Free SSL Certificate from Mozilla Let's Encrypt project

Last week Mozilla Let's Encrypt project announced the launch of its free, automated and open certificate authority. I had been waiting for this news for a long time. I quickly deployed Let's Encrypt on my staging server to learn how this technology works. The deployment process is painless and very straight forward. The certificates needs to renewed every 3 months, the Let's Encrypt client does this automatically. Thank you Jerome and Ryan for all your help!.

At the time of writing this blog post, Let's Encrypt client was not available for Ngnix server. So I am using the manual method to obtain the SSL certificate here. Please read the latest docs for additional information.

# Check out the let's encrypt source code
$ git clone https://github.com/letsencrypt/letsencrypt

# Stop the Nginx server, we need the client to bind to port 80.
$ sudo service nginx stop

# Start the let's encrypt client and follow the instructions on screen. You need to provide an email address.
$ sudo ./letsencrypt-auto --server https://acme-v01.api.letsencrypt.org/directory certonly --domains staging.example.org
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/staging.example.org/fullchain.pem. Your
   cert will expire on 2016-01-02. To obtain a new version of the
   certificate in the future, simply run Let's Encrypt again.
 - If like Let's Encrypt, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

# Edit the Nginix config to point to generated certificates.
$ sudo nano /etc/nginx/sites-enabled/staging.example.org

 listen 443 ssl;
        server_name staging.example.org;
        ssl_certificate /etc/letsencrypt/live/staging.example.org/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/staging.example.org/privkey.pem;

# Restart the Nginx server
$ sudo service nginx start

Please don't forget to test your server using an comprehensive SSL server test such as SSLLabs.

Wordpress Blind SQL Injection Vulnerability

My friend a Bay Area entrepreneur had a nasty surprise, his website was defaced. Updating the wordpress content management system to stable version and resetting the default theme from backup fixed the problem.

So don't forget to keep your wordpress CMS updated to latest release and secure your wordpress website to avoid such nasty surprises.

The vulnerability effects WordPress version 3.0.4. Malicious script kiddies exploit the remote blind SQL injection vulnerability in comment_post_ID to deface the wordpress websites. You can learn more about this vulnerability on packetstorm.
packetstormsecurity.org/files/104989/WordPress-3.0.4-Blind-SQL-Injection.html

How to Bypass Internet Censorship :: Book Review

The book How to Bypass Internet Censorship using free software tools is now out. The book is distributed on Lulu.com. The interesting aspect about this book is that it is created using collaborative content development system over a period of (just) five days by various contributors.

In the past I had blogged about how to bypass the filtering systems using translation services like Babelfish, however I think the book would be more informative for all.

About The Book

Because of concerns about the effect of Internet blocking mechanisms, and the implications of censorship, many individuals and groups are working hard to ensure that the Internet, and the information on it, are freely available to everyone who wants it.

This book documents simple circumvention techniques such as a cached file or web proxy, and also describes more complex methods using Tor, which stands for The Onion Router, involving a sophisticated network of proxy servers.

FLOSS Manuals publications will always be available for free in HTML and PDF from the FLOSS Manuals Website. Each book sale generates $2.50 (USD). 100% of this income goes back into the development of more manuals about free software.

You can also order a dead tree version of this book or just download it.

Bash Path Security Gotcha!

The devil they say is in details, even the simple Bash path variable can open some security problems on your box. Every Bash documentation out there warns us not leave '.' in the path (it matches current directory). They however don't seems to mention that leaving a dangling ':' (colon) at the beginning or the end of Bash $PATH does create the same security vulnerability.

# Standard Bash $PATH $ echo $PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games # Let's get evil, append a colon at the end $ export PATH="$PATH:" # Let's check the tainted Bash $PATH $ echo $PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games: # Create Trojan application (of sorts) $ echo "echo foo"> app $ chmod +x app # Run the command and Viola! $ app foo

Ebay India Security Problem

Its almost midnight I am surfing the ebay.in listings. To my surprise I found this page shows me that I logged in as viper something. I don't know if there are any security issues with ebay India site authentication system. Could someone enlighten me ?.

Checked again this morning, same issues. No good , no good at all

What is Video-Hams

Robert Schifreen is the author of Defeating the Hacker . He recently wrote about the The Age of the Video Ham . I posed few questions about the video-hams to him.

Who coined the word “Video-hams”?

Robert: As far as I’m aware, I coined the term in August 2006. Other people have written about the topic before, and I know that one person has used the term “philming” to describe it.

How does one define “Video-hamming”?

Robert: I define a video ham as someone who seaches the internet for IP-based security surveillance cameras which have not been secured, in order that they can watch the live footage.

How did he stumbled upon the problem ?

Robert Schifreen writes about it in a comment on his blog .

Robert: My interest in the subject was sparked a few weeks ago, when I was looking to buy some IP cameras for a client and decided to search the manufacturers’ websites for sample images so I could judge their quality. I soon realised that most of the manufacturers didn’t make such things available, but that there were plenty of unprotected cameras out there.

What measures should one take to protect themselves ?

Robert advices on protection measures .

Robert: My advice to anyone using an IP camera for surveillance is:

1. Use the camera’s in-built password protection rather than allowing the pictures to be streamed to the world.

2. Once you’ve set up the camera’s securely, test it by attempting to connect from outside your company’s network.

3. If you really want footage to be accessible over the internet, configure your firewall so that it can only be accessed by those who need to see it.

Hacker High School

From a Slashdot article

“Hacker High School, an initiative from the non-profit Institute for Security and Open Methodology , pioneers of the OSSTMM have received some media coverage for their Hacker High School Program . It’s a license-free open-source program that provides security and privacy-awareness teaching materials to teachers. Here’s the link to the BBC stream and article about the project.”

Also mentioned on a thread on BSD-INDIA .

Do Get started with the program and read the lessons online. Do join the project mailing-list help them.

Running automated package updates with Cron

LinuxLove.org's recent post about automatically running apt-get upgrades daily with cron using a simple bash script can be easily done using Cron-Apt package itself.

Please do note that such automated package upgrades in apt based distro's is a very bad idea. Joe had rewritten a detailed account about the problems and security issues involved in Debian-Administration.org few years back.

By default, cron-apt will only download updates -- it will not install them. I know other packages for other distributions like up2date will automatically install the updates for you, but I've learned to like this and that in the long run, automatically installing updates is a Bad Thing. Why? Well when I was experimenting with auto-installs, I ran into problems:

• Even though I told apt to say Yes to everything, it still prompted me for input on config file conflicts (was I doing something wrong?). This caused the script to hang indefinitely in the background until it was killed.
• Auto-accepting configuration changes can ruin your day. With Debian, it's fairly easy to back out of a change and hopefully you have a backup copy of the config file, but that's not the point. Good System Administration means you should never be in that position in the first place. "OK, what if I just deny all configuration changes and leave my copy?", you ask. Well, what if the upgraded program uses new syntax in its config file. Your program is now broke and you're in the exact opposite position as you were with auto-accepting.
• Just as you should always review configuration file changes, always review what packages are being installed. If you know that installing that new version of Samba will mean some extra work in other places, don't install it yet.

Bottom line: Yes, it can be very tedious to manually review each update batch -- especially if you have several servers -- but that is part of your job when you are running a server. Deal with it!