 |
 |
|
|
|
|
|
|
23 September 2000 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Assignment #2 - Evaluate an Attack |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Assignment #3 - Analyze This |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Suspected Compromises |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Assignment #4 - Analysis Process |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Annex A - Field Descriptions |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
CISCO Secure IDS logs (field descriptions available in annex a) ARGUS Logs (field descriptions available in annex a) 1. Source of trace: Target Criticality = 5 The targets were DNS servers. The network information contained in the records and
the importance of DNS to our users makes the targets of this attack very critical Attack Lethality = 1 This detect is a probe. The only traffic exchanged appears to be a query. No
payload could be determined from logs available. System Countermeasures = 3 Target systems are well maintained and patched. Network Countermeasures = 5 Intrusion Detection Systems, well maintained firewall, router ACL’s, and a current
Security Policy. (5 + 1) - (3 + 5) = - 2 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
CISCO Secure IDS logs (field descriptions available in annex a)
There are network reconnaissance techniques which use the portmapper to gather information for future attacks. This can usually give enough information to compromise the host in question and gain root access. An example would be a buffer overflow targeted at a service such as rstatd running on the host. cve-1999-0008 and 27 other cve's came up on a search of "rpc + scan" 5. Attack mechanism: As stated previously, the source packets of this detect are crafted. A tool similar to NMAP may have been used, however NMAP is presently incapable of crafting a win size of 1028, which rules out this specific tool. It is probable that the attacker is targeting UNIX based systems, however, other Operating systems such as Microsoft NT would respond as well if listening on this port. Analysis of the Shadow report reveals that the same duplicate sequence numbers are used in the source packets. The Syn/Fin flags are set too, trying to evade Intrusion Detection Systems. This technique was successful in evading ARGUS as none of this activity was noted in those logs. The default IP & HOST filter was used on Shadow. Note the highlighted fields below. 06:57:50.734869 63.197.4.191.111 > host1.goodguys.com.111: SF 665720017:665720017(0) win 1028 06:57:50.760410 63.197.4.191.111 > host2.goodguys.com.111: SF 665720017:665720017(0) win 1028 (fingerprint of Synscan) Analysis of the CISCO Secure IDS logs confirm the activity, which correlates the ports, time, and IP addresses involved. These logs also indicate TCP responses from specific hosts. The highlighted CISCO Secure IDS logs at the beginning of this assignment indicate TCP connections from our hosts to the attacker. These are not as critical as first anticipated. The hosts that replied have TCP Wrappers installed. When connections are noted by the kernel to unprivileged ports, by unauthorized hosts, TCP resets are sent. This still provides some trivial information, however in a mass scan such as this, the attacker is more likely looking for an easy compromise related to RPC vulnerabilities and will not even look at responses such as resets. 6. Correlation: As discussed above in section 5, this probe was correlated with two independent logs. Generous amounts of information are available on the internet that address the use of remote procedure calls for reconnaissance or exploit. www.cisco.com/univercd/cc/td/doc/pcat/nerg.htm www.nswc.navy.mil/ISSEC/CID/ www.argus-systems.com/ Cert Advisory Sept 15th 2000 www.sans.org/newlook/resource/IDFAQ/trouble_RPCs.htm www.cert.org/advisories/CA-99-16-sadmind.html www.cert.org/advisories/CA-99-12-amd.html www.cert.org/advisories/CA-99-08-cmsd.html www.cert.org/advisories/CA-99-05-statd-automaountd.html NMAP Another detect was submitted by Del Armstrong (San Jose, 2000) that appears to have been generated by the same tool. He arrived at pretty much the same conclusion, but unfortunately, did not know which tool was used either. www.sans.org/y2k/practical/Del_Armstrong.htm 7. Evidence of active targeting: This detect was actively targeted at our network. Reponses were solicited. This was a probe. 8. Severity:
