Identity Validation Regardless of Message Source

There are cases when one needs to communicate securely with a specific person to ask for help or to share private information. In such cases, one's private account must never be used, and instead, a new anonymous ID must be created.

Scenario example: Person Alpha has published secure ways to be reached (PGP/GPG Public key to be used for emails, or a secure chat facility). You need to contact that person from an anonymous account.

Solution:

1. Create an ID for the intent of sending ONE message only.
2. This message must start or end with a hash.
3. The hash is an output of a text that you have randomly selected (old news article, historical event, ...etc.) that is not included in the same email, but instead, included in the next email exchange.
4. This way, the recipient is able to validate the sender's identity even if the sender used a different ID or email, simply by hashing the first/last paragraph to result in the same hash output of the previous email.

A source for the random text should not be anything that can be linked to you. Not your favorite song lyrics, name, birth date, ...etc. It must be RANDOM. A good example is an article, or a part of an article, from Wikipedia. Luckily, Wikipedia offers an option to get a random article: https://en.wikipedia.org/wiki/Special:Random

It's also a good idea to mix 2 sources of random text to avoid having an adversary pre-compute text (something someone with lots of compute power can easily do). Google's "I'm Feeling Lucky" button will take you to a random topic.

It is up to you to select the text, but make sure it's at least 1 paragraph, then use a STRONG 1-way hash function such as SHA512. Avoid weak functions such as CRC & MD5. It is also advisable to NOT use any online converters. Download a tool to do the hashing offline on your computer.

This method can also be used to publish posts on famous text dump sites, such as pastebin, without having to register an ID. People can verify that the next dump is legit by hashing the paragraph you define in your next post.

Example posts to pastebin verifying the authenticity of the poster:

Message 0:

======== begin SHA512 hash ========
07f0f838fe03b92682728e8b2164796ea53bfa8f9a11dd29f0057ab9ea8a222142819c3c9d40d170519977544d9b623d02099bdc0e25f1f6e739a34b065e2793
======== end SHA512 hash ========
I need help. I have secret docs that I need to publish and require you to do it on my behalf. I can't expose myself.

I'll send details from another account in a different email. Write "The weather is nice today" in your public Twitter account so that I know that you received this and agree.

The sender then sends another email from a different account (to avoid creating an association between sender & receiver).

Message 1:

======== begin SHA512 hash ========
dd5e53f533d6d740857249b215e0a49c61f221abc5c633d6cda141efad5a558426e9c943ef1015a2b468c6fc9289a302b6ef455459d19d6283a24612710894cc
======== end SHA512 hash ========

======== begin hash text ========
Vernon Reginald Pinkney (born May 27, 1955 in St. Louis, Missouri) is a former American football defensive back. He played five seasons in the National Football League, two with the Detroit Lions and three with the Baltimore Colts.[1] Pickney was drafted 166th overall in the 1977 NFL Draft after an All-Conference career at East Carolina University.

Under the rule of the House of Este, the city of Ferrara attracted great artists and scholars of the Italian Renaissance, and the city itself expanded according to Renaissance ideals of urban design.
======== end hash text ========

Here's the link to the Tor hidden service to download the documents: http://dx2oyt83zbdgc3uy.onion/.files/secrets.7z

When receiving and downloading the files successfully, put a hidden HTML tag in your blog/site that says 'I can has cheezburger'.

As you can see, the sender changes his email , and didn't have to provide a way to be contacted back. Some email services even allow you to set an expiration date on an email account & it gets auto deleted.

Additionally, the first block of hash text is for the NEXT email to be authenticated, if any. It's always a good idea to keep one in case you have to reach out to the person and to prevent any impersonation attempts.

Below the hash output is the text that should be hashed to get the hash output of the previous email (Message 0). This is how the receiver validates the sender's identity.

Recommendations:

1. Only email the person if s/he has a public key published, otherwise if you email in plaintext, you risk the email being intercepted & modified, rendering all future exchanges to be altered by an adversary.
2. If the person doesn't have a public key or an encrypted messaging option, ask them to do so using an anonymous account. Twitter, web-to-SMS, ...etc. Always use Tor to browse and create any anonymous/fake/temp account.
3. It's good practice to add spelling mistakes and random characters to the random text you chose, to further reduce the chance of it being pre-computed.
4. Use a new email/messaging account for each message you send. Many tools and adversaries online exist that can correlate between frequency of emails and possible people to monitor. By sending from multiple accounts, each one only once, you reduce the chance of being tracked or linked.

Be paranoid. Be safe.

HOWTO: Tor2Web on Debian

What is Tor2Web?

Tor2Web is an open source software that allows the general public to browse Tor hidden services, which are servers running anonymously behind the Tor network. These servers could be web servers, email servers or any other services, and are normally accessed only via the Tor software, but if for some reason you cannot install it, or need a quick look, tor2web provides this kind of easy access via standard web browsers.

Tor's hidden services (HSs) usually look like this http://sx3jvhfgzhw44p3x.onion (Wikileak's HS), but with tor2web, you can create a general public proxy where people enter the HS like this https://sx3jvhfgzhw44p3x.tor2web.org/ or bind your tor2web node to a specific HS (yours or someone else's) so that when someone accesses your tor2web domain name, it will only view your specific HS.

In all cases, Tor2Web cannot be used alone. You still need a 2nd node that has the HS running on it. This guide will not cover how to setup a HS. You can refer to Tor's guide for that. Never run both the HS & tor2web on the same node!

Why Use Tor2Web?

Tor2Web is part of a bigger project called GlobaLeaks, but one can use tor2web to provide access to banned/blocked material or provide services anonymously, not related to whistle-blowing, like an anonymous chat service. Taking down the tor2web node doesn't affect the HS & it's always easy to bring up a new tor2web node.

Another reason is to simply hide your stuff. With news of governments snooping on everyone and everything, one doesn't feel safe anymore. They could use anything against you at any point in the future. So, by running a HS, you can run your own email server or file server, and not worry about some law enforcement goons seizing your hardware and disrupting your work, even if you're collateral damage (like when Mega Upload servers were seized, many other websites were also affected).

Of course, one cannot attain full anonymity without taking all possible precautions such as registering the host/VPS/domain name using Tor to not be tracked to you, paying for the services using Bitcoins, and SSH into your system from behind Tor.

