Into.the.Void.

We have been talking with Patroklos (argp of census-labs.com) about going to a CCC event for years. This year though we were determined. So on late September 2009 we booked our flight tickets to Berlin. A couple of weeks later some other friends expressed their wish to come with us. So in the end me, Patroklos, huku and SolidSNK (of grhack.net) and Christine formed up a group to visit 26c3 Here Be Dragons. Another group of Greeks also came to 26c3, among them Ithilgore, xorl, sin , gorlist and one more that I have no idea who he was, sorry 🙂

After a canceled flight on the 26th of December due to fog on SKG airport we finally flew on the 27th and went to Berlin. After arriving there we immediately went to the hotel we had booked and then straight to the Berliner Congress Center where the 26c3 was taking place.

BCC is an excellent conference center, nothing close to anything I have ever seen in Greece. It looks great both from the outside and from the inside. When we entered BCC we saw a huge number of diverse people. You could see and feel the difference with all the other IT conferences. People were very relaxed, very talkative and extremely friendly. What makes CCC so special is it’s community. There were soooo many CCC volunteers inside the BCC willing to help you with any information you might need. More on that later on…

After paying just 80€ for the whole conference, 4 days, we started walking around the ground floor. There were many information desks of various projects, free PCs to use (loaded with Ubuntu), the huge lounge which included a bar for food and drinks with lots of seats for people and 2 rooms for presentations. On the upper floor there were many more projects and another large room for presentations.

What made BCC so lively were all these projects around the presentation rooms. There were always hundreds of people sitting outside of the presentation rooms hacking on their projects, discussing with other people, selling merchandise, etc. Because it was our first time in the conference we were not experienced enough to use our time wisely between the lectures so I only managed to visit very few projects, Cacert, Gentoo and Debian. I am sure that there were people who did not attend any lectures at all and just sat all day at their projects’ infodesk.

Before I continue with the presentations we went to I want to make a note about volunteers again. Volunteers at 26c3 were called angels and they did an EXCELLENT job. They would not allow you to sit wherever you liked at a lecture, they would try to find you a seat or they would put you on a place where you could stand without blocking others. Nobody was allowed to sit at the corridors, nobody. Everything was in order and I never ever heard a single person complain about angels’ policy. They were strict and firm on one hand but helpful, fair and polite on the other. They were probably the best volunteers I have ever faced anywhere. All of them were carrying an ID and a DECT phone on them to cooperate with other angels (oh yes, the conference had it’s own DECT network…AND it’s own GSM network!!!) Funny quote: Angels at the entrance and exit doors wore t-shirts that wrote “Physical ACL”, heh.

The very first presentation we attended was “Here Be Electric Dragons“, and then we moved to see “Exposing Crypto bugs through reverse engineering“. After a break we tried to go to the “GSM: SRSLY?” lecture but it was SOO full that we were not allowed to go inside the presentation room. So we went to the “Tor and censorship: lessons learned” presentation which was more interesting than I expected. The final talks we saw on the first day were: “UNBILD – Pictures and Non-Pictures” which was in German and of course “cat /proc/sys/net/ipv4/fuckups“. Since none of us spoke German there was no urge to see the UNBILD lecture, but as we painfully understood by not being able to even enter the presentation room for the “GSM: SRSLY?” lecture, you have to go a LOT earlier to see a good lecture. We definetely wanted to see fabs lecture so we went there an hour earlier to find some seats. By the way, outside of the presentation rooms were TVs with live streaming from inside for people who couldn’t go inside or for people who didn’t want to. As I said earlier a lot of people preferred sitting at their projects’ infodesk and watched the streams of the presentations.

On the next day we saw: “Milkymist“, “Advanced microcontroller programming“, “Fuzzing the Phone in your Phone“, “Defending the Poor, Preventing Flash exploits“, “Haste ma’n netblock?” and “SCCP hacking, attacking the SS7 & SIGTRAN applications one step further and mapping the phone system“.

On the third day just “Playing with the GSM RF Interface“, “Using OpenBSC for fuzzing of GSM handsets” and “Black Ops Of PKI” since we decided to do some sightseeing as well 🙂

Finally on the last day we went to “secuBT” and from that to another German lecture about a distributed portscanner called Wolpertinger that replaced a canceled lecture on IBM AS/400. Afterwards we went to the realtime English translation stream of “Security Nightmares” and to the “Closing Event“.

