Security Issues of Labview Web Server?

Hi All,
How secure is the web server for Labview? Is anyone aware of any one
successfully hacking the systems?
I would assume that it could be possible to gain full control of the
machine running Labview as Labview can read/write data to drives etc.
Just interested as we will be running labview servers on open network
not protected by a firewall etc.
Any comments?
Regards
Wayne Peacock

I have found that a LabVIEW application running the Web Server can be crashed from any machine that has access to it. The Browser Access List denial of an IP address will not prevent this crash.
I have reported the details and National Instruments has confirmed the report and responded with this: "Crashing LabVIEW Through the G Web Server Using TCP VIs"
http://digital.ni.com/public.nsf/websearch/4C3F86E655E5389886256BA00064B22F?OpenDocument. It turns out that this crash will only occur if the web server logging is enabled.
Aborting a server is generally categorized as a Denial of Service (DOS) attack. In this case, it is the LabVIEW application itself that aborts, web server and all. This can be more serious than the usual DOS if the application is perf
orming some other important activity by running VIs. They would unexpectedly abort along with the rest of LabVIEW.
This attack does not enable reading or writing drives, or otherwise controlling the host machine, the vulnerabilities that you asked about. I have even tried to trick the server into getting pages outside of its root directory without success.
If you are running a LabVIEW Web Server, you should certainly disable web server logging. If you could not tolerate an unexpected abort in some LabVIEW VIs that you are running and want to be even safer, I recommend that you do not run them in the same LabVIEW application that is running the LabVIEW Web Server. The principle here is compartmentalization.
On one hand, the small number of deployed servers, relative to other more numerous and attractive targets, has not attracted undesired attention. So you're pretty safe now. On the other hand, LabVIEW is growing and moving to the Internet, and LabVIEW systems control machin
es and chemical processes, not merely data and dollars. Think about the risks as well as the convenience of using the web.
Steve Zins -- steve @ iLabVIEW . com

Similar Messages

How to create web applications with the LabVIEW web server

Wonderful Forum,
I've noticed that sometimes it can be tricky for LabVIEW users to learn how to create their own custom web clients using the LabVIEW web server. I created a LabVIEW web development community group and wrote some tutorials to teach the basics of creating web clients using HTML, Javascript, and AJAX. The idea is that LabVIEW users without any web background can quickly look at some tutorials and examples to get started on their own projects.
https://decibel.ni.com/content/groups/web-services
What do you think?
Joey S.
Software Product Manager
National Instruments

Hi Joey,
A great idea! I recently presented at a local user group meeting about my WebSockets API (see the links in my signature). I've uploaded the presentation and the demo code I gave to our UG here.
I think the barrier to entry is with needing to know the web languages (e.g. html/css/js) as well as writing your LabVIEW code. I have joined the group and look forward to seeing some interesting content on there! Certainly some demos of using AJAX to make requests to Web Services and do something with the data (e.g. display on a graph) would be a good place to start.
Certified LabVIEW Architect, Certified TestStand Developer
NI Days (and A&DF): 2010, 2011, 2013, 2014
NI Week: 2012, 2014
Knowledgeable in all things Giant Tetris and WebSockets

Difference entre G web server et LabVIEW web server

Salut,
je voudrais savoir quelle est la difference entre le G Web server et LabVIEW web Server et quelles sont les avantages de chcun d'eux.
Merci.

Bonjour rose2009,
Labview web server est le serveur web alors que le G server permet d'executer des script CGI. Il faut se rappeller que labview web server ne permet pas de faire des entrées/sorties, les CGI VI permet de recevoir les entrées ou les requetes pour renvoyer les données.
Cordialement,
Hi rose2009
Labview web server is the web server until G server allow to execute CGI script. LabVIEW does not work with standard HTTP input and output, a CGI VI receives the standard input data as a string when it receives request and sends data that it generates as a string.
Best regards,
Aurélien J.
National Instruments France
#adMrkt{text-align: center;font-size:11px; font-weight: bold;} #adMrkt a {text-decoration: none;} #adMrkt a:hover{font-size: 9px;} #adMrkt a span{display: none;} #adMrkt a:hover span{display: block;}
>> Du 30 juin au 25 août, embarquez pour 2 mois de vidéo-t'chat ! Prenez place pour un voyage au coe...

