text:
|Publication number
|Publication type
|Application number
|Publication date
|Dec 18, 2003
|Filing date
|Mar 20, 2003
|Priority date
|Mar 3, 2000
|Also published as
|Publication number
|Eran Reshef, Yuval El-Hanany, Gil Raanan, Tom Tsarfati
|Original Assignee
|Eran Reshef, Yuval El-Hanany, Gil Raanan, Tom Tsarfati
|Export Citation
|BiBTeX, EndNote, RefMan
|Patent Citations (5), Referenced by (97), Classifications (9), Legal Events (5)
|External Links: USPTO, USPTO Assignment, Espacenet
[0001] This is a continuation of application Ser. No. 09/800,090, filed Mar. 5, 2001, now pending.
[0002] This application is related to U.S. Pat. No. 6,311,978, entitled Method and System for Extracting Application Protocol Characteristics, issued Oct. 30, 2001, which application is hereby incorporated herein by reference in its entity.
[0003] A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.
[0004] The invention generally relates to the art of detecting security flaws with a web site, and in particular, to detecting vulnerabilities at the application level, as opposed to the network level.
[0005] It is often quite important to ensure that a web site or web application is secure from attack or perversion by hackers. In order to assist in this endeavor, network scanning tools exist which provide security management capabilities for network host computers or servers. One example of such a scanner is the Internet Scanner™ marketed by Internet Security Systems, Inc. of Atlanta, Ga., which product appears to be described in U.S. Pat. No. 5,892,903 to Klaus.
[0006] The shortcoming with network security products such as the Internet Scanner™ is that they only scan for vulnerabilities at the network level. The goal is to limit access to a web site to only designated protocols and services. To analogize, network-level security products can be thought of as a fence that forces access to the site only through a main gate, and network-level scanners seek to find the holes in the fence.
[0007] However, there also exists a need to ensure that a web site or web application is secure at the application level. Many web applications assume or depend that the application user is in fact executing a mobile agent of the application on the user's browser. However, a malicious user can overcome or modify the limitations or logic embedded in the mobile agent and send destructive or forged data to the web server. For example, one common type of web application is an online storefront wherein goods and services can be bought or sold over the Internet. A hacker should not be able to change the sale price of a product by manipulating the HTTP requests sent to the application program executing on a web server. A need therefore exists for an application-level scanner to identify application-level vulnerabilities. In other words, carrying on with the previous analogy, once the user is inside the gate it is important to identify ways in which the user may misbehave while on the premises.
[0008] Application level vulnerabilities have traditionally been discovered in a manner similar to looking for bugs in software—through a quality assurance or auditing process. Conventionally, this has been a completely manual process that can devour a significant amount of time. Not only does someone have to review the application line-by-line and understand the code intimately, they also have to try to imagine or anticipate potential security loopholes in the code. This is problematic in and of itself because many web developers lack the expertise and requisite knowledge to properly evaluate and correct application-level security flaws. This, coupled with the ever prevalent speed to market concern of getting new web applications on-line as fast as possible, makes human error in web development unavoidable. Worse yet, web applications are constantly changing and being upgraded while third party vendors are continually issuing patches that need to be implemented. In short, manual auditing processes to find application-level vulnerabilities are not very practical.
[0009] The invention seeks to provide a scanner for automatically detecting potential application-level vulnerabilities or security flaws in a web application. In the web environment, generally speaking, the application scanner analyzes the messages that flow (or would ordinarily flow) between a client browser and a server hosting the web application in order to discover the structure or elements of the application's interface with external clients. Then, based on a pre-defined set of hacking rules or techniques, the scanner mutates client requests in various ways, thereby generating exploits that will be unique for each web application. These exploits may then be used to attack the web application. The attack is monitored and the results evaluated and reported to the user.
[0010] According to one aspect of the invention a method is provided for detecting security vulnerabilities with an application implemented through a client-server architecture. The method comprises actuating the application in order to discover one or more application-level elements of the application's client-server interface; attacking the application by sending one or more client requests to the server in which the discovered elements have been mutated in accordance with pre-defined mutation rules; receiving server responses to the mutated requests and evaluating the responses in order to identify anomalous application activity.
[0011] According to another aspect of the invention a method is provided for detecting security vulnerabilities in a HTML-based web application installed on a web server or web application server. The method includes: traversing the application in order to discover and actuate links therein; analyzing messages that flow or would flow between an authorized client and the web server in order to discover elements of the application's interface with external clients and attributes of these elements; generating unauthorized client requests in which these elements are mutated; sending the mutated client requests, to the server; receiving server responses to the unauthorized client requests and evaluating the results thereof.
[0012] According to another aspect of the invention, a scanner is provided for detecting security vulnerabilities in a HTML-based web application installed on a web server or web application server. The scanner includes a crawling engine, an analysis engine, and an attack engine. The crawling engine traverses through the application in an automatic, manual, or interactive way in order to discover application links. The attack engine analyzes the messages that flow or would flow between an authorized client and the web server. The analysis is carried out in order to discover elements of the application's interface with external clients and attributes of these elements. Based on this information unauthorized client requests are generated in which the application interface elements are mutated. The attack engine sends the mutated client requests to the server; receives server responses to the unauthorized client requests and evaluates the results thereof.
[0013] The foregoing and other aspects of the invention will become more apparent from the following description of illustrative embodiments thereof and the accompanying drawings which illustrate, by way of example, the principles of the invention. In the drawings:
[0014]FIG. 1 is a process flow chart illustrating four major stages of operation provided by a web-application scanner according to one embodiment of the invention;
[0015]FIGS. 2A, 2B and 2C are system block diagrams showing the major software components of the web-application scanner illustrated in FIG. 1 in accordance with first, second and third methods of implementation, respectively;
[0016]FIGS. 3A, 3B, 3C, and 3D are flowcharts showing the major processing steps executed by the web-application scanner of FIG. 1 in each of the four stages of operation, respectively;
[0017]FIG. 4 exemplifies a security vulnerability that may arise in a web application due to a data parameter inherent in the application's external interface;
[0018]FIG. 5 exemplifies a security vulnerability that may arise in a web application due to a path parameter inherent in the application's external interface;
[0019]FIG. 6 is a schematic diagram of a data structure for storing the particulars of client-server transactions; and
[0020]FIG. 7 is a schematic diagram of an exploitation report.
[0021] 1. Overview
[0022] Referring to FIG. 1, the application scanner 10 of the illustrated embodiment employs four stages of operation: a crawl stage 100, an analysis stage 200, an attack stage 300, and a reporting stage 400. Due to the typically expected processing times each stage is preferably initiated manually, but the stages could be automatically actuated if desired.
[0023] In the crawl stage 100, the scanner 10 dynamically traverses through an entire web application or site and examines the application-level messages that flow (or would ordinarily flow) between a web server hosting a web-based application and a client browser operating in an intended or authorized way. This enables the scanner to discover the structure or elements of the application's interface with external clients, particularly the path and data parameters employed in the interface. Attributes of the path and data parameters, such as file names and data types are also extracted. Collectively, this provides a description of the application interface (the "application interface structure") 102. If desired, the operator of the scanner may also initiate customizable filters to reduce the crawl path and eliminate scanning any unnecessary or undesired levels, layers or links.
[0024] The analysis stage 200 comprises a detection phase 202 followed by a mutation phase 208. In the detection phase 202, the scanner 10 searches through the application interface structure 102 and, using a set of detection rules 204, identifies application-level messages that may be potentially vulnerable to various forms of "hacking". For example, the HTML <form> tag in a web server message may be associated with a numeric input field. In normal operation, the client browser would only accept a numeric input value. However, a hacker may potentially alter this to a non-numeric value when an HTTP request is generated to communicate the value of the field to the server. This minor change has the potential to freeze the application. By iterating through other such detection rules the scanner can thus produce a list of vulnerabilities 206 specific to the web application or web site.
[0025] In the mutation phase 208 the scanner 10 uses a set of mutation rules 210 to create mutated HTTP requests 212 such as just described above that will be used to test the web application or web site. The foregoing represents potential "hacks" into the web application or site arising specifically out of the design and structure of the web application or site. In addition, the scanner 10 also preferably includes pre-defined "long shot" rules 214 which are used to create HTTP requests based on published security flaws or vulnerabilities with hardware and/or software platforms that may be employed by the web application or site.
[0026] In the attack stage 300 the scanner 10 sends the mutated requests 212 to the site, receives the responses, and ranks the attack results by severity and success ratings. A security problem list 302 is thus generated. If desired, the operator may define the types of attacks to execute and perform them automatically or manually.
[0027] In the reporting stage 400 the scanner 10 generates a report 404 describing the foregoing auditing process. The scanner 10 preferably also provides a report 402 recommending fixes or other pertinent advice concerning each detected vulnerability. The scanner 10 can thus provide an organization with a repeatable and potentially cost-effective process for conducting application security audits.
[0028] 2. System Architecture
[0029]FIG. 2A shows the system architecture of the scanner 10 in accordance with one implementation method. The major software components comprise:
[0030] A control module 12 which controls all other components and communicates with each component.
[0031] A crawling engine 13 for crawling over or traversing some or all of the links in the target web site 40. The crawl engine can operate in one of three modes:
[0033] A proxy 14 that is responsible for communicating messages flowing between a web server 40 hosting the target web application or site and the scanner 10. Note that the scanner 10 may also operate in conjunction with a client browser 30, for instance, to inform the scanner as to which links of the web application should be followed, as described above. In this case, the proxy 14 is configured, as known in the art per se, to intercept messages flowing between the client browser 30 and web server 40 and forward them to the scanner for analysis. After analysis, the scanner 10 forwards the intercepted messages to the intended recipient device. The proxy 14 enables the monitoring of multiple client browsers, as shown in FIG. 2A.
[0034] A parsing engine 16, employed in the crawling stage 100, for parsing HTTP messages and the HTML language encapsulated therein in order to discover the application interface structure 102.
[0035] A database 18 for storing, among other things, the application interface structure 102 and the site's vulnerabilities 206, the various expert rules 204, 210, 214, the mutated requests 212 and the security problem list 302.
[0036] An analysis engine 20, employed in the analysis stage 200, for analyzing the application interface structure 102 as stored in the database 18, applying the detection and mutation rules 204 and 210, and generating the mutated HTTP requests 212.
[0037] An attack engine 22, employed in the attack stage 300, for attacking the web application by sending the mutated requests 212 generated in the analysis stage 200 and scoring the result.
[0038] A graphic user interface server (GUI) 24 that, in the illustrated embodiment, is a web-based GUI.
[0039] A license manager 25 for validating any request going from the scanner 10 to the web site 40 in order to ensure that only licensed web sites will be evaluated.
[0040] It should be noted that the proxy 14 is just a means to access the web server 40 and could be eliminated so that the scanner 10 communicates directly with the web server 40. This alternative method of implementation is shown in FIG. 2B. In this case the scanner functions as a proprietary client or browser and includes a user interface in place of the GUI server 24.
[0041] In another alternative method of implementation shown in FIG. 2C, the proxy 14 could be replaced with a browser plug-in as known in the art per se. In this case multiple plug-ins would be required for monitoring communications from multiple browsers.
[0042] 3. Crawl Stage
[0043] The crawl stage 100 may be executed in an automated mode or manual mode. In the automated mode, the crawling engine 13 automatically scans the whole web application or site and discovers all the links or URL's associated therewith. In the process, the scanner identifies the application interface elements associated with each link and stores this information in the database 18.
[0044] The processing steps carried out by the crawling engine 13 are shown in the flow chart of FIG. 3A. The flowchart references two data structures, WorkQueue and LinkDB, which are stored in the database 18. LinkDB is a log which stores the links that were traversed, as well as the application interface elements associated with each link and the attributes thereof. WorkQueue is temporary data structure for holding all links extracted from a particular web page or server message until such time as the link is processed and logged in LinkDB.
[0045] Initial step 110 requests the operator to provide the starting or root URL to the scanner 10. This is stored in WorkQueue and LinkDB.
[0046] Step 112 sets up a conditional loop for testing whether or not the WorkQueue is empty. If so, the crawl stage 100 has terminated and the operator may initiate the analysis stage 200.
[0047] Step 114 retrieves a link from WorkQueue. The link under consideration is tested at step 116 to see if it matches a pre-defined filter. The filter may be based on the site's domain name so as to prevent the scanner 10 from leaving the web application or site. Other types of filters may be also be employed, such as URL object type matches. For example, a filter based on a '.jpeg' extension may be established to prevent the scanner from following image links. The types of filters may vary and will be application dependent. In the event the link under consideration matches an applicable filter, it is ignored and control passes to step 112.