I had a really great time and I certainly want to be there again next year. If I manage to go there again though I will try take a lot more days off work so I can visit many more places around the city. The whole event was excellent, the organization was almost perfect and the people who contributed to it deserve a huge applaud, especially the angels.

Congratulations to all.

Necessary pics:

P.S. I don’t want to go into specific details about the lectures I attended. Some were REALLY good, some were average and some were totally boring. If you follow the news you already know which streams of lectures you should certainly download and see. You can find every lecture on CCC’s FTP server.

P.S.2 What a great wiki for an event…I was amazed by the amount of information one can find in there…

P.S.3 To Greeks only…please download the closing event presentation to see how we should start organizing events. Just check on the efforts of the people who contributed to the 26c3 event. I don’t want to write anything more about this issue because the difference with any Greek event I’ve ever attended to, or even the mentality of the people attending “our” events is SO SO SO HUUUUGE that it makes me really sad. I hope that this might fire up something. If more Greeks attended events organized abroad then maybe one day we might get more serious about our events as well.

Filed by kargig at 15:41 under Internet,Linux,Networking,Privacy
Tags: 26c3, bcc, Berlin, cacert, ccc, conference, debian, dragons, Gentoo, germany, hack, here be dragons, ubuntu
12 Comments | 12,236 views

If you have adblock enabled and you try to visit any url of www.archivum.info you will get a really nasty alert saying:

You Are Using Adblock Plus or some other advert blocking software! Archivum.info relies on advertising for revenue. Please add www.archivum.info to your ad blocking whitelist or disable ad blocking when you visit www.archivum.info.

When I first saw this I laughed…and then I tried to find a way to bypass it.
I used curl to see the sites html code:

$ curl -v www.archivum.info
curl -v www.archivum.info 
* About to connect() to www.archivum.info port 80 (#0)
*   Trying 69.147.224.162... connected
* Connected to www.archivum.info (69.147.224.162) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.19.5 (i486-pc-linux-gnu) libcurl/7.19.5 OpenSSL/0.9.8k zlib/1.2.3.3 libidn/1.15 libssh2/1.2
> Host: www.archivum.info
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Tue, 17 Nov 2009 11:24:22 GMT
< Server: Apache
< Last-Modified: Mon, 16 Nov 2009 08:41:17 GMT
< Accept-Ranges: bytes
< Content-Length: 9392
< Vary: Accept-Encoding
< Content-Type: text/html
< 
<html>
<head>
<title>archivum.info - The Internet archive.</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<script type="text/javascript">var disabled = false;</script><script type="text/javascript" src="http://www.archivum.info/js/adblocker_probe.js?
site=http://googlead.foobar.tld/"></script><script type="text/javascript">if (disabled == false) { location.replace("http://www.archivum.info/denied");
alert("You Are Using Adblock Plus or some other advert blocking software! Archivum.info relies on advertising
for revenue. Please add www.archivum.info to your ad blocking whitelist or disable ad blocking when you visit
www.archivum.info.");}</script></head>

[snip]

Here’s how this site blocks Adblockplus: there’s a variable called disabled set to “false” then if a js (http://www.archivum.info/js/adblocker_probe.js) runs it sets disabled to “true” . The hint is that adblockplus blocks urls starting with “googlead.” so it won’t visit “http://www.archivum.info/js/adblocker_probe.js?site=http://googlead.foobar.tld/” and the variable will remain “false“. Then the alert pops up.

The solution is very simple, just add an exception to your local AdblockPlus rules, AdblockPlus Preferences -> Add Filter:
@@|http://www.archivum.info/js/adblocker_probe.js?site=http://googlead.foobar.tld/

So firefox, visits the js url, disabled becomes “true” you are allowed to continue browsing the site and AdblockPlus continues blocking all blockable items.

Filed by kargig at 14:14 under Internet,Linux
Tags: adblock, adblockplus, alert, archivum.info, block ads, curl, firefox, javascript, Linux
No Comments | 5,733 views

The following configs can be used when you have either Vodafone Mobile Internet or Cosmote Internet on the Go or both 3G USB sticks and you want to connect to the 3G Internet (in Greece) while using Linux. I’ll provide two ways to connect to 3G, the command line way using wvdial and the GUI way using umtsmon.

1) Using wvdial
Create /etc/wvdial.conf:

[Dialer Defaults]
New PPPD = yes
Dial Command = ATDT
Dial Attempts = 1
Modem = /dev/ttyUSB0
Modem Type = Analog Modem
ISDN = 0
#commented out see the comments on the post.
#Baud = 460800
Username = user
Password = pass
Init1 = ATZ
Init2 = AT&F E1 V1 X1 &D2 &C1 S
[Dialer cosmote]
Phone = *99#
Stupid Mode = 1
Init3 = AT+CGDCONT=1,"IP","internet"
[Dialer vodafone]
Phone = *99#
Stupid Mode = 1
Init3 = AT+CGDCONT=1,"IP","internet"
[Dialer vfPIN]
Init4 = AT+CPIN=1234
[Dialer cmPIN]
Init4 = AT+CPIN=5678

WARNING: You HAVE to change the PINs on the last part of the config

To connect to Cosmote, plug in the usb stick:

# wvdial cmPIN
# wvdial cosmote

To connect to Vodafone, plug in the usb stick:

# wvdial vfPIN
# wvdial vodafone

2) Using umtsmon
Connection->Manage Profiles and create the necessary profiles with settings that look like these:

Username and Password does not really matter. Enter something like User/Pass or Username/Password.

Both versions tested on Debian and Gentoo and they are working just fine.

If someone has the Wind ADSM settings please provide them as a comment so I can complete the post with all three Greek 3G providers.

References: List of AT commands

Filed by kargig at 21:38 under Gentoo,Internet,Linux
Tags: 3G, cosmote, debian, Gentoo, Internet, Linux, umtsmon, vodafone, wvdial
8 Comments | 24,594 views

I’ve decided to start a filter for adblock plus to filter out advertisements from Greek sites.

You can find more information on subscribing to the filter on the page: Greek adblock plus filter.

I started the list a long time ago with some personal filter for sites I visit the most. In order to enrich the list I searched and found a list with the supposedly “top 50” greek sites (regarding traffic), so I visited them and started adding filters to reduce the ads on them.

I warn you though, the filters are a bit strict…and I don’t like flash ads…I really don’t. I hope you like the list.

Please contact me, by email or by commenting on Greek adblock plus filter page to add your own custom filters to the list.

Filed by kargig at 23:46 under Internet
Tags: adblock, adblock plus, ads, filter, firefox, Internet, web
4 Comments | 17,097 views

I’ve written a small perl script to parse random entries from the extremely usefull commandlinefu.com website. Quoting from their site:

Command-Line-Fu is the place to record those command-line gems that you return to again and again.

The script code is very “clean”. I can almost say that it’s written in a very python-ish way.
Sample output:%./cfu.pl
CMD: for (( i = 0; i < 100; i++ )); do echo "$i"; done
URL=http://www.commandlinefu.com/commands/view/735/perform-a-c-style-loop-in-bash. Title=Perform a C-style loop in Bash.
Description: Print 0 through 99, each on a separate line.
%./cfu.pl
CMD: rsync -av -e ssh user@host:/path/to/file.txt .
URL=http://www.commandlinefu.com/commands/view/20/synchronise-a-file-from-a-remote-server Title=Synchronise a file from a remote server
Description: You will be prompted for a password unless you have your public keys set-up.

You can get it from here: commandlinefu.com random entry parser perl script

As far as I’ve tested, it works out of the box on default perl installations of Debian, Gentoo and Mac OS X.

Filed by kargig at 01:28 under Gentoo,Internet,Linux,MacOSX
Tags: commandlinefu, debian, Gentoo, MacOSX, oneliner, parse, perl, script
3 Comments | 11,683 views

The Problem
To sum it up, the case is this: many many many web applications were programmed so that they used latin1 collation for their fields inside mysql databases. But most users now use utf8 from within their browsers. What happens is that utf8 characters are getting stored inside latin1 fields, which in return produces chaos! A huge web application that used that kind of madness was WordPress. Luckily (or not) WordPress now uses utf8 everywhere. I’ve known many many many people that got so frustrated when they tried to move from their old WordPress installation to a newer one because all their greek posts couldn’t be exported “easily”, I won’t say “properly” because there are always solutions to problems like this, but all the solutions were not straightforward at all, that they finally dumped the idea of moving the posts and started a new blog.