Installation issue: Sun one web server 6.1 SP5 with JDK1.6 on Windows XP

Hi,
I am trying to install sun one webserver 6.1 SP5 on my system which has windows XP operating system for the development work. the JDK version i am using is JDK1.6.
While installing sun one webserver at step where i can use custom java development kit i am providing path for the JDK1.6 in "JDK Path" text box as "C:\Java\jdk1.6.0_11".
while clicking next it throws me error "The version of selected JDK is too old". i don;t have any other version of JDK installed on my system.
Can any one tell me what can be the problem here?
Regards,
Nemish

Can you try Web Server 7.0 update 6?
BTW JDK version you are using has security vulnerabilities. Please upgrade to the latest JDK
as per [http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1]
This issue is addressed in the following Java SE and Java SE for Business releases for Windows, Solaris, and Linux:
* JDK and JRE 6 Update 15 or later
* JDK and JRE 5.0 Update 20 or later

Secure service in Java Web server 2.0

Hi all, I have installed a Java Web Server 2.0 without the secure service running, and everything works just fine.
Then I make a self-signed certificate with authstore, using key size 1024, MD5withRSA, hostname: <my computer> (testing on local net (maybe this is what fails?)), and all the other stuff. All looks good and certificate info looks like this:
Subject Information: CN=yodopc1, OU=SW dept, O=Yodoba, L=Z?rich, ST=Z?ric, C=CH
Issuer Information: CN=yodopc1, OU=SW dept, O=Yodoba, L=Z?rich, ST=Z?ric, C=CH
Dates Valid: Thu Jun 28 10:19:35 CEST 2001 --> Wed Sep 26 10:19:35 CEST 2001
Algorithm: MD5withRSA
Serial Number: 993716375
Then I exit, and restart (even tried rebooting machine).
Start webserver, type inn key password, and login to the Server admin applet. There it says:
Service -------------- Status ------ Port -- Network Address
Java web server ------ Terminated - -------
- Web service -------- Unknown --- 80 ----
- Secure Web service - Unknown --- 7070 --
If I try to start the server, it runs for about ten seconds before it is back to the same state again. Of course trying to access server through http(s)://localhost(:7070) results in a "Cannot find server..." If I delete the keys file in <JWS-root>, everything is back to where it was before I started creating the certificate.
I have seen that there are a lot of old (1-2 years old) Posts with similar and perhaps related issues, but none of witch have any replies that finds a solution. Hopefully someone can help my now...
All help and suggestion are Greatly appriciated.
Sjur

Hi Sjurba,
Please follow this URL:
http://www.sun.com/software/jwebserver/faq/faq.html#f6
http://docs.iplanet.com/docs/manuals/messaging/sims35/install/postwa.doc6.html
Also read the below.
Client side workaround: Use Netscape Communicator 4.x instead of Netscape Navigator 3.x.
Java Web Server workaround: Use the VeriSign root certificate that is shipped in Java Web Server 1.1. Follow these instructions:
1.Copy or save the file named keys, located in the top level directory of your Java Web Server installation, to a secure place (for example, a floppy disk).
2.Locate the secure server certificate that VeriSign sent you.
3.Install Java Web Server 1.1 in a temporary directory. You don't need to run this server--you only need to run AuthStore to regenerate the keys file. (The install of
Java Web Server 1.1 does need not be on the same machine as the install of the Java Web Server 1.1.x that has the problem).
For the remainder of these instructions, 1.1.x server root is the installation directory of the Java Web Server 1.1.x that shows the problem. 1.1 server root is the
installation directory of Java Web Server 1.1
4.Copy the keys file from 1.1.x server root/ to 1.1 server root/.
5.Run AuthStore under 1.1 server root. AuthStore is in the bin directory. You will need to type in the server passphrase to launch AuthStore.
6.From the scrolling list, select the key that corresponds to the secure server certificate from VeriSign.
7.Click Import and type the full path of the certificate that you received from VeriSign.
8.Click Save to write a new keys file under 1.1 server root.
9.Click Exit.
10.Copy the new keys file from 1.1 server root/ to 1.1.x server root/.
11.Restart the Java Web Server 1.1.x under 1.1.x server root.
I hope this will help you.
Thanks
Bakrudeen
Technical Support Engineer
Sun MicroSystems Inc, India

