Damn it! Patch your DNS Server!

July 26, 2008

In the last days an exploit has been released, but still many big companies have not patched their recursive DNS server. According to the Austrian CERT which released a report two third of the recursive DNS are still not patched. These are not small companies or system, according to The Register the big US ISPs like AT&T, BT and Time Warner as Bell Canada are not patched. There are even some hints that attacks are already carried out.

So Damn it! Patch your DNS servers, you’re risking the security of your customers!

Even Microsoft released following security warning Increased Threat for DNS Spoofing Vulnerability which tells you to install the patch MS08-037 at once. But what do you think can be even worse?

Apple

They have still not provided a patch for OS-X-Server, that just shows that apple can’t be taken serious in the server world.

And I wondered why Ubuntu did no upgrade of MaraDNS

July 22, 2008

In the last weeks all major DNS vendors and distributions did upgrade their DNS servers, but I was not getting an update for the DNS server which I use: MaraDNS

So I did take a look around and found following blog posting by the MaraDNS guys: MaraDNS is immune to the new cache poisoning attack. Which basically explains that because of DJB (whose DNS server I used before it was removed from Ubuntu Hardy) they use query ID and source port randomization since the first public release. Good that I always search for a secure implantation of a service I need. Why are so many people still using bind that much. It can’t be that every setup needs features which only bind provides. It must be laziness or they don’t care about security.

Lynis – an auditing tool for Linux/Unix

July 19, 2008

The first step to higher security of your system is to assess the current state of the system. Lynis is a small command line tool, licensed under GPL 3, which can help you achieving this. From the authors homepage:

Lynis is an auditing tool for Unix (specialists). It scans the system and available software, to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes.

This software aims in assisting automated auditing, software patch management, vulnerability and malware scanning of Unix based systems. It can be run without prior installation, so inclusion on read only storage is no problem (USB stick, cd/dvd).

He also clearly states what Lynis is not:

Not a hardening tool: Lynis does not fix things automatically, it reports only (and makes suggestions).

More to the technicial stuff: The basis of the program are shell scripts which scan the operating system and installed software (e.g. old software) but also stuff like SSL certificates (e.g. expire date). The software checks for accounts without password or wrong file permissions and it takes also a look at your local firewall. It runs under many Linux and Unix versions including Debian and Ubuntu.

“Transparent end-to-end encryption for the Internets” is not the solution

July 13, 2008

Last week the guys behind the popular torrent site The Pirate Bay went public with their project of an opportunistic encryption of all traffic from an computer. The project is called “Transparent end-to-end encryption for the Internets” (IPETEE) but it is not the first time something like this is tried. Due to the pressure by the media industry it has more success chances than the last tries but I think we should target something else.

So what should be our target?

To build an overlay network with allows anonymous, encrypted and censor resident communication for unchanged IP based protocols over the internet. From the user perspective the software creates a virtual network adapter like OpenVPN does and every traffic that goes into that device is send via this overlay network. The overlay network does not send the traffic to the other peer directly (in this case the communication would not be anonymous) but via other peers taking part in that network. The more security you need to more peers it takes, but it will also get slower. This enables the usage of the network by different user groups.

This would be a real solution and not a half one like the idea from The Pirate Bay guys. Ah, before I forget it, following are non-goals.

• This network should not guard against information leak through programs which use this network (e.g. mail client sending real IP address)
• No military security/anonymity is targeted, it should be just enough to have a plausible deniability.
• It is not the goal of this network to provide access through the network to the outside world. What goes into to network should stay there. But this does not mean that any effort is invested to prevent anyone to play proxy. (e.g. http proxy)

What do you think about it?

Kpartx: a tool for mounting partitions within an image file

July 12, 2008

Kpartx can be used to set up device mappings for the partitions of any partitioned block device. It is part of the Linux multipath-tools. With kpartx -l imagefile you get an overview of the partitions in the image file and with kpartx -a imagefile the partitions will accessible via /dev/mapper/loop0pX (X is the number of the partition). You can mount it now with mount /dev/mapper/loop0pX /mnt/ -o loop,ro. After unmounting you can disconnect the mapper devices with kpartx -d imagefile.

There are packages for Debian and Ubuntu.

