Archive for September 2013

Apps that make OSx useful

It’s been a long time since I’ve wiped out my workstation and started with a fresh Operating System.  I’m starting to get a real solid grasp of OSx so a clean slate to work with sounds fantastic. Having a much better knowledge then I did a year ago about the apps I like, which apps to I definitely don’t like and in what combination I find them most useful.   So here’s a quick breakdown of the OSx Apps I use while things backup backup before I race down green-glass lane, nuke this MacBook & arrive at destination defaults.

Web Browsers

Code Editors IDE’s & Support

  • Netbeans – PHP/Java IDE
  • TextMate $$
    • Simple GUI text editor
    • I rarely use it now however given that it’s paid for…  It’s still noteworthy to mention that I use VIM much more often.
  • Github + Command Line Tools
  • Arduino

DB Tools

Video/Graphics

  • GIMP - All my graphics editing needs under one easy to use roof.
  • VLC - Have Video File… Will Play.
  • Quicktime – pre-Bundled w/OSx
  • Camtasia $$ – Everybody loves screencasts and video demo’s

Organization, Notes & non-code Text

  • Evernote $$ – THE only notes app worth using on all platforms & architectures when logging all things noteworthy in any media type (txt,image,audio,etc)
  • OmniGraffle $$
    • Flow charts, Wire Frames, Brain Storming, Network Maps, Visual website site maps…  and whatever else you can think of once you get good at using it, it’s hard not to.
  • OfficeLibre – Offline office suite
  • FreeMind – Offline Mind Mapping otherwise I use Mindmeister $$ w/an entry level paid subscription.

Communication

Misc

  • Jing & Snagit – Screenshot + annotation & sharing tool.
  • SEO Power Suite $$
  • MarketSamuri – DEPRECIATED – Keyword research tool
    • This shouldn’t be listed here.  I can’t recall the last time I used this.
  • VirtualBox – Virtual Machines for all!
  • uTorrent – Leech

System Resources

  • FUSE for OS X
    • MacFUSE
    • NTFS-3G
  • TrueCrypt –  It’s all encrypted.  Everything.  Thumbdrives, backups, shared containers.  Everything.
  • Little Snitch $$ – Amazingly simple firewall
  • QuickSilver – Cutting shortcuts and mashing mashups for super quick access to everything.
  • GPGTools – This stuff should be understood now.
  • Homebrew – An OSx Packaging system that’s as useful as it is easy.
  • oh-my-zsh – Useful & Pretty.
  • Java – Necessary

Workaround for truncated dump file – NTOP Suspicious Packets File

I was encountering an error when trying to run tcpdump using the suspicious packets or other packets PCAP files generated by ntop as input. Tcpdump would display an error message stating the provided file was a “Truncated dump file” and die. the end. No beans.

The Workaround: Don’t run NTOP in daemon mode.
Don’t use the -d or –daemon command line argument. This also means that any common means of starting ntop as service such as with `/etc/init.d/ntop start` or `service ntop start` also results in failure.

The real answer: Stay current: As of this writing ntop has been replaced by it’s successor ntopng which is freely available and available freely: ntopng v.1.0 [stable] is available for download as pre-compiled packages or build-your-own from source of course. ^_^

Other then that I hadn’t resolved a real answer – however the NTOP Man Page warns about daemon mode under the –output-packet-path command line option. *shrug*

My Enviornment:

  • NTOP v.4.1.0 (32 bit)
  • Ubuntu [precise] 12.04.3 LTS
    • Linux hq 3.2.0-53-generic-pae #81-Ubuntu SMP
    • Thu Aug 22 21:23:47 UTC 2013
    • i686 i686 i386 GNU/Linux
  • tcpdump version 4.2.1
  • libpcap version 1.1.1

 

I Installed DD-WRT on a Netgear WNDR3400v2

This post is old and out dated.

Please see my new post New DD-WRT Firmware for Netgear WNDR3400v2 for links to a more current DD-WRT firmware version with Heartbleed fix, NAT reversal and more!


 

Right on, It WORKS.!.

I’m not a fan of many devices with extremely limited administration interfaces, especially network devices so when the Netgear WNDR3400v2 resting behind the couch (in arms reach for easy wired laptop connections ^_^) suggested there was an update available I agreed. With a quick slight of hand I confused the slick little black n’ blue device long enough to upload a firmware file downloaded from this website. I would guess that it took less than 90 seconds to eliminate the less-than-flexible firmware provided by Netgear & replace it with the always friendly DD-WRT.  Mission accomplished without so much as a questionable pause or hiccup.

Warning: WNDR3400v2 is not supported

Unfortunately, as of this post DD-WRT is still not officially supported for the Netgear WNDR3400v2 wireless access point.  Actually, DD-WRT.com states that donation devices are needed and that the firmware is only a work in progress and offering no files, suggestions or other information.  I however didn’t really care for the device anyway especially considering it’s been flaking out lately so I searched Google for DD-WRT Firmware for WNDR3400v2, downloaded the first thing I saw and flashed it to the device.  Fully prepared to toss the failed brick in the ‘parts’ bin with the rest of the bits n’ pieces I’ve saved for Arduino & Raspberry Pi projects, I uploaded the extracted file dd-wrt.v24-K26_WNDR3400V2-25-02-2013.chk using the web management interface to the Netgear device and clicked upgrade.  To my amazement I was presented with the dd-wrt “set your username & password” page displayed after successful flashes!  Heck yeah!

DD-WRT installed on WNDR3400v2

Here’s some links to the file I used. You can download the file from the original source if you’d like or grab the ones I uploaded.  Either way, here are some links and MD5 Hash values.  The Zip compressed file is not any smaller then it’s extracted .chk file so either one is just as quick to download.

Download the Firmware

Firmware File (Uncompressed)
MD5:8cc51e081f3115cc2514b55595d1cc16
File size: 6.5 MB
dd-wrt.v24-K26_WNDR3400V2-25-02-2013.chk @ Copy.com
dd-wrt.v24-K26_WNDR3400V2-25-02-2013.chk @ BurnMyTime.com

 

Zipped Firmware File
MD5: a3477656f891e12c6bed0a9761eae400
File size: 6.5 MB
dd-wrt.v24-K26_WNDR3400V2-25-02-2013.zip @ Copy.com
dd-wrt.v24-K26_WNDR3400V2-25-02-2013.zip @ BurnMyTime.com

 

Installing DD-WRT

  1. Acknowledge to yourself that what you are about to do has a high potential to render your wireless access point useless.  I’m not personally sure what the real likely-hood of creating a paperweight out of your AccessPoint actually is but if you like your WNDR3400v2 as much as I did mine then it’s just as good bricked as it is functional.  Lets move forward and hope for 1337 results!
  2. Locate & Login to the Web Admin – Netgear Genie web administration portal usually at http://192.168.1.1 or whatever it claims your default gateway to be if you plug in to it and let it DHCP issue your network settings after resetting the device to factory defaults.
  3. Reset to Factory Defaults – If you haven’t yet reset the device to factory defaults – navigate to the advanced tab -> administration -> backup settings page and click ‘erase’. That’s all I did to reset it anyway. I could have 30/30/30 reset it while patting my head n’ rubbing my belly but I didn’t care to find a paperclip to hold the reset button while cycling the power nor could I find any lolzcats to photo.
  4. Upload Firmware Upgrade – With your WNDR3400v2 at the factory default settings again visit the HTTP Genie Admin portal and bypass the internet setup junk.  Do what it takes to get to the Advanced Tab then Administration (I believe) and finally the Upgrade page.   Click browse & browse your computer for the .CHK file you downloaded and/or extracted from the downloaded .zip .
  5. Click [Upgrade] – Confirm that you do in fact want to take over the world and are not willing to accept payment for doing so….  Wrong admin panel.   Just agree to the warning dialogs and such and wait a minute or two.   I didn’t have to do anything else except refresh the http page I was viewing and whala – it displayed the dd-wrt password update form.!.

Sadly I didn’t make note of what firmware version I previously had from Netgear however it’s whatever version just got replaced today or perhaps yesterday as this post is being published the day after. I’ll follow up in a week to report how well the Netgear WNDR3400v2 is performing with DD-WRT.  I’ll donate the device to dd-wrt.com if it acts twitchy so everything will end well regardless. So far it’s working great though. Cheers!

Submitting Personal Information with[out] SSL

UPDATE:As of September 24 2013 
TeachingChile.com is completely wrapped in SSL.  
~Thank you!

This post is no longer entirely relevant. TeachChile.com has updated their site and wrapped it in SSL. Thanks guys!

https://teachingchile.com

 


URL: http://teachingchile.com/apply_online/machform/view.php?id=6

TeachChile.com has an online application process that requires the submission of quite a bit of personal information including your Passport Details over plain text. Seriously? I almost feel like someone’s playing a prank here.  with SSL and ‘secure websites’ being pretty well understood it’s mind boggling to see websites like this still exist requesting personal information including passport number be submitted via plain text non-secured form data. What’s more amazing is that the lack of SSL is just one of what seems to be a whole ton of security-ignorance which pretty much guarantees anyone submitting data to these guys gets their identity (all their submitted data) jacked.

Wha? Google shows some love.

What makes it more astonishing is the domain was registered in 2005 and ranks #1 for “Teach in Chile” on google(us) and ranks really well for quite a few other keyword phrases. With the potential traffic exceeding thousands of visitors a month – I wonder how many fill out that insecure form?

Source: http://www.semrush.com/info/teachingchile.com

Google gives the page that links to the Non-SSL encrypted page a PageRank of 3.
http://teachingchile.com/to_apply.htm – With all the crazy search listing algorithms and such you’d think Google wouldn’t demonstrate much appreciation for this.

WTF? Guess until you find a stored form!

Saved forms can be easily brute forced!  Now this is so far over the top I’m not sure what to make of it but it offers to let you save the form if you provide an e-mail address like so:

Save Form & Resume Later

and upon saving you are presented with a ‘special link’ which at a quick glance looks like a simple 10 character alphanumeric hash.

Link to permanently saved form.

http://www.teachingchile.com/apply_online/machform/view.php?id=6&mf_resume=f4e2cdde3a

As far as I can tell that is permanent unless they purge the system of old resumable forms at some point. But to drive my point home – all one has to do is generate hash values 10 alphanumeric characters long. The following function ‘should’ generate those hashes.  Can’t say I checked but it is quite that simple.

function generate_random_hash($length=10){
 $chars = '0123456789abcdefghijklmnopqrstuvwxyz'; // Our Hash Building Alphanumeric Soup
 $char_count = 1; // Counter for how many characters our hash is (as it loops and grows)
 while($char_count <= $length){
   // Add random chars from our alphanumeric soup until we hit our target length
   $hash .= substr($chars,rand(0,35),1);
   $char_count++;
 }
 return $hash;
}

Replace the ‘special’ part of the resume URL with generated hash & test for live data.

There can’t be more then 6.something quadrillion hashes possible used to uniquely identify the  saved forms are in their database.  6 Quadrillion is a lot, don’t get me wrong but it’s really not if you break the work down across 1 thousand, 10 thousand or even more computers it becomes pretty easy to pull the task off in a very short period of time, even if approached in a slow enough manner as not to bring their web server down.  I’m digressing though – this isn’t the school of brute-forceology.

Verifiably Exploitable Platform…

If I were to assume TeachChile.com was using Mach Forms (which they are) based on ‘machform’ being in the url or some other simple means then a quick Google search for existing (and very well documented) Mach Form exploits might apply. The latest exploit having been uncovered less than two months ago.  *shakes head* … I’ll just stop there on the topic of exploits.

Just 1 of 1,000+ Other Sites on the Server

With over 1,000 other sites likely hosted at the same IP address (server) I wonder what the odds are that the server itself isn’t entirely compromised already? Source: http://www.reverseip.us/?url=teachchile.com

Running across this situation on a legit website isn’t something that happens anymore. I’m blown away by the seemingly legitimate operation being run on TeachChile.com.  Beyond notifying their contacts I’m not sure what else to do about it.  Should anyone beyond their posted contact be notified of this? Lets hope this application isn’t to teach web development. ^_^

The purpose of this post!

Be very aware of what you’re doing when you release personal information online.  In this case It’s pretty safe to assume that data submitted to TeachChile.com will become property of some nefarious individual. Unless you have some otherwise unobtainable insight in to what happens to your data after you submit it – be cautious.  It doesn’t take much for a web server to fall victim to an automated attack, especially and very specifically DATA because that’s what everything is all about anyway.  Nobody reads the ‘terms of use’ or ‘disclaimers’ anyway (and in many cases, neither do the writers of those things so they don’t identify how your personal information is being securely managed anyway; further – there is no code enforcement to ensure what you’re reading is in fact what happens) so it’s best to assume all the data you’re submitting to a website is going to be retained indefinitely by an individual or a staff that isn’t specifically driven by keeping your data safe. Most techs are extremely trustworthy however often quite lazy.  It doesn’t take much oversight for a whole database, server or better yet a cloud driven limitless data storage asset to become the property of an attacker.  It’s often just a password between the evil attacker and your personal information.  

Don’t EVER submit your Social Security Number or Passport information online.  Just don’t. Perhaps try using your dog or cat’s social security number as a temporary placeholder. ^_^

Helping our comunity by publishing the monthly newsletter

Katherine Heights Townhomes

Z and I volunteered to create the monthly newsletter that gets delivered to all the residents of our community here in Katherine Heights. Our goal is to establish a publishing schedule, workflow, design template and ‘system’ in which most of the newsletter process could be automated. Since we’ve managed printed newsletters & digital E-Mail Marketing campaigns in the past we saw a clear opportunity to organize and implement a bit of organization. With a little structure & intent the whole process of creating, editing & publishing the newsletter should be much more efficient and error resistant through the automatic re-use of existing articles, schedules and so on.

This month we established the publishing schedule, basic workflow and setup & implemented the tools with which we (the front office, or whoever wishes to be responsible for it) will manage and maintain future publications.

We’ve been using podio to support many of our projects as well as our business workflow so it didn’t take much effort to setup a Podio Workspace for the Katherine Heights Newsletter.  Adding apps for Article management, built in version-monitoring for simple editing, discussions, reader input (both signed & anonymous), an events calendar and tied it all together with a publishing schedule to keep us on track.  With the workflow and information framework in place, starting in October we’ll be exporting data from Podio directly in to the newsletter template for printing.

If all goes well, by November we will have nearly completely automated the creation of every subsequent month’s newsletter.  A step up in quality, a step around unnecessary labor and errors, and a step in toward enhancing community involvement as we begin making the resources available for external input.  I’m excited – I love it when technology makes things easier rather then being a point of frustration. With a small amount of documentation created and stored in Podio I hope to see this more simple, efficient system stick around for a long time to come.

Here’s the front and back of September’s Newsletter.

[September-Front] [September-back]

Podio – Simple & Effective Workflow Resources