Security Issues while calling Web Service

Hello,
I have designed a flex client that calls .NET web service and
displays the results in the data grid. The application executed
properly when I launch it from the development (D:\FlexTest\bin),
the one that I specified while creating Flex Project (FlexTest).
However, if I copy the same files (or the whole folder) to another
location on my laptop, I receive the following error.
[RPC Fault faultString="Security error accessing url"
faultCode="Channel.Security.Error" faultDetail="Unable to load
WSDL. If currently online, please verify the URI and/or format of
the WSDL (
http://192.168.0.101/AjaxServiceInvoker2/AjaxServiceInvoker.asmx?wsdl)"
at mx.rpc.soap::WSDLParser/::dispatchFault()
at mx.rpc.soap::WSDLParser/
http://www.adobe.com/2006/flex/mx/internal::httpFaultHandler()
at
flash.events::EventDispatcher/flash.events:EventDispatcher::dispatchEventFunction()
at flash.events::EventDispatcher/dispatchEvent()
at mx.rpc::AbstractInvoker/
http://www.adobe.com/2006/flex/mx/internal::dispatchRpcEvent()
at mx.rpc::AbstractInvoker/
http://www.adobe.com/2006/flex/mx/internal::faultHandler()
at mx.rpc::Responder/fault()
at mx.rpc::AsyncRequest/fault()
at ::DirectHTTPMessageResponder/securityErrorHandler()
at
flash.events::EventDispatcher/flash.events:EventDispatcher::dispatchEventFunction()
at flash.events::EventDispatcher/dispatchEvent()
at flash.net::URLLoader/flash.net:URLLoader::redirectEvent()
I incur the same problem when I place the same file on my
laptop's web-server. Can anyone tell why Flash Runtime could not
find the wsdl file?
Regards,
Jehanzeb

I believe this is a security sandbox issue. You will need a
crossdomain.xml file on the server that is serving the webService.
Check the docs, archives, and google for more detail.
Tracy

Admin Commands issue on Windows Web Server 2008 R2 - 64Bit

Hi,
I have tried exactly same process on FMS3.5 Installed on Centos and it worked perfectly.
But not working in case of Windows Web Server 2008 R2 - 64Bit.
Here is what i am trying to do -
Basically i want to extract live streams list and display them in HTML as ordered list on another server them FMS.
What i did in the case of FMS on Centos server -
I installed Apache and PHP on this server and created a PHP file with following text in it. -
abc.php
   $xml = simplexml_load_file('http://<fms-server-ip>:1111/admin/getLiveStreams?auser=admin&apswd=password&appInst=live','Simple XMLElement', LIBXML_NOCDATA);
foreach($xml->children() as $child)
   foreach($child->children() as $child2)
          echo $child2 . ",";
and in hosting server where i want to display the list i entered following code in PHP file -
$homepage = file_get_contents('http://<fms-server-ip>/abc.php');
echo $homepage;
i got comma seperated values easily and everything is loading fast without any issue.
Now problem occured with Windows Web Server 2008 R2 - 64Bit.
I installed FMS, Apache and PHP in this server also, did evrything in the same way like in centos.
FMS, APache and PHP files are working fine in this.
But only problem occured when in abc.php i use
$xml = simplexml_load_file('http://<fms-server-ip>:1111/admin/getLiveStreams?auser=admin&apswd=password&appInst=live','Simple XMLElement', LIBXML_NOCDATA);
After this file do not loads and takes longer time to load and after some time a blank page appears. It works fine with a local XML file.
i am able to see the XML file by opening it directly in browser, but somehow this is not working with   simplexml_load_file. I dont think this is PHP issue because with local XML file it works fine. May be some port issue or something else. But i am able to view XML file directly in browser from another computers as well.
Kindly help, is there some other configurations should be changed in case of windows version. I have allowed admin commands as usual before doing all this. Ports 1111,80,1935 are also opened.
Please guide

Hi,
Yes in Browser, the response is perfect. The only issue is in Calling inside in any file, i even tried Javascript's XML dom to load it, but same result, the file is just loading and never loads completely. I also tried using an SWF file with AS3 code to load XML inside as3 and send the result to any JS function.
The output comes using trace in as3, but when it comes to browser, the same loading happends and result never loads.

