A generous gift - Into The Breach

Michael Santarcangelo, II has given us (the community) a generous gift. A while back, I wrote a review about his book, Into The Breach.

Today, he authorized HiR Information Report to give you access to the e-Book version for free.

Simply order the book online, then apply coupon code: hir31337

You can also purchase hard copies (and ask for an autographed one) as well. While you don't have to agree with Michael's take on things, It's a good read that might change the way you and your managers think about breach of data in the enterprise.

Thanks, Michael!

Reverse Tunnel with SSH

Inspired by a thread on the Hak5 Forums...

Sometimes, you might find yourself wishing you could poke arbitrary holes through a NAT or firewall. The potential uses (both good and evil) are nearly limitless. Perhaps you want to be able to log in to the computer in your dorm room while you're a thousand miles away on vacation with family.

You will need a few things before we start:

1. Physical access to a computer on the "inside" of the network
2. Access and permission to install software on that computer
3. A system on the "outside" that can accept SSH connections from the Internet

It helps if the 2 computers involved are running Linux, Mac OS X, BSD or some UNIX variant, but you could probably use PuTTy on Windows for the "inside" computer in a pinch.

I'll be using NetBSD on my SparcStation 20 on the inside of the HiR Lab, and one of my web servers with a public IP address on the outside.

SSH Tunneling is the process of encapsulating some other protocol within an SSH session. There are many advantages to this. Essentially, if you can get out of a network with SSH, you can get to almost any TCP service on the outside world, even if it's blocked.

Reverse SSH Tunneling is a similar process. If you can get out of the network with SSH, you can use that SSH tunnel to spawn a listening process on the outside of the network, from which you can get to anything internal.

Step One: Deploy SSH keys without a password
This has to be done from the "inside" computer. You can use your personal desktop system or a server where you have an account. It must be able to SSH out to the Internet.

I don't like to use public keys without passwords, but they do come in handy, particularly for tunneling. The un-protected public key should only be placed into the authorized keys list for UN-TRUSTED accounts that aren't in the wheel group or sudoers file.

I wrote about using passwordless SSH keys before. If you're using a UNIX variant, just follow the first few steps on generating and distributing the ssh keys. If you're using Windows, install PuTTy and follow the steps that Steve Friedl put together.

Step Two: Create and test your tunnel
I wrote a little about tunneling (forward and reverse) back in February. In this case, I'm going to tunnel SSH over a reverse SSH connection -- that is, I'm going to SSH from my inside box (NetBSD) to the web server (betaweb.h-i-r.net), and tell SSH to open a reverse tunnel port (2222) on the web server that connects to the SSH port on the NetBSD box (localhost:22). The -g option allows any remote host to use the tunnel. Otherwise, it will bind only to the localhost interface.

[axon@NetBSD]$ ssh axon@betaweb.h-i-r.net -g -R 2222:localhost:22
Last login: Sun Nov 30 14:13:08 2008 from netbsd.labs.h-i-r.net
[axon@betaweb.h-i-r.net]$

Now, from anywhere in the world that can access port 2222 on betaweb.h-i-r.net, I can SSH through my home NAT to get to the internal NetBSD box:

Chimera:~ axon$ ssh -oPort=2222 axon@betaweb.h-i-r.net
Password: [my password]
Last login: Tue Oct 14 19:01:57 2008 from localhost
NetBSD 4.0.1 (GENERIC) #0: Wed Oct 8 01:06:02 PDT 2008
Welcome to NetBSD!

[axon@NetBSD]$

You don't need to reverse tunnel to localhost, and you could just as easily use this trick to reverse-tunnel your e-mail (POP/IMAP), VNC to a Windows/Mac desktop or even to an internal web proxy server.

Step 3: Automate!
If you just leave the SSH tunnel up and running, it won't likely last too long because of session timeouts. You'll need some process to start the tunnel. Here's where you can get creative. Obviously, a process involving the use of cron or at would be one way of going about it. A script running in the background (with nohup) or in a screen session could also take care of things nicely. One idea I had was to set up fetchmail to check a dummy e-mail account every 5 minutes or so. If there's new mail, it initiates the tunnel. Send mail. Wait. Tunnel. Another way would be to upload a file to a web or ftp site to trigger it. You could even make it read information from that file to create the tunnel for different protocols. I opted to create a configuration file on the web server that would be downloaded and used.

On the "inside" box, I created this script and called it tunnel.sh:

#!/bin/sh
ssh betaweb.h-i-r.net rm .tunnel
args=`cat .tunnel`
rm .tunnel
ssh $args

Then, I added this to my crontab:

*/5 * * * * scp axon@betaweb.h-i-r.net:.tunnel ~/.tunnel && ~/scripts/tunnel.sh

Every five minutes, it will try to scp a file called ".tunnel" from the "outside" box. If it was successful, it runs the tunnel.sh script.

The tunnel.sh script removes the .tunnel file from the remote box (so that it doesn't try to spawn multiple tunnels every 5 minutes) and then uses the contents of .tunnel as the arguments for ssh.

I create a file on my laptop named ".tunnel" and add the following:

axon@betaweb.h-i-r.net -g -R 2222:localhost:22 sleep 600

Then, I upload it to the location and wait about 5 minutes. Then, I ssh to port 2222 of betaweb.h-i-r.net. The "sleep 600" is executed on the remote end, which means it will only stay connected for 10 minutes (600 seconds).

Tada!

chimaera:~ axon$ scp .tunnel axon@betaweb.h-i-r.net:
axon@betaweb.h-i-r.net's password:
stdin: is not a tty
.tunnel 100% 58 0.1KB/s 00:00

[ wait 5 minutes ... cue Jeopardy theme song ]

chimaera:~ axon$ ssh -oPort=2222 axon@betaweb.h-i-r.net
Password: [my password]
Last login: Tue Oct 14 23:24:10 2008 from localhost
NetBSD 4.0.1 (GENERIC) #0: Wed Oct 8 01:06:02 PDT 2008
Welcome to NetBSD!

[axon@NetBSD]$

Considerations and Risks:
I've already stated that using public keys without a password is risky business.

The other shady business is directly executing anything using arguments pulled from some file on a remote server. All it would take is "; [insert evil command here]" added to the .tunnel file and havoc can potentially be wreaked on that internal box.

If you can get away with it, BY ALL MEANS use separate accounts that are not used for anything other than this tunneling process. Lock them down as best you can and be mindful of local privilege escalation attacks.

See? This is why admins put firewalls up in the first place. And don't go pointing your finger at me if you get in trouble for unauthorized tunneling.

We've got cards, yo! (and 2600 This Friday)

It's hard to tell, but there's green source code in the background of the front of the card. These are MiniCards by Moo.com. They've got a nice finish. I'll be handing them out to the HiR crew soon. We were all sick of being at conventions and events without being able to hand anyone some contact info. The e-mail address on the back will spam the whole team (so please don't abuse it?) Note: AsmodianX@, Frogman@, tmib@ and ax0n@ will get to individual writers at h-i-r.net.

Also, the KC 2600 meeting is coming up in one week. Same time and place. Oak Park Mall food court at 5:00PM.

Capacitor Plague

"Capacitor Plague" is the colloquial term for a vast range of electrolytic capacitor failures, most often used when several capacitors on a circuit board are bulging or have burst. The following photo shows the cooked acidic residue that sprayed out from several capacitors hiding under the mechanical part of one of my DVD players.


In my case, the residue had been cooked onto the backplane and corroded several surface mount components. This cheap DVD player is a write-off. I could probably fix it, but it would be more trouble than it's worth.

Capacitor plague is common on older motherboards and video cards, as well as in other chintzy consumer electronics. When it happens, there's usually a hiss or a pop from the device. If you catch it (and clean up the electrolyte using flux cleaner or high-grade isopropyl alcohol if any leaked) before it ruins something else, you can usually buy and solder in replacement capacitors of equal value. Remember, though, that many capacitors are polarity sensitive.

Electronics repair tips:

• If polarity is marked on a component (by a colored band down the side of a capacitor or a band around the positive end of a diode), mark the positive terminal on the board before removing the component. I usually just put a black dot near the positive terminal on the solder side of the board using a permanent marker.
  
• Avoid confusion of parts by replacing only one failed component at a time.
• Use a grounded work mat and a wrist strap to avoid a static discharge that could damage the part you're working on.
  

Security Bloggers Network is back online

SBN is now powered by lijit networks. Here's the RSS Feed for SBN as well.

As of right now, Security Bloggers Network is the combined buzz of about 180 different blogs, all of which have at least partial focus on information security. Drop it into your RSS aggregator and start getting fed.

Update: Security4All has pointed out that the SBN site and feed aren't working right now. They were a bit ago. Keep your eyes on the links. It'll probably be back this weekend.

Okay, looks like it's online at www.securitybloggers.net now.

GMail In Terminal Mode - Really (with Links-SSL)

Sorry to make a second post about this, but I got all nostalgic about the Terminal theme for GMail, and it reminded me that you can actually access GMail with a text-only browser.

It's been a while since I've done it this way, but Gmail actually plays along quite nicely with the Links (not lynx) browser, as long as you have it compiled with SSL support. If you use Links in X11, you can even use the mouse to click on things.

GMail Themes? Terminal Mode!

GMail recently enabled a Theme feature. I couldn't resist using the new "Terminal" theme. I'm such a nerd.