« first day (2965 days earlier)      last day (2000 days later) » 

3:29 AM
exec is used to replace commands with current process.. What does exec do within a shell script?
exec >> ./file.out
exec 2>&1
 
4:11 AM
5
Q: +8 -5 answer: how to improve?

FabbyI've posted an answer that gave me a +8/-5 score and the only hint I have is sebasth's comment that SpinRite is snake oil. I own SpinRite and I've seen it recover bad sectors, but I'm willing to improve the answer and am looking for guidance on what to do: Delete the answer Take out section 2....

People actually think SpinRite is not snakeoil? O_o
 
0
Q: Find what program accessed a kernel module

David KamerOkay, How do I access a list of users/programs that accessed a certain module. Let me explain exactly what I'm looking for. I run: lsmod | grep ^uvcvideo This returns this line when no application is using my video camera: uvcvideo 86016 0 Well, I have something running that...

any ideas?
 
Folks, would this be on-topic for Unix.SE? Our EE.SE folks are suggesting to migrate it.
0
Q: Intercept the "take photo" signal of a usb camera

qedI use this usb camera on a Linux machine and when I plug it in, I can see this message from dmesg: [39415.454259] usb 3-1.2: new high-speed USB device number 3 using xhci_hcd [39415.654802] usb 3-1.2: New USB device found, idVendor=1908, idProduct=2311, bcdDevice= 1.00 [39415.654809] usb 3-1.2: ...

 
@forest I feel like I'm always running into you lol
 
@DavidKamer Regarding your question, I don't think there's a way to tell what program triggered the module load after it has already been loaded.
 
@NickAlexeev so similar/tangential to my question... weird..
@forest so there is no log for kernel module loading?
 
4:14 AM
@DavidKamer Kernel modules are autoloaded when certain features are accessed. So for example, an access to a video character device might autoload a video-related driver module. Using netlink to do encryption might load a Crypto API module. There's no one interface that triggers loading of modules.
 
@forest So would I need to catch it upstream?
so basically would I need to figure out which interface is accessing it and then back from there?
 
There might be a way to detect it while it happens. I'm sure there's a profiling tool which is capable of doing that. I'm looking it up now.
 
thanks for helping
 
Example:
7
A: which process is using nvidia module?

LekensteynI've noticed that Flash sometimes turns the card automatically on and then loads the driver. If the module is not used you can safely unload it after which you manually disable the card: sudo rmmod nvidia sudo tee /proc/acpi/bbswitch <<<OFF If the driver cannot be unloaded, it will display: E...

So in some cases you can tell by seeing what process is accessing e.g. a character device, but naturally that only works for modules that autoload based on that.
@DavidKamer If it's uvcvideo, chances are that lsof on stuff in /dev will help.
 
that's what I'm doing for audio
I'll add add a watcher that logs that.
 
4:19 AM
You could check out the module source code.
 
@forest that might be too in depth for right now, but I'll do it eventually
 
SystemTap then?
 
I've never used it before, but seems like a good idea
 
It's good for kernel hacking without needing to read all of the code, just a little bit.
Also kprobes (injecting tiny bits of code into the kernel).
 
sounds dangerous to put on a system though. I might put them in a vm and get hashes of them to check for them on my system lol.
 
4:23 AM
It's something you wouldn't want to do on a production system.
Do you have the ability to patch the kernel?
Because implementing a log that prints exactly what processes are using a given module shouldn't be particularly difficult. After all, the kernel knows how many processes are using a given module, it just doesn't show them.
 
I'm a freelancer lol, I own all of my equipment. I can do whatever I want to my stuff, but I'll probably try it on a junk computer I never use or a pi after testing in a VM. I'm sure if it is malicious and not just a hickup from the kernel then if I make a honeypot it'll happen again and I can see exactly how it's done. I don't know of any imaging software for linux but I'm sure it's out there.
 
Imaging meaning drive imaging or?
BTW for auditing purposes, you might like auditd. :P
 
@forest I want to make an image of my current install, put it onto a VM, spoof my mac and remove all valuable information
 
dd can do that. Or dcfldd for forensic purposes (saving hashes etc).
 
I used dd unsuccessfully with a raspberry pi once.
 
4:29 AM
But honestly I'd make a new honeypot system from scratch. It's probably a lot harder than you think to remove all personal information... E.g. inode backups in the journal which contain bits of small files when inline_inode is enabled...
 
