Belated BT5 LiveDVD Review

When Backtrack5 came out, Blogger was down, which probably aggravated a lot of security blogtards because they wanted to get their two cents out to the masses as soon as possible.

I was one of them, but I didn't really have anything to say except I was glad that BT5 finally included JFS support.

Maybe "glad" is the wrong word. It was more like "no longer pissed off".

I mean—for fuck's sake—why have a shitload of disk forensics software that you can't use? And if it's too bloated to fit on a CD in the first place, what's the harm in bloating it a teensy bit more with a friggin' JFS kernel module? I mean Jeebus, I had to download a goddamned kiddie distro (Linux Mint) to get JFS support.

Suffice to say, I am now a bigger fan of BTx than I was a couple of months ago. And since it does IPv6 so well on my network, I will be using it all day long come World IPv6 Day.

But I still have my issues.

Their motto is "The quieter you become, the more you will be able to hear."

I have a corollary to that: "The more invisible you become, the more you will be able to see."

Hinky's First Rule of Invisibilty: Lose the hacker desktop.

I know it makes you fell like a L337 HAX0R, but anyone with an IQ of over 65 shoulder surfing you knows you're up to no good. And smarter people will start having paranoid delusions. Underneath all that cruft is a plain vanilla Ubuntu desktop. Use it. The best way to do that is after booting the DVD, change root's password, add a non-root account (I use "notroot") to the admin group, do "su notroot", then run startx.

If you're doing wireless, you should be able to fire up Wicd and get connected. I have noticed that in some environments you may have to fire up "dhclient wlan0" in a terminal to get an IPv4 address.

Why not run as root? Aside from the getting the plain desktop by default, you're going to run Chromium, which refuses to run as root. Open a terminal and enter "sudo apt-get install chromium-browser". After it's set up, open Chromium and install a better-looking theme. "Dolce&Gabanna" looks good with the default Ubuntu brownishness, as does "Desktop". Next, install Ad Block Plus for Chrome, because no one likes ads.

Sure, BT5 comes stock with NoScript, but you're booting from a DVD, so who cares if you get hacked? While you have Chromium open, check your IPv6 connectivity just for laffs.

Since your "notroot" account is in the "admin" group, you can sudo anything without entering a password. A lot of the tools from the Backtrack menu will automatically bump you to root, some won't. For the most part, running as "notroot" isn't too restrictive.

At this point I generally install mc (Midnight Commander) and my favorite non-vi editor jed, mostly because I've been running both for the last fifteen years and I can't live without them.

And of course, I need obfuscated-openssh if I want to "phone home" over ssh. You have to build it (BT5 already has build-essential, but it needs libssl-dev to compile). Get a USB drive and build it there and you'll have it next time you need it. If you're going to be hopping between 32 and 64bit versions of BT5, build the 32bit version since it works fine on both platforms.

If you're into wireless hacking, get yourself an Alfa 1 USB card (based on the RaLink RTL8187) and check out Vivek Ramachandran's megaprimer on SecurityTube. Lots of excellent information on wireless hacking with BT5 for newb and expert alike.

As a LiveDVD, I highly recommend BT5, but I doubt if I would ever install it as a desktop or notebook OS. It is an excellent tool that I would have used—instead of Linux Mint—to rescue my JFS drives back in March.

Screwing The Pooch, Linux-Style

My dear wife, Pinky Dink, has been running Ubuntu 6.04 LTS (LTS="Long Term Support") for close to three years now. She has been quite pleased with it but I've been bugging her about upgrading to 8.04 LTS for months.

But she's seen how my "upgrades" go (the long saga of EXP IV being the most recent) and wanted nothing to do with it. So we compromised for a while. 6.04 came stock with FireFox 1.x, which is dreadfully out of date. I found a hack on the Web and upgraded here to 2.x, which is only woefully out of date. The problem there is the upgrade was out-of-band, so she stopped getting updates to FireFox or important plug-ins like Flash (which is full of vulnerabilities and has been hacked to death lately).

