Random links

No I’m not dead, just been busy.

But here is some interesting things I’ve seen the last while:

Infer: static code analysis from facebook of all people.  Supports C, Objective-C and Java.

Dr Jack Whitham’s blog, with some interesting stuff related to compiler optimizations and how they alter floating point results, along with ‘bug 323‘, and some DOOM fun!  Plus he has his updated source repositories online here.

And finally, Building A 10BASE5 “Thick ethernet” network.  A fun look at the first gen ethernet cabling on ‘slightly’ newer machines.

All aboard the VENOM hype train!

So here we go, another time for another major security threat, and this time it’s the “VIRTUALIZED ENVIRONMENT NEGLECTED OPERATIONS MANIPULATION” aka VENOM attack.  Yes it has a website, and even a logo! (Creative Commons Attribution-ShareAlike 4.0 International License)

Look at me!

Look at me!

So what is all the fuss about?  Well if you can compromise a Xen, or KVM (and QEMU) VM to run code that bangs against the floppy controller it can have a buffer overflow exploit.

fantastic.

But, I know what you are thinking, most people who KVM use guest OSs that either don’t have floppy drivers, or even explicitly disable the floppy controller.  And from the site:

an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers.

Oops.

But let’s calm down, first the attacker has to get root level on the VM before they can think about doing anything.  Of course this is a BIG problem for VM resellers.  Hopefully the patches will be available quickly, and they will be moderately disruptive, especially for those of us who still use virtual floppies.

The source patch has been released on the Qemu mailing list right here.

Overheating boxes…

So apparently sometimes doing ‘stupid things(tm)’ can overheat your disks, and your box… So you should always keep an eye on the temperature.

So for my benefit more so in the future, and maybe others, here is a quick script to check the temperature of the processors, disk, and any changes in /var/log/messages to see what is going on.  I guess I should make it more modular, and not hardcode stuff, but here we are.

#!/bin/bash
#
#
# Read the disk temperature

disk="smartctl -d ata -A /dev/sda  | grep Temperature_Celsius | awk '{print \$10}'"
diskt=$(eval $disk)

if [ "$diskt"  -gt 40 ];
	then
	error=$"Disk temperature is hotter than 40c it's now $diskt\n"
	else
#	error=$"Disk temperature is fine, it's $diskt\n"
	:
	fi

sensors| grep Core|awk '{print $3}'>/tmp/dat.txt

j=0

while read line
do
number="echo $line |sed 's/\.
#!/bin/bash
#
#
# Read the disk temperature
disk="smartctl -d ata -A /dev/sda  | grep Temperature_Celsius | awk '{print \$10}'"
diskt=$(eval $disk)
if [ "$diskt"  -gt 40 ];
then
error=$"Disk temperature is hotter than 40c it's now $diskt\n"
else
#	error=$"Disk temperature is fine, it's $diskt\n"
:
fi
sensors| grep Core|awk '{print $3}'>/tmp/dat.txt
j=0
while read line
do
number="echo $line |sed 's/\.\0\°C//g'|sed 's/\+//g'"
cpu=$(eval $number)
if [ "$cpu" -gt 82 ];
then
error=$"$error\nCPU core $j temperature is $cpu"
else
#error=$"$error\nCPU core $j temperature is $cpu"
:
fi
j=$(($j+1))
done < /tmp/dat.txt rm -f /tmp/dat.txt if [[ -f /tmp/messages.1 ]]; 	then 	tail /var/log/messages > /tmp/messages.2
dstring="diff /tmp/messages.1 /tmp/messages.2" 
logadd=$(eval $dstring)
if [ ! -z "$logadd" ];
then
error=$"$error\n\n$logadd"
else
:
fi
mv /tmp/messages.2 /tmp/messages.1
else
tail /var/log/messages > /tmp/messages.1
fi
if [ ! -z "$error" ];
then
echo "there are issues.."
echo -e $error > /tmp/message.tmp
mail your_name@your_domain.com -s "errors on machine_name" 
\°C//g'|sed 's/\+//g'" cpu=$(eval $number) if [ "$cpu" -gt 82 ]; then error=$"$error\nCPU core $j temperature is $cpu" else #error=$"$error\nCPU core $j temperature is $cpu" : fi j=$(($j+1)) done < /tmp/dat.txt rm -f /tmp/dat.txt if [[ -f /tmp/messages.1 ]]; then tail /var/log/messages > /tmp/messages.2 dstring="diff /tmp/messages.1 /tmp/messages.2" logadd=$(eval $dstring) if [ ! -z "$logadd" ]; then error=$"$error\n\n$logadd" else : fi mv /tmp/messages.2 /tmp/messages.1 else tail /var/log/messages > /tmp/messages.1 fi if [ ! -z "$error" ]; then echo "there are issues.." echo -e $error > /tmp/message.tmp mail your_name@your_domain.com -s "errors on machine_name"

