My fragready server has been taken offline because of a ‘virus’.

And let this be a warning to all.

The Data center has null routed because of virus complaints originating from 216.231.130.102.

Sadly I haven’t heard back as far as exactly what this virus is/was and what is going on.  Just that a ‘complaint’ had been logged against my ip address.

So googling my ipaddress + virus turns up more automation gone awry.

Virus Total...

Virus Total…

So as you can see this “virus total” is listing a bunch of my  files being infected.  The first thing I noticed is that it’s NetHACK, and for non i386 win32 platforms, both Windows CE for the i386 (it’s not a normal win32 exe), and nethack for the MIPS.

And looking on how they score me 2/52 well these are the sites that now scour around looking for “viruses” and false positives that will get your server blacklisted.

URL: http://vpsland.superglobalmegacorp.com/install/WindowsCE/nethack/nethack3.4.3-WinCE-2.11-x86.zip
Detection ratio: 2 / 52
Analysis date: 2014-04-13 05:37:54 UTC ( 1 day, 17 hours ago )
    URL Scanner Result
    CLEAN MX Malicious site
    Websense ThreatSeeker Malicious site
    ADMINUSLabs Clean site
    AegisLab WebGuard Clean site
    AlienVault Clean site
    Antiy-AVL Clean site
    AutoShun Unrated site
    Avira Clean site
    BitDefender Clean site
    C-SIRT Clean site
    CRDF Clean site
    Comodo Site Inspector Clean site
    CyberCrime Clean site
    Dr.Web Clean site
    ESET Clean site
    Emsisoft Clean site
    Fortinet Unrated site
    G-Data Clean site
    Google Safebrowsing Clean site
    K7AntiVirus Clean site
    Kaspersky Unrated site
    Malc0de Database Clean site
    Malekal Clean site
    Malware Domain Blocklist Clean site
    MalwareDomainList Clean site
    MalwarePatrol Clean site
    Malwarebytes hpHosts Clean site
    Malwared Clean site
    Netcraft Unrated site
    Opera Clean site
    PalevoTracker Clean site
    ParetoLogic Clean site
    Phishtank Clean site
    Quttera Clean site
    SCUMWARE.org Clean site
    SecureBrain Clean site
    Sophos Unrated site
    SpyEyeTracker Clean site
    StopBadware Unrated site
    Sucuri SiteCheck Clean site
    ThreatHive Clean site
    URLQuery Unrated site
    VX Vault Clean site
    WOT Clean site
    Webutation Clean site
    Wepawet Unrated site
    Yandex Safebrowsing Clean site
    ZCloudsec Clean site
    ZDB Zeus Clean site
    ZeusTracker Clean site
    malwares.com URL checker Clean site
    zvelo Clean site

    Which now makes hosting any kind of file that some random people with zero accountability can screw up your hosting.

    Worse for me, is that my automated backup hadn’t been running frequent enough.  I’m now suffering through low bandwidth, and replicating all my crap that I’ve acquired through the years on vpsland.superglobalmegacorp.com is just too much.  And with the possibility of being shut down “just because” is now too much.  I kind of liked having a dumping ground for old stuff but now that is no longer permissible.

    So where to go from here?

    I can password lock the site, and require people to contact me for access.  What a pain.  I’m sure I could automate it, but I don’t want these arbitrary systems to remove me again so that is out of the question.

    I could use some kind of certificate based encryption on everything, and provide a link to the certificate and give instructions on how to use it.  But obviously this will discourage people who are unfamiliar with the command line, and with OpenSSL (and all the great news it’s had the last week!).

    Another option is to use OpenVPN to permit people to access vpsland from within that.  This removes it from public search, but does allow people to connect in a somewhat easier method.  And it doesn’t involve something tedious like downloading OpenSSL, getting my servers’s key, downloading the wanted file, decrypting the file, and then decompressing it.

    I’ve pulled the latest posts out from google’s cache.  I’ll try to put up the comments but I can’t promise much there.  As it stands right now, I haven’t heard back from fragready in over 22 hours, and at this point I want to just get my blog back in operation.

    Sorry for the hassle.

     

    –update:

    Finally got a response, but not the one I was hoping for.

    In situations such as this, where a server has been compromised, we require the server to be reinstalled with a fresh OS installation. Please let us know how you would like to proceed

    So basically a false positive on the internet will get your data destroyed.  Well this sucks.

    Mirroring Wikipedia

    So I had an internet outage, and was thinking if I was trapped on my proverbial desert island what would I want with me?

    Well wikipedia would be nice!

    So I started with this extreme tech article by Sebastian Anthony, although it has since drifted out of date on a few things.

    But it is enough to get you started.

