Linux-Tricks on OiePoie!

Free strong (two factor) authentication using One Time Passwords on your mobile phone

Fri, 02 May 2008 00:18:44 +0200

Authentication is the process by which you verify that someone is who they claim they are. In computerland this mostly involves a secret. By using the secret (for instance a password) in the authentication process Alice (there she is again) proves to Bob that she really is Alice since the secret is coupled to her (digital) identity. This process is as old as the road to Rome.
But not all secrets are as secret as we would like them to be. If i choose the name of my girlfriend as the secret, it might be easily guessed, even by someone who doesn’t know me, but is willing to go through the effort of making a few phone calls. Also secrets can be captured in transit, through shouldersurfing when you log in to the system, etcetera.

The next step in this game is strong authentication a.k.a. two factor authentication, this is where you combine two out of the next three options to prove your identity:

something you know (e.g. password, pin)
something you have (e.g. token, smartcard, cellphone)
something you are (e.g. fingerprint, iris pattern, DNA, voice)

So apart from capturing someones secret, Eve also has to steal the token/smartcard/cellphone or in case of biometrics duplicate your fingerprint/iris in a way the scanner is convinced that it’s still attached to a human being. This doesn’t make it impossible to authenticate as somebody else, it just makes it harder.

One of the problems with strong authentication is that it is expensive. You can get (for instance) an RSA token on a trade fair for free, but when you actually want to use one you have to buy the token and also buy the license for the authentication server that is needed to make it work, this may set you back between $50 – $100 per user.

Another disadvantage is the the cryptographic algorithm used to produce to codes is know only to the company, so you can’t use the RSA token and verify the authentication process to a authentication server of a different vendor. Also nobody can check if the cryptographic principles on with the product is build are sound. Good cryptography is build on open source so anyone can verify the correctness of it’s operation.
Luckily for us there is the Open Authentication Framework (OATH) which led to the definition of the “Hashed Message Authentication Code One Time Password” or HMAC OTP or even more concise HOTP. If you are interested you can read rfc4226 on it’s inner working’s and even build your own implementation.

The next step is to build our own strong authentication system using HOTP. Tri-D systems has an open source One Time Password authentication server available for download. They also sell the tokens to use for authentication, but since we are talking open source HOTP we can look for a company which sells the authentication server and has a (soft) token for free: Data Security Systems Solutions. They provide a free Java Phone Token which can generate the One Time Passwords.

Build Process

goto: http://www.tri-dsystems.com/software/downloads.html
accept license and download otpd-3.1.0.tar.gz & pam_otp_auth-3.2.2.tar.gz

gtar zxvf otpd-3.1.0.tar.gz cd otpd-3.1.0/ ./configure make make install

mkdir /etc/otpstate touch /etc/otppasswd chmod 600 /etc/otppasswd chmod 700 /etc/otpstate mkdir /var/run/otpd touch /var/run/otpd/socket

install oathdsss on your Nokia or Windows Mobile phone
from: http://www.dsssasia.com/token.html
and start the program

First time initialization asks for a label, e.g. SEC
a seed length between 16 … 20 (choose 20)
OTP Length between 6 … 8 (choose 6)

Select Options -> Init
and register the seed displayed:
e.g. 44D060008BF440A2F9FF588AAD537F78B820F200
Now copy the seed to your computer, don’t make any mistakes or it won’t work.
The seed is case insensitive since it’s a hexadecimal number. If you are using a Windows Mobile device, you might have to switch it to landscape to see all the characters, you should see a left and right square bracket.

Do you want to set a PIN to protect the OTP?
Yes (otherwise it wouldn’t be two factor authentication)
Pin: ****
Pin Again: ****

If all goes well oathdsss finishes and when you start it
up again, you will be asked for a PIN and after that the
6 number OTP is displayed together with a countdown timer
running from 60 seconds.

Setting up the OTP server
Enter the generated seed from your cellphone into /etc/otppasswd

cat >> /etc/otppasswd
foo:hotp-d6:44D060008BF440A2F9FF588AAD537F78B820F200

foo is the username, alter it at your convenience
hotp-d6 is the token algorithm, so HOTP with a 6 digit OTP.

Generate two OTP’s from your cellphone and use them with resynctool (this is installed together with the OTP server) to save the state information which the OTP server will need in the authentication process:

resynctool -1 816857 -2 433761 -u foo -k 44D060008BF440A2F9FF588AAD537F78B820F200 > /etc/otpstate/foo

If you look at the contents of /etc/otpstate/foo you should see something like:

5:foo:0000000000000003:::0:0:0:

Due to a bug (i assume) resynctool is not able to work with 7 or 8 figure OTP’s (it will present you with the error message: resynctool: passcode 1 wrong length). There is also a second bug (maybe we should call it an discrepancy). While resynctool writes: 0000000000000003 meaning the first two OTP’s have been used and the next to be presented is number 3, the otp server reads that 0000000000000003 as: the first three OTP’s have been used and the next to be presented is number 4. So change the number back to 0000000000000002 or generate an OTP from you cellphone and don’t use it.

Testing authentication

start up otpd as root in debug mode:

# otpd -D
otpd: otpd 3.1.0 starting
otpd: accept_thread: tid=3086179248

Now generate an OTP from your phone and test it with:

# otpauth -u foo -p 549855 -s /var/run/otpd/socket
0 (ok)

On the otp server you will see:

otpd: accept_thread: plugin accept fd=5
otpd: work_thread: tid=3076053936, fd=5
otpd: work_thread(3076053936,5): handling plugin request for [foo]
otpd: verify: [foo], sync challenge t:0 e:0 0000000000000004, expecting response 549855
otpd: verify: user [foo] authentication succeeded
otpd: work_thread(3076053936,5): plugin disconnect

If you don’t see a 0 (ok) from otpauth, you might get a 3 (authentication error) which means you didn’t present the expected OTP to the server. In the server debug window you will see 5 OTP’s (configurable through /etc/otpd.conf) which the server expects from that user account. Generate another one from you phone an you will immediately see if that one is in the list and will work.
If you get a 5 (service error) there is something wrong with your configuration and you have to fix that first before authentication will work.

You might want to play around a little bit more with the HOTP software to get a grip on how it’s working. An easier way to generate the OTP’s is through a small perl program on your computer. For this you have to install the Authen::HOTP module:

perl -MCPAN -e 'install Authen::HOTP'

And then create this program:
[perl]
#!/usr/bin/perl
use Authen::HOTP qw(hotp);
use strict;

my $secret=”44D060008BF440A2F9FF588AAD537F78B820F200″;
my $counter=$ARGV[1];
my $digits=$ARGV[0];

my $pass = hotp($secret, $counter, $digits);
print “$pass\n”;
[/perl]

Now it’s a easy as:

# ./hotp.pl 6 5
853481

If you got a successful authentication we can proceed to doing something useful with HOTP. Tri-D delivers a pam-otp module which you can use on a local system to replace your standard username/password authentication dialog. But they really recommend using the OTP daemon through RADIUS.
So download freeradius and compile & install:

cd /tmp wget ftp://ftp.freeradius.org/pub/radius/freeradius-1.1.7.tar.bz2 gtar jxvf freeradius-1.1.7.tar.bz2 cd freeradius-1.1.7 ./configure make make install

cd redhat/ cat rc.radiusd-redhat > /etc/init.d/radiusd chkconfig –add radiusd chkconfig –list radiusd radiusd 0:off 1:off 2:off 3:off 4:off 5:off 6:off

On my redhat system i had to modify /etc/init.d/radiusd to read:
RADIUSD=/usr/local/sbin/radiusd
and i had to run ldconfig again or otherwise radiusd would complain about
a missing libradius-1.1.7.so

Modify the radius configuration /usr/local/etc/raddb/radiusd.conf to allow for One Time Passwords:

remove the comment (#) before: $INCLUDE ${confdir}/otp.conf
add otp directly below authorize {
add otp directly below authenticate {

And start otpd and the radius service up:

# otpd
# service radiusd start
Starten van RADIUS server:                                 [  OK  ]

Now we can test OTP authentication through RADIUS with the radtest program:

# ./hotp.pl 6 11 885417

radtest foo 885417 localhost 10 testing123

Sending Access-Request of id 197 to 127.0.0.1 port 1812 User-Name = “foo” User-Password = “885417” NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=197, length=20

tail -1 /var/log/messages

May 1 23:25:10 vortex otpd[11395]: verify: user [foo] authentication succeeded

testing123 is the default RADIUS secret for localhost, you MUST change that in:
/usr/local/etc/raddb/clients.conf, the NAS port number (10) is not used.