[0048] Step 118 tests whether a web page or portion thereof under consideration (arising from a retrieved link) requires user input. This may occur, for example, when the retrieved web page includes a form. In this event, in order to continue traversing the web application or site, the crawling engine 13 provides fictitious values as input, step 120A, based on the field or data type. In the alternative (as indicated by the dashed flow control line), the engine 13 can operate in the interactive mode wherein the web page is displayed to the operator for manual input, step 120B. (Note that in the first pass of the loop set up by step 112 no web page has been loaded by the scanner, but in subsequent passes a web page or portion thereof is under consideration.)
[0049] At step 122, the link under consideration ("nextLink" in FIG. 3A) is actuated and an HTTP request is generated for transmission to the web server. For this purpose the crawling engine 13 functions as an authorized or "correct" client browser as known in the art per se in order to send an authorized or "correct" HTTP request. The web server replies with an HTTP and HTML response that is received by the scanner and loaded into memory. The server response represents a web page or portion thereof pointed to by the actuated link.
[0050] The HTTP request is logged in LinkDB. Alternatively, the salient attributes of the HTTP request are stored so that it can be reconstructed at a later time. In particular, any HTTP method, e.g., GET or POST, the requested link or URL, and the method's data parameters are noted.
[0051] The HTTP and HTML response is preferably also logged. Using the parsing engine 16, the response is parsed as known in the art per se to extract any path parameters or links encapsulated therein. Provided the extracted links have not already been processed, i.e., not already stored in LinkDB, they are stored in WorkQueue and LinkDB. The response is also parsed to identify other application interface elements (in addition to the encapsulated links) such as data parameters. Attributes of the path and data parameters are also extracted and logged in LinkDB. For example, the parser identifies any input or hidden fields such as those associated with HTML forms. The identity and nature of the field, including its name, type and field length is extracted and logged in LinkDB. Using a similar procedure, the scanner also check for forms, fields, fixed fields, hidden fields, menu options, DOM components, etc. The nature and attributes of these elements are written into LinkDB. The parser also identifies any other actions available in the web document/response. These include, for example, a "submit" command on an HTML form, a "search" command, or other application-level protocols. These additional actions encapsulated within the response are also extracted and stored in LinkDB. In a similar manner the parsing engine 20 identifies any other request-generating tags or the attributes thereof. By traversing through the links within the application the end result is a description of the application's interface with external clients.
[0052] In the manual mode, the operator can "walk through" the web application or site using the client browser 30. This allows the operator to manually specify the application links that he or she wishes to traverse. The requests from the browser are directed to the proxy 14 which forwards them onto the scanner 10 for analysis and logging. Once this process is accomplished the scanner forwards the request to the web server via the proxy. The web server receives the request, activates the needed application components, and returns the response to the proxy. The proxy passes the response to the scanner for analysis and stores any discovered interface elements and the attributes thereof into the database 18. In this way the scanner can discover the structure of the portion of the application interface that was encountered during the operator's session with the scanner. The scanner can then attack and test the application based on this information.
[0053] 4. Analysis Stage
[0054] 4.1. Detection Phase
[0055] The scanner 10 enables the detection and assessment of security vulnerabilities within the web site. As described previously, there are two major categories of web site vulnerabilities. The first major category is unknown or application specific vulnerabilities—security holes within the site's own specific application. These arise from the application-level interface with external clients and include, but are not limited to, path vulnerabilities and parameter vulnerabilities. These are identified in the detection phase 202 by rules 204 (FIG. 1). The second major category is known vulnerabilities—security flaws within 3rd party applications such as web servers, operating systems and packaged or off-the shelf software platforms. Since these vulnerabilities are not application-specific they are not identified in the detection phase 202. Instead, the long-shot rules 214 (FIG. 1) handle these types of vulnerabilities.
[0056] 4.1.1. Parameter Vulnerabilities
[0057] Web applications interface with external clients using a multitude of parameters. These parameters are used to call, initiate or trigger various functions, actions or logic of the application. Each such parameter may have a number of attributes such as data type, length, visibility, and value. The web application may be developed in any one of a vast option of languages (such as Perl, PHP, Java and many others) and may use one or more integration methods (CGIs, servlets, server APIs, etc.). Irrespective of implementation, the application may expect to receive the "correct" parameter containing the "correct" type and value ranges. Any deviation from the expected parameters might potentially lead to erroneous application activity and a wide variety of potential hazards.
[0058] To demonstrate parameter vulnerabilities, an example of online theft is shown in FIG. 4. In this example a form 280 for purchasing a product contains the product price in a hidden parameter 282. The left part of the figure shows the "appropriate" URL including price parameter that the browser creates from the form 280 leading to the correct acquisition of the product for the sum of $149.99. The link including URL-encoded price parameter would ordinarily be sent in an HTTP request 281 to the server as the path and data parameters of the GET method. The scanner 10 is capable of identifying such a vulnerable HTTP request and changing the value of the vulnerable parameter 282 to create a mutated HTTP request 284 in which the value of the price parameter is changed to 1.99. The security flaw is exposed as a result of sending the mutated request to the web server, resulting in the ability to buy the product at any given price (in this case $1.99).
[0059] While a hidden field is one kind of parameter, other examples of parameters include, but are not limited to:
[0060] Input fields associated with HTML forms
[0061] Query parameters that are being passed in the URL (and not in an HTML form)
[0062] HTTP headers
[0063] Cookie values
[0064] It is specifically within the scope of the present application to vary the particular parameters detected by the scanner, especially in view of the rapid introduction of new Internet communication standards.
[0065] 4.1.2. Path Vulnerabilities
[0066] The file system shown by the web server to the clients is vulnerable to unauthorized access. Basically, any place in the file system that is left unguarded may serve as an illegal entry point into the system. The possibility of accessing unattended files and directories enables reading old and backup files, listing of directory content and access to hidden applications. These types of vulnerabilities are referred to as path vulnerabilities.
[0067] Access to a hidden part of the file system and a severe breach of security arising from it can be seen in the following example shown in FIG. 5. In this example an old version of a CGI script was left in the file system for backup purposes but its access attributes were not changed to block access. The figure shows an untampered URL 290 that allows normal access to the application via a login.pl CGI script. However, this URL can be identified as a CGI link and a ".bak" suffix may be added to it to create a tampered URL 292. Sending the tampered URL to the web server in a mutated HTTP request exposes the source of the backup file that was left in that directory. The ability to view the source of the script can be a significant security flaw since it may lead to full exposure of the site's vulnerabilities.
[0068] 4.1.3. Long-Shot Vulnerabilities
[0069] Long-shot vulnerabilities are security flaws that generally exist within web servers, application servers and other applications interacting with client browsers. The vulnerabilities are published by a large number of organizations (e.g. BugTraq by SecurePoint.COM, Security Focus) and can be accessed by anybody with Internet access. After the hacker checks the vulnerabilities, he or she can scan through a web site trying to find places where the vulnerability has not been blocked or a patch has not been applied. The scanner 10 preferably maintains an updated list of known vulnerabilities in the long shot rules 214. During the mutation phase the scanner enumerates the relevant vulnerabilities according to the type of web server, application server and other third party applications identified by the operator, thus verifying that the known holes in the system are blocked.
[0070] 4.1.4. Processing Steps
[0071] The processing steps carried out by the analysis engine 20 during the detection phase 202 are shown in the flowchart of FIG. 3B.
[0072] At initial step 220 the analysis engine 20 collects pertinent information about the web server hardware and software platforms from the operator. Alternatively, this data can be extracted automatically based on fingerprints in a server response.
[0073] At step 222, the analysis engine 20 scans the LinkDB log in order to match each client request with a server response from which the request was generated. (Recall that each client request is generated from a prior server message.) The server response provides information about the attributes of the data parameters and path parameters used to interface with the web application. This information is used to mutate the previously stored request as described in greater detail below. A matched request and response pair is referred to herein as a "transaction" and stored in a transaction file.
[0074] A simplified example of a transaction file is shown in FIG. 6. Each record 294 in the file, which may be constructed as an indexed linked list, comprises:
[0075] a transaction ID 294A;
[0076] the original authorized or correct HTTP request 294B (or reference to it in the LinkDB);
[0077] the original HTTP+HTML response 294B (or reference to it in the LinkDB);
[0078] mutated HTTP request 294D;
[0079] HTTP+HTML response resulting from the mutated request ("mutated response") 294E;
[0080] a list 294F of changed application interface elements, including element type (i.e., path or parameter), element name/ID, original value, and mutated value;
[0081] fired rules 294G (as described in greater detail below); and
[0082] attack results 294H (as described in greater detail below).
[0083] A conditional loop is established at step 224 for iterating through all the transactions identified in the previous step. When all transactions have been processed the detection phase 202 has terminated and the analysis engine 20 may begin executing the processing steps 242-260 associated with the mutation phase 208.
[0084] At step 226 one transaction is read or retrieved from the transaction file. The analysis engine then iterates through all the detection rules 204 to see if any of them apply to, or are "fired" by, the transaction under consideration. Step 228 establishes a nested conditional loop for this purpose. In the nested loop, steps 230 and 232 apply or test one of the detection rules 204 against the transaction under consideration. Representative detection rules include, but are not limited to, identification of transactions that incorporate: (a) a hidden field; (b) a numeric field; (c) a text field; (d) a command; (e) user-selectable input options; (f) a "/scripts" directory in the URL; (g) a "/script/[command names].cgi" in URL, where [command names] are various pre-defined guesses. Rules (a)-(e) are examples of parameter vulnerability detection rules and rules (f)-(g) are examples of path vulnerability detection rules. If the rule is true or "fired", e.g., the transaction involves a hidden field, the analysis engine updates field 294G in the corresponding transaction file record 280 with the ID of the fired rule. At the end of the detection phase, the transaction file will include a list of detected rules (the "detected list").
[0085] In practice, because the detection rules for each type of parameter tend to have a similar structure, they can be organized in an SQL database. This makes it convenient to search for multiple rules in a single SQL query in steps 230 and 232.
[0086] 4.2. Mutation Phase
[0087] In the mutation phase 208, the potential security vulnerabilities itemized in the detection list are evaluated and one or more mutations is generated for each detected vulnerability based on the mutation rules. These represent exploits that are unique to the application. The types of mutations correspond to the types of detection rules. An example of this is set out in Table 1.
TABLE 1 Detection Rule Fired By: Mutation Rule Text field parameter Change parameter value to %00 (NULL) Increase string length beyond maxlength attribute Numeric field parameter Increment parameter value Decrement parameter value Multiply parameter value by −1 Change parameter value to %00 (NULL) Change parameter value to text type SQL query parameter Change value to 'show' Change value to 'search' Change value to 'delete' Change value to 'edit' Parameter name = 'file' Change value to '/boot.ini' Change value to '/etc/passwd' Path parameter Append '˜' to path Append '.sav' to path Append '.bak' to path Append '.old' to path Break path into sub-paths (e.g., a/b/c.html will generate: /c.html; and /a/c.html)
[0088] The foregoing are just representative detection and mutation rules and it is specifically within the scope of the invention to implement a wide variety of rules.
[0089] The processing steps carried out by the analysis engine 20 during the mutation phase 208 are shown in the flowchart of FIG. 3B. Step 242 establishes a conditional loop for iterating through the transaction file and the list of detected vulnerabilities embedded therein. For each transaction, step 250 retrieves the mutation rules 210 associated with each detection rule that was fired relative to that transaction. Based on these mutation rules, step 252 creates one or more mutated HTTP requests 212 for the transaction. The mutated requests are stored a separate data structure termed AttackList and referenced in field 294D of the transaction file.
[0090] Step 260 adds additional unauthorized HTTP requests to AttackList based on the non-application specific long shot rules 214.
[0091] 5. Attack Stage
[0092] The result of the prior stages is a list of mutated requests or exploits (stored in AttackList) that can potentially cause security errors within the application. The mutated requests may be initiated automatically or manually during the attack stage 300 to evaluate the real threat that the potential vulnerabilities pose. Since the attack list can be quite large, the attack engine 22 preferably grants the operator the ability to select the general types of vulnerabilities to execute, or specific attacks to filter out.
[0093]FIG. 3C shows the processing steps carried out by the attack engine 22 in the automated mode. Step 310 sets up a conditional loop for iterating through the AttackList. Step 312 determines whether a particular mutated request has been filtered out. At step 314 a mutated request on the attack list is sent to the application and the server reply is received at step 316 and stored or referenced in field 294E of the transaction file. At step 320, the attack engine 20 analyzes the response received from the application and a success rating and severity are assigned to the potential vulnerability. This is stored in field 294H.
[0094] The success rating is preferably based on the recognition of certain keywords in the response. For example, the status line of the HTTP response may include a 4xx result that indicates some kind of error. Alternatively, the application may send a web page back in which the keyword "error", "sorry" or "not found" appears. In these cases the application appears to have withstood the attack since an error was trapped in the mutated client request. However, if these pre-defined keywords are not present, then an assumption is made that the attack was successful. In this manner, any anomalous activity of the application or the lack thereof can be used to evaluate the success or failure of an attack.
