you could allow unfettered access to all the files on your computer. If you store any private information on your machine, it might not be private for long.

As long as you're cautious when you set up a peer-to-peer service, you should be fine. Just keep in mind that by the very nature of the service, you'll be compromising your network's security.

It might seem like the tips we've shared in this article are excessive. But think about how important your personal information is to you. If someone else had access to that information, he or she could steal your identity. A malicious hacker could raid a banking account, ruin your credit rating or use your machines to attack a Web server or send out spam. While no network is ever 100 percent immune to attack, following these tips will greatly reduce the risk of a security compromise.

Sunday, 8 May 2016

Investigation Report: How Drones work?

How Drones Work!

In this brave new digital world, the word "drone" has taken on some seriously ominous overtones. Mass media portrays drones as cold-blooded mechanizations silently soaring the skies in search of unsuspecting human targets. The general public sees surveillance drones as creepy reminders that someone, somewhere is watching every little thing you do. Drones are indeed powerful weapons and spy tools. But they're also much more.

Although "drone" is the most common term, these flying machines are also often called UAVs (unmanned aerial vehicles). Although government and military agencies were among the first to explore drones for their warfare capabilities, these winged devices are now also marketed to kids, teenagers, RC plane hobbyists, photographers, videographers, farmers and just about anyone who can benefit from a viewpoint in the skies around them.

Military-grade drones may fit in a backpack, or they may be nearly as big as a full-size plane and loaded with death-dealing armaments. These drones can cost tens of millions of dollars and have wingspans of more than 100 feet (30 meters).

Although military drones are promoted to the public as bloodless and precise types of war machines, they can be disturbingly deadly. The Bureau of Investigative Journalism estimates that in Pakistan alone, the United States executed more than 400 drone attacks that killed as many as 4,000 people, of which perhaps 1,000 were civilians and 200 were children.

Consumer and commercial drones offer a happier spin on automated flight. They may actually fit in your palm and run you less than $100. Sturdier, more advanced models can cost thousands and scream high into the sky (and possibly onto local radar), which may very well land you in trouble with the Federal Aviation Administration (FAA).

Small drones operated by commercial enterprises are growing in number. Those businesses will benefit in amazing and as-of-yet unforeseen ways, using drones to boost revenue and help economies all over the globe.

Fire departments, police units and disaster responders all use drones to some degree, assessing harrowing situations, finding missing people and helping fellow humans. Drones are handy for construction, mapping, wildlife conservation, pipeline inspection and much more.

Drones are also just plain fun. We humans can't sprout wings and fly, but we can do a little vicarious living through our winged friends, lofting cameras for amazing images or just zooming around the heavens for the joy of it.

The Drone Backstory:

There was no history-rattling moment when the first drone went airborne. That's in large part because it's a matter of semantics when trying to determine exactly which historical device qualified as a drone. Was it one of the explosives-laden balloons used in the 1800s? Was it the initial V-1 rockets that the Germans deployed during WWII?

In the early 1900s, military groups used drones, including radio-controlled versions, for target practice. Engineers also developed unmanned aircraft loaded with munitions. These weren't really drones. They were the first cruise missiles, sometimes called flying torpedoes, and not meant to return to base.
During the Cold War, the U.S. ramped up research on drones, hoping to use them as substitutes for manned spy planes. As the Vietnam War dragged on, drones flew thousands of high-risk reconnaissance missions and were destroyed by enemy fire, but in the process saved the lives of pilots who otherwise would have perished.

At about the same time, engineers began equipping drones with real-time surveillance capabilities. With their onboard cameras and unlimited courage, drones could approach enemy lines and document troop movements and strategies without risking human lives.

In 2002, the CIA first used a Predator drone to kill an enemy combatant in Afghanistan. The Predator (more precisely, the MQ-1 Predator), with its spine-chilling name, was one of the first military drones to see widespread action. It was unveiled in 1995 and has since zoomed all over the world — but it's used mostly in the Middle East. It can fly more than 500 miles (805 kilometers) on single mission and circle targets for hours; armed versions can fire sophisticated missiles.

The Predator is one of the best-known military drones, but now it's just one of many. Those first strikes in Afghanistan were, as they say, just the beginning.

More Military Might:

As the digital revolution has unfolded with its tiny microprocessors and long-distance communications abilities, drones have become more and more useful for military operations. By one estimate, the U.S. military has roughly 11,000 manned airplanes and perhaps 8,000 drones, meaning that a third of the air force is unmanned. For anyone who feared the coming age of automated, sci-fi-type warfare ... well, those days are already here.

