binpoint.com » Internet

Forget Reading the News, Absorb It

tom — Fri, 27 Mar 2009 03:42:18 +0000

Similar to the NYT Article Skimmer I posted recently, Newser.com provides another option if you want to absorb the news rather than read it. +5 points to them for reducing burn time spent on the internet.

VMWare Headed to a Smartphone Near You

tom — Thu, 26 Feb 2009 18:28:14 +0000

AWESOME (Clicky!) Related posts:I sure miss grep in M$ Windows A Romance Flowchart: When Is It Inappropriate to Use Your iPhone? Pretty graphs for the malware detection (ftw?) Related posts:

How to Read the NY Times Fast with Article Skimmer

tom — Wed, 18 Feb 2009 03:11:41 +0000

NY Times article skimmer

The NY Times has a new prototype page called Article Skimmer for displaying news. After being spoiled by the efficiency of Google Reader, I like where they are going with it.

Free dia-like webapp

tom — Thu, 12 Feb 2009 17:38:42 +0000

online flowcharting

Lifehacker brings us lovelycharts for all our “free, I don’t have time to download and install dia” needs.

Minority Report Computer is Real

tom — Tue, 18 Nov 2008 08:28:42 +0000

No really. Watch here.

Now they just need to finish up Jarvis from the Iron Man movie and we’re all set for RL to become obsolete.

Free OSX Tools I Use Everyday

tom — Tue, 18 Nov 2008 00:34:11 +0000

Since a lot of my friends have been “converting” over to Apple machines, they often ask about programs I have running that they don’t recognize. Here’s a (fully linked) partial list of applications I use daily either at work or when at home:

Now I know I said free software, but I had to include the following paid software I couldn’t live without:

Update: Want more? Here’s one list and another list.

What did I miss? Comments.

Spam is unpredictable

tom — Thu, 13 Nov 2008 19:54:36 +0000

Does anyone remember when the FBI busted a major spam ring? Bravo to those boys for what must have been a tough job.

Here’s a pic of what a huge difference it made according to submissions to spamcop.net:

Hmmm, not much to see here.

Today I saw an article in the Washington Post talking about how Web Host McColo was shutdown after being accused with spam activity. Here’s this week’s spamcop.net pic:

I leave it up to you the reader to determine which day and at what time McColo was voted off the island.

alltop

tom — Mon, 07 Jul 2008 21:40:52 +0000

My RSS reader constantly has 1000+ entries left to read. My average day doesn’t budget enough time to get through them faster than they arrive.

Time to reduce, reus– err, prioritize!

Many of my favorite blogs are part of the gawker media network, which features a “top posts tag.” This is perfect. I can now let other people do the dirty work of weeding out the less interesting posts and leave only the cream of each day’s crop. Great, but what if I want to read / stumble new websites?

alltop‘s got you covered.

Thousands of Sacrificial Lambs

tom — Thu, 26 Jun 2008 17:41:29 +0000

Problem:

So you say ‘hackers’ are constantly knocking on the perimeter door to your network.

You claim that they are trying to ‘map’ your network.

You insist that they will cherry pick targets based on fingerprint data, wins/dns name, or other factors.

Proposition:

Fill up a virtual machine host with hundreds to thousands of fake hosts that each have random fingerprint appearance and different name. They don’t need to do anything except listen on a few ports (on a set of believable ports, to mimic a real OS), and maybe send a fake packet or two around (you know, like M$ boxes like to do because they get lonely.) A full blown app like vmware is overkill for this purpose. A perl script on five tiny embedded systems would suffice.

Just think of the possibilities.

Each would dilute any reconnaissance tool with bogus hosts
Each is indistinguishable from real hosts without attempting to check the function of each service for each address.
Each could also be setup to send alerts to your InfoSec dept when anyone attempts to connect to them; (only two categories of connectors: 1) misconfigured friendlies, and 2) bad guys.)
Every second the scanner spends poking around in these fake hosts, your real ones aren’t touched.
You can brag about how many ‘hosts’ are on the network you manage.
If ‘fancy’ is your middle name, you could write a script that would forward connection attempts to a honeypot and attempt to grab a fresh piece of badware.

Thoughts?

P.S. I admit I partly stole this idea from Tom Liston’s LaBrea tarpit.

Writing a DNS sniffer

tom — Tue, 24 Jun 2008 23:37:50 +0000

Programming project: construct a program that can listen to perimeter traffic and construct http proxy-like logs. The weapon of choice? libpcap! The app will need to listen for both DNS (udp port 53) and HTTP (tcp port 80) traffic to accomplish this.

First up is determining where all the interesting bits in each layer of the OSI stack are located within each packet. In logical order:

Ethernet Headers & Packet Structure

IP Headers & Packet Structure

UDP Headers & Packet Structure

DNS Records and DNS Headers (about half way down)

With all that reference material, you might think this is a lot of reading! Okay, fine how about a copy and paste job? Tcpdump is the perfect place to exercise your mouse wheel click skillz to get all the data structures and defines you’ll need.

One last useful tool that should be in every network programmers tool belt is of course, Wiershark (aka ethereal). In this case, it comes in handy to double check your program is disassembling the packets the same as Wireshark.

A BPF is used to speed up the filtering of interesting packets from useless ones and is passed in to the program as follows:

dns_sniffer “udp port 53″

When writing any network aware application, the best place to start for documentation is always going to be the applicable RFC for whatever protocol you plan to speak.

When figuring out what bitmasks were needed to mask out specific bits (namely the first two bits for parsing DNS compression) Conversion Table came in handy. I also found this handy page if you need to brush up on bitwise operations (I sure did, since I hardly use them.) And don’t forget your ASCII-Table!

Have you ever wondered how your lonely little-endian wintel laptop / desktop is able to communicate over the same IP network to a big-endian speaking SPARC system? It certainly kept me up at night! See for yourself how it is able to work.

More to follow… (you know, like source code)