On my testbox there was no pam_radius_auth module, so:

cd /tmp
wget ftp://ftp.freeradius.org/pub/radius/pam_radius-1.3.17.tar.gz
gtar zxvf pam_radius-1.3.17.tar.gz
cd pam_radius-1.3.17
make
cp pam_radius_auth.so /lib/security/
cat  pam_radius_auth.conf > /etc/raddb/server
chmod go-rwx /etc/raddb/server

Edit /etc/raddb/server to match te secret for localhost in /usr/local/etc/raddb/clients.conf, next add a line in /etc/pam.d/system-auth like this:

auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/pam_radius_auth.so try_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

This will allow normal password authentication, but if you are providing an OTP the unix password authentication will fail and the OTP is passed on to the pam_radius_auth module for validation.

You can also use OTP authentication on you Apache webserver by using the mod_auth_radius module.

Have fun!

sources:
Foo Bar Quux
Tri-D QuickStart Guide

Update 20080529
Since it looks like the Tri-D site is offline, i will make my copies of otpd and pam_otp_auth available for download:

Oneliner to remove duplicates while maintaining the original order

Sat, 12 Jan 2008 16:58:01 +0100

If you have got a list like this:

one
two
one
three
one
two
four

and you want to remove the duplicates from the list, chances are that you will end up with this result:

four
one
three
two

Because you are using a command like:

sort -u < list.txt

or the longer form:

cat list.txt | sort | uniq

There is an easy way to keep the original order of the list and remove the duplicates in an oneliner.
For this you need to number the entries in the list with this command:

nl list.txt

If you don't have nl on your system, you can use cat -n or whatever tickles your fancy.
This will give you the list:

     1  one
     2  two
     3  one
     4  three
     5  one
     6  two
     7  four

We will use the numbering to restore the original order when we are done removing the duplicates.
Next thing is to sort the list on the second field:

nl list.txt | sort -k2

     7  four
     1  one
     3  one
     5  one
     4  three
     2  two
     6  two

and tell sort to remove the lines with duplicate fields:

nl list.txt | sort -k2 -u

     7  four
     1  one
     4  three
     2  two

All that is left is to restore the original order:

nl list.txt | sort -k2 -u | sort -n

     1  one
     2  two
     4  three
     7  four

and get rid of our inserted numbering:

nl list.txt | sort -k2 -u | sort -n | cut -f2-

one
two
three
four

Imagine trying to do this on a Windows box, I wouldn't know where to start 😉

Oneliner to remove duplicates while maintaining the original order

Sat, 12 Jan 2008 16:58:01 +0100

If you have got a list like this:

one
two
one
three
one
two
four

and you want to remove the duplicates from the list, chances are that you will end up with this result:

four
one
three
two

Because you are using a command like:

sort -u < list.txt

or the longer form:

cat list.txt | sort | uniq

There is an easy way to keep the original order of the list and remove the duplicates in an oneliner.
For this you need to number the entries in the list with this command:

nl list.txt

If you don't have nl on your system, you can use cat -n or whatever tickles your fancy.
This will give you the list:

     1  one
     2  two
     3  one
     4  three
     5  one
     6  two
     7  four

We will use the numbering to restore the original order when we are done removing the duplicates.
Next thing is to sort the list on the second field:

nl list.txt | sort -k2

     7  four
     1  one
     3  one
     5  one
     4  three
     2  two
     6  two

and tell sort to remove the lines with duplicate fields:

nl list.txt | sort -k2 -u

     7  four
     1  one
     4  three
     2  two

All that is left is to restore the original order:

nl list.txt | sort -k2 -u | sort -n

     1  one
     2  two
     4  three
     7  four

and get rid of our inserted numbering:

nl list.txt | sort -k2 -u | sort -n | cut -f2-

one
two
three
four

Imagine trying to do this on a Windows box, I wouldn't know where to start 😉

Gratis online boeken over Linux, Programmeren, Security

Fri, 11 Jan 2008 22:56:25 +0100

Eigenlijk is december de maand van de lijstjes, maar ik kwam ergens een lijstje van online Linux boeken tegen, ging op zoek naar andere lijstjes en gratis online boeken en kon het toen toch niet nalaten om een superlijst van gratis boeken te maken.

Nu nog een iLiad of een kindle om al dat online spul eens fatsoenlijk te kunnen lezen.
Tip:Er is ook een nieuwsgroep: alt.binaries.e-book.technical waar veel leuke boeken in worden gepost om te downloaden, maar daar nemen ze het met Copyright niet zo nauw.

Working with Nikon RAW (.nef) photo’s on Linux

Wed, 05 Dec 2007 13:38:18 +0100

If you own a digital SLR (Single Lens Reflex) camera, there comes a time when you want to move to RAW format because it gives you so much more options of processing the photo afterwards. Also the price of memory cards has decreased tremendously, so the extra storage space needed is no reason anymore to keep shooting in JPEG. On my last holiday to Canada i took 3 compact flash cards of 4GB each with me, so i had room for around 2000 photo’s with my Nikon D70S.

When i returned from this fantastic holiday and mounted the memory cards on my Linux box to look at the results, i had a bit of a disappointment because the .nef files were not recognized by gqview, my favorite photo viewing program. Also i couldn’t put them straight away on the website, because nobody would see the picture when clicking on the nef images.

After a little bit of searching on Google i discovered that a Nikon NEF image contains four JPG images, so you don’t need to convert the NEF to JPG, but you can just extract the desired jpg image from the NEF file. Phil Harvey has written the excellent exiftool to do that (and a lot more) on Linux. The syntax to do this is:
exiftool -b -JpgFromRaw orignal.NEF > output.jpg

If you want to do this for a lot of files, you can use the command like this:
exiftool -b -JpgFromRaw -w _C2007.JPG -ext nef -r .

The command specifies to operate recursively on all files in the current directory (-r .) and use the original filename with _C2007.JPG appended as output filename.
But it turned out that the EXIF information which is present in the original NEF image is not copied to the resulting JPG image. Luckily you can do that with exiftool in a second step:

exiftool -b -JpgFromRaw original.NEF > output.jpg

Before putting these images on my website i wanted to scale them down to a viewable dimension and also rename the image to a more sensible name. By choosing a name based on the date i took the photograph, the images would automatically be listed (and viewed) in chronological order. Also because i took two camera’s with me on holiday, this would allow me to merge both photo sets into one directory and still have them in chronological order.

To automate all the steps, i wrote a small perl program which i named neftojpg.pl

[perl]
#!/usr/bin/perl -w
#
# wil create a set of JPEG images from NIKON NEF files
# resize those to $pix pixels
# copy the EXIF data over from NEF to JPEG
# and rename the JPEG files to a filename based on the
# creation date

# 20071205 (c) Ewald

use strict;

my @files;
my $file;
my $name;
my $pix=”800×600″; # desired geometry
my $dir=”.”;
my $dirname=”small”; # output subdirectory
my $ext=”nef”; # nef for NIKON, crw for Canon

@files = <$dir/*.$ext>; # set of files to work on

foreach $file (@files) {
print “processing $file\n”;

($name) = ($file =~ /.*\/(.+?)\.$ext/); # separate name from file extension

if (!-d $dirname) {
mkdir $dirname or die “$!”;
}

# extract jpg image from raw and convert to $pix pixels
qx{exiftool -b -JpgFromRaw $file | convert – -geometry $pix $dirname/$name.jpg};

# copy exif tags from the raw image into the jpg file
qx{exiftool -TagsFromFile $file $dirname/$name.jpg};

# rotate image if nessessary based on EXIF information (NB your camera might not support this)
qx{exiftran -ai $dirname/$name.jpg};

# rename jpg file to a date based name
qx{exiftool ‘-FileName$ext to CRW the script should just as easy work for Canon RAW image files.

Both exiftool and ImageMagick (where the convert command comes from) have their own perl modules, so the next step would be to get rid of the qx{} to execute shell commands and rewrite all operations in perl, but i am in no hurry yet to do so 😉

completely removing information from an USB stick

Wed, 28 Nov 2007 18:15:46 +0100

Perhaps you have seen those movies where a person is questioned about things from the past. Of course he doesn’t remember all those embarrassing things the interrogator wants to know. Then a hypnotherapist is called in and puts the man under hypnosis and all details come pouring out.
A USB stick acts the same. If you look at it from Windows explorer or you do a mount + ls under Linux you see only the information which is on the surface. But beneath it a lot of other information is often lingering, information which maybe could be embarrassing if it falls into the wrong hands.
The reason for this is that when files are deleted from the USB stick, or from a harddisk for that matter, they not actually wiped. The only thing that happens is that the space is marked free in the File Allocation Table. But as long as this space is not overwritten by new files, the information still remains on the device.
That is why undelete tools can recover files for you.

A potential risk is that when you hand over your thumbdrive to someone for copying info on or of the stick, they might just copy a complete image of the stick to their laptop. There is even a handy program: USBdumper which provides this functionality. Afterwards they can do a forensic analysis of the data, for instance using foremost and see what kind of residual data they can retrieve. On linux you could even do a strings < USBimage.dd to get a quick view.