The U.S. military has three categories for drones: mini, tactical and strategic. Mini drones are small and mostly used for short-range surveillance. Tactical drones can fly for several hours and as far as 200 miles (322 kilometers) and are used to assess enemy targets. Strategic drones can fly for days and carry weapons.
Some drones use battery power to turn propellers. Newer and pricier versions have full-blown jet engines and can fly more than 500 miles (805 kilometers) per hour, soaring to 50,000 feet (15,240 meters) or even higher.

Some drones are autonomous, following preprogrammed routines. Many others require pilots. Those pilots may be on the ground near the operation, or they may sit in control rooms, thousands of miles away, guiding their minions by high-speed wireless networking links.

In part because there's a delay of a couple of seconds from the control room to the drone, crashes do happen. Sometimes pilots push the wrong buttons. Sometimes they misread the flight data they see on their workstation monitors; cameras on the drones simply aren't a substitute for a pilot's real vision and other senses. More than 400 large drones have crashed since 2001, but many disasters have been averted, too. If a communications link is cut, advanced drones are programmed to fly in circles or even to return to the nearest base without human guidance.

Like air traffic controllers, drone pilots have high-stress yet often dull and repetitive jobs, mostly surveilling areas for intelligence and potential targets. Because of burnout, they quit three times as often as regular pilots, and the U.S. military recently doubled drone pilot salaries to stop them from running for the exits.
Those who stay receive extensive training in a traditional classroom setting, as well as hands-on training at their computers. They execute endless practice runs and then review their in-flight decisions, attempting to hone their minds to select the best approach to any given scenario, particularly those that involve the use of deadly force.

When they score an important victory, these pilots receive medals just like any others, and in spite of the geographical disconnect from their targets, many suffer emotional trauma from the damage their strikes cause.

Not all drones inflict suffering and mayhem. There is an entire range of drones for commercial and private use.

Drones in Your Homes:

In many places, including the U.S., civilian and commercial drone use is severely restricted by aviation administration regulations, primarily in the name of safety. That does not, however, stop thousands of people from using drones for a plethora of purposes, including videography, sheep herding, product delivery and crop surveying.

If you perform a quick search through your favorite online megastore you'll see that dozens of drones are available. Some are less than $100. Other costs thousands. There are two broad drone categories: fixed wing and rotary. Each type has its strengths and weaknesses.

Fixed-wing drones can be hand-launched, but often they require a runway or even an unwieldy catapult. But they're generally faster and can fly much longer than their rotary brethren.

One option is the eBee senseFly, a fixed-wing drone designed specifically for mapping purposes. Toss it into the air and it follows a preprogrammed route, snapping high-resolution images that are then integrated into maps and 3-D models. It can cover more than 4 square miles (10.4 square kilometers) on a single flight. Farmers are the primary customers, as they can use the drone to optimize their agricultural practices and increase their yields. The eBee retails for more than $10,000.

The Agribotix Hornet LR is another fixed-wing drone, and like the eBee, it's intended largely for agricultural use. It has a 6.4-foot (2-meter) wingspan and a cruising speed of more than 30 miles (48 kilometers) per hour. It can fly for nearly an hour and a half before it must descend for recharging. Rather than only offering purchase options, Agribotix leases units to customers for less than $2,000.

Fixed-wing drones are just a teensy sliver of the commercial and hobbyist drone market.

The Most Common UAVs

Fixed-wing drones are fast and fly far, but rotary models are much more common, in part because they're easier to fly and more stable for purposes like photography. If you want a rotary drone, you'll have dozens of options from which to choose.

On the cheap side, for instance, there's the Hubsan Mini RTF quadcopter, which sells for less than $60. It's so tiny that it will fit in the palm of your hand. After a 40-minute charging session, you'll get about seven minutes of flight time during which you can make the drone do four-way flips and other stunts. You can also capture pictures on a miniscule 0.3-megapixel camera.

The Parrot AR.Drone 2.0 Power Edition is a quadcopter that sells for around $400 online. This drone features upgraded batteries that offer about 36 minutes of flight time. It comes with a free flight control app that you can load to your WiFi-enabled device, such as a tablet or smartphone, letting you control the drone to range of 165 feet (50 meters). It also has a 720p HD video camera that streams video live to your device, giving you a bird's-eye view literally on the fly.

