Geeks talking about cool stuff

This story grabbed my attention today. Microsoft’s Chief Research and Strategy Officer is calling for the creation of something called the Internet Drivers License. Now, this isn’t and entirely new idea, it has been mentioned several times before. The real question is, whether it would actually have any benefit to the Internet as a whole.

The Slashdot article puts a rather negative spin on the idea, citing the fact that the Internet is unable to cause death, and raises the question of anonmity and incresed identity fraud. It closes by comparing the Internet to the aging telephone networks, stating that we have had a scammers and spammers presence here for many years, without requiring a license.

Whilst overall, I think I agree that the idea of an Internet Drivers license is a bad one, there are some benefits which we may be able to draw something from. Now the whole honus on this idea is that people get a license. A license is defined as a legal document, giving someone official permission to do something. Most often it is accompanied by some form to test, to ensure competancy in a particular field.

This is the part I agree with. Though it can not be mandated, few can argue that the Internet wouldn’t be a better place, if people understood more about the risks of being on the World Wide Web. Imagine if 90% of the worlds compromised machines were no longer under the control of botnets. It’s a nice thought eh?

So there definitiely is some kind of benefit here, but really it’s not so much about giving legal permission, as it is to educating the potential holder in the field of The Internet. What do I mean by this? I mean showing people how easy it is for their computers to fall under the control of the bad guys.

Last year, at around this time, I presented a talk for people in my area to learn more about securing themselves online. I will never forget their faces when I told them that the front page of a particular banking website that they had ll agreed looked legitimate, couldn’t be because I wasn’t even on the Internet.

We need to find a way to instill some basic security knowledge and common sense into the average user. The general public seems to have gotten it into their heads that we don’t just let anyone into our houses, but when it comes to computers, it’s more of, “Why do come on in and put your feet up. Would you like a cup of Tea?”

The problem with a license is it conjours up images of lawyers, police and paperwork. Why I say paperwork, I’m really talking about holding a piece of paper that says that you have a license to be on the Internet. Personally, I think this is taking things a little too far. Who would police it? How would you police it? And more importantly how much do you think you can sell someone elses license for on the black market.

If the license truly is going to abolish anonymity on the web, then we are going to see a sharp rise in the advent of identity theft. It’s hard to think that the license could be any more secure that current web technologies. If I’m wrong here, please tell me

In short, I think it brings up some good ideas. Some things which we could use to further protect the general public. Do I think it will work as described? Hard to say. Come back to me once I’ve passed and have my license

The other day I bought myself, at the great expense of £12, an 8Gb USB stick. My idea was to try out several things.

1. Create a persistent BackTrack Live CD
2. Create an encrypted USB partition, for all my secret things
3. Try booting ISO images using grub2

I feel that before I go any further, I should take a leaf out of another bloggers book and point out that grub2 will not directly boot ISO images. So, it will not allow you to take a windows XP install ISO and boot it. It will not let you take just any old ISO image and boot it. There are some fairly restrictive criteria to getting this to work, however, it does lend itself to being a very useful tool.

So to start with I followed the BackTrack USB install video at the offensive security website. I’m not going to re-iterate all the commands here, but simply give an overview of what I did.

Using fdisk I created 3 partitions

• 1 – 5Gb – Bootable – W95 FAT32
• 2 – 1Gb – Linux
• 3 – 1Gb – W95 FAT32

In my case, just to ensure I didn’t screw anything up, I installed this on my usb stick using a live CD, with my HDD unplugged. I have heard how the grub2 installer can be a little flaky and indeed will share an experience of this later. In the beginning I used the BackTrack, but later on I switch to using the ubuntu live CD for another reason.

So my stick had a device identifier of /dev/sda. I have replaced this in the instructions with /dev/sdX so that people trying to copy and paste don’t hose their systems.

The next step is to format the partitions;

mkfs.vfat -F 32 -n BT4 /dev/sdX1
mkfs.ext3 -b 4096 -L casper-rw /dev/sdX2

Now we need to copy all the data from the BT4 CD. Before you all shout in unison, yes, I could have just used the BT4 ISO here, but I simply didn’t want to

So we mount the /dev/sdX1 partition, and run rsync -avh /media/cdrom/ /mnt/sdX1

This will take a few minutes and allow me to explain that the way we have created this allows us to run BT4 in one of two ways. First, we can run just as a live CD, with all the benefits that brings. Second we can run a persistent version of BT4 which will use the casper-rw partition as a sudo layer over the top of the live ISO layer. Any files we alter whilst booted in the persistent environment will be stored in this layer. Many people use a 4Gb partition for the casper-rw purely so that they can apt-get update their BT4 installation.

One of the next steps in the process on the video is to install grub. I’m actually going to skip this step and go straight to a CD change, now booting into ubuntu 9.10. There is good reason for this. Though BT4 seems to have all of the relevant files for grub2 on the DVD in the /boot/grub directory, the actual install only appears to have grub1.

Once I was booted up into ubuntu-desktop, I remounted that same /dev/sda1 partition, moved the /boot/grub directory to /boot/grub-old and then created a new /boot/grub directory, initially blank. After this I ran the grub installer.

sudo grub-install --no-floppy --root-directory=/media/BT4

The /media/BT4 was where my /dev/sda1 partition was mounted. This should correctly install grub2. After this we just have to modify the grub.cfg file. It’s not actually present right now, as we are not supposed to create one from scratch. Grub2 works differently to previous incarnations and prefers users to use a grub-update command, which pulls various lines from various files and merges them into it’s own grub.cfg which will get overwritten each time an update is made, hence the advice not to edit it ones self.

Since we are not going to be running the grub-update command we are safe to create our own. Just before we do this, I want to mention about the /boot/grub/iso folder I created in out BT4 partition. I have copied an ubuntu netbook install there, so that I can demonstrate just how easy it is to boot Ubuntu live cds.

Below is my grub.cfg file. You will notice upon booting backtrack that we maintain the fancy terminal screen during boot and tty sessions. However I haven’t, as yet, messed with the grub boot image. Enjoy.

GRUB_GFXMODE=1024x768x16
insmod vbe

menuentry                "Start BackTrack FrameBuffer (1024x768)" {
linux                /boot/vmlinuz BOOT=casper boot=casper nopersistent rw quiet vga=0x317
initrd                /boot/initrd.gz
}

menuentry                "Start BackTrack FrameBuffer (800x600)" {
linux                /boot/vmlinuz BOOT=casper boot=casper nopersistent rw quiet vga=0x314
initrd                /boot/initrd800.gz
}

menuentry                "Start BackTrack Forensics (no swap)" {
linux                /boot/vmlinuz BOOT=casper boot=casper nopersistent rw vga=0x317
initrd                /boot/initrdfr.gz
}

menuentry                "Start BackTrack in Safe Graphical Mode" {
linux                /boot/vmlinuz BOOT=casper boot=casper xforcevesa rw quiet
initrd                /boot/initrd.gz
}

menuentry                "Start Persistent Live CD" {
linux                /boot/vmlinuz BOOT=casper boot=casper persistent rw quiet
initrd                /boot/initrd.gz
}

menuentry                "Start BackTrack in Text Mode" {
linux                /boot/vmlinuz BOOT=casper boot=casper nopersistent textonly rw quiet
initrd                /boot/initrd.gz
}

menuentry                "Start BackTrack Graphical Mode from RAM" {
linux                /boot/vmlinuz BOOT=casper boot=casper toram nopersistent rw quiet
initrd                /boot/initrd.gz
}

menuentry		"Ubuntu Server 9.10" {
loopback loop /boot/iso/ubuntu-9.10-netbook-remix-i386.iso
linux (loop)/casper/vmlinuz boot=casper iso-scan/filename=/boot/iso/ubuntu-9.10-netbook-remix-i386.iso noeject noprompt --
initrd (loop)/casper/initrd.lz
}

menuentry                "Memory Test" {
linux                /boot/memtest86+.bin
}

You can see the loop commands tell grub to loopback mount the CD ISO. This is where the magic happens. Notice also the iso-scan option passed, which tells the kernel where to find the iso image once the second stage is loaded. Different distros have different ways of accomplishing this on live CDs, it’s worth googling to find out how. The one distro I haven’t heard of people having success with is fedora, but I’m unsure just why this is. I guess I need to take a look.

There are options to tell the loopback mounter to pull isos from different partitions, but if you place them in the same dir that grub lives, you don’t need to do this. This was the main reason for having such a large initial BT4 directory. BT4 is only 1.5Gb

That’s enough for one sitting. Have fun.

I saw this tweet today by our good friends “Wired”

wired
For years, the sophisticated play of pro teams trickled down to colleges & high schools. Videogames are reversing that. http://bit.ly/9GNpaB

It piqued my interest and off I clicked to have a look. The article in question was discussing an incident that happened in an American football game, where, in the closing seconds, a player forwent scoring a goal immediately and instead ran across the width of the field. When questioned about his tactic, it was apparently revealed that his time-wasting tactic was learned from a video game. True enough, it’s a tactic that I myself have employed several times.

The article then went on to talk about how athletes today are getting far more training than their predecessors, by using video games instead of real world experience. Apparently it seems to be working, but I couldn’t help but wonder how many other tactics in video games could be useful in the real world.

Would you really see soldiers jumping up and down on the battlefield to avoid getting hit by their enemies? Would we see drivers trying to drive their cars through walls and over jumps to find a shortcut to work?

Don’t get me wrong I love video games, but sometimes you have to wonder if the younger generation is basing too much of their reality on a virtual world.