Some previously disclosed Cisco CLI Vulns, the joys of youth hockey practice, and fuzzing like a ninja

The highlight of my Sunday is my son's hockey practice at the Skatium here in Skokie. Among the more amusing things that almost always happen:

• One of the parents (who acts & looks like a coach, but I don't think he is) arguing with the real coach about religion (the parent is a Christian, probably fundamentalist, and the coach is Jewish, I assume)
• Eight and nine year olds tripping and falling on the ice and occasionally doing some nasty checks on each other (usually unintentionally)
  
• The previously mentioned parent (who is out on the ice for some reason, has a flattop and is a damn good skater) doing "hockey stops" (resulting in a shower of ice fragments) in the faces of kids. Today he also banged on his son's knee with his stick shouting "knee's can't get hurt" while his son was flat on his back, not wanting to get up.
  

All Good stuff. But other than that (and the upcoming election of the 12th Bishop of the Episcopal Diocese of Chicago , today I've been sort of been fixated on CLI vulnerabilities after my last blog entry on the futility of router vuln work in 2008 and Thomas's Quarterly Affirmation (reversing IOS images is not an option for a whole lot of reasons) so I was curious what was out there:

In cisco-sa-20060712-cucm we see this

The CallManager CLI provides a backup management interface to the system in order to diagnose and troubleshoot the primary HTTPS-based management interfaces. The CLI, which runs as the root user, contains two vulnerabilities in the parsing of commands. The first vulnerability may allow an authenticated CUCM administrator to execute arbitrary operating system programs as the root user. The second vulnerability may allow output redirection of a command to a file or a folder specified on the command line.

And in cisco-sa-20010131-arrowpoint-cli-fs

The Cisco CSS11000 must be configured to permit command line access to users by providing a management address and defining user accounts. Once command line access is gained by non privileged users (defined user accounts without administrative privileges), running a command requiring a filename, and providing a filename that is the maximum length of the input buffer can cause the switch to reboot, and a system check to be started which will prevent normal function of the switch for up to 5 minutes. The show script, clear script, show archive, clear archive, show log, and clear log commands are capable of causing the CSS to restart if the specified file name is the maximum length of the input buffer. Cisco Bug ID CSCdt08730.

And from cisco-sa-20060719-mars

The CS-MARS CLI is a restricted shell environment which allows authenticated administrators to perform system maintenance tasks. The CLI contains several privilege escalation vulnerabilities which may allow shell commands to be executed on the underlying appliance operating system with root privileges. These vulnerabilities are documented by Cisco bug IDs CSCsd29111 ( registered customers only) , CSCsd31371 ( registered customers only) , CSCsd31377 ( registered customers only) , CSCsd31392 ( registered customers only) and CSCsd31972 ( registered customers only) .

And Cisco Security Response: Cisco IOS Reload on Regular Expression Processing

Some regular expressions that make use of combined repetition operators ('*' or '+') and pattern recalls ("\1", "\2", etc.) into the same expression may result in a stack overflow on the Cisco IOS regular expression engine. A stack overflow will result in a reload of the device.

Given the ubiquity of dumb (IOS-like) shells on network devices (and not just on Cisco boxes), it would appear that this might be fertile ground for a tool that:

• Allowed you to connect to various transports (SSH, Telnet, serial)
• Obviously support authenticated/unauthenticated sessions and configuration modes
  
• Using built in command expansion and help documentation, map out the various commands (and their syntax) depending on the helpfulness of the shell you could probably prepopulate various payloads for common configuration parameters that have to be parse (IP addresses, netmasks, hashes, etc.)
  
• Could leverage some existing fuzzing/fault injection framework so you would have to generate control characters, malformed arguments, and other sequences
  

Although this is sort of intriguing, I doubt I have the time to pull this off. And if I've managed sketch up this idea, somebody has probably already written a tool like this somewhere. And if not, it would certainly be a more useful project than what they are teaching the kidz these days at Berkeley. Of course I'm probably just bitter that I couldn't get into any dept. there, let alone that one. Yeah some parent's hard-earned cash is going towards having their little one learn how "fuzz like a Ninja."

Hacking Vyatta (or is there any interesting router vuln work to be done 2008?)

In one month I will be clean. Straight. Sober. No vuln work for a year. A year ago I was struggling to finish up the ICCP vulnerability paper I presented at S4, although I've had a few tempted a few times in 2007. Like before Fortify released their Java script Hijacking paper, I was sort of of interested in JSON and JSON-RPC.

And yesterday, this absolutely silly Network World article on Vyatta (a Linux based on Open Router platform -- I have another blog entry on Vyatta in progress, we'll see if I ever complete it) but as I was walking with my kids to the park I struggled to come up with anything interesting. After FX, after the BGP work Sean Convery and I did, after "Slipping in the Window," after Mike Lynn, after Gadi Evron's routesec list, after whatever Raven Alder was trying to accomplish with her SchmooCon talk, I'm not sure the point. (NOTE: the last two I list as efforts that might show that the field is played out, exhausted, that there isn't much to be done)

What can (or should) be done security/vuln-wise for commodity routing and switching features. Sure, you could fuzz/audit all the Quagga (or whatever they use) protocols and there are probably some more bugs to be found -- just like there probably are in IOS protocol implementations. If they mucked with lower layer (TCP/IP) protocols, well you could look at that. Yawn! And their web interface is an obvious (but also boring) target. Privilege escalation from within the CLI, maybe? We never had much time for post-auth stuff back in the day. Automated CLI testing (and fuzzing?) seems sort of interesting, if only because it wouldn't be protocol work. If they really had some virtualization features (like Cisco's that might be worth looking at) but just running in VMWare? Come on guys! I dunno maybe there is something to look at in their HA features like their VPN clustering technological or their "protocol sandboxing" (assuming that just doesn't mean each protocol is just running a separate Linux process). Who knows? Maybe I'm just not being creative enough.

Back on Ubuntu Again (on Desktop at least)

So has it only been a little under three years since I first installed Hoary Hedgehog on my T40 while I was still at Cisco? Seems like ages.

But I'm pretty pleased with Gutsy on my T-61. I did the alternative install CD and kept my /home partition (this caused some issues with XFCE and gnome settings) and compiz (which is amazingly snappy) didn't work until I checked out the hint on the Thinkwiki page. VMWare Server 1.04 installed without a hitch. Sound (after modified some perms, since it only works on the user you installed with) Flash and Java installed Fine.

Now if only I could get my kids to go to bed on time and keep my dogs from killing each other, I'd be happy.

Believe or not an 80lb lab mix and and 30lb Boston Terrier is a fair fight.

End of Festung Mac (or the curse of Liberal Arts majors turned security pundits)

Lisa Vaas's article "Fortress Mac is Gone" is typical of the vacuous shit that is out there in response to whatever the name the new trojan is. DaveG provided a much needed corrective to this nonsense.

The subtitle? While I don't know if Ms. Vaas has a BA, I certainly do, but from a decent engineering school, damnit!

And yes I'm still pissed about this blogger captcha.

OpenBSD Kernel Janitors Sound Good to Me

I must be bored because I'm reading I'm reading openbsd-misc but this kernel janitor thread was pretty classic and almost as good as the one last month when a Google recruiter propositioned Theo.

Here are some quotes although I skipped the good ones:

> > Development is not the same process as writing a whiny mail.
>
> that is a shame.  i can probably better understand the relectance to
> re-visit this if it has failed before.  perhaps, others are right,
> perhaps linux can tolerate it because it's not as good as openbsd.

and

> i think we'll simply agree to disagree.  i personally find it quite
> disheartening to hear the attitude that prevails here but that's the
> community's decision.  it certainaly seems to refelect the attitute
> of it's leaders (developers).
>

Consider it the voice of experience (bitter).

Its easy to tell which ones are the programmers.

They write code, then they submit it, it does not suck too much and they
take the suggestions of the current project leads. Then they resubmit
better code.

The rest of us should simply buy CD's, ask and answer the occasional
question, and other wise keep quiet.

And those weren't even the best (the one where Theo tells the n00b he has anger issues, in particular) but this Blogger word verification is pissing me off, but if you want ask some questions to the OpenBSD crowd to stir the pot, here are some ideas:

• Ask if anyone is interested in porting dpkg/apt to OpenBSD (I actually did the former over the Xmas holidays last year)
• Ask where the "forums" for OpenBSD are and point to the Ubuntu Forums as examples
• Ask where the "desktop edition" of OpenBSD, you know the one with the GUI isntaller instead of this
  

Only 2-3 Weeks from Cyberattack to Cannibalism?

So there's been an amusing thread over on the SCADA mailing list about the interdependencies of various critical infrastructure sectors

Fact is, Los Angeles, Chicago, SFO, Detroit, NYNJ, Boston, WaDC, etc. are two to three weeks away from cannibalism. Any large city will devolve into rioting and block warfare if the power stays off for longer than about 48 to 72 hours. As soon as the stored food is gone, people will die, or other people will kill and eat them.

Maybe Walt has recently read Cormac McCarthy's novel The Road or perhaps he is just tapping into that little voice inside all of us that wants to stock water, food, and ammunition in preparation for the "big one." I wonder if kids that are old enough to appreciate 9/11 have the same fears those of us who grew up during the cold war did?

How many rounds of .223 is enough for your Mini-14? How many plastic milk jugs full of rice will last you until food shows up on the shelves again? Can you ever prepare enough? As for myself, I put my faith in martial law and I have enough real problems (and real madness close at hand) rather than preparing these sorts of fantasies. But if you want to go there, definitely check out this amazingly haunting, spiritual, Pulitzer-prize winning book, which I read in nearly one sitting a few months back:

The clocks stopped at 1:17. A long shear of light and then a series of low concussions. He got up and went to the window. What is it? she said. He didnt answer. He went into the bathroom and threw the lightswitch but the power was already gone. A dull rose glow in the window glass. He dropped to one knee and raided the lever to stop the tub and then turned on the both taps as far as they would go. She was standing in the doorway in her nightwear, clutching the jamb, cradling her belly in one hand. What is it? she said. What is happening?

I dont know.

Why are you talking a bath.

I'm not.

However, it is not what you think. You will not get a linear description of what happened that led the father and son to wander across a ash covered America of the future and encounter various characters out of Mad Max. But there is cannibalism. And infanticide. And it is definitely good read.

Gutsy Gibbon on Thinkpad T-61: First Impressions

So I'm using the Gutsy Gibbon (Ubuntu 7.10) LiveCD on my Thinkpad right now and I'm quite impressed. I assume much of the stuff that didn't work was because it was a LiveCD? Not sure. In any case this is a significant jump over what I've got with Debian Etch

What worked?

• Sound card
• 1440x900 Resolution in X
  
• Adobe Flash installation (after adjusting synaptic)
• Intel 4965 Wireless Card with WPA Personal
• Brightness Controls
  

What didn't work?

• Sun Java5/Java6 Installation
• Flash Installation
• Multiple Displays weren't autodetected (not sure if Linux can even do this)
  
• Fancy Desktop effects (who cares, since I'll probably install xfce anyway)

What sort of worked?

• Suspend (on resume screen was really dim)
  
• Volume controls (they showed up on the screen but it didn't impact XMMS)
  

I used to think the Internet was wive's tale

Yeah I think I've lost my mind from running one too many script to pull various firewall stats, generate .csv's, then create plots in Excel. (The great think about Ruby is that it makes you so productive that in the time you could use manage to get something working out of CPAN you could write right your own API in Ruby. And of course that is more fun, too.) So of course I think Gabe and Max's Internet thing is pretty hilarious. And I'm not sure why but I could watch this guy all day long.

Who cares about the iPhone/iTouch Web Apps

So this email for the iPhone Development Center just showed up in my Inbox and I'm not sure it was meant to placate folks that want an Open OSX "Mobile" platform, but I found it more infuriating:

1. I don't want an iPhone, I want an iTouch. Expensive cell phones are for hip 20-somethings that don't have big dogs that eat cell phones (or destroy laptops) or kids that drop your cell phone in the bath tub.
2. I want offline apps. I want console apps. I want GUI apps. I want apps that don't run in Safari.
   

Itouch and Google-Blogger Collusion

And I wondered why I was getting all those hits, but #2?

Crazy.

But I didn't Work All Weekend!

Although I did spend way too much time near Lincolnshire both days. And yeah my daughter's bangs have almost grown out after her "scissor work" during the summer.

Project Work and the Dreaded "Middle Third"

Whether it was doing security testing of [Cisco] products or commercial webapp assessments or conducting some sort of critical infrastructure security research -- the "middle third" was always the worst.

You are stuck between the initial thrilling period of a whole lot of learning and the final culmination of the project where you are wrapping up the deliverables or presenting them to a client -- or to the community. This middle phase is sheer drudgery. Nothing makes sense, everything is up in the air, and you wish you never started the project. But eventually but you will experience enough angst to be able to pull the project together and in the end it will have been all worth while.

And you will repeat the cycle all over again.

I have not yet figured out the curve yet for operational security work, responding to unplanned outages, or administering behind the scenes gear that folks only care about when it is breaking or broken. But it does not follow this pattern. Or if it does the curve is dramatically compressed (perhaps the bipolar cycling patterns of adults vs. children is analogous) so that the initial excitement of kicking off what you thought would be a minor upgrade and the terrifying spiral of unexpected events to the moment of relief when you are back on steady ground and you manage to scrape together some solution to the problem -- all in a matter of a few hours.

Unlike consulting or R&D work this "middle third" is where you find clarity, where you realize in quite concrete terms some of the information (or assumptions) you had was incorrect and you know you would do things differently next time. This is wear the real learning occurs, where mistakes become crystal clear, where things become concrete.

So, yeah its been a busy week and I had to pull another early-morning upgrade today. And I'm exhausted. And how many more weeks of Edens construction?

Best Vertical Case for 14.1" T-61?

I'm ashamed to say I'm a bit laptop bag snob, so finding a small, sturdy case for my T-61 is proving to be difficult due to its weird dimensions: 9 1/4 x 13 1/8 x 1 3/8 (my measurements, not the official one).

I have a crappy 15.4" Targus sleeve I use when putting it in the laptop compartment of my Boa XM but I want something small for only the laptop like the Booq PowerSleeve XS I have for my 12" PowerBook, when I don't need to carry a backpack.

So far the candidates are the McKlein S Series Transporter (Nylon) Trager Vertical Transporter, Higher Ground 14" Shuttle or the Tom Bihn Vertical Brain Cell (Size 4) or maybe the Booq Natrix SlimCase but that's probably bigger than I want. None of these are cheap, some I'm sure they are all good quality. I'd like to be able to fit the small power adapter somewhere. and have a decent shoulder strap.

Any experiences with these? Or anyone find the perfect case for their 14.1" T-61?

Update on iTouch Hacks

So I previously pondered the feasibility of running non-Apple/webapps on the iTouch (which I looked at again at the Northbrook Apple store last week, and I really like this little devices) and it looks iPhone hacking community is making progress:

Very late tonight (or early, depending on your timezone), we were able to decrypt the iPod Touch/iPhone 1.1.x ramdisks. We are proud to announce the md5 of the asr binary from the 1.1.1 iPhone image, as proof that we do indeed have access to it: 358bf0bd1f1024ed25fa69ced23dab90

As for the actual key, it's sure to pop up in the next few days, keep your eyes peeled.

It's been a long month with many distractions, but we are finally breathing a sigh of relief as we work towards the release our own iPod Touch jailbreak solution, as well as expediting the process of unbricking 1.1.1 phones that were renedered unable use their SIMs after running AnySIM on mobileOSX 1.0.2. Contrary to claims made by the so-called "elite" iPhone development group, we are indeed very dedicated to getting a free and workable solution out to the general public. At the very least, a baseband downgrader should be possible. We understand your frustration, and please don't think for a second that we've forgotten you.

We have been able to install many of the third-party iPhone applications working on the iPod Touch, and can confirm that Mail and Maps work great. Stay tuned for more info on how to add more Apple apps.

Here is the RSS Feed for the wiki so you can track progress..

The point of my CIAG Research RIP Post?

I noticed from my web logs that some folks in Austin are looking for my blog entry on the demise of CIAG Research, where I used it work. Yeah, I pulled it down.

One reason was due to the Dark Reading article which I was shocked to see, since this story was hardly industry news. And nothing compared to the re-org's and layoffs at Cisco that occurred in 2001 during the "hundred year flood" (as John Chambers called it) and continued as various product lines and groups were shut down. And I heard there were quite a few other other teams that were impacted at the end of the FY, including a decent size product group in San Jose I had worked with.

Another reason I pulled down the post was is I think some readers may have missed the point. Although my comments within the content of the closing down of a group I had been part of, they were more on the sort of teams that I wanted to work in based on some hard-learned lessons. One of those is, watch out if you take cool jobs in groups that are out of whack with the overall company's mission. You shouldn't be surprised if it gets the axe. Hell, these days, even if you are are in a group that is properly aligned, you still might get re-orged or outsourced. We are in "get lean" Tom Peters world. Even your high paying security job can vanish before your eyes (of course you can get a new one, but that is not the point). Companies, teams, your own careers hav life cycles you need to be attuned to...

Things fall apart; the centre cannot hold;
Mere anarchy is loosed upon the world,
The blood-dimmed tide is loosed, and everywhere
The ceremony of innocence is drowned;
The best lack all conviction, while the worst
Are full of passionate intensity.
Surely some revelation is at hand;
Surely the Second Coming is at hand.

to quote The Second Coming (whether or not it applies)

Kulturkampf 2.0

Believe it or not, I'm actually glad that I had so little exposure to the Internet while I was in college. It was only my last year (in 1993, as a struggled to complete the inane requirements for teacher certification in Texas) that I ran across gopher, usenet, and lynx (that was what I would telnet up to in Kansas from my VAX account at Texas A&M, right?)

Most of my friends (including my soon to be wife) were grad students in the A&M English Department. Many were embroiled in debates about the Culture Wars of late 80s and early 90s. Critical theory, multiculturalism, Post-Modernism, Post-Colonial Literature, Foucault, Derrida, the Canon, the Body, The Border. Critical Pedagogy. The flattening of hierarchy, the collapse of high and low culture, the end of the authority, the decimation of institutions, the horrific lack of standards, decent into moral chaos, etc. ad nauseum.

This is what I was exposed to in my upper level English and History classes. This is what we debated and argued. I remember attending a speech Dinesh D'Souza who was denounced (yes, denounced in the Maoist sense) by several African-American students in the shrill terms as a racist. But as a white male, middle class, Liberal Arts major in at an majority engineering school (adding insult to injury the English department shared the same building with the business school, the horror!) who no clue what I wanted "to do" let alone "how to do it" -- I felt like a persecuted minority. Put off reality by going to grad school. In what? Apply for the that MFA program in creative writing? Could I get into the Iowa Writer's work shop. Probably not.

It all seems so trite now (ah, to return to the naivety of age 22, although I remain a reactionary still) as does an Interview with Andrew Keen (the author of The Cult of the Amateur: How Today's Internet is Killing Our Culture) spurred this nostalgic blog entry.

The review in Academic Commons was the most compelling and begins with:

Andrew Keen insists he is neither anti-technology nor anti-progress. Yet this veteran of the dot com era begins his recent book, The Cult of the Amateur (Doubleday/Currency, 2007), sounding much like a high-culture snob pooh-poohing the vulgar masses for having appropriated the Web as their own and, in the process, wreaking potential destruction on our economy, culture and values. Keen's polemic hints less at neo-Luddite dissent than at an underlying bitterness and resentment--at his own gullibility at having been so easily sucked into the Internet dream, and also at those who have taken the technology out of the hands of professionals like himself ("I almost became rich" [p. 11], he confesses in the beginning of the first chapter). Drawing on 19th-century evolutionary biologist T. H. Huxley's "infinite monkey theory," Keen fears what lies ahead when the masses are empowered with far-reaching technology. As the author describes it, Huxley's theorem asserts that if infinite monkeys are provided with infinite typewriters, one of these monkeys will eventually create a masterpiece. Keen updates and reverses the theorem, replacing monkeys with humans and typewriters with networked personal computers; and "instead of creating masterpieces, these millions and millions of exuberant monkeys--many with no more talent than our primate cousins--are creating an endless digital forest of mediocrity" (pp. 2-3). By the end of the introduction, a reader would have just cause to feel a bit insulted

And definitely better than the one in the NY Times

Mr. Keen argues that “what the Web 2.0 revolution is really delivering is superficial observations of the world around us rather than deep analysis, shrill opinion rather than considered judgment.” In his view Web 2.0 is changing the cultural landscape and not for the better. By undermining mainstream media and intellectual property rights, he says, it is creating a world in which we will “live to see the bulk of our music coming from amateur garage bands, our movies and television from glorified YouTubes, and our news made up of hyperactive celebrity gossip, served up as mere dressing for advertising.” This is what happens, he suggests, “when ignorance meets egoism meets bad taste meets mob rule.”

Whether or not this depiction is true (and there certainly have been critiques of his facts) which is different question from whether or not this development (some of which is obviously the case) is a bad thing -- this critique seems strangely naive, ignorant of history and recent philosophy.

How many times in past cultural changes/wars have we heard these same arguments?

However it is curious, that the most interesting technological trends (and many such as Free/Open Source software, the ultimate amateur endeavor) of the day seem to be an ultimate fulfillment the prophecies of the postmodern theory I was reading 15 years ago.

If only I had known.

Can't Sleep? Read about Scaling Web Apps

If, you too, happened to have watched Knocked Up tonight and can't sleep (and no I haven't been reading the "baby books" but I probably should be), you might try reading this fairly vacuous article/discussion called Why most large-scale Web Sites are not written in Java but it lead me to High Scalability which actually pretty interesting and reminded me of the cool Joyeunt Prezo from RailsConf I ran into a while back.

Gated Communities Work in San Antonio (and Iraq)

If you are looking for some positive news (well, sort of) from Iraq Jamie Tarabay story was interesting this afternoon. Funny how the same Iraqi's that were complaining about the walls going up now don't want them to open the gates. Reminded me of the The Dominion where our course I couldn't afford to live on a teacher's salary. The closest I got was my students and quite a few weekends at Camp Bullis.

The "Invisible Threat" at the End of the Fiscal Year

It's hard not be cynical these days, especially when you see topics you have some knowledge of (or know the folks that are getting quoted) show up in the media. So the timing of the leaked/intentionally release "staged cyber attack" right before appropriation time makes a lot of sense. Get those earmarks while you still can. "Got to get them Dead Presidents" (to quote Tim Fite.)

From the CNN Story

The White House was briefed on the experiment, and DHS officials said they have since been working with the electric industry to devise a way to thwart such an attack.

"I can't say it [the vulnerability] has been eliminated. But I can say a lot of risk has been taken off the table," said Robert Jamison, acting undersecretary of DHS's National Protection and Programs Directorate.

Government sources said changes are being made to both computer software and physical hardware to protect power generating equipment. And the Nuclear Regulatory Commission said it is conducting inspections to ensure all nuclear plants have made the fix.

And from the AP Story (written by our old friend Ted Bridis, no doubt.)

President Bush's top telecommunications advisers concluded years ago that an organization such as a foreign intelligence service or a well-funded terror group "could conduct a structured attack on the electric power grid electronically, with a high degree of anonymity, and without having to set foot in the target nation." Ominously, the Idaho National Laboratory — which produced the new video — has described the risk as "the invisible threat.

Given that most people in the field know this sort of thing has always been possible, I'm curious why it has taken this long. Why now? Its been a month or two since the Black Hat press cycle? To me the fact that this experiment was leaked/released to the public is either a sign of immense vitality (things could never be better!) or extreme sickness for the SCADA Security community (the naysayers are questioning why so much money is being spent?) If I were forced to pick, I would go for the latter.

To me this attack is more interesting if taken more literally, meaning you don't try to make the stretch against large scale generation assets. How many large data centers have comparable generators and then there is HVAC. With all the focus on Power Grid security and Process Control Security, the folks over the Building Automation Systems are still back in the euphoric glory days of web services and the wonders of TCP/IP enabling embedded devices. If you think about comparable sort of HVAC equipment (or controllers) that are often directly connected to campus networks (nothing like seeing BacNet broadcasts when you sniff traffic on your switch port to make you feel warm and fuzzy.)

If the "risks have been taken off the table" then what is the point of the smoking generator? IMHO, the video was sort of a letdown. And the endgame is not nearly as interesting as the access requirements, components under attack, the messages getting sent, and specific sequence of events necessary to get there.

Outing PeerTAB

Sometime back when it was still cold (probably in April, I around the time we had that last really wet snowfall of the year, perhaps even when I shot this video of my kids beating up our snowman -- it is amazing how many "snowman beating" videos are in Youtube) I got this wacky idea while stuck in traffic.

So the question I had, was why haven't we seen any global (or even Enterprise-wide) log/traffic/alert sharing tools which use P2P technologies? Why haven't we seen a decentralized Dshield? The answer, several months later, was PeerTAB.

Obviously there is no code yet, but there are a reasonably refined set of requirements. Just to be clear, this is not another log analysis tool, or a SIM. It is basically a [hopefully] thin layer on top of JXTA that would allow stuff like Snort logs, netflow-data (lets say from flow-tools), mod-security logs, or whatever to be contributed and searched across a global (or localized) P2P network. I had some initial success in using JRuby and JXTA but there is a lot more to do, so stay tuned.

And if you have any interest in learning about P2P Networking APIs and have some minimal of level of Java/Ruby competence and want to get involved in the project, let me know, let me know.

So which mods which brick the iPhone/iTouch?

So between Steve Jobs threats to combat hackers and the "genius" (who had this annoying cocky swagger) at the local Apple store in Skokie gloating about how users that hack their iPhones won't get support and others will automatically be "bricked" when then run iTunes, it will be interesting to see what happens and how Open the platform? For me running arbitrary apps is the whole point of even buying one of these devices.

GNUCITIZEN: I liked you back when you were a temp!

About a year ago I started following GNUCITIZEN (back when it was just PDP) because the graphics were cool and there was interesting content like running Jython within your browser and even the AttackAPI.

But things started to get less and less interesting as GNUCITIZEN hit the Web 2.0 Security warpath--and other folks started blogging besides PDP. Then came the Firefox vuln (yeah the one you just updated for) and then today's pre-disclosure of a Acrobat 0-day.

The site is certainly on a downward trajectory and it was with a certain sadness that comes this time of the year [in North America when you know the days are getting shorter] when I read the profound advice not to open any PDF's. Another non-actionable disclosure. If you are going to pre-disclose (which I disagree with, but fine!) at least provide something useful, like a PoC. Otherwise, what is the point? A site that had the potential to be something interesting and off-beat like lcamtuf has devolved in to banal disclosure posturing. And we certainly could use a lot less of that.

Oh but it looks like the site is now down, so its not a total loss.

New Click Router Release!

While there are loads of crude packet generators like hping, sendip, nemesis (and back in the day I used to used a set of tools called spak in a TCP/IP Security course I wrote back in 1998) that you could use to reproduce various L2/L3 attack or send the arbitrary frame. But if you need to have tight control of the packet rate and packet size (like smartbits/avalanche) to do performance testing of forwarding devices, the free/Open Source tools are pretty primitive. The built in Linux packet generator allows a mean spew of frames (I measured around 300kpps on my T-61!) but it is either a firehose or a trickle since the delay mechanism was just not effective to set the consistent packet rate.

The Click Modular Router however, does not suffer form these limitations and I used it extensively this Spring when I was comparing interrupt utilization across OpenBSD and FreeBSD PF implementations. But unfortunately it only ran on older kernels (and believe me I tried) so today's release is good news.

I have been meaning to release a UbuntuTrinux-Click release that has an easy to deploy version of Click. Maybe this will help me get on to that task.

iPhone Never, iTouch Maybe -- it all depends on the Apps

So even after the price drop, the iPhone is not tempting, but my [almost four year old] daughter couldn't keep her hands of the iTouch at the local Apple store and I'm intrigued if you can run the same apps as on the iPhone such as Dropbear and of course Ruby, Python, etc. It might be even worth $299. The idea of having a decently powered, 802.11 capable *BSD box, that you can easily move files to and from using standard tools (ssh, rsync, etc.) that fits in your pocket seems really cool.

This NerveGas character seems to be doing some cool stuff and there is a growing list of cool iphone hacks available and of course the iPhone Dev Wiki is definitely show promise.

But has anyone confirmed these growing number of apps and hacks run on the on the iTouch? If Colloquy runs on both I assume its the case, but there isn't much out there yet in on the iTouch.

The Men of SCADA Security (June Edition)

It's been a hectic week (and breathing too much filtered data-center air has not only given me a cough but also clouded my judgement) but thanks to Dale for making my night.

You must check this shit out.

It’s 2 a.m. at a major industrial facility, and about 20 yards from the rear perimeter, two figures dressed in full camouflage gear are slinking along the tree line just outside the plant fence. They’re wearing backpacks and carrying various paraphernalia, pausing occasionally to peer through night vision monoculars to scan the plant perimeter.

Although this was strangely reminiscent of the whole man that saved the internet farce, I guess this is good marketing within the parochial SCADA security community where everything is about a decade behind the rest of the security world.

But who I am to be judgmental? If this guess if it gets Ty and Jonathan more assessment dollars, good for them! But I wonder how much someone would have to pay me to wear BDU pants again and don a black T-shirt holding a laptop. But not the hard hats.

By the way, this reminds me of spot on parody of the whole para-military/martial-arts attitude of computer security folks in season 2 of the UK office, which is also a must watch.

More Shrewd Analysis from Richard Clarke

I happened to follow on of many posts on OBL 's new beard over on Andrew Sullivan's Daily Dish to silly article
with these amazing bits of intel analysis:

"It does look oddly like he is wearing a false beard," Richard Clarke, a former White House counterterrorism official and now ABC News consultant, said. "If we go back to the tape three years, he had a very white beard. This looks like a phony beard that has been passed on."

And is Richard Clarke on "my list?" Maybe, I started (but never finished) a blog on his silly Blackhat Keynote (no I didn't attend personally, since I don't do Las Vegas). I probably do have some lingering resentment towards the former Cybersecurity Czar for having to miss a bunch of Common Criteria conference sessions back in April 2002, when my group at Cisco had to do some BS prezo on the "Future of Internet Security" for him.

And if you are wondering where my technical blogs went (and are wishing I'd cut all this political crap), they are over on AngryRuby which actually isn't so angry anymore. Look for more JRoR fun this weekend!

Folksy Fred? 'Fraid Not!

Although this is actually a pretty decent picture that made a positive first impression for some reason (squinty eyes, head cocked, bald-spot chopped off, dark shirt, hand reaching out...) I had the misfortune of watching Fred08's video this morning. I'll admit I was on the way out the door and the video was a bit choppy, but it was hard to watch. And then on the way home I heard the nice NPR Piece on his movies. They played all these really bad lines from really bad movies. Who could listen to this guy? But I guess some people watch these dreadful shows.

Dubya is painful enough to listen to, but this guy? The delivery was all wrong. Come on. Made me think I was listening to another Southern lawyer from North Carolina that is on the Democratic ticket, except Edwards is more articulate. It reminded me of a folksy, blue jean, tough guy video of Bush driving his truck on the ranch during the 2000 Republican convention that was at least effective albeit cheesy. (That sort of thing works against a Gore or Kerry but not against Clinton or Obama this year).

With the exception of McCain (and maybe Paul) both of which are probably unelectable, the clowns (and pandering to the "conservative base", which is somehow more pathetic than the Democrats pandering to the Anti-War vote, when of the outcome in Iraq will be likely the same regardless of which sides wins) the Republicans have in the race (yes, G-n-R are clowns) illustrate the desperation of the party that deserves a 1964 style ass-kicking if they go with someone like Fred--or deserves it period. Apparently the smart Republican candidates (much like Clinton in 2004) know it is best to sit this one out and watch the cultural conservative (meaning the gay-bashing, immigrant hating...) wing of the party get their clocks cleaned.

Thwarting the Evil Thinkpad T61 ESC Key

Since I am not an emacs wanker and the T-61's ESC key is small and way the hell away, I get the GNOME help screen only like 40-50 times a day (and have been for the last 3 month). But no more. Enough is Enough.

xmodmap -e "keycode 67 = Escape"

Shiner comers to Skokie!

I was shocked last night to see Shiner Bock in the cooler at the seedy little Austin Liquor store. (For the record, Dempster & Crawford is about as far from Austin, TX as you can get.) But it made up from the quirky Russian, Czech, and Israeli beer I've bought at the village market. Although a Shiner on tap would be even better! Since I took the afternoon off, must get off the computer and enjoy the gorgeous weather that you wouldn't see in Texas until November.

My Year at Digital Bond and Gifts that Keep On Giving

Although I have since sworn off fuzzing (I've been clean for quite some time, I promise) I was pleased to see that the small toolset I developed for fuzzing TPKT, COTP, and OSI protocols used by ICCP, MMS, and IEC61850 was released to vetted Digital Bond subscribers.

Bring on the clueless news stories.

Of course there were a lot of tragedy and comedy that happened behind the scenes (but none that trumped when the crappy Python fuzzer I wrote in CIAG back in 2002 was called "threat to national security" now that was truly a happy day and the tragedy? the frightening number of emails on the topic to various members of Cisco PSIRT arguing about whether or not said tool should ever see the light of day) that only a handful of folks will ever be privy to, but one of the more amusing anecdotes that is public (if you know the right google keywords) was when a private email I sent to board members of the UCA Foundation asking for contact information for a couple of the smaller SCADA vendors got posted their sharepoint site you can imagine the fun that was had by all end users started asking "what up with that?" to their vendors. And, no doubt, some heated emails were exchanged between myself and others. Ah, sweet memories.

Non-Jython News and the irrelevance of Jython

So JDJ has an article on a major upgrade in Jython 2.2

Jython 2.2 has support for most of Python 2.2 and numerous features from Python 2.3. The new release - the first major overhaul in 4 years - includes many major changes:

* new-style classes
* Java Collections integration
* PEP 302 implementation
* iterators
* generators
* __future__ division
* support for running on JDK1.5 and 1.6
* new installer
* a significant number of features to bring Jython in line with CPython

Compatible with 2.2? Who cares? Given the incompatibilities between 2.3 and 2.4 (let alone 2.2 and 2.4) this makes Jython basically unusable.

JRuby has clearly won the war here in terms of major scripting languages to use with Java and that is too bad.

RSnake vs. TQBF: As we used to say at Cisco, "Two Man Enter: One Man Leave"

Apart from the 4-packs of sparkling fruit drinks they had in San Jose, probably the best thing about working at Cisco was the online directory. Working at a large company that has a Notes based online directory, I really, really, really, really miss directory.cisco.com (I think that's what it was, but hey is it resolves, so it must exist as does my old workstation samara.cisco.com, woo-ho!).

Not only could you watch as ordinary "Software Engineers" became "Technical Leaders" (and you knew they were either a grade 11 or 12 by then and could then guess at their bonus percentile) there were pictures! So you could tell who was shooting for the stars when they replaced their first day digital camera picture (yes I was so happy to have left Southwestern Bell/SBC and at $54 the stock could only go up!) with an executive portrait in a suit and tie and the blueish Sears portrait studio style backdrop. And any directory.cisco.com blog entry would be incomplete without stories of the SPA engineer[s] that used curl-cron jobs (or whatever) during the "Hundred Year Flood" (the term Chambers gave to the big round of layoffs in the Spring of '01) to track which organizations and individuals we "impacted."

But back to the pictures! So much you could do with these pictures. During a "management transition" my cube-mate created javascript popups of our new boss all over his screen to let him know that our new boss was always watching him (and improving his productivity!). Other folks replaced their photo's with arbitrary URLs of their favorite movie characters. I sent out one of a crazy looking crypto program manager spoofed from misterx@cisco.com. Who was this Mr. X? What did he want? Those were the days. And that is what happens when you are in a overhead group with no revenue responsibilities or infrastructure to operate and maintain.

But the best were the cage matches. You picked (and printed out) a crusty old distinguished engineer that had the vagrant/professor look down and imaged him battling the VP/GM of some switching BU that looked like the bully that kicked your ass in 7th grade. And you watch them fighting, brawling, swinging, until one was left standing. And you would shout, "Two Man Enter: One Man Leave!"

* * *

Oh yeah if you are taking the day off (I haven't logged into the VPN once!) and are looking for a fun read, check out Robert Hansen Loses His Sh*t Over Google Gadgets. A classic cage match, Cisco Austin Building 3 style.

CVE-2007-4091 and the Lack of Actionable Info in Vulnerability Disclosures

I was going to blog on something more interesting tonight -- like Cormac McCarthy's Novel, The Road which I read in almost one sitting yesterday evening -- but I got distracted by the new rsync vulnerability disclosed last Wednesday which once again show how little useful information (from the point of view of an end user/administrator) shows up in the disclosures by either the vendors or the finders.

For example:

It still pays to have a look at open source projects.
rsync 2.6.9 contains two off by one stack overflows, one from which the target buffer is next to the
saved frame pointer.
The problematic function is f_name().
Obviously it expects a target buffer size
of MAXPATHLEN bytes. Otherwise
the size parameter calculation to
strlcpy() is wrong.
Lets have a look at f_name() calls within the two following pictures.
An offset is added to the fname buffer
which is of size MAXPATHLEN.
The offset is the stringlen of dir.root
plus one (due to the slash).
Within successfull_send(), the buffer
should be neighbor of the saved

And USN-500-1 is only slightly more useful:

Sebastian Krahmer discovered that rsync contained an off-by-one miscalculation when handling certain file paths. By creating a specially crafted tree of files and tricking an rsync server into processing them, a remote attacker could write a single NULL to stack memory, possibly leading to arbitrary code execution.

So this is only a server issue? In my state of exhaustion (had to work most of the weekend) I am more worried about attacks against the "client?" Like a more trusted centralized server pulling files from many more exposed (less trusted) server. So an attacker creaties a malicious path (greater than 1024) on a remote server (plus whatever else is needed...) to compromise the "rsync client" pulling from the servers? If I'm running rsync+ssh am I just as vulnerable? Is this only an rsyncd issue?

Of course most bug finders could give a shit about real access world issues that ultimately allow risk decisions to be made, and help folks that run systems must be upgraded immediately, which can wait? Or how does this vuln compare to others?
I'm not sure I buy the CVSS 6.8 in the NVD. The NVD entry says this is a pre-auth?

I think you get the point here. More questions than answers. Or do you just blindly update the .deb or RPM? So Ubuntu and Debian have updates out but doesn't look like this is in FreeBSD ports yet and nothing in CVS yet. And the rsync in OSX, can you say 2.6.3

Forget about it.

Any luck ILO100 (DL145G3) on non-Windows JVM?

So HP DL145 G3's are nice, cheap (non-RAID), AMD-64 1U servers with Lights Out Management (they use the ILO100s built by ServerEngines) and the Java Applet KVM (which runs VNC or something like it) worked well on OSX, Linux, and obviously Windows for the eval hardware we had from HP. But whatever the version of only works with the JRE1.4.2-13 of Windows. Using any other JVM results in a NullPointer Exception and the message "General Exception: Optional Package Installation is Aborted"



Anyone else have luck? Oh well, guess I'll be dealing with HP support this week, wish me luck.

BWM-NG + Ruby for Gathering Network Stats

BWM-NG is a great tool for getting real time stats, but by using the CSV output you can capture historical data as well.

# bwm-ng -o csv -t 2500 -c 1 -C,
1186367009,em2,198.09,50.12,248.21,126,498,0.40,0.80,1.19,2,1,0.00,0.00,0,0
1186367009,lo0,0.00,0.00,0.00,0,0,0.00,0.00,0.00,0,0,0.00,0.00,0,0
1186367009,total,198.09,50.12,248.21,126,498,0.40,0.80,1.19,2,1,0.00,0.00,0,0

So to make use of this, we'll need some sort of Time/Date API to convert the etime into something useful as well as the CSV parser.

#!/usr/bin/env ruby
require 'csv'
require 'pp'
require 'date'

bytes={}
packets={}
errors={}
cmd = 'bwm-ng -o csv -t 2500 -c 1 -C,'
p = IO.popen(cmd) do |f|
   f.each_line do |g|
       h = CSV::parse(g).flatten
       $dtg = Time.at(h[0].to_i).to_s
       interface = h[1]
       bytes[interface] =  h[2..4]
       packets[interface] =  h[7..9]
       errors[interface] = h[14..15]
   end
end

puts "Date: #{$dtg}"
bytes.keys.sort.each do |i|
   puts "\nInterface: #{i} (TX/RX/Total)"
   print "Bytes:"
   pp bytes[i]
   print "Packets:"
   pp packets[i]
   print "Errors:"
   pp errors[i]
end

And the output looks like

# ./rbbw.rb
Date: Mon Aug 06 03:35:17 +0000 2007

Interface: em2 (TX/RX/Total)
Bytes:["128.88", "76.37", "205.25"]
Packets:["0.80", "1.19", "1.99"]
Errors:["0", "0"]

Interface: lo0 (TX/RX/Total)
Bytes:["133.65", "133.65", "267.30"]
Packets:["1.59", "1.59", "3.18"]
Errors:["0", "0"]

Interface: total (TX/RX/Total)
Bytes:["262.53", "210.02", "472.55"]
Packets:["2.39", "2.78", "5.17"]
Errors:["0", "0"]

Where these are obviously rate values (per second) for a very boring FreeBSD VM.

KGSR Online: Required Listening for Austin Refugees

Of course there is nothing like KGSR in Chicagoland. Hell, there is probably nothing that plays the eclectic mix of Texas and Foreign music anywhere else. One more reason to work from home more often.

Sunbrid Recant (or searching for a browser-based iCal Replacement)

So once again I'll recant on on a previous blog.

Sunbird is crap. Events mysteriously get created and can't be deleted. Or get deleted, period. Or something weird happens with the interface. It never crashed, though. But it was annoying enough to stick with iCal.

So what I really want is a entirely browser-based iCal/Google Calendar-like tool (that means Javascript, and I'm not a Javascript programmer) tool that allows me to:

Drag (and eventually drop) activity across a daily schedule for stuff I work on.

Remember/autosuggest project names

Export events to some standard format, iCal or XML, YAML, or whatever

Summarize project activity by week/month/totoal

Yeah this probably could be done in Rails/Django but I don't want that. No databases. No webservers, but still browser based. Am I crazy? Creating a Dojo Calendar has promise, but it requires server side code. What I want is something self contained like TiddlyWiki. Where the data is all stored in the .js and can be moved around and modified.

Since I'm obviously in over my head (what else is new) this is obviously something I wouldn't want to start from scratch, but what next? Should I look at GWT or better yet pyjamas to avoid Java development? Obviously this would be (relatively) trivial to do as a traditional desktop GUI app but that is no fun.
The key is needs to be portable, lightweight, usable off line. Somebody else had to have run across this sort of problem (and solved it) before. We'll see what happens.

Sunbird as an iCal Replacement

Although orage is more useful than it appears at first, I discovered Mozilla Sunbird today when looking for a decent standalone calendaring program for Linux.

Now my primary use for calendaring is tracking my hours on projects, and iCal ended up to be the easiest way to do this on the Mac although I did try out some time tracking software. Now folks can pry my 12" Powerbook out of my cold dead hands, but I'm trying to ensure I'm using cross platform tools in case my Powerbook dies, I have to send it in for service, etc.

BTW, Sunbird easily handled 18 months of timesheets I exported from iCal so it looks like a keeper.

Using i4965AGN (iwlwifi + not ndiswrapper) and wpa_supplicant

For some reason I've always had a mental block about wpa_supplicant. I thought it was hard to setup.Well for WPA Personal it is not.

So after getting discouraged about not seeing anyone getting wpa_supplicant working with the iwlifi/mac80211 drivers, I was suprised to actually get WPA working with my Linksys AP (one of the crappy new VXWorks based ones I think). See my previous blog for the list of components necessary.

Using a simple config file (/etc/wpasupplicant.conf)

network={
ssid="kartoffel"
psk="m00nfac3"
}

The stock Debian 4.0 network-manager packages and wpasupplicant 5.5 ( which is a dependency of network-manager) were required. So starting from scratch:

franz-t61:~/iwlwifi# ./unload
Unloaded: iwl4965 iwl3945 mac80211 cfg80211
franz-t61:~/iwlwifi# ./load
No modules unloaded.
Loaded: iwl3945 iwl4965
franz-t61:~/iwlwifi# startwpa
ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 4 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 5 value 0x1 - franz-t61:~/iwlwifi# cat /usr/local/bin/startwpa
wpa_supplicant -B -c /etc/wpasupplicant.conf -i wlan0 -D wext
franz-t61:~/iwlwifi# iwconfig wlan0
wlan0     IEEE 802.11g  ESSID:"kartoffel"  Nickname:""
         Mode:Managed  Frequency:2.457 GHz  Access Point: 00:18:F8:52:B5:E1
         Bit Rate=54 Mb/s   Tx-Power=27 dBm
         Retry min limit:7   RTS thr:off   Fragment thr=2346 B
         Encryption key: wo-ul-dn-ty-li-ke-to-kn-ow
         Power Management:off
         Link Quality=65/100  Signal level=-68 dBm  Noise level=-127 dBm
         Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
         Tx excessive retries:0  Invalid misc:0   Missed beacon:0

franz-t61:~/iwlwifi# dhclient wlan0
There is already a pid file /var/run/dhclient.pid with pid 5114
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

wmaster0: unknown hardware address type 801
wmaster0: unknown hardware address type 801
Listening on LPF/wlan0/00:13:e8:08:8d:f5
Sending on   LPF/wlan0/00:13:e8:08:8d:f5
Sending on   Socket/fallback
DHCPREQUEST on wlan0 to 255.255.255.255 port 67
DHCPREQUEST on wlan0 to 255.255.255.255 port 67
DHCPACK from 192.168.170.1
bound to 192.168.170.100 -- renewal in 35748 seconds.

And of course there are NetworkManager and wpa_supplicant daemons. I think I've actually got 5-6 wpa_supplicants running, hehe.

i4965 Finally Working (Albeit Insecurely)

Well I can finally toss my PCMCIA Aironet 352, and a good thing since the button was starting to stick. Even the thick single button design on the T-61 seems a bit flawed.

Components that worked for me

• Linux 2.6.21.5
  
• Linux wireless tools v 29 (compiled from source, obviously you need to wipe the one in your distro)
• iwlwifi-4965-ucode-4.44.15.tgz
• iwlwifi-0.0.38.tgz
• mac80211-9.0.2.tgz

Here is an excerpt of my kernel config. The key breakthrough (I think) was that I read somewhere (probably on ThinkWiki) not to enable the wireless netlinks (CONFIG_NL80211 below) Otherwise the README's are pretty much on target. You do have to up the wlan0 interface before trying to assign the essid.