One of the better-known drone manufacturers is DJI, which makes the DJ Phantom series. These drones aren't just for fun — they're intended to give blossoming cinematographers a way to catch amazing high angles without the need for more expensive gear. Some models come with GoPro camera mounts, while others are equipped with onboard cameras of their own.

The FC40 Phantom 2 Vision+ quadcopter weighs in at just under $1,000. It can fly to more than 2,600 feet (792 meters), with a flight time of roughly 25 minutes. A controller helps you manage the drone's flight, while the app that you load on your phone or tablet manipulates the video and camera capabilities.

With all of these flying contraptions zipping around, it's hard to deny that they seem awfully reminiscent of regular old remote-control helicopters and planes. So what's the difference between those traditional radio-controlled machines and new-age drones?

It has a lot to do with automation and advanced digital features. Whereas traditional remote-controlled devices require constant attention, drones can do amazing things on their own. Program in a GPS location, for example, and a drone can automatically fly itself to that point and then hold its position. Or you can run a so-called "follow me" mode, and the drone will follow you around, tracking you by sensing the signals from your phone.

Modern drones are equipped with a whole slate of similar fun and useful features. Of course, none of those capabilities are worth much if the thing can't get off of the ground.

Aerial Acrobatics:

Even casual observers realize one striking thing about drones — they often have four propellers (but can have anywhere from three to eight) unlike traditional RC helicopters, which have only one main rotor. Drones need extra rotors because they need more stability to pull off their automated functions.
More rotors also means more lift. Lift, of course, is the push that spinning propellers create beneath a flying machine. The more lift a device has, the higher and faster it can go, and the more weight it can carry. That last part is vital for anyone who wants to attach a camera to a drone. Too little lift means a drone will moan and groan and crash, or maybe never get airborne at all.

There's a reason that most consumer drones don't get much more than 15 to 20 minutes of flight time, and that reason is related to power. Drones need batteries to power their props. A couple of lightweight rechargeable batteries suffice for a short amount of time in the air. Adding more (or more powerful) batteries is a great idea ... until you realize the extra weight they add actually reduces overall flight time.

As power flows from the batteries to the rotor motors, the propellers begin to spin, and it's the spin of each prop relative to the others that changes altitude and direction. Rev up the rotors and they'll generate enough lift to overcome the force of gravity, zipping the drone higher and higher.

If you want the drone to tilt on one side, two of the rotors will begin spinning faster on one side, creating more lift. In doing so, some of the upward lift becomes more of a sideways force, causing the drone to move forward or backwards. In the same manner, different prop speeds will spin the drone.

Obviously, you don't have to think through these processes as you're flying your drone, otherwise you'd probably crash it every 10 seconds. Drones are loaded with accelerometers and gyroscopes that help them maintain their orientation in space. These instruments detect linear acceleration, tilt and other directional cues to keep them from dive-bombing the ground or, worse, unsuspecting bystanders.

Many drones also have integrated GPS so the machine "knows" where it is. Command the drone to hover in one small space and it will do so, fighting a breeze if necessary.

To input your commands, you need a controller, typically one that uses 2.4 gigahertz radio waves. Many drone controllers look just like RC controllers of yore; that is, a boxy unit with two thumb joysticks and a collapsible antenna. Others rely on a combination of 2.4 gigahertz signals and WiFi, and they may pass on an old-school controller for one that looks more like a gamepad, or they may rely on a control app on your smartphone or tablet.

The act of flying consumer drones ranges from pretty easy to fiendishly difficult. Cheaper drones are budget friendly but may be so difficult to fly (and so delicate) that they're broken before you can figure out how to make them travel in a straight line. Pricier drones often have some automatic functions, like landing assistance, that help simplify some of the harder and riskier portions of flights, easing you into your new role as pilot.

Drones: Dystopia or Dream?

Drones are the stuff of dystopian nightmares. They're used for surveillance at home and abroad, raising privacy issues everywhere. They can carry weapons and can kill people from thousands of miles away while the operator sips coffee in a temperature-controlled office.

Yet drones are a dream come true for many commercial enterprises. Farmers can better monitor fields and livestock. Construction engineers can much more easily see their projects from every angle. Drones can offer new perspectives on real estate, move cargo and deliver packages.

By one estimate, drone technology could create more than 100,000 jobs in the next decade. And they could boost the economy by billions and billions of dollars as they spill into sectors of engineering, computer science, commercial contracting, videography, forestry and, of course, the military [source: Whitlock]. All of these disciplines will require experts in fabricating and flying drones — and commercial drone pilots could start with an annual salary of $50,000 to more than $100,000, working for manufacturers, surveyors, law enforcement or any number of other organizations.

