HOPE Day 2 - Citizen Engineer

Posted by Eric Stein - July 22, 2006 CE @ 20:48:51 UTC
Lady Ada of Adafruit Industries gave a talk about all the hardware hacking she's done and the history and recent resurgence of it. You may know her by from her Altoids tin MP3 player that received a good deal of publicity online. As the panel was starting, I recognized Phillip Torrone by his laptop. That isn't something that happens to me every day. It only happened because his powerbook has a tarsier laser-etched into it. The two continued to show off cool hardware hacks, including a rotary-dial cellphone that definitely outdoes the classic cellphone handset over at ThinkGeek. To top it off, Phillip gave a copy of Make magazine to the first person to call the phone. I want that phone.

Modding existing proprietary hardware isn't the only hardware hacking out there. Lady Ada reverse-engineered a famous (and recently, expensive due to lack of supply) sound synthesizer and published the plans online. Her version, the x0xb0x (pronounced zocks box), is availabe as both a kit and full plans under an open source license! Hundreds of peope have made them from the plans since, and there have even been contributions of improvements!

Some links for aspiring hardware hackers (courtesy of Lady Ada):Well, I've got to go attend the panel on password cracking and the time-memory tradeoff. That's all for now.
To the comments...

HOPE Day 2 - Tales of Hotel Pennsylvania

Posted by Eric Stein - July 22, 2006 CE @ 20:19:19 UTC
Before we checked in, we expected:What we got was:The bedding issue wasn't too serious - after all, Mike had brought an air mattress, so we could get by. The problem was Internet access. But when 4 people with 4 laptops and plenty of networking gear are alone and bored in a hotel room, things happen. The Internet connection we could have got would have cost us $30 for the weekend, and you don't take that sitting down. So, Christian did some things and we soon found out that the gateway was running Windows with no firewall and IIS5. He called someone who knows things, and we had an exploit ready to go in a few minutes. However, we decided it wasn't the nicest thing to do, so we decided to leech wifi instead. Christian and Mike could get on, but I couldn't - my wifi card is considerably lower powered. Not to worry - Mike bridged his connection though a patch cable Bryon had. Sadly, by the time we had this all figured out, it was too late to do much and we had to get to sleep.

Fast forward to this morning. Still no net access for me, as the wifi set up by the convention only covers the 18th floor. In a lull of panels I didn't want to attend, I brought my laptop up to the Internet lounge on the top floor. I fired up kismet, and that worked perfectly - plenty of nodes to connect to (screenshot). However, it wasn't quite so simple when I tried to connect. After some hacking around, I found it.
bash-2.05b# arp -an
? (70.47.112.1) at 00:00:92:a7:c3:d9 on ath0 [ethernet]
? (70.47.115.239) at 00:0c:f1:26:3b:fd on ath0 [ethernet]
bash-2.05b# arp -d 70.47.115.239
70.47.115.239 (70.47.115.239) deleted
bash-2.05b# dhclient ath0
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 3
DHCPOFFER from 70.47.112.1
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPACK from 70.47.112.1
bound to 70.47.112.53 -- renewal in 300 seconds.
bash-2.05b#
70.47.112.239, you bastard. I totally wasn't expecting something like this at a hacker convention. No way - you shocked me. As you can probably guess, my IP is 70.47.112.53 right now. Bring it, 70.47.112.239.
To the comments...

HOPE Day 1

Posted by Eric Stein - July 22, 2006 CE @ 19:46:22 UTC
Yesterday was a very interesting day. We got in the car and ended up driving for over six hours (1.5 of which were us lost in New York as it poured cats and dogs). We finally got there at about 11 AM, but as I wasn't the one with the reservation, I didn't get checked in until about 2 PM.

The first scheduled event I attented was the keynote address at 4 PM by Richard Stallman. The first time I saw Stallman speak, I didn't experience much different than I expected. He talked about the specific freedoms required for Free Software and only ranted about Bill Gates and George W. Bush a little. Then I watched a video recorded at an FSF Europe event in which RMS talked about the changes to GPLv3. That makes 3 times so far - and every time, that part of the speech has been recycled. This is appropriate at events with mainstream press coverage (such as the FSF Europe event), but 85% of the audience wasn't being told anything new at the other events, including today's.

The majority of the keynote was worthwhile and very informative. Stallman gave a brief history of hacker culture, including the origin of the pejorative use of the word 'hacker'. In 1980, a journalist misused the word to refer to the subset of the hacker community involved in breaking the new security systems on many online hosts.

