Yet another reason why ramdisk distros rock

From tor-ramdisk

Tor-ramdisk is an i686 uClibc-based micro Linux distribution whose sole purpose is to securely host a Tor server purely in RAM. For those not familiar with Tor, it is a system which allows the user to construct encrypted virtual tunnels which are randomly relayed between Tor servers (nodes) until the connection finally exits to its destination on the internet. The encryption and random relaying resist traffic analysis in that a malicious sniffer cannot easily discover where the traffic is coming from or what data it contains. While not perfect in its efforts to provide users with anonymity, Tor does help protect against unscrupulous companies, individuals or agencies from "watching us". For more information, see the Tor official site.

The usefulness of a RAM only environment for Tor became apparent to me when Janssen was arrested by the German police towards the end of July, 2007. (You can read the full story in a CNET article.) While the police did not seize the computer for whatever reasons, they certainly could have. More typically, it would have been taken for forensic analysis of the data on the drives. Of course, if the computer housing the Tor server has no drives, there can be no question that it is purely a network relaying device and that one should look elsewhere for the "goods".

RealEyes

Sometimes just browsing Freshmeat can lead to some interesting discoveries like tonight I ran across Realeyes

The Realeyes analysis engine is a C library of functions that maintain state information and analysis results about streams of data. Applications may be built on it to search for complex patterns and then output information about the data or even transform it. It has been tested on several Linux distributions but should run on any Unix system.

The first application that has been developed using the library is a network Intrusion Detection System (IDS). It reassembles sessions (including both halves of a TCP session) from live or captured network traffic and analyzes them for patterns.

The detected records are transferred to a database interface and inserted into a PostgreSQL database. The database also maintains configuration information which can be sent to the IDS hosts for dynamic reconfiguration. The database interface can communicate with one or more hosts.

The user interface is a Java application using the Standard Widget Toolkit from the Eclipse project, which has been tested on several Linux distributions and Microsoft Windows. It is used to administer the application as well as to analyze detected network traffic and create reports for supporting a secure environment.

All Realeyes technologies are licensed under GPLv3 and are originally developed on the GNU/Linux v2.6 operating system.

And there is a blog, too -- because everything must have a blog, right?

Kiosk Mode, or why are all the cool Linux security tools on Fedora?

It's not that I have anything against Fedora, but for some reason I've never used it much, but I'm thinking I should wipe OpenSuSE on my 2nd partition and add Fedora (8 or 9?) because there seems to be a lot going on there. The most recent example is Fedora Kiosk Mode which is built on xguest and Linux namespaces (how many times can you say polyinstantiation?) GNOME Sabayon and SELinux of course to create "highly secure" (or at very least restricted environments) for public environments such as classrooms or public information kiosks. Cool stuff.

HT: James Morris

Linux Auditing Tool Showdown: sectool v. ProShield

So I ran across ProShield on Complete Dose of Linux Poison and I was expecting good things by the writeup, but when I peeked inside the .deb I was shocked to see a 1000+ line shell script. Got a new test? Just tack in on the end of a monolithic script.

The horror. The horror.

Unless you are writing system startup scripts there is no reason anything should be written in shell that is longer than 10-20 lines.

(Having had to maintain thousands of lines of shell/sed/awk scripts that somebody else wrote.)

On the other hand sectool (which doesn't work out of the box with Ubuntu/Debian) does have some potential not only because it is written in a post-1970s scripting language (Python) but has a framework-plugin architecture where where individual test cases can be written in shell or Python.

Of course a limitation of both of these is that must be run locally to get results (I assume) making it very difficult to scan large numbers of systems -- unlike what you can do with Nessus compliance checks for UNIX.

Why Manual Whitelisting works for Kids

As I've blogged previously a few times, I use squid with a simple white list

acl goodsites dstdomain "/etc/squid/goodsites"
http_access allow goodsites our_networks

for blocking access to my kids subnet. I have a very small list of sites, mostly .gov, because after all the government would never post anything inappropriate right?

(I initially allowed the entire TLD but my son started looking up crime statistics on the FBI web site, so made it more restrictive.)

My son has spent hours on the NASA sight downloading pictures, adding them to his GNOME backgrounds (yes his desktop is Ubuntu) editing them with gimp, creating OpenOffice presentations and during hurricane Ike I added weather.com so he's become obsessed with weather. but I was looking for something new.