@forest well, it would have to be a vulnerability on my current system, probably in an installed package imo
 
What distro is it?
Because you can usually copy package manager configuration.
And then install everything the exact same way it was on another system.
 
ubuntu studio lol so ubuntu
 
You can create a list of packages with dpkg in a format suitable for installation on another system. Another dpkg command will read the list and install it.
You can also back up all registered configuration files and the like.
 
that's really usefully for more than just this...
 
4:32 AM
It'd be far better to do that than to copy the entire image (which very well might not work anyway if you are loading system-specific drivers or have system-specific configurations, e.g. fstab). The entire image will contain a lot of hidden information in unallocated filesystem space, including deleted files.
 
do you have a link to a question or tutorial that shows me how to use dpkg to make a list of packages?
I'm also worried it may be a compromised binary
so will it copy the applications or just a list of them for install?
 
Well you can rule out a compromised binary by making dpkg do an integrity check.
Every package it installs comes with a cryptographic hash of the package. You can ask dpkg to verify that the cryptographic hash matches the actual hash.
That way you can be absolutely sure that, as long as the singing keys from upstream Debian are not compromised, the binaries you have are not compromised.
Of course you should always do that from a known-secure system viewing your potentially compromised filesystem via a chroot... Otherwise a malicious binary/library could just fool dpkg into lying.
 
what's the best command for that?
 
I forget how Debian does it, I use Gentoo now. Lemme look it up...
 
I found dpkg -V
but it's spitting out gibberish...
 
4:37 AM
Ah you're right, -V is it.
Make sure you read the man page for it, since it has some caveats (like you also need to check -C to make sure the hashes actually exist). And naturally you'll need to use a safe version of dpkg, not just chroot in to the filesystem and use its own copy.
There's probably a way to tell dpkg to look for packages in a specific directory.
@DavidKamer Why do you suspect a binary has been tampered with?
 
@forest because I think I know who did it lol, and I think I know what tactics they usually use after years of watching it happen lol. It was probably through nvidia drivers tbh
it could be something else though, but it will be a proprietary file from an American company
 
What indicators of compromise (infection symptoms) are you seeing?
 
probably compiled on a windows machine lol
@forest UI slows first, that's always the same symptom and then network activity is always the same and it's always through a device from a company like Dish or Amazon (or even a cable provider) The device sends out old packet types like STP in weird patterns. Within the next few hours or so the UI slows a little
 
Honestly none of that seems like an IoC. A slow system is natural. And anomalies through the network are common. You should try using something like netstat to see exactly what is sending the traffic. Chances are, it's something completely benign.
 
I just now (more or less) proved it's what I thought it was and that the camera is being accessed (or a hardware device like a hard drive) which will light up randomly as accessed when these symptoms are present
 
4:45 AM
hm
 
@forest system doesn't matter lol
 
Professional advice: Shut the system down and do a complete backup (imaging the drive with dd) for later analysis. Re-install the operating system.
Memory dump is unlikely to be important if any compromise is so obvious that it actually causes slowdowns and such.
Anyway if it's a malicious kernel driver, you won't be able to see what is happening via lsmod or anything like that, since a kernel driver can easily hide itself.
 
@forest The thing is it's probably a kernel level vulnerability exploited over the network... Because this can happen on freshly installed systems. I just want to rule that out once and for all. I'll probably do that though.
@forest huh, are you sure?
Let me rephrase
 
I really really doubt it's a kernel vuln exploited over the network. Those are rare.
 
If a device is accessed, doesn't it need to use the kernel module no matter what?
 
4:49 AM
No. Not if the kernel is compromised.
The kernel module only exports an easy-to-use interface to userspace.
 
@forest so something couldn't load a kernel module into a remote system using a custom protocol disguised as something else?
 
Well it would be theoretically possible, but it would require an extremely valuable 0day. Valuable like, I'd expect it to sell for $100k or more. Maybe even $500k if it's reliable.
 
@forest yeah... how would one sell that? Also would it be legal to sell it if it came from some group that was legally allowed to use it (theoretically)
 
It's legal in some countries. And you'd have to find an exploit broker. Some resell to individuals (that's what I do), some resell to governments or government contractors like Exodus or Raytheon SI (those ones are evil and I will have no part with them).
But if you do end up finding such a valuable 0day, I can buy it off you for a fair price. :P
 
@forest I think if it is that I'll just use it to remotely root an iphone, sell it to Apple for a million dollars and then disclose it for everyone's sake. It's definitely not legal to sell exploits the way you're referring to in the US
 
4:54 AM
Sure it is. That's how Immunity Inc sells CANVAS.
 
well it's only legal if you're friends with a federal judge. We live in a totalitarian state controlled by federal judges and appointed officials who have impunity to harass, detain, spy on or imprison anyone they can't profit off of
or they don't like lol
 
Well the problem is that they won't persecute you if you sell to a government contractor. It's a little more risky to sell to individuals, even if strictly legal in most senses. That doesn't stop it from being a profitable market.
 
so they probably provide some kind of intel or something to someone like that really creepy transunion company to get left alone
 
Exodus, Talos, Leidos, Raytheon SI, In-Q-tel, Vencore, Zerodium...
There are a lot, usually US companies.
They all buy exploits. And sometimes missiles.
@DavidKamer If you were compromised, it's most likely either due to a mistake on your part (social engineering or an insecure configuration), physical access, or an old vulnerability if you haven't updated for a while. It's very unlikely to be a 0day.
 
@forest Yeah I don't want to sell to the government if at all possible atm. I feel confident that there is some corruption in this country that disqualifies it as a true democracy/republic (not because of elections but because they don't mean anything technically) so I feel it is unethical to sell to the government until it fixes it's issues with power in the hands of unelected persons.
 
4:59 AM
@DavidKamer Do you have access to a 0day right now?
 
@forest you're probably right
@forest no
but if I did I wouldn't say I did because I know what heat that would bring lol
 
And I agree. It is unethical to sell to the government or government contractors.
Heh. Well if you ever do get one and want it sold to a private buyer, contact me. ;)
 
honestly if they fix the fact that federal judges can do anything with impunity it would fix the system...
 
Well they discriminate against security researchers.
 
@forest I'll keep that in mind lol. I'd probably ask a lawyer first to make sure neither of us get in any trouble.
@forest think about it for a second... Whether or not you agree with the President on anything (or any president that could be elected or will be) do you really want the same class of people issuing FISA warrants telling the president what he can or can't do?
I mean if the president does something it's very public and he will be accountable
 
5:02 AM
I don't like politicians or lawyers, much less judges...
 
but a judge can do it with impunity
 
I don't like bureaucrats, period. Those with power I like even less.
 
dude judges control the whole country
it's really bad
 
Corporations do, because they have judges in the back of their pocket.
 
if you even say anything about it they might try to lock you up
 
5:03 AM
And not just stuff like Coke, but companies we've never heard of (not because they're staying hidden, but because they don't sell to end consumers, big banks like World Bank and BIS, huge unions, etc).
 
well try saying "I think that judge (insert name) should be out of office" you might get locked up like a guy did in 2007
no politician or agent has that entitlement
@forest oh yeah definitely, but they are still under the judges as far as pure uninhibited and corruptable power
the root of the problem would be that they can pay off one guy and control the whole country
 
True. Many countries have very corrupt legal systems...
There's a reason I hate law enforcement with a passion.
 
Ours was pretty good until 1982 when they added the federal circuit courts... gave them the same power as the supreme court lol
 
Even the Los Zetas aren't collectively as bad as the prison-industrial complex.
 
that's when America turned into a land of warlords lol
 
5:05 AM
No, it happened during the cold war.
 
yeah 1982
that's when it was founded
they gave them power to do whatever
 
It was '47 when the CIA was founded and when the power of the government spiked.
 
hopefully one of the thousands of judges never has a stroke when interpreting the constitution or something stupid would become law of the land lol
 
The things that you mention, along with stuff like post-9/11 laws are just the newest and most visible symptoms of a massive problem.
You know in the USA, slavery is officially legal, as long as the slaves are prisoners?
 
@forest oh the 9/11 stuff was probably forced by the group of judges with help of the ACLU imo
 
5:07 AM
You can make something illegal and then take anyone breaking the law as a slave, and profit off of it in for-profit prisons (yes, they exist).
Nah, the ACLU fights against that shit.
They aren't nearly as big and powerful as they seem.
 
