Mountains of NSA Data

Get SmartLast week the Guardian broke the news about Prism, an NSA data mining project in which the security agency harvests transaction records with the cooperation of private telecoms and internet companies. While it’s illegal to eavesdrop without a warrant, the NSA is harvesting conversational meta-data: calling records, email transactions and credit card swipes. This is basically the stuff you’d find in server logs.

The news was greeted with simultaneous outrage and indifference. Some were tremendously bothered by the news while others shrugged and said “meh.” Your Joe Dog’s congressman emailed to say he was greatly bothered by the news. Really? Then why didn’t you email constituents after any one of the thirteen briefings you had on the subject?

Five years ago, the NSA was probably incapable of doing much with all the data it collected. Just managing its information would have been a full time job. Since it began its surveillance programs, the NSA has brought up a series of large data centers to warehouse its records. The biggest, its Death Star, was constructed at Camp Williams, Utah.

The agency also improved its ability to effectively use this information. As the New York Times reports, NSA is working with Silicon Valley big data experts to efficiently sift through its transaction records. Its algorithms search for patterns and alert human agents when they match the hallmarks of terrorist activity.

And this is where it gets eerie.

From a study published in Nature, we learn that just four points of phone data are necessary to pinpoint the caller’s location with 95% accuracy. The average person leaves many breadcrumbs that reveal his whereabouts: cell phone data, EZ-Pass transactions, credit card purchases, ATM transactions, etc. Using information from cell towers, the agency can pinpoint your altitude right to the floor you’re sitting on at this moment. (I’ll save you some trouble: I’m currently on the third).

If you’d prefer to keep your location a secret, then, yes, this program is a concern. Unfortunately, it appears to be perfectly legal. You can have modern conveniences like cell phones, EZ-Pass, credit and debit cards or privacy. Pick one.

 

 

Posted in Security | Leave a comment



Siege and the Single Cookie

An emailer wondered if siege could be configured to refuse cookies. I had a vague recollection on the matter. My brain cells were all, “Yeah, sure, you can disable cookies.”

The best place to look for more esoteric features is inside $HOME/.siegerc If you don’t have one, you can generate a new one with this command: siege.config That command will place a new one inside your home directory. ‘siege.config’ is designed to build a resource file which is compatible with your version of the program.

I checked the latest version of that file and I found nothing to disable cookies. Really? That seems like a no-brainer. Why wouldn’t we allow users to disable that? “Sorry,” I replied. “Siege can’t disable cookies.”

Yet my own response was bothersome. I was certain you could turn that off so I checked the code with ‘egrep cooki *.c’ Sure enough, siege parses siegerc for ‘cookie’ which accepts true or false. The latter disables cookie support.

Documentation for this feature has been added to siege-3.0.1-beta4. The feature itself is available in just about every contemporary version of siege that’s floating around the Internets. Just add ‘cookies = false’ to your siegerc file to disable their support.

Posted in Applications, Siege | 2 Comments



The Chinese Military Is Hacking US Infrastructure

chicoms

The New York Times reports that a large percentage of Chinese cyber attacks on American targets originate from inside a same small neighborhood that features a Chinese army headquarters building. The headquarters, a large white office tower in Shanghai, is surrounded by restaurants, massage parlors and a wine importer. It is the only structure in the neighborhood capable of housing a large number of sophisticated cyber attackers. This all but confirms the Chinese army is behind the American attacks.

The hackers, known in the US as the Comment Crew, were traced to Shanghai by Mandiant, a US security firm hired by the NY Times. The New York paper hired Mandiant to end infiltration of its network last year. The Virginia firm traced that attack and hundreds like it to the Shanghai neighborhood that houses the base, known as P.L.A. Unit 61398.

The firm were not able to confirm the attacks originated inside the building but the probability is very high.

“Either they are coming from inside Unit 61398,” said Kevin Mandia, the founder and chief executive of Mandiant, in an interview last week, “or the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.”

Sure, it’s possible that an enterprise scale hacking effort led by mainland Chinese with direct access to Shanghai telecom infrastructure has setup shop inside one of the restaurants by Unit 61398. Now that they’ve been exposed we’ll just wait for the Chinese government to shut them down. That should happen any minute now. Yep … any … minute … now. Who are we kidding? The Chinese are attacking us!!

Posted in Security | Leave a comment



We’re Number One!

nixCraft selected siege as the Number One Greatest Open Source Terminal Application of 2012. We’re not sure what that means other than AWESOME! It’s been a long road to 2012 greatness. The project began in late 1999 and was released into the wild in early 2000. Since then, it has been developed shaped by countless people from all corners of the globe.

Even though siege is a very esoteric program, its source code is downloaded around 50,000 times a year. Binaries are distributed by most major Linux vendors.  One day  a co-worker wanted to run a test from a new server so he asked if I could get him some binaries. Before I could react to the request, he said, “Nevermind.” He ran ‘apt-get install siege’ and got it from the vendor. That was a pretty cool moment for reasons other than the fact that it saved me some work.

Let’s be clear. This isn’t my recognition. It’s our recognition. For twelve years siege has been a community project and its direction will continue to be shaped by the people who use it. “Now let’s eat a god damn snack.” — Rex Ryan to the siege community.

Posted in Applications, Siege | 1 Comment



Apple’s New Locking Screws

As residents in the Information Age, we consider ourselves clever sorts. We no longer waste hours on bar stools arguing about the year of Joe DiMaggio’s 56 game hitting streak. Before someone rebuts with his second “nuh-uh” we’ve smart-phoned the answer: 1941

But are we right?

I just got the answer by Googling. Like most people, I clicked the first link of the search results. In many cases, that link goes to Wikipedia and this was no exception. The free encylopedia is an excellent source of information but like all sources, it’s prone to error. So unless our bar bet is substantial, we probably won’t cross reference the findings. “I guess the next round is on me…”

Apple's locking screws keep users out of their phones

Was this new Apple new proprietary locking screw designed to keep customers from opening their phones? (© 2012 Imgur, LLC)

That was certainly the case when a Swedish firm broke the news about Apple’s new iPhone screws. They were designed specifically to prevent its owner from opening the phone. Given Apple’s penchant for limiting access to the owners of its products, the story struck a nerve. It was picked up by MacWorld, Wired and Yahoo and spread across the Internets.

There was just one problem: the story wasn’t true. Oh, it was truthy. It struck most readers as the type of thing Apple would do but it was a hoax all the same.

The locking screws were fabricated by a Swedish company named Day4. Their intent was to see how easiliy they could spread disinformation. They designed a peculiar screw and posted it to Reddit  along with the following message: “A friend took a photo a while ago at that fruit company, they are obviously even creating their own screws.”

That’s it. Neither Apple nor its phone were mentioned in the message. But Day4’s timing was excellent. iPhone 5 is expected to be announced in September and tech media outlets are jonsing for information. If those outlets would have cross-referenced their information, they would have discovered it was all from a single source. That should have raised red flags. Would those flags have halted publication? I don’t know. Everyone wants to be first with a scoop.

In the Information Age, it is too frequently consumers – not distributors – who must perform integrity checks. When a politician stone-cold misrepresents information, the media rarely corrects his inaccuracies. Instead it notes that the other side disagrees. Instead of a debate in which we’ve established the facts, we tend to argue with two separate sets of “facts.”

On this site, I’m not driven to publish scoops. The Day4 prank is already several days old. All the code and configurations you’ll find here were tested before publication. My facts are generally double-checked. And with regard to the event that accompanies this story, you can confidently assert that Joe DiMaggio batted safely in 56 straight games back in 1941. That information is confirmed by multiple sources….

Posted in Tech Media | Leave a comment



The Security Two-Step

This is depressing.

Matt Honan is an author at Wired. Recently his Google account was comprimised. And since his online life was chained together, the hackers were soon able to access his Twitter, Amazon, AppleID, iPhone, iPad and MacBook accounts. For lulz, they erased his digital life.

By his own admission, Honan was sloppy. His accounts were interconnected and his data was not backed up. His biggest regret was that he didn’t take the time to implement a defense mechanism provided by Google. He didn’t set up 2-step verification. In the article, Honan refers to it as “two-factor authentication.”

What’s two-step verification? This is a system provided by Google which adds an extra level of security to your account. After it’s set up, you’ll need two things for access. You’ll need to provide something you remember (your password) with something you have (a code on your phone).

