* Posts by E

573 publicly visible posts • joined 22 Jun 2007

Page:

CERT: Linux servers under 'Phalanx' attack

E

Comments on comments

@Adam Williamson

Did so on the Debian boxes, all machines are updated regularly. We found the rootkit on a few up to date Redhat 5 boxes. I do not think the two are related.

@Richard Hebert

You probably want to download rkhunter and chkrootkit from the noted sites. There is no guarantee that any given distro is up to date or has not modified the package. I used the two programs built from source downloaded from the noted web sites. I did detect Phalanx successfully.

@Colin Wilson

Yes and no. Linux doesn't suffer from a registry, but there's no reason why a rootkit cannot be used to patch standard binaries. So maybe one uses tripwire or some such and can detect this. Problem is that no Linux distro that I've ever seen installs and runs tripwire by default.

@Peter Gathercole

Good rules and I in fact use them all. Linux being multi-user it's hard to enforce them across the board. Couple that with known exploits and something like a rootkit is going to succeed occaionally anyway.

"Lazy Admins"

1) I don't know that this is entirely fair, or at least not all the time. The RH5 boxes I found the rootkit on were fully patched, their admin had yum running update as a daily cron job. There was no "unpatched openssl or weak Debian keys" and the kernel was also current.

2) So, what should we do: regularly delete all the users' keys, force them to recreate the keys, and change the system's keys? Basically that would break so much functionality that they might as well use Windows. IMHO, that's not a vigilant admin that's a fascist admin.

3) Accounts will get compromised whether they are on a Windows, Mac or Linux box, offering an entry for the back hats. The means of subverting an account are numerous and not all involve software weaknesses - you'll have heard of social engineering and the ubiquitous sticky note?

E

Comment

This is not some BS from CERT.

Phalanx used to harvest SSL/SSH keys is out there, it is pretty sophisticated, it appears to archive the keys for collection by the operator of the rootkit, and it is not exactly rare. We've found several infestations of of this rootkit in the past few weeks where I work - we have a lot of Linux boxes.

If you run Linux machines then it would be a very good idea to install rkhunter (http://www.rootkit.nl/) and chkrootkit (http://www.chkrootkit.org/) and run them periodically. These are detection tools not cleanup tools.

The cleanup is, depending on your paranoia level, (a) boot off an install DVD to repair mode and delete the rootkit, or (b) format your disks and reinstall Linux.

If your keys have been lifted then at the least you must regenerate your system keys and user keys. Look out especially for users that have set up host-based authentication (ie ~/.ssh/authorized_keys) between machines they use.

This is potentially a very bad one, people.

DARPA in Tom'n'Jerry robo-brain quest

E

Acronyms

That acronym - synapse - must have spent time in Abu Graib.

Minister warns of national grid hack threat

E

It's the UK, n/p

Doesn't the UK just give the data away, or sell it to streamline directed advertising? Where's the problem?

Wind turbines put bats under (low) pressure

E

@Anonymous Coward

Well, actually there is a green case for nuclear: a while back researchers found a new(?) species of fungus growing inside the melted-down reactor chamber at Chernobyl. Radiation levels are high enough in the chamber to kill a mammal in a few minutes. The fungus is doing fine however.

Therefore not building reactors deprives the Chernobyl fungus of it's ecological niche.

Suicide squirrel knocks out Swiss TV

E

Surveillence

Clearly the UK needs more cameras watchiong the public spaces in order to protect the state from squirrels.

MetaRAM now pumping 288GB of memory into Intel boxes

E
Stop

Where / how to buy?!?

MetaRAM is very neat. I have people who could actually use 128+ GB to run simulations. We have some boxes with a lot of memory slots. I'd like to use MetaRAM RAM.

But... who is actually selling the things? Where can I go to buy some?

Anatomy of a malware scam

E

Have seen this elsewhere too.

I have seen a few users machines catch a variant of this malware from infected email attachments and also from .exe's downloaded via bittorent.

In the cases I saw, running the attachment or d/l file just installed the exploit and ran the xpantivirus2008 automatically, popped up the viruses found message.

It installed an executable in \windows\system32, and this thing would run at start up - not from registry run keys, or the start menu start folder nor as a service. I assume it patched some standard system exe to launch itself?

MacAfee detected it but could not remove it. Booted into safe mode, I could not remove it manually. There were open handles to the file.

It also would periodically pop up a system modal dialog with a test entry field and an alphanumeric code, and then demand the user type the code into the text box and click OK. This had enormous annoyance value.

