Month: September 2010

Oh srsly? 300MBs for a scanner driver (/.-)

My granny asked me to bring her a driver for her all-in-one scanner thingy, because it would take her too long to download it. Well, I wasn’t too sure whether it’s HP’s fault by not supporting the generic classes or Windows 7‘s fault by not implementing the USB Printer or Scanner class driver (But they should). However, I didn’t think a driver can be that huge. However, HP supposes you to download 290 whopping MB! For making their product work!

But they are serious. You cannot download anything smaller than that. ๏̯͡๏ I thought they were kidding me. Must be a very complicated device… Well, I’m copying their BLOBs onto a pendrive now…

The beauty of a free (Maemo) handset

During GUADEC, I of course wanted to use my N900. But since the PR1.2 update, the Jabber client wouldn’t connect to the server anymore, because OpenSSL doesn’t honor imported CAs. So the only option to make it connect is to ignore SSL errors. But as I’m naturally paranoid, I didn’t dare to connect… It’s a nerdy conference with a lot of hackers after all.

Fortunately, I had all those nice Collaborans next to me and I could ask loads of (stupid?) questions. Turns out, that the Jabber client (telepathy-gabble) on the N900 is a bit old and uses loudmouth and not wocky.

So I brought my SDK back to life (jeez, it’s very inconvenient to do stuff with that scratchbox setup 🙁 ) and I was surprised that apt-get source libloudmouth1-0 was sufficient to get the code. And apt-get build-dep libloudmouth1-0 && dpkg-buildpackage -rfakeroot built the package. Almost easy (I had to fix loads of dependency issue but it then worked out).

As neither I nor the Collaborans knew how to integrate with the Certificate Manager, I just wanted to make OpenSSL aware of the root CA which I intended to drop somewhere in ~/.certs or so.

After a couple of busy conference days I found out that code which implements the desired functionality already exists but was commented out. So I adapted that and now loudmouth imports certificates from /home/user/.config/telepathy/trusted-cas.pem or /home/user/.config/telepathy/certs /home/user/.maemosec-certs/ssl-ca before it connects. The former is just a file with all root CAs being PEM encoded. The latter is a directory where you have to put PEM or DER encoded certs into and then run c_rehash . in it the certificate manager puts the certificates in after you’ve imported it. Because just loading any .pem or .der file would have been to easy to work with. It was hard for me to understand OpenSSL’s API. This article helped me a bit though, so you might find it useful, too.

So if you want your jabber client on the N900 to connect to a SSL/TLS secured server that uses a root CA that is not in the built in certificate store, grab the .deb here. You can, of course, get the source as well.

Turns out, that there is a workaround mentioned in bug 9355 hence you might consider it to be easier to modify system files yourself instead of letting the package manager do it.

Bottom line being that it’s wonderful to be allowed to study the code. It’s wonderful to be allowed fix stuff. And it’s wonderful to be allowed to redistribute the software. Even with my own modifications. And that it will be that way for the lifetime of that piece of software. I do love Free Software.

mrmcd1001b Impressions

I had the pleasure to be invited to the MetaRheinMain ChaosDays 1001b (mrmcd1001b) in Darmstadt. This years motto was “Beyond Science Fiction” and ~250 people gathered together to discuss “Society and Technology in 20th century fiction and 21th century reality”.  

The presented talks were mostly interesting, although I didn’t attend that many. I spent most of the time talking to people or giving (two) talks myself: Security in Mobile Devices and Virtualised USB Fuzzing.

The first one went as expected and I think the attendees enjoyed it very much. Again, talking about technical details that a buffer overflow on x86 involves is not that much fun but I think it went at least alrightish. Slides can be found here.

The second talk was kind of a rehearsal for my final thesis presentation. So I took the chance to prepare myself for Dublin and present brand new stuff^tm. I started off crashing a Linux PC with my N900 and went then to the talk. It was a bit confusing, I guess. But in fairness: It was very late in every sense of the word 😉 But I got positive feedback nonetheless so it’s better if you make up your own mind with the slides. Although I don’t think the slides alone are that interesting.