Requirements

1. Debian Squeeze (6) or Wheezy (7)
2. tor
3. python2.7
4. python-Twisted version 13.1.x
5. tor2web

tor2web v3.0 uses Python Twisted as a webserver rather than a standalone webserver like Nginx.

Note: This guide has slight differences from the Tor2Web guide. Feel free to refer to both and modify as you please.

1) Debian

Some Virtual Private Server (VPS) providers do not support Wheezy, but tor2web needs packages only available in Wheezy. You will have to install a lot of packages from Wheezy to be able to use python2.7 and its requirements, but you don't need to run a dist-upgrade. So, in the end, your distribution will still be Squeeze.

If you're already running Wheezy, then you can simply ignore the parts about adding Wheezy's specific repositories and removing them later.

1.1) Initial Sources

Modify the file /etc/apt/sources.lst with your favorite editor (vi, vim, emacs, nano, pico)

deb http://ftp.uk.debian.org/debian             squeeze main contrib non-free

deb http://ftp.uk.debian.org/debian-security    squeeze/updates main contrib non-free

deb http://ftp.uk.debian.org/debian-backports squeeze-backports main

deb http://ftp.uk.debian.org/debian-backports squeeze-backports-sloppy main

deb http://deb.torproject.org/torproject.org squeeze main

deb http://dl.bintray.com/globaleaks/deb /

Replace "squeeze" with "wheezy" if that's what you're running, but ignore the backports lines as you don't need them.

Your sources above could be from a different mirror for Debian's packages. Always use the closest mirror to your host.

1.2) Upgrading the box

You need to be root to run these commands, or have "sudo" installed with the correct privileges.

The last command will upgrade your host to the latest packages of your distribution. It's always good to stay up to date and avoid buggy packages.

sudo apt-get update

sudo apt-get upgrade

1.3) Add Wheezy repositories

Modify the file /etc/apt/sources.lst with your favorite editor (vi, vim, emacs, nano, pico) again, and add Wheezy repos

deb http://ftp.uk.debian.org/debian             wheezy main contrib non-free

deb http://ftp.uk.debian.org/debian-security    wheezy/updates main contrib non-free

2) Tor

Import Tor's keyring to authenticate the packages and install Tor.

Note: If you're running as root, or you don't have sudo installed, simply remove "sudo" from the 2nd command above.

sudo apt-get update

sudo apt-get install debian-keyring debian-archive-keyring

sudo apt-get update

gpg --keyserver keys.gnupg.net --recv 886DDD89

gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -

sudo apt-get install deb.torproject.org-keyring

sudo apt-get update

sudo apt-get install tor

Now you should have tor installed. You check the service status using: service tor status

3) Python

Check if you already have python installed and which version:

python --version

python2.7 --version

Now to install python and some of its fellow packages:

sudo apt-get install -t wheezy python2.7 python-pip python-dev wget ca-certificates

If you're running Squeeze, you'll be asked to also install glibc, and during the install you'll be asked to restart the services associated with it. If this is a fresh host, it's safe to say "Yes" if it's a production box with services running live, choose "No." This will also upgrade & install a lot of packages from Wheezy, as python-pip is dependent on them.

If you have multiple versions of python installed (2.6, 2.7 & 3.x), you'll need to change the default to 2.7:

update-alternatives --install /usr/bin/python python /usr/bin/python2.7 10

If you need to change the default later on, run this:

update-alternatives --config python

4) Tor2Web

First to grab the tor2web requirements and install them:

wget https://raw.github.com/globaleaks/GLBackend/master/requirements.txt

sudo pip install -r requirements.txt

sudo apt-get install tor2web

sudo service tor2web status

sudo service tor2web stop

Now that you have tor2web installed, and stopped, you need to create certificates for session encryption between the tor2web node and the user's browser.

when running the 2nd openssl command, make sure the Common Name (FQDN) is the same as the domain name that will be used to access the tor2web server. If you're planning to access it by IP, use the IP here.

The 3rd command will create a certificate valid for a year (365 days). If you want it to live longer, increase the number of days.

The last command will take a long time to generate the file. If your computer is faster than your host, run it on your computer then copy it there.

cd /home/tor2web/certs/

openssl genrsa -aes256 -out tor2web-key.pem 4096

openssl req -new -key tor2web-key.pem -out tor2web-csr.pem

openssl x509 -req -days 365 -in tor2web-csr.pem -signkey tor2web-key.pem -out tor2web-intermediate.pem

openssl dhparam -out tor2web-dh.pem 4096

Don't change the file names as tor2web is coded to use them as is.

The certificates created will require you to enter the password whenever you [re]start the tor2web service. This is good in case your server was hijacked & your certs were taken, they cannot be used unless someone knows the password (which shouldn't be the same as the root password!).

If you don't care, then you can create a certificate without a password:

openssl rsa -in tor2web-key.pem -out tor2web-key.pem.insecure

mv tor2web-key.pem tor2web-key.pem.secure

mv tor2web-key.pem.insecure  tor2web-key.pem

5) Configuring Tor and Tor2Web

Limit tor to the local host IP and prevent external connections, by modifying /etc/tor/torrc and add this line:

SocksPort 127.0.0.1:9050

Copy the example file into a new one:

cp /etc/tor2web.conf.example /etc/tor2web.conf

Modify /etc/tor2web.conf

nodename = whatever you want here. It can be the IP since it's unique

listen_ipv4 = IP of your VPS

listen_ipv6 = IP of your VPS, if you want to use IPv6

Change these to the IPs. If you don't want to bind by IPv6 or IPv4, comment the line out by adding a # sign at the beginning of the line. One of them must be present.

listen_port_http = 80

listen_port_https = 443

You cannot comment out http port, as tor2web will automatically redirect to https, but you can change the default ports.

basehost = this should be the root domain name (example.com not www.example.com or any subdomain, unless you happen to be running behind a subdomain). It can also be an IP. If you do not use the exact name/IP that the tor2web service will be accessed from, tor2web will not function.