[0095] The attack score is preferably based on an a priori success probability assigned to each mutation rule. The lower the probability of the vulnerability, the higher the score given to the attack results, unless the attack appears to be unsuccessful in which case it has no score or a zero score.
[0096] In the manual attack mode, the scanner preferably enables the operator to browse through the different exploits via their associated links or URLs and select particular ones to attack the application with. In this case the success or failure of the attack can be manually ascertained.
[0097] In addition to analyzing the attack responses, the scanner preferably also automatically locates and marks any potentially harmful information in the server responses that may potentially be used to hack into server-side systems. This information, which is based on the recognition of certain tags and/or keywords, is displayed in a "content review" page and may include hidden web page elements such as suspicious text comments, JavaScript code and CGI parameters. Hackers can use these elements to hack into a site by viewing the source code, which may yield important pieces of information about the site that may assist in their hacking attempts.
[0098] 6. Reporting Stage
[0099]FIG. 3D shows the processing steps in the reporting stage 400. At step 410 attack results having scores above a specified threshold are reported to the operator. At step 412 the operator is preferably given the option of adding or deleting attacks to or from the report. An example report 450 provided through the web-based GUI 24 is shown in FIG. 7. In the report the original link to which a client request is shown and the mutation to the URL, if readily apparent, is shown in bold (or red). The results of the attack, stored in the transaction file, are preferably viewable by engaging the "View Attack Result" hyperlink. The "Name" column describes the attack according to predefined categories."
[0100] The scanner preferably includes an expert knowledge base for providing advice upon ways of correcting the security flaws exposed by the mutated requests. The suggestions made by knowledge base comprise changes to the site's software or available patches to the problem in cases of third-party platforms. Pressing the "report" icon in FIG. 7 preferably triggers this.
[0101] 7. Variants
[0102] In the illustrated embodiment there are two distinct processes for discovering the structure of the web application's interface with external clients, i.e., the crawl stage, and identifying the elements of the application interface which are susceptible of mutation, i.e., the detection phase of the analysis stage. This is convenient because the crawl stage is useful for determining the application's security policy as described in greater detail in commonly assigned application Ser. No. 09/345,920. However, those skilled in the art will readily appreciate that it is possible to collapse the two processes together in order to identify mutable application interface elements in a single pass.
[0103] Furthermore, in the illustrated embodiment each stage of operation is executed prior to the next stage being initiated. In alternative embodiments, the stages of operation may be compacted together and executed sequentially per transaction. For example, a loop may be set up in which, as soon as the crawling engine retrieves a new link, the mutated client request is generated, the web site is attacked and the result evaluated. In still further variant, the scanner can be constructed as a multi-threaded application in which each of the stages of operation are executed in parallel. Numerous other modifications and variations may also be made to the embodiments described herein without departing from the spirit or scope of the invention.
|Cited Patent
|Filing date
|Publication date
|May 4, 1936
|Mar 28, 1939
|American Box Board Co
|Title not available
|Title not available
|Title not available
|Title not available
|Citing Patent
|Filing date
|Publication date
|Jan 18, 2002
|Oct 16, 2007
|Cigital, Inc.
|System and method for identifying and eliminating vulnerabilities in computer software applications
|Oct 10, 2003
|Sep 22, 2009
|Citrix Systems, Inc.
|Methods and apparatus for providing access to persistent application sessions
|Mar 8, 2004
|Oct 13, 2009
|International Business Machines Corporation
|Method, system and computer program product for computer system vulnerability analysis and fortification
|May 1, 2003
|Nov 3, 2009
|Protegrity Corporation
|Method for the automatic setting and updating of a security policy
|Jul 28, 2004
|Nov 10, 2009
|Orbital Data Corporation
|Wavefront detection and disambiguation of acknowledgments
|Feb 18, 2004
|Nov 10, 2009
|Citrix Systems, Inc.
|Inferencing data types of message components
|Jul 28, 2004
|Dec 8, 2009
|Orbital Data Corporation
|TCP selective acknowledgements for communicating delivered and missed data packets
|Dec 7, 2004
|Jan 12, 2010
|Hewlett-Packard Development Company
|Automated user interaction in application assessment
|Jul 28, 2004
|Feb 2, 2010
|Citrix Systems, Inc.
|Flow control system architecture
|Jul 28, 2004
|Apr 13, 2010
|Oribital Data Corporation
|Early generation of acknowledgements for flow control
|Sep 30, 2004
|May 4, 2010
|Citrix Systems, Inc.
|Method and apparatus for reducing disclosure of proprietary data in a networked environment
|Aug 3, 2006
|May 18, 2010
|Citrix Systems, Inc.
|Method and appliance for using a dynamic response time to determine responsiveness of network services
|Sep 30, 2004
|Jun 29, 2010
|Citrix Systems, Inc.
|Method and apparatus for associating tickets in a ticket hierarchy
|Aug 1, 2006
|Jul 27, 2010
|Hewlett-Packard Development Company, L.P.
|Integrated crawling and auditing of web applications and web content
|Sep 29, 2003
|Nov 23, 2010
|Method and apparatus for real-time security verification of on-line services
|Oct 28, 2005
|Nov 30, 2010
|Ntt Docomo, Inc.
|Terminal control apparatus and terminal control method
|Mar 12, 2007
|Dec 14, 2010
|Citrix Systems, Inc.
|Systems and methods for configuring flow control of policy expressions
|Mar 12, 2007
|Dec 14, 2010
|Citrix Systems, Inc.
|Systems and methods for configuring handling of undefined policy events
|Mar 12, 2007
|Jan 4, 2011
|Citrix Systems, Inc.
|Systems and methods for providing structured policy expressions to represent unstructured data in a network appliance
|Oct 1, 2004
|Jan 4, 2011
|Citrix Systems, Inc.
|Method and apparatus for assigning access control levels in providing access to networked content files
|Mar 12, 2007
|Jan 11, 2011
|Citrix Systems, Inc.
|Systems and methods for using object oriented expressions to configure application security policies
|Oct 1, 2004
|Jan 11, 2011
|Citrix Systems, Inc.
|Method and apparatus for providing policy-based document control
|May 28, 2003
|Feb 1, 2011
|Kavado, Inc.
|Application layer security method and system
|Oct 19, 2007
|Apr 12, 2011
|Citrix Systems, Inc.
|Systems and methods for managing cookies via HTTP content layer
|Apr 24, 2009
|Jun 28, 2011
|Citrix Systems, Inc.
|Method of determining path maximum transmission unit
|Sep 29, 2009
|Aug 30, 2011
|Citrix Systems, Inc.
|Inferencing data types of message components
|Oct 21, 2005
|Sep 20, 2011
|Citrix Systems, Inc.
|Method and system for verification of an endpoint security scan
|Mar 1, 2006
|Nov 22, 2011
|Citrix Systems, Inc.
|Method and system for assigning access control levels in providing access to networked content files
|Sep 21, 2009
|Dec 13, 2011
|Citrix Systems, Inc.
|Methods and apparatus for providing access to persistent application sessions
|Jan 26, 2009
|Jan 3, 2012
|Citrix Systems, Inc.
|Systems and methods for fine grain policy driven cookie proxying
|Apr 25, 2006
|Apr 17, 2012
|Hewlett-Packard Development Company, L.P.
|Network management and administration
|Apr 2, 2010
|Jul 24, 2012
|Citrix Systems, Inc.
|Method and appliance for using a dynamic response time to determine responsiveness of network services
|Jul 28, 2004
|Jul 31, 2012
|Citrix Systems, Inc.
|Transaction boundary detection for reduction in timeout penalties
|Jul 28, 2004
|Aug 7, 2012
|Citrix Systems, Inc.
|Automatic detection and window virtualization for flow control
|Sep 25, 2009
|Sep 4, 2012
|Citrix Systems, Inc.
|Wavefront detection and disambiguation of acknowledgements
|May 16, 2005
|Sep 11, 2012
|Hewlett-Packard Development Company, L. P.
|Secure web application development environment
|Mar 12, 2007
|Sep 18, 2012
|Citrix Systems, Inc.
|Systems and methods of using packet boundaries for reduction in timeout prevention
|Jan 24, 2006
|Oct 2, 2012
|Whitehat Security, Inc.
|System for detecting vulnerabilities in web applications using client-side application interfaces
|May 19, 2010
|Oct 9, 2012
|Citrix Systems, Inc.
|Method and apparatus for associating tickets in a ticket hierarchy
|Dec 9, 2009
|Nov 13, 2012
|Samuels Allen R
|Flow control system architecture
|Aug 12, 2011
|Nov 13, 2012
|Citrix Systems, Inc.
|Method and system for verification of an endpoint security scan
|Oct 9, 2009
|Dec 25, 2012
|Citrix Systems, Inc.
|Systems and methods for configuring policy bank invocations
|Sep 23, 2011
|Jan 8, 2013
|Citrix Systems, Inc.
|Method and system for assigning access control levels in providing access to networked content files
|May 15, 2009
|Jan 29, 2013
|Frederick Young
|Web application vulnerability scanner
|Sep 28, 2007
|Feb 5, 2013
|Whitehat Security, Inc.
|Automatic response culling for web application security scan spidering process
|Aug 3, 2006
|Mar 5, 2013
|Citrix Systems, Inc.
|Systems and methods for using a client agent to manage HTTP authentication cookies
|Oct 28, 2009
|Apr 2, 2013
|Citrix Systems, Inc.
|TCP selection acknowledgements for communicating delivered and missing data packets
|Mar 12, 2007
|Apr 30, 2013
|Citrix Systems, Inc.
|Systems and methods for stochastic-based quality of service
|Mar 12, 2007
|May 7, 2013
|Citrix Systems, Inc.
|Systems and methods for additional retransmissions of dropped packets
|May 21, 2010
|Jun 11, 2013
|Citrix Systems, Inc.
|Early generation of acknowledgements for flow control
|Apr 11, 2007
|Sep 3, 2013
|Hewlett-Packard Development Company, L.P.
|Apparatus and method for performing dynamic security testing using static analysis data
|Nov 8, 2006
|Sep 10, 2013
|Citrix Systems, Inc.
|Method and system for dynamically associating access rights with a resource
|Aug 31, 2012
|Oct 8, 2013
|Citrix Systems, Inc.
|Wavefront detection and disambiguation of acknowledgements
|Aug 3, 2006
|Oct 15, 2013
|Citrix Systems, Inc.
|Systems and methods for using a client agent to manage HTTP authentication cookies
|Feb 11, 2005
|Oct 22, 2013
|Hewlett-Packard Development Company, L.P.
|System and method for testing web applications with recursive discovery and analysis
|Sep 30, 2011
|Oct 29, 2013
|International Business Machines Corporation
|Web application exploit mitigation in an information technology environment
|Sep 30, 2004
|Dec 17, 2013
|Citrix Systems, Inc.
|Method and apparatus for providing authorized remote access to application sessions
|Nov 30, 2011
|Dec 31, 2013
|Whitehat Security, Inc.
|Using fuzzy classification models to perform matching operations in a web application security scanner
|Mar 12, 2007
|Jan 14, 2014
|Citrix Systems, Inc.
|Systems and methods for configuring policy bank invocations
|Aug 17, 2011
|Apr 8, 2014
|Citrix Systems, Inc.
|Inferencing data types of message components
|Jan 26, 2009
|Jul 1, 2014
|Citrix Systems, Inc.
|Systems and methods for proxying cookies for SSL VPN clientless sessions
|Jun 14, 2012
|Sep 2, 2014
|Citrix Systems, Inc.
|Automatic detection and window virtualization for flow control
|Dec 27, 2011
|Oct 14, 2014
|Citrix Systems, Inc.
|Systems and methods for multi-level tagging of encrypted items for additional security and efficient encrypted item determination
|Jan 2, 2013
|Oct 14, 2014
|Whitehat Security, Inc.
|Automatic response culling for web application security scan spidering process
|Aug 27, 2012
|Nov 18, 2014
|Whitehat Security, Inc.
|System for detecting vulnerabilities in applications using client-side application interfaces
|Aug 3, 2006
|Jan 27, 2015
|Citrix Systems, Inc.
|Systems and methods for using an HTTP-aware client agent
|Oct 3, 2013
|Apr 14, 2015
|Citrix Systems, Inc.
|Wavefront detection and disambiguation of acknowledgments
|Jun 17, 2014
|Jun 16, 2015
|Citrix Systems, Inc.
|Systems and methods for proxying cookies for SSL VPN clientless sessions
|Apr 3, 2013
|Jun 30, 2015
|Citrix Systems, Inc.
|Systems and methods for additional retransmissions of dropped packets
|Aug 2, 2013
|Aug 4, 2015
|Lookout, Inc.
|Assessing an application based on application data associated with the application
|Apr 29, 2003
|Nov 4, 2004
|Cole Eric B.
|Methodology, system and computer readable medium for rating computer system vulnerabilities
|Nov 20, 2003
|Feb 17, 2005
|Yuval Ben-Itzhak
|Method for the automatic setting and updating of a security policy
|Jul 28, 2004
|Mar 17, 2005
|Samuels Allen R.
|Wavefront detection and disambiguation of acknowledgments
|Jul 28, 2004
|Mar 24, 2005
|Samuels Allen R.
|TCP selective acknowledgements for communicating delivered and missed data packets
|Oct 10, 2003
|Apr 14, 2005
|Pedersen Bradley J.
|Methods and apparatus for providing access to persistent application sessions
|Dec 7, 2004
|Jun 16, 2005
|Caleb Sima
|Automated user interaction in application assessment
|Sep 29, 2003
|Jul 21, 2005
|Method and apparatus for real-time security verification of on-line services
|Mar 8, 2004
|Sep 8, 2005
|International Business Machiness Corporation
|Method, system, and computer program product for computer system vulnerability analysis and fortification
|Feb 11, 2005
|Nov 10, 2005
|Caleb Sima
|System and method for testing web applications with recursive discovery and analysis
|Apr 26, 2005
|Nov 24, 2005
|Watchfire Corporation
|Method and system for website analysis
|Sep 22, 2004
|Mar 23, 2006
|International Business Machines Corporation
|Network threat risk assessment tool
|Oct 28, 2005
|May 11, 2006
|Ntt Docomo, Inc.
|Terminal control apparatus and terminal control method
|Jan 24, 2006
|Aug 31, 2006
|Whitehat Security, Inc.
|System for detecting vulnerabilities in web applications using client-side application interfaces
|Apr 25, 2006
|Nov 2, 2006
|Smith Richard J
|Network management and administration
|May 16, 2005
|Nov 16, 2006
|S.P.I. Dynamics Incorporated
|Secure web application development environment
|Aug 1, 2006
|Dec 14, 2006
|Caleb Sima
|Interactive web crawling
|Nov 18, 2010
|Frederick Young
|Web Application Vulnerability Scanner
|Aug 23, 2012
|Abhishek Chauhan
|Inferencing data types of message components
|Dec 22, 2011
|Jun 27, 2013
|International Business Machines Corporation
|Detection of second order vulnerabilities in web services
|Mar 26, 2012
|Jun 27, 2013
|International Business Machines Corporation
|Detection of second order vulnerabilities in web services
|Jul 31, 2012
|Jul 25, 2013
|International Business Machines Corporation
|Dynamically scanning a web application through use of web traffic information
|Jan 24, 2012
|Jul 25, 2013
|International Business Machines Corporation
|Dynamically scanning a web application through use of web traffic information
|Aug 2, 2013
|Nov 28, 2013
|Lookout Inc.
|Assessing a data object based on application data associated with the data object
|Mar 15, 2005
|Sep 29, 2005
|Netcraft Ltd
|Security component for use with an internet browser application and method and apparatus associated therewith
|Jan 25, 2006
|Aug 3, 2006
|Whitehat Security Inc
|System for detecting vulnerabilities in web applications using client-side application interfaces
|Jul 31, 2007
|Feb 7, 2008
|Raymond Kelly
|Interactive web crawling
|Jan 15, 2014
|Jul 24, 2014
|Beyondtrust Software, Inc.
|Systems and methods for identifying and reporting application and file vulnerabilities
|U.S. Classification
|International Classification
|Cooperative Classification
|European Classification
|Feb 9, 2005
Owner name: WATCHFIRE CORPORATION, CANADA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SANCTUM LTD.;REEL/FRAME:015687/0308
Effective date: 20040824
|Oct 24, 2007
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:WATCHFIRE CORPORATION;REEL/FRAME:020004/0204
Effective date: 20071017
|May 24, 2010
Owner name: TREND MICRO INCORPORATED,JAPAN
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:INTERNATIONAL BUSINESS MACHINES CORPORATION;REEL/FRAME:024424/0949
Effective date: 20100331
|Dec 27, 2010
|Fee payment
Year of fee payment: 4
|Dec 26, 2014
|Fee payment
Year of fee payment: 8


