I think I see the problem... [Soldering]

My NiMH Battery recharger has been acting up lately. One of the slots often (but not always) fails to charge. I finally took it apart today to check it out. The blue thermistor had somehow broken free from the negative terminal.


Thermistors are resistors that vary in value according to temperature. NiMH fast chargers almost always use some form of temperature sensor to determine the end of the charge cycle. That's what these thermistors are for.

I thought I'd introduce one of my favorite little gadgets. It's a Bernzomatic MicroFlame ST200.


A bona-fide soldering station will probably give you 150 watts or more of soldering power, fully adjustable. On full power, this little butane torch is probably in the 85-100W equivalent range, but is adjustable. It's considerably hotter than my 45W soldering iron, but not nearly as hot as my 150W soldering gun. On its lowest setting, I'd say it's about equivalent to 25 watts.



For little jobs and when I'm outside and away from electricity, this works quite well. It also heats up a lot faster than my 45W electric iron, which is why I chose it for this repair.

I also like the fact that it not only can be used as a torch for heating plumbing joints, loosening stubborn bolts, etc...


But it also features a hot air nozzle if you remove the solder tip. That's great for shrink tubing, de-icing locks, warming solder paste and removing surface-mount components.

Exploiting in-game logic flaws

Another one of my favorite games of days gone by is Maelstrom. I first discovered this my sophomore year of high school. Someone had installed it on quite a few Macs in the computer lab. It's a 3D-looking Asteroids rip-off. When I finally built my first Linux system for home use in the mid-90s, this was one of the first games I found that worked well. It had been open-sourced.


It's got all the features you'd expect of an Asteroids clone: Shields, UFOs that shoot at you from time to time, and... asteroids. There are also comets (shoot for more bonus points), surprise packages (catch them with your ship to get different weapons or other surprises, some good, some bad), metal asteroids you can't destroy, and the occasional black hole (or Maelstrom, if you will)


One thing I noticed early on, is that if you ever blow your ship up on the last asteroid, you don't actually lose a life, but any special weapons you have will go away.


But, if you look, your shields get replenished back to new when you start the next wave (level)


This happened because there are some logic problems at play. Primarily, the logic to reduce your lives by 1 (or to end the game if you're at 0 like I was) does not run as part of the block of code that initializes the ship's options to default when it's struck, and is somehow missed because of the end of a level. Was it intentional? I have no idea without checking the source code. It's always possible stuff like this is actually an easter egg.

This is the kind of bug that slips through the cracks and is only noticeable during code audits or caught with fuzzing or other black-box testing methods. Often, by invoking conditions that happen rarely, you can get unexpected results. If you can leverage those conditions to happen easily, you can reproduce the results as frequently as you wish. In Maelstrom, it's as simple as sacrificing your ship to knock out that last asteroid, knowing you'll get rewarded with shields for the next round. The same applies to operating systems, the firmware running on your mobile phone and cable box, and pretty much anything else that's been programmed by a human.

Have you found any little game bugs worth exploiting?

Operating System Junkie

I've talked about the computers in the Lab-O-Ratory before. Today, the laboratory is really, really noisy -- more so than usual. I'm always working on something and I'm coming to realize that I'm pretty much a hopeless operating system junkie.

The photo is from a few months ago. The SparcStation 20 on the top of that photo used to be my OpenBSD 4.1 DMZ box until the hard drive died. I shelved it for a while and replaced it with a fresh install of OpenBSD 4.4 on one of the noisy 1U rackmount cluster servers from the startup I worked at in early '06. That 1U now sits in the SS20's old spot on top of the Sun Ultra 5 (which happens to be one of my primary workstations, running Solaris 10)

A few weeks ago, a friend of mine gave me a pile of old SCA-80 hard drives -- 4GB, 9GB stuff that was going to get landfilled. I put some of them in the SS20 again, and decided to try NetBSD. I used this for the SSH Reverse Tunneling article. It's now on the top of the lower stack, below the FON and Jornada and on top of the beige low-profile server.

