InMobi hackathon

The day came when I had to go to participate in a Hackathon once again after a long period. It was Saturday and I woke up early morning so that I can reach at the venue on time. InMobi's office in Bangalore is a masterpiece, I must say. First line of selection process was online where our ideas were filtered and we were called at the facility after our ideas were chosen. I was joined by my friend Ravi and like every team we were allotted two cubes - the open cubes at InMobi. After Mohit's sesssion about the hackathon we went to our cubes and settled. All the teams had a mentor and we were asked to formalize our idea within a limited time. It was reviewed by our mentor after the time was over. Then we started thinking about how to approach the problem.

I got a chance to interact with Soumya during lunch. He works at InMobi on databases. He is a cool guy and we interacted a lot and shared some quality time on the lunch table. We went back to our cubes after lunch. I had few discussions with Ravi as he was facing some issues with his web interface. I was thinking about each of the modules of our idea and trying few things on linux and writng scripts for those. It was 3 in the afternoon and there was a laughter session by Sanjay Manaktala. We laughed a lot!! and it was really helpful in rejuvenating a new source of energy within us. We went back and resumed our work. After some time, we had few lines of codes working and we could actually showcase something of our idea. It was 7 in the evening and there was a third round of review by our mentor. We had a great support from Siva and his inputs were truly helpful. We had dinner after some time and I must say that the food was awesome like lunch and breakfast.

It was midnight and we decided to come back to our home and then go back to the arena next morning. We went back to the arena next morning and saw that few folks looked as if they didn't sleep at night. I met with my friend Tushar again in the morning. He had also participated in the Hackathon. It was a wonderful experience and a perfect refresher for me after college. We enjoyed the environment at InMobi a lot and I am eagerly waiting for the next one.  

The FREAK Attack

Last week saw one more security attack. It was named as the "FREAK" attack and is basically an MITM (Man In The Middle) attack which targets the "downgrade to weaker algorithm" property. It downgrades to export grade algorithm. As a countermeasure to this attack, the support for export cipher suites has to be disabled. Several write-ups are worth mentioning and the readers are suggested to go through each of the links mentioned in the references below in detail.  

References:

• https://www.smacktls.com/#freak
• https://freakattack.com/
• Blog by Matthew Green
• CVE
• Washington post
• Quora post

virtualbox window resizing

From quite a few days I was annoyed with the small screen size of my Ubuntu installation in virtualbox. Tried a lot of package installations and reboots, but nothing worked. Finally, the following set of commands worked:

sudo apt-get install build-essential module-assistant
sudo m-a prepare
cd to VBOXADDITIONS which is there in /media/
sudo ./VBoxLinuxAdditions.run
sudo reboot

And the window should be fitting the screen after the reboot.

Wings of Fire - APJ Abdul Kalam

Recently I visited my home town after one year with my cousin brother and this time I booked train ticket from Bangalore. It has always been a great journey for me whenever I have travelled by train. Watching the fields, distant land, people working, trees, mountains and houses gave me a wonderful experience. I felt that my country indeed has lots to offer and great diversities. My journey started from south western part of India and ended in the eastern part and I reached my home after travelling through six states. It was a long journey of about two days and I was thinking what I should do during my travel. So, I looked into my stack of books and I found a book written by our ex-president, a great scientist and a great teacher, Dr. APJ Abdul Kalam. The book was "Wings of Fire". 

It is indeed a great book which not only gives us the experiences of Dr. Kalam but also motivates us to do the likes. Through his experiences he has imparted a sea of knowledge to us. Apart from all the events which he has beautifully written, I liked his scribbled poems. It felt difficult sometimes to fully understand what he actually meant but I gave sufficient time to each of his stanzas. The end result was that I ended the book while returning from home to Bangalore. An old Bengali gentleman, who was having his reservation in front of mine while returning, told me that he has read the book twice and described me his understandings of the book. He was a very friendly person and liked to talk much.

It was a great learning journey as I travelled by train for so long after three years. At the end I decided to take a book on every journey of mine now onwards. 

The POODLE attack on SSL 3.0

Google wrote on its blog about the POODLE attack which seems to be a concern now. Though nvd still says it is under review. One of the recommendations being to disable SSL 3.0 on client (or server or both). Readers are suggested to go through "Recommendations" section here for detailed explanation on the recommendation and "The POODLE Attack" section for explanation on how the attack works. Any comments are appreciated.