text:
To identify the most threatened areas, Colunga-Garcia and colleagues selected 39 invasive plant pests reported by the North American Plant Protection Organization or the Cooperative Agriculture Plant Survey as being of U.S. economic importance. They then compiled a list of all U.S. county occurrences for each selected group of pests through July 2009. They found one or more of the 39 selected pests in 504 counties in 36 out of 48 states; 357 counties harbored just one pest, and 147 counties had two or more. Additionally, the coastal states seemed to be at greatest risk for invasion with at least one pest occurring in each.
"Major coastal urban areas, for instance, should be carefully monitored since they hold a double threat of invasion: a populous area receiving large volumes of potentially infested imports," says Colunga-Garcia. "These characteristics can lead to the rapid spread of plant pests, starting in the urban end of the gradient and moving outward to rural areas as people transport infested materials for development or recreation."
Humans are a driving factor in the spread of exotic plant pests, not just from importing plants and their associated hitchhikers directly to the ports, but likely dispersing pests inadvertently into exurban areas as well, say the researchers. Exurban development and recreational activities, such as camping, have the potential to bring infested material, like firewood, directly into sensitive ecosystems. The researchers claim the key to early detection is through careful monitoring of human activity in coastal states and other vulnerable urban areas.
"A challenge for detecting invasive pests in urban and nearby ecosystems is the fragmentation of the landscape and the many ownerships involved" says Colunga-Garcia. "Public participation in monitoring efforts will perhaps be the most economic and ef
|Contact: Katie Kline
202-833-8773 x211
Ecological Society of America