Of course, it can and should be expanded to check up on things like SMART disk errors, and other things going on.  And of course in the crontab, something like:

*/5  *    *   *   *   /root/report.sh

To run it every five minutes.  As always it’s lacking comments, full pathing to executables, and much of anything to keep it safe.  I’m sure if I was smart I could read more from pipes and variables, but I’m old so I read from files.  If you were looking for the bash shell script expert, it’s not me. lol

Going away for a bit

So Cloudflare is hitting my site like crazy, basically DOS’ing me.  So Im going back to the old way.  And then as luck has it my DNS guy has a fit once, I move the root enteries off Cloudflare.

websitespot...

websitespot…

 

Yeah, so looks like I’m going off line, but once I get the DNS sorted out I’ll be back.

OK I’m back.  Turns out it’s someone in Hungary that has their client misconfigured.

80.64.65.25 – – [11/May/2015:11:21:17 -0400] “GET /?feed=rss HTTP/1.1” 301 496 “-” “Mozilla/6.0 (compatible; Firefox 9.0; Windows NT 5.1; SV1)”
80.64.65.25 – – [11/May/2015:11:21:18 -0400] “GET /feed/ HTTP/1.1” 200 37325 “-” “Mozilla/6.0 (compatible; Firefox 9.0; Windows NT 5.1; SV1)”
80.64.65.25 – – [11/May/2015:11:21:20 -0400] “GET /?feed=rss HTTP/1.1” 301 496 “-” “Mozilla/6.0 (compatible; Firefox 9.0; Windows NT 5.1; SV1)”
80.64.65.25 – – [11/May/2015:11:21:21 -0400] “GET /feed/ HTTP/1.1” 200 37325 “-” “Mozilla/6.0 (compatible; Firefox 9.0; Windows NT 5.1; SV1)”

I’ve had to block you, 80.64.65.25, whomever you are.

Quake One blocked

Is this happening to everyone else?

Screen Shot 2015-05-04 at 11.40.58 AM

Google blockinig

Screen Shot 2015-05-04 at 12.02.16 PM

Sophos warning

Apparently, according to Sophos, it’s Mal/HTMLGen-A, which is just some generic placeholder thing.

Safari blocking Quake One now

Safari blocking Quake One now

The generic blocked by Safari message.

Which is a shame, they just had an interesting interview with John Romero.  Oh well when this gets sorted out, for those who are brave (lol) the link is right here.

Screen Shot 2015-05-04 at 10.44.56 PM

It’s short, but an interesting read none the less.

It’s late but I think I’m back up

some things are still broken, and yeah… it’s been fun.

So, the disk in my colo el-cheapo box died. No problem, I have a backup right? After the last great disaster.  Well that disk DIED TOO.

Un-real.

So here we are running on some half baked incremental backup.  At least I did have this much here we are.

it’s late, I have updates, but I’m tired.

Leonard Nimoy passed away.

st5-016

Leonard

To say that Star Trek influenced many nerds of today is a massive understatement.  From the over estimating engineer, the surly physician, the cocky captain to the logical science officer the show had everything that children of all ages could not only appreciate, but aspire to be.

It was sad news to wake up to find that Leonard had passed from complications with his pulmonary disease.  Even though he quit smoking some 30 years ago it simply wasn’t enough.

We are fortunate in this digital age where we can celebrate his life’s works, and remember him for the role that made him a world recognized icon.

st5-004

The final frontier

Indeed a role model to many has departed to that final frontier.

Leonard Nimoy was 83.