Alas I cannot remember what MacAfee called it right now.

Intel CTO demos building blocks of shapeshifting robots

E

Wireless Resonant Link

Was done by Nikola Tesla roughly one hundred years ago. This is described in so many textbooks and enthusiast magazine articles and places on the web that I am surprised Intel would try to rebrand it - also that the Reg did not see through the attempt immediately.

Intel hands out rose tinted polarizing glasses to chip geeks

E

Prescription 3D glasses

I wear eye glasses. Will Intel's technology be available with custom ground lenses?

Intel stuffs Nehalem chips with joy

E

@Laurent_Z

Just run more instances side by side. That's much easier than learning posix threads.

AMD's 'Fusion' not a native CPU+GPU design

E

@Matt Bryant

Great point!

What about a quad core CPU + 4 GPU cores and AMD's HPC GPU API stack? Some serious computational power!

E

@AC

Wrt 64 bit apps... 64 bit XP, 2003 and I think Vista all exist. Linux was 64 bit from almost the moment the Opteron was released. 64 bit UNIXes have been around for at least 20 years (OSF/1). IBM DB2 and Oracle are 64 bit for many years. It's not a short list.

Of course 32 bit XP still dominates on the desktop but that's probably got more to do with that it's so hard to find a copy of 64 bit XP to pirate ;-)

Acer Aspire One A110

E

A few points

-- "Real techies will probably want to install an alternative distro, like Ubuntu." - nooo.... I think real techies will not install Ubuntu.

-- 100 - odd minutes is awful. That really defeats the purpose of such a machine.

-- The HP 2133 has this thing beaten on all fronts, even comes with a 'standard' Linux: SuSE.

Harness XML with PHP 5 extensions

E

@John Bayly

"Arbitrary method naming, no variable declarations & no strict types."

Not sure what you mean by arbitrary method naming - not a C# user.

PHP 5 did add support for typed parameters to class methods. It's not required but it's there and I've found it useful.

I guess it took me quite some time after learning C & C++ to accept fairly typeless scripting languages, but I can't recall where PHP confused types and did the wrong thing.

Is C# as strongly typed as, say, C++ without casting and void* ?

E

Real men

...use binary wireline protocols.

Three found guilty of web extremism plot

E

Thought Crime

Yup, that's what it is. Pretty much exactly what it is.

HP Procurve people buy into 802.11n

E

I am the first

to comment on this article.

Hadoop: When grownups do open source

E

@Ashlee

I'm not offended by profanity per se, just gratuitous profanity. That said, this latest article is less gratuitous than the previous ones. So there is hope.

IBM solves world's 'paper or plastic' crisis

E

Patenting what?

Are items 202 and 214 patented as well? If so does the patent specify that 202 & 214 are *my* head, *your* head, or just he person down the streets' head?

Transmeta hooks Nvidia for $25m power payment

E

Good Lord and Adam Smith and King Edward

Dint that Torsvald fellow work for Transmeta? Before the alter of win32 I swear, I herd lately that even Intel and AMD have been decieved into supporting that Linux thing! Godless commies, anti-profit-motive theeves, destroying good Amerikan corporations! How will we save the Iraqis in the face of this double dealing!?!

Jesus would weep.

Nokia's Trolltech renews Windows mobile vows

E

Qt Good

Qt is a good UI toolkit and it does a very good job on a variety of platforms. The signal/slot thing is a pleasure to work with, the Qt class hierarchy is pretty rational.

Nevertheless, and even in the strength of Qt, I'd advise Trolltech to avoid providing garish default icons that Redmond cannot deal with. MS might just buy Nokia in order to retain control of the desktop!

Paris Hilton - the compromised candidate

E

@Mark

A wippet with tits!

I'm in mind of a minx. Or a ferret.

Makes it look so much bigger going in!

Intel says 48 core graphics is just over the horizon

E

Naysayers

Judge the product on it's merits not Intel's past mistakes.

Even if it does not crack the high end GPU market I expect it will be successful in the HPC market. It looks pretty neat.

Sun may or may not be about to obliterate Oracle and Microsoft

E

@Gerhardt

Sure. Some people use MPI on multicore chips.

But, LOL, there will still be some people that will complain that MPI is too hard!

E

@AC, and another stupid-man's-threaded model too

"The problem is that you have to consider every other flow in the program which might touch list1 and list2, and set up a mutex which they all honour. Forgot one and the program crashes in an occasional and infuriating way."