subset: commoncrawl


text:
Godrej Properties in Pact to Develop Mumbai Land
MUMBAI - Godrej Properties Ltd. said Wednesday it has signed an agreement with group company Godrej & Boyce to develop a land in western India.
The company will receive 10% of the total revenue generated from the development as fees, the real-estate arm of the Godrej group said in a statement to the Bombay Stock Exchange.
The design and construction costs will be incurred by Godrej & Boyce, while the cost for sales and marketing will be borne by Godrej Properties, the statement said.
The land at Vikhroli in Mumbai will be developed in phases.
The companies have already started construction of the first project--a residential development of about 600,000 square feet, comprising four towers, the statement said.


text:
The 2015 meeting of the IWC Scientific Committee will be held at the Marriott Marquis, San Diego Marina from 20th May to 4th June.
|General Principles
|These general principles were agreed by the IWC Scientific Committee in 1996
|Back to whalewatching
|Return to previous section
1 Any vessel (with or without engine), aircraft or person in the water.
2 Chase (as opposed to follow), causing the whale to change its course or speed.


text:
My review
Cindy Callentine
Original recipe yields 6 servings
Based on a 2,000 calorie dietSee full nutrition
I thought the directions were a little confusing: 'Add sweet potatoes, boiling water, and salt to a large saucepan' should read 'Add sweet potatoes and salt to boiling water.' My family doe...
Since we had the oven going anyway, we baked the sweet potato s for an hour, then peeled and cut them into a skillet, and followed the recipe, substituting honey for the corn syrup. The orange f...


text:
Twinkle, my superwoman: Akshay Kumar
'Khiladi' Akshay Kumar is a proud hubby! While his wife Twinkle considers him the "man of the house", he makes no bones about calling her his "superwoman".
"She calls me man of the house in her column but she is my superwoman," Akshay tweeted Friday alongside a photograph featuring Twinkle on the cover of a leading fashion magazine.
The couple got married in 2001, and they have two children together - son Aarav and daughter Nitara.
Twinkle, daughter of Dimple Kapadia and late Rajesh Khanna, was an actress and now she's a popular interior designer.
(Posted on 01-08-2014)
Share This Page:
Free Yearly Horoscope: Select your zodiac sign
Pisces | Aquarius | Capricorn | Sagittarius | Scorpio | Libra | Virgo | Leo | Cancer | Gemini | Taurus | Aries


text:
Ducks' Thompson anxious to make playoff debutApril 28th, 2015, 4:13 pm by ERIC STEPHENS
ANAHEIM -- As he chased after teammates and bumped into them Tuesday, Nate Thompson looked the part of someone that's fit to do that against someone else.
Thompson remained tight-lipped about his availability to the Ducks for Game 1 of the Western Conference semifinals against Calgary on Thursday but the veteran center was in his usual fourth-line spot during every practice drill Tuesday.
It isn't clear what is holding Thompson back at this point. He's been recovering from an upper-body injury suffering in the regular season finale against Arizona, which was serious enough to keep him out of the Ducks' four-game sweep against Winnipeg in the first round.
Maybe this is just about keeping the Flames guessing. If so, Thompson is definitely in on it.
"Just going to keep practicing every day and see how I feel," Thompson said. "Go from there."Read the rest of this entry »


text:
House of Harlow 1960
Silver & Navy Leather Sunburst Drop Earrings
- Color:
- navy
Qty: 1
- 1
- 2
Please select an available size.
Please select a size.
Silver-plated base metal tilted square and sunburst disc drop earrings with navy leather center details
- Post back closure
Measurements: 1.03" long, ½" at widest point
Material: Silver-plated base metal and leather
Brand: House of Harlow 1960
Origin: Imported


text:
With 1.7 million freelancers, we'll match you with the perfect talent.
The client has made the following changes to the job.
Client prefers freelancers from:
You are still able to submit a proposal for this job.
The client prefers freelancers from
a different location.
We have a financial model that is tested, tried and proven.
Join a team of innovators and build substantial & residual income that can double every 2 - 3 months.
Use your disciplined skills to make a difference.
Must be punctual, know how to communicate explicitly,work with in a team environment and meet goals in a timely manner.
Sign in or Register to see more


