Are Mlink and ACM Secure?

The recent Hannaford data breach sent a shockwave through the IT community because Hannaford was PCI Compliance Certified. Anybody involved in data security should be constantly reviewing the strength of their efforts. This is especially true with communications and data transport.

So, no doubt the Mlink faithful have asked themselves, "Is my data safe?" The answer to that question is, as you might have guessed, "Yes and no." There are two primary areas where security might be compromised - data format and access control. Lets deal with the data first.

Mlink transmits data via the Mlink Protocol, which is unique and proprietary. The protocol uses a number of methods to cram as much information into as small a space as possible, to expedite and streamline protocol chatter and to compress the processed packets. Mlink Compression is also proprietary and unlike anything else in use today. By combining the Mlink Protocol with Mlink Compression, a relatively high degree of data "encryption" is achieved. I am unaware of any method for interpreting and reconstructing data that has been processed by Mlink other than another copy of MLink. In fact, in the late 90's one highly vaunted US military penetration testing team gave Mlink an encryption waiver as long as the compression feature was also used. I will also point out that encryption algorithms, even really good ones, have been broken before. Eternal vigilance is the name of this game.

How about access control? There are two weak points in an Mlink/ACM data transport system, and they are both insider attack weaknesses. The first is storage of login IDs and passwords in a clear text format in a file and the second is transmission of ID and password in clear text. This might not seem like much until you realize that possession of the ID and password can provide a hacker with complete access to remote Windows systems because of the interface provided by the remote Mlink.

My shameless plug is this: we've developed an encryption system that eliminates both the clear text storage and transmission problems. It's an easy plug-in and is invisible to the end user after installation. And it should be no surprize to anyone, you use Mlink and ACM to transfer and install the system.

So, yes, MLink and ACM are relatively secure but could be more secure. My advise is to always watch your six!

Upgrading Unix OS Mlink problem

For those of you who have or are contemplating an upgrade to your Unix operating system, you should be aware of a problem that arises when you do so.

When Mlink transfers a file, by default it uses a "temporary receive file" until the transfer is completed. It then renames the temporary file to it's permanent name. In order to prevent temporary file name conflicts, Mlink uses a unique numeric naming convention. This name is derived from the 5 left justified characters of the Unix process ID of the process transferring the file. This scheme worked fine since the process ID was only 5 characters in length. 64 bit Unix operating systems can have substantially longer process IDs, which means that two Mlink processes can end up trying to use the same temporary file name during a transfer. This doesn't happen very often, but when it does, the contents of two files from separate remote locations ends up in the same file on the receiving system. The second transfer to complete reports a "Local File I/O error. #FILE = 1" error and fails the transfer.

Note that we've seen this problem occur even though the upgraded Unix kernal was built as 32 bit.

Send us an email at drmlink at mlink dot com and we'll tell you how to get the patch that fixes this problem.

Welcome to the Mlink Guru blog

Hello, this is Dr. Mlink, owner and President of Mlink.com LLC - welcome to the Mlink user's blog. I hope to make this a place where Mlink and ACM users can converse about data transport issues, polling system design, modems, networks, security and anything else we can help you with.

Mlink and ACM are legacy products, yet they are still in use by mom 'n pop shops as well as Fortune 500 corporations worldwide. Mlink is still actively sold and new clients are being added all the time.

I welcome your questions and comments - Mlink and ACM have needed a user's group for quite some time!