GSM cracked

December 29th, 2009

So now that Karsten Nohl finally showed everyone how you can be listening to GSM phone calls of other people in 10 Minutes flat using hardware you can almost pick up from anywhere, Something needs to be done fast.

GSM, a 20 year old system has become vulnerable with new processors that can compute faster and faster, to be more specific Karsten used nVidia CUDA’s (Yes, modern nVidia graphic cards in your PC), where hundreds of processors exist on every card with an instruction set large enough to do the computations.

it won’t be long before most networks find solutions, but it is the headsets that are going to be on the market that are the problem, it will probably take some time to get them out of the market and a bit longer to get the off the streets

The bottom line is this, people not so familiar with the security industry think he has done harm to everyone, while in reality, he has done you a favor that you should be grateful for, since he decided this is a public project, because usually, there are people who come to the same results and do not publish them, and you wouldn’t even know that eavesdropping is possible on your mobile phone, and those money driven companies would not be urged to do anything about it.

Don’t have this mixed up with the phone monitoring some governments like the American federal government practice, that one is not a vulnerability of GSM but rather the telecom recording your phone calls, but this one IS a vulnerability, and that girl next door that had a crush on you is listening to your phone calls :P

Anyway, if you want to know more, or even want to know who the guy living next door is seeing check out the AirProbe website (Official website for this project), and one last thing, i forgot to tell you you need a degree in CS more or less to make any sense of what is on that website, the bottom line is, this one is cracked, take us to the next level Motorola…

For the Karsten’s website see http://www.cs.virginia.edu/~kn5f/.

And for the presentation demonstrating the cracking see this http://events.ccc.de/congress/2009/Fahrplan/attachments/1479_26C3.Karsten.Nohl.GSM.pdf

Mind you that GSM is over 80% of the market, and it is the newer technology, i remember when one company in Israel had older technology where you sometimes hear other people’s conversations very clearly, I remember because one of my friends from Israel had a phone that worked from Jordan, and we could clearly here other people’s conversations, not intentionally, but you would be talking from his phone and suddenly you would hear the other party in addition to 2 more people talking, the plenty of fun it was is beyond the scope of this post :)

NOTE: It comes as no surprise that GSM has been cracked, for example 256bit SSL Certificates have become the standard these days because it is expected that breaking 128bit SSL Security will be possible in a timely manner in 2011, or to restate this better, in 2011 computers will be fast enough (CPUs and GPUs) to break 1024bit SSL security  in a timely manner.

Enjoy the complicated new world my friends :) where nothing is as it seems….

Open Source Statistics

December 24th, 2009

I have been using google analytics for some time now (Urchin), but the truth is, although it is very very nice, i lack control.

What amuses me is how good an open source alternative piwik (piwik.org) is.

And all of the stuff PIWIK offers, they still consider it new and incomplete, that is strange, it does everything i ever asked for from google’s own analytics.

Anyway, once i use it for a while, i am thinking of making the hosted service available to the public, on the condition that it can be modified to become a distributed system that is scalable :)

Safe Auto Update

December 22nd, 2009

Wordpress consumes a considerable amount of my time, not blogging, but updating this wonderful blogging tool, but is it not time yet to create some sort of Auto-Updating software ?

And by auto updating, i mean in a safe way that does not involve allowing apache to write to all files, i mean a bit of a more complex machanisim where one of the files is owned by a user allowed to edit the contents of PHP files or something creative that does not end up being itself a security vulnerability.

Security Volnerabilities are sometimes more commonly found in code that is distributed free (Like GPL), the code is distributed, then someone who has just learned a bit on regular expressions (A search mechanisim that can be used in most advanced editors to look for strings in files) searches the code for some sort of volnerability prone syntax, and then scrutenises it in order to inject links into popular websites for the purpose of fooling google into thinking they own an important website about some important medication

Truth be told, the guys at wordpress are doing a lovely job in updating there software as soon as a volnerability is found, Microsoft and other propertiary software vendors on the other hand enjoy the Security through obscurity principal and have to worry much less until disaster strikes, Like when IE brought the world destruction with a bunch of flaws that crippled most internet users and caused my dad to accuse me of vandalizing his PC on purpose, no doubt GPL is for the brave amongst us (And the generous).

But it may be time to write my own blogging software, as fond as i am of wordpress, i need a captcha system that i can trust (With no need for API keys and releying on other people’s uptime), i need a privilages system that does not classify people to Anon, User, and Admin, and a system that can be tailored to my needs easy by being simple and pluggable.

I have already found a name for it (TEKSTS.COM) and a nice hosting service for it (ALLSPOT.COM), once i finish the first beta release, i will open it for testing, then i will start adding functionality to it.

Surely, This is the main reason i was talking AJAX in the last post, because such an application without AJAXIFICATION is obsolete from day 1

Click here for an explanation of what AJAX is

AJAX no longer optional

December 22nd, 2009

So, i have been a C++ developer for 10 years, a PHP developer for 6 and a system administrator (*NIX) for god knows how long, but i speak no JavaScript.

