Rsyslog Configuration

While working on a system that sends events to an ELA (Event Log Analyser) Server, I had to start filtering the events that were sent. I noticed this after sending all events (*.* in rsyslog) to the server and seeing 218,000 hits in 30 seconds. Apparently rsyslog logs everything from kernel events to authentication issues, and network traffic. This filled up the event log incredibly quickly. Just browsing the web for a few moments resulted in thousands of messages being saved in the event log. In addition, ever broadcast and multicast from every machine was logged. For my system and remote monitoring, this was not feasible.

As you can see, there are multiple entries for broadcast MACs. I do not want to log these. So, I set out on what would become a two-hour adventure on rsyslog and conditional filtering.

First, I discovered that Ubuntu uses rsyslog rather than the older syslog. Essentially, what I wanted to do was send all events to an ELA manager except for the broadcast and multicast messages (note: this computer is not for web browsing. If yours is, you will want to filter out web traffic as well or risk seeing millions of messages).

Before sending all of my information to an ELA Server (I remembered what happened last time I did that), I needed a way to see what messages would be sent and filtered. Enter "xconsole." Xconsole allows you to view messages that are being sent to the console. To run it, open up a command prompt and type:

sudo xconsole


This will open the console window. Leave this open while testing.

Ubunut stores its rsyslog settings in two places. The first is rsyslog.conf which is stored in /etc. However, it references/includes a file "50-default.conf" which is stored in /etc/rsyslog.d. To open that file and begin our edits type this in a command prompt (open a new command prompt tab so we don't close the xconsole)

sudo gedit /etc/rsyslog.d/50-default.conf


This will open a text editor. This file originally looks like this:

#Test logging to temp log
#*.*;kern.none    /dev/console
*.*    /dev/console

#LOG to remote host ELA
#*.* @10.10.92.33

#  Default rules for rsyslog.
#
#            For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*            /var/log/auth.log
*.*;auth,authpriv.none        -/var/log/syslog
#cron.*                /var/log/cron.log
#daemon.*            -/var/log/daemon.log
kern.*                -/var/log/kern.log
#lpr.*                -/var/log/lpr.log
mail.*                -/var/log/mail.log
#user.*                -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
#mail.info            -/var/log/mail.info
#mail.warn            -/var/log/mail.warn
mail.err            /var/log/mail.err

#
# Logging for INN news system.
#
news.crit            /var/log/news/news.crit
news.err            /var/log/news/news.err
news.notice            -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
#*.=debug;\
#    auth,authpriv.none;\
#    news.none;mail.none    -/var/log/debug
#*.=info;*.=notice;*.=warn;\
#    auth,authpriv.none;\
#    cron,daemon.none;\
#    mail,news.none        -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#    news.=crit;news.=err;news.=notice;\
#    *.=debug;*.=info;\
#    *.=notice;*.=warn    /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
    news.err;\
    *.=debug;*.=info;\
    *.=notice;*.=warn    |/dev/xconsole

This is the original file. We are going to be adding all of our rules to the top. Here are the edits I made to the file. These edits drop all messages matching a rule before logging them.

#Test logging to console with /dev/console.
#Then open CLI and do sudo xconsole to watch output

#Drop all packets containing information matching below. Then write.
:msg, contains, "DST=10.10.92.255"
& ~
:msg, contains, "DST=255.255.255.255"
& ~
:msg, contains, "DST=224.0.0.251"
& ~
*.*    /dev/console

#LOG to remote host ELA
*.* @10.10.92.3


The line for logging to the ELA can be commented out while you test this. The line with /dev/console will write to the xconsole window. Now we need to save it and restart the service. Save the file in the text editor, exit, and then issue:

sudo service rsyslog restart


That will begin throwing messages to your xconsole. If it works, you can comment out that line and then send the messages just to the ELA.

