English - 12

Today heise security brought a news that a growing number of old wordpress installations get's misused by spammers to improve their pagerank. I've more or less waited for something like that, because it's quite obvious: If you have an automated mechanism to use security holes in a popular web application, you can search for them with a search engine (google, the mighty hacktool) and usually it's quite trivial to detect both application and version.

This isn't a wordpress-thing only, this can happen to pretty much every widespread web application. Wordpress had a lot of security issues recently and is very widespread, so it's an obvious choice. But other incidents like this will follow and future ones probably will affect more different web applications.

The conclusion is quite simple: If you're installing a web application yourself, you are responsible for it! You need to look for security updates and you need to install them, else you might be responsible for spammers actions. And there's no »nobody is interested in my little blog«-excuse, as these are not attacks against an individual page, but mass attacks.

For administrators, I wrote a little tool a while back, where I had such incidents in mind: freewvs, it checks locally on the filesystem for web applications and knows about vulnerabilities, so it'll tell you which web applications need updates. It already detects a whole bunch of apps, while more is always better and if you'd like to help, I'd gladly accept patches for more applications (the format is quite simple).

With it, server administrators can check the webroots of thier users and nag them if they have outdated cruft laying around.

I got some spam in the comment fields of my blog that raised my interest.

Some sample how they looked like:
http://www.unicef.org/voy/search/search.php?q=some+advertising%3Cscript%3Eparent%2elocation%2ereplace%28%22http%3A%2F%2Fgoogle%2ede22%29%3C%2Fscript%3E

I've replaced the forwarding URL and the advertising words (cause I don't want to raise interest on spammers pages). I got several similar spam comments the following days all with the same scheme. Using a Cross Site Scripting vulnerability, mostly on pages that might raise trust to forward to a medical selling page.

This is probably a good reason why XSS should be fixed, no matter what attack vectors there are. It can always be used by spammers to use your pages fame / authority to advertise their services. Same goes for redirectors or frame injections. Some where already reported at some public place (for the above see here). I've re-reported them all, but got just one reply by a webmaster who fixed it. True reality on the internet today, even webmasters of famous public organizations don't seem to care about internet security.

For the record, the others:
http://adventisthealth.org/utilities/search.asp?Yider=<script>alert(1)</script>
http://www.loc.gov/rr/ElectronicResources/search.php?search_term=<script>alert(1)</script>

And thanks to iconfactory, they fixed their XSS.

Well, I usually don't tend to blog the content of my spam inbox, but hey, this time I make an exception. It's worth the fun.

There's a campaign that wants the UN to start a military action to shoot down an Unidentified Flying Object to know if there are extraterrestrians:
http://www.ufocampaign.org/

Yeah, that's really something worth making a petition. Tell those politicians you want their military to shoot down aliens. I wonder if this is a well-made hoax or not.

nouveau, the project for creating a free 3D linux driver for nvidia cards, recently got first support for real 3D applications with gallium on some NV4X cards (see Nouveau Companion 36). Today I got it working on a friends machine.

Here you can see an openarena benchmark (also uploaded on youtube). It got 55 fps, which is far away from the nvidia binary driver yet (178 fps), but at least more than my r200 setup (32 fps).

For the brave ones, here's a quick and dirty howto for Gentoo:
a) Get the nouveau overlay with svn co https://svn.hboeck.de/nouveau-overlay and add it to PORTDIR_OVERLAY in make.conf.
b) The nouveau-overlay won't install the nouveau/gallium-branch of mesa. Get my overlay with svn co https://svn.hboeck.de/overlay and also add that to your PORTDIR_OVERLAY (I'll try to contact the nouveau-overlay developer if we can merge this).
b) Add media-libs/mesa, x11-base/x11-drm, x11-libs/libdrm and x11-drivers/xf86-video-nouveau to /etc/portage/package.keywords and merge them.
c) If you've been running the nvidia binary driver, eselect opengl set xorg-x11, change the graphics driver in xorg.conf to nouveau, rmmod nvidia (if you've been running the binary driver), modprobe nouveau and start X.
d) Have fun!

Note: The nouveau developers consider gallium completely unsupported at the moment and don't want to get end-user bugs. If it runs, fine, if not, don't nag them with it.

After some more »out of memory«-messages by josm, I thought it's time to look out for alternatives.

For the openstreetmap-project, the two main editors are josm (java) and potlach (flash). I think using java probably wasn't a very wise decision (I still wonder how an app can get »out of memory« after loading about 5 MB of images, do they create a pixel class and store every pixel in an object?) and I don't like flash either.