9. Defensive recommendation: It is difficult to stop these types of scans. Calling the Internic registered owner of the network to which host 63.197.4.191 belongs to see if they are aware of the objectionable traffic generating from their address range is the most profitable course of action. Perhaps it is a compromised host and more information about the originator of the traffic may be gained, or more knowledge of the tool used may be found. It is likely that this is a stolen or compromised account as the IP resolution indicates this is a dial-up account. Doing regular internal vulnerability audits with current signatures, and performing routine maintenance/patching/updating will lower chances of a successful probe. 10. Multiple choice test question: What fingerprint for this tool can best be derived from these log entries? 06:57:50.734869 63.197.4.191.111 > host1.goodguys.com.111: SF 665720017:665720017(0) win 1028 06:57:50.760410 63.197.4.191.111 > host2.goodguys.com.111: SF 665720017:665720017(0) win 1028 06:57:51.056561 63.197.4.191.111 > host3.goodguys.com.111: SF 665720017:665720017(0) win 1028 06:57:51.078469 63.197.4.191.111 > host4.goodguys.com.111: SF 665720017:665720017(0) win 1028 A. Syn/Fin flag set B. Window size is a constant 1028 C. Source and destination ports are equal D. All of the above. D is the correct answer. |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
CISCO Secure IDS logs (field descriptions available in annex a) Target Criticality = 4 The position of a legitimate attack against another organizations web server has
been taken to calculate Severity. Attack Lethality = 1 This was not a lethal attack, assuming that the test-cgi script is the one
described in CVE-1999-0070. This is more of a probe that could aid an attacker in compromising the server if the vulnerability exists. This is a well known vulnerability
and has had plenty of time to be addressed by vendors since 1996. For these reasons attack lethality is rated at 1. System Countermeasures = 0 There were no system countermeasures in place to disable the system administrator
from carrying out this suspected attack. Network Countermeasures = 5 Intrusion Detection Systems, well maintained firewalls, router ACL’s, and a current
Security Policy. (4 + 1) - (0 + 5) = 0 12:38:33.578264 205.158.26.242.www > 172.16.0.119.50321: P 7169:7605(436) ack 353 win 16384 4500 01dc 6f22 0000 3506 7d86 cd9e 1af2 E...o"..5.}..... |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
7th Shadow logs (field descriptions available in annex a) Target Criticality = 1 This third party attack did not target specific hosts within our network. It
actually did not actively target our addresses with any apparent malice intended. Attack Lethality = 1 As this was not targeted at our addresses with the intent to cause us damage, the
attack lethality is very low as well. System Countermeasures = 3 Target systems are well maintained and patched. Network Countermeasures = 5 Intrusion Detection Systems, well maintained firewalls, routers, and a current
Security Policy. Specifically, this attack does not cause collateral damage except to rob network bandwidth. Reconfiguration of border routers to drop the victim would be
an option. (1 + 1) - (3 + 5) = -6 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Assignment #2 - Evaluate an Attack |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Evaluate an Attack
Note the impossible ethernet MAC addresses, the fake three way handshake, repeating ID and use of the well known port 23 (telnet). ARP The next test tries to take advantage of a flaw in Microsoft’s older generic network interface card drivers. A computer using one of these Microsoft drivers will respond to packets coming from broadcast ether frame address of ff:ff:ff:ff:ff:ff if the NIC is in promiscuous mode. It should not however respond to an address of ff:00:00:00:00:00. It turns out that only the first octet is checked and if it is 255 or 0xff, the packet will be dropped unless the computer is in promiscuous mode. In this case, it is passed up the stack and processed accordingly. If the IP address is correct for the computer, it will be processed, and a response generated, effectively indicating that the computer is in promiscuous mode.
Interesting to note that SNORT translated the ARP requests into it’s own format and did not include ethernet header even though the –e option was included with the command execution. A TCPDUMP log, however, did include the ethernet headers and it can be seen that the ethernet address of the source is an odd number and represents a broadcast address. See www.netsys.com/macaddr.html for a list of manufacturer MAC addresses. Etherpings This test is aimed at older Linux and NetBSD kernels. It takes advantage of the fact that these older kernels did not look at the ethernet address when in promiscuous mode. A crafted packet containing a bogus ethernet address, but a valid IP address would be passed to the kernel and handled if the machine was in promiscuous mode. In normal operation this would never happen as the bogus ethernet address would ensure it was never looked at past layer two.
