skypipe : a cloud based named pipe

skypipe is a really nice idea about an ubiquitous named pipe on the net.

Basically it allows you to pipe data on a shell from one machine to another without knowing/doing anything, no IP to know, no tunnel to setup, nothing.

See at the end of the post how to set it up.

I show you a small demo here with the default anonymous pipe:

.
MachineA # skypipe < /etc/issue.logo

-------------

MachineB # skypipe

     .vir.                                d$b
  .d$$$$$$b.    .cd$$b.     .d$$b.   d$$$$$$$$$$$b  .d$$b.      .d$$b.
  $$$$( )$$$b d$$$()$$$.   d$$$$$$$b Q$$$$$$$P$$$P.$$$$$$$b.  .$$$$$$$b.
  Q$$$$$$$$$$B$$$$$$$$P"  d$$$PQ$$$$b.   $$$$.   .$$$P' `$$$ .$$$P' `$$$
    "$$$$$$$P Q$$$$$$$b  d$$$P   Q$$$$b  $$$$b   $$$$b..d$$$ $$$$b..d$$$
   d$$$$$$P"   "$$$$$$$$ Q$$$     Q$$$$  $$$$$   `Q$$$$$$$P  `Q$$$$$$$P
  $$$$$$$P       `"""""   ""        ""   Q$$$P     "Q$$$P"     "Q$$$P"
  `Q$$P"                                  """


This is \n.\O (\s \m \r) \t

Magical isn't it ?

skypipe takes a parameter to give you a named pipe, so alternatively you can do the more precise :

.
MachineA # skypipe gentoologo < /etc/issue.logo

-------------

MachineB # skypipe gentoologo

     .vir.                                d$b
  .d$$$$$$b.    .cd$$b.     .d$$b.   d$$$$$$$$$$$b  .d$$b.      .d$$b.
  $$$$( )$$$b d$$$()$$$.   d$$$$$$$b Q$$$$$$$P$$$P.$$$$$$$b.  .$$$$$$$b.
  Q$$$$$$$$$$B$$$$$$$$P"  d$$$PQ$$$$b.   $$$$.   .$$$P' `$$$ .$$$P' `$$$
    "$$$$$$$P Q$$$$$$$b  d$$$P   Q$$$$b  $$$$b   $$$$b..d$$$ $$$$b..d$$$
   d$$$$$$P"   "$$$$$$$$ Q$$$     Q$$$$  $$$$$   `Q$$$$$$$P  `Q$$$$$$$P
  $$$$$$$P       `"""""   ""        ""   Q$$$P     "Q$$$P"     "Q$$$P"
  `Q$$P"                                  """


This is \n.\O (\s \m \r) \t

Skypipe even bufferize your output so it doesn't require any precise timing to do it.

Setup

A prerequisite is to go to https://www.dotcloud.com/ and request a free account (it is relatively hassle free BTW).

Once you get that, you can install skypipe from my overlay if you are under gentoo :

# layman -L
# layman -a gbin
# echo "=net-analyzer/skypipe-9999 **" >> /etc/portage/packages.keywords

# emerge skypipe

Under other systems you will need for now to go with a manual setup :

# git clone git://github.com/progrium/skypipe.git
# cd skypipe
# python setup.py install

Then simply starts once the skypipe command on both machines so it first deploys itself to your newly dotcloud account then asks you and remember your credential for access on any new machine.

# skypipe                      
==> First time use, please setup dotCloud account
dotCloud username: gbin
Password: 
==> Launching skypipe satellite. This only has to happen once for your account.
==> This may take about a minute...
==> DEBUG: Found satellite

Thanks to Jeff Lindsay  for this cool tool.
Edit: removed the useless cat usage thx to sigil

gcp nice tool to copy back from a dd image

You know my brutal trick about defragmenting a filesystem on linux right ?
http://klaig.blogspot.be/2011/06/poor-man-backup-and-defragmentation.html

gcp can be used as a simpler alternative of the rsync -av --progress
http://wiki.goffi.org/wiki/Gcp/en

It streams the copy and have preserve, so the minimal set of what I use for rsync.

5 reasons why you should use open source tools for computer forensics investigations

In some ways computer forensics is a scientific process, you need to prove facts with a reproducible process.
Scientists use open source software all the time and they have good reasons that also apply for you, computer forensics.


1. The tool itself is publicly available

If another expert is called in, he can always download the tools you used and reproduce your findings without having to buy an often very expensive license for possibly a one shot third party tool.


2. The code is open.

Any doubt about the tool itself, you can show the source code and tell exactly what the software has done. You have to rely to documentation and explanations from a third party if you use closed source tools.

3. You (often) can go back in time.

Old versions are often available in public source repositories
Legal processes are really long. They can probably span several versions of any piece of software you used during your investigations. What if the publisher won't publish the old version anymore ?


4. Steps to reproduce your findings are easily documented.

Open source tools are often backed by command line tools. So in your report, you can just copy paste all the commands you used and all the outputs.
Any other expert can pop in, redo the same thing and check the output is exactly the same.


5. They are customizable and flexible

One of the mantra of linux for example is that one tool does one simple thing but does it right so you can combine them to fulfill your need.

The golden hammer never exists and sometime you miss just one little thing/feature to be able to accomplish a specific task. Open source rocks in this case, you have the source code, you can hack it to accomplish your task.

And ... why not sharing your hack back to the community ? :)

Customizing the Xoom kernel / modules to add hardware support

This tutorial will show you how to customize, compile and install a kernel on your rooted xoom.
My goal here is to be able to use extra hardware from the USB port.

For the sake of the example and to link back to forensics I gonna show you how to add support for a "more versatile" USB wifi dongle.

Prerequisites
- an OTG (On The Go) cable to be able to connect your device. I bought one of those on ebay and it worked perfectly.
- a working cross-compilation environment (first part of the article) and/or a chrooted gentoo on the xoom
- a good, working recovery rom (clockworkmod or eq.) where you can specify a .zip to flash.
- the guts to possibly make your xoom unbootable and recover from it with the recovery rom

Note
This is quite an advanced procedure, if you have no clue about what I am doing here, just don't do it.
Also, please understand I am not responsible for any damages caused by this, you have to understand the experimental of the procedure and acknowledge that stuff can go wrong.

let's go

Here, as a base, I used the Tiamat customized kernel but you can also use more stock ones or other alternatives.

First, install the compiled Tiamat kernel and boot image from the procedure described here.
Keep a copy of the boot image, you will need it further down the tutorial.

When everything is ok and you are able to run this custom kernel, we can customize it further.

From your PC with crossdev installed or from your chrooted xoom, go to your favorite folder to develop kernels (I use /usr/src) and checkout a kernel.

cd /usr/src
git clone https://github.com/Tiamat-AOSP/Tiamat-Xoom.git

It takes a whole bunch of time to copy the git tree, be patient.

Recover the configuration from your running kernel from the xoom running the kernel you want to customize. If you are doing this from within the chrooted environment it is easy :

cd /usr/src/Tiamat-Xoom
gunzip -c /proc/config.gz >.config

Make sure the config is squared out:

make oldconfig

Then fire up the configuration menu:

make menuconfig

If you are compiling if from a cross dev environment adb pull the file and adjust the cross compilation prefix :

General / Cross-compiler tool prefix (armv7a-hardfloat-linux-gnueabi-)

If you are compiling if from the chrooted xoom, remove completely the prefix as you are pure native.

General / Cross-compiler tool prefix ()

Now add the support for the hardware you want : here I add the support for rt2x00 matching the wifi device I want to support.

Networking Support/Wireless/Cfg80211 & Generic IEEE802.11 NEtworking stack 
Networking support/ RF switch subsystem support/Power off on suspend [x] # it is needed for the stack above
Device Drivers / Networking device support / wireless lan / Ralink driver support / rt2800 (USB) 
... / rtxx [x]
... / unknown [x]

Once you are done, build your kernel, from the crossdev, (adapt the j parameter for the number of cores you have of course) :

make -j8

From the xoom :

make -j2
make modules_install

Unzip the tiamat kernel zip update you downloaded earlier:
take a kernel update zip you used before as reference from tiamat and unzip it, for example:

mkdir custom_update
cd custom_update
unzip ../Tiamat_Xoom-2.6.36.4-v1.4.3_OC-1.6.zip

It create a structure where you need to overwrite some files :
First the kernel itself (adapt it along the lines of this)

cp /usr/src/Tiamat-Xoom/zImage kernel/

The modules :

rm system/lib/modules/*.ko
find /usr/src/Tiamat-Xoom/ -name *.ko -print -exec cp {} system/lib/modules/ \;

Ok, now repack deployment !

zip -r ../Custom_Tiamat.zip *

You just need to flash this and insmod / modprobe the modules from your android command line / chroot.

Enjoy !

Book review : Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground

ISBN-10: 9780307588685
ISBN-13: 978-0307588685
ASIN: 0307588688

An interesting book with a neutral stand on the hacker/LE point of view. You can see that real criminals have real criminals problems : money laundering, not having a snitch in your organization, reselling stolen goods etc...
Also it spans recent years so you see how security evolved compared to the Cuckoo's egg story.

You see also a real life application of a Cold boot attack (or what is a firewire DMA access ?) to recover the key of an encrypted HD from the RAM of a live system.

Few tricks to sort out and present recovered pictures

Often after a recovery with photorec/testdisk or any other recovery tools, you just have a flat list of files named by their index where the tool found it on the image.
Some are corrupted, plenty are irrelevant.

Let's say you have a bunch of jpeg to sort out.
So first, a tool to check quickly which one are corrupted or not :

On Gentoo:

emerge media-gfx/jpeginfo

Then from the directory where you have your flat list of images :

mkdir ok_images
jpeginfo -c *.JPG | grep "\[OK\]" | cut -d " " -f 1 | xargs -I {} mv {} ok_images/

In plain English : This will check the integrity of the images, find back those OK in the list, isolate the name of the file and pass the file names one by one to the mv command.

Next step, produce a nice picture composed from the thumbnails of those images:
The tool is imagemagick :

emerge media-gfx/imagemagick

Be careful here, this can take a huge bunch of ram so don't run it with a root account or you risk to have your user processes killed :). Monitor the progress with for example htop.

montage -set label '%f' *.JPG -geometry 128x128+2+2 thumbnails.jpg &
htop

If it OOM, add swap or do it subset by subset.

Nice book for forensics "The cuckoo's egg"

The cuckoo's egg: Tracking a Spy Through the Maze of Computer Espionage
Cliff Stoll
ISBN-10: 0743411463
ISBN-13: 978-0743411462

It gives also some cool historical background.
I found it well written, not too edulcorated for the masses and highly entertaining.

You can get it on amazon for example :
http://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/0743411463

PV (progress viewer), a computer forensics friend

On your linux command line, whether you disk image, netcat, copy a giant dd file, you often have the drawback of the no feedback = good feedback of the unix world : sometimes you simply don't know if you gonna stay in front of your blinking cursor 5 minutes or 5 hours.

It is where I find the pv tool extremely nice.

To install it under gentoo :

emerge -a sys-apps/pv

Example of a disk imaging session (all as root): 

First make sure the targeted hard drive here /dev/sdb will be accessed read-only (for those still without a physical write blocker :P ):

losetup /dev/loop0 -r /dev/sdb

pv acts by default somewhat like cat :

pv /dev/loop0 | tee image.dd | md5sum
10.8GB 0:01:24 [ 133MB/s] [==>                                                 ]  4% ETA 0:28:55

At the end of the process it gives you nicely your md5sum:

1dec4b2b97cee8f456f5b3b6c0164d56  -