That's an IBM RS/6000 Model 250 -- 80 MHz (yes, really) with 256MB of RAM and a 36GB SCSI hard drive. Initially made to run IBM's AIX 3.x operating system, it still runs AIX 5.1 quite well as long as you keep the GUI from trying to start. After AIX 5.1, IBM dropped all support for Micro-Channel Architecture. Still, having AIX 5 to tinker with is beneficial to me. I have to deal with AIX (as well as Linux and Solaris) at my real job. Don't forget all the cool freeware that's been ported to AIX and Solaris!

The Dell PowerEdge server below it was going to be an AMP (Apache/MySQL/PHP) server for a client of mine who never ended up needing it. It gets re-purposed whenever I need a reasonably powerful machine or one with a lot of storage to test something on. I just installed FreeBSD 7 on it last night. This one's even more noisy than the 1U cluster server.

My wife bought a 4U rackmount case from Frogman back in the day, and it was originally built up as a telnet MUD server. Now, it's kind of the communal Windows 2000 test box. It's the HiR OpenArena server for the time being.

Then, there's the Dell Optiplex mini-tower out of frame that's still running BackTrack -- although after Mubix wrote about it, I plan on downloading Sumo very soon!

With so many of my own little projects going on and utilizing all these boxes, I'm currently running all of this in my apartment's second-bedroom-turned-laboratory:

• OpenBSD 4.4 / x86
• Solaris 10 / ultrasparc
• jLime Linux (Mongo) / arm
• Openwrt Linux 7.09 / mips
• NetBSD 4.0.1 / sparc
• AIX 5.1 / ppc
• FreeBSD 7.0 / x86
• Backtrack Linux 3 / x86
• Windows 2000 SP4 / x86

That's not even considering that my wife's laptop is running Vista, and I'm running Mac OS Leopard on my own. I'm no stranger to lesser-known OS's either. I've written about OpenSolaris before. I used to run BeOS as my main platform at work. I've used Plan 9 before (in the late 90s) and I even helped a little bit with the now-defunct V2OS project in 2001.

What's next? I think I need to mix it up with ReactOS (Windows clone) or Haiku (BeOS clone) or perhaps try Plan 9 again...

More OpenArena Fun

First and foremost, this is just a concept, but L3DGEworld is an OpenArena-based visualization platform for network hosts. Currently, the main info-gathering daemon (Greymatter) only supports FreeBSD. I tried compiling it on OpenBSD and the code doesn't quite get along with OBSD's C Compiler. Fakematter, the demonstration daemon, however, does work. I just want to know if I can frag other sysadmins while I'm in L3DGEworld!

Also, The HiR Information Report OpenArena server is up and running using my wife's old rackmount server as the donor platform. It will probably get listed eventually on the Internet server list in-game. Otherwise, you can click "specify" and connect to openarena.h-i-r.net:


Maybe we'll have it set up for a weekly deathmatch or capture-the-flag brawl.

Open-Source gaming: OpenArena

I'm not a big-time gamer, but on occasion I get the urge to blow stuff up. I'm also not exactly rich. It would be silly for me to spend a lot of money on a console, or even $50 on an FPS that I probably won't play every day. It is for this reason that I really, really like OpenArena.

OpenArena is based on the ioquake3 engine. Ioquake3 is, in turn, based on GPL'd Quake3 code form id Software. While ioquake3 is little more than a framework for games, OpenArena takes it and packages the engine along with other GPL licensed content (level maps, weapons, character models and such) to give you a ready-to-play Quake3 clone, and for free!

Maybe in the near future, I'll set up an OpenArena server so we can duke it out. Otherwise, look for me (ax0n) playing on some of the Capture The Flag servers.

More BIOS update info.

I posted some time ago about upgrading a mobo without Windows or DOS. That process still needed one to use a floppy to perform the update. On more modern systems we can get by with nothing but the hard drive you already have installed. I recently picked up a Dell Optiplex GX280 from the usual source and of course it came without the hard drive and RAM, and it never had a floppy drive installed. I sourced a hard drive from my previous workstation, picked up some new RAM and booted the Ubuntu 8.10 install on the drive. The machine was still running the original A00 BIOS it shipped with. I then did a bit of digging and found out that Dell has been working to make updating the flash BIOS on their systems much easier under Linux -- so easy that it's literally just about cut-n-paste for the command line wary. A blog post gave the steps to get it done under Debian, and they worked just fine under Ubuntu. I already had the larger uni and multi repos enabled so all it took was to nab the correct .hdr BIOS image and get to work. It wouldn't take much work at all to get this into a point-and-click setup and have it be as dead simple to do as under Windows.

I'm surprised how easy this was to do, and this system is four years old. Linux is really coming into it's own.

The dangers of proliferation of shared FTP accounts

In a medium sized education organization which shall remain anonymous; FTP and windows file sharing is the file transport of choice for distributing small reports and data chunks. For a long time when a ftp account was needed the person would simply call up the first person who maintained a server that came to mind and had one created. The new ftp account was then fed into a script on the database server (mainframe or AS/400) which then once a day/month/year it spit out a report and uploaded it to the server where (someone/something/every one) picked it up and either loaded it into a different script, or dumped it into a spread sheet, did their business then deleted it and went to lunch.

This has gone on for decades with out some one pointing out that there is something wrong with this process.

Let me count the ways this is wrong:
1. It's not encrypted.
Packet sniffers are very easy to implement even on a switched LAN.
2. There is no way to prove that the remote host is what it says it is.
Server spoofing via DNS or Denial of Service.
3. Access control (in this case) isn't managed.
Static user names and passwords being passed in the clear.
4. Proliferation of potentially sensitive data
Just about every industry is required by law to protect certain kinds of data.
5. Use of old and un-maintainable server for warehousing information.
No warranty, use of old 3rd party software which is unmaintained, End-of-life OS.
It's potential for being 0wned is pretty high.
6. Total disregard of Intranet and Internet facing status of server.

Why? You ask has this issue been allowed to even occur?

Reason #1 Impending retirement. Why would some one who is retiring in 5 or so years would want to learn something new? Ftp and windows file sharing is well known. Ftp has been used on open systems since their inception so everybody supports it. (I mean the standard supports 7 bit file transfers, from the time when bits were expensive, really when is the last time you NEEDED to transfer something using 7 bits as opposed to 8bits?).

Reason #2 Bypassing the chain of command. Why follow protocol and make an official request when you can call the person maintaining the server and have them do it for you.

Reason #3 Maintainers versus dedicated IT staff. In most small and medium organizations, they cant afford dedicated IT staff so they give the position to some one who already does something else. The problem is that the person just puts out fires and performs maintenance. They don't keep up on industry issues and so long as the server limps along everything is fine.

Conclusion:
Because the chain of command is bypassed the Network Administrator isn't aware of it. And the only way he or she will find out about it is either an audit, if it fails or if the server is totally Pwned and now is now selling generic Viagra. Should the latter be the case, a pile of finger pointing ensues and you can guess the rest.

Alternatives:

The solution is finding a suitable replacement technology which is secure and possesses controls on access and availability yet is similar to an existing process so you take advantage of the users existing habits instead of putting them into an uncomfortable situation of learning some "NEW" computer process.

1. Pre configuring the email client to use encryption. Email is one of those skills that every one knows or should know.
   
2. Implement Ftp over SSL on a managed file server .(Windows, Linux, Novell ...etc) Most of them have some form of secure drive mapping or mounting which is done transparently to the user. This really is the best choice because most modern server platforms possess some form of auditing features which allow you to track access to resources and or files.
   
3. Secure web application for reports and data. Automate the process and load it into a database then generate the reports on a web page or make it available as a download. A well designed web system can contain all of the controls to keep data safe. Surfing the web is a national pastime, provided you make a usable web interface.

Perhaps in conjunction with...

1. Controlling movement of data. Prevention of use of external storage devices.
   
2. Encrypting file contents using authentication. Smart cards, public/private keys, hardware keys...etc

Information security is not about being perfectly secure, it's about maintaining a good balance of security vs. usability.