I think the judges use the ACLU to communicate and as a cover
think about it
they get the ACLU to bring it into court so they can
make their opinions law
all the while pretending the ACLU is against "the system"
 
But the ACLU are the ones who fight against it. Anything they bring into court is much less likely to result in a verdict that the feds want.
 
but really they have the choice no matter what
 
It's easier for them to just make a case out of some random guy.
E.g. in re boucher.
They took some random criminal and used it to make their opinions, that passwords should be easier to force people into disclosing, into law.
And in such cases, they don't even want the ACLU to get involved. They want some crappy court-appointed lawyer to help bring it all the way up.
 
@forest yeah but when it's convenient to do something against the "feds" (the elected ones) they go with it
so basically they use the ACLU to override anyone we elect
and those that get elected know it
 
5:10 AM
I strongly doubt the ACLU is being "used" by anyone.
They win many of the fights they start.
 
maybe not
yeah, but none of it is actually good imo.......
 
I mean why would they need to use them? Why couldn't they just make a big deal about a small-time criminal to set dangerous precedent? That's what they do.
That's why I consider anyone in the intelligence community or criminal law enforcement to be less than human.
 
Here's what I'm seeing:
The ACLU drums up a controversy out of nothing. Next they take it to a federal judge. Now that federal judge runs the entire country by subjectively interpreting the constitution
so basically they only serve to hand complete power to federal judges over things that wouldn't otherwise be decided on except through plain interpretation of law by normal courts
 
But most of what they do reduces the power the government has over people.
That'd make sense if it weren't for that fact.
Because they don't need the ACLU to drum up a controversy about nothing.
 
but going against our elected officials is against the people
 
5:14 AM
They consider civil liberties to be more important than letting bad laws stand.
 
"personal liberty" isn't something that matters if the people can't vote for what they beleive it is
 
Anyway, I gotta go get some stuff now.
 
@forest who should decide that? I should with my vote like you and everyone else, not some federal judge
ok, peace out. Another good convo lol. THanks for all the help again
 
The USA is a corporate oligarchy. Your vote doesn't matter. Douche vs Turd, etc.
Anyway, ttyl. o/
 
adios
 
6:10 AM
@forest just so you know I may have had a false positive. The gmail app triggers the module even if you have camera completely disabled in browser (it's the chat box). creepy...
 
7:00 AM
@DavidKamer You can easily check exactly what does that.
Strace might help a bit to see if syscalls do anything interesting.
 
 
5 hours later…
11:55 AM
@Fabby OpenVAS version from testing working now, but it was a PITA....Going to do some more testing, however OpenVAS in Stretch is buggy behind use, that I am sure.
 
 
1 hour later…
12:57 PM
Hi guys
I've been going through my answers on all sites and I found this one with -2 and 1 delete vote. Is it possible to salvage the answer or should I delete it?
 
1:50 PM
I agree with the comment from the review queue; that's a "try this and see" Answer, which isn't definitive.
@JakeSymons sorry, should linked my reply like this. See above ^^
Independently, I just cast a vote-to-close on the Question, as it appears to be non-reproducible.
 
 
3 hours later…
4:45 PM
@JeffSchaller Thanks for that, I won't try and fix the answer then :)
And that's just given me +4 rep, nice
 
5:02 PM
Hi @PrabhjotSingh
 
5:32 PM
How are you doing @FaheemMitha
 
6:02 PM
Hello @FaheemMitha How are you ?
printf("Aloha @Jesse_b ");
 
@PrabhjotSingh :) How are you Prabhjot
 
@Jesse_b I am well. What about you ?
 
@PrabhjotSingh Pretty good, just trying to make it through another day of work lol
 
@Jesse_b You are busy these days ? Don't come here.
 
@PrabhjotSingh No I wish I was more busy. I mean I could probably find something to do but I feel like people don't like when I take initiative at work and do things not technically in my job scope so I have been trying to stay in my lane
 
6:17 PM
@Jesse_b in US these things happen. Quite common here
 
I suppose I could clean the bathroom but I think I'm the only person in this office that does it so I might just leave it dirty
 
6:34 PM
But in this way they are successful, you are becoming what you are not
 
What do you mean?
 
6:48 PM
If you leave things dirty, you are behaving what they want you to do. So they are successful.
 
I hope it's nobody intent for things to be dirty, I think they are just lazy.
 
