More security problems in Windows 7

In spite of the announced increase on security levels, a problem discovered in 2007 in Vista is still causing complications, this time on Windows 7. In 2007, Bruce Schneier points out the problem with the following:

Experts say that the fundamental problem that this highlights is that every stage in Vista's booting process works on blind faith that everything prior to it ran cleanly. The boot kit is therefore able to copy itself into the memory image even before Vista has booted and capture interrupt 13, which operating systems use for read access to sectors of hard drives, among other things.

Interestingly, 2 years after, Windows 7 keep almost the same problems. During HITB (Hack In The Box), wich is a security event, the researchers Vipin Kumar and Nitin Kumar demonstrate here how to gain control of a Windows 7 virtual machine, while during the boot.

It's a design problem," Vipin Kumar said, explaining the software exploits the Windows 7 assumption that the boot process is safe from attack. While VBootkit 2.0 shows how an attacker can take control of a Windows 7 computer, it's not necessarily a serious threat. For the attack to work, an attacker must have physical access to the victim's computer. The attack can not be done remotely.

Not only this, but Nitim says that there is nothing to be done, because this is a project problem, where is presumed that during the boot the OS is safe against attacks.

"There's no fix for this. It cannot be fixed. It's a design problem," Vipin Kumar said (..)

VBootKit 2.0 is only 3 Kb !!!

Reinstalling our best tools in Ubuntu 9.04

Finally, Ubuntu 9.04 is right on the way. Since 8.10 version, I have installed lots of tools, and now it is time to install this 9.04 pearl. But, of course I get worried of wasteing some of the tools I was allways making use of. Here I'll show what to do to get all them again.


Levantamento de Software Instalado
I have been using aptitude instead of apt-get for some time, for it is already in the system by the default, in any Debian variant, as Ubuntu is. Besides, aptitude records in log every action. This log file is /var/log/aptitude.log.

Thus, the folowing line will reveal back all tools that have been installed by aptitude, in Ubuntu:

sudo cat /var/log/aptitude | grep "\[INSTALAR\]" |\
cut -d" " -f2 > ~/Desktop/Inst.txt
sudo zcat /var/log/aptitude*gz | grep "\[INSTALAR\]" |\
cut -d" " -f2 >> ~/Desktop/Inst.txt

Consider the "\" by the end of 1st and 3rd lines. It tells BASH that the following line is the continuation of the actual line. Thus I can assure that there are only 2 lines of CLI code. Instead of having them typed, I strongly suggest you to copy and paste them both on BASH CLI.

A file Inst.txt will pop up in the Desktop, and in it a list of the installed files. This is the content of my file:

alien-arena
avant-window-navigator
build-essential
chromium
compizconfig-settings-manager
debian-keyring
dia
extremetuxracer
exuberant-ctags
fdutils
ffmpeg
flashplugin-nonfree
frozen-bubble
gdm-themes
gnochm
gnome-ppp
gpaint
hping2
htop
idle
iftop
imagemagick
ipcalc
iptraf
k3b
mozilla-plugin-vlc
mpg123
msttcorefonts
nmap
p7zip
python3
rails
rar
smplayer
sox
ssh
sun-java6-jre
swat
traceroute
transcode
tree
unrar
vim
virtualbox-ose
vlc
wireshark

I removed the dependencies, because they will automatically be installed, but you don't need to.

So, after installing the new Ubuntu version , I will be able to install my stuff with this following line:

aptitude install $(cat ~/Desktop/Inst.txt)

Of course, this only applies to packages installed via aptitude. tar.gz and other ways of installation usually does not apply, because they are not logged by aptitude log file.

The top 10 Linux commands on BASH, and more ...

I recognize I am an almost 100% Ubuntu user, either in home or working. But even with all the resources ready to use in a Ubuntu Desktop, and the usability it provides, I am frquently in a CLI (Command Line Interface).

Thus, almost with a new version of Ubuntu, the 9.04, I am searching for all the stuff I have installed in my 8.10, because I will probably reinstall them. Of course, registering this here will help others, and myself.

But, in the warmth of the battle, I questioned myself: what was the command I used the most ? "Googling" the web, I found a post written by MySurface, that shows a soberb pipeline :

history | awk '{CMD[$2]++;count++;}END { for (a in CMD)print CMD[a] " " CMD[a]/count*100 "% " a;}' | grep -v "./" | \
column -c3 -s " " -t | sort -nr | nl |  head -n10

Ok, great and terrible, Godzilla is a tiny and cute gecko, and so on. I assure you, it will not bite you, nor melt your CPU. What it will really do is to show the top ten commands you've issued in BASH. Copy it from here and paste on your console. The result in my root account was:

1 73 14.6% ls
2 37 7.4% ufw
3 37 7.4% cd
4 25 5% iptables
5 23 4.6% aptitude
6 18 3.6% ifconfig
7 14 2.8% man
8 13 2.6% tail
9 13 2.6% du
10 11 2.2% host

That means ls is my most used command: it represents 14.6% of all: it was issued 73 times, in different conditions. This pipeline researched my command history and gave me this results.

I have made a simple modification to see the whole list:

history | awk '{CMD[$2]++;count++;}END { for (a in CMD)print CMD[a] " " CMD[a]/count*100 "% " a;}' | grep -v "./" | \
column -c3 -s " " -t | sort -nr | nl |  less

In this case, press q to finish.

Conclusions
After that, I could see that:

• To have a better information, I should no use sudo for my administration tasks. Instead, I should login to root ($ sudo su -). Now every command issued by root account will be stored in its history. Guys on Ubuntu does warn that this may be harmful, that's why they provide a so complete sudo resource. So be advised: USE IT WITH CARE! :)
  
• Ubuntu default size for History File is 500 lines. I changed this to 1000 lines in ~root/.bashrc, adding the line HISTSIZE=1000 in this file.
  

MSN Messenger access Microsoft secretly

At least, most of MSN Messenger does not know that ...

Recently I was called by a friend, to help him in his computer problems. A reasonable desktop box, with Windows XP and ESET anti-virus.

MSN 2009 had been installed, but just was not working. I started ESET firewall, and set him to block data traffic, incoming or outgoing. This way I could watch any MSN access. Unfortunatelly, it did not worked at all, so I started working in some others tries, but left Firewall working in the same way. Searching on Internet, I found this page, with older versions of MSN.

After downloading 8.5, I started removing the 2009 version. Surprisingly, ESET Firewall blocked an access try to the Software Vendor. And more than 3 times !!! I cannot understand this. If I was uninstalling the software, why to contact Microsoft ?

I immediately thought of VLC, as shown in this popup. This just did not happened with MSN. The software did not warned me of this, just did it. this is disgusting. They could at least prompt the user about what was about to be done.

After this bad experience, after breathing deeply, I decided to continue, of course. Having installed 8.5 version, I started it, and I was prompted by a warning of a new version to be installed. Of course, I denied, and ... nothing happened. Twice, 3 times, and nothing happened. That means, get the new verson, it is an order. Or else just does not use it.

Wow! Those guy are really bold!! The computer is owned by the one who bought it, if he wants to use it with an older version, it is his business, not Microsoft business.

Mais uma vez fiquei tremendamente irritado. O computador pertence ao seu dono, ou seja, a quem desembolsou dinheiro para o comprar, e o fornecedor do software se acha no direito de impôr suas decisões sobre qual versão do software o usuário tem que usar. It was his own money!!!

Went for a little (a lotta) water, to cool my hatred. I found some tricks to apply on Register (nothing that easy, as many says) and MSN 2009 (after being re-downloaded) was ready to be used. That's okay, it is a Beta version. It will be fixed.

But, I ask any of you: Why does it must be this way ? please, technical answers, and not those built upon a "I think" basis.

HTML errors messages

Do you want to know what is the meaning of those weird error messages in your web browser, such as "error 407" or "error 400", whenever you try to access an internet page ?

Here is a helpful table, mainly when you are reading Squid's access log file. I found it in Stretched Out site:

Code	Description	Comment/Reason
100	Continue
101	Switching Protocols
200	OK	Action complete successfully
201	Created	Success following a POST command
202	Accepted	The request has been accepted for processing, but the processing has not yet been completed.
203	Partial Information	Response to a GET command, indicates that the returned information is from a private web.
204	No Content	Server has received the request but there is nothing to send back. (Empty Document)
205	Reset Content
206	Partial Content	The requested file was partially sent. Usually caused by stopping or refreshing a web page before it loads.
300	Multiple Choices	The request could fit multiple files.
301	Moved Permanently	Requested a directory instead of a file. The web server substituted the index.html file.
302	Moved Temporarily
303	See Other
304	Not Modified	The cached version of the requested file is the same as the file to be sent.
305	Use Proxy
400	Bad Request	The request had bad syntax or could not be interpreted.
401	Unauthorized	User failed to provide a valid user name / password required for access to file / directory.
402	Payment Required
403	Forbidden	Access to a protected or private password protected folder was attempted.
404	Not Found	The requested file was not found.
405	Method Not Allowed
406	Not Acceptable
407	Proxy Authentication Required
408	Request Time-Out	The server did not respond in the allocated time.
409	Conflict
410	Gone
411	Length Required
412	Precondition Failed
413	Request Entity Too Large
414	Request-URL Too Large	The submitted URL was too long to be interpreted by the server.
415	Unsupported Media Type
500	Server Error	The server encountered an unexpected condition which prevented it from fulfilling the request
501	Not Implemented	The server does not support the service required.
502	Bad Gateway
503	Out of Resources	The server cannot process the request due to a system overload. This is usually a temporary condition.
504	Gateway Time-Out	The service did not respond within the time frame that the gateway was set to wait.
505	HTTP Version not supported	The Web Server does not understand the version of http used by the browser.