All SSL Sites are fake-able with new real world MD5 collision attack [Update]

December 30, 2008

You really should look at this video of a presentation (in English) which was just given at the 25C3 in Berlin. Alexander Sotirov, Marc Stevens and Jacob Appelbaum have generated an intermediate certificate which is “signed” by RapidSSL which is shipped with all browsers. As there is no limit which certificates can be signed by which CA, it is possible to fake any SSL site!!

The good news is that they don’t indent to release the private key.

Basically they took the 2007 shown theoretical MD5 collision attack and improved it and the major part: They took it onto a real world CA. They used the RapidSSL CA as they still use MD5 and have a nice automatic and predictable generation process. It takes always 6 seconds to generate one and they increment the serial number of the certificates by one every time. As for the collision attack it is important to previously know the timestamp and the serial number. Both was not that hard at RapidSSL, specially if you did some requests at Sunday night. Here is the link to a document from the guys describing it more in detail.

Ok, this time it maybe the good guys but who can prove to me that nobody else did this, as it cost them under 700 Euros. And removing all MD5 signing CAs is also not a solution at this point of time as up to 30% of the websites are signed by such CA’s. And for server admins it is also almost impossible to find CAs which report which hash functions they use. And there is still the revoke list problem, I’ve written previously (and also here).

Tips for running Kubuntu 8.10 (Intrepid) on an EeePC 901go [Update 2]

December 26, 2008

As I’ve written before I got an Asus EeePC 901go for Christmas and of course I’ve installed Kubuntu (8.10 / Intrepid) on it. In this post I’m going to share the tricks I used to get it running well.

• I’ve attached a USB CD drive and installed Kubuntu from the alternative CD. The kernel on this CD is not able to get any networking to work, but this is no problem. The installed kernel will get the LAN running.
• Set noatime, nodiratime for your partitions. Take also a look at this post.
• When the installation is finished you should update your system, as this didn’t work with the install kernel.
• To get all devices running you need a special kernel for your EeePC. I recommend the usage of this kernel, take a look at the installation howto. I’m using the lean kernel.
• Now you should install eeepc-config (apt-get install eeepc-config), which will allow you do en-/disable the webcam, wifi, … . Just try it out.  Press the two most right buttons above the keyboard. The Fn-Keys work now also. Cool!
• You’ll also notice that sometimes on high I/O activity the whole system will hang for seconds. This is because of the I/O scheduler, as the default one is optimized for hard disks and not for flash. This wiki page describes how you can change this. I’ve set it in /boot/grub/menu.lst and added the echo line to /etc/init.d/bootmisc.sh (add the beginning of the do_start function)
• As it seems the ath5k driver for the WLAN is more or less useless. It has a real poor performance but the biggest problem is that it has a package loss between 5-10% on my WiFi. To solve this it is best to go back to the old madwifi driver. Here is the mini howto:Go do http://snapshots.madwifi-project.org/madwifi-hal-0.10.5.6/ and download the newest version there. In my case I did following:wget http://snapshots.madwifi-project.org/madwifi-hal-0.10.5.6/madwifi-hal-0.10.5.6-r3879-20081204.tar.gzNow extract it:
$ tar xzf madwifi-hal-0.10.5.6-r3879-20081204.tar.gz
$ cd madwifi-hal-0.10.5.6-r3879-20081204/

  Now we need some packages installed:
  sudo apt-get install build-essential
sudo apt-get install linux-headers-eeepc-lean

  And now the actual compiling and installation

  sudo ./madwifi-unload
sudo ./find-madwifi-modules.sh $(uname -r)
cd ..
sudo make
sudo make install


  At last we need to add blacklist ath5k to /etc/modprobe.d/blacklist-eeepc and append ath_pci to /etc/modules. After a reboot you should have a working WLAN.

• The UMTS card ( a Huawei E620 USB Modem) works without any problems. Take a look here for get it to work on the command line. I was not able to get it to work with the KNetworkManager. PS (For my Austrian Reader): Here is a link to a site in German with the Init Strings and User/Password combinations needed for the various Austrian providers.
• The eepc has a multi touch track-pad, you can scroll by using 2 fingers and have a middle click when you click with 3 fingers. (Thx to Meredrica for this info! )

Following items are not resolved to my satisfaction – I need to look further into these topics

• (K)Ubuntu Intrepid seems to have a poor graphics performance and rendering errors on Intel 945 systems, which is build in the 901go. The rendering errors happens most often at the start of non KDE apps like Firefox. Here is a link to the Bug Report. I’ll post here if I find a fix or workaround.
• Get the UMTS dialing working with the KNetworkManager.

I’ll add additional tips as soon as I need and find them. Please also post tips and tricks you know for the Asus EeePC 901go. Thx.

PS: I’m running KDE 4.2 Beta2 on my 901go and I really can recommend it! Get it from there.

Home partition encryption with LUKS under Linux

December 25, 2008

I’m often asked how I crypt my notebooks. I normally crypt only my home partition and sometimes (more on servers in remote locations, than on notebooks) the swap partition. I use for this Linux Unified Key Setup (Luks), as it allows up to 8 passwords for a partition and you can change them without reformatting the partition. It also stores the used encryption method so you can use it also for encrypting external hard disks and you don’t need to keep track which encryption algorithms you used for it.

First you install your notebook with a swap and a root partition, but leave space for a /home partition. After the installation is finished you create the partition e.g. with cfdisk or fdisk. You need to restart your system after creating a new partition. In my example I call it /dev/sda3. Now you can tell cryptsetp (which you need to install on Ubuntu with apt-get install cryptsetup, reboot after installing it if the setup does not work) to create a container with following command

cryptsetup --cipher aes-cbc-essiv:sha256 --key-size 128 luksFormat /dev/sda3

After you did this, you need to open the container with

cryptsetup luksOpen /dev/sda3 home

Now you can format the container:

mkfs.ext3 -m 0 /dev/mapper/home

ps: -m 0 means that no blocks are reserved for root, as it is our home partition.

Now you need to go to the console of your system (ALT-CTRL-F1) and login there and stop the X server (log off before that 😉 ). On Ubuntu you do this by calling /etc/init.d/gdm stop on Kubuntu /etc/init.d/kdm stop.

Now you can mount the new partition on a temporary location and copy your home directory over.

mount /dev/mapper/home /mnt/
cp -a /home/* /mnt/.


Now we need to unmount it and close the crypto container.

umount /mnt/
cryptsetup luksClose home


Now we need to configure the system that it is launched at the boot time. Add following line to /etc/crypttab:

home /dev/sda3 none luks

and in your /etc/fstab you add following:

/dev/mapper/home /home ext3 noatime,nodiratime 0 0

Now everything is done. Reboot your system and you will be prompted for the password of your home partition. If you don’t enter it your system will use the “old” home directory.

BasKet: A KDE application for implementing the “Getting Things Done” method

December 24, 2008

Are you also using a Post-It application (like KNotes) on your computer to store your ideas and todos? At least I do, but I found a better application. Welcome to BasKet Node Pads. It takes your notes, but it also lets share them with others. You can integrate it into Kontact and store not only text but also images, links, email addresses, files and you can even pick a from screen. After you stored you ideas, todos, ….. you surely want to access them easily. BasKet supports this by a full text search or it also allows you to set tags and intelligent todo list management.

Maybe your ideas are secret, if so you should use the buildin encryption of BasKet. And best of all, it is OpenSource and you can download it for KDE or it is already shipped with your distribution of choice.

Ah, before I forget it. One of the various ways you can use BasKet is to implement the “Getting Things Done” method to get more organized. Get more information by reading Wikipedia article or this wikisummaries book summary.

ps: Merry Christmas and a happy New Year!