CONFIG_CFG80211=m
# CONFIG_NL80211 is not set
CONFIG_WIRELESS_EXT=y
CONFIG_MAC80211=m
# CONFIG_MAC80211_DEBUGFS is not set
CONFIG_MAC80211_DEBUG=y
CONFIG_MAC80211_VERBOSE_DEBUG=y
CONFIG_MAC80211_LOWTX_FRAME_DUMP=y
CONFIG_TKIP_DEBUG=y
CONFIG_MAC80211_DEBUG_COUNTERS=y
CONFIG_HOSTAPD_WPA_TESTING=y
CONFIG_MAC80211_IBSS_DEBUG=y
CONFIG_MAC80211_VERBOSE_PS_DEBUG=y
CONFIG_IEEE80211=m
# CONFIG_IEEE80211_DEBUG is not set
CONFIG_IEEE80211_CRYPT_WEP=m
CONFIG_IEEE80211_CRYPT_CCMP=m
CONFIG_IEEE80211_CRYPT_TKIP=m
CONFIG_IEEE80211_SOFTMAC=m
# CONFIG_IEEE80211_SOFTMAC_DEBUG is not set

Kernel modules and stuff

franz-t61:/var/log# lsmod
Module                  Size  Used by
iwl4965               181796  0
iwl3945               159460  0
mac80211              161548  2 iwl4965,iwl3945
cfg80211                8264  1 mac80211
ecb                     3840  2
arc4                    2432  2
ipv6                  236640  22
button                  8400  0
dm_snapshot            16868  0
dm_mirror              20756  0
sbp2                   21700  0
eth1394                18884  0
tsdev                   8000  0
pcmcia                 35220  0
firmware_class          9920  3 iwl4965,iwl3945,pcmcia
i2c_i801                8912  0
ohci1394               32944  0
i2c_core               21056  1 i2c_i801
ieee1394               90040  3 sbp2,eth1394,ohci1394
yenta_socket           25292  1
rsrc_nonstatic         11008  1 yenta_socket
pcmcia_core            37524  3 pcmcia,yenta_socket,rsrc_nonstatic
psmouse                35528  0
serio_raw               7044  0
pcspkr                  3584  0
intel_agp              23452  1
agpgart                32712  1 intel_agp
evdev                   9664  3


franz-t61:~# iwconfig -v
iwconfig  Wireless-Tools version 29
      Compatible with Wireless Extension v11 to v22.

Kernel    Currently compiled with Wireless Extension v22.

wlan0     Recommend Wireless Extension v21 or later,
      Currently compiled with Wireless Extension v22.


# ifconfig wlan0
wlan0     Link encap:Ethernet  HWaddr 00:13:E8:08:8D:F5
      inet addr:192.168.2.137  Bcast:192.168.2.255  Mask:255.255.255.0
      inet6 addr: fe80::213:e8ff:fe08:8df5/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:1635 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1269 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:1234676 (1.1 MiB)  TX bytes:300070 (293.0 KiB)

franz-t61:~# iwconfig
eth1      no wireless extensions.

lo        no wireless extensions.

eth0      no wireless extensions.

wmaster0  no wireless extensions.

wlan0     IEEE 802.11g  ESSID:"tsunami"  Nickname:""
      Mode:Managed  Frequency:2.437 GHz  Access Point: 00:90:4B:38:E6:5C
      Bit Rate=54 Mb/s   Tx-Power=27 dBm
      Retry min limit:7   RTS thr:off   Fragment thr=2346 B
      Encryption key:off
      Power Management:off
      Link Quality=81/100  Signal level=-53 dBm  Noise level=-127 dBm
      Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
      Tx excessive retries:0  Invalid misc:0   Missed beacon:0

And dmesg from ./loading and ./uloading the interface.

[ 1296.724000] iwl4965: ipw going down
[ 1298.780000] wmaster0: Removed STA 00:90:4b:38:e6:5c
[ 1298.848000] ACPI: PCI interrupt for device 0000:03:00.0 disabled
[ 1326.836000] iwl3945: Intel(R) PRO/Wireless 3945ABG/BG Network Connection driver for Linux, 0.0.38d
[ 1326.836000] iwl3945: Copyright(c) 2003-2007 Intel Corporation
[ 1326.836000] iwl4965: Intel(R) Wireless WiFi Link 4965AGN driver for Linux, 0.0.38d
[ 1326.836000] iwl4965: Copyright(c) 2003-2007 Intel Corporation
[ 1326.840000] ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 17 (level, low) -> IRQ 22
[ 1326.840000] PCI: Setting latency timer of device 0000:03:00.0 to 64
[ 1326.840000] iwl4965: Detected Intel Wireless WiFi Link 4965AGN
[ 1327.076000] iwl4965: Channel 12 [2.4GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 13 [2.4GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 14 [2.4GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 183 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 184 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 185 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 187 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 188 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 189 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 192 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 196 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 7 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 8 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 11 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 12 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 16 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 34 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 38 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 42 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 46 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 100 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 104 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 108 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 112 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 116 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 120 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 124 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 128 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 132 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 136 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 140 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 145 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Tunable channels: 11 802.11bg, 13 802.11a channels
[ 1327.076000] wmaster0: Selected rate control algorithm 'iwl-4965-rs'
[ 1327.076000] iwl4965: Unhandled INTA bits 0x04000000
[ 1327.076000] iwl4965: Disabled INTA bits 0x04000000 were pending
[ 1327.076000] iwl4965:    with FH_INT = 0x00010000
[ 1327.080000] iwl4965: REPLY_CT_KILL_CONFIG_CMD succeeded
[ 1348.472000] HW CONFIG: channel=1 freq=2412 phymode=3
[ 1348.480000] ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 1365.048000] HW CONFIG: channel=1 freq=2412 phymode=3
[ 1365.052000] HW CONFIG: channel=6 freq=2437 phymode=3
[ 1365.060000] iwl4965: REPLY_ADD_STA failed
[ 1365.060000] wlan0: Initial auth_alg=0
[ 1365.060000] wlan0: authenticate with AP 00:90:4b:38:e6:5c
[ 1365.060000] wmaster0: TX to low-level driver (len=30) FC=0x00b0 DUR=0x013a A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=00:90:4b:38:e6:5c
[ 1365.060000] wlan0: RX authentication from 00:90:4b:38:e6:5c (alg=0 transaction=2 status=0)
[ 1365.060000] wlan0: authenticated
[ 1365.060000] wlan0: associate with AP 00:90:4b:38:e6:5c
[ 1365.060000] wmaster0: TX to low-level driver (len=53) FC=0x0000 DUR=0x013a A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=00:90:4b:38:e6:5c
[ 1365.064000] wlan0: RX AssocResp from 00:90:4b:38:e6:5c (capab=0x401 status=0 aid=1)[ 1365.064000] wlan0: associated
[ 1365.064000] wmaster0: Added STA 00:90:4b:38:e6:5c
[ 1365.064000] wmaster0: TX to low-level driver (len=42) FC=0x0040 DUR=0x013a A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=00:90:4b:38:e6:5c
[ 1365.064000] ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 1365.072000] wmaster0: TX to low-level driver (len=108) FC=0x0108 DUR=0x002c A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=33:33:00:00:00:16
[ 1365.600000] wmaster0: TX to low-level driver (len=96) FC=0x0108 DUR=0x002c A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=33:33:ff:08:8d:f5
[ 1366.600000] wmaster0: TX to low-level driver (len=88) FC=0x0108 DUR=0x002c A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=33:33:00:00:00:02
[ 1370.600000] wmaster0: TX to low-level driver (len=88) FC=0x0108 DUR=0x002c A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=33:33:00:00:00:02

FastCompany: Bosses and Real Bosses

Leadership: The Boss and the Real Boss got me thinking about some of the more (or less ) dysfunctional teams I have have been part of in the past and the formal or informal leadership roles that are often at play and impact team effectiveness.

What is interesting about my family is that we have all been given the same "bossy" gene. It skipped no one and each one of us is just as confident about his or her "rightness" as the next one. This year, nine of us traveled, and as usual, we stopped in Niagara on the Lake for the first night. My 10-year old son and his 17 and 14-year-old cousins, already fed up with the grown-up's bickering over the best route to the cottage, went into town, "to walk down the street of the last civilization they will see for a week." They are very dramatic! When they returned, they brought us a gift. It was two hats - one said THE BOSS and the other said THE REAL BOSS. They explained that every night at dinner we would designate a Boss and a Real Boss for the next day. The Boss would make the plan and if any disagreement or dissent erupted, then the Real Boss would step in to have the final word. Interesting.

Fortunately, I've forgotten most of painful details of bad experiences to blog about them, except to say that overhead groups that have no revenue requirements or operational responsibilities can be really fun (for a while) -- but can implode quickly and become sheer hell to work work in when these leadership get out of whack.

Early Returns: Franz: 1 VMWare+CARP+FreeBSD: 0

So running FreeBSD 6.2 CARP on VMWare Server is the subject of some confusion and struggling for me today. This closed CARP bug turned out to be a red herring and this VMTN thread made it seem that it was only possible to use CARP on ESX (if you enable promiscous mode on the virtual switch) and/or possibly with VMWare workstation with teaming. But I don't have admin privs on the ESX cluster. And I want to be able to do development and testing on my laptop and our VMWware Server.

On the drive home I remembered similar battle battle I faced a year ago working with the SCADA Honeynet where broadcast traffic (ARP Requests) were being forwarded to a virtual interface but the unicast was failing. Today pings to the CARP interface were failing even though I had an ARP entry on the host I was pinging from and of course the ICMP Echos were going out--but not making it to the virtual interface.

So it looks like once again loosening permissions on /dev/vmnet[0-9] is the solution to the problem.

i4965: Two Steps Forward, One Step Back

iwl4965:    with FH_INT = 0x00010000
iwl4965: REPLY_CT_KILL_CONFIG_CMD succeeded
iwl4965: REPLY_ADD_STA failed
iwl4965: no version for "release_firmware" found:  kernel tainted.
iwl4965: Intel(R) Wireless WiFi Link 4965AGN driv er for Linux, 0.0.35d
iwl4965: Copyright(c) 2003-2007 Intel Corporation
iwl4965: Detected Intel Wireless WiFi Link 4965AG N
iwl4965: Radio disabled by HW RF Kill switch

So with 2.6.21.5 + iwlwifi-0.0.35 and mac80211-9.0.0 and Linux Wireless Tools v 29 (you'll need the firmware from the Intel site as well) I was able to get to able to get the hardware detected, see a few access points, associate a couple of times, and oh yeah get kernel stack traces every time I tried to get a lease. I was surprised to see the kernel honored the "kill switch" on the front of the laptop.

Oh well, I'll try again next weekend. It's back to a wide open Aironet card when running Linux (God knows why WEP isn't working with the Aironet 352 and the Truemobile running OpenWRT). If you are in the neighborhood, you can have free wifi if you spoof the 3 MACs I have in the filter list (until I get WPA working I'll adopt the bonehead OpenBSD view (I need to find a better link, but that will do) that Wireless security protocols encourage a false sense of security) but I'm sure its much easier to hop on my neighbor's Linksys. Assuming they didn't close it down. But I've got fprobe running the OpenWRT box (as simple as ipkg install fprobe, very cool!) so I'm watching you :)

#  --- ---- ---- Report Information --- --- ---
#
# Fields:    Total
# Symbols:   Disabled
# Sorting:   Descending Field 1
# Name:      UDP/TCP destination port
#
# Args:      flow-stat -f 5 -S1
#
#
# port      flows                 octets                packets
#
80          223                   1012583               4549            
123         182                   21280                 280             
3000        132                   56380                 271             
443         20                    77666                 331             
2050        16                    42523                 239             
53          16                    15287                 239             
60321       7                     20647                 69              
22          7                     24766                 307             

Minor Rant on Fuzzing

Bejtlich's Pre Review triggered some painful memories. Back when I was a teacher, I ran across two types of really bad papers: those that were so bad they were funny and those are those that are so bad they made you angry, really angry -- because they were wasting your time.

Last year, I had the misfortune of serving as a technical reviewer for the new Addison Wesley Fuzzing book. The manuscripts I read clearly fell into the into the second category. It just wasn't worth the $750 (or whatever it was they were going to pay me) to provide feedback and fill out the little forms, so I eventually quit responding to emails from the editors and a deleted all the copies of manuscripts I had in my possession. Now, to be honest, it wasn't just that the manuscripts were a lost cause that I gave up the endeavor. I did have a lot on my plate: trying to get my house on the market in Austin, finish up some projects for my last job, and figure out where the hell I was going to live in Chicago--and move two kids and two dogs cross country, without losing any of them in Oklahoma. Which almost happened.

But if I thought the book had any hope of being useful I probably would have found the time. Unfortunately, from the table of contents, it doesn't look like they fixed the book's structural flaws. Not only the did conceptual sequence not make much sense to me, the audience and purpose were always a mystery. But maye that was maybe because I didn't ever see the first section. I was never sure if it existed? Was it be written last? There was no clear driving purpose linking the content. Was the book targetting professional application security teams (Software Security is an example of one of these, a very useful book) or just a quick way for 3rd rate independent researchers to find a bug or two. It appeared to be the latter, which to me was a pointless exercise. Why invest time in writing (let along reading) a book on the topic of vulnerability testing that does not go beyond what you could find by downloading tools from Packet Storm.

Lastly, I wonder if they cleaned up annoying colloquial writing style that sounded like a transcript of a bad Black Hat talk (except what I assume were Pedram's Amini's chapters, the were fairly well written and had some original content as well) but I guess I'll never know. I'd love to hear these problems were fixed, but I'm certainly not going to spend good money on finding out myself.

rtnetlink kernel link errors with Intel 4965 Drivers

In my last blog I mentioned some instructions I'd run across for building the Open Source Intel drivers for the i4965 that ships with Lenovo T-61s. I more or less followed the instructions but am still getting the follwing error:

net/wireless/wext.c: In function ‘rtnetlink_fill_iwinfo’:
net/wireless/wext.c:1136: warning: initialization discards qualifiers from pointer target type
  CC      net/wireless/core.o
  CC      net/wireless/sysfs.o
  LD      net/wireless/cfg80211.o
  LD      net/wireless/built-in.o
  LD      net/built-in.o
  GEN     .version
  CHK     include/linux/compile.h
  UPD     include/linux/compile.h
  CC      init/version.o
  LD      init/built-in.o
  LD      .tmp_vmlinux1
net/built-in.o: In function `rtnl_getlink':
rtnetlink.c:(.text+0x10c69): undefined reference to `wireless_rtnetlink_get'
net/built-in.o: In function `rtnl_setlink':
rtnetlink.c:(.text+0x11372): undefined reference to `wireless_rtnetlink_set'
make: *** [.tmp_vmlinux1] Error 1

Linux i4965 Wireless Preview on T-61

Last few days I confess I've mostly been using XP on my T-61 (hell I've mostly been working on a blasted Compaq DL-145 and FreeBSD through the lights out management software, which oddly enough Opera seems to work best with since it uses Java Applet for some VNC-ish looking thing for the remote KVM) but I ran across a Fedoraforum thread on getting the 4965 drivers working. It appears you will need iwlwifi and mac80211 and some microcode but it looks like it is now possible. Maybe I'll give it a shot.

SCADA, SIGINT, IW, and the PRC

It might be vain, but I look at my webserver logs occasionally. You never know who stumbles across your site with an interesting set of google search words. Like when 58.31.65.233 searches for pages with SCADA and SIGINT in them. Which reminds me of the amusing dailydave thread on IW (the one on responsibility and power). Of course any conversation that starts with the question about who has the best hackers is bound to go nowhere, fast. It doesn't matter whether the context is the information warfare capabilities of nation states, the real or perceived regional concentration of security expertise within a large networking, security consulting companies trying to win assessments, or DoE (or Batelle, it is a business, despite the national security angle) labs hyping their "cyber" credentials to secure mo money, mo money, and get those earmarks while they still can. It's all the same. It all ends badly with someone talking out of their ass.