I suggest big corporations, and important public services stop using insecure operating systems

On April 21, 2010, beginning at approximately 14:00 UTC, millions of computers worldwide running Windows XP Service Pack 3 were affected by an erroneous virus definition file update by McAfee, resulting in the removal of a Windows system file (svchost.exe) on those machines, causing machines to lose network access and, in some cases, enter a reboot loop. Mcafee rectified this by removing and replacing the faulty DAT file, version 5958, with an emergency DAT file, version 5959 and has posted a fix for the affected machines in their consumer knowledge base. The University of Michigan’s medical school reported that 8,000 of its 25,000 computers crashed. Police in Lexington, Ky., resorted to hand-writing reports and turned off their patrol car terminals as a precaution. Some jails canceled visitation, and Rhode Island hospitals turned away non-trauma patients at emergency rooms and postponed some elective surgeries. Australian supermarket behemoth Coles reported that 10 percent (1,100) of its point-of-sales terminals were affected and was forced to shut down stores in both western and southern parts of the country.

http://en.wikipedia.org/wiki/McAfee#History

LSO local shared object flash cookies

better privacy lso flash cookiesWhy are Flash Cookies Harmful?

  • they are never expiring – staying on your computer for an unlimited time.
  • by default they offer a storage of 100 KB (compare: Usual cookies 4 KB).
  • browsers are not aware of those cookies, LSO’s usually cannot be removed by browsers.
  • via Flash they can access and store highly specific personal and technical information (system, user name, .).
  • ability to send the stored information to the appropriate server, without user’s permission.
  • flash applications do not need to be visible to the user
  • there is no easy way to tell which flash-cookie sites are tracking you.
  • shared folders allow cross-browser tracking, all browsers use the same LSO folder
  • the company doesn’t provide a user-friendly way to manage LSO’s, in fact it’s incredible cumbersome.
  • many domains and tracking companies make extensive use of flash-cookies.
  • flash-cookies are used to re-create data of deleted traditional cookies.

Read more about LSO’s on wikipedia and Download Better Privacy firefox extension to keep track of those who keep track of you!

aircrack-NG Intel PRO Wireless 3945 a/b/g SUPPORT!

Iwl3945 is the new driver for the Intel PRO/Wireless 3945ABG wireless chipset. It includes new features like:

  • Managed and monitor mode support in one driver
  • Enhanced injection support
  • Multiple interfaces on one device – use the aircrack suite on a monitor interface while remaining associated on a managed interface
  • Full radiotap support, for both incoming and outgoing packets
  • No more binary regulatory daemon needed, regulatory enforcement is done by the firmware

The driver is based on the mac80211 stack, so the usual requirements apply (aircrack-ng 1.0-rc1, a recent version of libnl, a fairly new kernel, etc.)

I’m quite excited about this, because previously my chip wasn’t able to do packet injection. Now, I can force WEP client to dissassociate from their WAPs, and I can potentially break WEP! My Core2Duo 1.8GHz machine may not have the horsepower, but my AMD 6400+ X2 can certainly handle it.

Aircrack-NG and Intel iwl3945 Driver

Nmap on Cygwin

Installed nmap on cygwin. Dead easy!

  1. Download and install Cygwin
  2. Download and install WinPCAP
  3. Accept most defaults
  4. Do the default installation, typically C:\cygwin\
  5. Download nmap for windows (zip)
  6. Open the zip file
  7. Double click the folder inside the zip, a large list of files should appear
  8. Extract these files (and not the folder which contains them) to C:\cygwin\usr\local\bin
  9. Open cygwin
  10. Type
    • nmap --version
  11. Your nmap installation on cygwin is now complete

Update 3/May/2012: Try running the vcredist_x86.exe file found in the zip archive if nmap doesn’t seem to run.

For a general understanding of nmap, just type nmap. For a more detailed comprehension, read the manual, and search the web.

Password-less Logins with OpenSSH, scp, and rsync

UPDATE: I changed ‘>’ (erase file, then write to file) to ‘>>’ (append to file). This avoids you overwriting your, or other peoples’, public keys.

Setting up password-less logins is both dangerous, and mighty. It allows one to authenticate to an OpenSSH server without typing in a password. Authentication is gained via knowledge of a private key.

Generate a Public/Private Key Pair

$> ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/felipe/.ssh/id_rsa):
Enter passphrase (empty for no passphrase): <ENTER>
Enter same passphrase again: <ENTER>
Your identification has been saved in /home/felipe/.ssh/id_rsa.
Your public key has been saved in /home/felipe/.ssh/id_rsa.pub.
The key fingerprint is:
d7:79:c3:01:ce:90:71:a2:a2:3d:83:26:fb:9a:1f:5b felipe@linux.local

You will then find two files inside your directory. Keep them safe, secure, and secret. The public key (the one with .pub at the end) can be widely disemmindated. It represents the antonym of secrecy and privacy. The private key, however, must remain private and secret at all times.

Copy the PUBLIC key to a remote OpenSSH server

You must copy your public key to a remote host. The host will verify that you own the private key by encrypting a “challenge” and forcing your ssh client to decrypt it. If successful, you are authenticated, and admitted entrance. A password isn’t required.

$> cat /home/felipe/.ssh/id_rsa.pub | ssh felipe@remote-host.com \
"cat - >> .ssh/authorized_keys"
felipe@remote-host.com's password: <PASSWORD>

This copies your public key the authorized_keys file (NB: authorized_keys2 is deprecated and no longer recommended for use. OpenSSH checks both).

Testing Phase

‘logout’ or ‘exit’ and try:

$> ssh felipe@remote-host.com

It should not ask you for a password. You should automatically be logged into the remote system.

Works with scp and rsync too!

‘scp’ and ‘rsync’ both use a ssh client at the backend, and so will also authenticate automatically utilising your public and private key pair. Try:

$> scp file_a felipe@remote-host.com:file_b

This should transfer without pausing to ask for your password. Likewise try:

$> rsync -r /backups/2010/Jan felipe@remote-host.com:/backups/2010

This should backup your entire directory to remote-host.com without pausing to ask for a password. You can put a line similar to this one in a shell script, and run it with cron once a week or so. It will automatically backup your system, using OpenSSH, and proven secure and safe method for authentication of human and machines across an untrusted public network, away from curious eyes.

Crackers infiltrate US Army Servers

army-logo

The hacks are troubling in that they appear to have rendered useless supposedly sophisticated Defense Department tools and procedures designed to prevent such breaches. The department and its branches spend millions of dollars each year on pricey security and antivirus software and employ legions of experts to deploy and manage the tools.

[…]

Equally troubling is the fact that the hacks appear to have originated outside the United States. Turkey is known to harbor significant elements of the al-Qaida network. It was not clear if “m0sted” has links to the terrorist group.

Idiot newspaper.

Setting up IMAP with KMail in Linux to get e-mail from QUT

These instructions are for QUT students. I do not know if they will work for QUT staff. Use at your own risk.

You need ‘vpnc’ program (install it with your pkg mgr). Then download off-campus.conf file and save it to /etc/vpnc/ directory. You could name it default.conf if it will be your only vpnc connection. The contents should begin with at least:

IPSec gateway sas.qut.edu.au
IPSec ID qut
IPSec secret qutaccess

As root run vpnc off-campus of just vpnc if you renamed it to default.conf. Enter username/password when prompted.

In Kmail, you setup IMAP connection using SSL, username/password and port 993 to host mail.qut.edu.au. SMTP uses NO ecryption, but authentication method is LOGIN (not PLAIN) and port 25 on host mail.qut.edu.au.

To exit vpnc type vpnc-disconnect as root.

I hope this helps someone.

References
http://www.its.qut.edu.au/offcampusaccess/sas/linux.jsp