I tried once with a very nice book called “JavaScript, The Definitive Guide” by David Flanagan, but couldn’t read through the first few chapters, simply put, the lack of what i consider a clear discipline got on my nerves *(Explanation follows)

What happens is, My brain got used to C++, then i started accepting PHP once i knew how the interpreter worked with my code and started making sense of what seemed a lack of discipline.

What happens is this, people consider C++ to be a tough language because you have to take care of every single detail, you invoke procedures stored at known addresses in memory, You borrow memory from the OS and need to give it back, you declare a variable and the type of that variable is fixed, you know, very strict, in PHP i had to wonder how i could simply switch the data type of a variable by simply assigning a new value, it felt as if it was very inefficient (By imagining what could be happening at the compiler level) having to deal with all the random castings one can make while writing PHP code, sure i was wrong, and the gurus that made PHP made sure it executes like a BMW (If C++ was a ferrari), in short, PHP turned out to be a very good performer, and surely, for the time savings PHP offers, i would chose it for web development over C++ any day of the week, if it can run WIKIPEDIA, it can run my applications.

It took me some time to understand how the interpreter of PHP works, i jumped into understanding it when i was fiddling with APC (Software to almost precompile your PHP code).

In case you are curious why i was playing with APC, I was playing with APC to try and make all instances of a Wordpress PHP file in every client account (Website) use a single copy of the opcode to speed up Wordpress on our servers, it turned out that APC uses a files INODE and not it’s flags and attributes for caching and my plans were canceled due to the risky nature of similarity guesswork.

Anyway, not to get far off topic, Javascript reminds me of my PHP-switch pains, i don’t comprehend it well yet (maybe i am getting old), and my brain functions in a very primitive way, the “Jump in now understand later” approach i have been trying to adopt is not working well, it never did, so i have always had to do it the hard way.

I have for a long time asked for a dose of wisdom from my gods (if you are wondering, i asked Athena, Minerva, and the mighty Nabu) but to no avail, this evil mechanism inside my brain is demanding a simple language (Like C++).

Sure JavaScript is a discipline, All computer languages are, but not to speak in absolute terms, When a Discipline has 2 many rules and even more exceptions, it looks random until you master it, what is getting on my nerves even more is the fact that everything i write in it works, and that scares me, i feel as if bugs will happen any minute with any user and crash his or her browser.

But as a web developer, It seems AJAX is essential and there is no running away from it, I have to add it to my skill sheet no matter the cost, so consider me away for a weeks time while i get a good grasp of this vodoo language

Memory to good use

December 5th, 2009

At my office, Everyone runs a PC with pleanty of RAM, and  uses less than 2GBs most of the day

My computer processes data stored in a database, my hard drive constantly making noises, reading and writing to that database, the raw data comes in every day, new data compared to old data… changes recorded, old data deleted, etc…

This process usually takes up 5 to 6 hours, even though i run multiple threads on 4 processors, the reason is, well the hard drive, every thread reads the data it needs to operate on, if only i had a good SSH to cut the time down to 2-3 hours, or wait, maybe i have what is better than SSD, RAM !

First, i need to informa anyone that i intend to use there PCs for a background process that they will not feel exists

Most of the users are Windows users, so i need MEMCACHED for Windows installed on there PCs, but before i install on there PCs, i will delay this operation until i implement on my own PC first (Although i have little of my 8GBs to spare unlike everyone else)

Now, let us play, First i download memcached, made sure it is usefull in PHP as well as C++

next i unzipped the data to C:\Program Files (x86)\memcached

Now open the command prompt (cmd)

cd C:\Program Files (x86)\memcached

From properties of the memcached.exe file, change properties to always run as administrator (I can’t because UAC is off and i don’t need to for that same reason)

On command prompt

memcached.exe -d install

Now, if it has been installed as a service, i should be able to see it right ? So i open services, scroll down, and there it is with startup type set to auto :)

Adding more ram to make use of 4GBs on every PC

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\memcached Server

find the ImagePath entry and change it to look something like this, adding the amount of RAM you want to use (Increase) to a number in megabytes, i want 4GB so that would be 4096MB

“C:\memcached\memcached.exe’ -d runservice -m 4096

Now when you start the service via net start “memcached Server”, it will run with 4GB of memory at it’s disposal.

Good, now what, Now we need to start memcached, Just start it from services, or run one of the following line to start it from the command line

c:\memcached\memcached.exe -d start
net start “memcached Server”

Now that it is online, let us see how it works from PHP

We need to load php_memcache.dll

edit php.ini (Mine is in my PHP directory, yours can be in the windows directory)

Uncomment (Remove ;) from

extension=php_memcache.dll

Now restart apache

Testing !

Now i need to check that memcached works from PHP on my localhost

<?php
$memcache = new Memcache;
$memcache->addServer(‘localhost’, 11211);
print “Server’s version: ” . $memcache->getVersion() . “<br />\n”;
$memcache->set(“mykey”,”A string you should obviously see in output”,false,60);
print $memcache->get(“mykey”);
?>

The magic of multiple servers is done in php by simply adding more of the (addServer) calls, they will only be opened when they are needed and there is no overhead.