Sockshost = 127.0.0.1

socksport = 9050

These should match the SocksPort config in /etc/tor/torrc file.

cipher_list = DHE-RSA-AES256-SHA

I do not trust the others, as DSS is not quite common and is only used by Microsoft for some reason, and RC4 can be misused at times.

mode = TRANSLATION

onion = hidden service name: name.onion (jntlesnev5o7zysa.onion - piratebay's HS)

blockcrawl = True

Using mode Translation means you'll bind tor2web to a specific hidden service defined in the onion option. If you want tor2web to function as a general proxy, leave the default options. The blockcrawl option blocks search engines.

I commented out the email notification options as I don't really care about notifications.

#mirror = ...

comment it out unless you happen to be running multiple tor2web nodes and want this one to list them in the banner.

6) Clean Up & Run the Services

If you're running Squeeze, remove the Wheezy main repo and only keep the security one to prevent upgrading the entire host to Wheezy.

Now run the tor2web service: (it will run tor for you)

service tor2web restart

You'll be asked to input the password of the certificate every time you [re]start the service, unless you have removed the password. Read the caution about it above.

It's always a good idea to NEVER ssh into your hidden service node using its real IP from your tor2web node. Should your tor2web node ever get seized or compromised, you do not want anyone looking at the logs or history to find the IP of your hidden service, as it won't hidden anymore.

7) Help

If you need my help setting up a HS, never contact me with your personal email and do not ask for help in the comments section. Create a fake email or use tormail.org. I don't want to know why you're setting it up or what kind of material you're hosting. The less I know, the better for the both of us.

You can ask anonymously on my blog about generic config or a problem you're having, but if you need specific help, send me an email with no details and then we'll agree on how to proceed.

8) Sources

• http://backports.debian.org/Instructions/
• https://github.com/globaleaks/Tor2web-3.0/wiki/Getting-started-with-Tor2web
• https://www.torproject.org/docs/debian

No More Passwords

Too many websites have been breached in the past 24 months: 21 Sony sites, Gawker, and most recently LinkedIn. A minimum of 20 million passwords were leaked causing chaos on the Internet, from increase in spam originating from legitimate email accounts, to stolen credit cards used for money laundry from stolen emails attached to Amazon, PayPal, eBay and other online payment systems and stores.

This is an article showing what password crackers have done with all those leaked passwords; in summary: Minimal work is now needed to crack 90% of passwords in less than 24 hours!!!

Users are stupid. Fact well established thanks to all those leaks, where users have used the same password for their accounts as the email password. But, for the website developers to also be a failure in understanding proper password hashing & encryption? This is the ultimate failure that users cannot see coming until it's too late.

So why are we relying on passwords still? I own accounts at least 15 different websites and I do not like the idea of Single Sign On where one password allows me to login to all of them. That's simply insecure & risky.

The answer is very simple: We don't need passwords in general. Websites should instead offer authorization/access codes in combination to email addresses to access content. Those codes are auto generated by the website, random, long (128+ characters), and most importantly, the user does not have to input any data nor remember anything. It's important to not tie the code to any user data (salting).

The only thing that needs a password is: Email and online payment systems. Everything else should send its auth code by email. When a user wants to login, they go to their email, open the email that has the code and copy/paste it to login.

In case a website is cracked, then users aren't at risk & the website maintainers can simply regenerate all auth codes and email them to the users.

As for now, I adopted the "make a silly temp password" method. I keep forgetting passwords on purpose and every time, I reset the password and enter a new temporary and random password, until website maintainers cut the crap and ditch this password scheme.

Arab Internet Governance Forum: Preparations

Ahmad Al-Ibrahim is organizing a meeting to discuss topics and seek participants for the upcoming Internet Governance Forum event later this year.

The forum will be called "Arab Internet Governance Forum." There will be a brief about the scope here and more details will be discussed in a meeting with the bloggers.

Scope of the forum:

• Focus on discussing public policies related to internet governance especially in the areas of access, stability, security and development.
• Facilitate the exchange of information, best practices, knowledge and lessons learned by involving experts, technical community and academics.
• Gather different opinions and build consensus for harmonized Arab views on priorities and on mechanisms to respond to Arab countries needs related to internet governance issues.
• Discuss emerging issues and develop recommendations on them, as appropriate.
• Build and develop capacity in internet governance as well as improve the participation of all stakeholders to benefit from all possible resources of knowledge and expertise.
• Communicate the Arab positions globally and enhance the Arab role in formulating global internet governance policies.
• Engage in outreach with the internet governance forum and other regional IGFs with the purpose of exchanging knowledge and expertise.

IGF 2012 will be hosted in Kuwait and organized by KITS.

The main themes of the forums are:

• Access
• Openness
• Security and Privacy
• Content
• Managing Critical Internet Resources
• Youth

This preparation meeting will be held on Sunday August 5th, 2012 in KITS @ 9:30 PM.

You can invite as many people as you want, as we want this to reach all the bloggers if possible. It's important for all to know about it.

Drizzle, NGINX, PHP and PHP-APC

Introduction

This is a guide/howto on setting up Drizzle database, Nginx webserver, PHP (CGI) and PHP-apc (bytecode cache) on Debian Linux 6 (codename Squeeze).

NOTE: If the guide is too messy to read here, head over to this Google Document for better formatting.

Why?

Apache and MySQL are quite heavy and MySQL has been becoming worse thanks to the idiots in Oracle. NGINX has been getting a lot of recommendations and it’s proving itself to be quite stable and faster than any existing webserver in the arena.

Drizzle DB is the child of the co-founder of MySQL after he left MySQL when Sun bought it. Its main focus is web applications, and easy replication of databases.

From preliminary tests on a non-optimized virtual machine, I was able to reach 800 requests/sec for read/write operations and 2400 requests for read-only operations, hitting my URL shortening web application on NGINX and Drizzle. My VM had 1 core and 512MB RAM, but only 69MB RAM was used during the tests!

Stress Test

Hardware: Lenovo laptop with an Intel(R) Core(TM)2 Duo CPU P8600 @ 2.40GHz, 6GB RAM, running Debian6 32-bit.
Software: VMware Workstation v7. The VM has 512MB RAM and 1 core allocated, running Debian6 32-bit (business card installation). VMware tools were not installed during the stress tests.

I had apc statistics enabled and access logging enabled in NGINX at first, but turning them off reduced load times from 126ms to 16ms for read/write operations and from 40ms to 4ms for read-only requests.

