Blog

  • Update on Fedora 18 on VMWare Fusion 5.0.3

    Everything now works.

    VMware FusionScreenSnapz017

     

    The quick version is:

    • Create a new Fedora 18 VM
    • Do not use “Easy install”
    • Disable 3D acceleration in the VM settings (Command-E) prior to starting the install, otherwise you get a spinning idle cursor and no action upon first boot
    • Install as you see fit. I use a 64 bit F18, 4 GB of RAM (my Mac has 16 GB of RAM), 100 GB partition, and 4 virtual processors. YMMV. General rule of thumb is that 1 GB is plenty for a casual Gnome desktop, but if you’re using it for software development like me, then the more the better.
    • Once installed, update all software using
    sudo yum update
    • and then reboot.
    • This gets you to kernel 3.8.4-202.fc18.x86_64 at the time of writing. This is currently incompatible with VMware tools 9.2.2-893683, but there are known patches (see below) until a VMWare Tools update comes along.
    • Let’s install the build tool chain needed to complete VMware Tool installation
    sudo yum install patch kernel-devel kernel-headers gcc make
    • Reboot just to make sure we’re all good
    • Click “Install VMware Tools”
    • Unzip the tar ball to ~/Downloads/vmware-tools-distrib/
    • Visit this page http://erikbryantology.blogspot.com.au/2013/03/patching-vmware-tools-in-fedora-18.html
    • Download the vmware9.k3.8rc4.patch and vmware9.compat_mm.patch patches, and if you feel like you’re not a patch wizard, the shell scripts that apply those patches, too. 
    • Follow the directions in the above page to patch the source to the VMCI and HGFS file system sharing modules
    • Now build the patched VMware tools
     sudo ./vmware-install.pl
    • There should be no compilation ERRORS (there will be a couple of warnings, particularly for 64 bit architectures)
    • Reboot
    • Test drag and drop file sharing, cut n paste, screen resizing, shared folders, and printing to a MacOS X printer.
    • If it’s all good, shutdown the VM
    • Go to Settings for the VM (Command-E)
    • In Display, re-enable 3D acceleration
    • Start up the VM

    At this point, you should have access to accelerated 3D within the VM and all VMWare Toolbox features.

  • Responsible disclosure failed – Apple ID password reset flaw

    Responsible disclosure is a double edged sword. The faustian bargain is I keep my mouth shut to give you time to fix the flaws, not ignore me. I would humbly suggest that it is very relevant to your interests when a top security researcher submits a business logic flaw to you that is trivially exploitable with just iTunes or a browser requiring no actual hacking skills.

    If anyone knows anyone at Apple, please re-share or forward this post, and ask them to review my rather detailed description of my rather simple method of exploiting the Apple ID password reset system I submitted over six months ago with so far zero response beyond an automated reply. The report tracking number is #221529179 submitted August 12, 2012.

    My issue should be fixed along with the other issues before they let password reset back online with my flaw intact.

  • Running Fortify SCA 3.80 on Ubuntu 12.04 64 bit Linux

    I have a bit of a code review job at the moment. It’s a large code base, and you all know what that means. LOTS OF RAM! So I got me a 16 GB upgrade. Then I found that I could only allocate 8 GB to a VM in VMWare Fusion. So here’s how to scan a big chunk of code with minimal pain:

    The default VM disk size for a Easy Installed Ubuntu is 20 GB, with 8 GB of swap. WTF. So don’t use Easy Install as you’ll run out of disk space doing a scan of a moderate sized application. I expanded mine to 80 GB after it was all installed, but if you are smart, unlike me, do it when you first build the system.

    To add more than 8GB to a VM in VMWare Fusion, allocate 8192 MB (the maximum amount) in the GUI whilst the VM is shutdown, open the package contents of the VM by right clicking the VM (I’m on a Mac, so if you rename a folder foobar.vmwarevm, it becomes a package automagically). Find the VMX file. Open it carefully in a decent editor (vi or TextWrangler or TextMate) – there is magic here and if you edit it wrong, your VM will not boot. Change memsize = “8192” to say memsize = “12384” and save it out. I wouldn’t go too close to your total memory size as you’ll start paging on the Mac, and that’s just pain.  Boot the VM. Confirm you have enough memory!

    First off, do not even try to do it within Audit Workbench. It will just fail.