Here are some links that were used as sources. However, I wrote this post because none of the sources I found addressed multiple rules directly.
http://www.rsyslog.com/doc/rsyslog_conf_filter.html
http://www.rsyslog.com/doc/rsyslog_conf_examples.html
http://www.rsyslog.com/discarding-unwanted-messages/
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog-example.conf

Potential Facebook Security Issue

Facebook introduced its tagging feature (in wall posts) not too long ago. Since then, almost everyone I know on Facebook has learned to tag their friends in both status updates and comments. But one thing that I haven't seen much of, yet something that could be a security concern, is the ability to tag pages in wall posts using the '@' reference. This works well when the page is on Facebook, such as the company's official Facebook page or a product or service. Here is an example of tagging a company's page on Facebook:

When the user presses 'enter,' the tag is converted into a link that takes anyone clicking it to the official Grooveshark Facebook page.

The word "Grooveshark" becomes a link that directs the user clicking it to the Facebook page for Grooveshark. However, not all pages are contained within Facebook. For example, prior to recent changes (Facebook changed the "liked" links into wall post stories rather than a recent activity), a "page" could be created from any page on the web with Facebook's like button installed. Here is an example from Blogspot blog with a random post.

(Keep in mind that this only works with pages that have been "liked" previously and does not work with new posts).

Clicking "Like" under the post causes a post to be made to your Facebook profile wall saying that "user x likes page y." However, in this case, it simply says "User X likes 'did that five year old I just saw have a cell phone?'" The name of the page is a clickable link redirecting to the original blog page (as it should for viral purposes). Now here is where the potential vulnerability comes into play. Since Facebook treats these older "likes" as pages, the user can "tag" the page as well.

This creates a link, which is posted on the user's wall to the original blog post.

So essentially, this creates a problem because we have links that are masked by text (the same way they are around the web). However, this is especially problematic on Facebook because users will almost always click a link posted by their friends without investigating the underlying URL. It is important to remember that the owner of the original blog post still has complete control over that web page. He or she can redirect it, add malicious code, etc., and there is nothing Facebook can do about it.

Now imagine if the above link said "This video is hilarious!" It looks like a trustworthy post from a friend. But in reality, it's a post made by a rogue application that obtained permissions to post to the user's wall. The text "This video is hilarious!" could redirect to any page on the web.

Fortunately, this problem is not a large one. First, it is hindered by the fact that very few users are aware that they can tag pages. Secondly, Facebook has stopped treating new "likes" as pages and instead treats them as links, displaying their full URLs. However, the problem can still exist on older pages, of which there are millions.

To protect against this threat, always be aware of where the link is going. On Facebook (and any other site), hovering over the link reveals the URL at the bottom of the screen.

This isn't a major security issue with Facebook, nor will it probably be corrected. However, it is important to continually monitor Facebook before clicking any links.

Everything is Moving to the Cloud... Even Hacking?

I promise that this won't be a buzzword-laced post about the benefits of cloud computing, the continuous move to store all our information online, or the pros and cons of relying on off-site storage. However, an interesting trend has been cropping up in terms of cloud computing and network security: the use of "the cloud" as a launching point for cyber attacks. One of the most notable incidents (and the one that inspired this post) was that of the cyber attack on Sony's Playstation Network. One of the big differences between that attack and more "conventional" hacks is that the attackers were able to harness the power of cloud computing to launch their attacks rather than relying on local servers or widespread botnets. I believe that this will quickly become a trend, if not the norm, for cyber attacks in the future. The anonymity of a cloud-based launching point, its ease-of-use, availability, power, and low costs combine to make using the cloud to launch a cyber attack not only feasible, but also tempting.

When Sony released information about the attack, one of the more noteworthy facts was that the attacked had been launched from Amazon's EC2 cloud computing infrastructure. Although hackers have previously used rented servers, this attack marks one of the most significant cases of late where a service such as Amazon's has been abused in such a manner. No longer are the masterminds behind cyber attacks required to purchase server space from shady third parties in unknown countries. Instead, they can use a legitimate service, at a fraction of the cost and with more power (Amazon's cloud is notoriously resilient).

In terms of anonymity, using cloud based services doesn't necessarily decrease your chances of detection, but it does add another layer. Now, law enforcement investigators will need to subpoena Amazon, search their records, find connecting computers, and trace from there. It's another step that only adds time and could possibly aid attackers. Renting a server and service from Amazon is as simple as signing up with a fake account and a fake credit card, something to which cyber criminals undoubtedly have easy access. In addition, using an Amazon server to launch an attack is like hiding behind a proxy without the obnoxious bandwidth reduction. Now, attacks can be launched at full speed, without being channeled through proxies. Only the commands sent to the servers need to be sent through proxies to obfuscate the identity of the attacker.

Amazon has an amazing infrastructure and you can be assured that hackers will continue to exploit it mercilessly. A question that needs to be asked, however, is how will Amazon protect against outbound attacks? They have demonstrated (for the most part) that they can secure their infrastructure from attack. But what happens when that infrastructure is doing the attacking itself rather than being attacked? Hopefully Amazon will be able to implement security that can prevent the abuse of its services.

Sony and Anonymous

When discussing online intrusions, hacks, and denial of service incidents, one of the primary questions posed is: "who did this?" Obviously, the company under attack has a direct obligation to its customers to both repair the damage and implement preventative measures. However, an organization today known as "Anonymous" is increasingly challenging the ability to pinpoint a direct source of an attack. Anonymous is neither a collective group nor a dedicated few individuals; it is everywhere, at any time, consisting of whomever so desires to be a part of it. Do I think that Anonymous attacked Sony? No. However, this makes it difficult for Sony because if Anonymous is not a group or a defined set of people, how can it be said that the hacking attempt wasn't Anonymous?

In my opinion, Sony needs to determine who made the attack, and for this reason they have listed Anonymous as the perpetrator. Regardless of its innocence, Anonymous will take the blame because it is not defined, and there is no way to prove it wasn't the group. How can we prove that it wasn't Anonymous if the entire point of the organization is to claim that it is everywhere? If one person "joins" Anonymous, then later, with several other people who have also "joined," commit a service disruption, is that the action of Anonymous or not? How many people does it take to form "Annonymous?" Since there are no statistics on the size of the group, one hundred people could make up 70% of the organization on Monday but only 10% on Tuesday.

As odd as it may sound, I think that most people in the tech community believe Anonymous when they say they aren't seeking credit card numbers. The group as a whole seems to pursue what they feel are moral crusades and stealing customer data doesn't seem to align with the past. However, it is hard to pinpoint a motive for the group, and there certainly be members who elect to pursue more damaging attacks than the rest of the organization. Regardless, Sony will most likely continue to blame the group as a whole. Since Anonymous wants to be anonymous, it can use the shield of anonymity to protect it, but it may also come back to harm them later as well.

RIT48 Challenge

This past weekend (March 25-27) I got a collective six hours of sleep. This comes from the fact that I was participating in a challenge at RIT called the RIT48 Challenge. Essentially, this challenge required participants to design, plan, and launch a web startup company in just 48 hours. Participants are judged on their business models, plans, product designs, etc.

I joined a team at the last minute when their web developer had a family emergency. The team already had their idea in place, we just had to wait until the start of the event to work on it (participants can only work on their ideas during the 48 hours). My team's idea was to create a new content distribution system for small publishers, web artists, videographers, photographers, etc. Essentially, we wanted to create a site that would allow larger companies to get in touch with smaller companies / content producers in regards to licensing their content.

After 48 hours of almost no sleep, our product and business model were in place. Although we didn't win the competition, I really learned a lot during that weekend. I learned a ton about team work, business models, how to launch a startup company, and a lot more. I also met a ton of interesting people in all areas.

RIT48 was an amazing challenge, and I'm already planning on competing next year.