Read/write test: ab -c13 -n 10000 http://192.168.59.135/shorten.php?longurl=http://bit.ly
Requests per second:    789.07 [#/sec] (mean)
Time per request:       16.475 [ms] (mean)
Time per request:       1.267 [ms] (mean, across all concurrent requests)
CPU utilization: 25% Drizzle, 19% NGINX, 2.3% * 15 PHP CGI processes.

Read-only test: ab -c13 -n 10000 http://192.168.59.135/a
Requests per second:    2633.09 [#/sec] (mean)
Time per request:       4.937 [ms] (mean)
Time per request:       0.380 [ms] (mean, across all concurrent requests)
CPU utilization: 49% NGINX, 3.3% * 15 PHP CGI. Drizzle wasn’t showing in “top.”

The read-only test involved engaging a REWRITE rule from NGINX, which puts a tad bit more processing on its shoulders.

The numbers above are very specific to my application, but the numbers can be much better if I install VMware tools to provide VM optimizations, so don’t let the 49% CPU usage put you off.

0) Installation
0.0) Drizzle
Note: Drizzle relies on upstart, which means sysvinit will be removed.

First, add the PPA to /etc/apt/sources.lst using your favorite editor

      deb http://ppa.launchpad.net/drizzle-developers/ppa/ubuntu maverick main
      deb-src http://ppa.launchpad.net/drizzle-developers/ppa/ubuntu maverick main

Run:
      sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 06899068
      sudo apt-get update
      sudo apt-get install drizzle
(to continue, you’ll have to type ‘Yes, do as I say!’ excluding the single quotes)

Resouces:

http://docs.drizzle.org/installing/from_source.html#debian-install-commands

http://www.howtoforge.com/install-drizzle-on-debian-lenny

http://docs.drizzle.org/configuration.html

0.1) NGINX

      sudo apt-get install nginx

0.2) PHP

      sudo apt-get install php5-cgi php5-mysql php-apc

The PHP extension for drizzle is available as a PECL but it’s not kept up to date & since we’re gonna compile either way, we’ll have to install some dev packages & a compiler. Those can (should) be removed after the compilation of the extension, if you’re doing this on a production box.
      apt-get install php5-dev libdrizzle-dev make

This is to fix a bug in the configure script looking in the wrong place
      ln -s /usr/include/libdrizzle-1.0/libdrizzle /usr/include/libdrizzle


Grab the latest stable Drizzle PHP extension from here: https://launchpad.net/drizzle-php-ext
      wget http://launchpad.net/drizzle-php-ext/trunk/0.5/+download/drizzle-php-ext-0.5.tar.gz
      tar -zxf drizzle-php-ext-0.5.tar.gz
      cd drizzle-php-ext-0.5
      ./configure
      make -j2
      make install


Let’s clean up after the mess
      make clean
      apt-get remove php5-dev libdrizzle-dev make
      apt-get autoremove
      rm -I /var/cache/apt/archives/*

In my case, the modules were copied to: /usr/lib/php5/20090626+lfs/  and the module drizzle.so is ready to be included in php.ini later.

Resources:

http://www.phptutorial.info/?apc.configuration
http://devzone.zend.com/article/4793
http://php.net/manual/en/install.pecl.phpize.php
http://chrisschuld.com/2007/07/missing-phpize/

1) Configuration
1.0) NGINX

The configuration of nginx is not a standard process. Each website may have its own specific setup & needs that one would have to tweak the settings around to fit one’s needs. Make sure you refer to the referenced links to see all available options and things to avoid doing.

I’ll include my own configuration changes here and not the full configuration file.

Modify the file /etc/nginx/nginx.conf
   worker_processes 3;


   error_log /var/log/nginx/error.log;
   pid /var/run/nginx.pid;


   events {
       worker_connections 1024;
       multi_accept on;
   }


   http {
       include /etc/nginx/mime.types;
       access_log off;
       # if you want to have an access log, comment the line above and uncomment the following one
       # access_log /var/log/nginx/access.log;


       sendfile on;
       tcp_nopush on;
   }

Modify the file /etc/nginx/sites-enabled/default
   index index.php index.html index.htm;


   server {
       # this block redirects all connections to www.domain.com to domain.com 
       # this is handy for cache configurations like Varnish & for statistics
       # if you prefer to view your site as www.domain.com, swap server names
       listen 80;
       server_name www.domain.com;
       rewrite ^ $scheme://domain.com$request_uri redirect;
   }


   server {
       listen 80;
       #listen [::]:80 default ipv6only=on;


       server_name domain.com;
       root /var/www/;
       #access_log /var/log/nginx/localhost.access.log;


       location / {
           try_files $uri $uri/ /index.php;
       }


       location ~ \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
           #I don’t want it to search for directories so I removed $uri/
           try_files $uri /index.php;
           #enable this if you enabled access logging previously
           #access_log off;
           expires 30d; #useful for caches
       }


       location ~ \.php$ {
           try_files $uri /index.php;
           include fastcgi_params;
           # unix sockets are faster & better than binding to a port
           fastcgi_pass unix:/tmp/php.socket;
       }
   # remember to include other settings from the original config file
   }

Modify the file /etc/nginx/fastcgi_params
   fastcgi_param  SERVER_SOFTWARE    nginx;
   fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
   fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;

Create a new file /etc/init.d/php-cgi

#!/bin/bash

BIND=/tmp/php.socket

USER=www-data

PHP_FCGI_CHILDREN=15

PHP_FCGI_MAX_REQUESTS=1000

 

PHP_CGI=/usr/bin/php-cgi

PHP_CGI_NAME=`basename $PHP_CGI`

PHP_CGI_ARGS="- USER=$USER PATH=/usr/bin PHP_FCGI_CHILDREN=$PHP_FCGI_CHILDREN PHP_FCGI_MAX_REQUESTS=$PHP_FCGI_MAX_REQUESTS $PHP_CGI -b $BIND"

RETVAL=0

 

start() {

      echo -n "Starting PHP FastCGI: "

      start-stop-daemon --quiet --start --background --chuid "$USER" --exec /usr/bin/env -- $PHP_CGI_ARGS

      RETVAL=$?

      echo "$PHP_CGI_NAME."