So how to avoid this risk? If you are on a Windows system, there is a free tool called eraser which securely wipes all residual data of a device. For Linux there are a number of tools, for instance wipe, but it is more fun to do it by hand and know what you are doing.

Let’s say i plug in my USB stick and mount it under: /media/disk
When i execute a df -k it displays how much space is free and therefore the number of bytes of hidden information there possibly are on the stick:

# df -k /media/disk/
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sdb1               249336     60736    188600  25% /media/disk

To completely obliterate all data, we need to overwrite all information with something else. If this were a harddrive, the specialists say you need to overwrite the data a fair number of times with random bytes, otherwise it’s possible that the NSA can still reconstruct the original bits from looking at the magnetic patterns on the disk. But since we are talking microchips here, anything will do. The fastest way would be to read zero’s from /dev/null, but we will use /dev/urandom just for the fun of it 😉

Since there are 188600 blocks of 1 kbyte free, we need to write exactly that amount of data to the USB drive:

# cd /media/disk/ # dd if=/dev/urandom of=rnd.bin bs=1k count=188600 188600+0 records in 188600+0 records out 193126400 bytes (193 MB) copied, 52.3836 s, 3.7 MB/s

df -h .

Filesystem Size Used Avail Use% Mounted on /dev/sdb1 244M 244M 0 100% /media/disk

sync

ls -l

total 188640 drwxr-xr-x 2 root root 4096 2007-11-22 15:39 porn_collection drwxr-xr-x 2 root root 4096 2007-11-21 14:11 passwords -rwxr-xr-x 1 root root 193126400 2007-11-28 15:43 rnd.bin

hexdump -C rnd.bin | head -6

00000000 6b 9d 85 95 6c 41 00 56 30 c5 f4 49 0a 90 ed 5a |k…lA.V0..I…Z| 00000010 54 eb df 6d 4e 53 7a 39 33 a8 21 44 f7 a7 df 61 |T..mNSz93.!D…a| 00000020 6a 33 f6 77 c1 cb d4 46 6e ab 57 0d 28 8e eb 13 |j3.w…Fn.W.(…| 00000030 f3 0d bd 28 eb 96 54 6c 21 ec d9 91 b8 4e ea 50 |…(..Tl!….N.P| 00000040 fa 98 8e 78 0c d0 6c 49 7d 4a c6 b9 37 87 84 21 |…x..lI}J..7..!| 00000050 ad 25 a5 fa 6a 52 62 ff 54 ae 77 ba 9d 45 4d a3 |.%..jRb.T.w..EM.|

That looks alright, since 188600 * 1024 = 193126400 and sync is needed to flush the data from the write cache to the USB disk.
The only thing left to do is remove the random blob again (but now you know that what happens is that the space is marked free in the File Allocation Table and our random bytes remain in place), sync and unmount:

# rm -f rnd.bin
# sync
# cd
# df -k /media/disk/
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sdb1               249336     60736    188600  25% /media/disk
# umount /media/disk

And as you can see we are spacewise exactly where we started from.

Caveat lector! This trick only protects you from somebody recovering deleted information. If you got private files on the stick, use cryptography to protect those. TrueCrypt is a very nice program you can use. If you choose a simple password to access the encrypted files, you might as well use no crypto at all.

Sniffing Google’s blacklist for firefox

Sun, 25 Nov 2007 16:40:05 +0100

Firefox 2 has a new security feature which protects you from entering private data on phishing websites or getting infected with malware on a website which promises you heaven and earth.
Protection is done by comparing the website address (URLagainst a so called blacklist. The blacklist is maintained by the good folks at Google, they take care of updating the blacklist regulary and firefox automagically downloads new versions.
Curious by nature, i wanted to know which websites were in the blacklist, so i took a peek in my .mozilla/firefox/… directory where all the users stuff is stored. The blacklist itself is easy identified by it’s name: urlclassifier2.sqlite and the extension betrays what kind of system is used to store the bad sites: sqlite.

SQLite is actually a database program, but in it’s simplest form. You don’t need to run a database engine and setup permissions, etc. But the complete database is stored into a file. So this is the KIS principle to the max, and it works great as long as the database doesn’t grow to large or to complex.

Next thing to do is fire up sqlite and have a look at the structure of the database:

$ sqlite3  urlclassifier2.sqlite
SQLite version 3.4.2
Enter ".help" for instructions
sqlite> .tables
goog_black_enchash goog_black_url goog_white_domain goog_white_url
sqlite> .schema
CREATE TABLE 'goog_black_enchash' (key TEXT PRIMARY KEY, value TEXT);
CREATE TABLE 'goog_black_url' (key TEXT PRIMARY KEY, value TEXT);
CREATE TABLE 'goog_white_domain' (key TEXT PRIMARY KEY, value TEXT);
CREATE TABLE 'goog_white_url' (key TEXT PRIMARY KEY, value TEXT);

Looks simple enough, the bad sites are probably in: goog_blac_url

qlite> select * from goog_black_url LIMIT 3;
uggc://ybtva.zlfcnpr.psz.shfrnpgvba.hfre.fcynfu.ubzr.zlgbxra.76701n2644n8605.pn0qpor.pbz/vaqrk.cuc|c
uggc://ealfcnprv.pbz/vaqrk.pszshfrnpgvba=ybtva.cebprff&ZlGbxra-wrrqk4r1ssn-s3kg3k2ns0-4r3-sfs3n421-s7goskks3ks231.ugz|c
uggc://eeaelfcnpr.pbz/vaqrk.psz-shfrnpgvba657Qybtva.cebprff8526ZlGbxraf79843964886883084155.ugz|c
sqlite> .quit

Hmm, it turns out that the content is encoded through the famous ROT13 methode. The reason being that the file otherwise might be flagged as harmfull by locally running antivirus software.

So we need a ROT13 decoder, this is easilly done with the unix utility tr and the complete construct snugly fits into a oneliner:

echo "SELECT * FROM goog_black_url LIMIT 3;" | sqlite3 \
urlclassifier2.sqlite | tr N-ZA-Mn-za-m A-Za-z

Which will output something like:

http://login.myspace.cfm.fuseaction.user.splash.home.mytoken.76701a2644a8605.ca0dcbe.com/index.php|p
http://rnyspacei.com/index.cfmfuseaction=login.process&ZyGoken-jeedx4e1ffa-f3xt3x2af0-4e3-fsf3a421-f7tbfxxf3xf231.htm|p
http://rrnryspace.com/index.cfm-fuseaction657Qlogin.process8526ZyGokens79843964886883084155.htm|p

If you’re brave, you might cut ‘n paste one of the URL’s in your firefox browser and see what happens 😉

Sniffing Google’s blacklist for firefox

Sun, 25 Nov 2007 16:40:05 +0100

Next thing to do is fire up sqlite and have a look at the structure of the database:

$ sqlite3  urlclassifier2.sqlite
SQLite version 3.4.2
Enter ".help" for instructions
sqlite> .tables
goog_black_enchash goog_black_url goog_white_domain goog_white_url
sqlite> .schema
CREATE TABLE 'goog_black_enchash' (key TEXT PRIMARY KEY, value TEXT);
CREATE TABLE 'goog_black_url' (key TEXT PRIMARY KEY, value TEXT);
CREATE TABLE 'goog_white_domain' (key TEXT PRIMARY KEY, value TEXT);
CREATE TABLE 'goog_white_url' (key TEXT PRIMARY KEY, value TEXT);

Looks simple enough, the bad sites are probably in: goog_blac_url

qlite> select * from goog_black_url LIMIT 3;
uggc://ybtva.zlfcnpr.psz.shfrnpgvba.hfre.fcynfu.ubzr.zlgbxra.76701n2644n8605.pn0qpor.pbz/vaqrk.cuc|c
uggc://ealfcnprv.pbz/vaqrk.pszshfrnpgvba=ybtva.cebprff&ZlGbxra-wrrqk4r1ssn-s3kg3k2ns0-4r3-sfs3n421-s7goskks3ks231.ugz|c
uggc://eeaelfcnpr.pbz/vaqrk.psz-shfrnpgvba657Qybtva.cebprff8526ZlGbxraf79843964886883084155.ugz|c
sqlite> .quit

Hmm, it turns out that the content is encoded through the famous ROT13 methode. The reason being that the file otherwise might be flagged as harmfull by locally running antivirus software.

So we need a ROT13 decoder, this is easilly done with the unix utility tr and the complete construct snugly fits into a oneliner:

echo "SELECT * FROM goog_black_url LIMIT 3;" | sqlite3 \
urlclassifier2.sqlite | tr N-ZA-Mn-za-m A-Za-z

Which will output something like:

http://login.myspace.cfm.fuseaction.user.splash.home.mytoken.76701a2644a8605.ca0dcbe.com/index.php|p
http://rnyspacei.com/index.cfmfuseaction=login.process&ZyGoken-jeedx4e1ffa-f3xt3x2af0-4e3-fsf3a421-f7tbfxxf3xf231.htm|p
http://rrnryspace.com/index.cfm-fuseaction657Qlogin.process8526ZyGokens79843964886883084155.htm|p

If you’re brave, you might cut ‘n paste one of the URL’s in your firefox browser and see what happens 😉

Caught a virus? Trinity to the rescue!