Another issue clarified by Stallman was that DRM is allowed by GPLv3 - but it is afforded no special permissions under the DMCA, either. Indeed, any restrictions of the 5 freedoms imposed by local laws are explicitly disclaimed. This is not to say that Stallman approves of DRM - he mentioned that a good website on the topic is defectivebydesign.org.

Anoter random tidbit: Stallman runs Ututo Linux. Also, GNU HURD is unlikely to be finished in the forseeable future. I don't remember the exact wording, but the exchange went like this:
<person> when can we expect HURD to be complete?
<rms> It's delayed.  The mach microkernel is not suited for what we need, and there is currently no microkernel to replace it.  But that's not very important - you can use Linux.
Some of the questions from the audience were amusing.
<person> How can I grow a rockin' beard like yours?
* audience laughs
<rms> Well, I don't fertilize it or anything...
<person> so it's au naturale then?
<rms> I guess...
Due to problems with FreeBSD and my camera playing nice, I won't be posting the pictures I take this weekend until I get home. They'll be integrated into the posts that they correspond to.
To the comments...

HOPE Number Six

Posted by Eric Stein - July 20, 2006 CE @ 16:07:47 UTC
By this time tomorrow, I'm going to be at a convention on computer security in NYC - Hope Number Six. This excerpt from the website sums up what I expect very well:
The HOPE conferences have been running since 1994. HOPE stands for Hackers On Planet Earth and it has become a gathering point for thousands of computer hackers, phone phreaks, net activists, government spooks, and a whole lot of curious people from all corners of the globe. This will be our sixth one (hence the name) and we expect to continue to grow and have more imaginative events, cool speakers, and fun projects than ever before.
I'm going to be taking pictures and blogging on the conference as it happens.

I can't wait.
To the comments...

FreeBSD - on a laptop

Posted by Eric Stein - July 20, 2006 CE @ 05:00:15 UTC
Recently I installed PC-BSD on my laptop. It was pretty decent, but it had some problems. I would have continued to use it if a kernel compile that I botched hadn't removed its ability to boot. I needed a new OS, and since I'm going to be out of town this weekend, I needed it fast.

I wanted an OS that had:I've liked BSD since I first used it, so I wanted to give it a try on a laptop. It definitely had the network security - firewall or not (I wanted a firewall anyways). Physical security is reasonably easy in FreeBSD with swap and partition encryption. There is a wide variety of good looking and low resource use desktop environments in the ports collection - I chose Xfce. BSD, being UNIX based, has a great command line. My wifi card is supported natively by the if_ath driver. Here's the kicker - what's cooler than running FreeBSD on a laptop? I guess my mind was made up before I started deciding, but I really think it was a good choice.

Partitioning

During install, I added an extra 3 GB partition to be configured as my home partition later. I'd advise using more than this - I wish I had used more like 8 or 9 GB out of my 17 GB drive, as my home directory is likely to fill up fast.

Loading Modules

After installing the OS, the first thing I did was to set up my /boot/loader.conf:
if_ath_load="YES"
ipfw_load="YES"
geom_eli_load="YES"
This loads the driver for my wifi card, ipfw (firewall), and the module used for encrypting my home partition. Some modules are loaded by default, so this is the list I have now:
bash-2.05b# kldstat
Id Refs Address    Size     Name
1   14 0xc0400000 691928   kernel
2    1 0xc0a92000 d9f4     ipfw.ko
3    1 0xc0aa0000 b944     geom_eli.ko
4    2 0xc0aac000 19f44    crypto.ko
5    2 0xc0ac6000 ad04     zlib.ko
6    1 0xc0ad1000 fa20     if_ath.ko
7    3 0xc0ae1000 3015c    ath_hal.ko
8    2 0xc0b12000 3fbc     ath_rate.ko
9    1 0xc2438000 16000    linux.ko