Learn how to set up 2-step verification after the jump.

Continue reading »

Posted in Security | Leave a comment



Intel releases updated Linux drivers

Intel has released a new version of the open source Intel graphics package, that can be used on Linux systems. This is good news for users of the software, who will be able to access the updated version, known as 12.07. With the package, users will get new X Server drivers for Intel cards, along with other features that work with these specific drivers.

Version 2.20.0 is the most significant component of this new release, available with the xf86-video-intel driver for the X Server. Those who regularly use this type of technology, or any for that matter, spending time on their computers playing poker.de or communicating to their friends via e-mail, will be glad to hear this news. The feature comes with SNA, which is a 2D acceleration method that can be selected at runtime. It’s purpose is to use less CPU than the previous method, UXA, and to be faster. To take advantage of this, the user must specify Option “AccelMethod” “sna” in the Xorg.conf file. It also features modern Intel graphics cards, which the new SNA architecture is designed to make the most of.

This new release from Intel is pre-tested, and therefore geared towards developers who look for this feature rather than Linux end users. It comes with other features that have also been tested, along with the main ones that will be the biggest draw. The other features include the stable 3.4.x version of the Linux kernel. This was made available to users in May and its default setting is to use the RC6 power saving mode. Those who want to get their hands on this new package can download it from Intel’s Linux driver web site and begin enjoying the benefits. Its source code is licensed under MIT and GPLv2 licences.

Posted in OS, System | Leave a comment



Microsoft’s Bigguns

In April Microsoft made news when it became a top-twenty contributor to the Linux kernel. The Redmond giant contributed over 20,000 lines of code in support of Hyper-V. This was a striking turn around. Remember, Microsoft’s CEO once described Linux as a “cancer.”

Although it contributed over twenty thousand lines of code, the Internets are now abuzz over a single line of code in hv/hv.h line 45:

  #define HV_LINUX_GUEST_ID_HI 0xB16B00B5

A Microsoft programmer assigned 0xB16B00B5 to HV_LINUX_GUEST_ID_HI. That’s a hexadecimal number whose value is 2,976,579,765. But that’s not what has the Internets all worked up. Look again. 0xB16B00B5 is 1337-speak for BIG BOOBS.

Posted in Programming | Leave a comment



SSH – Disable known_hosts Prompt

Do you have scripts that do remote procedures over ssh? Do host key checks occasionally cause them to break? This entry will show you how to avoid that mess and keep your scripts running smoothly.

BACKGROUND

ssh protocol is designed to verify the host key against a local file to ensure the integrity of the remote server. By default, the user is prompted to accept a new key or warned when the host key changes (like after a server upgrade). This is a nice defense against man-in-the-middle attacks, but it plays havoc on scripts. If a prompt occurs, your script stops and waits for input.

FIX

There are two ways you can avoid this problem. You can pass parameters to ssh or you can change the system setting in ssh_config. If you want to turn off host key checks for scripting continuity, then we recommend using command line parameters. You only type them once when you write your script and they only affect that instance of ssh.

By default, StrictHostKeyChecking is set to ‘ask.’ That’s why you’re prompted to accept a key. In order to avoid the prompt, you can change that to ‘no.’ When it’s set to ‘no’ the key is stored with no questions asked.

Unfortunatley, that’s not as clean as it seems. If the host signature changes due to an upgrade, then ssh stores that key, too. Since you have two, it starts throwing warnings such as this:

key_read: uudecode AAAAAAAB3NzaC1yc2EAAAABIwAAAQEAzh1G5NiiEfawhBhly
VLR92Q/+iXZ3Bs56RBLZtso/lEFk9TYZuS+Qp+tKOIv1j5HpuwsoIAZt6A1fJfCHfN3
KYtuWNbdMywuoOUb5Z9S0c/3jyeesy2eTy+ZZjgb0uPdU8cCKg029NF9gQr5tbDlrj+
vW6QvvWJ0KVJFJPWg6u3/Qt/N/xlPXziyHv4HKuzMDoRLQ5ltiC8zk3ZefeRK7ZZKtp
qSneTsHZt7alOGOsKTrPL5PA50QwBiNJFbvrnmJs2Xjk3x6MunXFuRSZCEsGboQWDie
whcOFxDlkYfWjHNbShPYBY3xuq/MnsL8QHUx9AT75wpl2U0/KFbXsMAKw==
 failed
key_read: uudecode AAAAAAAB3NzaC1yc2EAAAABIwAAAQEAzh1G5NiiEfawhBhly
VLR92Q/+iXZ3Bs56RBLZtso/lEFk9TYZuS+Qp+tKOIv1j5HpuwsoIAZt6A1fJfCHfN3
KYtuWNbdMywuoOUb5Z9S0c/3jyeesy2eTy+ZZjgb0uPdU8cCKg029NF9gQr5tbDlrj+
vW6QvvWJ0KVJFJPWg6u3/Qt/N/xlPXziyHv4HKuzMDoRLQ5ltiC8zk3ZefeRK7ZZKtp
qSneTsHZt7alOGOsKTrPL5PA50QwBiNJFbvrnmJs2Xjk3x6MunXFuRSZCEsGboQWDie
whcOFxDlkYfWjHNbShPYBY3xuq/MnsL8QHUx9AT75wpl2U0/KFbXsMAKw==
 failed
Last login: Fri Jul 13 11:09:36 2012 from jdfulmer-lt.joedog.org
RedHat 5Server - LinuxCOE 4.2 Fri May 11 09:48:33 EDT 2012

We can avoid this mess with another setting. Instead of saving host key entries to known_hosts, we can bury them in /dev/null. We can change the file location with the UserKnownHostsFile parameter. If we change it to /dev/null there are no entries for ssh to read.  And when it writes a new entry, well it goes to /dev/null

IMPLEMENTATION

There are two ways we can implement this. One is at the script level and the other is at the system level. If we want to continue to prompt for host key checks, then we can add the configuration to our script. This can be done with OpenSSH’s -o option. Here’s an example in which we run the hostname command on a remote server:

ssh -o StrictHostKeyChecking=no \
    -o UserKnownHostsFile=/dev/null \
       user@host /usr/bin/hostname -s

To set this configuration system-wide, place these entries in ssh_config:

StrictHostKeyChecking no 
UserKnownHostsFile /dev/null
LogLevel QUIET

NOTE: This configuration applies only to OUTBOUND ssh connections. This does not affect your system’s inbound ssh traffic.

UPDATE:  I added LogLevel  QUIET to the ssh_config above. This is the same as running ssh with a “-q”. This suppresses all warning messages which may wreak havoc on your scripts.

Posted in Applications, ssh | 1 Comment



Mondoarchive Exclude List Failures

To illustrate config files in sh scripts, I published my mondoarchive script. That script dynamically builds an mondo exclude list from a list of directories inside a file.

Since I published that article, many of you have arrived here after Googling mondoarchive exclude lists. It seems they’re failing you. Fear not, faithful Googlers. Your JoeDog has experienced this pain and he can help.

There are two main problems with mondoarchive exclude lists that causes the program to ignore them. One is documentation and the other is a bug.

Older versions of mondoarchive use space separated exclude lists. You construct them like this:

  -E "/usr/src /data/archive /usr/local/src"

Since version 2.2.9.5 the syntax has changed for both -E and -I. Whereas older versions used space separated lists of directories, newer versions use pipe separated directories. If you have a newer version, construct your lists like this:

  -E "/usr/src|/data/archive|/usr/local/src"

The other problem I’ve encountered appears to be a bug. The first directory in my exclude list wasn’t being excluded. To fix that problem, I’ve placed /tmp first in all my exclude lists.

  -E "/tmp|/usr/src|/data/archive|/usr/local/src"

Problem “solved.”

Posted in Mondorescue | 1 Comment



Recent Comments

  • Jeff Fulmer: Ninety-five percent of the time, this error occurs because you’ve configured more simulated users...
  • Sohan: Hi, Resolved by commenting time parm in siege.rc Cheers
  • Sohan: Hey, My bad. I resolved the issue by setting default time out parm in siege config. I made to 60s as per my...
  • Sohan: Hey, My bad. I did not understand ordering matters for commands in siege from command line. I tried changing...
  • Sohan: Hi, Why the transactions number is always different in siege. Its weird getting always different transaction...