Dreamweaver Namespace issue on my web server

I am hosting my site on GoDaddy.com. I have created a site
using Dreamweaver CS3 and SQL2005. Everything works great on my
local machine, but when I upload it to the remote web server, the
aspx pages do not work. GoDaddy support says it is due to the
second line in every one of my aspx pages, specifically the
namespace attribute. From what I've read, this is automatically put
into every page created by Dreamweaver that contains an asp/asp.net
control. GoDaddy's response is to remove this line from my page and
everything will work great, which obviously it will not. I really
would not like to have to rebuild 32 + aspx pages after already
developing them in Dreamweaver. The actual line they say is causing
the problem is below:
<%@ Register TagPrefix="MM" Namespace="DreamweaverCtrls"
Assembly="DreamweaverCtrls,version=1.0.0.0,publicKeyToken=836f606ede05d46a,culture=neutra l"
%>
Does anyone have any suggestions as to how to get around this
issue?

"carrb69" <[email protected]> wrote in
message
news:[email protected]...
> Joris,
>
> I did have the dll located in a subfolder of the root
directory. I also
> put it
> in the root directory as well after receiving your
previous response and
> got
> the same results. Unfortunately, I would need to go to
GoDaddy to get the
> exact
> error because all I see when I try to access my aspx
pages is a very
> generic
> error. I had to go to GoDaddy previously to figure out
that it was the
> Namespace attribute that was causing the issue. I'll try
this evening to
> get
> them to send me the actual error message and post it
then. Thanks for the
> quick
> responses.
>
> Brian
Hi Brian,
maybe it's your browser that's hiding the error message, if
using MSIE then
please disable the "Show friendly HTTP error messages" option
in Internet
Options.
If that doesn't reveal the error message, try editing the
web.config that
dreamweaver generated for you with the following settings,
(add any missing
settings, and leave the connectionstrings that dreamweaver
has setup intact)
<configuration>
<system.web>
<compilation debug="true"/>
<customErrors mode="Off"/>
<trace
enabled="true"
traceMode="SortByCategory"
requestLimit="10"
pageOutput="false"
localOnly="false"
/>
</system.web>
</configuration>
Debug Compilation should give more insight inrto compilation
errors, which
can allso be done at the page level via<% @ Page
debug=true" %>
Custom Errors Off will disable any error pages that may be
shown in case of
an error, seting it to "emoteOnly" will only thow these page
to external
visitors, but since you are not working on the server that
actually makes
little sense.
The trace setting should enable a HTTP Handler that allows
you to view trace
information from /trace.axd in the root of your website,
enabling pageOutput
will inject the tracing information into every page, which
can allso be done
at the page level via <% @ Page trace=true" %>
There settings do have a performance impact because they are
enabled for
every request in the application, once you've got the errors
out disable
them at the application level and enable them per-page.
Hope this helps
Joris

Security Principal propagation from Web Server to App Server

How would I propagate a customer Principal from weblogic Web Server
to a Weblogic App Server?
For e.g this is what I want to do.
1. User logs in via a login page with UserId and password.
2. After a user is authenticated successfully, I want to fetch
some user credentials like groups he belongs to, his status etc.
basically his profile info (stored in oracle db). I want to store
this as part of a security principal object. How do I let the weblogic
web server know about this principal?
3. I want the Weblogic Servlet container to recognize this principal
and whenever any servlet calls a ejb, the web server should send
this custom principal to the weblogic app server so that the ejb
container can identify it.
4. In the ejb, I should be able to do sessionContext.getPrincipal()
that will return my custom principal object, which would give the
ejb access to the credentials of the logged on user.
Has anyone done this? This is urgent. Can anyone pls shed some
light on this.