Network Security

Security configuration was pretty simple too:
linux_enable="YES"
usbd_enable="YES"
syslogd_flags="-ss"          # syslogd - no network
portmap_enable="NO"          # no portmap - security risk
inetd_enable="NO"            # no inetd - no need
firewall_enable="YES"        # use ipfw
firewall_script="/etc/rules" # load rules from /etc/rules
hostname="eowyn"
ifconfig_rue0="DHCP"         # use DHCP to get an IP (wired)
Setting up ipfw can be decidedly confusing when you first start doing it. It took a few hours to come up with this rules script:
ipfw -q -f flush
cmd="ipfw -q add"
$cmd 00001 allow ip from any to any via lo0
$cmd 00002 allow tcp from any to any out setup keep-state
$cmd 00003 allow tcp from any to any in established
$cmd 00010 deny ip from any to any in frag
$cmd 00020 deny ip from any to 127.0.0.0/8
$cmd 00021 deny ip from 127.0.0.0/8 to any
$cmd 00060 deny icmp from any to any in
$cmd 00600 allow tcp from any to any dst-port 68 in
$cmd 00601 deny udp from any to any dst-port 68 in
$cmd 00603 deny tcp from any to any dst-port 68 in
$cmd 65534 allow ip from any to any out keep-state
$cmd 65535 deny ip from any to any
In a nutshell: let anything on localhost work, allow needed network services to work, and let anything that's connecting to the net out.

Physical Security

Configuring encrypted swap was extremely simple. All I had to do was add .eli to the end of the device filename for the swap partition (in /etc/fstab). It was a bit more difficult to encrypt a partition, but it is well documented in the handbook. I'm quite happy with the results:
bash-2.05b# df -h|grep eli
/dev/ad0s1g.eli    2.9G    384M    2.3G    14%    /crypt
bash-2.05b# swapctl -l
Device:       1024-blocks     Used:
/dev/ad0s1b.eli    992416         4

Programs

After setting up the basics, I installed a few programs from ports. To have a reasonably comfortable user experience on a computer, I need abiword, bash2, calc, cvsup-without-gui, eog, fastest_cvsup, firefox, gnome-terminal, kismet, portaudit, screen, scrot, xfce4, xpdf, and xscreensaver. Needless to say, this took awhile to compile on a 333 MHz laptop.

Success

People say Linux isn't ready for the desktop. The people who say Linux is ready for the desktop say BSD isn't. I don't know about Joe sixpack, but BSD is ready for my laptop - a lot readier than Windows or Mac OSX will ever be.
To the comments...

PC-BSD powered blogging

Posted by Eric Stein - July 7, 2006 CE @ 17:37:50 UTC
After beating around the bush trying to get the FreeBSD if_ed driver to work with my EtherFast PCM100 for almost a week, I got a random phone call from Ryan requesting help purchasing and installing a new stereo in his car. I allowed myself to be bribed with a broken USB ethernet adapter and went along. His car is a hack job indeed - he had formica sheeting, duct tape, ethernet wire, computer speakers, an inverter and an iPod built into his audio system. It improved - most of the hardware is actually normal now (ok, the ethernet, duct tape, and iPod are still there).

OK, back to business. The USB adapter was rather damaged - the flip-up cat5 jack can't hold itself shut and the case falls off. This is no problem for a true laptop ninja:
MacGuyvered laptop ethernet
MacGuyvered laptop ethernet

As you can see, rubber bands from the produce department are always a suitable fix for your broken ethernet adapter needs. At this point I charged ahead, installing firefox from the ports collection. This didn't last long, as something somewhere segfaulted. I fell down the dependency tree, hitting everything on the way. Being the ever-suspicious-of-the-hardware-because-software-is-perfect guy that am, I immediately resorted to Memtest86. I would not be disappointed.
Someone set up us the dead ram.
Someone set up us the dead ram.

Oh dear, it looks like my third stick of RAM is up to no good. I promptly removed my keyboard and removed it. Memtest86 agrees, I am fine now! Thank you Memtest86. Burn in hell, error-prone RAM.
The guilty RAM
The guilty RAM

After all the trouble I've had getting this laptop to work, I'm surprised that I'm not ready to kill Nick yet - he is after all the one who sold me a laptop with these defects:Nick, if you're reading this, I realize that you're just technologically retarded, not underhanded. Still, thanks for nothing.

On a more positive note, I now have a laptop with both kinds of ethernet, a great operating system, and a large hard drive for its class. I'm not complaining.
To the comments...

PC-BSD - ready for the desktop?

Posted by Eric Stein - July 2, 2006 CE @ 06:29:40 UTC
I have a laptop. It's a very picky laptop. Only the very best in operating systems will install on it. So far, Debian, Ubuntu, Knoppix, Gentoo, Damn Small Linux, and FreeBSD have attempted residency on my laptop. To be fair, I think some of my hardware hates life, the universe, and everything (but especially software). It may have something to do with that time a high voltage wire shorted out - sparks and smoke resulted. The current contestant, and the topic of this post, is PC-BSD. PC-BSD purports to be FreeBSD, made shiny and easy. Think UbuntuBSD. But first, the results of my previous attempts.And no, Windows is not an option. I have a very short and simple list of well thought out arguments why not:Now that that is over with, you should see that I want an open source operating system. One that I can mess with. One that has a decent command line. So, the process of installing PC-BSD awaits.