Sat, 04 Aug 2007 12:45:35 +0200

Last week we detected some PC’s in the network behaving badly. The were sending a massive amount of ping packets to one host on the Internet, so some sort of DoS (Denial of Service) attack. When we investigated the problem there was nog sign of the culprit at first, also McAfee which was installed and running had not detected anything abnormal going on.
What most people do next is load lots of tools on the PC and try to discover the hidden programs responsible for all this havoc. But actually there is a much simpler approach.

Today there is a lot of money to be earned by sending SPAM. But since sending SPAM is illegal in a lot of countries, the challange is to keep sending out these giant amounts of SPAM e-mail without being caught. The way to do this is by “owning” a lot of computers of unaware home users and send the e-mails through these systems. So if a recipient traces back the SPAM e-mail, he only sees the home computer as the source.

To be able to control these computers, the hacker needs to infect them with something that installs a backdoor. The backdoor is the way in for the hacker to control the computer and the program which installs the backdoor is often a trojan named after the trojan horse strategy of the greek.
Such an trojan might be an e-mail with the message that you received a postcard from a friend, neighbor or worshipper. To see the postcard you need to click on a link, and that link contains postcard.exe. Since you are curious by nature, you of course click on the link and execute the postcard program.
You might even see a postcard, but meanwhile a program is covertly installed on your computer and your system becomes a marionette to the hacker.

It is important for the hacker to keep his program hidden, because the longer it stays on your computer, the longer he can make money out of it. A way to hide programs from other programs (like you antivirus) is by using rootkit technology. A rootkit installs itself inside or just above the operating system. If you start the taskmanager to look at all the programs that are running, the taskmanager requests this information from the operating system. But instead of communicating with the OS, it really communicates through the rootkit, and the rootkit filters out it’s own existence when sending back the response from the OS to the taskmanager. So effectively the rootkit is a cloaking device which makes it own existence and the existence of the backdoor invisible.

The simple approach i mentioned to finding this kind of software is by eliminating the Operating System when you look for this kind of hidden software. The way we do that is by booting a different Operating System (known to be clean of rootkits) and from there start our search for the culprits. We even assure that the booted OS can not be infected with malware by running it from a read-only medium (i.e. a cdrom).

Trinity Rescue Kit

There are some other bootable cdrom’s out there with antivirus products on it, but TRK is different in that it supports 4 (four!) different antivirus products and they are all legal versions for you to use. Apart from the antivirus bit, TRK also has these (and more) features:

easily reset windows passwords
4 different virusscan products integrated in a single uniform commandline with online update capability
full ntfs write support thanks to ntfs-3g (all other drivers included as well)
clone NTFS filesystems over the network
wide range of hardware support (kernel 2.6.19.2 and recent kudzu hwdata)
easy script to find all local filesystems
self update capability to include and update all virusscanners
full proxyserver support.
run a samba fileserver (windows like filesharing)
run a ssh server
recovery and undeletion of files with utilities and procedures
recovery of lost partitions
evacuation of dying disks

Start with downloading the TRK iso from: here and burn it on a cdrom, for instance with Nero (here is a good tutorial on how to burn iso’s with Nero).
Put the cdrom in your computer and reboot, when the BIOS kicks in you might need to press a key to get a boot menu and select the cdrom to boot from (on Dell computer, press F12). When you see the TRK boot screen (click on the image for a larger version):

press enter to continue booting the default option. After a lot of text scrolling over your screen you will end up with a prompt, indicating that trinity as ready to obey your commands. To start scanning your computer for viruses, all you have to do is type in:
virusscan -a avg

This will mount all the Windows disks, update the virusscanner to the latest signatures and start scanning. Apart from selecting the AVG virusscanner, you can also choose to use: ClamAV by specifying “clam”, Bitdefender (bde) and F-Prot (fprot). But we had very good results with AVG. Of course if you are really paranoid, you can run them all four sequentially.

For the update to be successfull you will need an Internet connection on the computer. If the computer is detached from the network, you can first boot TRK on a different computer with Internet and then give the command:
updatetrk, this will update all four virusscanners and generate a new iso image from which you can burn a new updated cdrom.

When one of the virusscanners has found something fishy and has deleted of renamed the file, you can reboot Windows and be sure that the rootkit is not operational anymore. It is wise (now you know the name of the malware) to run a targeted removal tool for the malware, because they will clean up the registry as well.

Some other neat thing TRK can do is copy itself to an USB stick so you can boot it from there with trk2usb or start a fileserver so you can access all the disks from an other computer on the same network with: fileserver.
For a complete overview of it’s capabilities, type trkhelp or have a look: here.

Have fun & stay clean…

Leadtek Speeding Master GPS on Linux

Sun, 15 Jul 2007 14:42:43 +0200

I can’t resist buying gadgets, even when they are of no practical use (and that’s the characteristic of most gadgets) i am drawn to buying it, firing it up, see how it works, peek in it’s insides and after that it mostly ends in a box in my overcrowded hobby room. So when i saw this GPS device for only 35 € i had to buy it, even when the device has an outdated Sirf II receiver and only works when attached to a power source. 35 € is just no money for such an ingenious device.

The next thing is of course connect it to my Linux system and see how much trouble it will be to get things working. The Leadtek GPS is a RS232 serial device but comes with a serial to USB convertor. So when i plugged it in, the convertor registers on the system:

# dmesg | tail
usb 4-1: new full speed USB device using uhci_hcd and address 2
usb 4-1: configuration #1 chosen from 1 choice
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for pl2303
pl2303 4-1:1.0: pl2303 converter detected
usb 4-1: pl2303 converter now attached to ttyUSB0
usbcore: registered new interface driver pl2303
drivers/usb/serial/pl2303.c: Prolific PL2303 USB to serial adaptor driver

And it shows up on a lsusb output:

# lsusb
Bus 001 Device 001: ID 0000:0000
Bus 001 Device 004: ID 413c:a005 Dell Computer Corp.
Bus 001 Device 006: ID 0b97:7762 O2 Micro, Inc. Oz776 SmartCard Reader
Bus 001 Device 005: ID 0b97:7761 O2 Micro, Inc.
Bus 003 Device 001: ID 0000:0000
Bus 003 Device 002: ID 046d:c016 Logitech, Inc. M-UV69a Optical Wheel Mouse
Bus 004 Device 002: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port
Bus 004 Device 001: ID 0000:0000
Bus 005 Device 001: ID 0000:0000
Bus 002 Device 001: ID 0000:0000

To communicate with the GPS the documentation says the baudrate should be 38400 bits per second, so we will configure that for the first USB serial port and see what happens.

# /bin/stty -F /dev/ttyUSB0 speed 38400 raw cs8
38400

(i had to repeat the command twice on my system because the first time it reported back 9600 bps)

And Lo and Behold, there is the NMEA data spilling out:

# cat < /dev/ttyUSB0
$GPGGA,120523.932,5210.0992,N,00430.9070,E,1,08,1.2,57.4,M,,,,0000*30
$GPRMC,120523.932,A,5210.0992,N,00430.9070,E,0.00,,080707,,,A*7A
$GPVTG,,T,,M,0.00,N,0.0,K,A*13

Since humans are not optimally equipped for interpreting these sequences of data, we need a program to convert the messages into sensible information, for instance coordinates. I will use gpsd for this purpose. It's a daemon which can provide the information gathered from a GPS device to one or more clients even if they are not running locally. On my Fedora Core 6 system the program was available through yum:

#yum -y install gpsd gpsd-clients

First we will start it up in debug mode to see whether it understands our GPS:

# gpsd -N -n -D 5 /dev/ttyUSB0

gpsd: CLK 0x07 gpsd: Raw SiRF packet type 0x29 length 91: 2900000204059b02a5f30607d707080c143ed61f0000801f18412002b0f4cb000016f20000048f1500000000000000000000000000da0000018f00000000000002a35 c1100000000001c2453000000000000000000000000060800 gpsd: Raw SiRF packet type 0x02 length 41: 02003ba1d70004b582004c8357000000000000040802019b0043cb8006081d1a1c1b19000000000000 gpsd: MND 0x02: Navtype = 0x4, Status = 1, mode = 3 gpsd: <= GPS: $GPGGA,122016,5210.0993,N,00430.9087,E,1,06,1.60,12.3,M,46.766,M,,*44\x0d\x0a$GPRMC,122016,A,5210.0993,N,00430.9087,E,0.0000,0.000,080707,,27\x0d\x0a$GPGSA,A,3,0 8,29,26,28,27,25,,,,,,,2.7,1.6,1.23C gpsd: Raw SiRF packet type 0x09 length 9: 09004300040028007c gpsd: THR 0x09: SegStatMax=0.360, SegStatLat= 0, AveTrkTime=0.215, Last MS= -0 gpsd: Raw SiRF packet type 0x07 length 20: 07059b0043cb800600017a970016870f02a5f306

That's looking good, so now we can run it as intended:

# gpsd -n /dev/ttyUSB0

And have a client connect to finally show us our position:

$ xgps -speedunits kph -altunits meters

click on the image to see it in a seperate window

Now you could program a tomahawk missile with these coordinates and wipe me of the face of the earth (better ring first to see if i am at home, otherwise it would be a total waste of such an expensive missile). But before spending a million dollar on a rocket it might be interesting to know how accurate these coordinates are, otherwise you might wipe out my neigbhors, and they are perfectly amicable people.
One way of getting an impression is to build a so called scatter graph of the GPS data. The GPS outputs coordinate data approximately once every second, so we could collect one hour of coordinates and put them into a graph. The way to do this is actually very simple with gpsd:

$ gpsprof -n 3600 | gnuplot -persist
gpsprof: looking for fix...first fix in 0.73sec, gathering samples...