Therefore, being a good programmer, you will immediately recognise that (a) you had best double check you are using the same mutex for all the list1 and list2 accesses; (b) test specifically the cases where obscure list accesses occur as well as the common cases.

Further, you do not "have to consider every other flow in the program which might touch list1 and list2" if you build the list as an instance of a class that controls it's own access - if you put the mutex inside the class. Someone else pointed out the basic idea with some Qt code above.

---

Finally, there is always OpenMP available for those people incapable of handling something like Posix threads or Win32 threads.

Though how one could fail to use Win32 threads properly is beyond me: IIRC there's only one mutex type but almost anything can be waited on.

E

Wanker

The author doubtless fears pointers. Threads are not difficult or hard: they merely require more planning than single threaded code.

Profanity is not inherently amusing. Unexpected or incongruous profanity can be funny but it gets tired very quickly. Spoken profanity is easier to make funny than written profanity - which almost never works.

Wit is much better than profanity and the author should strive to acquire some.

Ex-Googlers reinvent web search

E
Happy

Images

I searched on "Posix thread mutex" on cuil. It came back with links that seem well related to the search, but the pictures are a bit out there.

link title: "Boost.Threads - Mutex Concept", picture of book "Programming with POSIX Threads" by Butenhof.

link title: "Multithreading Programming Topics: Using POSIX Thread ...", picture of book "Programming with POSIX Threads" by Butenhof.

link title: "Qt Toolkit - Thread Support in Qt", picture of some cross stitch or petty point.

link title: "Thread Support in Qt", picture of a music CD "Star of Crash" (hard to read the title.

link title: "POSIX Threads Programming", picture of some men working on one of the cables atop a large suspension bridge.

I followed some of the links and they were indeed all related to POSIX threads, which is not too shabby. Just the pics were a bit odd.

Now, if I had searched on "POSIX rope mutex", or perhaps "insert object into STL container" I might have got some different pictures.

Interesting also that wikipedia did not constitute most of the first page of links.

E

diddlefinger

Wow, V, those are some excellent maps of Japan!

The FDRs of Green explain the gentle art of planet saving

E

Dogma

"...that the most efficient method of rationing something is price."

This may be true, or it may not. Price, however, is not the sole component in a rational decision.

Would the author drive a nuclear powered car that was cheaper than gas but had no radiation protection?

Rackable clears ICE Cube shipping containers for IBM blades

E

Questions

1: Why is it "white trash"?

2: Will one of these cubes get me over 120 FPS in Crysis with full eye candy? If so where can I pick one up?

Intel juices parallel programming for the masses

E

Hot Air

Library is not especially valuable unless the programmer knows what & how to thread in the first place. In which case pthreads / winthreads are perfectly useful.

US sees first airliner flight with laser defences

E

@Steve Mann

Good point. Historically - since end of WW2 - USA protected Middle East oil sources to ensure energy supplies to Europe and Japan, speedy reconstruction of which were considered important in inhibiting the spread of Soviet influence. Presumably the USA having it's hands on the throats of the countries supplying it's allies helped improve diplomatic relations between the USA and it's allies also.

Most of the output of the Middle East has always gone to Europe and Japan.

E

Error

The British helicopter getting shot down is unfortunate, but it was involved in a war.

To conflate losses during military actions with losses due to attacks on civilians is an error of several varieties.

Mono man accuses Mac Gtk+ fans of jeopardizing Linux desktop

E

@Josh Holman

Nope. I had no idea.

Makes even less sense in that case.

E

Rule of Law

My comments wrt .NET notwithstanding, I applaud the even tone and agnosticism of Law.

E

Comment

Perhaps I miss de Icaza's point. I doubt it. So...

I have some issues with a guy devoted to porting Microsoft's attempt to embrace extend and extinguish C++ (via managed C++) to non-Microsoft platforms criticizing a project which has built an excellent standard C & C++ cross platform GUI API (GTK/GTK+).

You might raise the hoary arguments that .NET frees one from memory management and the bone crackingly fearful specter of pointers. I'll just say that if that's your POV, then you need to go back to your first year programming course - the one where they taught you about allocation, de-allocation and what an address is, or that nifty article you once read in Dr. Dobbs or C++ Journal about smart pointers.

.NET is nothing more than an attempt by MS to let people keep coding for WIN32 using C++ tropes but still lock them into Windows. .NET remains under MS's control, ISO or ECMA or whatever not withstanding. MS can still release the next version which can break the 'standard' and just call it dotdotNET or such. Therefore whatever gets created using MONO will be hostage to MS's intents. .NET/MONO is an MS attempt to subvert the wide applicability across platforms of one of the dominant programming languages (C++) nothing more and nothing less.

