Category: Tech

Posted on

Open Source Security report from Coverity

[Coverity](http://www.coverity.com) has published it’s [Open Source Scan Report 2008](http://coverity.com/library/pdf/Coverity-Scan_Open_Source_Report_2008.pdf), which details the security status of several open source projects. Here’s my summary:

* The overall security of open source projects is improving.
* There’s a linear relationship between the amount of code and the amount of bugs.
* Surprisingly, there’s no relation between function length and defect density.

Projects with exceptionally low defect density include Amanda, NTP, OpenPAM, OpenVPN, Perl, PHP, Python, TCL, Postfix, Samba, curl, libvorbis and vim.

The top two security defects are

1. NULL pointer dereference
2. Resource leak

I got to preview [Coverity Prevent](http://www.coverity.com/html/prod_prevent.html) at a previous job, and it rocks at finding real bugs in code, with a very low rate of false positives.

Posted on

What programs are listening to the network?

Sometimes, I’d like to know what programs on my system are listening to the network, and to quote the Perl motto, “there’s more than one way to do it”. On Linux, there’s `lsof -Pi` and `netstat -p`. On Windows XP and Vista, there’s the built-in `netstat -b[v] -a` and a separate utility called [tcpview](http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx). I’ve included example usages and outputs.

__lsof__ (Linux)

sudo lsof -Pni

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
python 1886 root 4u IPv4 6621 TCP 127.0.0.1:2207 (LISTEN)
cupsd 1898 root 3u IPv4 6663 TCP 127.0.0.1:631 (LISTEN)
cupsd 1898 root 4u IPv6 6664 TCP [::1]:631 (LISTEN)
cupsd 1898 root 6u IPv4 6667 UDP *:631
sshd 1912 root 3u IPv4 6711 TCP *:22 (LISTEN)
httpd 20084 apache 4u IPv6 7293 TCP *:80 (LISTEN)
httpd 20085 apache 4u IPv6 7293 TCP *:80 (LISTEN)
httpd 20086 apache 4u IPv6 7293 TCP *:80 (LISTEN)
httpd 20087 apache 4u IPv6 7293 TCP *:80 (LISTEN)
httpd 20088 apache 4u IPv6 7293 TCP *:80 (LISTEN)
httpd 20089 apache 4u IPv6 7293 TCP *:80 (LISTEN)
httpd 20090 apache 4u IPv6 7293 TCP *:80 (LISTEN)
httpd 20091 apache 4u IPv6 7293 TCP *:80 (LISTEN)

__netstat__ (Linux)

sudo netstat -lp –inet –numeric-hosts

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN 1912/sshd
tcp 0 0 127.0.0.1:ipp 0.0.0.0:* LISTEN 1898/cupsd
tcp 0 0 127.0.0.1:2207 0.0.0.0:* LISTEN 1886/python
udp 0 0 0.0.0.0:ipp 0.0.0.0:* 1898/cupsd

Where’s `httpd`? It should be there, and it is, when I exclude the `–inet` option:

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 :::http :::* LISTEN 2038/httpd
tcp 0 0 ::1:ipp :::* LISTEN 1898/cupsd

__TcpView__ (Windows)

[Download](http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx) and start TcpView. From the menu, choose File > Save. Here’s the output from the file.

Process Protocol Local Address Remote Address State
svchost.exe:1064 TCP jareds-xp:epmapi jareds-xp:0 LISTENING
System:4 TCP jareds-xp:microsoft-ds jareds-xp:0 LISTENING
svchost.exe:976 TCP jareds-xp:3389i jareds-xp:0 LISTENING
nxssh.exe:2032 TCP jareds-xp:11000 jareds-xp:0 LISTENING

__netstat__ (Windows)

Note that this runs quite slowly on Windows.

netstat -bva

Active Connections

Proto Local Address Foreign Address State PID
TCP jareds-xp:epmap jareds-xp.mydomain.com:0 LISTENING 1064
c:\windows\system32\WS2_32.dll
C:\WINDOWS\system32\RPCRT4.dll
c:\windows\system32\rpcss.dll
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ADVAPI32.dll
[svchost.exe]

TCP jareds-xp:microsoft-ds jareds-xp.mydomain.com:0 LISTENING 4
— unknown component(s) —
[System]

TCP jareds-xp:3389 jareds-xp.mydomain.com:0 LISTENING 976
— unknown component(s) —
c:\windows\system32\rpcss.dll
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ADVAPI32.dll
[svchost.exe]

TCP jareds-xp:11000 jareds-xp.mydomain.com:0 LISTENING 2032
[nxssh.exe]

TCP jareds-xp:3389 jareds-xp.mydomain.com:0 LISTENING 976
— unknown component(s) —
c:\windows\system32\rpcss.dll
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ADVAPI32.dll
[svchost.exe]

Posted on

Read Office 2007 documents on Linux

I’ve had a few occasions where I’ve needed to read Microsoft Office 2007 documents, even though I don’t have Office 2007. There are several approaches.

Office 2007 stores it’s files and a zip archive, with xml files inside. This means that they’re somewhat human readable. I’ve used unzip to extract the file, and poked around until I found the xml file that represented the document (word/document.xml for docx). This works fairly well for Word and Power Point documents, but I’m not so sure that it would be good for Excel files.

Novell has provided a [converter](http://odf-converter.sourceforge.net) that converts Office 2007 documents to Open Office documents, and allows Office 2007 to save in Open Office format. The command line converter appears to work well, in my limited experience. Thanks to [this blog post](http://www.oooninja.com/2008/01/convert-openxml-docx-etc-in-linux-using.html), here’s how I installed it on a Fedora/RedHat system:

* “mkdir converter“
* “cd converter“
* “wget http://download.go-oo.org/red-carpet/ooo-680/sled-10-sp-i586/odf-converter-1.1-7.i586.rpm“
* “rpm2cpio odf-converter*rpm | cpio -ivd“
* “sudo cp usr/lib/ooo-2.0/program/OdfConverter /usr/local/bin“
* “cd ..“
* “rm -rf converter“

Run it as follows:

* “OdfConverter /i example.docx“

Windows users with MS Word 2000, 2002 or 2003 can install the [Microsoft Office Compatibility Pack](http://office.microsoft.com/en-us/word/HA100444731033.aspx). For those without MS Word, there’s the read-only [word viewer](http://www.microsoft.com/downloads/details.aspx?FamilyId=3657CE88-7CFA-457A-9AEC-F4F827F20CAC&displaylang=en)

Mac OS X Tiger office applications reportedly open Office 2007 documents.

Mac, Linux and FreeBSD users can use an online document conversion service such as [http://www.docx2doc.com/](http://www.docx2doc.com/) and [http://docx-converter.com/](http://docx-converter.com/) — with the caveat it may be unwise to submit confidential or proprietary documents to a third party.

Posted on

Palm TX: There’s more than one way to install an application

When I got my Palm TX, I didn’t realize that the Palm Desktop software wasn’t completely compatible with Windows Vista. For example, I can’t install new palm apps via hot syncing. Here are some alternative install paths:

1. Attach the pdb files to an email, and send it to myself. Use VersaMail to retrieve the message, and install the pdb attachments.
1. Use the web browser to download and install a pdb file.
1. Have someone beam it using the IR interface.
1. Have someone send it using bluetooth.
1. Install from an SD card. I haven’t verified that this works.

While I’m at it, it seems like configuring Linux to hotsync with Palm devices can be a pain. As an alternative, I think I’ll get an SD card and use [nvbackup](http://handypalmstuff.sourceforge.net/) to backup to SD, and then copy the backup from SD to my Linux box and use it with JPilot.

There’s more than one way to do things, especially for a Palm equipped with built-in WiFi, bluetooth and an SD expansion card.

Posted on

Disk Encryption: Not as secure as I thought

Apparently, it’s easier than I thought to recover disk encryption keys from a stolen laptop computer. The attack works against “several popular disk encryption systems: BitLocker (a feature of Windows Vista), FileVault (a feature of Mac OS X), dm-crypt (a feature of Linux), and TrueCrypt”. Watch the demonstration video at [http://citp.princeton.edu/memory/](http://citp.princeton.edu/memory/).

> The root of the problem lies in an unexpected property of today’s DRAM memories. DRAMs are the main memory chips used to store data while the system is running. Virtually everybody, including experts, will tell you that DRAM contents are lost when you turn off the power. But this isn’t so. Our research shows that data in DRAM actually fades out gradually over a period of seconds to minutes, enabling an attacker to read the full contents of memory by cutting power and then rebooting into a malicious operating system.

Encrypting a disk drive _does_ increase the confidentiality of data. It’s just not as secure as once thought.

Sidenote: Software and hardware based [key loggers](http://en.wikipedia.org/wiki/Keystroke_logging) can reduce the security of encryption as well.

Posted on

‘iotop’ shows top I/O consumers

Want to know why your Linux box is sluggish? Some program is probably hogging disk I/O. I just discovered a cool utility that shows what programs are using the most disk I/O: [iotop](http://guichaz.free.fr/misc/). To install it on Fedora, run

yum install iotop

Otherwise, download and run [iotop.py](http://guichaz.free.fr/misc/iotop.py) — it requires Python 2.5+ and Linux kernel 2.6.20+

Posted on

Evince broken: unhandled x-extension-pdf

On Linux and the Gnome Desktop, Evince is the default application for viewing Adobe Acrobat (PDF) files. Recently, it started giving me the message “Unhandled MIME type: ‘application/x-extension-pdf'”. Here’s how I fixed it.