To begin with, I put in the boot CD (I'm using version 1.11a, FYI) and turned on my computer. So far I have had to click maybe 4 times and hit enter once. A 3 year could do this. However, the installer is still copying files over, so I'm not done yet.

Ah, it finished with very little hassle. So far, I haven't had any problems except for my wired LAN card, the Linksys EtherFast PCM100. I am currently in the depths of confusion and despair about the recognition of my ethernet card. Details of my eventual success or failure to follow.
To the comments...

XChat windows - exclusive features?

Posted by Eric Stein - June 29, 2006 CE @ 17:29:29 UTC
The XChat official Windows build has some features that they would have you think are not available in the open source version.
* Added an option of using 'Last-Spoke' nick completion order in Settings > Input Box.
When I saw that in the windows changelog, I immediately wanted it in my build, as I often tab complete incorrectly and make an idiot of myself. So, off to the source I go! Using grep, I find this tasty little tidbit:
./fkeys.c:1512:                 if (prefs.completion_sort == 1) /* sort in last-talk order? */
./fkeys.c-1513-                         tmp_list = g_list_sort (tmp_list, (void *)talked_recent_cmp);
Well, it looks like I don't have to code this myself! Back to my still-running xchat instance:
/set completion_sort 1
[13:21:02]completion_sort set to: 1
Success! My tab complete now sorts by lastspoke, not just alphabetic order. As it turns out, this 'Windows only' feature is just not exposed in the gui settings dialog under Linux.
To the comments...

Philip is awesome

Posted by Eric Stein - June 27, 2006 CE @ 05:41:05 UTC
As many of you know, I have a cat. He vomits on the rug sometimes, and tends to bother me while I'm trying to work, but that doesn't matter. He's the best cat ever. I will prove this through CUTE PICTURES.
Thbhbhhtthhb.
Thbhbhhtthhb.


Cat feet.  No explanation needed.
Cat feet. No explanation needed.

Huh.  That down there is a camera... I think?
Huh. That down there is a camera... I think?

Take this how you will.
Take this how you will.

NINJA CAT ATTACK CAMERA STRAP OVER
NINJA CAT ATTACK CAMERA STRAP OVER

Don't believe me yet? I give up.
To the comments...

Installing MySQL on FreeBSD

Posted by Eric Stein - June 24, 2006 CE @ 05:42:50 UTC
Installing MySQL isn't as simple as you would think on FreeBSD. You might think it's as simple as this:
cd /usr/ports/databases/mysql51-server/
make install clean
But that isn't true. It does compile everything and install the binaries, but the configuration file and default databases are nowhere to be seen. If you've never installed MySQL before, this can be very irritating.

To install the configuration file and databases, do this:
cp /usr/local/share/mysql/my-medium.cnf /etc/my.cnf
cp /usr/local/share/mysql/mysql.server /etc/rc.d/
mysql_install_db --user=mysql
chown -R mysql:mysql /var/db/mysql/
chmod 700 /var/db/mysql/
You can change the medium in my-medium.cnf to huge, large, or small (depending on how resource-hungry your application is). After you install the correct one for your needs, you may want to consider turning off remote access to the MySQL server. If all the applications that need to access your databases are going to be on the same system, this is desirable - the fewer possibly malicious clients have access, the better. To do this, uncomment the skip-networking line in the my.cnf file you just created.

Once you're satisfied with configuration file (you may want to read through it and make some other changes), start up your shiny new MySQL server:
/etc/rc.d/mysql.server start
There's something about MySQL that has always bothered me - the complete and utter lack of an ability to set a root password BEFORE activating the server. Now you should set a root password, ASAP:
mysqladmin -u root password
mysqladmin -u root -h `hostname` password
If you don't care about people possibly seeing your password while you set it via w or ps, you can also do it like this (which won't prompt you interactively):
/usr/local/bin/mysqladmin -u root password 'new-password-here'
/usr/local/bin/mysqladmin -u root -h `hostname` password 'new-password-here'
If other people you don't absolutely trust have local access to your server (or you have left networking enabled for whatever reason), you might not be the first person to connect to the unsecured server and set the password. So hurry.

References

To the comments...
Valid XHTML, CSS, RSS | 8ms | Copyright 2004-2024 Eric Stein