}

stop() {

      echo -n "Stopping PHP FastCGI: "

      killall -q -w -u $USER $PHP_CGI

      RETVAL=$?

      echo "$PHP_CGI_NAME."

}

 

case "$1" in

    start)

      start

  ;;

    stop)

      stop

  ;;

    restart)

      stop

      start

  ;;

    *)

      echo "Usage: php-fastcgi {start|stop|restart}"

      exit 1

  ;;

esac

exit $RETVAL

Run the commands:

      chmod +x /etc/init.d/php-cgi

      update-rc.d php-cgi defaults

You are now able to start the php cgi service: service php-cgi start

References:

http://wiki.nginx.org/DirectiveIndex

http://wiki.nginx.org/IfIsEvil

http://wiki.nginx.org/Pitfalls

http://wiki.nginx.org/NginxHttpLogModule#access_log

http://wiki.nginx.org/PHPFcgiExample

http://tomasz.sterna.tv/2009/04/php-fastcgi-with-nginx-on-ubuntu/

http://www.howtoforge.com/installing-php-5.3-nginx-and-php-fpm-on-ubuntu-debian

http://interfacelab.com/nginx-php-fpm-apc-awesome/

1.1) PHP

These are minor modifications and you should take an overall look at the config file to see if you’d like to make any other changes.

Modify the file /etc/php5/cgi/php.ini

      ; this prevents PHP from executing scripts uploaded by users into image directories

      cgi.fix_pathinfo=0

      ; required for security reasons on CGI deployments

      cgi.force_redirect=1

      expose_php = Off

      ; original value is 128M which in my opinion is too much

      memory_limit = 64M

      ; before the File Uploads section, add this

      ; apc settings

      apc.shm_size = 32M

      apc.stat = 0

      ; before the Module Settings section, add this

      extension=drizzle.so

References:
http://devzone.zend.com/article/12618

http://www.phpjabbers.com/measuring-php-page-load-time-php17.html

1.2) Drizzle

Run:

      mkdir -p /home/drizzle/db/.temporary

      cp -Rv /var/lib/drizzle/* /home/drizzle/db/

      chmod -R 750 /home/drizzle

      chown -R drizzle:drizzle /home/drizzle

      mv /etc/init/drizzle.conf /etc/init/drizzle.conf.orig

Make a new file: /etc/init/drizzle.conf

      # Drizzle Service

      description     "Drizzle Server"

      author          "MBH "

      start on runlevel [2345]

      stop on runlevel [016]

      expect fork

      script

          DRIZ_VARS="--user drizzle --datadir /home/drizzle/db --drizzle-protocol.port 3306"

          start-stop-daemon --quiet --start --pidfile /home/drizzle/db/drizzle.pid --chuid drizzle --group drizzle --startas /usr/sbin/drizzled -- $DRIZ_VARS

      end script

Notes:

• Drizzle doesn’t support unix sockets to make sure applications connect to 127.0.0.1 rather than localhost, if the DB is local.
• The drizzle username created in Debian doesn’t have a shell nor a home directory, and it should remain this way.

You can now start poking with Drizzle and make your own applications. Here’s a link for a quick usage of Drizzle and PHP: http://devzone.zend.com/article/4793

References:

http://www.linuxjedi.co.uk/?p=35

http://upstart.ubuntu.com/wiki/

http://upstart.ubuntu.com/wiki/UnprivilegedUsers

http://devzone.zend.com/article/4793

http://docs.drizzle.org/options.html

http://docs.drizzle.org/

http://www.howtoforge.com/install-drizzle-on-debian-lenny

http://azhari.harahap.us/2011/04/connecting-drizzle-from-php-and-phpmyadmin/

Viva's Insecure Online Payment System

Viva's website allows you to pay your bills using credit cards like VISA or MasterCard, or the regionally accepted K-Net. In the case of VISA and MasterCard, Viva pushes the data (your phone number, email, credit card number, expiration date, cvv code) in clear text, without encryption!

In any website that takes payments or has a user authentication portal, should offer a secure channel using SSL/TLS and the user sees the link starting with "https." In addition, current browsers show part of the address bar in green when the browser is able to verify that the website is secure and it is who it claims to be.

A friend was worried as she didn't see "https" in the URL, so I checked the pages' source code to see if it was sending the data in a secure channel via javascript or some other mean, without showing it in the URL, alas, it was all in the clear text.

Here's a screenshot of a sniffed packet session from my machine to viva.com.kw (94.128.1.30), while submitting the form data.

This is some of the text from the packet (I removed my personal data):

prepRechargeCreditForm%3Aholder=Mojo+Jojo&prepRechargeCreditForm%3AcardNumber=4550xxxxxxxxxxxx&prepRechargeCreditForm%3AyearList=XY&prepRechargeCreditForm%3AmonthList=XY&prepRechargeCreditForm%3Acvv2=XYZ&autoScroll=&prepRecharg

I have contacted VIVA Telecom and Mr. Salman Al-Badran (CEO) via Twitter  on Saturday Oct 1st (when I found out about the issue). Mr. Salman replied on the same day and said he'll forward it to his team. I also gave him my email address in case his team wanted to get in touch with me.

Three days later I told Mr. Salman that the problem is still there and that I'll publish my findings on my blog next Sunday (a week from reporting the issue). He replied saying it'll be fixed on Oct 6th.

[this is fixed now] I checked today (Oct 6th) and the form now redirects to a secure website (https). The address bar may not always appear in a green color; In that case, do not use the website, but instead, refresh or try again until the icon looks like this:  not like this . Description of these can be found here. (the two images were produced by Google.)

[this is fixed now] Also, it seems like the changes they made broke the form in the main page, which sends the @ sign of the email address in hex form (%40). Just change the %40 to @ and submit the form again and it'll work.

I'd like to thank Mr. Salman for his prompt response to the matter. I wish other enterprise corporates' CEOs were as attentive and interactive with the consumers as he is. I would also like to point the finger at the technical team and the audit team who let this one slip by! This is a trivial and pivotal requirement of any online payment system!


What kind of complications the insecure site would have?
An attacker in the same network as you are can capture clear text that is being sent from your machine/mobile to the website. That's why the data shows in clear text in the picture above. If the connection was secure, it would have been garbled.

