A quick stop

So with the end of college coming up I'm madly trying to get all my work finished to distinction level so I can get that nice A*, not a lot of time to put stuff here but today I had to write an essay on current security threats and ended up writing quite a bit on the Conficker botnet and thought it could be worth a read for anyone looking to know a bit about it.

***NOTE: Due to the rate of release info on this worm, the info could be outdated very quickly, at time of writing it all fits though. ***

One of the most currently well known and hated infections is known as Conficker (Alias Downup, DownadUp and Kido). Conficker started its career sometime in 2008 but was not confirmed until November 2008. It’s considered to have the highest worm infections since an unrelated worm spread across the world in 2003. The worm uses extremely advanced techniques of exploitation, system hijacking and morphing to avoid its detection and removal wherever it ends up. Some of the places Conficker has infected have been hospitals, the French Navy systems, the Ministry of Defence and even the houses of parliament!

It started by just exploiting one quite famous hole in the Windows RPC service but since the release of versions Conficker.B, Conficker.C and Conficker.E the process has become even more complex with multiple infection routes, multiple “call to” routes and the creation of a P2P network where the infections talk to each other and update via each other. Now even the infection is spreading by removable media devices and NetBIOS shares.

To avoid removal the malware scans for processes known as anti-virus or anti-malware and kills any of them in one second intervals, it also disables Windows auto-update and even blocks DNS requests to any sites considered anti-malware help or downloads.

The worm is self updating and self maintaining and virtually impossible for the source to be traced to even a country, let alone a person(s) to hold responsible for the 15 million+ infected computers across the world.

The authors of Conficker has hoaxed its final call for instructions a few times including a good April 1st scam where the media hyped up that it would start full activity on the net then but in the end nothing happened at all. The Conficker writers currently do not give full instructions to these millions of awaiting bots that daily scan a range of 500,000 generated domains for instructions. Only one of these domains has to have instruction data in order for the entire botnet to receive its orders, so it makes it even harder to track down who is doing this. In an effort to stop these instructions being sent out Microsoft bulk bought 13% of the domains they found out about.

There has been many arguments over what the botnet is for and what it will do but all that experts are sure of at the moment is the author(s) are very clever programmers who now have enough control over the internet to turn it inside out with malicious intent.

Finally twittering

Yes I've finally given in and got a twitter account, mainly because I'm bored and spotted the Twitter API Wiki.

It works with technologies at the top end of web fun such as JSon, XML and REST.
It gives simple examples for using cURL with the JSon and XML elements. Like below
this cURL line updates the status on twitter (command line updates anyone? :P)



degus:/var/www/# curl -u netphunk:******** -d status="Status update from cURL" http://twitter.com/statuses/update.json
*snip JSon output because its boring :)*
degus:/var/www/#


And sure enough the -d status="" text appeared as my "What are you doing?" status on twitter woop.
Now thats all good but mastering the API in one line isnt enough for me so I made a version of the same principal but using the wget tool instead, just so I could look kool :D


degus:/var/www/# wget --post-data="status=Stats update from wget" --http-user=netphunk --http-password=*** http://twitter.com/statuses/update.json
--2009-04-21 20:42:23-- http://twitter.com/statuses/update.json
Resolving twitter.com... 128.121.146.228
Connecting to twitter.com|128.121.146.228|:80... connected.
HTTP request sent, awaiting response... 401 Unauthorized
Connecting to twitter.com|128.121.146.228|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 948 [application/json]
Saving to: `update.json'

100%[======================================>] 948 --.-K/s in 0s

2009-04-21 20:42:25 (159 MB/s) - `update.json' saved [948/948]

degus:/var/www/#


Yay it works all good :D Twitter is still a mystery and the way it autoatically connects people has some privacy debate questions behind it but it's got a very innovative API that looks good fun, nothing like updating blog style from a quick command line hack right?

Bluetooth EEE style

Ok so I've wanted good Bluetooth connectivity for a while now on my Asus EEE.
I spotted these adapters on Ebay for about £4 with delivery you could buy a 100M range USB2 adapter the size of your thumbnail. Perfect mini size for the nature of the EEE.

My experience with Bluetooth on Linux based systems just hasn't come around until now and I've got to say I'm very suprised at the support. I connected it and that was that, it was detected and activated as shown with the commands below.



netphunk@eee:~$ lsusb
Bus 002 Device 005: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)
netphunk@eee:~$

root@eee:/home/netphunk# hciconfig
hci0: Type: USB
BD Address: 00:15:83:0B:13:C0 ACL MTU: 384:8 SCO MTU: 64:8
UP RUNNING
RX bytes:759 acl:0 sco:0 events:33 errors:0
TX bytes:394 acl:0 sco:0 commands:32 errors:0

root@eee:/home/netphunk#

root@eee:/home/netphunk# hciconfig hci0 up
root@eee:/home/netphunk# hciconfig -a
hci0: Type: USB
BD Address: 00:15:83:0B:13:C0 ACL MTU: 384:8 SCO MTU: 64:8
UP RUNNING
RX bytes:771 acl:0 sco:0 events:35 errors:0
TX bytes:409 acl:0 sco:0 commands:34 errors:0
Features: 0xff 0xff 0x8f 0xfe 0x9b 0xf9 0x00 0x80
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy: RSWITCH HOLD SNIFF PARK
Link mode: SLAVE ACCEPT
Name: 'eee-0'
Class: 0x0a010c
Service Classes: Networking, Capturing
Device Class: Computer, Laptop
HCI Ver: 2.0 (0x3) HCI Rev: 0x7a6 LMP Ver: 2.0 (0x3) LMP Subver: 0x7a6
Manufacturer: Cambridge Silicon Radio (10)

root@eee:/home/netphunk#

root@eee:/home/netphunk# hcitool scan
Scanning ...

