- Roundtable - muug.ca

MitM on IMAPS?
by Trevor Cordes 19 Jan '14

19 Jan '14

I'm just wondering if it is possible for someone to MitM me in the following scenario and intercept plaintext traffic: dovecot imaps server with real thawte "quick" cert | imaps (ssl) | public wifi | android phone using imaps using "ssl" not "ssl (any cert)" option For instance, can a malicious hotspot use some sort of interception technique / spoofing and some sort of wildcard cert to trick my phone into negotiating SSL with it, which then does its own SSL to my dovecot server, thus MitM'ing me without me even knowing? I know in a web browser I'd normally be protected against that by looking at the URL in the address bar, or the green EV-cert graphics (or am I wrong in even that assumption)? How paranoid do I have to be? And is there any way to beat any shortcoming on Android, perhaps with a client cert or a way to tie the account to a single manually-specified server SSL cert?

3 4

Re: [RndTbl] xargs with no command
by Trevor Cordes 18 Jan '14

18 Jan '14

On 2014-01-18 Adam Thompson wrote: > Other way 'round: xargs was the newline inserter, splitting a > WS-separated list into multiple lines. >From memory, it looked to me like xargs was a NL-eater, and only an EOL NL- appender. #cat > z a b c # xargs <z a b c *** note how the input is NL-sep, but the output is space-sep, just I think as in Kevin's RTFM. And the while loop was one line (one xargs call) per iteration. Of course, this is just from memory!

1 0

Re: [RndTbl] xargs with no command
by Adam Thompson 18 Jan '14

18 Jan '14

Other way 'round: xargs was the newline inserter, splitting a WS-separated list into multiple lines. That's still the first time I'd ever seen xargs used like that! -Adam On Jan 18, 2014 12:54 AM, Trevor Cordes <trevor(a)tecnopolis.ca> wrote: > > As per Tuesday's meeting RTFM: > > ibm.com gave me the first hint: > If no command template appears on the command line, xargs uses echo by > default. > > Which then let me find it in Linux's man page: > ... and executes the command (default is /bin/echo) ... > > So they were basically using xargs as a newline-eater to combine all the > lines of the iteration into one. > _______________________________________________ > Roundtable mailing list > Roundtable(a)muug.mb.ca > http://www.muug.mb.ca/mailman/listinfo/roundtable

1 0

Re: [RndTbl] MitM on IMAPS?
by Adam Thompson 18 Jan '14

18 Jan '14

Short answer: not in any practical way. Medium answer: yes, but someone would have to surreptitiously obtain physical control of your phone long enough to install a new root CA. (See Sean's answer) Longer answer: of course it's theoretically possible, but the attacker would have to compromise a CA that you already trust. Sadly, this isn't as outlandish a prospect as it should be, but it's still extremely unlikely. I don't know how often Samsung or Google removes known-compromised CAs from the trust list, if ever, so I can't say how large the potential exposure is. On the other hand, the only way you'd be caught by something like that would be as part of a very large, very sophisticated operation that was doing it to *everyone*. You can issue your own certificate, signed against your own CA, and "just" ensure your own CA is imported into every client you use... I wouldn't bother, but it's an option. -Adam On Jan 18, 2014 3:37 AM, Trevor Cordes <trevor(a)tecnopolis.ca> wrote: > > I'm just wondering if it is possible for someone to MitM me in the > following scenario and intercept plaintext traffic: > > dovecot imaps server with real thawte "quick" cert > | > imaps (ssl) > | > public wifi > | > android phone using imaps using "ssl" not "ssl (any cert)" option > > > For instance, can a malicious hotspot use some sort of interception > technique / spoofing and some sort of wildcard cert to trick my phone into > negotiating SSL with it, which then does its own SSL to my dovecot server, > thus MitM'ing me without me even knowing? I know in a web browser I'd > normally be protected against that by looking at the URL in the address > bar, or the green EV-cert graphics (or am I wrong in even that > assumption)? > > How paranoid do I have to be? And is there any way to beat any > shortcoming on Android, perhaps with a client cert or a way to tie the > account to a single manually-specified server SSL cert? > _______________________________________________ > Roundtable mailing list > Roundtable(a)muug.mb.ca > http://www.muug.mb.ca/mailman/listinfo/roundtable

1 0

xargs with no command
by Trevor Cordes 18 Jan '14

18 Jan '14

As per Tuesday's meeting RTFM: ibm.com gave me the first hint: If no command template appears on the command line, xargs uses echo by default. Which then let me find it in Linux's man page: ... and executes the command (default is /bin/echo) ... So they were basically using xargs as a newline-eater to combine all the lines of the iteration into one.