Hi,
Basically you need to install the loadbalancer plugin on the web server and then configure the loadbalancer.xml in the config folder. You need to turn the httpsrouting to true. Then all will work fine for HTTPS and HTTPS
for HTTPS on web server and HTTP on app server, you need to turn the httpsrouting to false.
Regards,
Abrar

Running the G server and labview web server as a stand-alone serve

Hello,
Now I am running the G web server from the Internet toolkit cooprating with the Labview default web server because I need the server to handle both GCI reguests and the requests of the remote panel.
Now I have a question. Is there any way to make these two servers as stand-alone applications and also make it to be window service ( I think if I could make them the stand-alone applications, making them to be window services would be easy)? I just want the web server to be a stand-alone application without installing the Labview (just installing the run-time engine) on one machine. Could this be done? Thank you very much.
Best Regards,
Benjamin Chu

Hello Benjamin,
for running a LabVIEW application as Windows Service is here a tutorial.
I formerly tried to get the G web Server into an application and I know there were some dynamic VIs loaded by the HTTP Server Control.vi and some SubVIs. I never tried this seriously enough to get it running.
You need at least to put the VIs vi.lib\addons\internet\http\http0.llb\HTTP Server, vi.lib\addons\internet\http\http0.llb\srvr_%02d.vi (%02d is part of a format into string with a for loop index), HTTP Load Configuration Files.vi as dynamic VIs into your build definition.
Running the G Web Server and looking at the VI hierarchy is not for help because for some reasons the G Web Server VIs will not show up in the VI hierarchy window.
Waldemar
Using 7.1.1, 8.5.1, 8.6.1, 2009 on XP and RT
Don't forget to give Kudos to good answers and/or questions

How to configure LabVIEW web server to allow viewing and accessing the content of a folders

I have added the following html line to the body of the html file generated by the LabVIEW Web Publishing Tool:
<a href="MyFolder" target="_blank">My Folder Content</a>
I expect the link labeled "My Folder Content" to open a new browser window displaying the content of "Myfolder" which is located inside the LabVIEW webserver root folder. I got an error instead. If I substitute "Myfolder" with a filename, the browser will display the file just fine.
Can someone provide me with some hints on configuring the web server for this purpose?

Hola Hector
Estoy trabajando con tu caso y se me ha hecho bastante interesante.
Solo te quiero preguntar... que version de Internet Explorer tienes?
Utilizas algun otro web server ? ( Mozilla tiene este problema me parece)
Segui los pasos que mencionas con Internet Explorer 6
y pude abrir la carpeta sin problemas.
Te pido por favor que me contestes estos datos para darte una solucion muy especifica.
lamentablemente tengas que hacer referencia directa ( todo el path) a los archivos del folder para accesar a ellos si tu explorador no lo permite.
Lo unico que puedo confirmarte es que parece no ser un problema de National Instruments.
sin embargo si me das mas informacion podemos descartar cualquiera de las conclusiones a las que he llegado.
Espero tu respuesta
Saludos
Erwin Franz R.

Using LabVIEW Web Server in RT for other web applications

I'm looking to find out whether or not I can host other web page technologies (Java Scripts for example) on web pages hosted on a LabVIEW RT target. I'd like to be able to post a configuration or status page on the web server as well as the standard VI Front panel page.
Thanks,
Jason

Hello,
LabVIEW RT Web Server is not meant to be used for other things different from LabVIEW VIs. This feature is not supported.
Ricardo S.
National Instruments.

Security issues with calling web services from within Oracle?