At this point I was just seeing if the range would pickup any devices in the neighboring houses. :) Now I turn bluetooth to active on my phone.

root@eee:/home/netphunk# hcitool scan
Scanning ...
00:21:FE:**:**:** Bob
root@eee:/home/netphunk#

Its seen! At this point I reactivated gnome bluetooth daemon and used the graphical interface to pair the two devices with a couple of clicks. This has got to be the most impressive Linux driver setup I have come accross. With this ease you wonder why the blocks and troubles with wifi, and graphics related stuff is so bad. Maybe because it is a more profitable market by far?

Overall I think the dongle was worth the price and the people who have made Bluetooth on Linux 2.6.x such a breeze should be rewarded by getting to slap the guys in charge of wifi. :)

Few updates

Well still a lot has been going on.

Today I have implemented a new router into my home network, replacing the old broken Netgear router with a shiney nice Ciscco 837 Integreated services aDSL router :D woo. Its very kool.

Also I have had some trouble with two hard drives, one SATA, one IDE which is annoying. Looking into that more soon :)

Apart from that I've been trying to help solve problems for people on the gOS forums. Its something to do right and people like ya in the end.

Hopefully ill have another interesting "look what ive done" article up for you soon :)

War with the WG111T

One of the most annoying issues with Linux today is wireless drivers.
One of the most tedious wireless adapters sold in the UK in the past 2 years is the WG111T, its also one of the most uncompatible chips for Linux I have ever come accross.

The Netgear WG111T is popular for three reasons, one being
the branding, two being its cheap and three it being bundled with
alot of 'free wireless adapter when you buy <>' deals.

I have one of these from about 2006, it came free with our wireless
router package and has always been trouble. But in those days I
did not have the countless hours of Linux experience that I do now and considering the amount of people still scratching their heads
at the possibility of Linux and the WG111T, I thought I'd give it
one more try.

The WG111T has a long history with a Linux<->Windows wireless
driver utility called ndiswrapper. ndiswrapper creates a bridge
between the driver for windows and the Linux kernel and
interprets between the two.

I thought this was good a place as any to start out seeing as
some people have reported it working for them. Again for this
experiment I will be using my gOS setup on my Asus EEE 2g surf.

Abit of information on gOS for people wanting to know if this guide is of use to them:
gOS is based on Ubuntu Hardy, but my version is ugraded to Ubuntu Intrepid software all of the packages I used are from the Ubuntu Intrepid repositorys.
Ok so first I just whacked the adapter in to see what Linux said.

[ 342.420082] usb 5-4: new high speed USB device using ehci_hcd and address 4
[ 342.576100] usb 5-4: configuration #1 chosen from 1 choice


Ok so the thing is still working and Linux is not loading any incorrect
drivers for it. Now I needed the driver files for the adapter
and after a lengthy search I concluded that the latest version for windows (2.1) is different to the original driver files and does not seem to load into ndiswrapper at all. The older driver version 1.2 seems to be the best although hard to find for download if you google for wg111t_1_2.zip you should be able to find it.

Once downloaded I unzipped it and took alook at the files.


root@eee:/home/netphunk/Desktop# unzip wg111t_1_2.zip
Archive: wg111t_1_2.zip
<snip>
inflating: WG111T_re1.2_rc1/athfmwdl.inf
inflating: WG111T_re1.2_rc1/netwg11t.inf
<snip>


There is the two main driver inf files that ndiswrapper has reported to work with. Firing up ndiswrapper the driver files seem to load in ok:


root@eee:/home/netphunk/Desktop/WG111T_re1.2_rc1# ndiswrapper -i netwg11t.inf
installing netwg11t ...
root@eee:/home/netphunk/Desktop/WG111T_re1.2_rc1# ndiswrapper -i athfmwdl.inf
installing athfmwdl ...
root@eee:/home/netphunk/Desktop/WG111T_re1.2_rc1# modprobe ndiswrapper
root@eee:/home/netphunk/Desktop/WG111T_re1.2_rc1# ndiswrapper -l
athfmwdl : driver installed
netwg11t : driver installed


Now to plug in the adapter and see what it reports.
After connecting the adapter, its blue light turned on and started to
flash periodacally, promising.


root@eee:/home/netphunk/Desktop/WG111T_re1.2_rc1# ndiswrapper -l
athfmwdl : driver installed
device (1385:4251) present
netwg11t : driver installed


The driver files have seen and registered the adapter, I used dmesg
to double check and see if any errors were encountered.


[ 3412.002256] ndiswrapper: driver netwg11t (NETGEAR,01/07/2005,1.0.1.1007) loaded
[ 3412.407252] wlan1: ethernet device 00:14:6c:35:5c:60 using NDIS driver: netwg11t, version: 0x10000, NDIS version: 0x501, vendor: 'NDIS Network Adapter', 1385:4250.F.conf
[ 3412.408623] wlan1: encryption modes supported: WEP; TKIP with WPA; AES/CCMP with WPA
[ 3412.610925] ADDRCONF(NETDEV_UP): wlan1: link is not ready
[ 3413.900863] ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 3423.916017] wlan1: no IPv6 routers present


Seems to load up and be operating fine.


wlan1 Link encap:Ethernet HWaddr 00:14:6c:35:5c:60
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:56 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3562 (3.5 KB) TX bytes:468 (468.0 B)


ifconfig is confirming this too and by now gnome networkmanager had caught on and was actively scanning using the adapter. Unfortunately the adapter was having problems connecting to my home network despite picking up both networks belonging to houses either side of me. This is still a big step for any WG111T owner that I went from no drivers to detected and scanning adapter in about half an hour.

I hope this explanation/guide has helped some people get their WG111T adapters working, in theory this is going to work on any Ubuntu or Ubuntu based distrobution.

Any questions you can comment here or email netphunkATgmailDOTcom and I'll help if i can.

Further fun with gOS on my EEE

Ok so another day and easter holiday giving me more time to tweak with gOS on my EEE.
As most of the heavy stuff such as the kernels and dist-update was completed I switched focus to some bugs and getting it to look nicer.

Firstly I wanted to make Grub a bit prettier, all these kernels generic and EEE and their recovery modes left a jumbled boot screen rather than a slick looking grub.

I found a tutorial here on creating splash images for Grub and how to add them into the Grub menu.lst file in Ubuntu. A few minutes later with Gimp and I had a good conversion of the default gOS Gnome background into a 14-colour compressed XPM clone.

The image and removing a lot of unwanted menu.lst kernel entries made the boot process a little more tidy and appealing. Some changing around of the Gnome desktop setup and the Google Gadgets/wBar setup is now taking place. I also need to look into a bug where wBar is not transparent when gnome initially starts (I have to right click wBar then it goes transparent).

I dug around and found ~/.wbar contains all entries for my wbar so I can add a few programs to it by hand. Also been looking at the application they use for the web service clicks called 'Prism'
its some sort of embedded control browser used for web services and created by Mozilla Labs.

More information on the bugs soon but heres a link for my gos_splash.xpm.gz if anyone wants it:
Hosted by Mediafire


Update:

Heres a Screenshot of my gOS updated to Ubuntu Intrepid and reverted mostly to the gOS interface.

The beginning and adventures with gOS

Randomly I've decided to create a Blog to put my random technical stuff that I get up to on a page for nobody to view. :)
Now the boring part is over, to the gOS.

gOS is a distribution of Linux that focuses on three things,
1. Rich web service based computing.
2. A very easy to use system for the most non-technical users.
3. To be aimed at new net book style computers in the pre-install market such as that with Asus and their EEE pc.

The ideas go well together and the market for gOS is growing rapidly in all forms. The OS is also up for free download and I have been searching for some time for a "to keep" OS for my Asus EEE 2g Surf.

With the specification of the 2g being in the requirements for gOS by some way I was eager to get started with it.

After installing it to an 8gb flash stick on the EEE, I was faced with a few problems. The lack of ACPI/Function key support, the lack of wifi and full drivers for the internal hardware.

Some googling led me to Here where some nice person has made packages to fix all of these issues for Ubuntu Hardy and Ubuntu Intrepid.

I soon had the packages installed from the Hardy repo (gOS is based on Hardy) but some updates and support were only availiable from the Intrepid repositry. I now had to risk upgrading gOS to Intrepid (unsupported) and try make the system still gOS like. I did the upgrade the traditional Debian apt-get dist-upgrade route and it went pretty smooth if a little slow.

After the upgrade was complete I upgraded the linux-eeepc packages to the Intrepid repositry files and rebooted. A few package installs and graphical tweaks and I have gOS pretty much the same but an increase of 40mb in startup ram usage is a little problem that I need to look into.

After a day or two of waiting for the EEE to catch up with the speed of my thoughts I now have quite a polished setup.

I hope that was not too boring, I forgot most of the commands and steps due to not knowing I would need to post them.

If your interested in gOS I suggest you rock over to ThinkgOS.com and download a copy, its default kenel will support most hardware OOTB and its Live so worth a try for any Linux user!

Other sites mentioned for thanks:
array.org/ubuntu - Ubuntu packages for drivers, lightweight kernel and function key scripts.
Asus.com - For creating the EEE, The main part of my adventure with gOS.
eeeuser.com - Booming EEE forums, blog and wiki that provide invaluable information to any EEE owner.

:)