Secure copy - an introduction

Secure copy  [scp] is a remote file copy program which comes as a sub-module in OpenSSH. It uses SSH as underlying protocol to transfer data and uses the same authentication. A simple command to copy a file to a remote host is:

scp file user@remote_ip:

There are several options which we can pass to scp [in the command-line itself] like options for ipv4 [-4], ipv6 [-6], option for enabling compression [-C], specifying per-user config file for ssh [-F ssh_config], etc which are passed to underlying ssh process. Additionally, options can be passed in the format used in ssh_config.

Scp works in source and sink modes i.e. 'from' and 'to' which can be seen in the codes and can be realized from the command line also. Users are suggested to go through its manual page. This can be found either by executing "man 1 scp" in the terminal or from the internet ex. 'manual' link of OpenSSH.

Sometimes we need to debug issues in scp for which we may need to see the process hierarchy. For this, we can have a look at "ps -elf" and "pstree -p" and grep for 'ssh' and 'scp' for knowing the process hierarchy in ssh and scp.

Readers are suggested to comment for any rectification on this post or suggestion.

Cryptography I course by Stanford

Online learning has gained much popularity these days. One of these courses is Cryptography I taken by Prof. Dan Boneh of Stanford University through Coursera Inc. I highly recommend this course for those who want to start learning this subject. Even if I have studied few topics of the subject back in college and done some self-study in it, I found the course to be somewhat different. The way of teaching is too good. The course material is a balance of both theoretical and practical aspects and it also highlights some of the open problems in cryptography. The learners need to watch few videos each week and need to answer questions at the end, which they get points for. There is a final test at the end of the course. After successfully taking the test, a certificate of accomplishment is generated within two to three days for the participant. I am waiting for its advanced course: Cryptography II. Readers are suggested to go through the references mentioned below for these courses.

References:

 Coursera

 Cryptography I

 Cryptography II 

SSH protocol overview

Secure Shell, as the name suggests, is a protocol for getting a shell which can be used to securely execute commands on a remote machine. It supports several other features too. It is a combination of three layers of protocols namely, Transport layer protocol, User authentication protocol and Connection protocol [See references below for RFC links]. 

Transport layer protocol provides confidential channel over insecure network. This layer provides server host authentication, key exchange, encryption, integrity protection. It derives session id that may be used by higher level protocols.

User authentication protocol provides a suite of mechanism that can be used to authenticate the client user to the server.

Connection protocol specifies a mechanism to multiplex multiple streams (channels) of data over the confidential and authenticated transport. It also specifies channels for accessing an interactive shell, for proxy-forwarding various external protocols over the secure transport (including arbitrary TCP/IP protocols) and for accessing secure subsystems on the server host. 

OpenSSH is a wonderful implementation of SSH available online [See below for references].

Few references:

 SSH Protocol Architecture

 Transport Layer Protocol

 User authentication Protocol

 Connection Protocol 

 Wiki-SSH

 OpenSSH
 Wiki-OpenSSH

crypt function in Linux

Here is a function provided to encrypt a given key with a provided salt. The signature of the function is as follows:
 
char *crypt(const char *key, const char *salt);
 
If a salt given has a format of "$.$...$..." i.e. normally of the hashed password stored in shadow file (look for my previous blogs on shadow file), then the function will interpret the salt and get the type of hash to be used. A hash type could be of MD5 ($1$), SHA256 ($5$), etc. This way one can hash a password provided by a user (the argument 'key') and match/authenticate with the one stored in the shadow file. This function is highly recommended not to be used for any other purpose except authentication. Readers are recommended to go through its manual page and understand its usage. 
 
Here are some references:
man 3 crypt
gnu_libc_crypt
man7_crypt

Linux shadow and passwd files - an introduction

A user's credentials and password related information are maintained in shadow file in Linux. The file requires root permission to be read. It has the following construction:

username : hashed passwd with salt and type : last passwd change day : minimun days to change passwd : max passwd lifetime : warning period : grace period : account expire day

Days above are in refernce to last passwd change day (calculated from epoch, 01/01/1970) and max passwd lifetime. They can be changed as required. In grace period, a user is asked to changed the passwd as soon as s/he logs in whereas in warning period, which is calculated from max passwd lifetime, the user is just thrown a warning message saying when the passwd will expire. The account lock day is the day after which the user is not allowed to login. There are several utilities which can be used with appropriate options to manipulate these entries in shadow file.

A passwd file is a file which stores user information. It has the following construction:

username : user id : group id :full name : home dir : shell

The last field, shell, is the default shell given to the user after login and home dir is its home directory.

The above words are used so as to convey the information. More information comes in a follow-up blog with references.