Snort received 45019 packets and dropped 30208(67.101%) packets. Note the crafted destination ethernet address, repeating ID and sequence number. ICMP Time Delta Test This test works on the premise that a computer operating in promiscuous mode is not afforded the speed advantage offered to computers using their hardware for dropping unwanted packets. AntiSniff will send very large amounts of data over the wire, destined to user configurable IP addresses. Every so often a response will be solicited from a targeted machine and delays in response time will indicate the kernel of the tested machine is under increased processing load which can indicate it is in promiscuous mode. Take for example that SNORT dropped 83% of packets destined to a different computer as indicated by a capture summary below. Snort received 1702874 packets and dropped 1422508(83.536%) packets Breakdown by protocol:
This is an example to show just how much more load the logging computer was under during this scan. There are four distinct phases used in determining latency as indicated by the headings before the log samples below. Echo Responses with no flooding
This tries to determine normal response times prior to putting the suspected promiscuous computer under increased load. During flooding of different types, AntiSniff sends a legitimate ping to the suspect computer. This is how it calculates the delta in latency during flooding. "66" packet flooding
According to AntiSniff documentation: SIXTYSIX creates packets that are comprised entirely of the hex value 0x66. This is designed to not be accepted by any non-promiscuous mode host yet create data that is logged and captured by most normal use network monitoring tools such as tcpdump, snoop, etc. No traffic was noted complying to this description within SNORT or TCPDUMP. TCP SYN flooding
This method of flooding is done to labour promiscuous sniffers that operate on state. The theory is that the sniffer will notice the initial syn packet and monitor for following session packets in order to track state. A system doing this type of stateful logging will become taxed quickly under this type of flood and if this is the case latency, will become evident. TCP flooding with three way handshake
This flood is similar to a syn flood, but goes one step further by completing the three way handshake using bogus IP addresses. This is done in the hopes of triggering more sophisticated IDS' and creating a scenario whereby they are taxed more heavily by having to log these entries and increasing latency which is detectable. Below is an example of a ping sent during flooding to calculate latency. The example below was obtained from a scan with larger values entered into the parameters for the scan, against a Linux RedHat 6.2 system.
Echo Test
The echo test uses UDP pings. The computer being flooded in this example does not listen on UDP port 7, and generated an ICMP type 3 message. Following this activity more flooding is initiated as noted above during the ICMP Latency tests. The reason for using UDP pings is to circumvent firewalls or other filtering devices that may drop ICMP responses from the targeted computer. Again, legitimate pings are noted within the floods to determine latency. PING DROP Test
Then more syn flooding...
with occasional latency checks
The ping drop test floods the target computer with ICMP pings in an attempt to measure latency by comparing consecutive response times. This is followed again by three way handshake flooding, syn flooding, 66 packet flooding, and ICMP pings intermixed. SNORT lost a large amount of traffic as indicated by the summary listed below. Snort received 76677 packets and dropped 72004(93.906%) packets Breakdown by protocol:
Through the above measures, it is possible to find compromised hosts or other eavesdroppers that are not authorized on the network. The below screenshots offer a glimpse of the software.
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Assignment #3 - Analyze This |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Suspected Compromises
2. Another Telnet attempt that appears to have been successful was from a cable modem user based in Minnesota. It is suspected that this was an administrator for the site. Based on analysis, it is assumed that this is a Military Network, due to the identification of targets of interest and availability of resources (i.e. numerous mail servers etc). This telnet session was successful and did not trigger the "TELNET-Login Incorrect" alarm, but a newer alarm "IDS08-TELNET-daemon-active". Telnet sends passwords in the clear and this host must now be assumed compromised since anyone between 24.25.111.117 and the host could have sniffed it.
3. FTP traffic from watched networks (AREL-NET Israel 212.179.0.0/16 and Computer Network Center Chinese Academy of Sciences 159.226.0.0/16) indicates many file transfers took place. This requires further investigation of the hosts involved. Correlation was done with the "FTP-bad-login" alarm generated. Reasoning is that if this rule existed from the day the sensor was installed, this would have triggered for all other FTP servers unless anonymous FTP is enabled, or every user had a valid account and made no errors during authentication. It is suspected that this rule was added at the same time as the above "TELNET-Login Incorrect" rule.
This situation does require more investigation. A definite transfer of data occurred between 212.179.101.218 and MY.NET.181.88. As stated above, either anonymous access is enabled (which should be dealt with in the security policy) or an account has been compromised. There are also indications that this host was used for IRC.
Dangerous Traffic 1. The suspected use of ICQ (noted by connections from 205.188.153.111 fes-d015.icq.aol.com on port 4000) by MY.NET.217.126. (2240 hits in 3 days) was noted. The logs indicate it was installed between the 1st Aug and 3rd Aug. The connection is active 24hrs per day, which indicates shared usage from this destination host. Perhaps it is used by shift workers and is a required service. None the less, running this opens a system to numerous exploits, as the following links will show: www.arcwebserv.com/jumpsite/icqattack.html home.t-online.de/home/TschiTschi/icq_dedrohungen.htm
2. The traffic to port 25 on MY.NET.100.230 is noteworthy. Time was taken to specify filters to alert us of traffic including the Computer Network Center Chinese Academy of Sciences. This requires more investigation of the suspect host. Why are connections from a suspect network being made, with such frequency, to this host? Authentication services and mail are being probed. What did the offender find out and why is this host connecting from high ephemeral ports back to the network of interest? It is interesting to see that this network is busiest during government work hours with a dip during lunchtime (Beijing is 11hrs behind EST).