1. Edit $HOME/.local/share/mime/packages/Override.xml
2. Replace “application/x-extension-pdf” with “application/pdf”
3. Run “update-mime-database $HOME/.local/share/mime”

[Reportedly](http://www.mail-archive.com/evince-list@gnome.org/msg00485.html), a bug in the Nautilus file manager causes this behavior.

Posted on

Vista’s VirtualStore silently causes problems

When our household bought a Vista laptop, I migrated our install of Quicken 2002 to the new computer. My wife and I have separte accounts, and we update the checkbook separately. When she went to balance the checkbook, she noticed that my entries were missing.

On further investigation, it turns out that when I run Quicken, I can see my entries, but not hers. When she runs Quicken, she sees her entries, but not mine. It appeared that we are using two different databases. Quicken 2002 is supposed to write its files to the c:\Program Files\QUICKENW directory. I had given each of our non-Admin users access rights to write to that directory. I installed [Process Explorer](http://download.sysinternals.com/Files/ProcessExplorer.zip) so that I could see what files Quicken had open, and their location. It turns out that Quicken was writing its files to C:\Users\\[USERNAME]\AppData\Local\VirtualStore\Program Files\QUICKENW\. Why was it doing that? What is this VirtualStore thing?

Apparently, Windows Vista enforces security policy and doesn’t allow applications to write to C:\Program Files. Instead, it redirects badly behaved applications, like Quicken 2002, to write files to a per-user [VirtualStore](http://www.google.com/search?q=vista+virtualstore) directory, and it does this silently (for backwards compatibility). I wish Vista had simply denied write access to Quicken, so I would have known that there was a problem early on, before getting into this mess of having two diverging checkbook databases. I like the additional security that Vista enforces, but it’s inconvenient in subtle and exasperating ways.

Now I need to figure out how to merge our separate copies of the checkbook.

Update: I never did merge the two quicken databases.

Posted on

LatencyTOP

Jake Edge writes “Stuttering audio or an unresponsive desktop – typically caused by operating system latency – are two things that annoy users. They can be difficult problems to diagnose, though, as they are transient and buried deep inside the [Linux] kernel. A new tool, [LatencyTOP](http://www.latencytop.org/), seeks to provide more information on where latency is occurring so that it can be fixed or avoided.”

Read more: [http://lwn.net/Articles/266153/](http://lwn.net/Articles/266153/)

Posted on

Palm TX and Windows Vista

For Christmas, Santa gave me a [Palm TX](http://www.palm.com/us/products/handhelds/tx/) to replace my five-year-old [Sony Clie](http://en.wikipedia.org/wiki/CLI%C3%89). It was more cost effective than a Microsoft Pocket PC device or an [iPhone](http://en.wikipedia.org/wiki/Iphone), and it’s backwards compatible with my tried-and-true software.

Unfortunately, the [Palm Desktop](http://en.wikipedia.org/wiki/Palm_Desktop) software doesn’t work so well on [Windows Vista](http://en.wikipedia.org/wiki/Windows_Vista). It appears to work, but fails in subtle and non-obvious ways.

– Each time I hotsync, it repeatedly backs up all programs and databases, which takes a long time. _Solution_: I gave user write access to the folder where it was trying create the backup.
– CSV import of multi-line Note fields is broken. I used this feature to import addresses from MIS2PALM. _Solution_: I upgraded to [MIS2PALM version 4](http://www.mis2palm.com/), and configured it to export in vCard format. Palm Desktop properly imports multi-line Note fields from vCard format.
– CSV import forgets field-association. It used to remember this. Again, I’ve switched to vCard format, so this doesn’t get in my way anymore.
– HotSync > FileLink doesn’t work.
– The Beta Palm Desktop that’s supposed to be compatible with windows Vista hung on startup.

I had gone through a tedious download, uninstall, install process to try the beta out. I had another tedious process to uninstall the broken beta, and then I installed the previous Windows XP version, which I downloaded from the website to save time (I didn’t have the Palm TX install CD with me at the time). This was a big mistake, I realized several days later, because the downloaded version was missing several features such as the Media, Note Pad and VersaMail plugins to the Palm Desktop. So, I had to go through another tedious uninstall, reinstall process. Amidst all of this, the Desktop conveniently forgot some of my customized preferences, which required yet more time.

What a rant… maybe my experience will help someone else figure out how to solve some of the issues I’ve faced.

I really do like my new TX. It’s faster than my previous Clie. It has built-in bluetooth, which allows me to share contacts with my wife’s cell phone, or with other people. The built-in WiFi allows me to read the [mobile edition of the Deseret News](http://deseretnewscom/mobile) and the [Salt Lake Tribune](http://m.sltrib.com) with the Blazer browser. It’s not good for much more than that. If it’s handheld web browsing that I had wanted, I would have asked Santa for an iPhone or a [Nokia N800](http://www.nseries.com/n800) internet tablet. For me, the address book, the calendar and the [Plucker](http://www.plkr.org/) e-book reader are the most needed features.