Not a good situation.

So I finally talked her into it and she let me do it.

I anticipated the SCSI issue. Maybe you haven't noticed, but IDE hard drives are obsolete. SATA is now king and to simplify things, Linux now treats all drives as SCSI drives. If you upgrade to a new kernel and your root drive is on /dev/hda1 (the old IDE drive designation), the kernel will choke on boot because it thinks it should be /dev/sda1 (SCSI). The way around that is to either use LVM (Logical Volume Manager - which I despise) or to label your drives before you upgrade, which is exactly what I did, having learned that the hard way over several VM Linux upgrades and the EXP III/IV debacle. Use e2label for ext2/3/4 drives and mkswap /dev/whatever -L yourlabel for the swap partition. Then edit /etc/fstab with LABEL=yourlabel where /dev/hdax used to be. Reboot to make sure it works. If it doesn't... call me. Leave a message.

I knew there were going to be other issues. VNC4 is a wash, as I mentioned before. I was prepared for that. The alternative has always been Cygwin/X, which is slower and suffers from a lack of a dependable clipboard, among other things.

What I didn't expect was problems with her wireless drivers. When I first set that box up back in '06, the RaLink drivers had to be built from alpha or beta source and had to be rebuilt every time there was a kernel upgrade.

But over the years, the RaLink drivers were mainlined into the Linux kernel and that problem disappeared.

Turns out, it's back. With a vengeance. And it's apparently due to some "philosophical" differences the developers at Ubuntu have with the driver. For details, see this exasperated posting from some poor schmuck who can't get Ubuntu to admit they have a problem. I followed his lead, downloaded the source code, and blacklisted the stock Ubuntu drivers. Wireless is fine again, but I will be fucked on the next kernel upgrade.

One problem down.

The next was the remoting issue. Pinky's box is in the kitchen, but I always used VNC4 to hook up to it and do patching and housekeeping (which is a really bad idea - if your session gets trashed during an upgrade you can leave the box in an "undefined" state - but I'm prepared to take that risk because I'm too lazy to get up out of my chair).

As I said, I expected to fall back on Cygwin/X. Silly me.

Cygwin, for those who may not know, is a set of Linux utilities that run on top of Windows. Cygwin/X is an X server that allows you to run graphical programs or full graphical desktop sessions on another Unix box across the network while you're logged in to Windows.

This is very nice, considering it's free when most third party X servers (such as Hummingbird Exceed) cost hundreds of dollars.

The problem is, with all due respect to the Cygwin developers, they keep fucking the god damned thing up.

Upgrading Cygwin is a crap shoot. Something is always guaranteed to be broken.

So when I tried to connect to Pinkie's box and the X screen kept bouncing, blinking on and off, I knew I was in for more fun. I crossed my fingers, girded my loins, and upgraded Cygwin.

It worked. Or perhaps I should say I simply haven't found what's broken in it yet.

Now I have the box where I want it to be (almost). In fact I'm posting from it now, wirelessly and over a network Cygwin/X session! I'm 90% pleased with the way things turned out and this is still the best Linux box I ever built.

EXPERIMENTAL I & II

It's been a long time since my last post.

January, huh? Wow.

A lot has happened. Sometime in late January I put up EXPERIMENTAL I on an Ubuntu 6.04 VM I had on my desktop system. It ran surprisingly well. I had a couple of goals in mind:

• Re-write Robo-Hinky to use a common code base across all running games

• Implement a snort-based anti-cheat of my own design

• Make a wireless UT server that I could toss into the garage, basement, attic, whatever, if and when I wanted.
  

This worked so well on the VM that I bought an ancient (circa 1998) IBM NetVista at a computer junk store (for about fifty bucks), installed Slackware 11.0 on it and moved EXPERIMENTAL I to its new home.

There were a few bumps in the Robo-Hinky transition but it went well, so I bought a Hiro H50069 802.11g Wireless Adapter from TigerDirect for the wireless part of the project.

After that, everything started to go to Hell.

I never really had any complaints about TigerDirect until I bought that card. Real tech specs are hard to come by, and many manufacturers will ship a variety of hardware products under a single model number. You never know what's under the hood until you rip it off and look.

BUT, at the time (they're out of stock now) TigerDirect had a "photo gallery" on this... thing... and the photographs clearly showed it was based on a RaLink chipset, which is A Good Thing™ for Linux tards such as myself. Native RaLink drivers exist, work well, and are under active development. I was looking for a RaLink card. And I thought I had found one. After all, there was a picture! And it showed the right chip!

caveat emptor

What I got was a card, same make and model number as the one advertised, but with a Marvell Libertas 88w8335 chipset.

WTF? Those bastards!

Don't get me wrong. It turns out Marvell makes marvelous (heh) wireless chips. Absolutely the lowest power consumption on the planet. In fact, a Marvell chipset has been chosen for use in the One Laptop Per Child (OLPC) project.

But there weren't any Linux drivers (not exactly true, but the drivers were only available to the OLPC development team - something to do with the proprietary ARM OS burned onto the chips).

So after a lot of bad feeling, negative reviews, support calls, RMAs, etc., etc., I said my final farewells to TigerDirect (sorry, fellas but someone else is getting my money from here on out) and bit the bullet.

I decided to keep the card because I couldn't find a RaLink card. I chalked the TigerDirect fiasco up to experience.

I used the NDISwrapper driver, which is a Linux user's driver of last resort. Through a bit of serious programming wizardry NDISwrapper allows you to use any network card you can find an... ugh... Windows driver for.

And it "sort of" worked for about six weeks. But I got tired of the hanging and the core dumps so I put it back on the wired network.

And the problems didn't go away.

As it turns out, Slackware 11.0 itself is a pile of crap. And I hate to say that because:

• Slackware was my first experience with Linux (way back in 1994)
  

• Slackware is blessed by (PRAISE HIS SWEET NAME!) Bob

In time it was also evident that using a wireless router as an access point is not a good idea. It "appears to work, but is not a good solution" (as they used to say in the Microsoft certification tests). My wireless router, a NetGear WGR614 sucked ass as an access point. It probably sucks as a router as well, but I use Linux and iptables for that anyway. It has since been retired (that is, trashed) in favor of a real access point, in my case a TrendNet TEW 430-APB.

In the middle of this entire driver/access point/OS fiasco I made a fatal error with fdisk (long story) and wiped out the BOT House server in the process. Since I had backups I put the whole shebang on the NetVista until I could rebuild the BOT House server. Performance was painful.

I thought I was going to rebuild with Ubuntu because it is a very, very slick Linux distro, but I have some serious problems with their basic philosophy (otherwise, if you can buy that drivel, I highly recommend it... not the drivel, the OS... Mrs.HinkyDink runs Ubuntu 6.04 and loves it). But Debian 4.0r0 came out in April, so I figured I'd give it a shot (BOT House was on an aging Debian Sarge distro before I trashed it).

And, as luck would have it, I found a GigaBit RaLink-based wireless NIC (VERIFIED!) at NewEgg.

Once BOT House was back on Debian I threw EXPERIMENTAL I on it as well, gutted the NetVista, wiped it, and replaced Slackware with Debian 4.0r0. The RaLink driver worked as expected (I never had any doubts about that) and the TrendNet access point proved to be rock solid (oddly, it too is powered by a Marvell Libertas chipset on an embedded Linux OS - go figure). I retired EXPERIMENTAL I and put EXPERIMENTAL II on the NetVista. I moved the NetVista to its new resting place where it is now doing double duty as a wireless print server. And a damned good wireless print server as well!

Everything works great now. It took six months and a lot of pain, but it works great. But what the Hell, I have too much free time as it is.