A Usability Study On Ubuntu Operating System and Third Part Software Manager Using the Cognitive Walkthrough Method

A Usability Study On Ubuntu Operating System and Third Part Software Manager Using the Cognitive Walkthrough Method

                                                       

Abstract

Operating system – As name self explains, it manages the operation between Computer hardware and software resources. Application program is one of the components of operating system. Application program requires operating system to function. Major operating system are Linux operating system, Windows operating system, Mac.

 Ubuntu is an open-source Linux operating system, which is based on debian stable Linux distribution. Currently Ubuntu run across platforms such as laptops/desktops, servers and mobiles. Linux is similar to Unix but was developed without any Unix Code. Linux is an open license model, which has a general public license in which the Linux kernel code is available for studying and modification. Some of the popular Linux distributions are, red hat, Ubuntu, Linux mint, kali.

Introduction

How to install a third party software is one of the major tasks carried out in any operating system. The approach and procedure is different for the major operating system distributions, say windows, Linux and mac. So let’s walkthrough along to install a third party software in Ubuntu operating system which is based debian Linux distributions. Ubuntu comes with a default list of useful programs. However, most of the times, a specific software for serving the specific purpose is needed which is not served by default applications.

Software is a program which can be run on computer. However, for the smooth run of this software, it requires other resources in the operating system to work for it. So there are hundreds of files required just to make the program work. Upon that, the files has to be loaded onto the right locations, depending on different operating system architecture. Ubuntu stores all the needed files into a package, which has to be run. Thus package combines all files into a single file, which can be handled more easily.

Core tasks during the cognitive walkthrough are:

1. Validation of the software and installation of the system software.
2. Configuration of the fundamental services for the smooth and efficient run of the operating system.
3. The right way to start up and shutdown the operating system.
4. General Installation procedure for a user application.

Usability Guidelines

Guidelines used to evaluate the core task are as follows:

G1 - Users should be aware of the steps they have to perform to complete a core task.

G2 - Users should be able to determine how to perform these steps.

G3 - Users should know when they have successfully completed a core task.

G4 - Users should be able to recognize, diagnose, and recover from non-critical errors.

G5 - Users should not make dangerous errors from which they cannot recover.

G6 -Users should be comfortable with the terminology used in any interface dialogues or documentation.

G7 - Users should be sufficiently comfortable with the interface to continue using it.

G8 - Users should be aware of the application’s status at all times.

Ubuntu Operating System Installation:

The latest version of Ubuntu is 16.04.1 and is downloaded from the Ubuntu website. There are a couple of requirements to be met before kick starting the installation procedure. Validation of the software to check its health is important to start on. At times there are possibilities a software download can go corrupted. At the outset, if the hardware requirements fail, there is no point in continuing the installation, else if continued, the system would throw various errors during the operation of the system. Once this is met, the user interface of Ubuntu guides the user step by step. [G1,G3]

Ubuntu offers two types of installing the operating system

1. To externally install alongside another operating system

2. To inside the same operating system.

The advantage of installing inside an operating system is that, the files of the base operating system can be accessed through Ubuntu as it is. Therefore, by saving the switch over time between the operating systems and help solve duplicating the dataset. The next important aspect to be noted is the file system of Ubuntu. As in general NTFS/ fat 32 is used by Windows, likewise Ubuntu Linux considers ext3, ext4, ext5 as its file system. This is one of the critical step, a user should be aware of, as there are possibilities to lose valuable data in the hard disk. One of of the possibilities is, a user tends to have couple of operating systems to work on his machine. It is very important to know the number of partitions in the hard disk and its sizes. If confused with the partition name and formatted, then the user losses all data in that partition. After setting up these, the control shifts back to the system software to extract and copy the system files. Once done, asks the user to restart the operating system now or later, to complete the installation process.[G2,G5]

Configuration: Once the installation is done it is necessary to check for the available updates for the system. Configure default settings and preferences of audio, video, network applications. One of the good feature of Ubuntu is the use of terminal for most of the activities. Whether to update, install, traverse files terminal is a handy tool used extensively.  [G8]