This is a HUGE problem for many greek (and not only) users and I hope I now have an elegant(?) solution to it.
(more…)

Filed by kargig at 21:14 under Greek,Internet,Linux
Tags: bash, convert, Greek, latin1, mysql, sed, utf8, wordpress
22 Comments | 38,573 views

Today I had a very unpleasant surprise with my Vodafone Mobile Connect on Mac OS X. After a normal laptop standby, the application refused to open. Upon starting the application it peaked at 100% cpu usage but no gui ever appeared. I had to kill the application after a while…No messages at the console either. The solution was to (re)move the /Library/Application Support/nova media and /Library/Application Support/Vodafone folders to another location.

This way you lose your stats (data transfered, time used) but at least you can get back on the net…pheeeewwww

Filed by kargig at 20:37 under Internet,MacOSX,Networking
2 Comments | 6,923 views

451 CAOS Theory has a mini review of what’s going on with open source among the countries that compete in Euro 2008.
It’s quite interesting.
Here’s the link about Greece. It has quite a point…Things don’t look very promising…

Filed by kargig at 18:04 under Internet,Linux
No Comments | 4,613 views

When you are doing multiple ssh connections to one host there’s a way to speed them up by multiplexing them. When you open the first network connection a special socket is created and then all other connections to the destination machine pass through the first network connection and don’t open any new ones. All that is done via ControlMaster and ControlPath settings for ssh_config.

Example usage:
Inside /etc/ssh/ssh_config
ControlMaster auto
ControlPath /tmp/%r@%h:%p


Firsh ssh connection:
% ssh foobar@foo.bar.gr
Password:
Linux foo.bar.gr 2.6.20.1-1-686 #1 SMP Sun Mar 4 12:44:55 UTC 2007 i686 GNU/Linux
foobar@foo:~$


Second ssh connection:
% ssh -p 22 foobar@foo.bar.gr
Linux foo.bar.gr 2.6.20.1-1-686 #1 SMP Sun Mar 4 12:44:55 UTC 2007 i686 GNU/Linux
foobar@foo:~$

No password is asked and the connection opens up immediately.

kudos to apoikos for telling me about this neat feature in fosscomm 🙂

Filed by kargig at 11:50 under Encryption,Internet,Linux,Networking,Privacy
6 Comments | 5,798 views

Ο Δημήτρης έχει μια αρκετά καλή ανάλυση ενός attack σε ένα honeypot που έχει στήσει για πειραματισμούς. Αξίζει να του ρίξετε μια ματιά…

Επιτέλους μας την έπεσαν

Filed by kargig at 18:16 under General,Greek,Internet,Linux,Networking
No Comments | 5,742 views

I was reading my mails today and I bumped into some problems that Internet2 routers faced a couple of days ago with some multicast traffic sent from a host in France. Apparently the host was sending 44Mbit of traffic to a multicast group and that was more than enough to raise a very high load on some routers and cause problems to some firewalls too. Their solution was to either blacklist the host or to disable SAP listen on their routers.

To read more you can check the thread “Another SAP Storm?” from wg-multicast@internet2.edu All things related to multicast .

The same problem appeared on GrNET routers too, but unfortunately they don’t have any public archives of their exchanged mails on the problem. The only way to take a look at this problem from the GrNET point of view is to check on the GrNET router status page, click on the load of some routers and check the spike that appears on Wednesday night in the weekly graph.

Quite interesting…

Filed by kargig at 10:01 under Internet,Networking
No Comments | 4,159 views

This might be old news to most people but I didn’t know it…
You can use a special google url to view websites like mobiles phones do. Try this for example:
http://google.com/gwt/n?u=http://void.gr/kargig/blog/.
It’s quite useful when you want to see how your site looks like from a mobile phone or when you want to use a browser from a terminal like lynx or links (I know you don’t use these browsers but sometimes I do…)
To begin browsing in “mobile view” just go to http://www.google.com/gwt/n and all links you click afterwards will be parsed through the proxy.

And another link I liked was this: http://www.google.com/xhtml. Mobile view of google’s search.

Filed by kargig at 00:16 under Internet,Linux
3 Comments | 8,664 views

A friend of mine just ordered a macbook here in Greece. 2.4GHz CPU, 2Gb RAM, 160GB disk. No extras.
Looking at www.applestore.gr this macbook costs 1066E without tax. Tax here in Greece is 19% so the final price would be: 1294,72€
I decided to take a look at other applestores and compare the prices.
applestore.com lists it at 1299$. Using www.xe.com to convert that money to Euros: 843.403€ !! (there might be some kind of taxing missing from here. If you know something please correct me with a comment)
applestore.se lists it at SEK 11.795,00 with tax included. Using www.xe.com to convert that money to Euros: 1,266.38€
applestore.co.uk lists it at £829.00 with tax included. Using www.xe.com to convert that money to Euros: 1,049.31€
applestore.fr lists it at 1.199,00 € with tax included.
applestore.de lists it at 1.199,00 € with tax included.
applestore.it lists it at 1.199,00 € with tax included.
applestore.nl lists it at 1.199,00 € with tax included.
applestore.es lists is at 1.149,00 € with tax included.
applestore.pt lists it at 1.199,00 € with tax included.
applestore.no lists it at kr 10 390,00. Using www.xe.com to convert that money to Euros:1,304.20€
applestore.fi lists it at 1.199,00 € with tax included.

to summarize, from least expensive to most expensive (tax included):
US: 843€
UK:1049€
Spain: 1149€
Finland, France, Germany, Italy, Netherlands, Portugal: 1199€
Sweden: 1266€
Greece: 1294€
Norway: 1304€

Now, should I be happy or sad that in my country it costs a lot more than most other European countries ? It surely costs more than any other country in the Euro zone. If someone takes into account that the minimal monthly payment here in Greece is at 600€, then this macbook here in Greece costs more than 2 months of work. Shouldn’t the price be exactly the same as all other countries in the Euro zone since we are using Euros (€)? What’s the big deal with Greece ? Even the site looks different than all others.. :S

Filed by kargig at 15:00 under General,Internet
5 Comments | 14,014 views

Since I was tagged by comzeradd to show my Desktop..here it is.

To see what’s all that just click the image and check the notes of flickr.

I tag dstergiou, hsoc, stsimb and thatha 😀

Filed by kargig at 15:05 under General,Internet
10 Comments | 6,630 views

Problematic Configuration:
OpenVPN server config:
dev tun
port 1194
proto udp
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
persist-key
persist-tun
server 10.8.0.0 255.255.255.0
keepalive 10 30
client-to-client
comp-lzo
ifconfig-pool-persist ipp.txt
status /etc/openvpn/openvpn-status.log
verb 3
push "redirect-gateway"


OpenVPN client config:
dev tun
client
proto udp
persist-tun
persist-key
resolv-retry infinite
mute-replay-warnings
remote REMOTE.HOST 1194
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client1.crt
key /etc/openvpn/client1.key
comp-lzo
verb 3


The problem:
Using the above config files I continuously got errors like this on the server syslog:

May 1 00:00:00 hostname ovpn-openvpn[22563]: client1/X.Y.Z.W:1194 MULTI: bad source address from client [10.10.1.11], packet dropped

where X.Y.Z.W is my public IP and 10.10.1.11 is the Lan IP of the machine that makes the connection to the openvpn server.

The solution:
OpenVPN server config:
dev tun
port 1194
proto udp
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
persist-key
persist-tun
server 10.8.0.0 255.255.255.0
keepalive 10 30
client-to-client
comp-lzo
ifconfig-pool-persist ipp.txt
status /etc/openvpn/openvpn-status.log
verb 3
push "redirect-gateway"
client-config-dir ccd
route 10.10.1.0 255.255.255.0


Then I created the /etc/openvpn/ccd/ dir and put inside a file named client1 with the following contents:
# cat /etc/openvpn/ccd/client1
iroute 10.10.1.0 255.255.255.0


Client configuration stays the same.

All should be fine now and in your server logs you will now see entries like this:

May 1 00:00:00 hostname ovpn-openvpn[27096]: client1/X.Y.Z.W:1194 MULTI: Learn: 10.10.1.11 -> client1/X.Y.Z.W:1194

Hint: If you want your clients to be able to access the internet through the VPN tunnel you _must_ create NAT.
a typical config on a debian acting as the OpenVPN server:
# cat /etc/network/interfaces
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet static
address A.B.C.D
netmask 255.255.255.0
gateway A.B.C.E
network A.B.C.0
broadcast A.B.C.255
post-up iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.1/24 -j MASQUERADE
post-up echo 1 > /proc/sys/net/ipv4/ip_forward


Filed by kargig at 11:49 under Encryption,Internet,Linux,Networking,Privacy
33 Comments | 129,976 views