Clicky Web Analytics the alternative to Google Analytics

December 14, 2008

I’m using Google Analytics for some time now, it basically works, but it has some short comings like that the reports do only get updated every 24h, or that it is not able to track bound links without extra work on my side. But the most import part is that I don’t want that google knows everything. So I started to look for a valid alternative. I tried some local installable open source tools but decided to go with an other SaaS. If you’re using NoScript for your Firefox you might know it already I started using Click Web Analytics. Take a look at this screenshot, it looks like most web 2.0 sites, simple, clean design with a white background.

Whats nice is that you can do a real time campaign and goal tracking and that you can track every visitor who comes to your web site and if they accept cookies all their history. This will show you which power cookies gives website providers. You should really think to disable them or remove them on every start of your browser. But as long the most users have activated it I will also take a look at it and have a nice show case for people I talk over this.

No SWAP Partition, Journaling Filesystems, … on a SSD?

December 7, 2008

I’m going to get an Asus Eee PC 901go, which has a Solid State Disk (SSD) instead of a normal hard disk (HD). As you know me I’ll remove the installed Linux and install my own Kubuntu. I soon started to look at the best way to install my Kubuntu and I found following recommendations copy and pasted on various sites:

1. Never choose to use a journaling file system on the SSD partitions
2. Never use a swap partition on the SSD
3. Edit your new installation fstab to mount the SSD partitions “noatime”
4. Never log messages or error log to the SSD

Are they really true or just copy and pasted without knowledge. But first why should that be a problem at all? SSDs have limited write (erase) cycles. Depending on the type of flash-memory cells they will fail after only 10,000 (MLC) or up to 100,000 write cycles for SLC, while high endurance cells may have an endurance of 1–5 million write cycles. Special file systems (e.g. jffs, jffs2, logfs for Linux) or firmware designs can mitigate this problem by spreading writes over the entire device (so-called wear leveling), rather than rewriting files in place. So theoretically there is a problem but what means this in practice?

The experts at storagesearch.com have written an article SSD Myths and Legends – “write endurance” which takes a closer look at this topic. They provide following simple calculation:

• One SSD, 2 million cycles, 80MB/sec write speed (that are the fastest SSDs on the market), 64GB (entry level for enterprise SSDs – if you get more the life time increases)
• They assume perfect wear leveling which means they need to fill the disk 2 million times to get to the write endurance limit.
• 2 million (write endurance) x 64G (capacity) divided by 80M bytes / sec gives the endurance limited life in seconds.
• That’s a meaningless number – which needs to be divided by seconds in an hour, hours in a day etc etc to give…

The end result is 51 years!

Ok thats for servers, but what is with my Asus 901go?

• Lets take the benchmark values from eeepc.it which makes it to a max of 50 MByte/sec. But this is a sequential write, which is not the write profile of our atime, swap, journaling… stuff. That are typically 4k Blocks which leads to 2 MByte/sec. (Side node: The EeePC 901go mount the same disk of SSD ‘EeePC S101, to be precise model ASUS SATA JM-chip Samsung S41.)
• We stay also with the 2 million cycles and assume a 16GB SSD
• With 50 MByte/sec we get 20 years!
• With 2 MByte/sec we get 519 years!
• And even if we reduce the write cycles to 100.000 and write with 2 MByte/sec all the time we’re at 26 years!!
  

And all this is with writing all the time, even ext3 does write the journal only every 30 secs if no data needs to be written. So the recommendation to safeguard SSDs, as the can not write that often is bullshit!!

So lets take a closer look at the 4 points at the beginning of this blog post.

1. Never choose to use a journaling file system on the SSD partitions: Bullshit, you’re just risking data security. Stay with ext3.
2. Never use a swap partition on the SSD: If you’ve enough space on your SSD use a SWAP partition it will not be written onto it until there is to less RAM, in which case you can run a program/perform a task which otherwise you could not. And take a look at this article.
3. Edit your new installation fstab to mount the SSD partitions “noatime”: That is a good idea if all the programs work with this setting as this will speedup your read performace, specially with many small files. Take also a look at nodiratime.
4. Never log messages or error log to the SSD. Come on, how many log entries do you get on a netbook? That is not an email server with > 1000 log lines per second.

Please write a comment if you disagree or even agree with my blog post. Thx!