Installing Software

Role of binary file - Let’s look into the importance of the source code and binary file for installing a software. Generally, when a package is created, for a particular software or program, source code will be stored, for the program in the package. Source code is nothing but a set of instructions for the computer, in order to execute the software, which is written in human readable language. Machines cannot understand this human native-language and hence the need to interpret the source code. This task is taken care by interpreter or compiler. One of the best ways of achieving this is by converting the source file into a binary file, in which machines can understand. Binary packages are ones which have been made specifically for one type of computer, or architecture. [G1]

Package Dependencies – Sometime a program needs same file to support the installation of its own software. Instead of storing each file into each package, a separate package can be installed to provide, so that any program in need of that file, can use them directly. So, to install a program which needs one of these files, the package containing those files must also be installed. When a package depends on another in this way, it is known as a package dependency. By specifying dependencies, packages can be made smaller and simpler, and duplicates of files and programs are mostly removed. When we install a program, its dependencies must be installed at the same time. Usually, most of the required dependencies will already be installed, but a few extras may be needed. [G1,G5]

 Package Managers - A package manager is an application which comes along with the operating system which deals with the downloading and installation of packages. Ubuntu includes a couple of package managers by default, and which we use depends on how advanced the package management tasks are that we want to achieve. The basic package manager, we are going to use here is the Add/Remove tool, which is very easy to use.[G1]

Repositories - Ubuntu stores all its packages at a location called repositories. Repository stores packages of similar types, which can be downloaded and installed using a package manager. A package manager will store an index of all of the packages available from a repository/ software channel. At times the index are rebuilt, to make sure that it is up to date and knows which packages have been upgraded or added into the channel since it last checked. In addition to the official Ubuntu repositories, it is possible to use third party repositories. Be careful, though - some are not compatible with Ubuntu and using them may cause programs to stop working or may even cause serious damage to your installation. [G6]

Installing a Package - This section explains how to install packages using the various tools available in Ubuntu. [G1,G6]

·         Graphical method

·         Text Based Methods (Terminal)

Let’s walkthrough the graphical method first. Not all the packages can be installed through graphical method. For such packages, text based methods are suitable. In Ubuntu we find most of the packages at "Software Centre ". Software from additional repositories may be installed. Once this has finished, click Close. Our new programs are installed and are ready to use.

Advanced graphical method - The Synaptic package manager is a more user friendly method for installation of the software packages. If any problem in finding the package with Add/Remove tool, we need to try using the search in Synaptic.[G6]

Text Based Methods - Text based methods demands the knowledge of how to use the terminal and its commands. While install packages, we should consider using an AptURL over apt-get or aptitude.[G5]

Aptitude - the text-based method - Aptitude is a text-based package manager, which must be run from a Terminal.

apt-get method

The apt-get program is a command-line package manager, which should be used if the Add/Remove tool and Synaptic ever run into problems. It provides an advanced interface to APT, the underlying package management system which Ubuntu uses, but is reasonably easy to operate.

Installing downloaded packages

We may wish to install a package you have downloaded from a website, rather than from a software repository. These packages are called .debfiles. GDebi is a simple tool to install .deb files. It has a graphical user interface but can also be used in terminal. It lets us to install local deb packages resolving and installing its dependencies. It automatically checks packages for their dependencies and will try to download them from the Ubuntu software repositories if possible. We may first need to install GDebi - simply install the gdebi package using one of the package managers listed above, or open a Terminal and type sudo apt-get install gdebi.

Double-click the package to open it with GDebi. If all dependencies have been met for the selected package, click the 'Install package' button to install it. GDebi will warn, if there are unmet dependencies, which means that there's dependencies that aren't resolved in the repositories that we are  using. If all met and resolved, the software is installed and ready to use.[G1,G4,G6]

-Amit Vijayan

References:

1.      https://help.ubuntu.com/community/InstallSoftware

2.      http://www.ubuntu.com/download/desktop/install-ubuntu-desktop

WPA2 handshake attacks explained — how to keep your wireless network safe

Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

How the WPA2 handshake works (and why attackers target it)

When a device joins a WPA2 network, it performs a four-way handshake with the access point to derive session encryption keys from the shared passphrase. In WPA2-Personal, that passphrase is the only secret protecting the network — so the handshake is the attacker's prime target. Conceptually, the attack works like this: the attacker passively captures the handshake, then takes it offline and guesses passphrases against it at high speed. Because the guessing happens offline, the router can't slow the attacker down with rate limiting. If the passphrase is short, common, or predictable, it will fall.

Why deauthentication often accompanies handshake attacks

An attacker who wants a fresh handshake may forge deauthentication frames to force a connected client to rejoin the network, generating new handshake traffic to capture. So a handshake attack frequently starts with the disruption pattern described in our deauthentication article — client drops and reconnects clustered in time.

Signs of a handshake-capture attack in your logs

• A deauthentication flood immediately followed by client reconnects — the classic capture pattern.
• An unfamiliar client device that stays associated without normal traffic (a passive sniffer lingering nearby).
• Repeated reconnection cycles affecting a single client while others remain stable.
• WIDS alerts for deauth floods or unknown stations probing your AP.

How to defend your network

• Move to WPA3 if your hardware supports it. WPA3's SAE handshake resists offline dictionary attacks — captured handshake data is useless for guessing.
• Use a long, random, unique passphrase (20+ characters, generated not memorized) on WPA2-Personal networks. This is the single highest-impact defense on older hardware.
• Enable protected management frames (802.11w) to make the deauth-forced-reconnect trick far harder.
• Disable WPS PIN mode, which offers an independent brute-force path that bypasses passphrase strength.
• Monitor your airspace for deauth floods and rogue stations; treat repeated unexplained client drops as suspicious.
• For businesses: use WPA2/WPA3-Enterprise with 802.1X and per-user credentials, which eliminates the shared-passphrase attack surface entirely.

Authorization disclaimer

All security testing must only be performed on networks and devices you own or are explicitly authorized to assess. Capturing handshakes or attempting to recover passwords for networks you don't own is illegal in most jurisdictions.

Wi-Fi deauthentication attacks: what they are and how to protect your network

Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

What is a deauthentication attack?

Wi-Fi networks use management frames — small control messages like "deauthenticate" and "disassociate" — to manage connections between clients and access points. In older protocol versions these frames are neither authenticated nor encrypted, so an attacker within radio range can forge them. By sending spoofed deauthentication frames that appear to come from the access point (or from a client), the attacker forces devices to drop their connection, causing denial of service or repeated reconnections.

Why attackers use them

Deauthentication is rarely the end goal. Conceptually, attackers use it for two things: disruption (knocking users off a network, sometimes repeatedly, as harassment or sabotage) and facilitation — forcing clients to reconnect so the attacker can capture fresh handshake traffic or nudge users toward a rogue access point. What may look like "just kicking someone off Wi-Fi" is the same mechanism used in credential-theft attacks.

What deauth attacks look like in your logs

• A flood of deauth/disassoc frames in access point logs — far more than normal roaming would generate.
• Repeated client drops and reconnects clustered in time, especially affecting many devices at once.
• Source MACs that don't match any associated device, or frames attributed to the AP that arrive at abnormal rates.
• Wireless IDS alerts for "spoofed management frames" or deauthentication floods, if a WIDS is deployed.

How to protect your network

• Enable Protected Management Frames (802.11w) on your access points and clients — this cryptographically protects deauth and disassoc frames so forged ones are ignored. WPA3 mandates it; many WPA2 devices support it as an option.
• Deploy wireless intrusion detection (or at least monitor AP logs) so deauth floods trigger alerts instead of going unnoticed.
• Keep firmware current on routers and access points to ensure management-frame protections are actually available and patched.
• Use strong authentication (WPA3, or WPA2 with a long unique passphrase) so that even forced reconnections don't expose you to handshake-guessing attacks.
• For organizations: consider wireless IPS with automatic containment of rogue APs and RF containment policies for repeated deauth sources.

Authorization disclaimer

All security testing must only be performed on networks and devices you own or are explicitly authorized to assess. Transmitting deauthentication frames against networks you don't own disrupts other people's connectivity and is illegal in most jurisdictions.

Wi-Fi attacks explained (WEP/WPA/WPA2): how to secure your wireless network

Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

Why Wi-Fi security matters

Wireless networks broadcast your data through the air. Without proper protection, anyone nearby with an antenna can listen in or attempt to join your network. The encryption protocol your router uses — WEP, WPA, WPA2, or WPA3 — determines how hard that is. Understanding each generation helps you make sure your network is on the right one.

The Wi-Fi encryption generations

WEP — broken and abandoned

Wired Equivalent Privacy (WEP) was the first Wi-Fi security protocol, specified in the 802.11b standard. It uses static encryption keys that never change, and cryptanalytic flaws in the protocol let an attacker recover the key simply by observing enough network traffic. WEP should never be used for anything — treat any device still using it as compromised.

WPA — an interim fix

WPA was introduced as a stopgap while the full 802.11i standard was finalized. It added per-packet keys via TKIP, a major improvement over WEP, but it too has known weaknesses. WPA/TKIP is obsolete and should be disabled.

WPA2 — the long-standing baseline

WPA2 implements the full IEEE 802.11i standard using AES-based CCMP encryption. It has been mandatory on new certified devices since 2006 and remains widely deployed. WPA2 with a strong passphrase is still reasonable, but weak pre-shared keys are vulnerable to offline dictionary attacks, and WPA2 alone does not protect management frames from disruption attacks (see below).

WPA3 — the current best practice

WPA3 replaces the pre-shared key handshake with SAE (Simultaneous Authentication of Equals), which resists offline dictionary attacks, and it mandates protected management frames. If your hardware supports it, WPA3 (or WPA3 transition mode) is what you should be using.

How attackers approach wireless networks, conceptually

Attackers passively capture wireless traffic and look for weak protocols (WEP, WPA/TKIP), weak passphrases susceptible to offline guessing, or client devices willing to connect to a lookalike "evil twin" access point. They may also inject management frames — such as deauthentication packets — to disrupt legitimate connections, which can cause denial of service or pressure clients to reconnect to an attacker's access point.

Signs of wireless attacks in your logs

• A surge of deauthentication or disassociation frames in access point logs or a wireless IDS (WIDS).
• An access point advertising your SSID that isn't yours (rogue or evil-twin AP).
• Clients repeatedly dropping and reconnecting, especially clustered in time.
• Unrecognized MAC addresses appearing in association logs.

How to secure your wireless network

• Use WPA3 where possible, otherwise WPA2 with AES (never WEP or WPA/TKIP).
• Use a long, unique passphrase (20+ characters) that can't be guessed; never reuse the ISP-default key.
• Disable WPS on the router — PIN-based WPS has long-standing brute-force weaknesses.
• Enable protected management frames (802.11w) if your equipment supports it, to resist deauthentication-based disruption.
• Segment your network: use a separate guest SSID with client isolation for visitors and IoT devices.
• Keep firmware updated on routers and access points to patch known protocol flaws.
• Monitor your airspace with wireless intrusion detection or at least periodic scans for rogue access points using your SSID.

Authorization disclaimer

All security testing must only be performed on networks and devices you own or are explicitly authorized to assess. Attempting to intercept or access someone else's Wi-Fi traffic without permission is illegal in most jurisdictions.

SQL injection defense, part 3: detection, logging, and ongoing protection

Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

Authorization notice: All security testing must only be done on systems you own or are explicitly authorized to assess. The vulnerable-site target list this post once contained has been removed. This is the third installment of our SQL injection defense series — parts 1 and 2 covered finding and fixing injection flaws; this part covers what comes after the fix: detection, logging, and ongoing protection.

Why detection still matters after you've fixed the code

Parameterized queries eliminate SQL injection at the source — but no codebase stays fixed by accident. New code ships, dependencies change, legacy endpoints resurface, and regressions happen. A detection layer catches what secure coding misses and tells you when someone is actively probing your applications, which is intelligence worth having.

Log what matters

You can't detect what you don't record. Make sure these are captured and centralized:

• Full request details on database-backed endpoints: URL, parameters, user agent, source IP, and session identity.
• Database error events with the failing query context (logged server-side, never returned to the user): syntax errors, type-conversion failures, and permission denials.
• Query performance telemetry: execution time per query pattern. Time-based blind injection shows up as anomalous delays.
• Authentication and session events tied to the same requests, so you can correlate a probe with an account.
• WAF/edge block events — even blocked attempts are signal; a rising block rate against one endpoint means someone is working on it.

Build alerts that fire on real attacks

Turn the telemetry into detection rules in your SIEM:

• Error-rate anomalies: alert when database errors spike on an endpoint relative to its baseline — classic injection probing.
• Signature matches: flag requests containing SQL keywords, comment sequences, or stacked-query syntax in parameters that should never contain them. Tune to your application's normal input to control false positives.
• Behavioral anomalies: a single client cycling through many parameter values, unusually large result sets served to low-privilege sessions, or response-time patterns consistent with blind extraction.
• Known-bad correlation: match source IPs and request fingerprints against threat intelligence feeds of active scanners.

Ongoing protection: keep the fix fixed

• Test in legal labs continuously: DVWA, bWAPP, and WebGoat remain the right places to train your team and validate scanner coverage — never someone else's production site.
• Scan every release: integrate SAST and DAST into CI/CD so new injection flaws are caught before deployment, not after.
• Re-audit data access: periodically review database account privileges — least privilege drifts over time as features are added.
• Keep the WAF tuned: update rule sets, review what's being blocked, and investigate repeated blocks rather than ignoring them.
• Run tabletop exercises: walk through a "we're being probed" scenario so your team knows who triages the alert, who checks the code, and when to escalate to incident response.

Measure it

Track mean time to detect probing, the number of injection findings per release, and the percentage of database-backed endpoints covered by alerting. If those numbers improve quarter over quarter, your program is working.

Series wrap-up

Part 1 taught you to find injection flaws in your own applications using safe labs. Part 2 covered remediation — parameterized queries, least privilege, and layered controls. This part closes the loop: log the right things, alert on the right patterns, and keep testing so the flaw stays fixed. SQL injection is a solved problem technically; the remaining work is operational discipline.

WordPress Security Checklist

WordPress Security Checklist

Basic Checklist :

1.  Rename user Admin to something else.

2.  Change the ID field on the first user from 1 to something else.

3.  Enforce strong password requirements for all system users

4.  Don‟t let anybody but admins see available WP updates.

5.  Remove the ability for non-admins to modify theme files.

6.  Tweak the database so tables aren‟t prefixed with wp_.

7.  Don‟t use the MySQL root user to access the database.

8.  Limit the MySQL account used to the site database only.

9.  Restrict the MySQL account so it can‟t perform destructive actions (i.e. DROP,

etc.)

10. Give the MySQL account a very long, randomised password.

11. Don‟t allow the server‟s root user access via SSH. Use an account with SUDO

privileges instead.

12. Ensure all the secret key fields in wp-config.php are completed with 16-bit SHA

keys.

13. Disallow indexes on all site folders.

14. Hide the admin area.

15. Rename the wp-content directory to something else.

16. Block bad hosts and agents with blacklists.

17. Make any .htaccess files and wp-config.php non-writeable.

18. Make the admin area inaccessible outside of work hours (handle this one with care)

19. Schedule regular database backups.

20. Restrict the length of allowed URLs to 255 characters or less.

21. Require SSL connections on the admin area (if possible; this one has an on-cost attached)

22. If possible, install and run server-side antivirus software such as ClamAV.

23. Consider restricting the server‟s FTP service to only accept connections from certain, whitelisted IP addresses (only applicable if you have at least one static IP).

24. When deploy complete, consider stopping the server‟s FTP service completely.

You can always temporarily switch it on again if required.

25. If your web server is allowing proxying (for example, if you‟re load-balancing),

ensure it‟s not configured as an open HTTP proxy.

26. Remove any open SMTP proxies on your server.