For some reason, people were interested in the commands that I’ve used for the demo:

  1. Boot Ubuntu
    /opt/muelli/qemu/bin/qemu-system-x86_64 -enable-kvm -hda ubuntu.img -cdrom ~/ISOs/ubuntu-10.04.1-desktop-amd64.iso -monitor stdio -serial vc -m 1G -loadvm 1
  2. Setup Filter

    3. usb_filter_setup /tmp/filter
    export PYTHONPATH=~/hg/scapy-com/
    python recordingfilter.py /tmp/filter /tmp/phonet.dump

  3. Attach device

    4. info usbhost
    usb_add host:0421:01c8
    sudo chown muelli /dev/bus/usb/002/004

    usb_filter_remove
    usb_del 0.2

  4. Replay

    5. usb_add emul:full:/tmp/filter
    cat /tmp/filter.in &
    cat /tmp/phonet.dump.out > /tmp/filter.out

    usb_del 0.0
    kill %%

  5. Fuzz (didn’t really work because of a Heisenbug)

    6. python emulator.py --relaxed /tmp/filter /tmp/phonet.dump.combined
    python fuzzingemulator.py /tmp/filter webcam.dump
    usb_del 0.0

  6. Fully Virtualise


    7. usb_add emul:full:/tmp/filter
    python usbmachine.py /tmp/filter.in /tmp/filter.out
    usb-devices

Freedom not Fear 2010 on 2010-09-11 in Berlin

Call for Action!

Do you in or near Berlin? Or just happen to be there on 2010-09-11? Then go out for once! It’s good for your body, your mind and society. Again, Freedom Not Fear will take place and you are most welcome to join! You’re not in Berlin, great! Freedom not Fear will also take place in

The demands are:

1. Cutbacks on surveillance measures

  • abolition of the blanket logging of our communication and locations (data retention)
  • abolition of the blanket collection of our biometric data as well as RFID passports
  • protection from surveillance at the workplace by introducing effective labour data protection laws
  • no permanent student ID numbers
  • no handing over of personal information without cause; no European wide standardized state run collection of information (Stockholm Program)
  • no systematic surveillance of monetary transactions or any other mass data analysis within the EU (Stockholm Program)
  • no information exchange with the US or any other state lacking effective data protection laws
  • abolition of permanent CCTV camera surveillance and ban of all behavioral detection techniques
  • no blanket registration of passengers traveling with airlines or by boat (PNR data)
  • no secret searches of private computer systems, neither online nor offline
  • no introduction of the e-health insurance card in the presently planned form
  • no systematic surveillance of financial transactions data or similar mass data analysis in the EU (SWIFT)
  • no blanket registration of all air and sea travellers (PNR data)
  • no automated registration of vehicle number plates and locations
  • no secret searches of private computer systems, neither online nor offline

2. Evaluation of existing surveillance powers

We call for an independent review of all existing surveillance powers as to their effectiveness, proportionality, costs, harmful side-effects and alternative solutions. We particularly call on the European parliament to immediately re-evaluate existing and planned projects on interior security that restrict fundamental rights of the people in Europe.

3. Moratorium on new surveillance powers

Following the “arms race” in security measures over the past few years, we demand an immediate stop to new interior security laws that further restrict civil liberties.

4. Ensure freedom of expression, dialogue and information on the Internet

  • safeguard net neutrality with binding laws
  • keep the Internet free, unfiltered and uncensored, without blocking lists or pre-publication controls, neither by state institutions nor by Internet service providers
  • no Internet disconnection policies (“three strikes”, “graduated response”)
  • outlaw installation of filtering infrastructures on ISP networks
  • content deletion must require an order by an independent and impartial judge, the right to legal recourse must be ensured
  • establish a digital Human Rights Charter for the 21st century, with global protections of digital civil rights
  • introduction of an unlimited right to quote multimedia content, which nowadays is indispensable for public debate in democracies
  • protection of internet platforms for preserving the free expression of opinion (participatory websites, forums, comments on blogs etc.), which nowadays is threatened by inadequate laws encouraging self-censorship (chilling effect)

Cleanternet – campaign for a cleaner and safer Internet – cleanternet.org from alexanderlehmann on Vimeo.

Freedom Not Fear 2010

Creative Commons Attribution-ShareAlike 3.0 Unported
This work by Muelli is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported.