Author Archive for Edwin

Google DNS

A few weeks ago, Google announced that they are making available public DNS servers. They claim that it “provides many benefits, including improved security, fast performance, and more valid results.” And for some people, that might be true. They also claim that they are adhering to DNS standards, unlike many ISP and OpenDNS implementations, by not redirecting you to some crappy ad-filled search page when you fat-finger a URL. And as for privacy concerns:

With Google Public DNS, we collect IP address (only temporarily) and ISP and location information (in permanent logs) for the purpose of making our service faster, better and more secure. Specifically, we use this data to conduct debugging, to analyze abuse phenomena and to improve our prefetching feature. After 24 hours, we erase any IP information.

Google goes on to say that they are not tying any information to your Google account, or sharing it with anyone else. They don’t say they aren’t going to use it, though, but any data they retain won’t be personally identifiable. That eases most of my concerns. And it’s far better than most other DNS providers offer. I would not trust my ISP not to sell my information, and OpenDNS openly admits they are selling that information, but claim that it cannot be traced back to individuals.

So far, Google is coming out on top in privacy concerns and adherence to standards. But what about performance? Enter NAMEBENCH.

Namebench is a recently released tool that benchmarks the response time of hundreds of public DNS servers and shows you the best on for your situation. Just open the file and click “Start Benchmark” and after a short wait, it spits out a handy webpage with the results and recommendations. Very easy.

Results may vary.

As for the results…..I ran the test 5 times, and got 4 different results. After another 10 attempts, a clear winner had emerged.

Most people probably aren’t going to notice a difference in speed or stability, but then again, this blog isn’t for “most people.”

Help Me Name My Goddamn Cats

So Lenore and I got a couple cats a few weeks back. They are a brother-sister pair of ~1 year old Maine Coons. The girl was named Pepper Lily or some shit and we forgot what the boy’s name was, so we decided to give them new names. We’ve been calling them boy-cat and girl-cat since we brought them home.

So far we’ve tried:

  • Doris and Boris
  • Littlefoot and Bigfoot
  • Champ and Idiot
  • Bananas and Potatoes
  • Perl and Bash

Both parties are okay with Perl, but we (Lenore) is iffy on Bash. She also vetoed Java.

Also shot down were any references to Firefly, Star Wars, The Wire, and Jim Groom.

I would prefer a computer or internet reference that could also sound like a regular name to the hoi polloi.

We will also accept a pair of people names with some kind of reference to history, movies, TV or computer games.

So I ask you, Internet: name my goddamn cats.

SOME PHOTOS FOR REFERENCE:

If you look at it long enough he starts to look like he's retarded.

Boy-Cat: If you look at him long enough he starts to look kind of retarded.

Girl-cat: she flips shit over that thing.

Girl-Cat: she flips shit over that thing.

Boy-Cat again.

Boy-Cat again.

Hilarious.

How we find Girl-Cat every morning.

What a lady.

What a lady.

AWWWWWWW.

AWWWWWWW.

That chair has been fixed, in case you are wondering.

The chair broke when boy-cat jumped on it after his twelfth meal of the day.

If you leave the winning comment I will make a custom LOLCAT image for you, or maybe a t-shirt if your suggestion is that good and I like you.

Godspeed, dear readers.

Dear "Boris,"

Sam, Joe and I played Left4Dead with you last night. You played very well. You waited for us (Joe,) you put up with our (Joe’s) antics, and you had a very low rate of friend fire incidents. The ease with which you crowned witches, without fear for your own safety, will continue to inspire me, as I also attempt to crown witches until I get it right. You were easily one of the best I have ever played with, and we missed you and your auto-shotgun after you had gone.

But right before you quit, you set off a car alarm and attracted a horde.

So, in the end…

Kind of a douche.

Just saying.

-Edwin

Dear “Boris,”

Sam, Joe and I played Left4Dead with you last night. You played very well. You waited for us (Joe,) you put up with our (Joe’s) antics, and you had a very low rate of friend fire incidents. The ease with which you crowned witches, without fear for your own safety, will continue to inspire me, as I also attempt to crown witches until I get it right. You were easily one of the best I have ever played with, and we missed you and your auto-shotgun after you had gone.

But right before you quit, you set off a car alarm and attracted a horde.

So, in the end…

Kind of a douche.

Just saying.

-Edwin

That Apache-HTTP-DoS Thing.

This month marks the beginning of weeks of boredom for millions of  pasty teenagers everywhere. To mark this event, some a-hole released an easy-to-use script that makes it trivially easy to bring down an Apache-based website. This script, called “Slowloris,” takes advantage of a fundamental mechanic of Apache. This is not a hack. When run, it opens as many HTTP connections as possible.  Apache servers limit the number of possible connections to prevent runaway usage of system resources. This tool opens as many connections as possible, preventing legitimate users from connecting.
apache

Note: Not IIS :-(

In most large-scale production environments, there is some sort of load balancing or proxy-ing going on, which will prevent the site from becoming completely unreachable. Small and medium scale environments will probably not have this. While there are some options for lessening the impact of this attack, none are entirely effective at preventing it due to its nature. (You can read about those options here.) While this idea is not original, the way it was packaged is bad news. This script is kind of a big deal for the following reasons:

  • Pretty much all standard Apache installations are vulnerable
  • There is no patch, as it takes advantage of how Apache is suppose to work
  • It’s hella easy to use (enough so that “script kiddies” can use it.)
  • One person on one laptop can bring down a website. Not botnet required!

The original script is written in perl. There is also a python implementation called “PyLoris” available here. This is a classic denial-of-service attack running over HTTP against APACHE. This means it will not affect SSH or FTP or whatever else you are running on that server. For the most part, it won’t even eat up system resources too much. For reasons beyond my knowledge, this does not affect Microsoft’s web server, IIS.

HOWEVER:

Any server running iptables (linux) can add the following lines:

iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 -j DROP

These two lines drop any new connections after more than 20 connections have been made by the same source to port 80 within the last 60 seconds. These are pretty arbitrary numbers, and could take some tuning, but they prevent this attack from bringing down a website. (At least it prevents one person from doing it)

There is also a way to limit the number of sockets per IP in Apache, but I do not know how. That would probably be a better solution that the one proposed above. If someone know how to do it, please add to the comments.

A NOTE: It rankles me when people use the term “script kiddie.” This term is extremely dismissive, and is used mostly by crotchety IT professionals who forgot what it’s like to have three months off. I understand that there is a difference between “script kiddies” and “teenager hackers” but for the most part, the two are lumped together. People learn by looking at the examples of others. These kids will use these scripts this summer, but next summer, or the year after, they will be writing them, and making even more work for these same “hardened” IT “professionals.” So, bored teenager: go nuts. Have fun. Learn as much as you can. Just don’t be a douche about it.

ANOTHER NOTE: Yes, in case you are wondering, I do make the “quotations gesture” while I talk “IRL.”

ONE FINAL NOTE: I fully support people writing tools like this. There is nothing wrong with a little more awareness. I do find the timing amusing though.

If you have anything to add, or you find something wrong with my solution, please feel free to leave a comment so that I can take your ideas as my own.

P.S. I tried hard, but I couldn’t find any other suitable images to put here. Sorry.

3rd Party Router Firmware: A Brief Guide

There is a point in many a nerds’ life where he or she finds themselves constrained by their home router. For the confused, it probably looks like this:
Look familiar?

Look familiar?

This little devices sits between your cable modem and your computer. It basically is your “network.” Most people just plug them in, and configure only as much as it takes for it to work. These devices are, at a basic level, computers themselves, and as such have an “operating system” that provides a interfaces for you to tell the hardware what to do (like all operating systems.) Usually, you are stuck with the OS that shipped with the device.

Cut to June, 2003, when some neckbeards on the Linux Kernel Mailing List discovered that Linksys had included components of the Linux operating system in the firmware of their router. Due to the way those borrowed components were licensed, Linksys was legally obligated to release the entire source code for that OS. By studying this code, developers were able to create new operating systems that ran on the same hardware. Several projects aiming to replace the often-buggy stock operating system firmware sprang into existence, all adding new features. The dust has settled since then, and there are many mature firmware flavors to choose from.  I will focus on three, because I’ve used two, and Sam is currently using the third.

DD-WRT: I had pretty good luck with this one, and  have used it on my primary router. I was able to play Diablo 2 with some VPN’ed in while talking to them on Skype with no problems, although I wasn’t able to do anything else while bittorrent was running (this was probably due to limitations of the hardware i.e. it ran at 200 mhz) The DD-WRT project itself has weird issues with trying to make money, and their last stable release was almost a year ago. That being said, it runs on a lot of different consumer-grade routers, and it runs pretty well.

OpenWRT: “Linux is free if your time is worth nothing.” That saying sums up my experience with OpenWRT pretty well. Getting this installed and running was a pain in the ass. That’s not saying it isn’t a good product, but the project itself was in the process of un-forking when I looked at it, and I found the whole thing generally confusing. I was new to the Linux scene when I tried it, and was barely able to get it working. I have not looked at it in a couple years, so maybe it has improved. The OpenWRT also supports a side project called X-Wrt which aims to improve the usability of OpenWRT.

Tomato: I had moved beyond consumer devices by the time I discovered Tomato. But from what I read and heard from Sam, this would probably be my first choice in upgrading my router to new firmware. The most recent update was less than a month ago. As I have never used it, I asked Sam for his thoughts:

Sam here. I’ve been using Tomato for quite a while now, on a WRT54GL (which Edwin gave to me, no less). It has served me well. I don’t think I’ve ever had to power cycle the router. The programmers did a great job, especially with the web interface (think AJAX gizmos).

Some of my favorite features are the usual port forwarding, static DNS, spiffy real-time bandwidth graphs, and tables of daily/weekly/monthly bandwidth usages. You also get SSH and telnet access. You can even write custom scripts that execute when you press the Cisco button on the front of the router.

There’s a lot of other stuff that I have no clue about. My only complaint is that the firmware is updated pretty frequently, yet there is no auto notification of any updates.

There’s definitely enough features here to satisfy even the most hardcore network nerds. But it also works for someone like me, who just wants more than the commercial firmware.

There are a couple other distributions of home router software that deserve mention. The aforementioned firmwares run on hardware people already are using as routers. But if you need something with a little more horsepower, you could recycle an old PC and run m0n0wall (or it’s derivative, pfSense) on it.

m0n0wall: A modified barebones version of FreeBSD with a slick web interface. It provides an amazing amount of features, including VPN and QoS. And as it’s FreeBSD, it can run on probably any older computer you have just lying around, or a specially designed system such as the PCengines ALIX. The m0n0wall platform has also been used as a base for other projects, such as FreeNAS, AskoziaPBX, and….

pfSense: A modified version of m0n0wall, and my current favorite. Not intended as a competitor to m0n0wall, it boast more features, as well as a much larger footprint. I would suggest that you start with m0n0wall and upgrade to pfSense if you feel the need.

NOTE: The first three flavors mentioned are intended to run on your standard home router, and include immediate support of the wireless functionality you expect out of your home router. m0n0wall and pfSense are intended to run on actual computers, so other arrangements will have to be made to add wireless, such as adding a separate wireless access point behind the router.

I’m not going to give instructions here on upgrading your home router. Each project mentioned has extensive documentation on their website, along with a hardware compatibility list and installation instructions.

Some warnings: Installing new firmware on a home router can be a marginally harrowing process, involving TFTP, blinking lights, and properly timed hard resets. Also, there is potential to completely brick the device (render the device as useful to you as a brick.) So if you are curious about any of these, spend some time on their wikis and forums. Make sure your home router is supported, or, better yet, get a new home router based on the project community’s recommendations. This way, if you mess up, you will still have internet access with your old router.

My Setup: “The K’nexus”

This took me 25 minutes in Gimp.

This took me 25 minutes in Gimp.

On a completely unrelated note, if anyone with computer graphics skillz would like to join our team, please do so. There is no application process. You are now a member. Get to work.

My Big Friday Night

An Altoids can?

one

With network jacks??

two

An ethernet tap!

three

$25 a piece.

LOST SECTOR930 KNIFE

So all the original members of Sector 930 have engraved pocket knives. Well, had.

As of last Friday, mine has gone missing. As my name and “Sector 930″ are engraved on the side, I am hoping someone googles “Sector 930″ and lands here.

CITIZEN:

IF YOU HAVE FOUND MY KNIFE, PLEASE REPLY TO THIS POST OR EMAIL ME. I WILL REWARD YOU RICHLY.

THANK YOU.

OpenDNS: A Followup

In a previous article, I discussed OpenDNS and it’s proxying/filtering capabilities, suggesting that by changing the DNS servers your computer uses for queries will bypass OpenDNS’ content filtering. While this part remains accurate, my suggestion that using a root DNS server from Wikipedia’s article was a bad one.  After actually having tried it, I discovered it does not work for whatever reason. Maybe they restrict DNS queries to edge DNS servers in order to prevent being taken down by a DDoS.  Anyway, use 4.2.2.1 – 4.2.2.6 instead.

opendns2

I also made the mistake of assuming that if you are stuck behind an OpenDNS proxy, you probably don’t have the ability to change what DNS servers your computer is using.  Apparently, hotels and other establishments are using it on their “public” wireless.  Ethical and legal ramifications aside, setting your computer to use 4.2.2.1 will bypass OpenDNS filtering. So, again, just to burn these numbers into your mind:

4.2.2.1

Quick instructions on how to change this: (from this guy)

Click on “My Computer”. Click on “My Network Places”. Click on “View Connections”. Right click on the connection that supports your Internet connection and go to “Properties”. Double click on the Internet Protocol TCP/IP option. Make sure “Use the following DNS server address” is selected, and input the above recommended DNS.

To check go to “Start > Run > “cmd” ”. Type in “ipconfig /all” and you should see the DNS you input where it says “DNS”.

Those DNS servers (4.2.2.1-4.2.2.6) are apparently owned by Verizon as a throwback for something. So, they might just stop working one day.

I have grown uncomfortable with using OpenDNS as my DNS provider. While their privacy policy is adamant that they do not keep records, they provide statistics for your account. I’m not saying they are in any way malicious, but after seeing this…

.................................

Bum bum ba dum...............

…I am hesitant to send all my traffic to them.

A FINAL NOTE:

OpenDNS remains a solid choice for people wishing to set up easy, potentially effective content filtering for their network. Their actions to stop Conficker and other malware are commendable. They make it simple for people to move away from their using their ISP’s often-slow DNS servers. However, their content filtering should not be considered effective in any environment that does not control which DNS servers machines on that network can use. Also, there are glaring privacy concerns for any one that cares about that kind of thing.

The End………………………………………………………………………?

I’ve Got Your Toothpick Right Here: Part 2

Now that everyone has had a chance to look at the “answer” to the “puzzle,” I will explain why I think it’s fucked up.

First, let’s review the rules of the puzzle:

Without rearranging any, remove exactly nine toothpicks below to spell the last name of a US president.

Now, why I think it’s fucked up:

Spelling requires valid letters. No one would say that the word “priΩk~” is spelled correctly.

I realized that to most people it was a “free” puzzle, but I paid for that magazine. I also realize I spent way too much time working on it and complaining about it. But, in the end, I still feel cheated. Making people think “outside the box” only works if there is a large, more rigid box that defines the laws of time and space in your little puzzle world.

And to anyone that got it and wants to say differently, you can cram it up your ~~>.

POSTSCRIPT This might have been the first time I’ve cursed on this blog. I guess I can no longer show it to my mother. Or anyone’s mother. Except Joe’s. Was it worth it? I think time will show that it was.