    I downloaded my XML dump from Brazil like he mentions.  The files I got were:

    • enwiki-20140304-pages-articles.xml.bz2 10G
    • enwiki-20140304-all-titles-in-ns0.gz 58MB
    • enwiki-20140304-interwiki.sql.gz 728Kb
    • enwiki-20140304-redirect.sql.gz 91MB
    • enwiki-20140304-protected_titles.sql.gz 887Kb

    The pages-articles.xml is required.  I added in the others in the hopes of fixing some formatting issues.  I re-compressed it from 10GB using Bzip2 to 8.4GB with 7zip.  It’s still massive, but when you are on a ‘slow’ connection every saved GB matters.

    Since I already have apache/php/mysql running on my Debian box, I can’t help you with a virgin install.  I would say it’s pretty much like every other LAMP install.

    Although I did *NOT* install phpmyadmin.  I’ve seen too many holes in it, and I prefer the command line anyways.

    First I connect to my database instance:

    mysql -uroot -pMYBADPASSWORD

    And then execute the following:

    create database wikimirror;
    create user ‘wikimirror’@’localhost’ IDENTIFIED BY ‘MYOTHERPASSWORD’;
    GRANT ALL PRIVILEGES ON wikimirror.* TO ‘wikimirror’@’localhost’ WITH GRANT OPTION;
    show grants for ‘wikimirror’@’localhost’;

    This creates the database, adds the user and grants them permission.

    Downloading and setting up mediawiki 1.22.5 is pretty straight forward.  There is one big caveat I found though.  InnoDB is incredibly slow for loading the database. I spent a good 30 minutes trying to find a good solution before going back to MyISAM with utf8 support.

    With the empty site created, I do a quick backup incase I want to purge what I have.

    /usr/bin/mysqldump -uwikimirror -pw1k1p3d1a wikimirror > /usr/local/wikipedia/wikimedia-1.22.5-empty.sql

    This way I can quickly revert as constantly re-installing mediawiki is… a pain.  And it gets repetitive which is good for introducing errors, so it’s far easier to dump the database/user and re-create them, and reload the empty database.

    When I was using InnoDB, I was getting a mere 163 inserts a second. That means it would take about 24 hours to import the entire database!!  Which simply is not good enough for someone as impatient as me.  As of this latest dump there are 14,313,024 records that need to be inserted, which would take the better part of forever to do.

    So let’s make some changes to the MySQL server config.  Naturally backup your existing /etc/mysql/my.cnf to something else, then I added the following bits:

     key_buffer = 1024M
    max_allowed_packet = 384M
    query_cache_limit = 18M
    query_cache_size = 128M

    I should add that I have a lot of system RAM available.  And that my box is running Debian 7.1 x64_86.

    Next you’ll want a slightly modified import program,  I used the one from Michael Tsikerdekis’s site, but I did modify it to run the ‘precommit’ portion on it’s own.  I did this because I didn’t want to decompress the massive XML file on the filesystem.  I may have the space but it just seems silly.

    With the script ready we can import!  Remember to restart the mysql server, and make sure it’s running correctly.  Then you can run:

    bzcat enwiki-20140304-pages-articles.xml.bz2 | perl ./mwimport2 | mysql -f -u wikimirror -pMYOTHERBADPASSWORD  –default-character-set=utf8 wikimirror

    And then you’ll see the progress flying by.  While it is loading you should be able to hit a random page, and get back some wikipedia looking data.  If you get an error well obviously something is wrong…

    With my slight moddifications I was getting about 1000 inserts a second, which gave me…

     14313024 pages (1041.174/s),  14313024 revisions (1041.174/s) in 13747 seconds

    Which ran in just under four hours.  Not too bad!

    With the load all done, I shut down mysql, and then copy back the first config.  For the fun of it I did add in the following for day to day usage:

     key_buffer = 512M
    max_allowed_packet = 128M
    query_cache_limit = 18M
    query_cache_size = 128M

    I should add that the ‘default’ small config was enough for me to withstand over 16,000 hits a day when I got listed on reddit.  So it’s not bad for small-ish databases (my wordpress is about 250MB) that see a lot of action, but wikipedia is about 41GB.

    Now for the weird stuff.  There is numerous weird errors that’ll appear on the pages.  I’ve tracked the majority down to lua scripting now being enabled on the template pages of wikipedia.  So you need to enable lua on your server, and setup the lua extensions.

    The two that just had to be enabled to get things looking half right are:

    With this done right, you’ll see Lua as part of installed software on the version page:

    mediawiki installed softwareAnd under installed extensions:

    wikimedia installed extensions

    I did need to put the following in the LocalSettings.php file, but it’s in the installation bits for the extensions:

    $wgLuaExternalInterpreter = “/usr/bin/lua5.1″;
    require_once(“$IP/extensions/Lua/Lua.php”);
    $wgScribuntoEngineConf[‘luastandalone’][‘luaPath’] = ‘/usr/bin/lua5.1′;
    require_once( “$IP/extensions/Scribunto/Scribunto.php” );

    Now when I load a page it still has some missing bits, but it’s looking much better.

    The Amiga page...

    The Amiga page…

    Now I know the XOWA people have a torrent setup for about 75GB worth of images.  I just have to figure out how to get those and parse them into my wikipedia mirror.

    I hope this will prove useful for someone in the future.  But if it looks too daunting, just use the XOWA.  Another solution is WP-MIRROR, although it can apparently take several days to load.

    Blinking lights…

    I almost cannot believe I’m going to post this, but so many of my machines don’t have LED’s to blink for hard disk activity it is driving me nuts.

    Well thankfully, for windows there is a solution:

    diskled

    So what it does, is it’ll poll  \PhysicalDisk(_Total)\% Disk Time every 30ms, and if it’s doing something it’ll blink the icon colour.

    Why is this cool?

    It’ll even work with RDP.  So your server can be on the other side of the world, and you’ll know what’s going on.

    It's cooler than it looks

    It’s cooler than it looks

     

    Want to be scared?

    So there has been all this talk as of late with NSA and special USB cables that embed microprocessors and wireless transmitters that send out everything that passes through them.  not to mention video cables, that can do the same thing.

    Apparently another favorite thing to hit is the BIOS, as you can load whatever OS on there you want, and the firmware is still active.  The best of the best must be hacking peripheral firmware.  Namely storage.

    Did you know you can actually load linux onto your hard disk?  Or that various flash cards have embedded ARM processors on them?

    What would this say for a network ‘offload’ mechanism to pass along packets to another host?

    To those of you building “secure” systems (ie billing, medical, military) good luck.. It seems in this brave new world you cannot trust anything off the shelf.

     

    Merry Christmas!

    Wow this year has been quite a personal ride for me.  From a bad 2012, to a seeming uncertain 2013 where I not only found my love but also found a new home in a new continent.

    Through it all I’ve kept the blog up and going.  I’ve changed VPS providers a few times, to now living out the dream on dedicated hardware.

    As this year draws to the end, Id like to thank regular users for sticking around just as I’d like to thank new users for taking a look at my mis-adventures through the years.

    I’m really looking forward to next year, and the endless possibilities.

    Jason

    Qemu enters the 1.7 testing phase

    I built 1.7rc2 on OSX, and I’ve only tested the x86 portion… x86_64 of course still fails on vista & friends… 2003 of course hangs at “starting windows” so no progress there.  I haven’t tried any MIPS, PowerPC, or SPARC things…

    Also the Adlib/SoundBlaster is still broken in this release, there is a source change in adlib.c that has to be made.  Also I just noticed that IRQ sharing works in ISA mode again, so the Ne2000 can go back to 0x300 IRQ 9.

    Also speaking of emulation, I was thinking of shoving a VAX-11/780 into the world for the heck of it.  Although I don’t think anyone would care.  I’ll have to dig out the source to 4.3 and give the shell the ability to add new users.  I wrote it once, and I fear I’ve lost those changes but it was cool for something back then.

    Anyways post back here if you want an account on vax.superglobalmegacorp.com !

    Moving servers again..

    FragReady!

    FragReady!

    (EDITED)* So it seems that Fragready just knee jerks to bogus virus claims by fly by night idiots like  clean-mx.de because they are terrified of nethack on WindowsCE.  Yes really they deleted my server because of an old game on an old platform.

    So here we go. again.  2013 seems to be the year of plenty of moves.  While cruising around LEB, I came across this special on Frag Ready.  So yeah I’m going to collapse all my VPS stuff (once it is finished copying) and move everything to a dedicated server.

    What I’m hoping this will mean is that I can do far more neater things as now I don’t have to worry about CPU limitations, blowing my own quotas or being able to load whatever I want.  I think I’ll even go back to offering some kind of public UNIX thing, I just have to decide if I want a SIMH VAX running BSD 4.3 UWisc, or whatever.  I know I’ll certainly bring the Quake 1 server back, and maybe, just maybe hack enough to get a Doom dialup server going (if I can convince it to talk to my fake modems).

    Another observation is that using the new ext4 filesystem means things are slower than ever.  I know this server is two years old but still my seven year old Mac Pro destroyes it running Qemu vs running KVM on this linux box.  I’ve found the two things help for performance some.

    Convert disk images from sparse VMDK to QCOW2

    # qemu-img convert -f vmdk -O qcow2 -o preallocation=metadata source.vmdk destination.qcow2

    And changing KVM from ‘-hda disk.vmdk’ to

    kvm -cpu pentium -m 256 -drive file=/usr/local/kvm/disk.qcow2,if=ide,index=0,media=disk,cache=none -vnc :0 -net nic,model=pcnet -net user

    Next was to change the way the volume was mounted.  First a change in the filesystem

    tune2fs -o journal_data_writeback /dev/sda1

    Then changing the options to the following in fstab:

    noatime,data=writeback,barrier=0,nobh,errors=remount-ro

    So yeah, it feels a little better now.

    Here we go, again with what is moved over so far: