Posts Tagged ‘hack’

WordSequence For KeePass 2 = XKCD Passwords

If you’re not familiar at all with the title, click here to check out the fabulous comic in question.

“Lolz” right? Well I completely agree with it – and I’m finding that my passwords are getting longer and longer and you really have no hope of remembering them. Take at look at this monster: !J$?e04uGh=eDP (89 Bits) You have no choice but to store this in a program like KeePass, never actually look at it, and hope that your password database stays backed up. 🙁

Password enforcement has gotten better, and worse at exactly the same rate. Here’s an example excerpt from Cal Poly’s password document. (This was discovered when my sister in-law tried 15 times to make a password that she could actually remember for her access):

Passwords must contain at least one character from three of the following lists:
1. Uppercase Alphabetic (A‐Z) 2. Numbers (0‐9) 3. Lower case Alphabetic (a‐z) 4. These Special Characters are allowed: ! $ % & , ( ) * + ‐ . / ; : < = > ? [ \ ] ^ _ { | } ~ These special characters are not permitted: # " @ and the space character

Passwords must not contain any of the following:
1. Your previous passwords used within the last two (2) years 2. Passwords less than 16 characters must not contain any of the following: a. Any words of three or more characters, including non‐English words b. Any groups of three or more characters of the same character type c. Any names, person, places, or things found in a common dictionary d. Any of your names (first, middle, last), any current Cal Poly username e. Repetitive characters (sequences)

The second part ensures that no password can be easily memorized. This string has to be written down. Once it’s written down, the whole reason for having passwords fails everyone, and after staring at the logic for 5 minutes I came up with something like this: 50Fu40Yo (42 Bits)

If you network admins are listening, you need to get over trying to corner users into crazy strings of letters and numbers. Dictionary words are easy to guess, but strings of dictionary words with random characters in there are just as good, if not infinitely better for users to actually remember. Lets look at this example: Wool+BladeFriction5 (105 Bits) A brute force attack is just going to go through every possible character in every possible position, and there’s 19 of them. Now for our ‘easy to remember’ Cal Poly password, the length is only 8 because I would never actually want to make it more then the minimum. Do you want a short useless password that gets written down? Or a long somewhat complex one that is memorized?

The challenge is to make a complex password that is easy to remember. The password should also satisfy usual requirements for length, capitalization, and numbers or uncommon characters. Here’s what I use:
KeePass 2 & WordSequence

Search the web and drop a couple thousand words (I used nouns and prepositions) into the window. I came up with some common substitutions (like @ for a, etc. – ‘b@ke m0re p1e’) and created complex easier to remember passwords like: Cheese4TigerDinner! (88 Bits) Most normal websites would accept this as a excellent password for the length and the special characters, and most humans could remember the phrase: Cheese for tiger dinner!

Tags: , ,

24

01 2012

Transmission, Screen, etc. on your Storcenter NAS.

storcenter ix2 running transmission
As I guessed in a previous ix2 post – there is a better, thinner, BitTorrent client. Abhilash suggested checking out Vladimir Vuksan’s blog post about customizing iomega storcenter with ipkg.

I’m going to do some more research into all of this, but right off the bat I was able to install ‘screen’ and ‘transmission’.
This page on setting up transmission on a headless machine (NSLU2) was the ticket.
The only hard part I had was finding and editing the settings.json – in order to add 10.0.1.* (my local subnet) to ‘rpc-whitelist’ like this: “rpc-whitelist”: “127.0.0.1,10.0.1.*”, The trick is to start the daemon and let it run for a few seconds, then the file will be created.

vi /.config/transmission-daemon/settings.json

Once added, I re-started the daemon and opened http://10.0.1.5:9091 – the web client opened right up. In the preferences I set the directory to: /nfs/public/Media/Torrent/ (an existing share called public where my BitTorrent files are stored on the ix2) I started up a few torrents and checked my CPU with ‘top’. 10% is a lot better then 70%. The interface is much better then the stock ix2 version 2 firmware. You can set limits as well as “Temporary Speed Limits” for making sure your ix2 is in top form when you’re awake.

Further study:
1. I just heard of synology NAS drives this morning. I’m going to take another guess that their related in some way to the Storcenter.
2. Those repositories are from nslu2-linux. Knowing this from the start might have made my mucking about in the SSH a bit better…
Enjoy!

09

06 2010

Iomega Storcenter ix2 – SSH, email notifications, and BusyBox init.d

Iomega Storcenter ix2 ssh root access
Iomega Storcenter ix2 SSH access! (for firmware 2+ ; this works for the ix2, ix4, etc.) First – big ups to Christopher Kusek over at pkguild.com for getting this on the web. I’ve already had people comment asking how to do it – so I’ll cover it again here.

Login to your Storcenter with the admin user.
In your browser replace the /home.html?t=1 file at the end of the IP address with /support.html
You will now see the support.html page. There is an icon called Support Access.
Select this link and click the SSH access check box.
Now get on your *nix box or open Putty SSH. Type in your NAS IP address (mine happens to be 10.0.1.5).
Login as root, and the SSH password for your box is: soho[youradminpassword]
That’s “soho” with your current admin password tacked onto the end without brackets.
Thanks again to Christopher Kusek!

We have lift-off. Now what can we do with it? Well, at this point, that depends on how creative you are. So I typed “busybox” at the prompt and a list of currently defined functions came up. If you are handy in Linux you’re probably going to go further and faster then I did. If you have any suggestions after you read what could be a tragic Linux hack – hit up the comments.

How email notification works, why it broke, and how you might fix it.
I was less then excited when I discovered “sendmail” missing from the list of BusyBox functions. How in the hell does this thing send email? I started poking around and the “find -name” command is helpful. I logged into the html settings page on the machine and hit apply to send a test email. At the same time I had “top” running in the shell.

2466 postfix 3744 S smtpd -n smtp -t inet -u
2467 postfix 3492 S proxymap -t unix -u

Okay – smtpd sounded promising. I looked around and found that the Storcenter uses a stripped down version of postfix smtp to send email. Interesting side note: the config files are all there but commented out. As a side project, this device is pretty much ready to be an email server. Postfix uses /usr/local/postfix/main.cf to configure outgoing smtp. The storcenter points to mail.authsmtp.com on the default port smtp 25. It sends the outgoing mail directly to authsmtp.com with a password in the config file.

AuthCheck.exe from authsmtp.comAuthsmtp has a dandy little tester exe for Windows – AuthChk.exe found here http://www.authsmtp.com/support/diag.html This shows me that my Storcenter was not the issue, but it was my ISP (Verizon) blocking port 25 outgoing. This is to be expected, and Iomega should realize that a specified port number in their next release would be a good idea.

How can I fix outgoing email right now? For I AM root.
I first discovered that code in the javascript of the Storcenter’s web interface is what’s dropping any “user@host.com” because of the @ sign. This code is buried in the read only flash and it’s not clear to me how you could change it without breaking open the flash. Probably built with buildroot. I then looked at the port issue and figured that if I could get the NAS to send email out on a different port that mail.authsmtp.com could receive, (25, 26, 2525) I’d be in business. In the postfix main.cf file on this machine it says:

# In the case of SMTP, specify a domain, host, host:port, [host]:port,
# [address] or [address]:port; the form [host] turns off MX lookups.
#
relayhost = [mail.authsmtp.com]

So all we have to do is change this to read:

relayhost = [mail.authsmtp.com]:26

If only it survived a reboot… The main.cf file is located in /usr/local/postfix and symlinked to /tmp – this file gets created and written by the system every time it starts up. I’m pretty sure /sbin/executord -c /etc/sohoConfig.xml is doing it. If you look in sohoConfig.xml you see the mail.authsmtp.com specified. All of this is on the read only flash portion of the unit. I looked into BusyBox some more and found that /etc/init.d is doing the startup work. Long story short, rcS runs all the S?? numbered files one at a time in order. An example: “S20urandom, S39interfaces, S40bond-init, etc, etc…” mounts the drives, starts samba, makes toast, starts interfaces, etc. All I had to do was copy over the main.cf file with an edited one and restart the postfix email service.

What I came up with is a file in /etc/init.d called S73mailport (the 73 is a ham reference, and as long as it’s higher then 60, it runs this last)
Don’t forget to chmod 755 this file to make it executable.

#!/bin/sh
sleep 15
cp /etc/mailport/main.cf /tmp/main.cf
/mnt/apps/usr/sbin/postfix -c /usr/local/postfix reload

As you can see there is a modified main.cf file that I stored in /etc/mailport. I wait for executord to finish writing the config (sleep 6 is too soon) and I copy over it. I then restart the postfix services with the whole command postfix -c /usr/local/postfix reload. If you just type postfix reload it won’t find the config. Now my Iomega Storcenter sends me email on port 26! It survives a reboot, but I’ll admit it’s probably not the sexiest way to do this. Another caveat is that upon a hard shutdown (which I’m not going to test as I have active data on this NAS) I’m willing to bet that it executord will signal the Storcenter to send out an email as soon as it starts up. This will most likely never be sent as it will attempt to go out on the default port 25, before my S73mailport script changes it after waiting 15 seconds. So I won’t get the first email, but I’ll get the “Data Protection Reconstruction Complete: The storage device has completed data protection reconstruction,” once that’s finished. This will clue me into the fact that there is a serious problem on my NAS that needs to be looked at.

Other observations:
* The torrent downloader seems to be written into appweb and uses 60 – 70% CPU when running. It lags the interface and shell hard. So hard that I thought I broke it poking around. This is probably fine when I want to setup a download while I’m in Tahiti, but no good if I’m actively looking at pictures stored on the device. Is there a tiny linux torrent program that can run on this device in the shell? I’m sure.
* The read only file system is kind of BS. The flash and Iomega stuff is stored here, but the device boots off the physical hard drives… So config changes are overwritten, but if a drive were to die – you’re SOL with the interface. Time for the SATA cables and the Linux box to come out.
* Now that I know that I can, I have access to a little computer that can move files around, run little scripts, and possibly provide other network functions like TFTP PXE boot for some old thin clients I have hanging around.

Got ideas? Got a better implementation? Let me know!
– Kris

30

05 2010

Iomega Storcenter ix2 – the update hack.

storcenter ix2I’m posting this basically because I know others are out there on your own. Cold and wandering through the internets looking for something about how to mod and update this device. I’m talking about the (EMC) Iomega Storecenter ix2. I picked up this little guy a little more then a year ago for some cheap money. Then I found out that they were discontinuing the model because of some pretty obvious problems. :|

Pretty obvious problem #1. The fan is horrible and you probably have already done something about it. Along with the fan the airflow through the device is just as bad. You can see that Iomega took a complete 180 when they came out with “the new model“** What I suggest is you get out your Dremel and cut a nice hole in the back panel. I put an over-sized ultra quiet fan with a dust filter on it. It’s already back in the closet, so I’m not getting a picture of it… Hell, you don’t want to see a picture of it. It’s a 80mm PC fan bolted to the back of a $200 NAS drive. It’s goofy looking utilitarian hardware that needs to be in the closet. Let the sexy laptops and iPods take the credit while the hacked Linux device with wires and fans all over it gets the job done. *cough **For reasons of ‘search’ the next model up is the ‘eye ex two hundred’

Problemo #2. I have been looking for a USB aware UPS (Uninterruptible Power Supply) for this device from day one. Having a ‘self aware’ storage device is pretty cool. Enable write caching and don’t worry when the power goes out when your in Tahiti. I finally obtained a Tripp Lite UPS and replaced the battery on it. Fresh USB cable plugged in and – nothing. Then it gets worse. I restart the device and it just hangs. So – Are you having a problem where your Storcenter ix2 won’t recognize your Uninterruptible Power Supply?

Final Problem #3. Every time you try to search for Iomega Storcenter ix2 (or maybe storecenter?) you get a thousand ‘re-view’s’ of how awesome it is and nothing about helping you solve issues or fix problems. Even after you use a crazy Google search like this…

I’m here to help!
Not with the fan though – you’re clever, you’ll come up with something. :p

Iomega Link to all the files and info for the Storcenter ix2

Good news / Bad news. You hit ‘update’ and your device tells you that you have the latest firmware! You don’t. The latest firmware would be 2.0.15.43099 or higher. The good news is that along with potentially fixing the UPS not recognized problem, you will get the torrent downloader. This means that while your desktop is off and not using 500watts an hour your little ix2 can stay busy getting ‘the latest release of Fedora’***.
***or movies and pr0n.

Other bad news is you’re going to have to sign up to the Iomega site with an email. It’s not nearly as bad as Cisco is – but you have to get a valid email. Or an alias that forwards to your real email that you can shut down after you hit accept.

While your doing that – Might as well sign up for the Iomega Support Forums Lots of moderated fun in there… :)

Backup your data. Hack the fan. Load the firmware file and hit update. Wait a while in a panic. Login. Connect your UPS. Hopefully it now recognizes it! Torrent movies and pr0n. Set quotas. Oh – and because it can’t possibly all be good. You will lose the ability to get email updates from the unit… This is a gem – exhange?? :confused:

Update – I got SSH access!
Easy as HTML. Here’s how you get SSH access to your ix2. Now to FIX the email notification port and configuration… Initial look tells me that it doesn’t use sendmail :(

26

05 2010
Do NOT follow this link or you will be banned from the site!