But i hear you say, host1 has 4GBs of memory, and host2 has 512MB of memory, This is where you should set the weight of host1 to 8 since it is 8 times larger than the smallest server which is 0.5GB (and default weight is 1)

Multi Disk MySQL

December 4th, 2009

For performance reasons, separating DBs to Multiple hard disks can be beneficial

In Linux, when you want to include a directory for a database, you add a symbolic link ( Using the ln -s targetdir command), in Windows, there are no symbolic links, and Windows Shortcuts ( Via right click create shortcut ) don’t work

The truth is, MySQL enables Symbolic Links in Windows by default, but you have to do it the MySQL way

MySQL is a file based database engine, you should be able to see a folder for every database run by your database engine, Now to move one of those DBs to a different directory or hard drive, you just copy it to the new destination and create a file db_name.sym then, within that plain text file, you can add D:\data\db_name\ where D:\data\db_name\ is the folder containing the MySQL files.

You should be good to go if you have moved the directory of the database to d:\data, but if you copied it, the copy in the original MySQL data directory will be used

You are done, Now you should experience the extra performance of combining disks, the closest it gets without RAID and a reformat, surely this is assuming the DBs are used evenly

But there are other reasons why you may want to do this, one of which is, when you want to compile all user data in a directory, So DBs that person creates using your server management software puts all that person’s software in one place so that when he or she requests a backup, you know what to send him/her

Enjoy

MySQL data compression

December 4th, 2009

A table with millions of records, one of them a long text field was taking up too much space, especially that it is on a solid state drive (Expensive and small), so i decided it was not done correctly

The data in the text field was a page, there was no need to search the page, and the data is only needed when we know the row, so i decided the text should be compressed

The PHP site could compress the data before storing it, and decompress it when displaying it, surely there is overhead in compression and decompression, but since we are not talking about millions of hits a day, it should not be a big problem

to begin with, there were 2 candidate functions to do the mission

gzdeflate – gzinflate
bzcompress – bzdecompress

So, i chose deflate since it is more efficient (Much faster), and while testing produced results comparable to bz2, infact, the results were almost identical.

I did the testing on the first 9k records

What you need to pay attention to is that the text field should no longer be UTF_GENERAL_xx , the same compressed data when the filed was UTF8 was 80Mb (the first 9000 records), while it was only 50Mb when the data was stored as binary large object.

Here are the results of storing the first 9k records

Plain text in UTF8 field = 183MB
gzdeflate in UTF8 field = 80MB
gzdeflate in BLOB field (The right way to do it) = 50MB

Once i knew what i was supposed to do, the data ended taking up 1/4 of the space it required in plain text.

You may ask why 1/4 when the database compresses to 10% of the size when we have a SQLDUMP file, the truth is, every field of every row is compressed alone, if we compressed all the fields into one gz string, we would have got the 1/10 but since we can only compress field by field, 1/4 sounds good to me.

Enjoy

ICANN open gTLD policy very soon

November 24th, 2009

So, as you might already know, those who can afford a gTLD are going to be able to get it soon.

I can already find people who are opening up for preorders on gTLDs like

Business

.deal, .movie, .food, .free, .music, .golf, .news

Cities

.berlin, .london, .miami, .dallas

Other

.family, .arab, .gal

So, will this slow down the .COM ? in my oppinion, nothing can slow down the .COM, i always advise people to always get the .COM even if they want there main website to be .net.

The reason is, when people want to visit you directly, they will either google your business name, or enter it followed by a .COM, if you get the .NET and no .COM to forward to it you will probably be loosing visitors to the competitor who has the .COM.

Othe gTLDs did not result in the revolution everyone expected, Always a Gold Rush, then 1 year after, people would not even bother renew the domain, if it is not a .COM, it is hard to make it work for you.

I do think the ICANN’s idea of approving any gTLD for anyone is a good idea, for example you will probably be able to download your drivers from www.drivers.hp but i don’t think HP would ever drop the HP.COM website or let’s say depreciate it.

Even if some gTLDs do pick up, i don’t expect anything revolutionary, nothing capable of stopping the .COM growth, but i do think they will have there place, some place at least.


comapring registrars

November 15th, 2009

An ongoing comparison of Domain Name Registrars, more like Registrar Watch shows that GoDaddy alone has 36 Million Domain names registered, combined with WildWestDomains has more than 40 million, While the next in the list ENOM has 9.5 million, So the GoDaddy group is by far the largest registrar for domain names, 4 times the size of the second in the list !

From that website, it seems GoDaddy is the largest Shared Hosting provider as well, but i can not be sure about Servers, as i doubt they come close to theplanet (Which now owns EV1SERVERS)

I wonder how the new ICANN plans to introduce TLDs will affect the map of the domain name business, i am currently investigating the ICANN new ideas as they have a meeting very soon concerning the issue.

Also worth mentioning is that this is the first time i get to see the actual cost to registrars, the website lists the registry costs (For example how much verisign charges for .com and .net) and how much Public Interest Registry charges for a .ORG, so check it out

Watter on the moon

November 13th, 2009

You have to see this, there is watter on the moon….