If the address bar showed in red, it is still possible to attack a visitor from the same network, by altering the content that is being transmitted via insecure channels, which could lead to changing the form itself and the user would end up sending the data to a different script/page or a whole different website that the attacker crafted to collect the data.

Botamba Owns Your Twitter Account

Updated

Scroll to the bottom for the updates.

Botamba.com is a blog aggregator and it used to allow creation of users and then each user would link his/her blog(s).

I checked yesterday after a friend mentioned it redirects to twitter now, and it seems like they did changed their methodology to requiring Twitter and it asks to allow their application to access your Twitter account!!! It was based off a typical user/pass authentication previously.

What's worse is that their application gets the following permissions:

• Read tweets from your timeline (even if it's private)
• See who you follow, and follow new people
• Update your profile
• Post tweets for you

It can not do the following:

• Access your direct messages
• See your Twitter password

Why does a blog aggregator needs access to my Twitter account, see my timeline, post for me, update my profile & other privileges?! That's a massive privacy invasion, even if it provides certain ease of use for some users (to use their existing accounts).

If you did not know about this, and you've already allowed Botamba to access your account, you can deauthorize it by going to your profile settings, applications and deauhorize it from there.

So what could Botamba do?
They can get your tweets and follower list and sell that information to advertisers (currently sponsored by Zain). Advertisers can use the info to send you targeted advertisement by reading your tweets and seeing where you have been or what you liked and talked to with your friends.

How can I tell if Botamba posted on my timeline?
Some Twitter clients show the name of the program that posted on the timeline. In this picture you can see under the tweet the line "from TweetDeck." That's the name of the program and in case of Botamba, you'll see the line "from Botamba."

Solution?
Ask Botamba to NOT use Twitter for authentication & not invade your privacy (even if they *promise* they wouldn't), and ask them to put back the old user registration system, or use OpenID instead.

I'm waiting for a comment from Botamba on this issue to see what they have to say about this.

Update:
- Oct 4th: Botamba has deployed a user/pass authentication system. You can link your Twitter account but it gets read-only access to your timeline
- Oct 5th: Botamba's valid reasoning in using Twitter account-linking: If you own a public Twitter account that you'd like to be mentioned in Botamba's tweets/posts, you can link it to your account (read-only mode & only reads your public timeline). If you have a private account, you wouldn't want it to be public & tweet it, so you won't add it.

In the end, I'd like to thank Botamba for being responsive and understanding to the sensitivity of users' privacy!

SSL Certificates Stolen

The issue of DigiNotar's breach keeps getting worse; Computer World writes that over 200 SSL certificates have been generated & stolen, signed for Google, Yahoo, Mozilla, Tor Project among many others.

Google & Mozilla have updated their browsers to remove the affected certificates/invalid signatures, but in the latest build of Chrome on Linux (13.0.782.218) I still see DigiNotar as a CA.

I suggest you delete DigiNotar from all your browsers as it's not worthy of trust at the moment. Remember, if you update your browser, double check its existence as it may be added again by the update.

MtGox Compromise And What It Means To Me

MtGox is a BitCoin Exchange Market for the BitCoin digital currency and I have read about BitCoin last year but waited for it to mature before stepping into the market.

About two weeks ago I invested in MtGox about $880 USD and 2 days later a Distributed Denial of Service (DDoS) attack was launched at MtGox. I did some reading and it wasn't the first time they were under attack and they had everything secured and well planned so I wasn't worried.

The market volume suddenly increased with massive quantities flooding the market, followed by a market crash (prices dropped to $13/BTC where the price previously was $17). MtGox closed the market and halted all transactions. Apparently, they were compromised.

I panicked at first as I couldn't access my account on MtGox (they froze all) and they said they were going to do a roll over, which means undo everything and return to the state before the crash.
I wasn't happy because I didn't know the state of my money & coins, and those who bought coins at cheap prices could have withdrawn the coins from the market which means there is no way to trace the coins nor return them.

I still don't know how will MtGox deal with those who bought cheap coins & withdrew them, but if they do a roll back, they'll get their money/coins back to what they had before the crash, in addition to the coins they withdrew! That means extra profit! Unless they monitored the withdrawn amounts from each account and will balance those out.

Anyway, I searched for my username on Google in relation to MtGox but nothing came up. Maybe Google didn't have time to index all pages, they're underground or maybe my user wasn't affected. Either way, my account will be rolled back and the password I used was unique to MtGox itself, so the attackers can't access my email or any other service associated with my email.

Moreover, MtGox has switched to an obscenely secure password hashing scheme: SHA-512, along with contacting GMail and providing them with a list of compromised email addresses so GMail could block them and require a password reset before accessing them (I was one of those affected).

MtGox keeps updating its post with news of what they're doing so they've not neglected their customers, even when under such a big stress.

In my opinion, I'm sticking with them because only at rough times you'll see what a good company can do for its customers, and while there are inconveniences, the overall success of containing the situation was successful.
Perhaps people would have felt much better had MtGox shared how it manages its systems and what kind of security schemes are implemented so that we know they can be trusted. I hope they do that soon.

Away from MtGox, and in general, those who know me well know pretty well that I'm a paranoid person when it comes to computers and being online. Below are some of my practices for staying safe:

• Different passwords for different accounts.
• If I forgot a password, it's OK, I request a password reset.
• Passwords are at least 10 camel-cased alpha numeric and special characters.
• My passwords are a mixture of meaningful words forming a non-meaningful sentence: R0undTomatoe$Insid3Triangl3Whalez
• Always check my emails from my own systems & never someone else's (not even family or friends).
• GMail shows you the list of IPs of who last accessed your account & alerts you on suspicious access.
• When you create an account at a new site, request a password reset; if they send you the exact password in plaintext, close your account. They're not securing their database & don't care about your account security.
  If they send you a link to reset the password, or email you a randomly generated password, then you're fine.
• Use different browsers: One for your accounts and another browser for everything else.
  I use Chrome for GMail and Twitter. All links in emails or tweets are opened in Incognito mode (separate/isolated processes from the main) or in Firefox.
• I use Linux. No Windows or Mac for me, and please don't laugh at Windows if you're a Mac fanboy, Mac OSs are less secure than Windows but aren't targeted as much because you're a minority.
• If you have to use Windows, use a good antivirus. I put Kaspersky on my family members' machines. I had used it for companies and fully trust it.
• Do not open emails from strangers.
• Emails that say they're from good & honest people are most likely aren't.
• Email that come from addresses of people you know aren't necessarily from them. The addresses can be spoofed, i.e., I can send you an email from your account without accessing your account. Magic.
• If someone you know asks you for your password or to install something you don't know about, call them and ask them in person.
• If you read online about a nice service that you use that isn't secure, you better not shrug it off and say that you won't be affected. That's how everyone gets slapped in the end.

