The Underhanded C Contest is an annual contest to write innocent-looking C code implementing malicious behavior. In this contest you must write C code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should do something subtly evil.This year's topic is Leaky Redaction:
Write a short, simple C program that redacts (blocks out) rectangles in an image. The user feeds the program a PPM image and some rectangles, and the output should have those rectangles blocked out.The deadline for submissions is September 30th, 2008. Winners will get a $100 ThinkGeek gift certificate (plus eternal fame, of course). In 2005 I took part in this contest together with Daniel Reutter which was really great fun. See underhanded2005.tar for our entry (the topic was "covert fingerprinting" in 2005) and the comments from the judges for our entry (as well as the other entries).
[...]
Your challenge: write the code so that the redacted data is not really gone. Ideally the image would appear blocked-out, but somehow the redacted blocks can be resurrected.
Open a new tab, enter "about:config" as URL and hit ENTER. Click the annoying "I'll be careful, I promise!" button. Uncheck "Show this warning next time" while we're at it.
browser.urlbar.matchOnlyTyped = true to disable the new, annoying "AwesomeBar" URL bar feature (which is also a huge privacy risk).browser.tabs.tabMinWidth = 60 and browser.tabs.tabMaxWidth = 60 (needs a browser restart). You can even use less than 60 if you don't need any text and an icon per tab is enough for you.extentions.getAddons.showPane = false.bidi.support = 0. You'll probably never need it, so reduce the number of potential bugs and security issues by disabling it.browser.ssl_override_behavior = 2 and browser.xul.error_pages.expert_bad_cert = true (thanks Pierre Habouzit).browser.tabs.closeButtons = 3 in order to prevent accidental closing of tabs (no more Close buttons on each tab, only one global Close button on the right). Yes, CTRL+Shift+T helps in case it still happens.network.prefetch-next = false to prevent random prefetching of webpages which means wasting CPU cycles and bandwidth, as well as subtle privacy and security issues.
5,15,25,35,45,55 * * * * user ssh -x user@publicserver /home/user/updateip
#!/bin/sh # Update IP address. echo $SSH_CLIENT cut -d " " -f 1 > /home/user/homeserverip.txtSo to summarize: the homeserver's user simply executes the updateip script on the remote publicserver, which in turn abuses the $SSH_CLIENT environment variable which contains the public IP the ssh connection was coming from (which is exactly what we're looking for). We store that IP in the homeserverip.txt file, which will always contain the latest-known IP address of the homeserver (because of the cronjob). Getting the current homeserver IP address You can now retrieve the current IP address of your homeserver easily from anywhere (i.e. from your laptop when you're in another, possibly hostile network) in order to connect to your homeserver:
$ ssh -x user@publicserver cat /home/user/homeserverip.txtTo make this a bit more convenient you can add a shell alias (e.g. into ~/.bashrc):
alias homeserverip='ssh -x user@publicserver cat /home/user/homeserverip.txt'Or, to conveniently login to your homeserver as user:
alias homeserverlogin='ssh -x user@ ssh -x user@publicserver cat /home/user/homeserverip.txt 'Conclusion, advantages This may not be the most elegant solution, and it has a number of drawbacks when compared to services such as DynDNS, but it's sufficient for me and it also has some advantages:
OK, so I've been hacking on and testing my shiny new One A110 mini-laptop during the last few days and I must say I'm very happy with it. I'll write up some more details later (check the wiki if you're impatient), but today I want to highlight a very nice feature of this laptop (compared to, for instance, the Eee PC): The VIA C7-M ULV CPU in the laptop has VIA Padlock support.
VIA Padlock is a hardware feature in recent VIA CPUs which provides hardware-accelerated AES and SHA-1/SHA-256 support, among other things. This can be used in Linux (with the proper drivers and patches) to improve performance of dm-crypt, OpenSSL (and all programs using it), scp, sha1sum, OpenVPN, etc. etc.
I have written a quite extensive VIA Padlock HOWTO and benchmarks in the A110 wiki (but all of this will work on other systems which have VIA Padlock, too).