Here is the resulting graph:

click on the image to see it in a seperate window

This is all the help you will get from me, both in connecting the GPS device and in programming the missile with my home coordinates.

Have fun!

secure ssh access to your server

Sun, 03 Jun 2007 13:30:26 +0200

Every access to your system is a security threat.

Let’s focus on ssh (Secure Shell).
Even when there is no know security bug for ssh, hackers might have found a way in which they share (or sell) between them and which hasn’t surfaced yet. Even if there is no security bug at all for ssh, access mostly depends on username/password combinations and we all know what a weak system that is, especially when used from untrusted systems.

We can make life a little bit more secure by using a trick.
ssh access is blocked by default using iptables, but by visiting a secret URL on your website ssh access from that ip-address is turned on. You will still need username and password to access the box, but this way portscanners won’t detect an ssh server running.

We will need a little script which extracts the ip-address from the computer which accessed the webpage. The script will generate a 404 Error page (and HTTP 404 Error headers to fool the clever hacker):

[php]
#open the file for writing, suppress errors (remove @ to see errors) if(@$F = fopen("$TMPFILE",“w”)) { #write the ip to the file fputs($F,$IP); #close the file fclose($F); } header(“HTTP/1.1 404 Not Found”); ?>

404 Not Found

Not Found

The requested URL /secret-url.php was not found on this server.

Apache Server at www.yourserver.com Port 80

[/php]

The ip-address is written to a file in /tmp. As you might have noticed, there is no variable passing in the URL (e.g. http://www.yourserver.com/secret-url.php?ip=192.168.10.1 ) because these are potential security loopholes. Also the script itself uses a simple message passing algorithm to get the relevant data (the ip-address) to iptables, this way there is no direct coupling between an global accessable webpage and iptables.

We will use a bash script to read the ip-address and configure iptables:

[code]
#!/bin/bash
TMPFILE=”/tmp/allow_sshd.tmp”
LOGFILE=”/var/log/allow_sshd.log”
IP=`< ${TMPFILE}` DATE=`date` # timeframe for communications to start: SECONDS="300" LOCKFILE="/tmp/allow_sshd.lck"

if [ -s “${TMPFILE}” ] ; then #check for a lock file if [ ! -e “${LOCKFILE}” ] ; then #create the lock file to prevent more than one of these running /bin/touch ${LOCKFILE} #write to the log echo “${DATE}: SSHD started from ${IP}” >> ${LOGFILE}
#remove the temp file
/bin/rm -f ${TMPFILE} > /dev/null 2>&1

iptables -I INPUT -p tcp –dport 22 -s ${IP} -j ACCEPT
#wait SECONDS
sleep ${SECONDS}

iptables -D INPUT -p tcp –dport 22 -s ${IP} -j ACCEPT
#remove the lock file to allow another copy to run
/bin/rm -f ${LOCKFILE}
else
#log multiple copy attempts
echo “${DATE}: SSHD multiple copy attempt!” >> ${LOGFILE}
#remove temp file
/bin/rm -f ${TMPFILE} > /dev/null 2>&1
fi
fi
[/code]

The script needs to run every minute to check for new ip-addresses written to the tmp file, which is accomplished by using a crontab entry:
* * * * * /usr/local/bin/allow-ssh.sh > /dev/null 2>&1

original version:
http://gentoo-wiki.com/TIP_turn_sshd_on_from_php

de ultieme hacker toolkit aan je sleutelhanger

Wed, 07 Mar 2007 15:29:34 +0100

20080309 update: Deze post gaat over BackTrack 2, ondertussen is BackTrack 3 beta beschikbaar, deze kan veel eenvoudiger op een USB stick geinstalleerd worden, je krijgt bovendien meer tools en de laatste versies:
Installing BackTrack 3 on a USB stick

In Linux land kennen we al lang de zogenaamde “bootable distributions”, dat is een compleet Linux operating systeem plus alle applicaties op een cdrom of dvd die je in de computer kan stoppen om er vervolgens van te booten. Vervolgens heb je na een paar minuten een Linux desktop tot je beschikking zonder dat er ook maar een byte op je harde schijf wordt veranderd.

Een afgeleide hiervan zijn de “bootable security distributions”, dit is hetzelfde verhaal, alleen is de cdrom volgepakt met security tools om b.v. het netwerk mee te scannen, wachtwoorden te testen op hun sterkte enz. Extra handig zijn de forensische tools waarmee je op de harde schijf van de geboote pc kan gaan zoeken naar informatie over het gebruik, b.v. browser gegevens maar ook gewiste bestanden zijn weer boven water te halen. Als je de harde schijf van de PC in read-only mode mount (mount -o r /dev/sda /media/disk) dan wordt er nog steeds geen byte op de disk veranderd.

Belangrijk van security distro’s is vooral dat ze recente programmatuur bevatten. Enerzijds is dit vaak nodig om van de PC in kwestie te kunnen booten en goede ondersteuning te hebben voor de hardware in de PC, bv. (wireless) netwerkkaart, videodriver, enz. en anderzijds zijn de nieuwere tools doorontwikkeld en kunnen ze meer of werken ze sneller.

Na Whoppix, Whax, Auditor, STD, Phlak en wat al niet meer, is de ster aan het firnament op dit moment BackTrack, te vinden op www.remote-exploit.org.
Backtrack Final 2.0 is net uit en staat volgepakt met allerlei interessante software, het is ideaal om er mee te experimenteren op je eigen computer en te zien hoeveel informatie er achter blijft waarvan je het bestaan niet wist. Ook kan je goed testen of je eigen (wireless) netwerk veilig is voor hackers en of je wachtwoorden wel voldoende onkraakbaar zijn.

Nog leuker wordt het als je backtrack om een 1GB USB stick zet en hem meeneemt om bij computers van kennisen de guru uit te hangen door in een minuutje hun brave windows PC om te toveren in een volwaardig hacker workstation. Terwijl je in een desktop het station “Secret Agent” van SomaFM draait, mount je hun harde schijf en vertel je welke websites ze de laatste tijd hebben bezocht, zo heb je je eigen “Shock and Awe” campagne.

Behalve voor de security tools, is zo’n bootable usb omgeving ook bijzonder geschikt om zelf veilig van te werken, b.v. als je dingen op Internet wilt nakijken zonder het risico om spyware of virussen op te lopen, of om je e-mail te lezen zonder dat er (software)keyloggers of trojans zijn die “meekijken”, ook laat je geen history achter op de computer die je gebruikt hebt.

Hoe installeer je backtrack 2.0 op een USB stick?

Download de iso, b.v. hier vandaan.

Stop de USB stick in je PC, als die automatisch gemount wordt (meestal te zien aan pop-up windows met de inhoud v/d thumbdrive), sluit de windows en unmount de stick (kijkt met het command mount en dan: umount /dev/sd..).
Als er niets te zien is na het insteken v/d USB stick kan je met dmesg | tail meestal wel zien als welk device het herkent wordt. In het verhaal hieronder gaan we uit van /dev/sdb en ook moeten (bijna) alle commando’s als root worden uitgevoerd.