My wife suggested adding one site at a time so he could take his time with each site.

One of the really cool things about the national geographic website is that topic areas have distinct hostnames, so I could be more granular in terms of blocking access.

1226102204.230     54 192.168.10.33 TCP_MISS/200 735 GET http://science.nationalgeographic.com/staticfiles/NGS/Science/SiteAssets/img/backgrounds/fact-486-footer.gif - DIRECT/208.59.201.138 image/gif
1226102204.253     73 192.168.10.33 TCP_MISS/200 521 GET http://science.nationalgeographic.com/staticfiles/NGS/Science/SiteAssets/img/backgrounds/feature-486-body.gif - DIRECT/208.59.201.138 image/gif
1226102204.268     81 192.168.10.33 TCP_MISS/200 686 GET http://science.nationalgeographic.com/staticfiles/NGS/Science/SiteAssets/img/backgrounds/feature-486-footer.gif - DIRECT/208.59.201.137 image/gif
1226102204.438    170 192.168.10.33 TCP_MISS/200 1276 GET http://science.nationalgeographic.com/staticfiles/NGS/Global/ApplicationAssets/flash/dl-loader.swf - DIRECT/208.59.201.137 application/x-shockwave-flash

There is actually a pretty good music there, too. Lot's of world music My son is playing the Ben Harper song above over and over again.

What he doesn't remember is that he listened to a lot of Ben Harper on KGSR back in Austin. That and a lot of Lucinda Williams.

Good stuff. Good times.

Serial Console on Newer Ubuntu Systems

This is another one of those boring reference blog posts on things you don't do very often so you forget how to do them.

Starting with Edgy, Ubuntu uses upstart instead of good old init so you no longer use /etc/inittab to enable serial consoles.

See SerialConsoleHowto for details, but basically what basically what you do is create a file in /etc/event.d for all the devices you want to spawn a getty on.

root@cm1208:/etc/event.d# ls
control-alt-delete  rc1  rc4  rc-default   sulogin  tty3  tty6
logd                rc2  rc5  rcS          tty1     tty4  ttyS0
rc0                 rc3  rc6  rcS-sulogin  tty2     tty5
root@cm1208:/etc/event.d# 

Looking inside ttyS0

# ttyS0 - getty
#
# This service maintains a getty on ttyS0 from the point the system is
# started until it is shut down again.

start on runlevel 2
start on runlevel 3
start on runlevel 4
start on runlevel 5

stop on runlevel 0
stop on runlevel 1
stop on runlevel 6

respawn
exec /sbin/getty 115200 ttyS0

and you can see the process running

root@cm1208:~# ps aux | grep ttyS0
root       547  0.0  0.0   3004   756 pts/2    R+   09:40   0:00 grep ttyS0
root      4239  0.0  0.0   1716   512 ttyS0    Ss+  Oct23   0:00 /sbin/getty 115200 ttyS0

Web 2.0 Security You Can't Believe In

From Obama, McCain campaigns' computers hacked for policy data.

Obama is PHP (the horror, the horror). McCain in ASP.

As described by a Newsweek reporter with special access while working on a post-campaign special, workers in Obama's headquarters first detected what they thought was a computer virus that was trying to obtain users' personal information.

The next day, agents from the FBI and Secret Service came to the office and said, "You have a problem way bigger than what you understand ... you have been compromised, and a serious amount of files have been loaded off your system."

One of the sources told CNN the hacking into the McCain campaign computers occurred around the same time as the breach into those of Obama's campaign.

Representatives of the campaigns could not be reached for comment on the matter

As Sarah Palin would say: Thanks but No Thanks (for the GE Fanuc Exploit)

Although I thought about the feasibility of SCADA metasploit modules for the ICCP vulns (VU#190617 and others) I discovered back in 2006 but I didn't write the GE Fanuc Exploit on milw0rm.com

And truth be told (hanging my head in shame) I've never actually written an exploit for any of the vulns I've discovered and I don't do vuln work anymore.

I've been clean for almost 2 years now.