text:
Headlines June 08, 2011 Full Show | First Story >
Libya Claims 31 Dead in NATO Air Strikes
The Libyan government is claiming at least 31 people have died in the most sustained NATO bombings of the Libyan capital Tripoli to date. The death toll has not been independently verified. Libyan government spokesman Moussa Ibrahim said the dead included civilians.
Moussa Ibrahim: "Today, we have lost 31 martyrs from the center of the city in Bab al-Aziziya, the outskirts of Tajoura and Tareeq al-Matar. Some of these 31 were guards guarding the buildings that were hit. Some of them were passers-by. Some of them were totally innocent civilians. The injured are in the dozens."
Defiant Gaddafi Vows Prolonged Fight
The NATO bombings on the Libyan capital of Tripoli came as leader Col. Muammar Gaddafi delivered a televised address vowing "to stay in our land dead or alive." At the White House, President Obama said the NATO operation in Libya is weakening Gaddafi's regime.
President Obama: "Gaddafi needs to step down for the sake of his own people. And with respect to the pace of operations and participation, I think if you look at where we were three months ago and where we are now—or two months ago and where we are now—the progress that has been made in Libya is significant. Our goal there was to protect the Libyan people from a potential slaughter."
Obama Hosts Bahraini Crown Prince, Silent on Crackdown
President Obama's comments came on the same day he met face-to-face with another foreign leader facing internal unrest—the Crown Prince of Bahrain. Salman bin Hamad Khalifa's visit to the White House was kept under wraps, with no announcement beforehand that it was to take place. The meeting came less than one week after the Bahraini government lifted the nation's three months of martial law, then launched assaults on protesters in 20 villages. It also came one day after dozens of Bahraini medical officials who treated anti-government protesters were charged with attempting to overthrow the Bahraini monarchy. A White House statement about the meeting made no mention of the Bahraini crackdown. Bahrain is a key U.S. government ally and home to the Navy's Fifth Fleet.
Yemeni Gov't Rejects Transition Talks
Thousands of Yemeni protesters gathered outside the home of the nation's vice president Tuesday after the government rejected a proposal for a political transition. Yemeni officials appear to have ruled out coming to any agreements until President Ali Abdullah Saleh returns. Saleh was taken to Saudi Arabia over the weekend to receive medical care for wounds suffered in a rocket attack on his compound.
UNICEF Warns of Humanitarian Crisis in Yemen
The United Nations children's agency, UNICEF, is warning the ongoing crisis in Yemen is fostering a humanitarian catastrophe. Already one of the poorest nations on the planet, Yemeni residents are now struggling with widespread water and fuel shortages. Half of Yemeni children suffer from stunted growth, the highest rate in the world. Some 15,000 people have already uprooted by the nation's violence, but the United Nations fears that number could rise to as much as 40,000. The majority of the displaced are women and children.
Residents: Mutinous Syrian Soldiers Responsible for Troop Deaths
Syrians are fleeing a northwestern town in fear of retaliation for the killings of as many as 120 Syrian security forces. Residents of Jisr al-Shughour now say the killings were carried out by mutinous Syrian troops who had refused orders to attack civilians. One witness said government forces had attacked the town over the weekend.
Resident: ''They went to bury Basel al-Masri, and they started firing at us from the post office building. And there was a helicopter flying above us, and they hit us with the tanks, and they fired at us. They put the army in front of us. We don't want the army to come to us. They killed our youths. Four of my cousins were killed, and my two sons are injured.''
U.N. Official Criticizes Israel on Border Killings
A top U.N. official has criticized Israel's killings of unarmed demonstrators on the Syrian border. Up to 40 people have been killed and hundreds wounded in two separate Israeli shootings of unarmed protesters in the Golan Heights. Twenty-three people were killed after crossing from Syria into a buffer zone this past Sunday. In a statement, the U.N. High Commissioner for Human Rights, Navi Pillay, said, "The use of live ammunition against allegedly unarmed protesters, resulting in large numbers of deaths and injuries, inevitably raises the question of unnecessary and excessive use of force."
U.S. Drone Strike Kills 15 in Pakistan
At least 15 people were killed today in the latest U.S. drone strike in Pakistan's Waziristan region. The attack reportedly hit a compound in an area bordering North and South Waziristan.
Gates Wraps Final Trip to Afghanistan
U.S. Defense Secretary Robert Gates has wrapped up his final trip to Afghanistan before stepping down from the Pentagon at the end of the month. During his visit, Gates floated the idea of extending the U.S. occupation beyond 2014 while also rebuffing Afghan President Hamid Karzai's call to end U.S. attacks on Afghan homes. On Tuesday, Gates addressed troops at a ceremony in Kabul.
Defense Secretary Robert Gates: "So I leave Afghanistan today with the belief that if we keep this momentum up, we will deliver a decisive blow to the enemy and turn the corner in this conflict. And if we do, it will be because of the service and sacrifice of all of you, all of the rest of those from all of the coalition countries and our Afghan partners throughout this country, and the sacrifices of your families, as well. And for that, I will always thank you."
Bernanke: U.S. Economic Recovery "Slower Than Expected"
Federal Reserve Chair Ben Bernanke is warning U.S. economic recovery is advancing at a glacial pace with a full turnaround still years away. Bernanke spoke to a conference of bankers Tuesday night in Atlanta.
Federal Reserve Chair Ben Bernanke: "U.S. economic growth so far this year looks to be somewhat slower than expected. Aggregate output increased at only 1.8 percent annual rate in the first quarter, and supply chain disruptions associated with the earthquake and tsunami in Japan are hampering economic activity this quarter. A number of indicators also suggest some loss of momentum in the labor market in recent weeks."
Bernanke's comments follow last week's figures showing the United States added only 54,000 jobs last month, the fewest since last September. The nation's official unemployment rate also increased to 9.1 percent, up from 9.0 percent in April.
Private Prison Giant Hires Former Top Federal Official
The nation's largest private prison company has hired the former head of the Federal Bureau of Prisons to a top executive position. Harley Lappin retired as the director of the Federal Bureau of Prisons last month. On Friday, the Corrections Corporation of America named Lappin its executive vice president and chief corrections officer. Lappin had stepped down as federal prison chief following his arrest for driving under the influence. A $1.6 billion company, the CCA has faced widespread allegations of prisoner mistreatment and negligence in the deaths or injuries of prisoners in its prisons and immigrant jails.
Study: Nuclear Disarmament Steps Balanced Out by New Weapons
A new study is warning highly touted efforts at nuclear disarmament are being canceled out by parallel investments in new nuclear weapons systems. The Stockholm International Peace Research Institute says more than 5,000 nuclear weapons are deployed and ready for use around the world, including 2,000 kept in a state of high alert. The world's eight nuclear powers—Britain, China, France, India, Israel, Pakistan, Russia and the United States—possess some 20,500 nuclear warheads. Because of new weapons spending, the study warns, "it seems unlikely there will be any real nuclear weapon disarmament within the foreseeable future."
23 Die in Haiti Flooding
In Haiti, at least 23 people have died and scores of others are missing after torrential rains set off devastating flooding. Most of the deaths came in the nation's capital, Port-au-Prince. The crisis has worsened with the large number of people living in tent communities and temporary shelters following the devastating earthquake of January 2010. Haiti is bracing for more deaths with hurricane season just beginning.
U.N. Issues Warning on Food Prices
The United Nations is warning global food prices are expected to remain high for the rest of the year and beyond. In a biannual report, the U.N. Food and Agriculture Organization says dwindling stocks and modest gains in crop yields will prevent a reduction in food prices to more sustainable levels. Earlier this year, food prices hit levels seen during the 2007-2008 food crisis that sparked unrest in poor nations worldwide.
New Jersey Shutters Public Broadcasting
New Jersey Gov. Chris Christie has announced a deal that will radically scale back public broadcasting produced in his state. Christie's administration has agreed to place the publicly owned New Jersey Network under control of New York's public broadcaster WNET-TV. The deal will mean the firing of all 130 of New Jersey Network's employees, though around 20 will be hired to produce content for the new station. It also contracts the private Caucus Educational Corporation—owned by the son of a well-connected New Jersey political powerbroker—to provide 20 hours of television content per week. Christie has also reached separate deals to sell all nine of New Jersey Network's radio licenses to Philadelphia's WHYY and New York Public Radio.
Recent Shows More
Nobel Peace Prize Awarded to Tunisian Civil Society Organizations
McCarthy Withdraws from House Speaker Race; Congress in Disarray
U.S. General Pushes to Keep U.S. Troops in Afghanistan
Doctors Without Borders: 24 Staffers Still Missing After U.S. Strike
Obama Ends $500 Million Program to Train and Arm Syrian Rebels
Syria: Iranian General Advising Assad Killed by ISIL
Documents: Chilean Dictator Pinochet Ordered 1976 Murder on U.S. Soil
Report: "Systemic" Overpolluting by Car Manufacturers
Japan: Kids Near Fukushima 20-50 Times Higher Rates of Thyroid Cancer
ACLU: Benton County, WA, Operating "Modern-Day Debtors' Prison"
South Carolina: Walter Scott's Family Settles for $6.5 Million
Ben Carson: Holocaust Might Have Been Avoided If Jews Had Guns
Michigan: Flint to Return to Detroit Water amid Contamination Scandal
The original content of this program is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License. Please attribute legal copies of this work to
democracynow.org. Some of the work(s) that this program incorporates, however, may be separately licensed. For further information or additional permissions,
contact us.
By Amy Goodman & Denis Moynihan
She was not only a grass-roots organizer, but a philosopher, a teacher and a revolutionary. She devoted her life to empowering the poor, the working class and communities of color, and was deeply involved with a constellation of movements.
Show for Oct 12, 2015
Turkey: 128 Killed in Bombing at Pro-Peace Rally in Ankara
Iran: WashPo Reporter Jason Rezaian Convicted in Espionage Trial
Pentagon to Pay Victims of U.S. Airstrike on Afghanistan Hospital
Report: Taliban's Reach in Afghanistan Widest Since 2001
EU Leaders Meet on Syria; Putin Says Strikes Aim to Bolster Assad
2 School Shootings as Obama Visits Families of Oregon Massacre
Gaza: Israeli Airstrike Kills Pregnant Palestinian & Her Daughter
Investigations Find Fatal Police Shooting of Tamir Rice was Justified
D.C.: 10,000s Gather for 20th Anniversary of Million Man March
Republicans Seeking Paul Ryan for Position of House Speaker
Only 158 Families Have Provided Nearly Half of 2016 Election Funding
WikiLeaks Releases Final TPP Chapter Text on Intellectual Property
Germany: 100,000s March to Protest Trade Pact Between U.S. and EU
Bolivia Hosts World People's Conference on Climate Change
Angus Deaton Wins 2015 Nobel in Economics for Study on Poverty
NYC: Warehouse Workers Launch Campaign to Unionize B&H Photo Video
California: Law Bans Schools from Using "Redskins" as Mascot
Growing Number of Cities Recognize Today as Indigenous Peoples' Day
Oct21Wed | 7:00 pm
Nov12Thu | 6:00 pm
Dec2Wed | 7:00 pm
On Saturday's NPR Weekend Edition, Scott Simon interviewed Amy Goodman about Bernie Sanders, Donald Trump, Hillary Clinton, social movements, and more.
Most Popular
Does Free Speech Have a Palestine Exception? Dismissed Professor Steven Salaita Speaks OutOct 07, 2015
Legendary Patti Smith on Her New Memoir "M Train" & National Book Award Winner "Just Kids"Oct 08, 2015
Making Money from Misery? Disaster Capitalism from the Migrant Crisis to Afghanistan and HaitiOct 09, 2015
NAFTA on Steroids: Consumer Groups Slam the TPP as 12 Nations Agree to Trade AccordOct 06, 2015


text:
Grab your mittens! Fresh snow-filled fun arriving soon to Golden Gate
GOLDEN GATE - What is better than waking up to a fresh snowfall on a cold winter day? A Snowfest in Golden Gate on a warm sunny day, of course.
Set in Golden Gate Community Park, on Dec. 4, this snow packed event will mark the 25th anniversary of chilly excitement for local families. Snowfest will be icing on the cake for children of all ages, as the park is transformed into a cool winter wonderland by Collier County Parks and Recreation staff.
For many local children, it's their first time experiencing snow. So Parks and Recreation crews are in a flurry to prepare for chilly activities offered throughout the day, where residents will park in the Berkshire Commons or Calusa Park Elementary School, and ride a shuttle to attend the day's fun-filled event.
Snowfest is set to be jam-packed with entertainment, carnival rides, ice skating, sledding, a special visit from Santa Claus, pony rides, and more. And who can resist deep-fried Oreo cookies? The cookies are just one of the traditional carnival delicacies that will be offered for sale, along with sweet elephant ears, ice cream, hot dogs, hamburgers, traditional Spanish treats, candied apples, and freshly squeezed lemonade.
"Usually we have 70 tons of snow, and we're going to have 100 tons this year," said Peg Ruby, marketing specialist with Collier County Parks and Recreation, and she is expecting there will be more than 15,000 people in attendance. "There will be three separate mountains of snow, one for ages zero to 3 years old, one for 4- to 7-year-olds, and another mountain for 8-year-olds and over. We move the piles into the canal when it is finished, and it's surprising the snow lasts as long as it does."
Dreaming about starting a snowball fight? Not so fast, the organizers say.
"I was pegged by a snowball, and it hurts, so we try to discourage it, but we let a little bit go," said Ruby, ensuring a safe day of frozen fun for everyone.
"We recommend they wear mittens, socks and hats, and bring a change of clothes, because they will get wet in the snow," said Ruby. This year's event also includes an extra 12-foot toboggan ice hill. Two carved ice sculptures for photo opportunities will be delivered by Florida Ice, based in Deerfield Beach, for the first time in the history of Snowfest, too.
Staging each 800-pound ice sculpture is a feat of architectural mastery, but Steven Carrol and David Berman of Florida Ice are up for the challenge.
"It's heavy to move, but we do this all the time," said Carrol as he prepared to design and build another ice sculpture for the Waldorf Astoria in New York City. The two interactive ice sculptures for Snowfest will be a one-of-kind artwork of an Eskimo and a snowman. Snowfest participants can pose for photos, either with a hug from a frosty snowman, or by "wearing" icy Alaskan Eskimo attire.
"There is something for everyone," said Annie Alverez, regional manager for Parks and Recreation, as she credited her dedicated volunteers in the community, entertainers and staff members in planning a chillingly exciting community event.
- - -
If You Go:
Snowfest 2010
Golden Gate Community Park
3300 Santa Barbara Blvd.
Carnival only on Dec. 3, from 6 p.m. to 11 p.m.
Snowfest and carnival on Dec. 4 from 10 a.m. to 5 p.m.
Admission: $1.00 per person (3 and under are free)
Shuttle parking at Calusa Park Elementary School & Berkshire Commons


text: Aloo Tamatar Sabzi Recipe [Video]Do you ever crave for the aloo tamatar sabzi that you ate on that Aloo Poori bhandara? Well, i do every time i eat it and just told this to my mother in law. She claims to know the way it is prepared and shows the way here. Aloo TamatarAloo Tamator Last Updated 15 Feb, 2014 Share Tagged In Recipe Recipe In English Video Comments


text:
Air Movement
2 Results Found that Include 2 Products
How can we improve the Search Experience?
Product availability based on selecting either shipping or pick up and a location. Dismiss
Ship or Pickup Enter Location
- Indoor Air Quality Probe, CO2, Temp and RHIndoor Air Quality Probe,CO2,Temp and RH
- Item # 3DTD7
- Mfr. Model # 980
Indoor Air Quality Probe, Measures CO2, Temperature and Humidity, Range CO2 0 to 5000 PPM, Temp 14 to 140 F,...More
Price $2,343.00 / each
+Add to list
Catalog Page # NA
- Anemometer with Humidity, 0 to 6000 fpmAnemometer
- Item # 1UCY7
- Mfr. Model # AVM440-A
Anemometer, Hot Wire and Thermistor Sensing Method, Data Logging No, Humidity Sensing Yes, Velocity (FPM) 0...More
Price $2,216.00 / each
+Add to list
Catalog Page # 880
Note: Product availability is real-time basis and adjusted continuously. The product will be reserved for you when you complete your order. More


text:
Marek's Disease
An Evolving Problem
Edited by
- Fred Davison, Institute for Animal Health, Compton Laboratory, Compton, Newbury,UK
- Venugopal Nair, AVT McCormick, India
Veterinary researchers, diagnosticians and epidemiologists
Book information
- Published: June 2004
- Imprint: ACADEMIC PRESS
"Overall, the book is a highly recommendable addition to the library of anyone who has an interest in host-parasite interactions, especially in the area of poultry disease." - Shayan Sharif, DVM, PhD, University of Guelph, Canada for THE CANADIAN VETERINARY JOURNAL (May 2006) "This book is well suited for both pathologists and microbiologists who want to have a general overview of the complexities of Marek's disease." - VETERINARY PATHOLOGY (2006) "...On the whole, it is easy to read...Including both historical perspective and current findings, it provides a broad and comprehensive review of the subject area and the diversity of the chapters should provide something of interest to most readers. In addition to veterinary researchers, it would be suitable for undergraduate students, providing a condensed overview of the contribution of multiple disciplines on the understanding of a viral disease and problems faced in maintaining effective control measures." - MICROBIOLOGY TODAY (2005)


text:
Page 1
Iran. J. Environ. Health. Sci. Eng., 2009, Vol. 6, No. 3, pp. 173-180
Nigeria is located in Western Africa on the
Gulf of Guinea. The country land borders with
the Republic of Benin in the West, Chad and
Cameroon in the East, and Niger in the north and
has a coastline of at least 853km. Nigeria has a
varied landscape, from the Obudu Hills in the
southeast through the beaches in the south, the
rainforest, the Lagos estuary and savannah in
the middle and south west of the country and the
sahel to the encroaching Sahara in the extreme
north. The country has two main rivers: Niger and
Benue. The two rivers converge and empty into
the Niger Delta, the world's largest river delta.
Nigeria is a developing country, with a land area
of 923,768 km2, and a population of about 140
million with growth rate of 2.38. Nigeria is the
most populous country in Africa and ninth most
populous country in the world. With populations
distributed at 48.3% urban and 57.7% rural and
population density at 139 people per square km.
The country has GDP per capita of $1,800 and
population below poverty line is 60%. Nigeria
has a labour force of 50.13 million. The country
T. Ch. Ogwueleka
Department of Civil Engineering, University of Abuja, Abuja, Nigeria
Received 16 November 2008; revised 10 May 2009; accepted 15 July 2009
Municipal solid waste management has emerged as one of the greatest challenges facing environmental protection
agencies in developing countries. This study presents the current solid waste management practices and problems
in Nigeria. Solid waste management is characterized by inefficient collection methods, insufficient coverage of
the collection system and improper disposal. The waste density ranged from 280 to 370 kg/m3 and the waste
generation rates ranged from 0.44 to 0.66 kg/capita/day. The common constraints faced environmental agencies
include lack of institutional arrangement, insufficient financial resources, absence of bylaws and standards,
inflexible work schedules, insufficient information on quantity and composition of waste, and inappropriate
technology. The study suggested study of institutional, political, social, financial, economic and technical aspects
of municipal solid waste management in order to achieve sustainable and effective solid waste management in
Keywords: Waste disposal, Waste Collection, Municipal solid waste, Nigeria, Recycling, Waste Management
*Corresponding author: email@example.com
Tel: +08035061048
comprises thirty-six states and one Federal Capital
Territory, which were further subdivided, into
774 Local Government Areas. Life expectancy is
47 years (average male/female). The government
provides education free at primary school level.
68% of the population are literate and the rate of
men (75.7%) is higher than for women (60.9%).
The climate is equatorial in south, tropical in
centre and arid in north. 33.02% of the land is
The Federal Government of Nigeria has
promulgated various laws and regulations to
safeguard the environment. These include Federal
Environmental Protection Agency Act of 1988.
The Federal Ministry of Environment administers
and enforces environmental laws in Nigeria. It
took over this function in 1999 from the Federal
Environmental Protection Agency (FEPA), which
was created under the FEPA Act.
Pursuant to the FEPA Act, each state and local
government in the country set up its own
environmental protection body for the protection
and improvement of the environment within its
jurisdiction. Municipal solid waste management
is a major responsibility of state and local
Page 2
T. Ch. Ogwueleka, MUNICIPAL SOLID WASTE CHARACTERISTICS...
government environmental agencies. The
agencies are charged with the responsibility of
handling, employing and disposing of solid waste
generated. The state agencies generate fund from
subvention from state governments and internally
generated revenue through sanitary levy and
stringent regulations with heavy penalties for
offenders of illegal dumping and littering of
refuse along streets (Ogwueleka, 2003).
Municipal solid waste management(MSWM)
Municipal solid waste (MSW) is defined to
include refuse from households, non-hazardous
solid waste from industrial, commercial and
institutional establishments (including hospitals),
market waste, yard waste, and street sweepings.
Municipal solid waste management (MSWM)
refers to the collection, transfer, treatment,
recycling, resources recovery and disposal of solid
waste in urban areas. The goals of municipal solid
waste management are to promote the quality of
the urban environment, generate employment
and income, and protect environmental health
and support the efficiency and productivity of the
Solid waste management has emerged as one
of the greatest challenges facing state and local
government environmental protection agencies
in Nigeria. The volume of solid waste being
generated continues to increase at a faster rate
than the ability of the agencies to improve on
the financial and technical resources needed to
parallel this growth. Solid waste management in
Nigeria is characterized by inefficient collection
methods, insufficient coverage of the collection
system and improper disposal of solid waste.
The quantity of solid waste generated in urban
areas in industrialized countries is higher than in
developing countries; still municipal solid waste
management remains inadequate in the latter.
Solid waste in developing countries differs from
developed countries. Most developing countries,
Nigeria, inclusive have solid waste management
problems different from those found in
industrialized countries in areas of composition,
density, political, and economic framework,
waste amount, access to waste for collection,
awareness and attitude. The wastes are heavier,
wetter and more corrosive in developing cities
than developed cities.
In developing countries, local authorities spend
77-95% of their revenue on collection and the
balance on disposal (Ogwueleka, 2003), but
can only collect almost 50-70% of municipal
solid waste (MSW). In the past, the focus has
been on the technical aspects of different means
of collection and disposal(World Bank, 1992),
but recently, attention has been on enhancing
institutional arrangement to service delivery, with
a special emphasis on privatization (Cointreau,
1994). Nigeria is presently experimenting with
the privatization of this sector. The Federal
Government has instituted National Integrated
Municipal Solid Waste Management Intervention
Programme in seven cities of Nigeria. The seven
cities are Maiduguri, Kano, Kaduna, Onitsha,
Uyo, Ota, and Lagos. Lagos state government
established municipal solid waste management
policy to encompass private sector participation
in waste collection and transfer to designated
landfill sites.
This paper aims to examine current solid waste
management practices and problems in Nigeria.
The specific aims are the following:
-to present the current state of municipal solid
waste in Nigeria, and the challenges it faces.
-to document solid waste problems in Nigeria.
-to recommend and discuss applicable solutions
to the solid waste management system.
In this study, nine cities namely Lagos, Maiduguri,
Kano, Ibadan, Makurdi, Port-Harcourt, Onitsha,
Nsukka, Abuja were chosen as urbanistic
representatives of the current solid waste
management in Nigeria. The selection of the
municipalities is based on the existing situation
with different waste management problems,
size, and challenges. Lagos is the former capital
of Nigeria and the largest city in Nigeria. Abuja
is the capital city of Nigeria. Kano, Onitsha
and Port-Harcourt are commercial cities while
Makurdi is the capital city of Benue State in the
middle belt regions of Nigeria. Ibadan is one of
the major urban centres. Maiduguri metropolis
has been an administrative, cultural and religious
centre. The locations are given in Fig. 1. The
study was undertaken from April to October,
2007 and carried out in three steps.
Step 1: Documents, records and academic
Page 3
Iran. J. Environ. Health. Sci. Eng., 2009, Vol. 6, No. 3, pp. 173-180
literature relating to municipal solid waste
management in
Nigeria were studied.
Step 2: Thirty six (36) state environmental
agencies workers involved in municipal solid
management were interviewed to update
information in the document and records
Step 3: Twenty dump sites were visited at
Abuja, Makurdi, Lagos, Nsukka, Onitsha, Port-
Kano. Also the residents, scavengers, private
contractors were interviewed to confirm the
collection, disposal and treatment procedures,
recycling practice and problems facing solid
waste management.
Waste collection and transportation in Nigeria
The collection of solid waste is the function
of state and local government environmental
protection agencies. Informal solid waste
collection operations exist in parallel with official
agencies in some major cities like Onitsha, Lagos
etc. Informal collectors provide the service for
a fee. In most urban areas, stationary containers
system is adopted for waste collection; the waste
containers remain at the points of waste generation.
This method requires the delivery of waste by the
residents to a storage container. These confiners
are generally at open spaces along street ends or
junctions. These confiners are placed 500-800 m
apart. The some bins are fixed on the ground and
some are movable. The agencies find this system
less convenient and less expensive than house-
to-house service. House-to-house service is very
rare in Nigeria.
Different types of vehicles are used for solid waste
collection in Nigeria. The compactor trucks, side
loaders, rear loaders, mini trucks, tippers, skip
trucks and open back trucks are the commonly
used collection trucks. It was observed that
60% percent of trucks available are always out
of service at any one time. In Onitsha, the few
available trucks breakdown frequently due to
overuse (Agunwamba et al, 2003). The collection
vehicles are in a state of disrepair in most cities
of Nigeria. There is inadequate service coverage
in most urban areas and in rural areas there is
no collection. Rural dwellers have no access to
waste collection service. They dump waste at any
vacant plot, public space, and river or burn it in
their backyard, thereby polluting the air. Less
than 60% of (MSW) generated is collected in
developing countries (Ogwueleka, 2003). Solid
waste generation exceeds collection capacity.
Zurbrugg (2003) describes that one to two thirds
of the solid waste generation in developing
countries is not collected. There is no regular
Fig. 1: Map of Nigeria
Page 4
T. Ch. Ogwueleka, MUNICIPAL SOLID WASTE CHARACTERISTICS...
routine collection.
Currently, transfer stations are not common in
Nigeria. There are cases where such were once in
existence but are not longer functional. In Abuja,
the land earmarked for waste transfer station has
been converted to other land use. In Nigeria,
municipal solid waste is collected and taken
by collection vehicles directly to the disposal
site. The waste accumulates in open dumps at
roadsides. The open dumps provide harbourage
for diseases causing organisms, bacteria, insects,
and rodents.
Local agencies do not have adequate capacity to
handle the increasing solid waste mainly due to
limited budgets. In most urban areas of Nigeria, the
collection of fees and refuse are subcontracted to
private companies, which have higher efficiency
than government agencies. The current interest
involving private companies in solid waste is
driven by failure of government agencies to
provide adequate services. Private participation
in waste management has not been successful
in Nigeria because such companies are profit
driven and they are not monitored or regulated
by government. Also due to the unprofitable
nature of solid waste business, inefficiency and
dishonesty on the part of some of the contractors
and late payment of contractors by the agencies
worsen the situation. For example, in Ibadan in
1991, there were twenty-five registered private
waste collectors but only ten were found to be
operational (Onibokun, 1999). The solid waste
collection efficiency in Nigeria ranged from 5
percent in some semi-urban areas to 50 percent
in urban areas.
Waste characteristics
The waste generation rates ranged from 0.66
kg/cap/d in urban areas to 0.44 kg/cap/d in
rural areas as opposed to 0.7-1.8 kg/cap/day
in developed countries (Cointreau, 1982). The
waste generation rate is typical of low income
towns. The rate of waste generation is highly
influenced by the population income. In Nigeria
25 million tonnes of municipal solid waste are
generated annually. Table 1 shows the waste
generation rates and breakdown density for
urban and rural areas in Nigeria. Waste densities
and moisture are much higher in developing
countries which require different technology and
management systems (Cointreau et al., 1984).
The density of solid waste in Nigeria ranged from
250 kg/m3 to 370 kg/m3 higher than solid waste
densities found in developed countries. Density
defines the number of capacity of waste storage
and collection facilities required. High density
reduces the effectiveness of compaction vehicles
for waste transfer.
Source: All Sites Engineering Ltd
The composition of waste
Income and economic growth have impact on
the composition of wastes. High-income earners
consume more packaged products, which result
in a higher percentage of inorganic materials
– metals, plastics, glass, and textile. Waste
characteristics vary according to season, income
level, population, social behaviour, climate, and
industrial production, the size of markets for
waste materials and the extent of urbanization,
effectiveness of recycling, and work reduction.
Because of non-uniformity of collection
methods, the environmental agencies do not
provide separate solid waste management for the
six classification of solid waste. The majority
of substances composing municipal solid
waste include paper, vegetable matter, plastics,
Table 1: Urban solid waste generation
Page 5
Iran. J. Environ. Health. Sci. Eng., 2009, Vol. 6, No. 3, pp. 173-180
metals, textile, rubber and glass. Table 2 shows
a comparative analysis of municipal solid waste
composition in some major cities in Nigeria. It
can be seen that great majority of the total solid
waste generated in Nigeria is organic. The high
level of reuse of recyclable waste reflects the
extent of poverty in the developing countries.
In developing countries, waste stream is over
50% organic material (Hoornweg et al., 1999).
Studies in Bandung, Indonesia and Colombia, Sri
Lanka have found residential waste composed of
78% and 81% compostable material, and market
waste 89% and 90% compostable, respectively
(Cointreau, 1982).
Resource recovery and recycling
There are no formal recycling of resource recovery
programmes in Nigeria (Ogwueleka, 2003) and
no policy on composting. Currently, recovery/
recycling operations are carried out mostly by
the informal sector. In most big markets, the
scavengers pack refuse for a fee and salvage any
recyclable prior to the disposal of the waste. 60%
of wastes collected in Nigeria are organic waste
and only 8% are recovered for reuse.
Recycling is a method of solid waste
management like controlling or incineration, but
is environmentally more desirable (Ruzi, 2001).
Recycling can help the economy by recovering
and reusing valuable materials. Recycling
reduces the amount of waste need to be collected,
transported and disposed of, and extends the
life of disposal facilities, which saves money
to the agency. Waste recycling and composting
activities should be encouraged since this
approach is considered to be the right measure
in attaining sustainability in waste management.
Efficient recycling and composting could save
18.6% in waste management costs and 57.7%
in landfill cost (Agunwamba, 1998). In Onitsha,
40% of artisans and small-scale industries receive
48% of their raw materials from scavengers. The
role of the informal sector in waste collection
is significant. This sector is responsible for
removing 30 percent of total generated waste in
the urban areas.
Majority of the scavengers are between 17 and 30
old years. They operate without proper protective
wares. Scavengers are driven by poverty and
desire to earn a living. The informal private sector
comprises unregistered, unregulated activities
carried out by individuals, families, group or
small enterprises. The sector is labour intensive.
This sector provides employment opportunities
for a large group of people. Scavenging and
recycling should be encouraged. The stakeholders
are consumers/scavengers, middlemen, and
manufacturers. The contributions of each
stakeholder in the recycling process need to be
evaluated. The official population of scavengers
has not been known.
The informal collectors use pushcarts, barrow etc.
These collectors provide service in areas where
the agencies cannot. In some public places and
markets, people pay scavengers to clean the front
of their shops. Scavengers salvage repairable
and rentable materials to sell for recycling. In
Nigeria, scavengers are seen as menace. Materials
recovery facilities (MRFs) are used as dump sites
at Uwani in Enugu and Lagos.
Treatment and disposal system
In Nigeria like most developing countries,
wastes are commonly dumped in open dumps,
uncontrolled landfills where a waste collection
service is organised. Dumps are located along or
beside major roads. In Makurdi, Benue State, the
dump site is 2 km away from the city along Naka
road. In Onitsha, refuse spreads into the road,
blocking traffic and the wastes are burnt open on
Table 2: Composition of waste stream characteristics
Others = dust, ash, ceramics, rubber, soil, bones
α Diaz and Golueke (1985) , β Ogwueleka (2003) , ± Ogwueleka (2006), ¥ Agunwamba et al (1998), µ Cointreau (1982), # Dauda and Osita (2003)


text:
'Criticising M S Dhoni is like questioning Sachin Tendulkar's ability'
Top Stories
- Netaji files show family was under observation, intercepted communication hinted at sightings
- Indian fisherman allegedly killed in Pakistan firing off Gujarat coast
- Maharashtra government transfers Sheena Bora murder case to Central Bureau of Investigation
- Another drowned toddler washes up on Turkish beach: report
- Taliban attack on Pakistan base kills 29; 16 die in mosque
Mahendra Singh Dhoni's first coach Chanchal Bhattacharya today heaped praise on his beleaguered ward saying criticising the Indian skipper would be like questioning the run-making ability of Sachin Tendulkar.
The 49-year-old Bhattacharya, under whom Dhoni made the life-changing switch from being a football goalkeeper to a wicketkeeper in 1995, feels the critics should refrain from making negative statements.
"The other day (Sunil) Gavaskar was after Dhoni's captaincy and recently (after the win in Kochi) I've heard him saying there cannot be a captain like him," Bhattacharya said.
"Criticism is always welcome but it should be healthy. You should understand everyday is not a Sunday. He has given you all the titles from the World T20 title, the World Cup victory and being No 1 in Tests. It's like questioning the ability of Tendulkar's run-making skills."
But looking at the tremendous workload of Dhoni, Bhattacharya said the Indian skipper can consider giving up one format by 2014.
"Looking at World Cup 2015, I'm sure he's seriously thinking about giving up one format. However, we never spoke about it. It's been a long time since February that we las spoke," Bhattacharya said.
Fans are all excited about seeing Ranchi's favourite son in his own backyard for the first time, but Bhattacharya is a little jittery.
"Like any other coach, I'm nervous. I pray to God that he does well and the team wins on the day. I'm keeping my fingers crossed.
"Definitely there will be pressure for home ground for Mahi, but I still believe he would keep his cool demeanour and perform up to the expectations of thousands of fans."
Recollecting Dhoni's childhood, Bhattacharya, who is the sports head in Central University of Jharkhand, said he had spotted the ability in the Indian skipper very early.
... contd.


text:
1 Result Found that Includes 1 Product
How can we improve the Search Experience?
Product availability based on selecting either shipping or pick up and a location. Dismiss
Ship or Pickup Enter Location
- Rechargeable Emergency Lighting UPS, 120/277VAC Output Voltage, Number of Outlets: HardwiredRechargeable Emergency Lighting UPS, 120/277VAC Output Voltage, Number of Outlets: Hardwired
- Item # 12X244
- Mfr. Model # ELI-S-20
Rechargeable Emergency Lighting UPS, Output Voltage 120/277VAC, Backup Time (Half/Full Load) 90 min., Number...More
Clearance Price $220.00 / each
Price $485.50 / each
+Add to list
Catalog Page # NA
Note: Product availability is real-time basis and adjusted continuously. The product will be reserved for you when you complete your order. More


text:
J&K Handicrafts ( S&E )Kashmir, Jammu & Kashmir
Products & Services
Company Profile
i. To run, manage and administer the Kashmir Government Arts Emporium or any other State Undertaking as may be notified by the Government from time to time, in a manner as would ensure their efficient, economical and better management and operation;
ii. To undertake sale in India and Export of handicrafts, Handloom products, Khadi and products of village Industries and other products produced and manufactured in the State of Jammu and Kashmir as ...view all
Fact Sheet
|Nature of Business
Contact UsJ&K Handicrafts ( S&E )G.Q WaniView Contact Number
Emporium Buildings,
Residency Road.
Kashmir - 190001
Jammu & Kashmir, India
Residency Road.
Kashmir - 190001
Jammu & Kashmir, India
Send your enquiry to this supplier


text: Jeffrey Page | IBDB: The official source for Broadway Information IBDB: The official source for Broadway Information Official Broadway League sites: - sites - broadway.org broadwayleague.com broadwayfanclub.com kidsnightonbroadway.com stagespecs.org tonyawards.com Quick Search For: In This Category: All Show People/Org. Theatre Season Jeffrey Page Performer, Choreographer Male Productions ProductionsDate of ProductionsViolet[Musical, Drama, Original] Choreographed by Jeffrey Page Apr 20, 2014 - Aug 10, 2014Fela![Musical, Original] Performer: Jeffrey Page [Ensemble]Jul 12, 2012 - Aug 04, 2012Fela![Musical, Original] Performer: Jeffrey Page [Ensemble]Nov 23, 2009 - Jan 02, 2011 Find out where Jeffrey Page and are credited together © 2001-2015, The Broadway League, All Rights Reserved. (Copyright and Disclaimer)