- Roundtable - muug.ca

openssl bug
by Trevor Cordes 14 Mar '16

14 Mar '16

A side-channel attack was found which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture which could lead to the recovery of RSA keys. The ability to exploit this issue is limited as it relies on an attacker who has control of code in a thread running on the same hyper-threaded core as the victim thread which is performing decryptions. This issue affects OpenSSL versions 1.0.2 and 1.0.1. ======== Uhh... Umm... OK. How does one decide to start looking at hardware cache-bank conflicts to hack RSA keys? Worse yet, how is a programmer supposed to think of this stuff in his "brainstorm what can go wrong" phase of programming? "Oh, I need to alter my code to ensure it uses different cache banks on Sandy-Bridge." This is insane.

1 0

ecc laptops!
by Trevor Cordes 12 Mar '16

12 Mar '16

Now you can get ECC in a laptop, without spending tons (but still lots) of money. Lenovo's new P70 line has optional Xeon and ECC. They claim to be the "First ever Intel Xeon power in a mobile" but of course we know some smaller outfits have made Xeon/ECC laptops for years now. But, this probably is the first "name brand" Xeon/ECC laptop. http://shop.lenovo.com/us/en/laptops/thinkpad/p-series/p70/ You have to look at the highest-end ones to get ECC. Also, 4 RAM slots is nice. Note, I do sell Lenovo, but am posting this just as an FYI since I know a lot of us discuss ECC on a regular basis.

3 5

strange IMAP / G3 problem
by Trevor Cordes 08 Mar '16

08 Mar '16

Brad & I are having a weird problem with his iphone 4S (with the latest iOS versions). iphone builtin mail imaps (port 993) ssl (self-signed) (old ciphers disabled on server) dovecot He can connect to imap with the above config on his in-office wifi, in-home wifi over vpn to office, and shaw open wifi outside his office/home network. If he switches to 3G (I don't think his phone does LTE) then suddenly he can't connect! (With some useless "can't connect" error.) Huh? Duh? Exact same setup and settings on an iphone 5 works fine. Also works fine on Android. The problem is just on his 4S. Even more interesting, if he wifi tethers a PC to his 4S over 3G and hits imaps using thunderbird on the PC it works fine. My question is, what on earth does changing the connection layer have anything to do with this? Can the phone be doing something differently in the mail app depending on 3G or wifi??? Can the 3G network be blocking something (unlikely since the tethered PC works)? It make no sense whatsoever to me. Maybe his phone is p0wned? I'm stumped. Ideas?

4 6

load 27?
by Trevor Cordes 05 Mar '16

05 Mar '16

Huh??? My load has been stuck at 27-ish for an hour now even after I killed all the CPU and mem hogs, and I'm stumped... How can idle be around 90% and load avg be 27? System feels a bit sluggish, but not load 27 sluggish! Quad core system. (And yes, "daily" is supposed to be high CPU, but it's niced out the wazoo.) top - 16:20:12 up 31 days, 12:26, 58 users, load average: 27.17, 27.20, 27.23 Tasks: 496 total, 1 running, 481 sleeping, 13 stopped, 1 zombie %Cpu(s): 1.2 us, 0.8 sy, 8.4 ni, 89.5 id, 0.2 wa, 0.0 hi, 0.0 si, 0.0 st KiB Mem : 8174168 total, 2590468 free, 2260492 used, 3323208 buff/cache KiB Swap: 8376316 total, 7449712 free, 926604 used. 5777204 avail Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 11450 trevor 39 19 151372 52464 10000 S 33.4 0.6 0:12.71 daily 2170 root 20 0 448728 132620 23652 S 3.0 1.6 644:53.37 Xorg 4190 trevor 20 0 929896 105796 11352 S 2.6 1.3 146:56.66 gnome-terminal- 2794 trevor 20 0 267904 7628 6020 S 1.0 0.1 394:39.23 gkrellm 4492 trevor 20 0 773060 17256 12936 S 1.0 0.2 65:17.14 audacious ...

2 5

MUUG Meeting, Mar 8, 7:30pm -- Thunderbird
by Gilbert Detillieux 01 Mar '16

01 Mar '16

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, March 8. The meeting topic for this month is as follows: Thunderbird Brad Vokey will be doing a presentation on Thunderbird, a free, open source, cross platform email, news, and chat client developed by the Mozilla Foundation. Brad will focus on how to customize Thunderbird with extensions (and other little known features) to take this email client into power user territory. Topics will include the extensions: Keyconfig, Nostalgy, QuickFolders, Quicktext Pro, Signature Switch, Xnote, and Expression Search. He will also briefly cover tags, message filters, search folders, and other built-in tricks to help reduce the time you have to spend on email each day. New Segment: Daemon-Dash MUUG is proud to announce a new segment that has been dubbed: Daemon-Dash. The idea behind Daemon-Dash is to have a quick 15-25 minute presentation on a daemon, and dive right into the meat of the content. DD's will forgo the usual introductory theory and use cases, instead showing users how to start using the daemon right away. Daemon-Dash: dnsmasq For our first ever Daemon-Dash segment, Paul Sierks will be presenting dnsmasq. Geared towards small networks, Dnsmasq provides DHCP, DNS, and TFTP services. Written in C, it features a small CPU and memory footprint making it suitable to run on just about anything, such as a home router. It has been adopted by some distributions which have it configured as a DNS cache. Other use cases include BOOTP and PXE network booting. The group holds its general meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ****************************************************************** Please note our *NEW* meeting location for this month: *Room 3M60* (3rd floor) Manitoba Hall, University of Winnipeg, entrance on Ellice Ave. between Spence St. and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ****************************************************************** For more information about MUUG, and its monthly meetings, check out their web server: http://www.muug.mb.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: http://www.muug.mb.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.mb.ca> c/o Gilbert E. Detillieux Web: http://www.muug.mb.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

anti-spoofing geoloc in HTML5
by Trevor Cordes 28 Feb '16

28 Feb '16

I'd like to have a web page / form that gets the geo-location (via HTML5 and js) of the user (expected to be on a GPS phone) in such a way that I can be pretty sure they are at the coordinates I'm expecting. In other words, I want them to only access my page when they are at a certain place. I want to minimize hackers capturing / spoofing this page so that they can't do replay attacks, reverse engineering, etc. I don't want them to trick the site into thinking they are at the place the next day when they are not. The main page will be a form which requests geoloc and fills in a hidden form field with coords, and the user fills in some user text fields. The results get posted to my server. Since this is just a web page (not a native app), I understand I probably (almost assuredly!) can't lock this down 100%. But maybe I could stop the average (smart-ish) joe from spoofing it? I've thought of a few ways to make the spoof harder: tokens, timestamps, js obfuscation of post data and code, etc. I just thought I'd pick the brains of the MUUG geniuses for some ideas.

1 0

at command
by Trevor Cordes 28 Feb '16

28 Feb '16

Is there a way to tell after the fact what command(s) an "at" command ran? I got an email about an error in a cron job and it appears to be an at command that was queued up. The error is suspicious, and I don't remember queueing this at command (though I do use at from time to time). I can find in logs that it was atd running it under my user id, but the at queue is now empty and I can't find a way to retroactively see what commands/script tried to run. I'm doing a full fs search on some of the error strings but I am not hopeful. Is there a way to find out more about what at ran? Are there options that in the future would give me more log/debug output so I can more easily answer this type of question?