People who expect to leverage MONO to achieve Linux / Windows interoperability will get a rude awakening just as soon as some MONO app starts to look like a killer. A service pack from MS *will* appear that makes that killer app work so much better on Windows.

Java makes a lot more sense than MONO/.NET for cross platform software because at least Sun cannot seriously entertain strong arm tactics. Solaris' market share is too small and there is (was? - could be again - I'm an unreconstructed C/C++ programmer) an excellent Java VM implementation from IBM to keep Sun honest.

Whether Linux ever makes it on the desktop is irrelevant to de Icaza's argument. IMNSHO he's pissed because he works for Novell and he's starting to realize that Novell's strongest corporate trait is to back the right idea with the wrong horse - in this case cross platform interoperability with MONO.

That's just my $200,000,000,000.00 worth. All the tech managers and CIOs who apprehend the blinding truth of what I have just pointed out can contact me at emerth@hotmail.com for instructions on how to send me the consulting fee.

Google releases serialization scheme

E

Wanna bet

the people at Google used LEX to generate their parser?

I just read over http://code.google.com/apis/protocolbuffers/docs/overview.html and I dunno quite what to say. Every couple of years we to see some gee-whiz system mapping classes onto 'generic' text descriptions stirred in with rehashed RPC. If the mapping comes from an egghead in a university nobody much gives a damn. If it comes from Google it is news. If it comes from Microsoft it's less news but it gets used a lot.

Thus the power of money I suppose.

Initial Intel 'Nehalem' CPUs as cheap as chips

E

@pctechxp

Well, yes. Did you think all those pins for memory would fit in 775?

Levi's suffers profit meltdown in midst of SAP embrace

E

Maybe

they should have tried Peoplesoft instead. LOL!

Seagate first with 1.5TB hard drives

E

re Why

16 of these +3ware 9650 16 port controller in raid 6 config with a hot spare == backup solution for moderate sized servers. I trust a raid array more than a tape. I may also be mad.

Sun saunters into open storage formation

E

Injections

I can certainly understand that Sun's products need vim. But is vigor a vi variant I've not seen?

Microsoft hopes third time is lucky with XP SP3 update

E

@Charlie van Becelaere

I slipstreamed SP3 into an XP install point (is that the correct name?), then made a custom install CD from that. Have used the CD on a variety of AMD and Intel boxes (From Dell and HP to generic beige boxes to machines built from individually bought parts) with no trouble.

Fiorina threatens to get in McCain's antique cabinet

E

@Andy Livingstone

Republican back room boys say so.

Final Arthur C Clarke novel on the way

E

Pohl

Generally when some great writer's notes or incomplete books are 'finished' by someone else the results are anything from crap to execrable - I give you Brian Herbert as an example of the worse end of the spectrum.

However, Pohl is an accomplished writer who seems to understand that if a thing can be said in 10 words then it is better not to use 100. So I look forward to the book.

'HD TV gas' 17,000 times worse for planet than CO2, claims boffin

E

@Glenn

"I was kicked out of 2 year college after my first year ..."

Well then, you'll be an expert. eh?

ICANN approves customized top-level domains

E

Price is out of line

Obviously an attempt o build a namespace landgrab bubble. I assume the revenues will accrue to the same org that creates the bubble - ICANN?

There is no good reason for the price to be so high.

Perhaps there is a Bush or Cheney involved in this behind the scenes?

Mandriva's Linux on a stick will wow all the ladies this Summer

E
Joke

@Pierre

Oh no, no way! No no no no no!

Vigor, from it's sourceforge page, is one of the most disturbing developments I've seen on the *nix front in many years.

I don't know whether to nominate the programmer for best joke or schedule him for termination.

Daewoo's laptop is child's play – literally

E

I keep seeing 'Likud' not 'Lukid'.

Can't imagine why though.

Intel Atom 230 ultra low-power desktop CPU

E

No Go: Market Segmentation

It is a very pretty little board and the CPU is sexy, but Intel is clearly trying to control the market. PCIe on full size expensive boards for expensive CPUs, no PCIe and attendant crappy video on these small systems.

This CPU can drive an add in video card to make a very tiny workstation with fair 3D capability; if the board is used in a server as one fellow has done it would be nice to have the option of using an add-in RAID card.

Via's upcoming solution in this market is better, with it's x8 (or x16?) PCIe slot.

Page: