"Viral" Like-Jacking on Facebook

It's out of control. Perhaps you've started to see a lot of stuff like this lately:


The title is provocative, mysterious or racy. Maybe it's scantily-clad ladies, the promise of a hilarious video, or in this example: from the title, it's implied that we're about to see something bad that our own President did.

The formula is always the same, though. You're taken to a page where you need to click something to continue...


Those who are paying attention will notice that on these pages, pretty much the entire page seems clickable according to the mouse cursor. That's because there is an invisible "Like!" button floating under your mouse the whole time. Unless, of course, you're running NoScript (which I've mentioned before). NoScript won't even load the page properly. Even if you disable JavaScript protection, ClearClick will alert you to what's about to unfold. Note the "thumbs up" icon.


What's happening is that there's a little 10x12 pixel iFrame named "fbframe" being rendered on the page, and it's being set to invisible using the style tag. You can see that the iframe is loading a URL on Facebook that will add this page to your "likes." This would be in the top left corner of the page, by default.


This snippet is where the damage is done. It's at the bottom of the page, and loads a bit of code that keeps this invisible iframe positioned under your mouse wherever you hover it over the page.


The iframe will intercept your click, even if you click on something that appears to be a valid link. You end up unwittingly "liking" it, and displaying the rogue links to everyone on Facebook. Curious, some of them will click to see what it is, and be taken to the same page. I'd imagine most of these people will also unwittingly fall for it as well.

Clickjacking is nothing new. I believe RSnake named it in 2008 if not discovering it. Facebook's platform, however, is making it very easy for people to create pages that dupe unsuspecting folks into spreading links around virally. Many of these pages could be loading malware to your computer via browser bugs or exploit packs while some others are probably just trying to drive traffic to their site for ad revenue.

At any rate, use NoScript. Seriously.

Slowly growing my soul back...

I'm finally getting back to where I have some time (and the drive) to tinker some more.

I'm going to try to bring back the regular (several per week if not daily) RSS splice-feed of interesting links. I've been slacking on that since April. I wish I had a decent way to make those post here as well, but they only show up in the HiR RSS Feed and in a little box on the right side of the page. I suggest adding us to Google Reader if you don't currently use something else for RSS.

Reprogramming Respironics CPAP and Bi-Level BiPAP Machines

-- OR --

All Your Sleep Apnea Are Belong To Us

Disclaimer: Messing with CPAP settings can cause your machine to no longer function as required by your doctor, and may lead to bad things happening to the operator. Use only the settings that your doctor or sleep technician has prescribed.

I have some oddball CPAP and BiPap machines laying around and I had to reprogram one of them for a good friend of mine. While I was at it, I decided I'd like to figure out what lies in the "forbidden" area that only sleep technicians know how to get to. I'd heard from a friend who uses a CPAP that programming them usually involves unplugging it and pressing some buttons. So I started putzing around with this older model, the Respironics SleepEasy.

It's set to apply constant pressure of 6cm/H2O. Boring. There's not much that one can do with the buttons available to be pressed. They're for things like adjusting the heater attached to the humidifier reservoir, and enabling "Ramp Mode" which, from what I can tell, starts you off at a lower pressure as you try to get to sleep.

After a few minutes, I found that pressing the + and - buttons while plugging in the power did something interesting.

It's an unlock icon on the screen. Pressing + and - now adjusts the CPAP pressure in .5cm increments.

Pressing the humidifier button in this mode allows you to cycle through a few interesting diagnostics and settings. Shown below is the menu that allows the technician to completely disable the humidifier heater. Why? No idea.

This is the screen for adjusting Ramp Mode's initial pressure.

I also got my hands on a more expensive and elaborate bi-level CPAP machine, the Respironics BiPap Plus M Series. These machines usually apply a higher pressure when they sense that you're inhaling, and then drop to a lower pressure while exhaling. There are more buttons and a higher-quality display on this model.

Usually, this is the screen you get in standby mode. Hitting + for "Setup" in the default user mode gives the operator very few useful options.

Holding + and - while plugging it in didn't work on this model. Next, I tried plugging it in while holding the arrow keys, and that did the trick.

Note the unlock symbol as well as a new menu option for "Data" which has a very rich array of statistics buried beneath it.

This machine hasn't been used.

Once unlocked, hitting the Setup menu button provides a lot of features, including the inhalation pressure...

And exhalation pressure.

There you have it. It seems like most Respironics machines are programmed by holding down +/- and arrow keys. These machines seem to be pretty popular. Maybe this quick walk-through will help someone who has to buy (or sell) a used machine.

Sorry I've been silent for so long. I'm still getting settled in at the new job. It's going great, and I have a great team, but there is a lot to do. Also, frankly, my brain is usually mush by the time I get home. Hopefully, I start playing with some cool and new shiny things outside of work again soon.

OUI (MAC Address Vendor) Lookup with PHP

I often find myself writing reporting tools in PHP. For work, I wrote a tool to parse Kismet XML files and generate a nice report out of the data. I may talk more about that later on.

One of the things I wanted to do was to reference an OUI table so that I can include the manufacturer of each discovered access point in the report. I figure this may help some people, as this function seems useful anywhere that MAC addresses show up.

I started with the nmap-mac-prefixes file from the nmap subversion tree (and source distribution), but I had to clean it up a bit and turn it into something halfway friendly to cram into an array in PHP, although I suppose I could have done an external grep or loaded the entire file dirty with file_get_contents(). I opted to load the array using the OUI as the key, though. To do that, I did this ugly bit of shell-fu:

grep -v ^# nmap-mac-prefixes | sed s/[\"\',]/" "/g |\
sed s/" "/"\"=>\""/ | sed 's/.*/\ "&\",/' > ouilookup.php

Which resulted in thousands of lines like this:
"000000"=>"Xerox",
"000001"=>"Xerox",
"000002"=>"Xerox",

Next, I had to make it into a function and add the Array() syntax around it:

<?php
function ouilookup($mac)
{
$ouilist=Array("000000"=>"Xerox",
"000001"=>"Xerox",
"000002"=>"Xerox",
"000003"=>"Xerox",
"000004"=>"Xerox",

[... Thousands of lines ... ]

"FCFBFB"=>"Cisco Systems",
"525400"=>"QEMU Virtual NIC",
"B0C420"=>"Bochs Virtual NIC",
"DEADCA"=>"PearPC Virtual NIC",
"00FFD1"=>"Cooperative Linux virtual NIC");
$oui=strtoupper(substr(preg_replace('`[^a-z0-9]`i','',$mac),0,6));
$vendor=$ouilist[$oui];
return($vendor);
}
?>

The whole thing can be downloaded here: ouilookup.txt (rename to .php)

To use it, simply include the file, and call ouilookup() with the MAC address in pretty much any hex format you want (xx:xx:xx:xx:xx:xx, xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx are common)

A quick and dirty example using PHP from the command-line:

<?php
//oui.php - ouilookup() test
include('ouilookup.php');
$vendor=ouilookup($argv[1]);
echo $vendor . "\n";
?>

$ php oui.php 00:11:22:33:44:55
Cimsys

OpenBSD 4.7 + Chrooted Apache, MySQL & Suhosin PHP

FYI - There's now a page that covers OAMP for all recent versions of OpenBSD. My OAMP series is a popular one. Although OpenBSD 4.7 doesn't come out for 2 more days, the media has already shipped to those who pre-ordered. And, as I mentioned previously, you'll want to get crack-a-lacking on those patches. As of the time of writing, there are already 4 patches to install for OpenBSD 4.7, which affect all architectures.

I'll spare you the verbosity. The installation procedure for getting OpenBSD, Chrooted Apache, MySQL and Suhosin-hardened PHP all working together hasn't changed one bit in OpenBSD 4.7. You can follow my instructions verbatim from the OAMP 4.6 Walk-Through, with one minor difference: make sure you change "4.6" to "4.7" when defining PKG_PATH in your .profile.

I was able to go from an empty virtual machine to a fully-functioning, chrooted install of WordPress in under 30 minutes just by following the instructions (and, of course, pointing the PKG_PATH to the packages on the media, not FTP, since the 4.7 branch hasn't hit the Internet yet)

Now that blogger has the ability to store "pages", I may eventually convert this article series to a living document. There are also some lazy shortcuts I take that kind of go against traditional OpenBSD methods (directly launching stuff from rc.local, editing rc.conf instead of making changes in rc.conf.local, etc) - I may get around to de-cruft-ifying this how-to at the same time. Otherwise: Enjoy!

Back in action

Today was my first day back to work since January 8th.

Officially, I'm a Linux/Windows Administrator, helping a small IT shop wherever they need it while they scale up support for many new end-users around the world. That includes many IT things beyond Linux and Windows systems.

It was much to my delight this morning, while talking with my new boss, that he went over a vast array of security-related items that I'll be working on as time permits. I'm proud to be on a very talented team of folks with a diverse array of skills. While they've been prudent with their security stance, I'll be helping them take security to the next level while functioning as an all-purpose IT guy.

Conspiracy Theory: A Battle.net security shill?

A few days ago, my wife logged in to World Of Warcraft only to find that all of her characters had been pretty much stripped of everything. Her username isn't related to any of her mail or social media accounts, and her passwords are unique between all her various accounts. Her WoW password wasn't easy to guess by a long shot, and complex enough that I doubt it was brute forced.

Her system is up to date and protected with MSE, so I weeded through the various places that services can be stealthily launched from and found nothing suspicious. We then tried scanning with several other free tools such as MalwareBytes, Sophos Anti-Rootkit and others.

No sooner does she complain on the forums, she begins getting a massive influx of scam phishing. Most of these have forged mail headers, but originate from china or the UK and link to sites hosted in all the usual (shady) places. The email address she uses isn't published anywhere, at least in relation to World of Warcraft. Blizzard and Battle.Net are the only places that know that email address.

Blizzard's "official" way to help you secure your WoW account? Selling you a one-time-password keyfob along the lines of a SecurID, shown above. Given the fact that WoW is one of the least-sensitive accounts she logs into and that no other breaches have occurred, I'm kind of doubting that she was hit with something as sinister as a keystroke logger. What's more, is that looking at forum activity, it really does appear that there are a lot of these compromises taking place, and it really seems that WoW is often the only thing being compromised in these attacks.

I'm not one for elaborate conspiracy theories, but this whole thing stinks like a shill to sell keyfobs.