Zeroday 01100100011010010

ERROR: Your architecture, \’ppc\’, is not supported by the
Adobe Flash Player installer.

I use a professional VPN software on my Powerbook called VPN Tracker from equinux. I bought this software because I wanted a streamlined and pushbutton system for dealing with the ISAKMP VPN at work. Normally this software works quite well but because of the aging hardware in my Powerbook I’m suddenly without any access to my internal network.

Several bits of my laptop are broken and I had to bring my powerbook to the repair center. Before I turned in my laptop I created a mirror of the drive using rsync. OS X lets a user boot from a firewire drive and so with a “loaner” powerbook from work I have a complete, albeit slow, clone of my original laptop. thunderbird, firefox, etc all work the same and are configured exactly as they were. VPN Tracker unfortunately is not. the configuration is still intact however the software doesn’t think it is licensed anymore. I imagine that this is due to some check made on my CPU, drive volume, etc to verify that I’m not installing this on multiple computers or something similar. More interestingly I can’t get to my email server anymore because our work place is very paranoid and requires vpn authentication for access.

I understand the need for software protection in this marketplace but at this time I can say that it has utterly failed me as an end user. Despite supporting the company with a purchase all I can do now is sit and wait for an answer to my email. I only hope they respond to the alternate address I provided them.

I was looking for a novel way to recon a network for webservers and came up with a command line combination involving wget and find. The first stage is to use wget and download the index page of any server that responds. The second stage is to remove all the zero length files that will be written for non responsive but active IP addresses.

WGET STAGE
If you are assigned to scout a network range from 192.168.1.1 - 192.168.1.255 you can use a for loop and wget to quickly download index pages. Obviously this technique could be adapted for larger ranges but in this published form is best for Class C only.

for i in `seq 1 255`
do
wget -O 192.168.1.$i.html 192.168.1.$i &
done

Expanding the parameters of the wget command we see that -O is used to write an ouput file with a specific name. Otherwise we will have filename collisions all over the place and more importantly we will have no idea what the originating server is. The & is used to put the process into the background and acts as a cheap form of parallel tasking. All of the requests will launch at the same time. Since we are limiting ourselves to a class C we won’t worry about overloading the machine.

ZERO LENGTH FILE STAGE
The resulting files will either have html in them or have a zero length. The zero length files will occur when the ip address is alive but there is no web server there to respond. To clean these we use a clever technique for discovering these files using the find command.

for i in `find . -empty -exec ls {} \;`
do
rm $i
done


What is left is html code saved with a fliename of the ip address where it was found.

after hours of struggling with some code that writes to a mysql database I finally discovered that I was using old and buggy drivers. If you are on ubuntu and find yourself staring at this error it would be a good idea to install libdbd-mysql-ruby

sudo apt-get install libdbd-mysql-ruby

The other day I received an email about a new Anonymous vs. Scientology dispute on Youtube. The enterbulation forum reported that Tory Christman, a very vocal critic of Scientology, had her Youtube account suspended. This time it looks as though Mark Bunker (wise beard man) has had many of his videos taken down as Terms of Service violations. Roughly 90 of his videos appear to be down at this time. You can view these takedowns as we discover them at Youtomb
[disclosure: I am an active team member of the Youtomb project]
[update: the enterbulation forum has also confirmed this account suspension on the same thread on page 21]

I’ve created a CSV of the videos affected here.
Because Wordpress won’t let me upload .CSV I have named the file .txt. Rename it to .CSV and use your favorite spreadsheet software to view it.

Given the history of Mark Bunker one has to wonder what Scientology told Youtube in order to have his account shutdown. As one can see from the data collected all the public is told is that there was a Terms of Service violation. we have no idea what those violations might be.

This is the keynote by Dan Geer at the SourceBoston 2008 Security Conference.
disclosure: I am on the board of advisors for this conference.

Streaming Flash Video
MP4 File

Files hosted courtesy of blip.tv

This is a basic level of hardening for Ubuntu servers and should be considered a baseline. This tutorial will cover two topics: SSH and Firewall. This tutorial was prepared using Ubuntu Server 8.04 beta.

SSH
edit the ssh daemon configuration file to move the ssh port away from 22. Most worms or bots are programmed to look at 22 and bruteforce whatever is there. Moving to an unknown port is the easiest way to decrease the level of log activity.


zeroday> sudo vi /etc/ssh/sshd_config

Look for “Port 22″ and change it to a different value. Anything above 1024 is fine.

# What ports, IPs and protocols we listen for
Port 65522

Now restart sshd

zeroday> sudo invoke-rc.d ssh restart