• Ubuntu: http://packages.ubuntu.com/de/hardy/kpartx
• Debian: http://packages.debian.org/search?keywords=kpartx

EU Member States Data Retention Transposition Measures

I got my hand on this list which is out of a PDF from the European commission, and I though it maybe also interests others. It shows the status of data retentions laws in the EU member states. So here is the list. (The list is sorted by the native names of the nations and not the English ones I used here, e.g. Deutschland vs Germany)

.

Fix for Kopete 0.12.7 to work again with ICQ

July 2, 2008

Yesterday my Kopete stopped working with the ICQ network. The ICQ told me that my client version is too old. Here is the fix to make it work again. Look in the ~/.kde/share/config/kopeterc file and change the values of the variables to following (which are from trunk):

[ICQVersion]
Build=0x17AB
ClientId=0x010A
ClientString=ICQ Client
Country=us
Lang=en
Major=0x0006
Minor=0x0000
Other=0x00007535
Point=0x0000


After a restart of Kopete everthing works again for me.

Zattoo as backup for satellite TV

June 25, 2008

Today is the first semifinal of the EURO 2008 (=soccer – Germany vs Turkey) which is a big deal here in Europe, and today it was a really sunny day. But just 1h before the game starts it started raining strong in my home town together with lightnings. This leaded to a bad reception of my satellite TV. As the internet via ADSL was working without any problems I started searching for a backup solution and I found Zattoo. And I couldn’t believe it. They support Linux, specially (K)Ubuntu! Wow! I downloaded the .deb file for the 3.20 version but it didn’t work I got a

robert@darksun:~$ zattoo_player
(process:9626): GLib-GObject-CRITICAL **: /build/buildd/glib2.0-2.14.1/gobject/gtype.c:2242: initialization assertion failed, use IA__g_type_init() prior to this function
(process:9626): GLib-GObject-CRITICAL **: g_object_new: assertion `G_TYPE_IS_OBJECT (object_type)' failed
(process:9626): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed


I searched a little bit in the internet and found out that the 3.11 should work which I downloaded it from here. And yes it worked without any problems. One important side note: Your IP address needs to be in one of the countries for which the service is available. Ah and as I use Kubuntu and not Ubuntu I installed following packages before installing Zattoo.

apt-get install libgtkglext1 libgnome-keyring0 libgnomeui-0 libcurl3 libxul0d libgdk-pixbuf-dev

Do you know what a Host Protected Area (HPA) is?

June 17, 2008

It is sometimes also called Hidden Protected Area and it is an area of your hard disk which is normally not visible for the operating system and therefore the applications. It was first introduced in the ATA-4 standard and is defined in ATA-5 as optional feature which is supported by most modern hard disks. The normal use case of this is for system recovery and the backup of important configuration data.

So why is this security relevant? For law enforcement agencies and forensic experts it is important to detect HPAs and recovery data from it. For one someone could hide some sensitive data in it or there could be evidence or traces if the owner does not know about the HPA.

But it is also important for any business and home user, e.g. if you want to fully override your hard disk you need to make sure you also override the HPA. If you’re a user of a current Linux kernel you’re lucky – the kernel will deactivate (temporary) the HPA during booting and so can override everything without problems.

Here are some links which will help you do detect / remove the HPA from your hard disk:

• Computer Forensics and the ATA Interface
• Detecting Host Protected Areas (HPA) in Linux
• Removing Host Protected Areas (HPA) in Linux (disk_sreset Tool)
• HDAT2 (config tool for DOS, with many features)

DNS based revoke lists

May 24, 2008

I just thought about the scaling problem of the SSL revoke lists, I wrote in my last blog post.  The first two solutions that came into mind where peer-to-peer or DNS based ones. Peer-to-peer would be not that good for enterprise users so I took a short look at DNS based revoke list. I just entered it into google and got RFC 2538 back as answer. Thats a full solution for storing certificates in the DNS (and yes also a revoke list). Maybe we could use the revoke list part of this RFC for the SSL revoke lists. This solution would scale without problems and with DNSSEC it would get even more secure.

So why is that not implemented? Just one browser vendor and one CA need to go forward and the rest will follow. They could do that instead of the “green” https stuff which is only there to generate more money. What are your thoughts about this?