Convert a PHP Array to a JavaScript Array

Many times when working with advanced web applications it may be necessary to convert an array of PHP variables into an array of JavaScript variables. I stumbled upon this issue in some recent web development work and most of the solutions online seemed incredibly complicated for such a simple task.

JavaScript is different than PHP because JavaScript allows manipulation of the page data on the client side (meaning no page refreshes are necessary). PHP works by sending information to a server (server side) to manipulate and return. This means that page refreshes are necessary (typically). So let's say you have an array of strings in PHP; we'll call it "phpArray()". This array may be created in PHP with the following PHP code:

$phpArray = array("Word One", "Word Two", "Word Three", "Word Four");

Now we have a $phpArray variable in PHP that contains the words as strings. To convert this array to a JavaScript array, we are going to first create a string from the PHP array by running through a PHP loop. First, we will declare a string variable in PHP to hold the loop's contents:

$string = ""

Now we're going to loop through the loop and add each element of the array to the string with quotes around it. (Note: this is for an array of strings. An array of ints should be handled as strings in PHP, but passed to JavaScript without the quotes.)


foreach ($phpArray as $a) {
$string .= "\"" . $a . "\", ";
}


This code creates a PHP string that looks like:

$string = "Word One", "Word Two", "Word Three", "Word Four",

Now, we need to do one final thing. This code loops through the array and adds a comma (,) and space( ) to the end of each array element. That means that the resulting code will appear as "Last Word", We don't want this because it will mess up our JavaScript. To cut off this last comma and space, we will do:

$finalstring = substr($string, 0, (strlen($string) - 2));

This code removes the last comma and allows us to place it into our JavaScript. In the JavaScript section of our page, we're now going to add:

<script language="javascript" type="text/javascript">
            var jsString = new Array(<?php echo $finalstring; ?>);
</script>


We now have a JavaScript array called "jsString" which contains all of the elements of the PHP string array. It would be the same as writing:

var jsString = new Array("Word One", "Word Two", "Word Three", "Word Four");

That's all there is to it. If you have any questions, just leave a comment!

Watson and the Future of Humanity

You've probably seen it by now - the videos of the IBM-created supercomputer named "Watson" correctly answering question after question on Jeopardy as its human opponents stood by helplessly. After reading many of the comments on the news articles around the Internet, I have realized that most people truly don't understand the implications of the technology behind Watson. "Computer Overlord," "HAL," and "Rise of the Machines" jokes aside, Watson represents a unique turning point in the history of computing and information searching.

Watson is unique because it can truly learn from reading - just like humans. However, Watson stores its vast amount of information based on patterns. Everything that Watson does boils down to a series of patterns, word associations, and language recognition skills. Watson will never be able to "think" on its own in terms of the human definition of "thinking." However, with every passing day, its ability to compare billions and billions of words, create highly specialized series of rules based on associations, and deliver content that is unique grows.

So what can Watson be used for, besides putting Ken Jennings to shame? Imagine five or six years from now, you're experiencing pain in your stomach. You visit the hospital and you list your symptoms aloud for the doctor. But as you do, a machine is also processing your symptoms, sorting through millions of medical articles, patient databases, your family health history, and more to determine what it thinks you should be diagnosed with. Your doctor could never possibly process that much information. Together, the computer and the doctor correctly diagnose your problem. The point here is that neither the doctor nor the computer are working independently. Humans are amazing at understanding the complexities of speech. A computer could never understand "Well it hurts sometimes, but only when I am thinking about it." However, computers are excellent at processing information. Your doctor could never sort through five million medical articles for the one that relates to you; the doctor could never think of every possible side effect of every combination of medicine. But machines can. So working in tandem, the computer and doctor could achieve much more than either could alone.

Watson represents a giant step forward in the history of computing. It is amazing how machines are slowly being trained to comprehend our search queries in terms of the spoken language rather than a string of text we type into a search engine. Hopefully Watson's technology will help us achieve even more. But always remember: humans created Watson.