Cafaro's Ramblings

So it’s been over two years since my last post.  Been very busy in my life and haven’t had time to do as much tinkering and computer stuff at home as I usually would.  That’s not to say I haven’t done anything, just haven’t documented it.  Here are a few things that happened in the last two years:

1. I changed jobs, I now work in computer, network, and systems security full time.  I’m loving it!  Finally getting to really practice what I preach in the security field.  Georgetown was fun and a great time to grow my general systems experience, but I’m enjoying the focus on computer and network security.




2. Got a new car, this actually happened about three years ago, but I never posted about it.  The Chevy Blazer was taken out by it’s imploding supercharger and deemed not worth my time, effort, and money to repair.  Given it was early 2009 and car dealers were giving away cars I got a great deal on a new 2009 VW Tiguan SE with AWD.  Still love the car and making small upgrades to it as the years go on to make it more mine.  I did actually stand up a page for that work here: My SUV Project (Tiguan).




3. I made some network and computer upgrades at home as well.  I replace my original first generation MacBook Pro 15″ (Intel Core Duo 2Ghz) with a late 2010 model MacBook Pro 15″ (Intel i7 Dual Core) with HD display and 8GB of ram.  It’s currently triple booting MacOS X 10.6, Fedora 16, and Windows Ent 7.  I have a post on how to setup triple boot in the works.  I also upgrade my old Promise NS4300N 2TB NAS box with a new NetGear ReadyNAS Pro 6 12TB.  Much faster and a lot more storage plus so many options.  Finally I’ve kept the network up with technology and run full WiFI a/b/g 300mbps+ and GigE wired via NetGear WNDR4000 and assorted GigE switches paired with FiOS internet.  Finally I upgraded my workstation piece by piece to get it up to a Sandybridge i7 and 16GB ram so that I can build out a new HD+CableCard MythTV network using VMs, the NAS box, and the new Silicon Dust HD Prime. I’ll have a post later documenting my network general gear later as well as posts on how I setup MythTV.




4. I’ve got a Barnes and Noble Nook Color as well.  It’s a great little device and hoping to take better advantage of it this coming year.  And yes, it’s rooted.  Running stock Nook Software but with the added benefit of sideloaded and standard android market apps too.




5. And last but not least, still being a dad and husband working away enjoying watching the kids learn and grow (as I learn and grow).

Ok, so I’ve had my new Eee PC 1000 for several days and am loving it.  But, I did find a few really glaring security issues.  So with a lot of research I’ve come up with a basic list of must do’s for any new Eee PC owner.

1. Shutdown Samba and Portmap – These services are on by default and there are known security issues with the version of Samba that comes with the EeePC.  Here is how to make sure they are stopped and don’t come back on.  Be warned, if you do this you will not be able to share files with others from your computer, though you can access files on other computers:
   • First start up a terminal window by pressing Ctrl + Alt + T
   • Next issue the following commands:
   • sudo invoke-rc.d samba stop
   • sudo update-rc.d -f samba remove
   • sudo update-rc.d samba stop 20 0 1 2 3 4 5 6 .
   • sudo invoke-rc.d portmap stop
   • sudo update-rc.d -f portmap remove
   • sudo update-rc.d portmap stop 20 0 1 2 3 4 5 6.
   • Next edit the services file using the following commands:
   • sudo vim /usr/sbin/services.sh
   • Press the “i” key to begin edit mode
   • find the line:
     start-stop-daemon –start –quiet –oknodo –exec /sbin/portmap
     and comment it out like:
     #start-stop-daemon –start –quiet –oknodo –exec /sbin/portmap
   • find the line:
     /usr/sbin/invoke-rc.d samba start
     and comment it out like:
     #/usr/sbin/invoke-rc.d samba start
   • Press the “ESC” key, then press the “:” key, then type “wq” followed by pressing the enter key
2. There is a webserver that runs on the EeePC any time you launch the anti-virus icon under settings.  It by default hides the content from the internet, but the webserver is still listening on the internet port.  To force the webserver to ONLY listen to your local machine (and not advertise to the rest of the world) do the following.
   • You need to edit the following file using the commands:
   • sudo vim /usr/lib/esets/webi/nginx/conf/nginx.conf
   • find the http {} section,  then the server {} section and
   • Press the “i” key to begin edit mode
   • change “listen 20032;” to “listen localhost:20032;”
   • Press the “ESC” key, then press the “:” key, then type “wq” followed by pressing the enter key
   • Reboot the computer as there is no clean way to stop the service.

