Security Ripcord

Okay, I have been out of the blogging game a little too long.  It is time for me to start generating some more content.  So we will begin by doing a weekly wrap-up.  Basically I am going to go over a few of the things that occurred during my week.  I might even just set up a draft and populate as I go the hit submit on Friday afternoon.  As everybody will have started drinking by then my post should be well received.

I’m going to start out a little formless.  Hopefully this will start taking a  little better shape as we move forward.

Leadership

Lead from the front.  Some people might not like it, but the only reason they have time to bitch about it is because they are not doing it themselves.  You only learn from your mistakes.  If you aren’t leading you aren’t making enough mistakes to challenge yourself and provide yourself with enough opportunities to improve.

Training

I finally got around to using Wink the other day.  I developed some training using the same old Power Point slides everybody seems to generate.  You know the type, all words and no joy….er…pictures.  Even when you have a screen shot in PPTs it is just more words.  So, at the request of one of my team, I branched out with some flash video.  Of course Irongeek has been doing this for years and provides a walk through of what and how he does it: How I make Hacking Illustrated Videos.  Luckily I didn’t have to refer to Irongeek’s site as Wink was very easy to use.  I generated a quick training on doing a network capture using tcpdump.  Unfortunately I did it on my work system so I cannot provide it here.  But the point I wanted to make was that it was very easy.  Secondly, after pulling the video off my Linux system and onto my Windows system for emailing to the team, I noticed that I could import the Wink project back into the Windows version and add audio.  Now, I haven’t tried this completely, but it seemed straight forward.  So, hopefully, we will be seeing some of this later.  Next time I’ll generate the video on my own box and I’ll be able to provide it here.  Besides, everybody already knows how to do network capture with tcpdump, right?

Quick Tip

For the training I was just talking about I had to create a 10MB file.  It didn’t require any real data, I just needed some random bits but in a large file for demonstrating the file splitting functionality of tcpdump.  So I tried using “dd” to fill up the 10MB file using the following command.

# dd if=/dev/random 0f=./test_10MB.dat

I was doing this on a Ubuntu Linux box.  Although this seems like it would work, and there are plenty of search results that say to do it using this technique, this does not work on Ubuntu Linux.  All this does is create a 4KB file.  I tried all kinds of different concatenation techniques.  But I couldn’t get a 10MB file.

It turns out that Linux systems do not produce enough entropy to fill a 10MB file quickly.  If the Wikipedia /dev/random entry is to be trusted we see that “When the entropy pool is empty, reads from /dev/random will block until additional environmental noise is gathered. (Source: Linux Programmer’s Manual, section 4)”.

So, left out to dry I queried a friend of mine (Thank you, Schism) and he pointed out that the best way to do this is to use the following command.

# dd if=/dev/urandom 0f=./test_10MB.dat

Which, of course, works like a charm.  He was also quick to point out that this does not provide the “randomness” as is produced by /dev/random, but for my purposes it worked well enough.

Development

I have been working with Python programming a bit over the last few months.  It has been interesting watching the program I have been working transform into something useful.  I wish that I could provide a little more information about it, but it is still an ongoing project, so I’ll refrain.

One thing I can talk about is building function calls in Python.  I am not sure if I am using the right terminology for it, but basically what I mean is creating a list of functions and then calling them based on the results from some other function.  For instance if you can define a table or list of functions like this:

func_table = ( one, two, three )

Then create a function of those names (necessary indent removed by Wordpress, so just pretend)

def one():

print “one”

def two():

print “two”

def three():

print “three”

Finally you can call each function by referencing them via the list.

for i in range (3):

func_table[i]()

When run this will produce

one

two

three

Special note: if you are returning information from these functions then you will need to store them in a variable before using or returning.  At least that is my experience.

Not very exciting until you start thinking about using tests instead of iterating through the loop.  This can be used to clean up complex code very nicely.  My understanding is that this will also help with optimizing the execution of the code as well.  What the magic balance between this method and several “if” statements is, I do not know.

Can anybody describe to me a good method of testing this optimization?  I don’t know enough about programming to come up with a complex enough task to challenge the CPU and memory of my system and produce viable results.  If you have a recommendation leave a comment and I will test and post results.  Or, you can run it yourself and post your results in the comments.  Either way it will be beneficial to us all.

BTW, thank you, Invisigoth.  I learned this from reviewing your code.

Personal Input

Not much today as I need to get down stairs with the boys.

Go forth and do good things,

Don C. Weber

---

Help support my training and travel to security conferences. Get your SANS Training and GIAC Certifications through the Security Ripcord.

---

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.