3. The scan by MY.NET.5.37 to find hosts listening on port 5632 is intrusive. This destination port is associated with PCAnywhere. If it is running on the network, it should be monitored. PCAnywhere by default scans for other hosts on the network it is installed on when trying to make a connection (i.e. a udp 5632 broadcast). This is the case here as only the MY.NET.5.0/24 network was targeted.
4. The use of Napster by employees is another dangerous activity. Napster opens up shares on the host it is installed on. This software acts as both client and server applications in one. 5. "SMB name wildcard" packets were noted incoming on the network. No response to this activity was noted, but may have been present since we are only seeing traffic based on alarms. These types of packets should be dropped at the firewall. More information is available at: www.signaltonoise.net/library/cifs.htm
6. Telnet is active on this network. This should be replaced with Secure Shell. Recommendations 1. The SYN/FIN scans breached the firewall. A statefull filtering firewall should be put into service. This would eliminate large portions of log data (22.5% of traffic) and protect the network from malicious connection attempts and mapping via this method. Leaving the Snort rule in place would still allow monitoring for anomalies and internal probes of this nature. 2. Adjusting or enforcement of the acceptable security policy is needed to disallow ICQ, IRC, and Napster traffic. If these are deemed as necessary services by management then connections through a proxy server that is patched, monitored, and secured should be enforced. There was a large amount of activity related to monitored networks using these services. Generally, from experience in the field, these are not accepted services in corporate or government work environments. 3. Continued monitoring of the host MY.NET.1.3. This DNS server appears to be heavily loaded, but did not provide any other concerns. Perhaps load balancing may be required. Internal users could use the present secondary DNS server located at MY.NET.101.89 and external queries could be made to MY.NET.1.3. This enhances the security posture. 4. Shutting down Authentication Services (port 113) on computers that do not require it would be prudent. They have little value, slow connections down, and may provide account details for the machine. Unless they are required they should be edited out of the /etc/inetd.conf file. Numerous probes were done to servers running this service from networks of interest. 5. Employing the ACL's on the border router to drop traffic to port 53 except destined to the legitimate DNS server should be implemented. 6. The large quantity of ICMP traffic destined for MY.NET.140.9 indicates that there could have been a possible DOS attack against it. The policy for filtering ICMP incoming and outgoing should be reviewed. While it does not appear to have been of a magnitude that would have affected the operation of this host, it did comprise a large portion of the log data. 7. Reducing the number of mail servers would be prudent. Judging from the number of alarms present, the network has too many. Knowing the exact number of hosts on this Class B network, and their usage would clarify this. (The mail servers appear to be MY.NET.253.41 (1903 hits to port 25), MY.NET.253.42 (522 hits), and MY.NET.253.43 (582 hits). MY.NET.6.7 (41 hits) and MY.NET.6.7 (18 hits) appear to be smaller departmental mail servers. While there are theoretically 65534 hosts on this Class B network, a more accurate estimate on this sniffed segment is 5000 hosts. 8. SNMP Public Access strings were noted on the network. A suspected management device at MY.NET.101.192 is the destination of these packets. Generally speaking, having a Public Group Membership is considered a poor security practice. 9. To narrow the data down and aid in manageability, Snort rules should be tweaked. For instance, the "Wingate 8080 Attempt" signature could be removed (4% of traffic). Bid Ground Rules There were 52 individual hosts that triggered alarms originating from MY.NET.0.0/16. Theoretically, there is room for quite a large number of hosts (65534). Based on the fact that 18 Class C networks appeared, it is assumed that there are approximately 4572 hosts being monitored by these Snort sensors. If the alarm sensor was placed in an effective position than this count may prove to be an accurate number of hosts to aid in the bid process. It is also assumed that there are no Network Security Specialists presently employed on-site by this organization. The Bid On site monitoring should be conducted due to the sensitive nature of your companies business. A staff of one supervisor and three analysts have been identified as sufficient to handle up to 5000 hosts. They will aid present system administrators in enforcing a new security policy, written by our company, upon its acceptance. A Threat Risk Assessment will be presented prior to any policy change, and updated quarterly. In order to effectively monitor and maintain the confidentiality, integrity, and availability of data on this network, the following resources are initially required.
Recurring cost for first year extension:
Our company respectfully requests an answer to this bid by 1 October 2000. Regards, Christopher James French |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Analysis for assignment three was done using numerous tools. Due to the sheer amount of data present, and the awkward way in which it is presented, it was determined that another format was necessary to convert
it to that was more useable. |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Ports of Interest Hit by MY.NET.100.230 Pie Chart Find Duplicates Query Results |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
The Database in action |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Annex A |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||
|
Copyright
© 2000-2010 Whitehats.ca |
||