To summarize, here are the most important benchmarks:
dm-crypt (256bit AES, cbc-essiv:sha256)
Without VIA Padlock support:
$ hdparm -tT /dev/mapper/hdc2_crypt /dev/mapper/hdc2_crypt: Timing cached reads: 448 MB in 2.00 seconds = 223.47 MB/sec Timing buffered disk reads: 22 MB in 3.07 seconds = 7.17 MB/secWith VIA Padlock support:
$ hdparm -tT /dev/mapper/hdc2_crypt /dev/mapper/hdc2_crypt: Timing cached reads: 502 MB in 2.00 seconds = 250.41 MB/sec Timing buffered disk reads: 90 MB in 3.07 seconds = 29.36 MB/secThe native speed of the SSD in the laptop is 31.01 MB/sec, so there is almost no performance penalty when using VIA Padlock. OpenSSL OpenSSL speed benchmark, first line without Padlock, second line with Padlock enabled:
$ openssl speed -evp aes-256-cbc [-engine padlock] type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-256-cbc 9187.18k 10572.28k 11054.32k 11179.36k 11218.02k aes-256-cbc 47955.92k 150619.73k 325730.73k 458320.11k 520520.79kssh/scp Without VIA Padlock support:
$ scp -c aes256-cbc bigfile.dat localhost:/dev/null bigfile.dat 100% 159MB 5.9MB/s 00:27With VIA Padlock support:
$ scp -c aes256-cbc bigfile.dat localhost:/dev/null bigfile.dat 100% 159MB 14.5MB/s 00:11OpenVPN A real speed benchmark is pending (not measurable easily on 100MBit LAN, will try on a slower link), but as OpenVPN uses OpenSSL is should have roughly the same speedup iff you tell OpenVPN to use AES (it uses Blowfish per default). Also, there's a measurable difference in CPU load while tranferring large files over OpenVPN: 8% CPU load with VIA Padlock (vs. 20% CPU load without VIA Padlock). sha1sum / phe_sum phe_sum is a small C program which can be used as drop-in replacement for sha1sum (which doesn't support VIA Padlock yet). Quick benchmark: sha1sum, without VIA Padlock:
$ time sha1sum bigfile.dat real 0m6.511s user 0m5.864s sys 0m0.412sphe_sum (with VIA Padlock support):
$ time ./phe_sum bigfile.dat real 0m1.149s user 0m0.704s sys 0m0.424sAll in all VIA Padlock gives you a pretty impressive speedup for many crypto-using applications on Linux, which is especially useful on the A110 mini-laptop (think OpenVPN or scp for mobile usage, and dm-crypt for an encrypted SSD, of course).
OK, so I've spent my last money on the One Mini A110 subnotebook recently. Yep, yet another ASUS Eee PC clone, but this one has the great benefit of costing only 199.- Euros and has similar specs as the Eee PC 2G Surf (700), I think.
This is really a great little machine as far as I can tell. It's a VIA C7-M ULV 1GHz with 512MB DDR2 RAM and a 2 GB Solid-State-Disk (SSD), 7" screen at supposedly 800x480, VGA out, card reader slot for SD/MMC/MS, 2x USB, wireless, modem, audio. No webcam, no bluetooth.
Yesterday I created a wiki at a110wiki.de (for the A110, but also the A120 from the same vendor, which has a 4 GB SSD), where A110 users can collect information, HOWTOs, photos, etc. There's already quite some content there, especially some early tutorials and photos on the inner workings of the A110.
Today I've installed a stock Debian unstable distro on the SSD with 2.6.25 kernel, and I'm currently checking which parts of the hardware work out of the box, and which need further fixing. There's a a bunch of source code tarballs and patches on the vendor website, but most of it seems to be meant for 2.6.22, we'll see if and/or how much work it'll take to merge all this upstream (if it's not already done)...
My Debian Installation HOWTO is also available from the wiki, of course; I'll add more info and photos during the day.
Now for all interested parties: The vendor of the A110 has (again) announced a special weekend offer (valid until Sunday, June 1, 2008, i.e. tomorrow) where they'll sell the A110 for 199,- Euros again, the regular price will be 229,- Euros after that. So if you're thinking about buying one, now is probably the right time.
Check the wiki for issues which are important to you, some quirks remain at this point (but will probably mostly be figured out sooner or later), e.g. the wifi seems to have issues (the vendor said they'll send a driver update to all affected customers), the RAM is builtin and can't be upgraded, and some other, more or less important issues, depending on what you expect from the laptop.
For real-time communication there's also the #a110 IRC channel on Freenode.
startx (which is what I usually do) you might have experienced brokenness in Debian unstable recently:
Fatal server error: Unrecognized option: /etc/X11/xinit/xserverrcThis is already reported as bug #482425 and #482527 and should hopefully be fixed soon, but in the meantime this patch against /usr/bin/startx should work around the issue:
--- /usr/bin/startx.orig 2008-05-26 18:21:26.000000000 +0200
+++ /usr/bin/startx 2008-05-26 18:21:36.000000000 +0200
@@ -107,9 +107,7 @@
if [ x"$server" = x ]; then
# if no server arguments or display either, use rc file instead
if [ x"$serverargs" = x -a x"$display" = x ]; then
- server=$defaultserver
serverargs=$defaultserverargs
- display=$defaultdisplay
else
server=$defaultserver
fi
Hope that saves some people out there lengthy investigations and hassle.
Chris Watson at Silicon Mechanics says: "We will commit to offering coreboot preinstallation on the Rackform nServ A236 with a specific set of hardware and software. In the future, we may expand the program to additional platforms based on customer interest." The A236 is a nice 1U server with 4 drive bays and a dual Opteron board (Supermicro H8DMR), which is supported in coreboot v2.Nice to see more and more vendors shipping their products with coreboot pre-installed...
You might remember that I wrote a blog entry about my switch to the green electric utility "Lichblick" (Germany) a while ago. I did that purely out of environmental reasons, I didn't want to continue to waste money on polluting and/or dangerous crap such as fossil or nuclear power. Yes, even if that meant a slightly higher price (but I really didn't compare prices much before switching — I was after an environmentally clean solution, not the cheapest solution).
Quick status update: the switch went really nice and easy, no downtimes, no hassle. I've been a happy customer for more than 8 months now.
Today in my snail mail inbox: a letter from Lichtblick that they're going to reduce the price per kWh from 20.25 to 19.99 (Euro) cents starting July 1st and they give you a guarantee that there won't be any price raises before the end of 2009 (more details also here). Now, that's a positive surprise there.
Compare that to 98% of all other energy providers in Germany who have lately increased prices quite a lot for very obscure or non-existant reasons.
Yes, I do realize that the reduced costs are not that dramatic, and Lichtblick is using this as a means to impress people and gain new customers. But I fully support them in doing so, the more people are switching to a green energy provider the better, if you ask me. I encourage everyone to consider switching, either to Lichtblick, or some of their competitors (in Germany) e.g. Greenpeace energy, Elektrizit tswerke Sch nau, or Naturstrom AG. There are various alternatives in other countries too, of course.
You might have already heard of it — the new Nine Inch Nails album "The Slip" has been released by them under the Creative Commons BY-NC-SA 3.0 US license. Yep, that's right, it's totally legal to download it from the web — and use it for any non-commercial purposes!
It's a bit annoying that they want your email address, though. Nothing that bugmenot.com (or similar) cannot fix, but still. Luckily, the files are now also available from archive.org! This, and the fact that the music is CC-licensed allowed me to "play" one of the songs in my Creative Commons music podcast (RSS), and more will likely follow.
$ esd -public -nobeeps -tcpYou can do this as regular user (no need to be root) if you have the proper permissions. You also need to allow connections on port 16001 in your firewall settings. Then you can redirect audio to that daemon from another computer. In this example I'm redirecting some music using various players:
$ esddsp -s 192.168.0.xxx:16001 mpg321 -o esd foo.mp3 $ esddsp -s 192.168.0.xxx:16001 mplayer -ao esd foo.mp3 $ esddsp -s 192.168.0.xxx:16001 ogg123 -d esd foo.oggThis also works fine for videos, in which case you can redirect the audio (but not video):
$ esddsp -s 192.168.0.xxx:16001 mplayer -ao esd foo.mp4For the video player Miro, I've recently documented this in the Debian package's README.Debian file. Basically you have to edit ~/.xine/config and enable audio.driver:esd there, then start Miro with
$ esddsp -s 192.168.0.xxx:16001 miroAudio will be emitted on the remote host, video remains on your local PC. Some programs may also support esd natively, in which case esddsp is not required, e.g.
$ ogg123 -d esd -o host:192.168.0.14:16001 foo.ogg
This project aims to integrate into the coreboot BIOS a payload consisting of a minimalist KVM-aware Linux kernel along with an initrd image that contains the tools needed for creating and starting guest virtual machines installed on top of it. The resulting system could host any x86(or x86-64) OS that can run over KVM (almost any major OS does), and there is a great challenge to make it as small as possible, so that it can fit in a 2MB flash image.
Currently coreboot can not boot from an arbitrary SCSI controller. There are two solutions for the problem: (1) Use Linux and Kexec. This requires to keep the SCSI driver in the flash chip. (2) Use x86emu/vm86/ADLO and the int13 method. This would allow to use the PCI option rom available on all modern SCSI controllers. So we obviously need a solution based on the latter. This could as well be implemented as a Linux program, as an intermediate payload, or as a shared library. At this point of time, I would like to implemente it as a daemon program. The program needs to catch the int13 interrupt vector that the SCSI option rom installs and make it available to arbitrary (firmware/payload) code trying to load something from disk.This should make for an interesting summer with nice improvements for coreboot.
fetchmail (and that would fill up my disk) just sucks. So, after getting a cheapo 160 GB 2.5" disk (the old one was 80 GB), I had to move all my data to the new disk.
As I didn't want to re-install from scratch I started with dd'ing the whole disk over to the new one (using a live CD and an external USB hard-drive enclosure). This took pretty long, but went fine otherwise.
The new disk then contained all my partitions (hda1-hda3) and also GRUB in the MBR etc., as expected, but was still only 80 GB in size, of course. So the first step is to enlarge the hda3 partition, which is a dm-crypt volume that contains various LVM logical volumes (for /home, /usr, /var, swap, etc.), each of them using the ext3 filesystem (except for the swap volume, of course).
0. Perform backups, boot from a live CD
Important: If you plan to perform any of these steps, make sure you have recent backups! I take no responsibility for any data loss you might experience. You have been warned!
First off, you should boot from a live CD which has all the tools you'll need, including cryptsetup, LVM tools, resize2fs, etc. You can use the nice grml live CD for instance.
1. Resize partition
This sounds scary (and it is!), but the way I enlarged the encrypted hda3 partition was by first deleting it via fdisk. First, issue the "p" command in fdisk, write down the exact start cylinder of hda3. Then delete hda3. Now create a new hda3 partition which starts at exactly the same cylinder as the old hda3 but is larger, i.e. in my case it has ca. 80 GB additional space.
Your data will still be there if you don't screw up, and the partition is bigger now. Using something like gparted will likely not work as expected, as the partition is encrypted!
2. Resize dm-crypt volume
Nothing to be done, it seems dm-crypt automatically adapts and notices that the partition is bigger. Just "open" the encrypted volume using cryptsetup now:
$ cryptsetup luksOpen /dev/hda3 foo3. Resize LVM physical volume Next step is to tell LVM about the new space. We first resize the LVM physical volume on the
foo "partition".
$ pvresize /dev/mapper/fooThat will use all newly-available space for the volume. 4. Resize LVM logical volume Now we can pump the new space into any of the logical volumes (or into multiple ones). I only increased one logical volume, my /home:
$ lvresize -L +74 GB /dev/vg-whole/lv-home5. Resize ext3 filesystem The final step is to resize the ext3 filesystem on the
lv-home logical volume (after running the obligatory fsck -n). I first used ext2resize, but that failed horribly:
$ fsck -n /dev/vg-whole/lv-home $ ext2resize /dev/vg-whole/lv-home error: Invalid argument: seeking to 3258921205760This seems to be a known bug, ext2resize apparently cannot handle large disks or something, and as I found out a few minutes later it's pretty much deprecated anyway. The better solution is to use resize2fs:
$ fsck -n /dev/vg-whole/lv-home $ resize2fs /dev/vg-whole/lv-homeThat's it. We can now reboot the system from disk and enjoy ca. 80 GB of additional hard drive space. Yay!
If you want to generate a custom Debian live CD, including only the tools you want (and maybe additional tools you don't find in other live CDs) there's a really simple solution: live-helper.
Creating a basic bootable Debian live CD ISO image in the current directory is as simple as:
$ lh_config $ lh_buildThat's it. The result will be a file called binary.iso, which you can either burn on a CD-ROM via
$ wodim binary.isoor test in QEMU using a command line like this:
$ qemu -boot d -cdrom binary.isoOf course there are many possibilities to customize the generated image to your likings, see the documentation in the Debian wiki, or the lh_config/lh_build manpages. Please note that live-helper can not only generate CD ISOs, but also bootable DVDs, images for USB thumb drives, or netboot images. There's also a nice GUI called live-magic which will make the process a bit easier if you don't like doing things on the command line.
Next.