    Secondly, it seems that HP do not test the latest version of SCA on OpenSuse 12.2, which is a shame as I really liked OpenSuse. There’s no way to fix up the dependencies without using an unsafe (older) version of Java, so I gave it up.

    Ubuntu, despite not being listed as a valid platform (CentOS, Red Hat, and OpenSuse are all listed as qualified), Ubuntu had a graphical installer compared to OpenSuse’s text only install. Alrighty, then.

    Install Oracle Java 1.7 latest using the 64 bit JDK for Linux. I did it to /usr/local/java/ Weep for you now have a massive security hole installed.

    Force Ubuntu to use that JVM using update alternatives:

    sudo update-alternatives --install "/usr/bin/java" "java" "/usr/local/java/jdk1.7.0_15/bin/java" 1 
    sudo update-alternatives --install "/usr/bin/javac" "javac" "/usr/local/java/jdk1.7.0_15/bin/javac" 1 
    sudo update-alternatives --set java /usr/local/java/jdk1.7.0_15/bin/java 
    sudo update-alternatives --set javac /usr/local/java/jdk1.7.0_15/bin/javac

    I created the following in /etc/profile.d/java.sh

    #!/bin/sh
    JAVA_HOME=/usr/local/java/jdk1.7.0_15
    PATH=$PATH:$HOME/bin:$JAVA_HOME/bin
    export JAVA_HOME
    export PATH

    Note that I did not tell Ubuntu about Java Web Start. If you want to keep your Ubuntu box yours, you will not let JWS anywhere near a browser. If you did this step, it’s best to delete javaws completely from your system to avoid any potential for drive by download trojans.

    Install SCA as per HP’s instructions. 

    Now, you need to go hacking as HP for some reason still insist that 32 bit JVMs are somehow adequate. Not surprisingly, Audit Workbench pops up an exception as soon as you start it if you take no further action to make it work. So let’s fix that up.

    I went and hacked JAVA_CMD in /opt/HP_Fortify/HP_Fortify_SCA_and_Apps_3.80/Core/private-bin/awb/productlaunch to be the following instead of the JRE provided by HP:

    JAVA_CMD="/usr/local/java/jdk1.7.0_15/bin/java"

    After that, Audit Workbench will run.

    Now, let’s work on ScanWizard. ScanWizard the only way really to produce repeatable scans that work without running out of memory. So run a ScanWizard. It’ll create a shell file for you to edit. You need to make the following changes:

    MEMORY="-Xmx6000M -Xms1200M -Xss96M "
    
    LAUNCHERSWITCHES="-64 "

    There’s a space after -64. Without that it fails.

    Then there’s bugs in the generated scan script that mean it would never work when using a 64 bit scan. It’s almost like HP never tested 64 bit scans on large code bases (> 4 GB to complete a scan). I struggle to believe that, especially as their on demand service is almost certainly using something very akin to this setup.

    Change this bit of the scan shell script:

    FILENUMBER=`$SOURCEANALYZER -b $BUILDID -show-files | wc -l`
    
    if [ ! -f $OLDFILENUMBER ]; then
            echo It appears to be the first time running this script, setting $OLDFILENUMBER to $FILENUMBER
            echo $FILENUMBER > $OLDFILENUMBER
    else
            OLDFILENO=`cat $OLDFILENUMBER`
            DIFF=`expr $OLDFILENO "*" $FILENOMAXDIFF`
            DIFF=`expr $DIFF /  100`
    
            MAX=`expr $OLDFILENO + $DIFF`
            MIN=`expr $OLDFILENO - $DIFF`
    
            if [ $FILENUMBER -lt $MIN ] ; then SHOWWARNING=true; fi
            if [ $FILENUMBER -gt $MAX ] ; then SHOWWARNING=true; fi
    
            if [ $SHOWWARNING == true ] ; then

    To this:

    FILENUMBER=`$SOURCEANALYZER $MEMORY $LAUNCHERSWITCHES -b $BUILDID -show-files | wc -l`
    
    if [ ! -f $OLDFILENUMBER ]; then
            echo It appears to be the first time running this script, setting $OLDFILENUMBER to $FILENUMBER
            echo $FILENUMBER > $OLDFILENUMBER
    else
            OLDFILENO=`cat $OLDFILENUMBER`
            DIFF=`expr $OLDFILENO "*" $FILENOMAXDIFF`
            DIFF=`expr $DIFF /  100`
    
            MAX=`expr $OLDFILENO + $DIFF`
            MIN=`expr $OLDFILENO - $DIFF`
    
            SHOWWARNING=false
    
            if [ $FILENUMBER -lt $MIN ] ; then SHOWWARNING=true; fi
            if [ $FILENUMBER -gt $MAX ] ; then SHOWWARNING=true; fi
    
            if [ $SHOWWARNING = true ] ; then

    Yes, there’s an uninitialized variable AND a syntax error in a few lines of code. Quality. Two equals signs (==) are not valid sh/bash/dash syntax, so obviously that was well tested before release! Change it to = or -eq and you should be golden.

    After that, just keep an eye out for out of memory errors and any times you notice it saying “Java command not found”. To open a large FPR file may require bumping up Audit Workbench’s memory. I had to with a 141 MB FPR file. YMMV.

    You’re welcome.

  • Zombie Apocalypse – Economic armageddon using Gresham’s Law

    I was heartened to find out that someone was given grant money for a study that demonstrates that the fresh brains market in a zombie apocalypse would peter out after six months. Afterwards, the earth would be either empty (most likely) or a wasteland with few zombies.

    So that gave me an idea. Gresham’s Law, crudely stated, says that bad money drives out good money. My thesis is that the market for high quality security assessments (=”good money” e.g. skilled manual review) is being driven out by the prevalence of low / unknown quality security assessments  (=”bad money”) in a rush to the bottom in terms of fees. This correlates with an increase in business loss as attackers stop putting up alert boxes and start stealing (brains) from the population.

    So is there any hope? Do we need hope? Could we have a market in the post-trust Internet?

    Let’s have a thought experiment – what would the Internet look like post zombie apocalypse (or if you’re Paul Fenwick, a post singularity AI overlord who turns out not to be our friend). Could commerce exist and in what form if we totally (and I mean totally debased) the security market to the point that there is no trust on the Internet?

    Of course it would look like this:Let+Me+Show+You+My+Pokemans+pokemanscover

     

    What would that look like for traders in an all lolcats world?

    In my view, the signs of a post-zombie apocalypse are:

    • The market would mainly consist of small unregulated trades, much like drug deals today you see on TV crime shows;
    • There will be a limited market for large trades, and large trades would be highly regulated in a walled garden;
    • There is very limited to no trust;
    • Trades would be done in places that are not particularly consumer friendly (ether “friendly” to mall owners like Amazon or Etsy, or dark places like the Silk Road);
    • There would likely be an arms race of sorts between the main actors in the market, such as targeted phishes of oppressed ethnic minorities or other outgroups;
    • There would be little to no enforcement as there’s basically no detection;
    • There would be minimal to no proactive security measures being undertaken, where this “technology” is essentially unknown the market or deeply hoarded by those who actually know.

    In my view, much of the signs are starting to crop up now, with the dark net market of malware, infected machines, and illicit substances traded for virtual currencies.

    We are at a turning point for trust. Either we must support the market in a way that punishes weak security or bad money, and rewards leading security practices, or we give up and embrace the smaller and more diverse dark market. There’s still money to be made – for some – in the dark market.

    What do you think the future of the security market looks like?

  • Curation

    I have taken the step of finally splitting the cut-n-paste import from my blog at Advogato into the days they actually occurred. All that content was here previously, but in some cases bunched together over many thousands of lines in single massive multi-month postings.

    Some early permalinks are gone, but that’s okay, you can search for the content. The content I’m talking about dates back more than ten years.

  • Argumentum ad antiquitatem

    This post is not in Latin, but essentially a call to the Information Security industry to end policies based upon argumentum ad antiquitatem, which includes:

    • Password change, complexity and length policies and standards that simply don’t make sense in the light of research and tools that show that we can crack ALL passwords in a reasonable time. It’s time to move on to two factor authentication, alternatives such as OAuth2 (i.e. Facebook/Twitter/G+ integration) or Mozilla Account Manager, and random long passphrases for all accounts.
    • “Security” shared knowledge questions and answers. These are commonly used to “prove” that you have sufficient evidence of identity to resume access to an account. We see these actively exploited continuously now. Unfortunately, most familiies including ex-spouses have sufficient knowledge of the identity and access to the person’s identity documents that such questions, no matter how phrased (like “What was your favorite childhood memory”), are simply unsafe at any speed as more than ONE person knows or can guess the correct answer.
    • That requiring authentication is enough to eliminate risks in your application. Identity and access management is important, but it’s only part of the picture.
    • That enforcing SSL or access through a firewall is enough to eliminate risks in your application. Confidentiality and integrity of connection is vital, especially if you’re not doing it today, but it’s only part of the picture.
    • That obfuscation is enough to deter hackers. Client side code is so beguiling and the UX is often amazing, but it’s not safe. Business decisions must be enforced at a trusted location, and there’s little business reason to do this twice. So let’s get that balance right.

    What are some of your pet “argumentum ad antiquitatem” fallacies?

  • Securing WordPress with obfuscation

    So in a fit of security through obscurity, I renamed my WordPress database tables and promptly broke WordPress with a highly informative “You do not have sufficient permissions to access this page.” error message when accessing wp-admin.

    Changing the prefix is easiest done with a new installation, but my installation dates from the very first versions of WordPress when the dinosaurs roamed. Due to WordPress’s design, changing the database prefix (‘wp_’) is not as straightforward as you would expect.

    Edit wp-config.php

    In this exercise, we’re going to change from the default “wp_” prefix to “foo_”. If you’re doing this for security through obscurity reasons, don’t use “foo_”, use something you made up. Trust me, my prefix is NOT “foo_”. In wp-config.php, change:

    $table_prefix  = 'wp_';

    to

    $table_prefix  = 'foo_';

    Once you’ve saved the file, your WordPress installation is now officially broken. Move fast!

    Rename your tables

    use myblog
    show tables

    and for each of the tables you see there, do this:

    rename table wp_options to foo_options;

    At this point, your blog will now be viewable again, but you will not be able to administrate it. Accessing /wp-admin/ will say “You do not have sufficient permissions to access this page.”

    Fix WordPress Brain Damage

    Let’s go ahead and fix that for you:

    UPDATE foo_usermeta SET meta_key = REPLACE(meta_key,'wp_','foo_');
    UPDATE foo_options SET option_name = REPLACE(option_name,'wp_','foo_');

    You’re welcome.

  • Installing Fedora 18 (RTM) to VMWare Fusion 5 or VMWare Workstation 9

    I always live in hope that just one day, the folks over at Fedora will actually have a pain free VMWare installation. Not to be. Here’s how to do it with the minimal gnashing of teeth.

    Bugs that get you before anything else

    On VMWare Fusion 5, currently Fedora 18 x86_64 Live DVD’s graphical installer will boot and then gets stuck at a blue GUI screen if you have 3D acceleration turned on (which is the default if you choose Linux / Fedora 64 bit).

    • Virtual Machine -> Settings -> Display -> disable 3D acceleration.

    We’ll come back to this after the installation of VMWare Tools

    Installing Fedora 18 in VMWare Fusion / VMWare Workstation 8

    The installation is pretty straight forward … as long as you can see it.

    The only non-default choice I’d like you to change is to set your standard user up to be in the administrators group (it’s a checkbox during installation). Being in the administrators group allows sudo to run. If you don’t want to do this, drop sudo from the beginning of all of the commands below, and use “su -” to get a root shell instead. 

    The new graphical installer still has a few bugs:

    • Non-fatal – On the text error message screen (Control-Alt-F2) there’s an error message from grub2 (still!) about grub2 file not found /boot/grub2/locale/en.mo.gz. This will not prevent installation, so just ignore it for now (which the Fedora folks have for a couple of releases!). Go back to the live desktop screen by using Control-Alt-F1
    • PITA – Try not to move the installer window offscreen as it’s difficult to finish the installation if even a little off screen. If you get stuck, press tab until you hit the “Next” button – or just reboot and start again
    Update Fedora 18

    Once you have Fedora installed, login and open a terminal window (Activities -> type in “Terminal”)

    sudo yum update
    sudo reboot
    sudo yum install kernel-devel kernel-headers gcc make
    sudo reboot

    Fix missing kernel headers

    At least for now, VMware Tools 9.2.2 build-893683 will moan about a path not found error for the kernel headers. Let’s go ahead and fix that for you:

    sudo cp /usr/include/linux/version.h /lib/modules/`uname -r`/build/include/linux/

    NB: The backtick (`) executes the command “uname -r” to make the above work no matter what your kernel version is.