1 0

wireshark warning
by Trevor Cordes 18 Jan '14

18 Jan '14

Didn't have a chance to bring it up at the meeting, but I feel it's important to add that wireshark is probably the most frequently security-patched FOSS out there. I watch the security feed from Fedora and the package I see sec-updated most often is wireshark, probably followed by PHPMyAdmin. It's quite astonishing how miserably insecure wireshark is. (Hmm, too bad there doesn't seem to be a page or chart ranking FOSS by CVE count, unless someone else can find one.) So, if you use wireshark, do your package updates frequently and/or before each invocation of wireshark. This is a great argument for not using wireshark on Windows, as there is not yum/apt-get for it, AFAIK, meaning you'd be on your own to check for and install updates.

4 4

Fwd: OpenNTPD and NTP reflection attacks
by Adam Thompson 17 Jan '14

17 Jan '14

Along the lines of a question Alan raised at the meeting this week... apparently NTP DDoS attack are a thing now. :-( -Adam -------- Original Message -------- Subject: OpenNTPD and NTP reflection attacks Date: Wed, 15 Jan 2014 13:36:12 -0600 From: Nicolai <nicolai-omisc(a)chocolatine.org> To: misc(a)openbsd.org Hi everyone, I have a question about OpenNTPD now that NTP reflection attacks are in the news. OpenBSD produces and uses its own OpenNTPD, primarily written by Henning and made portable by Darren Tucker. The following website: http://openntpproject.org/ is an important effort to minimize reflection-related holes in NTP software. The given test command is not supported by OpenNTPD, suggesting no major amplification. And after reading the manual pages I don't think there's an alternative for getting OpenNTPD to generate a large amplification, though I could be wrong. So, is it correct to say that OpenNTPD is immune from generating large amplifications? (Recent articles on the subject mention 100x amplification factors!) Nicolai -- -Adam Thompson athompso(a)athompso.net Cell: +1 204 291-7950 Fax: +1 204 489-6515

2 1

Firewall/Router hall of fame?
by John Lange 10 Jan '14

10 Jan '14

Should the Linksys WRT router/firewall go into the hall of fame? Undeniably, a lot of stuff Linksys made was crap but the WRT was not one of them. Even with it's default firmware it was a great firewall for home and small businesses. From the start it handled state tracking, NAT and packet reassembly properly making it one of the only devices around that would handle things like VOIP (credit most likely goes to it's Linux roots). Even today many so-called high-end firewalls (e.g. Sonicwall) still can not handle a fragmented UDP packets breaking SIP over UDP. According to this Wired article, the WRT is now back in a Gigabit version and Linksys is now publicly embracing the alternative firmwares that helped make it so popular. http://www.wired.com/gadgetlab/2014/01/linksys-wrt/ I still run a WRT with the "Tomato" firmware at home and I think this device will always have a place in my personal "hall of fame". Long live the WRT! Regards, John

2 2

Video card?
by Kevin McGregor 08 Jan '14

08 Jan '14

It turns out I was a bit hasty in getting rid of all my video cards. At least, I think I got rid of them. I can't find any anywhere. :-) Does anyone have an old video card they don't need any more? It must be PCI or PCI-Express, and it's destined for a server (FreeNAS/FreeBSD or some such) so 2D/3D performance is not an issue. :-D I'd like to pick it up ASAP so I can continue to build my server. I can get a new card for ~$30, but I'd rather reduce, reuse, recycle. Thanks! Kevin

2 1

Red Hat and CentOS joining forces
by Gilles Detillieux 08 Jan '14

08 Jan '14

Here's an interesting development I didn't see coming. Yesterday Red Hat and CentOS announced they were joining forces on this community-developed platform. http://www.zdnet.com/red-hat-incorporates-free-red-hat-clone-centos-7000024… http://community.redhat.com/centos-faq/ http://www.centos.org/ http://lists.centos.org/pipermail/centos-announce/2014-January/020100.html -- Gilles R. Detillieux E-mail: <grdetil(a)scrc.umanitoba.ca> Spinal Cord Research Centre WWW: http://www.scrc.umanitoba.ca/ Dept. Physiology, U. of Manitoba Winnipeg, MB R3E 0J9 (Canada)

1 0