There's another project called merkaartor and today I had a look. My first feeling is that it's promising. It has good performance, it does nice live-rendering and it supports the basic features (adding nodes and ways, up/downloading stuff to the osm-system).

Sure, comparing to the large list of plugin features josm has, it's limited. Maybe I'll try to hack in some bits I'm missing at the moment.

In my continuing effort to improve gentoo for geo-related stuff, I've just added a merkaartor package to portage.

I recently took the new CAcert assurer test. Afterwards, one has to send a S/MIME-signed mail to get a PDF-certificate.

Having the same problem like Bernd, the answer came in an RC2-encrypted S/MIME-mail. I'm using kmail, kmail uses gpgsm for S/MIME and that doesn't support RC2.

While this opens some obvious questions (Why is anyone in the world still using RC2? Why is anyone using S/MIME at all?), I was able to circumvent that without the hassle of installing thunderbird (which was Bernd's solution).

openssl supports RC2 and can handle S/MIME. And this did the trick:

openssl smime -decrypt -in [full mail] -inkey sslclientcert.key

It needed the full mail, which took me a while, because I first tried to only decrypt the attachment.

I want to give some thoughts about some more advanced XSS-issues based on two vulnerability announcements I recently made.

First is backend XSS. I think this hasn't been adressed very much, most probably all CMS have this issue. If you have a CMS-System (a blog is also a CMS system in this case) with multiple users, there are various ways where users can XSS each other. The most obvious one is that it's common practice that a CMS gives you some way to publish raw html content.

Assuming you have a blog where multiple users are allowed to write articles. Alice writes an article, Eve doesn't like the content of that article. Eve can now write another article with some JavaScript adjusted to steal Alice's cookie. As soon as Alice is logged in and watches the frontpage with Eve's article, her cookie get's stolen, Eve can hijack her account and manipulate her articles.

Solution is not that simple. To prevent the XSS, you'd have to make sure that there's absolutely no way to put raw html code on the page. Serendipity for example has a plugin called trustxss which should do exactly that, though there are many ways to circumvent that (at least all I found should be fixed in 1.3-beta1, see advisory here: CVE-2008-0124). All fields like username, user-information etc. need to be escaped and it should be the default that users aren't allowed to post html. If a superuser enables html-posting for another user, he should be warned about the security implications.

A quite different way would be separating front- and backend on different domains. I don't know of any popular CMS currently doing that, but it would prevent a lot of vulnerabilities: The website content is, e.g., located on www.mydomain.com, while the backend is on edit.mydomain.com. It would add complexity to the application setup, especially on shared hosting environments.


Second issue is XSS/CSRF in the installer. I'm not really sure how I should classify these, as an open installer most probably has more security implications than just XSS. I recently discovered an XSS in the installer of moodle (CVE-2008-0123) which made me think about this.

I thought of a (real) scenario where I was sitting in a room with a group, discussing that we need a webpage, we would take Domain somedomain.de and install some webapp (in this case MediaWiki, but there I found no such issues) there. I suddenly started implementing that with my laptop. Other people in the room hearing the discussion could send me links to trigger some kind of XSS/CSRF there. This probably isn't a very likely scenario, but still, I'd suggest to prevent XSS/CSRF also in the installer of web applications.

I recently wrote about geo-tagged images. This makes use of the fact that different devices collect data and you can associate the data by the timestamp. It's most probably interesting for much more than gps/images.

While it's possible to get accurate timesetting by hand, it's usually not what you want. Preferably one wants to sync all devices with an internal clock automatically from the computer or some kind of network connection.

As a first step, we want to get our computer's time accurate. There are tons of tools out there, some linux distributions (and also windows xp) do this automatically on boot. I'm usually using rdate, it's small and simple:

rdate -s [any public timeserver]

There's a list of public time servers here. Other tools like netdate, ntpdate etc. will do it as well.

Now, my digital camera is a Canon Ixus 50. It uses PTP (picture transfer protocol) for data communication. If you have a PTP camera, most likely it supports time syncing. Syncing the camera time to the system time was recently added to libgphoto svn, but it's not yet available in a release. It also doesn't support any timezone management yet, so I'll get GMT time (while I live in the CET zone). The command to do it is:

gphoto2 --set-config synctime=on

If you don't have PTP, you're not completely lost. There's support for a lot of proprietary cameras in gphoto, some of them also support time syncing. Give it a try. I don't have information about usb storage devices (many cameras are just storage devices), links welcome.

Next device is my mobile phone, Nokia 6230i. As a mobile phone is permanently connected to the GSM-network, the obvious option would be time syncing over gsm. This protocol exists and most phones (including mine) support that. But bad luck, many mobile providers don't support it. So I'm out of luck here (vodafone, pointers to information about different provider support that are welcome).

Now, this device also speaks bluetooth, so timesetting via the computer should be possible. Both gammu and gnokii (the common applications to talk with all those proprietary mobiles out there) have a timesetting-option, but it rounds down the time to zero seconds, thus making it useless for exact time. I'm not yet sure if this is a limitation of the hardware or a bug in the software. An option would be to send the timesync-signal at the moment seconds turn to zero, but that would require application support, as there's a relevant diff between the application call and the moment the time get's set (because you have to ack the connection on the phone).
Though at the moment my phone needs manual timesetting, but the only data I'm collecting with it is gps-data, which get's it's timestamp via gps, so this is fine.

Over two years ago, it was announced that the security scanner nessus will no longer be free software starting with version 3.0. Soon after that, several forks were announced. For a long time, none of these fork-projekts produced any output.

openvas was one of that forks and from my knowledge the only one that ever produced any releases. It recently had 1.0-releases for all packages, I just added ebuilds to gentoo.

While openvas isn't perfect yet (many of the old plugins fail, because some files had to be removed due to unclear licensing), it's nice to see that we have a free, maintained security scanner again that will fill the gap left by nessus.

Recently geotagging of images became some popularity due to some articles on popular newspages. I'm already using geotagged images regularly for my work on openstreetmap.

Geotagging images means that you add some metadata in the EXIF-header (part of JPEG-files) where the image was taken. Future cameras probably will include a gps module and will be able to do this automatically, but with today's hardware we need some extra work. Beside manually adding the coordinates, e. g. by clicking on a map, we can synchronize gpx tracks (a common format for recorded gps data) with our images.

I'm usually recording gpx tracks on my mobile phone with Mobile Trail Explorer (a Java/J2ME-software) and an external bluetooth gps device. Before starting, you should accurately set the clock of both devices (the camera and whatever you use to get gpx data). For my hardware I have to do this manually. The mobile phone (Nokia 6230i) supports timesetting via gsm, but my german mobile phone provider doesn't transport that signal. It's also possible to set the time via bluetooth, but then it's rounded down to minutes (at least with gnokii and gammu, I'm not sure if this is an application bug or a hardware limitation), so this is useless, too.
My camera (Canon IXUS 50) seems to have no way of automatically setting the time.

Now, considering you were out somewhere, made some photos while you had another device recording gpx data. There's a small skript called gpsPhoto that will give your images GPS data:

gpsPhoto.pl --dir [directory of your images] --gpsdir [directory of your gpx files] --timeoffset 0

Now you have images that contain data where they were made. JOSM (an openstreetmap tool to create map data) supports showing the geotagged images, which makes editing openstreetmap much easier (you don't have to write down/remember street names, you can take photos of postboxes, bus stops etc. instead of writing down/setting waypoints with your device).

Beside that, this brings up the question if openstreetmap should get a database of geotagged free images together with tools to show them on the map. While this brings up some privacy issues (if the photos contain private buildings, people, car numbers), even the ones without any privacy implications (nature, public buildings) would be a nice feature: Having a map and always being able to say »show me some photos of that location«.
At the moment, this is probably far beyond of the computer ressources available for a project like osm, but it's worth a thought for the future.

Update: Bernd just told me that MTE doesn't use the phone's timestamp, but the one from the GPS device. This means this method doesn't work if your gps doesn't send a correct timestamp signal.

About one year ago, Sam Hocevar posted some results on tests with his fuzzing tool zzuf, which showed a large number of crashes in various applications, especially multimedia apps.
Crash bugs on invalid input very often lead to security issues, thus this should be taken seriously.