3 4

Re: [RndTbl] at command (John Donovan)
by jd 27 Feb '16

27 Feb '16

From where I'm at a) if it's being logged as having been run as user theo then we know theo is in /etc/at.allow Maybe anticipate the mystery process' next run and temporarily remove/disallow user theo Later, see error log for user theo The fully-spelled mystery command may show up. Also check root's error log (or errlog of anyone else in /etc/at.allow) in case the mystery command is invoked by spoofing .. $ sudo su theo -c "/explicitpath/script.sh" And, further on Theodore's mention of the -m option for at b1) I am a fan of alias, so .. add to your ~/bashrc alias at='/usr/bin/at -m' (for this Debian+bash example: to be accurate in spelling out the explicit invoke path, here, I did a $ which at and I was surprised to learn Ubuntu/Mint does not include it [at] in default install) Hmpf. b2) $ sudo mv /usr/bin/at /usr/bin/_at Then write a clever script named /usr/bin/at ( <-- no .SH this time) That can jot out a few notes about how & when it got called, then invoke the intended process, calling the re-named binary _at c) Optional reading - - at-tangent at ack-ack attack - - Early OCR would substitute a default character for any it could not recognise, into its text output. The chosen char was commonly @ Until you tuned scan resolution, etc (or until better OCR came along) your output would contain a lot of @ My pal Walter Gibbons is blind and in ancient days, we futzed with his kit to run OCR output thru his spiffy DECTalk TextToSpeech jobby, which would faithfully voice each @ simply as "AT" In the tuning, we sure laughed a lot (and swore) @ all the @ @ @, and we still n@ter at each other "AT AT, AT-AT-AT" for lev@y. Meanwhile .. my theory is th@ one of the writers of "Mars @tacks!" must have also run flaky OCR output through TextToSpeech and those creepy aliens' eery language was h@ched ! I pointed out to Walter that one of the sc@ological folk-names for the "@"-sign was dog[poop], and I pointed out further that we can 'train' the TextToSpeech to pronounce @ any way we wish. Walter cog@ated a bit, and declined the enhancement. Just as well, for soon, email was everywhere, and his system might have voiced: " EmailName DOG[POOP] email.com "

1 0

The O'Reilly Animals
by Trevor Cordes 24 Feb '16

24 Feb '16

The O'Reilly Animals An Adult Coloring Book http://shop.oreilly.com/product/0636920050223.do?sortby=publicationDate# !!!

2 1

SpamAssassin false positives on DATE_IN_FUTURE_96_Q?
by Gilbert E. Detillieux 23 Feb '16

23 Feb '16

I mentioned this problem at the last round-table session, but didn't get a solution, so I thought I'd post it here, just in case anyone has any suggestions to offer. I'm still seeing a whole bunch of false positives in SpamAssassin, since an update was installed in mid-September on a CentOS 5.7 system, for a rule called DATE_IN_FUTURE_96_Q, which is only supposed to be triggered when the "Date:" header has a date that is 4 days to 4 month ahead of the date in the "Received" header that has the _smallest_ difference in date. Here are the headers from the latest e-mail I've received with this false-positive. (I've stripped out irrelevant headers, for the sake of clarity and simplicity.) From topfivestories(a)messagent.itworldcanada.com Mon Nov 14 07:50:13 2011 Received: from mail.messagent.itworldcanada.com (mail.messagent.itworldcanada.com [207.112.10.80]) by palladium.cs.umanitoba.ca (8.13.8/8.13.8) with SMTP id pAEDoAxV028594 for <gedetil(a)cs.umanitoba.ca>; Mon, 14 Nov 2011 07:50:12 -0600 Date: Mon, 14 Nov 2011 08:50:13 -0500 X-Spam-Status: No, score=-0.3 required=5.0 tests=BAYES_00,DATE_IN_FUTURE_96_Q, HTML_MESSAGE,RP_MATCHES_RCVD autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on palladium.cs.umanitoba.ca Note that I'm calling spamd via the spamass-milter on a system running sendmail. Note also, that in the above example, the only "Received" header was the one generated by my own server. (I've had other false positives, however, with multiple "Received" headers, all of which were within seconds of the time in the "Date" header.) Any ideas? -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.mb.ca> Manitoba UNIX User Group Web: http://www.muug.mb.ca/ PO Box 130 St-Boniface Phone: (204)474-8161 Winnipeg MB CANADA R2H 3B4 Fax: (204)474-7609

6 11