But these are amusing. Must have struck a nerve.

proxy.writeFile('franzshell.jsp', Rex::Text.encode_base64(jspshell,''),false)
sock.put("GET /infoAgentSrv/franzshell.jsp?cmd=c:\\blogfranz.exe HTTP/1.0\r\n\r\n")

This module exploits an API flaw in GE Fanuc SCADA software

'Author'         => [ 'Matthew Franz ' ],
'Version'        => '$Revision: 20081031 $',
'References'     =>
['CVE', '2008-0175'],
['URL', 'http://support.gefanuc.com/support/index?page=kbchannel&id=KB12460'],
['URL', 'http://www.tenablesecurity.com/training/'],
['URL', 'http://blogfranz.blogspot.com/'],

I was wondering why I saw an increase in referrals from milw0rm.com and why someone asked me if I wrote an exploit. But of course I was too busy worrying about the election to care.

Mac was Back!

Apart from the booing goons in the crowd, I must say McCain did an awesome job tonight. Natural and authentic, no longer strained like the past few weeks and months. Remembering Gore's concession in 2000, what is it about concession speeches that are so flattering?

Almost makes me wish I was back in Chicago

See the slideshow from Grant Park and the live footage on MSNBC.

MSNBC: It's over

Ohio, New Mexico. And now the red states start flipping.

Yes We Can!

CyberSecurity Change you can believe in?

From Partnering for Cyberspace Security (Washington Post, 11/3/08)

By Walter Pincus
Monday, November 3, 2008; Page A19

In two recent speeches that have attracted little notice, Donald Kerr, principal deputy director of national intelligence, has called for a radical new relationship between government and the private sector to counter what he called the "malicious activity in cyberspace [that] is a growing threat to everyone."

Kerr said the most serious challenge to the nation's economy and security is protecting the intellectual property of government and the private sector that is the basis for advancements in science and technology.

"I have a deep concern . . . that the intelligence community has still not properly aligned its response to what I would call this period of amazing innovation -- the 'technological Wild West' -- by grasping the full range of opportunities and threats that technology provides to us," he said at the annual symposium of the Association for Intelligence Officers on Oct. 24.

Wild West? I though the late 90s were the Wild West?

Ground Game Reports Start to Trickle In

Good stuff from Ben Smith

I am 60 year-old white Republican for my whole life. I am a Vietnam combat veteran who has never voted Democratic before. I will vote for Obama Tuesday.

I am tired of politics as usual and am willing to take chance a on him. I believe he is sincere and has a good heart. I also have been impressed with his steadfastness during the economic crisis. He may be one of the most intelligent people I have ever heard. I have told no one I am voting for him, instead evading the question. I believe there are many like me.

I have not had one McCain visitor at my house, but have had 15 separate visitors for Obama. I counted them with a pad on my refrigerator.

Go Obamacons! There have to be a lot more like this, that want some intelligence in the White House for a change, who see the writing on the wall.

I'm talking small-government, NRA-life member, military types.

And then there was this interesting one

Interesting anecdote and probably a testament to ground organization. I have no idea what this means. Friday night (which happens to be the start of our Sabbath) my wife answered the phone to hear a man stating he was from the McCain-Palin campaign. He asked who she was supporting. She replied that we will vote for Obama. He replied with "but he's a f-----g n---er!". Before I get to my wife's response I'll first have to say that I understand desperation and I also understand that this pitch may actually work for a few people. I also understand that there are people who are whack-jobs phone-banking for both sides. But here are some facts:

My wife and I are Black. Citing the fact that Obama is a f----g n---er as a way to sway our vote may not be a great idea. My wife and I live in Maryland... Baltimore, MD.... One of the most African American areas of Baltimore Maryland. How on earth did our phone numbers get on to a McCain volunteers phone bank list of potential voters to be calling at this stage in the game? We have never received a call from the Obama campaign.

Just weird. Not sure what to make of it... but that's not a good sign of organization. If it did anything it made us want to donate more. BTW, the rest of the call went downhill from there. My wife prayed for forgiveness after the call.

Besides Blogging Yesterday!

From oct-nov-leaves-2008

SELinux and a Xen Vuln (CVE-2008-1943) Adventure

Given products like VM Fortess and the SVirt project I ran across today, I've been curious about the impact of application sandboxing/mandatory access control regimes against attacks against/using VMs.

Luckily, I happened to run across Adventures with a certain Xen vulnerability (in the PVFB backend). Now I don't claim to be able to understand even 20% of this paper, but I was pleased to see the impact of SELinux on the attack against dom0. Very cool. Plus, unlike so much vuln work it talks about the limitations of exploits and avoids all the media whoring that tends to characterize so much vuln work these days and turns me off.

Using the above guidelines, the exploit has been built. When SELinux was in permissive mode, it worked properly, handing out a connect-back root shell. However, an unsettling message was logged:

SELinux is preventing /usr/lib/xen/bin/qemu-dm (xend_t) "execmem"

And indeed, the exploit failed when SELinux was in enforcing mode. It turns out that by default the ability to map anonymous memory with rwx protection is denied by SELinux.

Thus, the call to mmap in the return-into-libc from the previous subsection failed.

There are workarounds for "execmem" protection, dutifully explained in, but I did not nd any le that can be opened with write permission and executed in xend t domain6. So, a less ecient return-into-libc payload has been created that does not use mmap. It returns into PLT entry for execv. The arguments for execv must be rebuilt at a xed address. Using repetitive returns into "assign %eax from the stack; ret" and "stosl; ret" (these sequences must be present in the qemu-dm binary) it is possible to create a payload of size const+4*length of execv arguments.

Please let this be true

A Palin prank call?

MONTREAL — A Quebec comedy duo notorious for prank calls to celebrities and heads of state has reached Sarah Palin, convincing the Republican vice-presidential nominee she was speaking with French President Nicolas Sarkozy.

In the interview, which lasts about six minutes, Palin and the pranksters discuss politics, pundits, and the dangers of hunting with current vice-president Dick Cheney.

The Masked Avengers, who have a regular show on Montreal radio station CKOI, intend to air the full interview on the eve of the U.S. elections.

The well-known duo of Sebastien Trudel and Marc-Antoine Audette have also tricked Rolling Stones singer Mick Jagger, Microsoft founder Bill Gates and French president Jacques Chirac.

The call to Chirac was rated by the BBC as one of the top 30 best moments in radio history of all time.

Tip: Ben Smith


The audio is at http://www.tindeck.com/audio/filestore/w/wwdo-SarahPalin.mp3.

Let's hope it isn't malware.

Please let this be true

A Palin prank call?

MONTREAL — A Quebec comedy duo notorious for prank calls to celebrities and heads of state has reached Sarah Palin, convincing the Republican vice-presidential nominee she was speaking with French President Nicolas Sarkozy.

In the interview, which lasts about six minutes, Palin and the pranksters discuss politics, pundits, and the dangers of hunting with current vice-president Dick Cheney.

The Masked Avengers, who have a regular show on Montreal radio station CKOI, intend to air the full interview on the eve of the U.S. elections.

The well-known duo of Sebastien Trudel and Marc-Antoine Audette have also tricked Rolling Stones singer Mick Jagger, Microsoft founder Bill Gates and French president Jacques Chirac.

The call to Chirac was rated by the BBC as one of the top 30 best moments in radio history of all time.

Tip: Ben Smith

Palin's Closing Counterfactuals

So how many in that crowd of Florida actually bring home a quarter mil?

Socialism, as in nationalizing the banks and federalizing the auto industry socialism?

Nah, we don't want to "experiment" with that. And the less that is said about J-the-P the better.



Tuesday can't come soon enough.

Dole's ^H^H^H^H^H McCain's Closing Argument

As one of my faithful readers (a Romney supporter, IIRC) predicted when McCain won New Hampshire. Romney is looking pretty good right now, given the selection of Palin. Oh well, hindsight is 20/20.



Let's hope the results are the same as '96, since Sarah Palin is no Jack Kemp.

Good Recent Paper to Get Up to Speed on SELinux

James Morris (of RedHat) has one of the better papers seen so far, Have you driven an SELinux lately?.

Among the areas for future work, he defines:

*Continued extension of SELinux architecture to the
desktop infrastructure and major applications. The
Imsep work mentioned in section 10.1 looks to be a
promising model for general separation of security
domains within applications.
• Working with the IETF to standardize Labeled
NFS, and with the Linux community to have it accepted
into the mainline kernel.
• Ongoing performance improvement, and efforts to
further reduce the memory footprint of SELinux.
• Further simplification of policy, perhaps through
the development of a higher-level policy language
with idioms more familiar to Linux administrators.
• Support for more virtualization models, including
Linux as hypervisor (e.g. KVM) and containers.
• Improved support for third party distribution of
policy modules, such as the case of cross-building
RPMs on systems with a conflicting host policy.
Continued usability improvements for end users,
administrators and developers.
• Better documentation.