Now, I took the freedom to have a look how many of the issues found back then were fixed. I used the most current versions in gentoo linux (testing/~x86-system), which tend to be quite up-to-date. I also cross-checked the crashes for other apps, as they often use the same or similar code.
Seems only vlc devs did their homework (Sam Hocevar is part of the vlc team). Interesting enough, even firefox seems to have a gif-crasher since a year.

gstreamer crash by lol-ffplay.mpg lol-gstreamer.m2v lol-mplayer.m2v lol-mplayer.mpg lol-vlc.m2v lol-vlc.mpg
endless loop by lol-ffplay.m2v lol-xine.mpg

mplayer hang by lol-mplayer.wmv,
crash by lol-ffplay.flac lol-mplayer.aac lol-mplayer.mpg lol-mplayer.ogg lol-ogg123.flac lol-vlc.aac lol-xine.aac

xine crash by lol-mplayer.wmv lol-ffplay.m2v lol-ffplay.ogg lol-ffplay.wmv lol-gstreamer.avi lol-ogg123.flac lol-vlc.aac lol-xine.mpg

firefox crash by lol-firefox.gif

I noted that my personal homepage on int21.de basically contained nothing relevant any more and was horribly outdated. Thus I decided that the time of personal homepages is over and I'll let it forward permanently to this blog (so my blog will get the fame and pagerank).

It still contains various subpages like howtos, cve advisories, they'll stay where they are.

Recently I had a discussion with someone about the security of various linux distributions where he claimed Debian stable to be very secure and that they use old versions where they backport all occurances of security issues. This is a common assumption, too bad that it's wrong.
I want to document this to demonstrate the dangerousness of opinions like »stay with the old software«, »never touch a running system« and alike that are not limited but often found in the Debian community.

I had a look at the security policy on a package recently very popular for it's vast number of issues, namely php. Their last php-update on php5 was in july. They have a heavily patched version of php 5.2.0 and according to their changelog the last thing they patched was CVE-2007-1864.

Now that probably means that CVE-2007-3996, CVE-2007-3378, CVE-2007-3997, CVE-2007-4652, CVE-2007-4658, CVE-2007-4659, CVE-2007-4670, CVE-2007-4657, CVE-2007-4662, CVE-2007-3998, CVE-2007-5898, CVE-2007-5899, CVE-2007-5900 are unfixed. Oh, and before you ask: This list certainly is incomplete, it's just what I found without much hassle.

Not only looking at php5, php4 is still officially distributed by many vendors, some hosters still use it. You can't really blame them, as php.net announced it to be supported until 2007-12-31. But that's theory, in fact, nobody looks if the various recent issues also apply to php 4, most recent advisories don't mention it. Fact is, at least CVE-2007-3378, CVE-2007-3997, CVE-2007-4657, CVE-2007-3998 also apply to php 4 and are unfixed in their latest release 4.4.7 (not neccessary to mention that they're not fixed in the debian stable php4 package).

If someone prefers to stay with old software, it's up to them. But be serious. It's probably a hell-job to get all the recent security issues in an app like php backported to some ancient version. A quick check showed me that debian isn't able to do that. If you can't do that, don't claim it's in any way »supported«. Because doing that put's other people in dangerous situations.

Yesterday I did some maintenance of our server configuration and wondered what would be the correct way to handle unconfigured virtual hosts. E. g. what http-response should come if someone just enters the IP of our server or a domain that just isn't used for http.

At the moment, we're shipping a html-page explaining that it's an unconfigured domain, which is probably okay, but we ship it with HTTP code 200 (which means »OK«). I thought it should probably ship with some kind of error code so that search engines know there's no real webpage.
Now, reading RFC 2616 (HTTP 1.1) didn't answer the question to me. Most near is probably a 404, others we considered were 403, 503 or 204, but non of them seems to really match that situation. Maybe I should write some enhancement request to the IETF...

Comments appreciated, what would you think would be the correct status.

I got an old laptop donated a while back, Pentium 133 with 24 MB RAM, no CDROM, no USB. I wanted to provide it for someone else as a basic internet surfing and office writing station and faced the problem what system would be suitable for that.

I tried some old flavours of Debian, but wasn't really happy. Then I found that there's a dsitribution called DeLi Linux that seemed to be just perfect. What they're doing is providing an intelligent mix of current and old software (yeah, xorg really runs on a P133). They have installation floppies for network install (well, it was nontrivial to find three floppies in my room). It's all a bit like doing Linux by foot, they're missing a real package management (they have one, but no auto-dependencies) and things like that, but that didn't really hurt.

In the end I had an IceWM-Desktop, together with Konqueror-Embedded, alternatively you can use Firefox 1.5 (they backport security fixes) linked against plain X-libs. Texts can be written with AbiWord, linked against gtk1.
It's a nice solution, if you once need some system for a machine where xubuntu is far too bloated, you might want to try out DeLi Linux. According to their webpage, it runs on a 486 with 16 MB.

My stub of an installation report for the HP OmniBook 5500CS is here (I may extend it when I get the laptop back, it has some more devices to explore, internal soundcard, tv-out).