I probably have other habits that don't come to mind right now. If you have any suggestions, leave a comment (you can do so anonymously) and I'll be more than happy to add it to the list.

Live paranoid. Live safe.

Untangle To Include Web Cache

Untangle is a gateway controller built on top of Linux. It can act as a router or a transparent bridge in the network.

Untangle is open source and offers a free version. The free version provides the following:

1. Web URL filter
2. Virus Scanner & Blocker
3. Spam Blocker
4. Attack Blocker
5. Phish Blocker
6. Spyware Blocker
7. Protocol Control (Layer-7 filtering)
8. Captive Portal
9. Firewall
10. Intrusion Prevention
11. OpenVPN
12. Reports

It currently does not provide a caching proxy, but I received an email notification today that the Untangle Web Cache feature request ticket, that was opened 2 years ago, has been assigned to a developer and should be included in Untangle 8.1. The current version as of this writing is 8.0.

I don't know when it's due, but that's certainly great news! I've been told by many people that making squid work with clamav is a huge headache as it often just dies (squid). So I'm guessing the Untangle team has finally worked a way to get around these issues.

Unscientific Browser Statistics

In my previous post, Apocalypse Survival Guide, I posted a link to the slides using Google's URL shortening service. I had a few reasons for choosing that specific service:

• Its short URLs are permanent.
• The service is unlikely to be under odd political disputes.
• It detects malicious websites & warns you.
• It provides neat statistics.
• It generates a small QR barcode image to share the short URL.

From the statistics link http://goo.gl/info/XHgI you can see some interesting things like times & dates of clicks, referrers, countries, browsers & platforms (operating systems / devices).

As of this writing, the link to the guide I posted had 62 clicks but shows an intriguing trend in browser usage:

• Chrome: 11 users
• Firefox: 11 users
• Safari: 7 users
• Mobile: 3 users
• IE: 1 user
• Opera: 1 user

What's even more interesting is the platform usage:

• Windows: 16
• Macintosh: 10
• Other Unix (since Mac is considered Unix): 4
• iPhone: 3
• Linux: 1 (that's probably me!)

So people are using Chrome & Firefox more on Windows. That's heart-warming & gives me hope in humanity.

The next time you want a URL shortener, use Google's and check out the statistics by adding /info/ in the middle of the short URL (see the link above).

I used bit.ly's service but didn't like its statistics page though it links to Twitter & Facebook public feeds for reference, but it doesn't always show the numbers or referrers correctly.

Websites and Account Management: Threat to Privacy

It's astonishing how many websites are still using archaic methods in storing their users' personal information.

I did stumble across a few in the past but have no recollection of them now, pretty much because I never bothered using them ever again.

The latest encounter was a few minutes ago when I went  to ChangeThis.com to vote for a manifesto. It required registration and I did register, only to find an email from them containing my password in clear text!
I followed my suspicion and changed the password, then logged out, then clicked on "Forgot password" to have them email me the password, and there it was: They sent me the password in clear text rather than a randomly generated one!!!

Why is this an issue? Simply because should one day their website gets hijacked, all registered users' passwords are visible to the attackers and since it also holds their email addresses, the attackers can try each email & password to see if it logs in or not, then collect those that were successfully logged in and sell them to SPAM networks.

Another issue is having a rogue/snoopy employee at the website trying to login to emails using the clear password.

This method of storing password is absolutely unacceptable! Websites should store hashes of the passwords and not the passwords in clear text, and when the user requests a password reset, a randomly generated one should be created, saved & served to the user.

Google To Phase Out IE6 Support

As received by email: (emphasis is mine)

Dear Google Apps admin,​

In order to continue to improve our products and deliver more sophisticated features and performance, we are harnessing some of the latest improvements in web browser technology. This includes faster JavaScript processing and new standards like HTML5. As a result, over the course of 2010, we will be phasing out support for Microsoft Internet Explorer 6.0 as well as other older browsers that are not supported by their own manufacturers.

We plan to begin phasing out support of these older browsers on the Google Docs suite and the Google Sites editor on March 1, 2010. After that point, certain functionality within these applications may have higher latency and may not work correctly in these older browsers. Later in 2010, we will start to phase out support for these browsers for Google Mail and Google Calendar.

Google Apps will continue to support Internet Explorer 7.0 and above, Firefox 3.0 and above, Google Chrome 4.0 and above, and Safari 3.0 and above.

Starting next week, users on these older browsers will see a message in Google Docs and the Google Sites editor explaining this change and asking them to upgrade their browser. We will also alert you again closer to March 1 to remind you of this change.

In 2009, the Google Apps team delivered more than 100 improvements to enhance your product experience. We are aiming to beat that in 2010 and continue to deliver the best and most innovative collaboration products for businesses.

Thank you for your continued support!

Sincerely,

The Google Apps team

A subtle sucker-punch to Microsoft for not supporting their own products, while still supporting Firefox 3.0. I thought FF 3.0 would be phased out too!

As for Chrome, as far as I know the stable version is 3.x while 4.x is beta, but I could be wrong.

CakePHP: Initial Problems

I just started with CakePHP, a PHP framework, and have been having some problems going through the "15 minutes" blog tutorial. It took me about 2 days to dig my way out through openSUSE, Apache, Linux and CakePHP itself.

First issue I had was enabling mod_rewrite on openSUSE. To do that, edit the file: "/etc/sysconfig/apache2" (Assuming Apache2.2)

• Go to the line that starts with "APACHE_MODULES" and add "rewrite" at the end just before the closing quote.
• Save the file then run "sudo SuSEconfig" to update Apache's configuration files.

I'm not using virtual hosts. I have downloaded the latest stable CakePHP and extracted it in my "/srv/www/htdocs" directory and named it "blog"

mj@linux-mlvm:~$ ls -l /srv/www/htdocs
drwxr-xr-x  5 mj   users 4096 2010-01-23 02:28 blog

So I access the blog through: http://localhost/blog/

After configuring the database and the connection settings for CakePHP as instructed in the tutorial, I had to set permissions for the tmp directory: "/srv/www/htdocs/blog/app/tmp"

sudo chown wwwrun /srv/www/htdocs/blog/app/tmp

This will set ownership of the directory to the user running Apache. In my case, it's wwwrun. On a shared web host, it's often nobody. You can find out which username Apache uses by making a small PHP script:

<?php echo `whoami`; ?>

Visit the script in a web browser and voila!

Second issue: when reaching the step to create the posts view, I created the directory:

mkdir app/views/posts

But I got an error message in the browser when visiting the link: http://localhost/blog/posts:

Missing View
Error: The view for PostsController::index() was not found.
Error: Confirm you have created the file: /srv/www/htdocs/blog/app/views/posts/index.ctp
Notice: If you want to customize this error message, create app/views/errors/missing_view.ctp

After verifying that everything is properly spelled and whatnot, turns out it was a dumb mistake of not checking directory permissions:

mj@linux-mlvm:/srv/www/htdocs/blog/app$ ls -la
drwxr-xr-x 12 mj     users 4096 2010-01-23 02:03 .
drwxr-xr-x  5 mj     users 4096 2010-01-23 02:28 ..
drwxr-xr-x  3 mj     users 4096 2010-01-12 05:58 config
drwxr-xr-x  3 mj     users 4096 2010-01-21 22:32 controllers
-rw-------  1 mj     users   67 2010-01-23 02:03 .directory
-rw-r--r--  1 mj     users  169 2010-01-23 02:08 .htaccess
-rw-r--r--  1 mj     users  859 2010-01-12 01:47 index.php
drwxr-xr-x  3 mj     users 4096 2010-01-12 01:47 locale
drwxr-xr-x  4 mj     users 4096 2010-01-19 06:54 models
drwxr-xr-x  2 mj     users 4096 2010-01-12 01:47 plugins
drwxr-xr-x  5 mj     users 4096 2010-01-12 01:47 tests
drwxr-xr-x  6 wwwrun www   4096 2010-01-12 01:47 tmp
drwxr-xr-x  3 mj     users 4096 2010-01-12 01:47 vendors
drwxr--r--  8 mj     users 4096 2010-01-19 07:00 views
drwxr-xr-x  5 mj     users 4096 2010-01-19 07:36 webroot

Never mind the fact that I'm using my own username for the directories. It's just for quick editing.
Focus on the bold line which has "views" -- since I didn't assign the user wwwrun for that directory, the permissions prevented Apache from accessing the directory resulting in the above Missing error message.

You can either change directory ownership as done for tmp, or change permissions:

chmod 755 views

Note: If a directory is not executable, you can't change to it.

Google's Response to Chinese Attacks

Google has finally spoken officially on the attacks on its infrastructure and the theft of intellectual property in China.

It's not clear in their response what was stolen from Google itself, but it did state that some email accounts of Human Rights activists were accessed.

For now, as a response, Google has started providing uncensored search results, which the Chinese government had mandated at the time of business negotiations in 2006.

It's yet not clear whether Google will withdraw from China, but it's a possibility.

The link above contains links to detailed reports on the attacks and responses.

Facebook Desperate For Love

After so many Facebook privacy breaches by Facebook itself, and the recent statement of its founder on how privacy is not important and everything should be publicly available, seems like Facebook is trying hard to get some back respect and love...

If privacy isn't that important, then why is its founder's profile private? The same person calling for public exposure of info... hmmm???

Note: Mark Zuckerberg (founder of Facebook) has 2 profiles: A public one (for stunts) and a private one (which got breached when they broke their own privacy rules!).

Try harder you snob.

Adding IPs to a Gateway

I've been using a VPN and I want only certain websites to go through the VPN, while the rest through my current connection.

On Linux, after connecting to the VPN, I can make it execute a shell script of my choice, by default named: ip-up.local -- below is my script:

#!/bin/bash
# add domain names to theHosts array -- don't edit anything else
# the script will have each site's IP pass through the gateway of the
# connection being established

theHosts=( pandora.com last.fm hulu.com youtube.com netflix.com )

ips=$(for host in ${theHosts[@]}; do host -4tA $host; done | awk '{print $4}')
for ip in $ips; do /sbin/route add -host $ip gw $4 dev $1; done

ip-up.local should be in /etc/ppp/

Make sure you check the option to tell your connection to not replace your existing default route.

Al-Ghanim X-Cite: Reported Attack Site

A friend sent me an email saying that Al-Ghanim's XCite website is being reported as a malicious website, by Firefox and Google.

Go to their website http://www.xcite.com.kw/, click on Search then "Search By Keyword"

Since they run .asp pages, they have a Windows web-server and it seems to be infected. Also, according to Google's report, the website has been reported for malicious activity 5 times in the past 90 days.

If you know anyone who works at Al-Ghanim, make sure you pass this to them so that they clean up their server! (My company sells and deploys Kaspersky for enterprises)




I tried contacting Al-Ghanim via their online web-form but it crashed...

Wardriving Kuwait: Listing Access Points

"Wardriving is the act of searching for Wi-Fi wireless networks by a person in a moving vehicle, using a portable computer or PDA." -- Wikipedia

Ever since I got my new mobile (HTC Hero) which has both GPS and WiFi, I've been wardriving; simply run a program and it does all the dirty work of scanning for wireless networks and attaching the geographical location of these access points (APs).

The program I use is wardrive. It's written by Raffaele Ragni and is freely available in Android's market.

A quick link to reach the full map is: http://sites.mbhbox.net. If you would like a list of only the open APs, visit the program's website: http://wardrivedb.appspot.com

The purpose of this project is to collect statistics and show a map of open and secured access points along with other things.

Don't be shy. Leave a comment. Anonymous comments are enabled.

If you'd like to contribute to this project, email me: mbhkewl TheAtSign gmail Dot com.