Herpartitioneer de USB stick met:

# fdisk /dev/sdb

Maak twee partities:

# fdisk /dev/sdb
The number of cylinders for this disk is set to 2575.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:

software that runs at boot time (e.g., old versions of LILO)
booting and partitioning software from other OSs
(e.g., DOS FDISK, OS/2 FDISK)

Command (m for help): p
Disk /dev/sdb: 1020 MB, 1020788224 bytes
129 heads, 6 sectors/track, 2575 cylinders
Units = cylinders of 774 * 512 = 396288 bytes
Device Boot      Start         End      Blocks   Id  System
/dev/sdb1            1              2575     996522  c  W95 FAT32 (LBA)
Command (m for help): d
Selected partition 1
Command (m for help): n
Command action
e   extended
p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-2575, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-2575, default 2575): +760M
Command (m for help): n
Command action
e   extended
p   primary partition (1-4)
p
Partition number (1-4): 2
First cylinder (1895-2575, default 1895):
Using default value 1895
Last cylinder or +size or +sizeM or +sizeK (1895-2575, default 2575):
Using default value 2575
Command (m for help): t
Partition number (1-4): 1
Hex code (type L to list codes): c
Changed system type of partition 1 to c (W95 FAT32 (LBA))
Command (m for help): t
Partition number (1-4): 2
Hex code (type L to list codes): c
Changed system type of partition 2 to c (W95 FAT32 (LBA))
Command (m for help): a
Partition number (1-4): 1
Command (m for help): p
Disk /dev/sdb: 1020 MB, 1020788224 bytes
129 heads, 6 sectors/track, 2575 cylinders
Units = cylinders of 774 * 512 = 396288 bytes
Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *           1        1919      742650    c  W95 FAT32 (LBA)
/dev/sdb2            1920        2575      253872    c  W95 FAT32 (LBA)
Command (m for help): w
The partition table has been altered!
Calling ioctl() to re-read partition table.
WARNING: If you have created or modified any DOS 6.x
partitions, please see the fdisk manual page for additional
information.
Syncing disks.

en zet er de juiste filesystems op met:

# mkfs.vfat -v /dev/sdb1
# mkfs.vfat -v /dev/sdb2

De tweede partitie is alleen maar een handigheidje, je hebt nu de mogelijkheid om bij gebruik met backtrack om hier tijdelijke bestanden naar toe te kopieeren, maar je kan de stick ook nog steeds als gewone datadrager gebruiken onder b.v. Windows.

Mount de backtrack iso via het loopback device en mount de eerste partitie v/d USB stick

# mkdir /FF
# mount -o loop bt2final.iso /FF
# mkdir /FF1
# mount -o rw /dev/sdb1 /FF1

Kopieer de bestanden:

# cd /FF1
# cp -r /FF/* .

De partitie is net voldoende voor alles:

# df -h /FF1
Filesystem            Size  Used Avail Use% Mounted on
/dev/sdb1             724M  4.0K  724M   1% /FF1

Nu nog ervoor zorgen dat de USB stick bootable is, hiervoor heb je het pakket syslinux nodig. Als het niet op je computer staat kan je het met yum, apt-get, emerge, enz. installeren afhankelijk van je gebruikte distributie.

# umount /FF1
# syslinux /dev/sdb1
# cat /usr/lib/syslinux/mbr.bin > /dev/sdb

Er is nog wat finetuning nodig voor syslinux om echt te kunnen booten:

# mount -o rw /dev/sdb1 /FF1
# cd /FF1/boot/isolinux
#  perl -pe 's#/boot/##'  isolinux.cfg> /FF1/syslinux.cfg
# mv boot/vmlinuz .
# mv boot/initrd.gz .
# cd
# umount /FF1

That’s all folks. Reboot, zorg dat de PC probeert op te starten van USB en backtrack start op en dan zie je:

Mocht je geen linux systeem hebben, maar toch die bootable USB stick willen hebben, brand dan de backtrack iso die je hebt gedownload op cdrom en start daar van op, vervolgens heb je een linux systeem draaien en kan je het bovenstaande verhaal volgen.

Tip: installeer vmware server, maak een vrij kaal linux systeem aan
en laat vervolgens de cdrom drive verwijzen naar de backtrack iso. Nu zal in vmware backtrack worden geboot en kan je daar zonder restricties in
“spelen” en b.v. je host systeem via het vmware netwerk laten scannen.

have fun!

Caveat Lector!
Volgens de nieuwe wet Computercriminaliteit is het voorradig hebben van hulpmiddelen die bedoeld zijn om niet alleen in te breken, maar ook gegevens op te slaan (onze 2e partitie?) of een systeem wederrechtelijk te gebruiken, strafbaar met maximaal vier jaar cel!

Zie: De Wet Computercriminaliteit: Computervredebreuk

Mijn intentie is om de USB stick prive te gebruiken om te controleren dat mijn eigen systemen veilig zijn en voor voorlichting van vrienden en kennissen, en dat is volkomen legaal (anders zou nl. iedere computergebruiker strafbaar zijn, want op ieder systeem staan wel programma’s die je kan gebruiken om te scannen of in te breken, b.v. ping tracert, telnet, enz. Het komt alleen op de kennis en de intentie van de gebruiker aan om ze ook als zodanig te gebruiken).

Upgrading from fedora core 5 to core 6 on a dell d620 laptop without any hassle

Sun, 04 Mar 2007 14:55:21 +0100

The main reason to upgrade to the (not so) new fedora release, was that i wanted the desktop eye candy that comes with compiz and beryl. On fedora core 5 i was forced to use the vesa display driver, but fedora core 6 had a much newer i810 display driver which should detect the i945GM graphics chipset on my D620.
After some googling around i decided to do the whole upgrade process through yum via the network and that proved to be surprisingly easy.

Read on to see the steps involved….

High speed password cracking with John the Ripper

Sun, 11 Feb 2007 20:08:06 +0100

John the Ripper has been out there for a long time, it’s a great tool for auditing passwords. How does it work, well simple: you take a password file with encrypted (or better hashed) passwords in it and give it to John. The program will first determine what kind of hash algorithm is used and will then start by taking normal words from an extensive wordlist and feed them one by one through the same hash algorithm. If the outcome matches with what is in the file that word is obviously the password.

After John has exhausted the wordlist it will try variations on the words. It will start every word with a capital and do the whole list again, than it could try every word backwards, substitute all letter “o” with zero’s, “i” with ones, “s” with “$”, and so on. Since computers have become mindboggling fast it can try a massive amount of combinations in a relative short time.

Since John the Ripper is around for a couple of years, it is written to be run on a single CPU. This is kind of a waste since we all got these dual core machines on our desks and even quad core’s or more in the servers in the racks. So how to make use of all this processing power?

Luckily there is a patch for John which allows it to use the Message Passing Interface to run multiple instances simultaneously, you can download this version: john-1.7.2-bp17-mpi2.tar.gz
and build it on your dual core box. Before the code will compile you need to install the MPI software, with yum on fedora this can be done with:

yum -y install openmpi*

next get the software (if not already done so), extract and move in there:

wget http://www.bindshell.net/tools/johntheripper/john-1.7.2-bp17-mpi2.tar.gz
gtar zxvf john-1.7.2-bp17-mpi2.tar.gz
cd john-1.7.2-bp17-mpi2/src

Make a small adaptation to the Makefile so it will work with openmpi:

vim Makefile

:%s/mpicc/om-mpicc/g

:wq

Now build the beast:

make linux-x86-mmx

If all goes well, you will see some warnings about pointers, but no errors and end up with a executable in ../run/john. Now change directory to
../run
and get hold of a shadow file, a .htaccess, a ldif with userpasswords, or anything with hashed passwords you would like to reverse back to the original form. If you don’t have anything yourself use Google with the right query to find something on the Net.
Give John his first assignment with the commandline:

om-mpirun -np 2 ./john -incremental my-hash-file.txt

The “-np 2” means that the “Number of Processors” is 2.
This is also the value to use if you have a single CPU machine with hyperthreading enabled.

Now if you want to get serious with decrypting hashed passwords, get the right wordlist for your language since people love to choose simple words they can easily remember. This is a good source:
ftp://ftp.mirrorgeek.com/openwall/wordlists
You can use the specific wordlist with John this way:

om-mpirun -np 2 ./john --wordlist=dutch_lower.txt my-hash-file.txt

So, when all is said and done, the main question remains. How fast is it?
Well John the Ripper has a build in benchmark function which you can
activate by using john -test, you then get lots of data for
all different ciphers which John supports.

I will take “FreeBSD MD5 [32/64 X2]” as a comparison metric.

On my Pentium D920 desktop running at 3.4GHz with linux /proc/cpuinfo:

cpu family	: 15
model	: 6
model name	: Intel(R) Pentium(R) D CPU 3.40GHz
stepping	: 2

dual cpu:	Raw: 23511.00 c/s real	23488.00 c/s virtual
single cpu:	Raw: 11786.00 c/s real	11786.00 c/s virtual

On my laptop: Core Duo CPU T2500 at 2.0GHz with linux /proc/cpuinfo:

cpu family	: 6
model	: 14
model name	: Intel(R) CPU T2500 @ 2.00GHz
stepping	: 8

dual cpu:	Raw: 9622.00 c/s real	10106.00 c/s virtual
single cpu:	Raw: 5061.00 c/s real	5061.00 c/s virtual

So what if this is not fast enough? There are two a number of roads you can take. There is Distributed Network Attack, this is like Seti at Home, where one master chops up the task at hand and delivers small chunks to thousands of computers which all complete the computations in spare processor time and then feed back the result to the master. The Secret Service has linked 4000 computers this way to try and decrypt passwords which it can’t break with “normal” supercomputer power.
You can build your own DNA password cracking universum by using Distributed John

An other way would be using Rainbow Tables where every possible password is already translated to it’s hash value. So if you have a hash from a password file and you want to know to which password it belongs, you can just do a lookup in the giant rainbow table and find the password.

Caveat Lector!
Usage of tools like “John the Ripper” might be unlawfull or illegal in your country, if you want to test strenght of passwords on systems which are not your own, get written permission of the owner first.

bootable security distro on your USB stick

Wed, 20 Dec 2006 23:26:25 +0100

20080309 update: This article covers BackTrack 2, you might want to consider reading the information on how to install BackTrack 3 beta on a USB stick. This is a much easier process, you will get more tools and the latest versions:
Installing BackTrack 3 on a USB stick

Bootable linux security distributions come and go, first there was Whoppix, than it became Whax and parallel there also was Auditor. But now we have got BackTrack. If Whoppix was the swiss army knife of a security auditor, than backtrack is his lightsword.

So what can we do with BackTrack? You can use it for security auditing, penetration testing, reconnaissance, wardriving, (wireless) network problem solving, actually a better question would be, what can’t you do with backtrack?

So what’s the ultimate geeky thing to do with backtrack? Install it on a USB stick and turn any computer into a stealth auditor toolkit. Today’s 1 gigabyte USB sticks cost less than 20 euro and are all USB-2.0 compliant, so they are fast to boot from. It’s important to stay current with these security distro’s, because if you try a penetration test with old tools, you might as well not do it at all. So we will use the latest beta which is available at the time of writing (bt20061013) and show you how to install that on a bootable thumbdrive.

step 1
Take the USB stick and plug it into a linux computer. If it mounts automagically, become root, type mount and remember the device which belongs to the USB stick (mostly something like /dev/sdc) and umount the device.
If it doesn’t mount automagically, type dmesg | tail and you will see the device that was recognized by the kernel.
Now run fdisk on the device (e.g. fdisk /dev/sdc) destroy all existing partitions and start a new (primary) one which starts at cylinder 1 and ends at +650M which will suffice for the complete backtrack toolkit. Next you can create a second partition (also primary) which fills up the rest of the USB stick and will allow you to use it the way it was intended (for instance transporting files), but is can also come in very handy to put discovered forensic data on that partition. Change both types of the partition to c which is W95 fat32 (lba). Don’t forget to make the first partition bootable.
Write the partition table to disk (USB drive) and exit fdisk. Now fdisk -l /dev/sdc should give you something like:

Disk /dev/sdc: 1020 MB, 1020788224 bytes 129 heads, 6 sectors/track, 2575 cylinders Units = cylinders of 774 * 512 = 396288 bytes

Device Boot Start End Blocks Id System /dev/sdc1 * 1 1641 635064 c W95 FAT32 (LBA) /dev/sdc2 1642 2575 361458 c W95 FAT32 (LBA)

Next, put a filesystem on both partitions with:
mkfs.vfat -v /dev/sdc1
and repeat that for /dev/sdc2

step 2
If you haven’t downloaded bt20061013.iso do so now and mount the iso image via the loopback device:
mount -r -o loop /data/iso/bt20061013.iso /FF4/
also mount the first partition of our USB drive:
mount -o rw /dev/sdc1 /FF
and start copying:
cd /FF4/
cp -r * /FF/

step 3
To make the device bootable we will use the syslinux package, if it’s not on your linux system install it with yum install syslinux (or use emerge, apt-get, or whatever). Now do the magic:

# umount /FF
# syslinux /dev/sdc1
# cat /usr/lib/syslinux/mbr.bin > /dev/sdc

and there are a few more steps to make it really work:

# mount -o rw /dev/sdc1 /FF
# cd /FF
# perl -pe 's/boot\///' isolinux.cfg > syslinux.cfg
# mv boot/vmlinuz .
# mv boot/initrd.gz .
# cd
# umount /FF

step 4
put the USB drive in your computer and reboot and see if it boot’s from the USB stick. You might need to alter your BIOS settings for this to happen, or hit some kind of magic key during startup (my DELL laptop requires F12). If all goes well you will end up with:

Have fun! and don’t forget to read the tutorials.

Windows
If you are on a Windows system and don’t have Linux installed, you can still follow the same procedure by downloading and booting knoppix. When the backtrack iso is on your C: or D: drive, knoppix will automatically mount and show these drives, and you can still mount the iso via the loopback device (-o loop) as described above.

Other ways of playing around with backtrack
Apart from booting backtrack from USB stick (or from cdrom) there is another very conveniant way of using this distro, and thats by running it inside VMware Server. You can use vmware server for free, but you have to register.
Here is a nice installation guide how to install vmware server on Fedora Core 5. After that you can just fire up vmware console and click together a new Linux machine. In “virtual mchine settings” the cdrom device should point towards your backtrack iso and after that power on the machine. Click the button to switch to full-screen, login as root (password toor) and type startx. You can still switch back forth to your host window manager by using CRTL-ALT-F7 and CTRL-ALT-F8.

Digg This!

N.B.
In most countries it’s only legal to use the auditing, scanning, and forensic tools on your own computer. Use at your own risk!

terughalen van verloren gewaande bestanden met Linux en foremost

Sun, 12 Nov 2006 14:53:20 +0100

Voor iedereen die wat met computers doet is het bijna een bekend probleem, een kennis heeft een digitale camera en om een of andere reden zijn alle foto’s van zijn geheugenkaartje verdwenen, of je ze even terug wilt halen.
Met de juiste tools is dit vaak vrij gemakkelijk. Het kaartje is bijvoorbeeld geformatteerd en dan lijkt het leeg, maar gelukkig staan alle bestanden er nog gewoon op.
Soms komen ook de standaard tools er niet uit en dan zijn er voor Linux altijd nog een aantal speciale forensische programma’s die je kan proberen. Een daarvan is foremost een programma dat het medium in kwestie afscant op bekende headers, footers en data structuren en vervolgens de bijbehorende bestanden weer terughaalt. Foremost is ontwikkeld door Air Force Office of Special Investigations en The Center for Information Systems Security Studies and Research.

Normaliter staat op een opslagmedium zoals harddisk of smartcard een zogenaamde “File Allocation Table”, in deze FAT is te vinden welke bestanden er op het medium staan en waar ze te vinden zijn (vergelijk het met een kaartenbak). Als de FAT afwezig of corrupt is, kan het besturingssysteem geen bestanden meer vinden en biedt het meestal aan om het medium te formatteren zodat het weer bruikbaar wordt.
Foremost kijkt niet naar de FAT maar begint het medium byte voor byte te lezen en vergelijkt de informatie met bekende headers. Zo begint een jpg bestand bijvoorbeeld met:
FF D8 FF
en eindigt het met:
FF D9
Ook (bijna) alle andere bestanden hebben dit soort unieke headers. In Linux gebruikt b.v. het file commando deze informatie om terug te geven wat voor soort bestand het is, dus zonder te kijken naar de extensie.

Om het xD kaartje te kunnen uitlezen op mijn fedora core 5 laptop sloot ik een Medion USB2 16-card reader aan van de aldi. Helaas ging dat niet onmiddelijk goed, de blauwe leesled bleef maar knipperen en dmesg | tail gaf foutmeldingen als:

usb 1-7: new high speed USB device using ehci_hcd and address 11
usb 1-7: device descriptor read/all, error -71

Dit lijkt een of andere bug te zijn is het USB2 subsysteem van linux. Onder Windows zou dit meteen einde oefening zijn, maar met Linux kan je b.v. het USB2 gedeelte uit de kernel verwijderen met:
rmmod ehci_hcd
en dan komt het kaartje alsnog netjes via USB1 beschikbaar:

[super@zorax ~]# fdisk -l /dev/sdd

Disk /dev/sdd: 65 MB, 65536000 bytes 8 heads, 32 sectors/track, 500 cylinders Units = cylinders of 256 * 512 = 131072 bytes

Device Boot Start End Blocks Id System /dev/sdd1 * 1 500 63972+ 1 FAT12

mounten wilde niet lukken (bekende melding:
mount: wrong fs type, bad option, bad superblock on /dev/sdd1, )
dus heb ik eerst maar eens een kopie gemaakt op harddisk om alle info
veilig te stellen:

dd if=/dev/sdd1 of=m-xd-card.iso

Met:

hexview -C m-xd-card.iso | less

kan je een indruk krijgen of er nog wat te redden valt. Als je allemaal 00 ziet dan is er niets meer van te maken. Of:

strings m-xd-card.iso | grep -i jpg

Foremost stond nog niet op mijn systeem, dus ik heb het eerst geinstalleerd met:

yum install foremost

en daarna was het een kwestie van:

foremost -t jpg m-xd-card.iso

en alle jpg plaatjes kwamen boven water in de directory output/jpg

[super@zorax ~]# ls output/jpg/
00000105.jpg  00006729.jpg  00013225.jpg  00018665.jpg  00024073.jpg  00029737.jpg  00035113.jpg
00001449.jpg  00008041.jpg  00014601.jpg  00019881.jpg  00025417.jpg  00031081.jpg  00036457.jpg
00002857.jpg  00010665.jpg  00016009.jpg  00021321.jpg  00026857.jpg  00032425.jpg  00037737.jpg
00005609.jpg  00012041.jpg  00017449.jpg  00022729.jpg  00028297.jpg  00033833.jpg

Hoe laat is het in …

Sun, 17 Sep 2006 22:49:13 +0200

Ik schreef laatst een stukje over tijdzone’s in linux en daarna viel het me op dat ik via Google af en toe zoekopdrachten binnen kreeg die op zoek waren naar de tijd in een bepaald land. Nu heb ik in PHP een script geschreven waarmee je kan zien hoe laat het is in diverse landen en plaatsen is die in allerlei verschillende tijdzones zitten. Dat klinkt iets makkelijker dan het is omdat we nu eenmaal zitten opgescheept met die zomertijd en sommige landen doen ook aan zomertijd en andere niet. Bovendien begint de zomertijd per land ook nog al eens verschillend, zo is de zomertijd in Australië precies tegenovergesteld aan die van ons. Anyway kijk maar eens op Hoe laat is het in…

Installing Fedora Core 5 on a Dell D620 laptop

Sun, 27 Aug 2006 22:56:03 +0200

Here is a article dedicated to how i went with installing Fedora Core 5 on a Latitude D620, most things work right out of the box and some (wirelss for instance) need a little tweaking. The challenge this time is to see whether i can keep SELinux in enforcing mode. In the past i have always switched back to permissive mode, because that’s the fastest way to get things working, but this time i will try and keep the beast activated.

If you want a Linux distro on your D620 that works in one go, it seems that Ubuntu is your best bet.

video filmpjes op een iAudio U3 via Linux

Tue, 01 Aug 2006 12:06:03 +0200

Af en toe is het weer tijd voor een nieuwe MP3 speler. De oude heeft te weinig capaciteit, meestal is de accu binnen een uur uitgeput en als gadget-junkie moet de drang naar nieuwe gadgets nu eenmaal bevredigd worden.

Een iPod is natuurlijk helemaal hip om te hebben, maar zo’n iPod nano kan bijvoorbeeld geen Ogg Vorbis aan en heeft zelfs niet eens de mogelijkheid om videofilmpjes af te spelen. Een iPod video vond ik te groot en te duur, dus het is een Cowon iAudio U3 geworden. Subliem geluid, ondersteund alle standaarden: MP3, WMA, OGG Vorbis, JPEG, XviD, WAV, TXT, FLAC, MPEG4 en heeft een 260K TFT-LCD Display met 160×128 pixels (formaatje postzegel, maar wel vlijmscherp beeld). Je kan er dus ook je foto’s op bekijken, radio mee luisteren of geluid opnemen met de bijzonder gevoelige microfoon.
Officieel wordt Linux niet genoemd als ondersteund platform, maar je kan het apparaat mounten (USB stekker aansluiten, met dmesg | tail kijken welk device eraan is toegekend, b.v. /dev/sda en dat dan mounten met: mkdir /iAudio ; mount /dev/sdb /iAudio) en bestanden heen en weer kopieeren.

Als je fimpjes wilt omzetten zodat ze op de U3 te bekijken zijn kan dat heel goed met mencoder (meegeleverd in het mplayer package). Output formaat moet 160×128 pixels zijn met 15 frames per seconde. Dat gaat als volgt:
mencoder orgineel.ext -quiet -oac pcm -ovc xvid -ofps 15 -vf scale=160:-2 -xvidencopts bitrate=256:vhq=4:me_quality=4:max_bframes=0 -o film.avi

Uiteraard vervang je orgineel.ext door de naam van het video bestand dat je wilt converteren. Hierna moet er nog een slag plaatsvinden om het geluid te converteren van PCM naar MP3:
transcode -i film.avi -P1 -b 0,1 -o U3-film.avi

En nu kan het bestand U3-film in de movie folder op je U3 geplaatst worden.

Wat een erg hoge “coolness” factor heeft is om het journaal op die manier te kijken. Met mplayer kan je zo de laatste versie van het journaal streaming bekijken:
mplayer 'rtsp://streams3.omroep.nl/tv/nos/journaal/bb.laatste.rm'

Dus voor het opslaan naar disk en slechts een kleine wijziging nodig:
mplayer -dumpstream -dumpfile journaal.rm 'rtsp://streams3.omroep.nl/tv/nos/journaal/bb.laatste.rm'

Vervolgens journaal.rm met mencode omzetten, door transcode halen en voila. De ondertitels zijn nog net (maar dan ook net) leesbaar.

Ik heb een klein programma in Perl gescheven wat alle video files in een directory in een keer kan converteren naar het juiste formaat

[perl]
#!/usr/bin/perl
# (c) 20060801 by Ewald

use strict;

my $DEBUG = 0;
my @files = glob( “*.mp4” ); # get files to work on
my $out1;
my $out2;
my $org;

foreach my $file ( @files ) {
next if -d $file; # directory?
next if -z $file; # zero byte ?
$DEBUG && print “$file\n”;
$org = $file;
$file =~ tr/A-Z/a-z/; # lowercase
$file =~ tr/\ /_/; # get rid of spaces
$file =~ s/[\’\”\[\]\$\&]//g; # get rid of special char’s
$file =~ s/\.mp4$//; # strip extension
$DEBUG && print “$file\n”;
$org =~ s/(.)/\\$1/g; # escape everything for the shell
$out1 = $file . “.avi”;
print “transcoding $file\n”;
$DEBUG && print “mencoder $org -quiet -oac pcm -ovc xvid -ofps 15 -vf scale=160:-2 -xvidencopts bitrate=256:vhq=4:me_quality=4:max_bframes=0 -o $out1\n”;
qx(mencoder $org -quiet -oac pcm -ovc xvid -ofps 15 -vf scale=160:-2 -xvidencopts bitrate=256:vhq=4:me_quality=4:max_bframes=0 -o $out1);
$out2 = “U3_” . $out1;
$DEBUG && print “transcode -i $out1 -P1 -b 0,1 -o $out2\n”;
qx(transcode -i $out1 -P1 -b 0,1 -o $out2);
unlink $out1; # remove intermediate file
$DEBUG && exit 0; # in debug we run only once
}
[/perl]
Het programma is ook te downloaden: cvt2u3.pl

have fun!

Radio 1 nieuws luisteren met Linux

Wed, 26 Jul 2006 14:23:15 +0200

Ik wil zelf graag op de hoogte blijven van het nieuws maar als ik op de klok kijk of het tijd is voor het journaal is het altijd te vroeg of te laat. Zelfs als de radio aan is ben ik vaak druk met andere dingen bezig zodat ik het journaal niet bewust hoor.
De oplossing is natuurlijk het journaal laten afspelen op het moment dat je de tijd wilt nemen om te luisteren. Met een beetje debuggen op de website vindt je de eigenlijke URL waar de stream met het journaal is verstopt. Vervolgens kan je die makkelijk vanaf de commandline afspelen met:

mms://cachemedia.omroep.nl/rambo01/0/nos/radio1nieuws/NOS_Nieuws.wma

Het bufferen van mplayer duurt even, maar daarna kan je tijdens het afspelen met alle vier de pijltjes toetsen voor- of achteruit “spoelen” in de stream.

Als je zo’n stream zou willen opslaan op disk onder Linux moet je eens kijken naar het pakket mimms.

mimms -o journaal.wma mplayer mms://streams.omroep.nl/nos/radio1nieuws/NOS_Nieuws.wma

Uiteraard moet je het copyright van het aangebodene in de gaten houden, niet alles mag opgeslagen worden.
Het is met mimms ook mogelijk om video streams op te nemen.

Om zelf makkelijk stream URL’s te vinden terwijl je met je browser aan het klikken bent is
streamsniff bijzonder handig.
streamsniff kan je als root gewoon opstarten en vervolgens met firefox (of desnoods IE) op websites klikken waar multimedia content staat.

Truuk
Om te zoeken welke shoutcast streams er zijn om via Internet radio te luisteren kan je op de volgende
Google Query klikken.

Tip
Zelf luister ik graag naar Radio Paradise, lekkere muziek zonder reclames.
Ze hebben diverse streams om online te luisteren, een daarvan is een 64 kbps AAC stream die vergelijkbaar qua kwaliteit is met 128 kbps mp3. Om deze stream onder Linux te luisteren kan je VLC (VideoLan Client) gebruiken:

vlc http://www.radioparadise.com/musiclinks/rp_64aac-2.m3u