Colleges, such as the University of North Dakota, are increasingly offering degrees for piloting drones in anticipation of the drone explosion. Students train on simulators as they build up their flight hours, but in many cases they can't fly actual drones as part of their coursework. That's because before drones can truly take flight, they'll have to surmount legal and regulatory hurdles. At present, the FAA limits what drones can do in American airspace, even if you're practicing through a college program.

Hobbyists must keep their machines flying lower than 400 feet (122 meters) and at least 5 miles (8 kilometers) from airports to prevent conflicts with manned aircraft. In spite of those rules, the FAA has documented dozens of near misses from people who violate regulations, and any of those instances could have potentially caused serious damage to an airplane and endangered lived. Those kinds of problems complicate the government's ability to integrate commercial drone usage on a larger scale.

Still, Congress has directed the FAA to find ways to regulate drones, particularly commercial drones, in ways that will help harness these technologies for the economy. Because of the large scale of drones' likely impact on our society (and because we're talking about a federal bureaucracy) you can bet that it will be a few years before drones really take off commercially across the country.

In the meantime, drone technology continues to evolve much more quickly than any single organization can track. Hobbyist drones are getting cheaper and more capable by the month, and more and more manned military craft are being replaced by enormous, powerful and deadly drones that can scour the skies far longer than any traditional craft.

If you were waiting for the day of the drones to arrive, realize this — that day has already come. Drones, for good or bad, will be a part of our culture for many years to come.

Author's Note: How Drones Work

Just like that, the drones are everywhere. I was running down a remote rural path a few weeks ago when I met a bicyclist heading the opposite direction. He'd strapped a controller to his handlebars and was guiding a quadcopter 20 feet (6 meters) above and ahead of him. I don't know whether he was recording a video or just flying for fun, but it was proof that no matter where we go, these small flying machines are with us, too. Let's hope that in the long run, that's a good thing.

Careers: Drone Pilots

How Drone Pilots Work ?

In 1898 the second version of Madison Square Garden was only 8 years old. There, on the shore of an indoor pond custom built for his purposes, the eccentric, brilliant inventor Nikola Tesla released a weird, metal boat and proceeded to make it zip around over the surface of the water. But how? Many of the stunned onlookers wondered if he was able to control the vehicle with his mind. In fact, Tesla was using radio waves to guide his invention, U.S. patent number 613,809 — arguably the world's first robot. Tesla's innovative use of radio waves to achieve remote control of a craft may legitimately be called the dawn of drone piloting [source: PBS].

The next step, of course, was to get that craft airborne.

The origins of drone piloting date back to the origin of airplanes themselves. The common denominator has been the military. The risks associated with surveillance, reconnaissance, bombing and fighting are so high that from the earliest days of air warfare, military strategists have been thinking of ways to get pilots out of the craft and safely on the ground.

During World War I, the inventor of the gyroscope, Elmer Ambrose Sperry, was contracted to develop a drone biplane for the Navy. Sperry and his son Lawrence assembled a team and began research and development on Long Island, New York. Their idea was to launch the unmanned aircraft with a catapult, pilot it remotely for 1,000 yards (914 meters) and then make the aircraft dive and detonate a warhead. Crash after crash followed as every attempt ended in failure. Finally, in March 1918, one of their planes flew the 1,000 yards (914 meters), dove on the selected target, recovered and landed. It was the first true drone. Or, as the experts like to say, it was the beginning of unmanned aerial systems [source: Barnhart].

The problem with early drones, like the one developed by Sperry, was that they were too unreliable for combat. While the U.S. Navy did evolve an attack drone that they deployed in the Pacific theater during World War II, most drones used by the military in the first half of the 20th century served as target practice for pilots-in-training [source: Barnhart].
During the Cold War era, more sophisticated drones began to be used for reconnaissance and surveillance. Today, more than 90 percent of extant drones are used for data gathering, whether by military, law enforcement or environmental monitoring agencies [source: Barnhart].

The Drone Pilot Spectrum:

The U.S. military's use of drones to strike targets abroad has become highly controversial. Air Force drone pilots have been called "armchair killers," and the fact that a pilot can be sitting at a console in Nevada while pulling a trigger that kills people in Pakistan is found, by many people, to be unsettlingly remote and cold. But many, if not most, drone pilots are not actually directly engaged in making kill shots. Their job is to fly surveillance missions that gather data about potential threats all over the world.

One way or another, there's no getting around the fact that many of these soldiers wake up at home, drive a few minutes to their job site and then pilot expensive flying machines all over the world before going home for dinner. The job of the modern military drone pilot is a far cry from what we think of when we picture fighter pilots.

On the other end of the spectrum is the hobbyist drone pilot. Often self-taught, the hobbyist might even have built her own drone and taught herself to use it. Or, at least, that's the way it used to work. People have been making and flying model airplanes by remote control for many years, but with the advent of smartphone technology and cheap, off-the-shelf quadcopters equipped with cameras, the hobby of drone piloting has really taken off. Built-in drone cameras are motivating their pilots to take risks for great footage that the old-fashioned model airplane pilots rarely took.

The current rules are incomplete and in flux, but in general terms, you're not allowed to fly your drone above 400 feet (120 meters), you've got to be able to see it at all times and you have to keep it 5 miles (8 kilometers) away from local airports. Until February 2015, law enforcement officials had been issuing steep fines to hobbyist pilots who disobeyed these rules [source: Fitzpatrick].

Somewhere between the soldier and the hobbyist are the commercial pilots, many of whom have made businesses out of aerial photography and cinematography. The world of commercial drone piloting is rapidly growing, despite the fact that the new Federal Aviation Administration (FAA) guidelines concerning commercial drones won't come into effect until 2017. We'll discuss this in more depth on the next page.

Finally, there's a potential fourth category of drone pilot — drones themselves. In theory it's possible to plot GPS coordinates and simply send a drone off to pilot itself to a destination. The major obstacle to this is, well, obstacles. You need pilots to man the monitor and keep a sharp eye out for impediments such as trees, power lines, tall buildings and other drones. But new miniature 3-D camera technology is already making it possible for drones to "see" obstacles in their path and take evasive action [source: Finley]. A future in which drones pilot themselves may not be far off.

Military Drone Pilots:

Two young men sit in a dark, smelly room in the Nevada desert. They're looking at the image of a mud hut somewhere in Afghanistan. At their fingertips are the controls to a powerful, unmanned aerial vehicle (UAV) that's hovering unseen in the skies high above the hut. They've been looking at this little house for hours, and nothing has moved except for a few goats. Finally, they're told that an intelligence source has determined there's an insurgent inside and they need to destroy the place. Placing a laser on the corner of the hut, they release a Hellfire missile from the UAV. A split second later they see something dart out of the house. Is it a kid? A dog? Then it's gone. The house is rubble, and whoever or whatever they saw is gone too. There's no mention of this darting figure in the official report, but the incident still haunts Senior Airman Brandon Bryant, one of the two men at the controls that day [source: Power].

In lightless, windowless boxes on Air Force bases around the country, people sit on chairs in regulation one-piece flight uniforms watching bright screen images transmitted from the other side of the world. These pilots control UAVs that patrol the skies over Syria, Iraq, Pakistan and other hot spots across the globe. More often than not the pilots are gathering data, but sometimes they're firing missiles at military targets. And they're at their posts for as long as 13 to 14 hours a day, six days in a row. On average, drone pilots fly their craft three times longer than conventional Air Force pilots spend aloft in their cockpits [source: Terkel].

Long hours, together with the strange disconnect between their immediate surroundings and the real-world consequences of their work, leads to a deadly combination of boredom and stress. And to top it all off, they get no respect. Teased by their peers for playing video games rather than flying, drone pilots are increasingly burnt out.

Recently, the Air Force has been having trouble recruiting new drone pilots to replace those who are retiring or quitting. The problem has reached such crisis proportions that Air Force Secretary Debra Lee James has publicly announced they are more than doubling incentive pay (to $1,500 per month). The Air Force needs more than 1,200 drone pilots, but as of January 2015 they had only 988 [source: Terkel].

Increasing the pay may not be enough. After six years of working as a drone warrior, Senior Airman Bryant left the Air Force, turning down a $109,000 bonus to keep flying [source: Power].

Drone Pilot Schooling:

Pick a disaster, any disaster. 9/11? Katrina? Fukushima? As rescue crews struggle through the rubble, miniature helicopters equipped with cameras zip up and down ruined buildings and in and out of wreckage too dangerous or difficult for humans to reach quickly. Use of robots like these has resulted in a nine-fold improvement in the performance of rescue teams at disaster sites. And the person you will often find at the controls for one of those helicopters is Dr. Robin Murphy. Founder of the Center for Robot-Assisted Search and Rescue (CRASAR) at Texas A&M University, Murphy is one of the leaders in the field of disaster relief robotics. Her CRASAR center has been directly involved in numerous disaster relief operations since its founding [source: CRASAR].

Murphy is also a teacher at A&M where she mentors graduate students through the school's computer science program. A&M is one of 358 U.S. public institutions, including 14 universities and colleges, that have an FAA permit to fly UAVs for the purposes of teaching and research. Some of them, including several community colleges, have drone pilot training programs, but only three schools offer degrees in the field: Kansas State University, the University of North Dakota and Embry-Riddle Aeronautical University. The programs don't just feature extensive flight simulation — at Embry-Riddle, for instance, students must also accumulate 13 credits in engineering to ensure they understand the drone system inside out [source: Raftery].

One recent graduate from the Kansas State program racked up $60,000 in student loans, but then immediately walked into a six-figure job with the military [source: Raftery]. While this graduate said he hopes to find work in the civilian market eventually, for now, the jobs are all with the military; there isn't really an official civilian drone pilot market yet.

Universities and other institutions are starting to offer training programs because they're expecting a massive boom in the use of commercial drones. In fact, everybody who knows anything about drones is anticipating this boom. They're just waiting for the FAA to make it legal.

The Future of Drone Pilots:

At the end of February 2015, the Federal Aviation Administration (FAA) lost a court battle that has important implications for commercial drone pilots. The judge in the case said the FAA could not yet regulate the use of drones without allowing the general public to have a comment period. This means that many of the $10,000 fines for operating without a permit have been reversed. Drone entrepreneurs can get back to business with pursuits like aerial photography for real estate companies and advertising firms [source: Kravets].

But they're still operating in a gray zone. The FAA has been working toward creating new regulations to govern drone technology, but their work isn't yet complete. On Feb. 15, 2015, the agency issued a proposal to let commercial drones under 55 pounds (25 kilograms) fly at will [source: Levin].

The proposal also dials back the anticipated requirements for drone pilots, who won't be forced to get a license. Instead, operators will have to pass a written test that demonstrates they have a basic understanding of aeronautical information, including airspace classifications, radio communication and emergency procedures [source: Fung].

But the actual regulations might not go into effect for another few years.

In the absence of official regulation, insurance companies have been drawing up their own rules to create policies that cover the proliferating use of commercial drones. Entrepreneurs who buy the insurance are operating on the time-honored assumption that you can't break rules that don't exist yet. Many are contracting themselves out for aerial photography, mapping and surveying. But people involved in drone flight anticipate a vast array of other applications from agricultural spraying to firefighting to ambulance services to parcel delivery [source: Levin].

Famously, online retail giant Amazon has already declared its intention of creating a drone delivery system that could see packages arriving on your doorstep within minutes of placing an order. Google has also jumped into the fray and is actively experimenting with a drone delivery system. The company anticipates a single pilot handling the flights of multiple drones at once. A European organization called Platform Unmanned Cargo Aircraft (PUCA) shares this vision and is working toward the deployment of large, slow-moving cargo drones that would deliver goods to isolated communities. PUCA proposes a single pilot controlling as many as 30 planes at a time [source: Madrigal].

In the meantime, a U.S. company called Skycatch, which uses drones to map sites for mining and construction companies, is building a list of pilots for its clients to hire. Called Workmode, the list already has 3,000 names on it, 1,000 of them in the U.S. Eventually, Skycatch wants to automate Workmode so it operates like an aerial version of Uber, allowing people to hire drone pilots for their various needs with their smartphones [source: Levin]. After all, it's unlikely that most people would need to actually own a personal UAV. But it seems like drones could fit quite naturally into the sharing economy.

Author's Note: How Drone Pilots Work:

When I was a kid I was convinced that by the time I grew up everybody would be driving hovercrafts. I never would have guessed that when we finally got around to creating working hovercrafts, drivers would be passé. As I see it, the basic problem is that we're too heavy to zip around in drones. The solution is obvious, we need to be lighter. Some futurists predict that we'll be able to download our consciousnesses into computer chips — why not just download to a drone? Maybe a transformer drone would be best — one that could reassemble itself into an ambulatory robot upon reaching its destination. Being a quadcopter could get old pretty quickly.

Search Favourite Tips