Ok, so now the why part.

The EeePC (including my brand new one) ships with a old version of samba enabled to start on boot by default that has a known remote attack that can grant root priveleges.  That is VERY bad:

http://risesecurity.org/blog/entry/6/

Also the webserver that runs when you start up the anti-virus program on the EeePC is the legacy stable branch (one entire version behind current stable) and several revisions of that behind the current legacy stable revision:

http://nginx.net/CHANGES-0.5

The EeePc runs version 0.5.33 from November of 2007.  You’ll notice in the change log several fixed segfaults and other bugs, some of which could lead to security issues.  It’s best not to take chances and make sure it doesn’t report to non-localhost requests.

I just posted my review of my new EeePC 1000. This is the Linux version with the 10″ screen and 40GB worth of solid state drive. So far I like it, hardware is great, software is good, security sucks.

Go here to get the details.

I’ve been watching this for a while now, and took note of a recent ruling in a US court which said you have no expectations of privacy at the border when returning from international travel. This means that when you are returning from an international flight to the US you are not on US ground when you land, and you miss out on many of your constitutional protections, apparently. Border agents can take ALL your electronic devices and make copies of the data, they can compel you to login to your computer, they can request encryption keys, they can do all of this with out having a reason for suspicion. All those emails, love letters, family pictures, they can all become goverment property just because they feel like it. There are no formal rules regulating it either yet.

If you don’t think this is a problem, I suggest you invite the police to come into your home and search through all your records, all your receipts, all your drawers, everything. I’m sure they can find some little law somewhere you broke (got an illegal radar detector? Didn’t pay USE tax on those internet purchases? Maybe a bad cop finds some intimate photos of you and the wife and decides to earn some money on the side by blackmailing you, or just enjoy them personally), cross your fingers.

Right now there is little to NOTHING you can do about it. And this hasn’t received much attention from mainstream press yet, which is sad. It’s all done in the name of protecting against terrorist and child molesters, and it will likely help neither of those causes. What it does mean are your corporate secrets on those company laptops are now the Government’s. All those personal moments in email and photos are now the Government’s. Your new idea you haven’t gotten patented yet that was going to let you break into the big time? Yeah, gov’t has it now.

If you worry at all about this (which you should if you travel internationally) you should write your representatives. They could at least have the common courtesy of setting some regulations and limitations on it. Oh, and yes other Governments can do this too. Flying into the UK? Yes they can search you just the same. Think twice about your laptop, smartphone, pda, they hold a LOT of information.

Here is a good article talking about how you might be able to do to protect your “Intellectual Property” (I hate that term, but at least I’m using it for good, kinda). Schneier on Security

Busy once more trying to finalize the Security Track for LinuxWorld San Francisco. Will be hard to top some of the speakers from last year, but I’ve got some very interesting topics this year. I just always forget how hard it is to coordinate all the different speakers’ times and communication.

Last year I actually missed out on attending LinuxWorld as I was on baby watch (the little one was due any day around that time), but looking forward to making it this year!

I run several servers, all of which run linux, OpenSSH, and Apache HTTPD. Some run VSftpd as well (legacy requirements). They all are attacked by brute force hacking attempts daily, yes daily. Every day I go through my logs and see the 10′s of thousands of attempted break in attacks. It’s annoying, it tends to make the log files very long to look through. Even my parsed and abstracted log reports are forced into long lists of attacking IP addresses and attempted usernames. Here is an example from just today on ONE server:

Failed SSH logins: 2971

Failed FTP logins: 18,415

Faild SMTP logins: 1656

And this is not a server hosting super popular websites or mirrors. This is just a no name server hosting a couple of websites. In the past I used to contact the owners of the IP addresses these came from, but it became tedious and difficult. They’re often internet providers dynamic IPs of clients, which the ISP tends to not care they are attacking my server (most likely, they are trojaned anyways).

All these attempted attacks do is waste resources. They waste my bandwidth, processing, and storage (the log files).

Just me deciding to put into writing one of my daily annoyances.

Well, today is a good day not to live or work in Germany if you make your living with technology.  Today Germany officially makes it illegal to use or develop security tools which could at all be used as “hacking tools” regardless of actual use or intent.  That means you can’t create or use a tool to scan your own network for errors in security that you made.  So you’ll just have to wait until some Black Hat hacker breaks into your network to learn of your mistakes.  Man is this a stupid law..

Germany enacts “anti-hacker” law

Here is a good article on what SELinux in RHEL 5 has brought to the table. Some cool new features and a lot more protection:

http://www.redhatmagazine.com/2007/05/04/whats-new-in-selinux-for-red-hat-enterprise-linux-5/

There is also some interesting points in the comment section. Basically, a reminder that NO security mechanism is 100% safe, but it’s better than nothing and should always be considered when looking at what you need for your deployment.

– @page { size: 8.5in 11in; margin: 0.79in } P { margin-bottom: 0.08in } –>

Ok, been a busy busy couple of months, two conferences down, two scheduled.

In February, I helped with the new LinuxWorld/OpenSolutions World Summit in NY. The show did pretty well, but the weather really messed it up (warning to others, don’t schedule a conference during a massive snow/ice storm, really messes things up LOL). I missed most of the first day when my 4 hour drive turned into around 8 hours, and I didn’t get to leave until 4 hours later than planned. The show’s presentation are are being pod casted here:

http://www.linuxworld.com/events/

Next on the list was the FOSE 2007 show where I helped organize the Tux.org non-profit booth. We handed out over 1,000 issues of Linux Journal with an intro to Linux flier, over 1000 CD/DVD Linux Distros, a couple dozen live FreeBSD CDs, and numerous other giveaways. We had some generally interested people talk to us and it’s nice to see more and more people actually know what Linux is and what OpenSource really means. Here’s some information on what we were doing:

http://www.cyberigor.com/fose/

Well, that takes care of what’s been happening, Now coming up this week is the ShmooCon conference:

www.shmoocon.org

I love this conference, has some great speakers, Bruce Potter and the rest of the Shmoo Group do an amazing job with it. Starts in about 3 hours, going to be a fun weekend!

Finally LinuxWorld/OpenSolutions World San Francisco 2007 is starting up. Hoping to get some real good speakers lined up for the Security track (which I’m track chair for). Anyways, not much to see, but here’s the site for that:

http://www.linuxworldexpo.com/live/12/events/12SFO07A

Well, once again, I seem to be sparse on the posts. Maybe it’s because I’ve been busy with LinuxWorld Summit NY, or trying to get a new software project at work finished, or maybe cause I’m devoting my free time to my new Nintendo Wii. Well truthfully it’s a little of all the above (and a lot of getting my new software project working), but I did run across this little interesting tidbit:

http://www.nintendoworldreport.com/newsArt.cfm?artid=12687

I hadn’t seen this published broadly, but it appears that the version of opera currently under beta testing to Wii users (any Wii owner can download and play with Opera 9 on their Wii for free) has a vulnerability that can at minimum cause the Wii to hard lock. Currently there is no reported exploit that can run code on the Wii, which would normally be a threat from this exploit, and not clear if it ever will given that Game Consoles are usually pretty strict in what code is or isn’t allowed to run.

Anyways, interesting to see how the age of the desktop vulnerability has come to the game consoles world, even Nintendo. Wonder how long it takes them to issue a fix?