Windows just likes to mess with me

I don't use Windows very much, but when I do my trusty Windows 2000 SP4 VM comes in handy (I guess now that Vista is out I should upgrade to XP). This morning I installed a big chunk of Windows updates that needed dealing with and Windows said:



Just why is the Restart Now button greyed? :-)

Facebook meets the Birthday Paradox

Logging in to Facebook this morning there was a great demonstration of the Birthday Paradox (which isn't actually a paradox, it's just that people get surprised by it).

I have 95 'friends' on Facebook, and this Thursday three of them have a birthday. Wow! Or not, wow, in fact since the calculation in the birthday paradox shows us that this is very likely to happen.



Once you reach 57 friends there's a 99% likelihood that two share he same birthday, with 95 friends your getting very close to 100%. So the fact that three people have the same birthday is not at all unlikely. In fact the birthday paradox can be generalized to cover more than two birthday's being the same. My three birthday example with 95 friends would happen with probability well over 50% (which happens with 88 friends).

Steve Gibson's PPP... new version 3 in Java and C

If you've been following along you'll know that I've implemented Steve Gibson's PPP system in Java and C. The Java code is in the form of a CLDC/MIDP project for cell phones and the C code is a command-line tool.

Steve's made a major change to the algorithm which he's calling PPPv3. My updated code is here:

The C source code is available in ppp3-c.zip.

The Java source code is available in ppp3-java.zip.

The compiled Java is available in ppp3.jar.

Read my original blog posts for details.

Cryptographically and Constantly Changing Port Opening (or C3PO)

In another forum I was just talking about a little technique that I came up with for securing a server that I want on the Internet, but to be hard for hackers to get into. I've done all the right things with firewalling and shutting down services so that only SSH is available. But that still leaves port 22 sitting there open for someone to bang on.

So what I wanted was something like port knocking (for an introduction to that you can read my DDJ article Practical Secure Port Knocking). To avoid doing the classic port knocking where you have to knock the right way to open port 22 I came up with a different scheme which I call Cryptographically and Constantly Changing Port Opening or C3PO.

The server and any SSH client who wish to connect to it share a common secret. In my case that's just a long passphrase that we both know. Both bits of software hash this secret with the current UTC time in minutes (using SHA256) to get 256 bits of random data. This data changes every minute.

The 256 bits gives me 16 words of random data. Those 16 words can be interpreted as 16 different port numbers. Once a minute the server reconfigures iptables to open those 16 ports forwarding one of them (which corresponds to word[0] in the hash) to SSH and the other 15 to a blacklist service.

At any one time 16 ports are open (i.e. respond to a SYN) with only one being SSH and the other 15 being a trap to be sprung by an attacker. The 16 ports change once a minute.

Since both sides can compute the hash the client is able to compute where the SSH server is residing at that moment and contact it. Once contact is established the connection remains open for the duration of the session. New sessions, of course, will need to recompute the hash once a minute.

The blacklist service serves to tarpit an attacker. Any connection attempt to one of the other 15 sockets causes the IP address of the attacker to be blacklisted (again an iptables change) which means that hitting any of the 15 ports causes the attacker to shut off their access to the SSH server for the next 15 minutes.

A casual NMAP of my machine gets your IP address blacklisted and shows up a random selection of open ports. A real user connects to the SSH server first time because they know where it resides.

Of course, this doesn't replace making sure that the SSH server is up to date, and that passwords are generated carefully, but it seriously frustrates a potential attacker.

If this is of interest to others I'd be happy to release my code (which is currently in Perl) as a GPL2 project.

The effect of trying to save electricity

Over the last couple of years I've tried to cut down electricity use in two simple ways:

1. Gradually replace incandescent light bulbs with low power fluorescents. I only do this when an incandescent bulb dies, currently I'd estimate that half the bulbs in the house are converted.

2. Switching off appliances that are not in use. This has been achieved by grouping appliances on power strips with physical on/off switches. When not in use I can kill off the TV and related appliances, the Internet and all networking, computers and peripherals.

I've not got a couple of years of data from electricity bills. For the first 10 months of 2006 I used 2,821 kWh of electricity, for the same period on 2007 (during which I've implemented 1 and 2 above) I've used 2,345. That's 83% of the amount used in 2006. And that's despite an increase in electricity use during the winter of 2007.

Here's a chart which shows the trend.

PPPv2 in Java and C

Recently, I released C and Java versions of Steve Gibson's PPP system for password generation. Steve updated the algorithm to PPPv2 which uses a different hash (SHA256 instead of SHA384) and a slightly different plain text generation algorithm (see the PPP pages for details).

I've now updated my code to PPPv2 and am releasing it here.

The C source code is available in ppp-c.zip.

The Java source code is available in ppp-java.zip.

The compiled Java is available in ppp.jar.

Read my original blog posts for details. All source code is released under the BSD License.