    NB: Some highly ranked and well meaning instructions want you to install the x86_64 or PAE versions of kernel devel or kernel headers when trying to locate the correct header files. This is not necessary for the x86_64 kernel on Fedora 18, which I am assuming you’re using as nearly everything released by AMD or Intel for the last six years is 64 bit capable. Those instructions might be relevant to your interests if you are using the 32 bit i686 version or PAE version of Fedora 18.

    Mount VMWare Tools

    Make sure you have the latest updates installed in VMWare before proceeding!

    • Virtual Machine -> Install VMWare Tools

    Fedora 18 mounts removable media in a per-user specific location (/run/media/<username>/<volume name>), so you need to know your username and the volume name

    Build VMWare Tools

    Click on Activities, and type Terminal

    tar zxf /run/media/`whoami`/VMware\ Tools/VMw*.tar.gz
    cd vmware-tools-distrib
    sudo ./vmware-install.pl

    Make sure everything compiled okay, and if so, restart:

    sudo reboot

    NB: The backtick (`) executes the command “whoami” to make the above work no matter what your username is.

    No 3D Acceleration oh noes!1!! Install Cinnamon or Mate

    Now, all the normal VMWare Tools will work. Unfortunately, after all the faffing about, I didn’t manage working 3D acceleration. I ended up installing something a bit lighter than Gnome 3.6, which requires hardware 3D acceleration.

    • Activities -> Software -> Packages -> Cinnamon for a more modern desktop appearance or 
    • Activities -> Software -> Packages -> MATE for old school Gnome 2 desktop appearance
    • Apply 
    • Logout 
    • From the session pull down, change across to Cinnamon or Mate and log back in
    When VMWare updates support Tools to support Fedora 18 or vice versa, I’d still suggest Cinnamon over Gnome 3.6. Gnome 3.6 sucks way less than earlier Gnome 3.x releases, but that’s no great compliment. YMMV and you may really like Gnome 3.6, but without 3D support, it’s going to be painful. 
  • Time to update knowledge

    This might be telling folks to suck eggs, but if you are doing secure code reviews and your development skills relate to type 1 JSP and Struts 1.3, it’s really time you got stuck into volunteering to code for open source projects that use modern technologies. There’s heaps of code projects at OWASP that need help, including helping me with code snippets that are in a modern paradigm.

    I don’t care what technologies you choose, but your code reviews will not be using Type 1 JSPs or Struts for that much longer – if at all. Time to upskill!

    I suggest:

    • Ajax anything. Particularly jQuery and node.js. GWT is on the wane, but still useful to know
    • Spring Security, Spring Framework and particularly Spring Web Flow are essential skills for any code reviewer doing commercial enterprise code reviews
    • .NET 4.5 and Azure are killer skills at the moment, particularly as Windows 2012 has just been released. Honestly, there is a good market to be a specialist just in this language and framework set, as it’s literally too large for any one person to know.
    • Essential co-skills: Continuous integration, agile methodologies (you have updated your services to be agile aligned, right?), and writing security unit tests so your customers can repro the issues you find.

    It’s important to realise that good code reviewers can code, if poorly. Poor code reviewers don’t code and have never written a thing. Don’t be a bad code reviewer.

    I do not suggest Python, Ruby on Rails, or PHP as these are rare skills in the enterprise market, but if they scratch your itch, go for it, but be aware that these skills do not translate out to commercial code review jobs. The fanbois of these languages and frameworks will hate on me, but honestly, there’s no reason to learn these languages except for the occasional job here and there, and if you’re any good at the list above, PHP in particular is easy to pick up. Fair warning, it’s a face palm storm waiting to happen.

  • OWASP Developer Guide – time for a new meeting

    If you are participating in the OWASP Developer Guide, I want to have another status meeting Friday next week.

    Friday 2nd November 1300 UTC
    Saturday 3rd November 0000 AEDST (my time zone)

    Come be my friend on Google+, and ask to be in my OWASP Guide circle. This circle can participate in the Hangout.

    Hope to see you there!