Archive for December, 2005

Umbrello

Thursday, December 8th, 2005

I just found a totally awesome UML tool for KDE. It is called Umbrello and it is possibly one of the nicest design tools I have seen on linux. I just started using it, and I found it intuitive, and very easy on the eye. And the fact that it is a KDE app really makes it even cooler. I really like when all my applications seamlessly integrate with the windowing system. I also love to be able to fish or sftp from a file open dialog.

I must admit that it did crash once when I was screwing around with it, but that might have been a one time glitch. Somemetimes KDE is temperamental like that.

I keep hearing good things about the violet plugin for eclipse (which is my IDE of choice). It would be very neat to be able to draw class diagrams right from the IDE, but for the life of me I cannot get that dumb plugin working. Eclipse seems to detect it in the Help=>About->Plugins dialog, but nothing else is happening.

Oh well, Umbrello is going to do it for me for now )

Tags: , , , , , , , , , ,

MSU Security

Thursday, December 8th, 2005

I poped into the CS lab in Richardson today and I was hanging out with our undergrads who were working on their Software Engineering project.

I noticed that all the windows boxen downstairs are running with user privileges (as they should), and access to some system settings is blocked. In particular, the IT squad blocked the access to the Control Panel. This is fine and dandy for a office machine that only has to run Word and Outlook but our lab is supposed to be used by students learning programming. For example some students may want to use Windows ODBC to set up their db connection. Unfortunately the odbc config app is usually accessible from the control panel. Good job IT!

So the poor undergrads were sitting there trying to figure out what to do next. Of course, as I suspected no one bothered to lock access to the system32 folder P As you may know, system32 is the windows equivalent of /bin - which essentially means that all essential system applications should be there. So I zoomed through the files there and located the odbc executable. I was able to open it and use it without any restrictions.

So my question is - why even bother locking the control panel? If any user can dig through the system32 folder and access any functionality offered on the panel, what is the point? Is it even possible to restrict user access to some of these files? And why would you want that anyway? Redmond thinks that even the lowliest user should be able to access the controls contained in the Control Panel, so why does IT thing otherwise?

Tags: , , , , , , , , , , ,

Out of the Crunch Phase

Thursday, December 8th, 2005

I am officially out of the crunch phase of the security project. All that is left now is to finish the writeup, documentation and prepare a presentation. I hope Mike doesn’t drop the ball on the GUI cause my code is not fully functional either. Not sure why, but I don’t think I have time to mess with it right now. Maybe once the paper is done I can fiddle, but not now.

Isn’t it interesting how every project starts with a good, whole hearted attempt to actually follow some software eng. principles, but it immediately turns into shit on wheels whenever some deadline draws near? I just realized that I overloaded the method “readHeader” 4 times in one class for absolutely no reason. These methods are not even remotely related, or even similar. What the hell was I thinking? I hate myself!

If you find yourself writing a comment “ugly hack below” over 5 times in the same class (or even method) it is probably a good indication that this piece of code should be rewritten at some later date P

But screw that. I’m done! Now I just have to finish typing documentation and we are in business. Worst part that I will have to do it in Word/OO.org because we will have to merge the docs at some point. Yuck! I wish I could do this in latex (

Tags: , , , , , , , , , , ,

XFN Icons

Thursday, December 8th, 2005

I have been using XFN for a while now, and I was trying to figure out how to make it more transparent to the average user. So I decided to make some icons that can be appended to links to signify XFN relationships. Here are some of them:

friend
friend met
friend crush
acquaintance
acquaintance met
contact
contact met
sibling
spouse
kin
crush

You can see them scattered all over the webpage on various links. If you like any of them, feel free to use them. All the icons are under Creative Commons Attribute-NonCommercial-ShareAlike 2.5 license.

Tags: , , , , , ,

169.254.101.152

Wednesday, December 7th, 2005

Lately I get strange hits from 169.254.101.152. They are usually TCP packets directed at port 2053, 2088 or something else in the 20xx range. WTF?

That host does not respond to pings. I tried hitting it on various ports in the 2k+ range with netcat, but the machine simply does not seem to exist. It’s either a spoffed IP or a very well cloaked system.

This is what I get from a whois query:


Szaman2@grendel ~
$ whois 169.254.101.152

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

NetRange: 169.254.0.0 - 169.254.255.255
CIDR: 169.254.0.0/16
NetName: LINKLOCAL
NetHandle: NET-169-254-0-0-1
Parent: NET-169-0-0-0-0
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: Please see RFC 3330 for additional
information.
RegDate: 1998-01-27
Updated: 2002-10-14

OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName: Internet Corporation for Assigned
Names and Number
OrgAbusePhone: +1-310-301-5820
OrgAbuseEmail: abuse@iana.org

OrgTechHandle: IANA-IP-ARIN
OrgTechName: Internet Corporation for Assigned
Names and Number
OrgTechPhone: +1-310-301-5820
OrgTechEmail: abuse@iana.org

# ARIN WHOIS database, last updated 2005-12-06 19:10
# Enter ? for additional hints on searching ARIN's
# WHOIS database.

Any clue why I get these hits 2-3 times a day?

Further investigation gave me this:

From RFC 3330 169.254.0.0/16 - This is the “link local” block. It is allocated for
communication between hosts on a single link. Hosts obtain these
addresses by auto-configuration, such as when a DHCP server may not
be found.

So a lost node that can’t obtain IP from a DHCP will get assigned a 169.254.x.x address. Question is, why do I get packets from that address bouncing against my firewall? Misconfigured node on the network maybe? Very strange.

Tags: , , , , , , ,