1
2
3
4
5
6
7
8
9
10
11
12
13

#!/bin/sh
 
PREFIX=/var/develbackup
SVNFOO=/home/svnuser/repos/foo
TRACFOO=/home/svnuser/trac-env/foo
 
DATE=$( date +%Y%m%d )
BACKUPDIR=backup-${DATE}
 
mkdir ${PREFIX}/${BACKUPDIR}
 
svnadmin dump ${SVNFOO} | gzip > ${PREFIX}/${BACKUPDIR}/svn-foo.dump.gz
trac-admin ${TRACFOO} hotcopy ${PREFIX}/${BACKUPDIR}/trac-foo

And the crontab line is as follows:

1

30 22 * * * /home/svnuser/develbackup.sh

This is the first article in a serie about CANBus and higher-level protocols, which are extensibily used in Industrial environtmens along with Embedded Systems.

CANBus standard describes only the layer 1 and 2, from an OSI point of view, dealing with physical and datalink activities. On the other hand, CANOpen is a protocol which lies in the OSI layer 7.

There is no need for intermediate layers in these kind of busses since all of them belong to the same network segment; neither the notion of session is available in CAN networks.

CANBus

As can be seen in the image above, CANBus uses two wires for the communication bus and transceiver only need hook these two lines (and the ground). In some representations, as the above, you may see the bus both sides ended, this is usually done by a 120 Ohms resistor which is only mandatory when the bus exceeds a normal length.

For now, the fields, in a CANBus Frame, we are going to care about are identifier, which is 11 bit wide in the base version, and the data field holding as much as 8 bytes in each frame, the rest of the fields deal with synchronization of frames and error checking, you can find them in Wikipedia CAN Entry.

CANOpen

CANOpen is a protocol built on top of CAN, but can run in different link layers, which implements an object centric message system. The main entity in CANOpen is the Object Dictionary, which is a description of all the objects supported by an specific device, it doesn’t matter the format it is delivered in as long as both side of the communication are aware of it. The protocol is profile based defining each of them different objects that must be implemented by the device

Each Object has its own 16bit wide index and another 8bit wide address for referecing subdata fields.  As can be seen in the next table there range of these address which are mapped to specific functions described in different profiles e.g. CiA 301 (communication profile area):

So with this new specification we have 4 bits to specify the function the message is requesting to perform and 7 bits spare for device’s ID which span from 1 to 127, being 0 forbidden.

Function Codes can be either pre-defined by the standard or custom, modified after the devices powers-up.

The tables below shows the configuration for the pre-defined connection set; the first for broadcast messages and the second one for peer-to-peer object messages:

Administrative Messages:

• This messages fall in the category of Master – Slave communication such as those dealing with initialization or  network configuration. As an example NMT is used to initialize, start/stop nodes, etc

Service Data messages (SDO):

• This messages provide access to device’s objects using the Object Dictionary index and subindex and allows data transfer of any length.
• Each message needs to be confirmed and each request / reply transports 8 bytes rendering this kind of service not suitable for RT data transfer.

Process Data Object (PDO):

• Used to transfer RT data from one producer to several consumers and each message is limited up to 8 Bytes.
• Each PDO is described by two objects, one for setting the COB-ID, transmission type, inhibit time and timer period and the other to map list of objects from the Object Dictionary mapped into the PDO.
• The objects mapped to a PDO are configured using SDO messages.
• There are to modes: SYNC (triggered by a SYNC object, ASYNC (triggered by a device event)
• Inhibite time: Minimun time betweet 2 PDOs
• Event Timer: Transmission Trigger

Predefined Messages:

• SYNC: Used to synchronized operations across the network, when device receive a SYNC message the perform the expected action.
• Time – Stamp: Common time frame reference
• Emergency: Triggered by an error in a device
• Node/Life Guarding: Monitor state of Devices, detects network errors, etc
• Boot-up: By sending an NMT message the slave change from state Initialising to Preoperational

After presenting this talk first at RootedCon and a month later at Hackito Ergo Sum the time for releasing the code behind it has arrived.

To understand the source code, you only need to have a look at the deployment diagram where the attacker is drawn in red and the victim in green.They have been designed as two independent components which exchange method invocations using a simple Marshalling/UnMarshalling scheme.

Although the proof is conceptually multiplatform I have only implemented the windows part so the source code is a Microsoft Visual Studio Solution with two projects, Attacker and Victim.

Attacker

• It is a dll implementing the PKCS#11 API ready to be added as a Security Device in Firefox as follows: Tools->Options->Encryption Tab->Security Devices->Load
• Instead of accessing any local device each method marshalls the parameters and sends them to the remote peer then  waiting for the response to arrive.
• A file at C:\pkcs11-ip.cfg must contain the IP address where the library will be sending requests.

Victim

• Binds a socket and waits for PKCS#11 requests to arrive
• After a new request has been read, the official PKCS#11 library is used to perform the selected operation and retrieve its output sending it back to the Attacker.

I have uploaded the source code to github, it is provided with known issues so do not blame for them, this is just a PoC.

Here you can find the presentation in Spanish and here in English, they are pretty much the same.

Any question, bug, improvement, whatever please leave a comment below!

<form id="myform">
  <input />
  <div>
    <input />
  </div>
  <div>
    <input />
  </div>
</form>

After trying different combinations and asking around I found the right expression to traverse all the inputs was the next one:

$("#myform input").each(function() {
  //do whatever you need
});

Straight forward example using httplib and urllib from python. In the example I just perform some kind of login request retrieve the session id and then other request sending XML data using POST.

Code! Feel free to send improvements

import httplib, urllib
import re
 
params = urllib.urlencode({'q': 'login', 'email': 'juasjuas@lol.com', 'pwd': 'lala'})
 
conn = httplib.HTTPConnection("my.lolizator.com:80")
conn.request("GET", "/cmd.php?"+params)
response = conn.getresponse()
print response.status, response.reason
 
#data = response.read()
#print data
 
cookies = response.getheader("set-cookie")
m = re.search('.*PHPSESSID=([a-zA-Z0-9]+);.*', cookies)
session = m.group(1)
print "session %s" % session
XML='<tag1 name="testgroup"><tag2 id="12" type="3"><tag3 id="1">aaa</tag3></tag2></tag1>'
params = urllib.urlencode({'q': 'set'})
headers = { "Cookie": "PHPSESSID=" + session, "Content-type": "text/xml",
            "Content-Length": "%d" % len(XML)}
conn.request("POST", "/cmd.php?"+params, "", headers)
conn.send(XML)
response = conn.getresponse()
print response.status, response.reason
 
print response.read()
conn.close()

To interface with Twitter services I used the Twitter extension located at http://code.google.com/p/python-twitter/, which has a pretty straightforward API.

The script shown below gives you back what average percentage of your last 20 tweets have been wasted.

import  twitter
import  sys
 
if len(sys.argv) != 2:
        print   "Provide a Twitter Username as Argument"
        exit(-1)
 
api = twitter.Api()
st = api.GetUserTimeline(sys.argv[1])
sum = 0.0
for s in st:
        sum += (140.0 - len(s.text.encode("utf-8")))/140.0
 
print "%s internal fragmentation is %.2f%s" % (sys.argv[1], round(sum / len(st) * 100, 2), "%")

And now some results:

$ python twinternal.py GabrielGonzalez
GabrielGonzalez internal fragmentation is 39.89%
$ python twinternal.py 48bits
48bits internal fragmentation is 36.79%
$ python twinternal.py reversemode
reversemode internal fragmentation is 38.72%
$ python twinternal.py aramosf
aramosf internal fragmentation is 32.41%


NSIS comes with a compiler which parses the sentences writting in its own language and produces a pretty decent installer. It also has a look-and-feeling similar to latets Windows versions, so it was the perfect choice!

The scripting language is really simple, we can generate a simple installer with only the next few lines:

OutFile “simpleAdvansenInstaller.exe”

InstallDir $DESKTOP

Section

SetOutPath $INSTDIR

WriteUninstaller $INSTDIR\uninstaller.exe

CreateShortCut “$SMPROGRAMS\simpleAdvansen.lnk” “$INSTDIR\uninstaller.exe”

SectionEnd

Section “Uninstall”

Delete $INSTDIR\uninstaller.exe

Delete $INSTDIR\test.txt

Delete “$SMPROGRAMS\simpleAdvansen.lnk”

SectionEnd

After compiling the script with the tool NSIS package’s comes with, two executables are generated:

simpleAdvansenInstaller.exe

Which will copy the uninstaller.exe to the Installation Dir set up to the Desktop and will add an entry in the Programs Menu for the uninstaller.

uninstaller.exe

Will delete itself and remove the entry in the Programs Menu.

NOTE: NotePad++ highlights the syntax of NSIS as well.

• Two processes I have to communicate with in order to validate data using stdin/stdout
• No source code of this programs
• Windows Platform

Since I am a UNIX guy I haven’t ever done anything advanced in Windows so I didn’t have the time to learn how to achive this in Windows as I would have done in any other Unix. Obviously I downloaded Mingw and I tried to used the proper POSIX functions but it didn’t work.

Now is when Python comes into play. It is an “easy to learn” (at sometime I will be discussing this topic) scripting language with a pretty well support in Windows platform, at some point this support seemed better than perl’s one so I chose Python.

After googling for 2 minutes about basic Python syntax and looking for function descriptions I came up with the solution, which was really straightforward and worked super-duper.

import subprocess

program = subprocess.Popen(['C:\path\to\program.exe, arg1, argn'], shell=False, stdin=subprocess.PIPE, stdout=subprocess.PIPE);

ret = check_ad.communicate(username + ” ” + group[0])

ret = program.communicate(“writing to stdin”);

print ret

Read from stdout

Really easy and simple code that can save someones life when working under pressure and do not have time to read a dozen of C/C++ examples.

In this article I classify the bugs depending where in the life cycle of development they can be produced. This would be helpful to reduce the bugs which can be produced in the softwae development and will help if any bug appears since we know, just with its behaviour, where in the life cycle was produce. Therefore we will be able to react sooner and fix it in less time.

This is the base of comming papers about building secure software systems from a software engineering point of view.

Besied the PDF and HTML versions I always provide this time I have the Google version as well.