Fabrice Bellard –of QEMU fame– has implemented a PC-emulator in JavaScript. So now you can boot Linux in your browser. How geeky is that? Enjoy the show… Here are some technical details.

There is a small C-compiler available. It is ‘tcc’ (also from Bellard). You can use it to compile the sample (hello.c)

My girlfriend –by accident– removed photo’s from her SD-memory-card while trying to make a backup of the photo’s. Yup, a simple case of pressing ‘Yes’ one time too much in a wizard-like windows-GUI-thingy that came along with her digital camera. Luckily she didn’t do any further tampering or run any tools to try to retrieve data from the SD-card. Now I can first put the ‘lock’ on the SD-card and dump an image of the entire card on my linux laptop. Once I had an image of the SD-card I could make copies and tamper with those all I want. If I could not restore files in one way I can just make a fresh copy and try another way… lovely.

Sure I could try to manually traverse the FAT-32 structures on the filesystem but that would take a lot of time. There must be some –free– tool out there to do this for me right? So a little googling pointed me to a tool called PhotoRec which is actually part of TestDisk. TestDisk can be used to recover lost partitions, filesystems and can even undelete files from many types of filesystems. PhotoRec can be used to scan raw data on (even) corrupt filesystems based on known fileheaders (the files should not be fragmented though). Very useful if you’ve had a disk crash and can’t recover the filesystem altogether. Now luckily the SD-card contained a consistent filesystems (although the meta-data was missing). So trying TestDisk first would definitely be the better option. And BINGO! Everything could be recovered: 1.8GB of photos and one happy girlfriend.

Of course –being the nerd I am– I also tried the PhotoRec tool to see what that would yield. In this case the same files were recovered by doing the raw scan of PhotoRec as well. So I would like to highly recommend these tools when you get into a similar situation. The tools are written by Christophe Grenier. They are available for many platforms and even a live-rescue-cd is available. My girlfriend immediately made a backup of the recovered files as she intended all along. Now we consider this as a serious warning on the importance of backups… once again… Still: it was a beautiful monday thanks to Christophe Grenier. Thank–a–you!

For all Unix-lovers out there: happy 15000th epoch day.

Whahahaha… it had to happen one day. A problem with an anti-virus update marks a false positive and puts the file in quarantine. The OS can’t load the file anymore and… oops… reboots… and…. reboots…. and… reboots… This is actually a great feature. Rebooting windows is like 80% of normal usage and it is now fully automated.

Fixing it can be a bit hard… since the computer is rebooting all the time. McAfee could create a bootable windows CD that restores the missing file from the system but.. hey wait.. no they can’t do that. You can’t distribute a proprietary OS like windows for free… Maybe they can create a Linux boot CD to restore the windows file… Something to contemplate: using Linux to revive a windows machine.

Well as many developers already know: security is a concept, not a product! You can’t just throw “some security” at a piece of software. Security considerations must be part of the original design and development of software. The Pwn2Own hacking contest shows –once again– that there is too little security awareness in current software design. Look at these embarrassing results: all major browsers took a fall: Internet Explorer,  Firefox and Safari. Most browser are compromised by popular plugins like acrobat reader

These OS’s took a fall: Windows 7, Windows XP, Mac OS X snow leopard. The only OS that is still standing is Linux. Because Linux is indefinitely more secure? Well maybe but there’s also something else: Linux is an open source OS where highly skilled developers are coding. Changes are reviewed by others before they are merged into the main kernel tree. In other words: security is part of Linux. Another thing is that people who run linux are people who are aware of abuse. These are –in general– not the people who would click on the ‘cute-kitten-movie.exe‘ attachment. So Linux is just not that interesting to Black Hat Hackers. True: Mac OS X is build on an open source OS as well: FreeBSD but the presentation layer and Safari is proprietary code from Apple (except for the WebKit on which it is build).

Microsoft currently runs the Security Development Lifecycle (SDL) model. This should make security an integral part of the development lifecycle. Well to be honest when budgets are getting tight and deadlines are running out: documentation and code quality are the first areas that take the fall. So really I don’t expect much from SDL. Especially since MS is trying to develop a ‘catch all’ (silver bullet) security measure inside the kernel… I’m not saying these measures aren’t worthwhile, they are (Linux has them for ages now), it’s just not enough.

The phrase ‘security is a concept, not a product‘ proves its point when you look at the measures current OS’s are implementing to prevent ‘arbitrary code execution’. Windows XP, Windows Vista (still in use?) and Windows 7 has DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization). Both ‘techniques’ should prevent (or make it harder) to execute arbitrary code… but they don’t. Dutch security researcher Peter Vreugdenhil showed an impressive circumvention of DEP and ASLR in windows 7. See: security is not a product…

The good thing is that the hackers are not just updating the vendors on the leaks they found. Instead they tell the vendors how to find the leaks themselves in an attempt to raise awareness.

You may have noticed some downtime of the blog. This was due to a major system upgrade in which the entire system was recompiled against a new gcc/glibc combination.

After doing this and sifting to all changes in the configuration files apache failed to start… How nice. Segmentation faults all over the place. A little tweaking here and there solved the problem albeit a little later than expected… Anyway… back online.

As it became clear that the outage was going to take more time than expected I wrote a small sorry-server in perl that served the webpage displayed below:

You can use the code for your own purposes if you want to:
Code can be found here

Yesterday Google officially announced Chrome OS, an operating system targetted netbooks (both intel x86 & arm-based). Chrome OS will be built on the linux kernel. Google will reimplement the security architecture of Linux. A new minimal graphical interface will provide an easy to use interface. As google says it: “it should just work”.

Speed, simplicity and security are the key aspects of Google Chrome OS. We’re designing the OS to be fast and lightweight, to start up and get you onto the web in a few seconds. The user interface is minimal to stay out of your way, and most of the user experience takes place on the web. And as we did for the Google Chrome browser, we are going back to the basics and completely redesigning the underlying security architecture of the OS so that users don’t have to deal with viruses, malware and security updates. It should just work.

Here’s the full announcement. You want screenshots don’t you?

Unix, one of the most important pieces of software ever created, will turn forty this summer. To commemorate this computerworld wrote up a nice story on the early days of Unix. How the first version came to be and how it became portable to other systems as well…

In August 1969, Ken Thompson, a programmer at AT&T subsidiary Bell Laboratories, saw the month-long departure of his wife and young son as an opportunity to put his ideas for a new operating system into practice. He wrote the first version of Unix in assembly language for a wimpy Digital Equipment Corp. (DEC) PDP-7 minicomputer, spending one week each on the operating system, a shell, an editor and an assembler.

There’s also another article which has the Unix timeline. A nice read as well.

Yes, today is a beautiful day for all unix fans around the world. In Unix we measure time in seconds since 1 januari 1970… and today that will go beyond 1234567890. How nice. The javascript clock below is counting… don’t miss it.

countdown

Download the clock javascript code

For those who missed it: there are some screenshots below
(more…)