I'd like to use a trigger to initiate pushing data to a web service, so I thought we should call the web service from PL/SQL in a DBMS job, or perhaps create a .NET stored proc to call the service. Our DB Lead is concerned about security, since the standard model is for clients to call the database, and not for the database to function as a client.
Does this pose any security risk? Can you refer me to any best practices or articles on this?
Thanks in advance.
Edited by: Kit.net on Nov 9, 2010 11:28 AM

First, a trigger is there to for a single sole purpose - guaranteeing the integrity of the data and the transaction. It is not there to interact with external services and processes (like mail, web and other services). Doing that exposes the transaction to those other processes/services. The transaction can now fail. not because of a business rule validation, but because of a network error when the trigger accesses an external service. How on earth can a business transaction fail when the transaction is valid, but a the transaction's trigger hit an external access error!?
And what happens do that event you have fired off in the trigger, when the transaction is rolled back? How do you undo that event you have created in the trigger that was based on uncommitted data?
So using a trigger like this is simply stupid (and yes, I have seen it too often in practice with horrible results to sugarcoat such an idiotic approach).
As for calling a web service from the database, using the database as the client in such a case. This is not a security risk. This is not unusual. In fact, it is very common in my experience. We have a lot of databases, ranging from SE to EE and several RAC clusters. All of them function as a client at some stage during processing. Some use a db link - and as a client fire off a SQL via that db link to a database server to obtain data. Some use ftp and act as a ftp clients, transferring processed data (XML format) to a server. Some call web services to extract data from 3rd party systems to reconcile the differences between local data sets and 3rd party data sets..
This is common between server and server. I do not see anything unusual in the database server using another server (and acting as a client when it does). Security between servers should not be a major problem (in fact, it can easily be done in a very robust way using trusted and encrypted communication).
The problem occurs when a client connects to the server and client and server roles are swapped at some stage (like the server "writing" a file directly to the client's filesystem). This very seldom makes any sense. And this is where authentication and security become an issue.

Is it possible to implement compression like gzip with the labview web server?

I am currently implementing a web page to be served by the NI sbRIO 9636. I was able to get html, css, and js served just fine. I am curious if there is a way to implement gzip compression to help with page load times?
Solved!
Go to Solution.

Ok, a couple points:
I have heard it discussed that you can in theory install a webserver on the Linux-based cRIO. But there is a great big caveat: I have never done it, or spoken to anyone who did so I don't know how well it would actually work.
Given the inexpensive price of hardware these days a safer alternative would be to include a separate computer the sole function of which is to host the web interface. There are many small computers that would be ideal for this application -- many of which were originally designed to work in home-theater applications.
The point of my post was that there are certain limitations in the LV webserver that you may have to find your way around.
Mike...
Certified Professional Instructor
Certified LabVIEW Architect
LabVIEW Champion
"... after all, He's not a tame lion..."
Be thinking ahead and mark your dance card for NI Week 2015 now: TS 6139 - Object Oriented First Steps

Sql Server 2008 Reporting Security issue ( added name to Server, some how cannot acces the report ) getting error message

have added name to Sql server , users cannot access the report, getting error message ,
I have give all the permission to this users, so why this users still cannot look at the report,
and getting error message,
An error has occurred during report processing.
cannot create a connection to data source Ax live
for more information about this error navigate to the report server on the local server machine or enable remote errors.
can some please help me what this message means,
I really appreciate it
thanks In advance

If "Credentials supplied by the user running the report" is selected, when the report is run, the user will be prompted to provide credentials. They would need to provide credentials that have the appropriate permissions (e.g., read, execute) to the
database. This prevents the double hop.
If "Credentials stored securely in the report server" is selected, you have to enter the username and password of a user (or service account) that has the appropriate permissions (e.g., read, execute) to the database. When the report is run, SSRS will use
these stored credentials each time to authenticate to the database engine and query the data. Users running the report are not prompted to provide credentials. With this option you can use an Active Directory or SQL Server account.
In order to access/run the report, a user will need to authenticate to SSRS. There are options here as well. You can provide them the link to the report manager and they can authenticate, navigate to, and run the report. You can also provide
direct links to reports that users click in a document or application. At this point the user is typically still prompted to authenticate to SSRS. You can also programmatically call the report using API's and essentially build a proxy that authenticates
to SSRS and open the report.
Not sure if that answers your question.

Security Issues of Labview Web Server?

Similar Messages

Maybe you are looking for