7:03 PM
@RuiFRibeiro :-( Wow, and you took the latest source and compiled...
(IIRC)
 
@Jesse_b Voted to delete
 
now if only he commented on another post and included a link of the answer
 
@Jesse_b, @PrabhjotSingh Still not good. I had a really horrible day. The good part is that it's over.
Being scared is really tiring.
 
@FaheemMitha why horrible ?
 
7:14 PM
@PrabhjotSingh Lots of fear and stress.
I think of myself as quite tough. Possibly not tough enough.
 
@FaheemMitha what happened ?
 
@FaheemMitha courage is not a lack of fear, but a presence of fear and the fortitude to persist.
2
 
Whenever situation demads people become tough.
 
@PrabhjotSingh Just my mother is very sick. I mentioned that earlier. The doctor wants to put in a tracheostomy, which sounds really scary. So I was struggling with that decision. I was also trying to decide whether to move my mother to another doctor's care or another hospital. Which doesn't seem like a good option. I mean, I could do it, of course, but it would likely make things worse.
I spoke to one big shot doctor today, who was totally helpful. He said left to him he would not do a tracheostomy and let my mother pass away peacefully.
 
@Jesse_b If people are lazy then why they get irritated when you take some initiative ?
 
7:19 PM
Also, unfortunately my mother doesn't get to decide whether to have a hole in her throat. And I can't think of anything I want to do less than make such a decision for anyone, let alone my mother.
 
@FaheemMitha tracheostomy can worry anyone.
 
@PrabhjotSingh I hope you are doing well.
 
@Jesse_b Starred! (Did you ever do any military service?)
 
@FaheemMitha I am well. I
 
@FaheemMitha If you can afford it, it probably wouldn't hurt to get a second opinion
 
7:23 PM
@Jesse_b I did. See above. The big shot doctor said doing a tracheostomy wouldn't make things any worse.
 
@PrabhjotSingh because it clearly shows their laziness
BRB
 
Of course, he hadn't actually seen my mother. But as I mentioned here earlier, the doctor who is taking care of my mother said she would quit if I got an "official" second opinion, which is quite disturbing.
 
@Fabby but if we give in, we will become complicit in their laziness.
 
But I've now talked to two other chest physicians, and they were both totally uninterested in helping me.
 
@Fabby I did
 
7:27 PM
@Jesse_b starred
 
@FaheemMitha I'm sorry. That sounds overly frustrating
 
@Jesse_b This is all very very normal for India. It might be relatively normal in the US too. But I suspect a US doctor who said - you can't get a second opinion or I'll quit could easily find himself/herself in interesting legal waters. Hot waters, that is.
 
@FaheemMitha Yeah, I also imagine most doctors here would take on any new patient simply to get paid for them
 
@Jesse_b Hmm. Well, ok, but that's a separate issue.
 
I think only surgeons ever really deny patients because they need to maintain a reputation of "successful" surgeries
 
7:32 PM
@FaheemMitha overall situation got better ?
 
@PrabhjotSingh Pardon?
 
@PrabhjotSingh I never said you had to give in! ;-)
Keep showing their lazyness!
@Jesse_b :-) it shows.. ;-)
What was your rank?
 
@Fabby Corporal
I was in only 4 years
 
@FaheemMitha I mean symptoms got better now ?
 
@Jesse_b Me only 1: Back when there was still conscription.
 
7:36 PM
I remember you were in Belgian military.
 
@PrabhjotSingh Yup!
(Good memory)
 
@Fabby: What job did you do?
 
@PrabhjotSingh The doctor said the (very scary multi-resistant infections) are a bit better. They are decreasing blood pressure support (some medication).
 
@Jesse_b What I was trained to do or what I actually did?
 
@Fabby Trained to do, everyone in the military is actually a janitor :p
 
7:41 PM
R-Base development and SysAdmin Team Lead, is what I actually did.
@Jesse_b :D :D :D
I was trained as a "runner": that is: I was trained to run with a 38Kg backpack for 5-7 Km, set it down and run back without.
In the Belgian military, that meant carrying a backpack full of whatever anyone wanted to be taken on training and if it was smaller than 38Kg: they added rocks.
During NATO manoeuvrers, that meant: go see a sergant-major of the US military, who gave you a really nice backpack.
then go to one US officer who gave you a key, which you hat to pocket
then go to another US officer who gave you another key.
 
@Fabby and a pharma wizard if not mistaken.
 
and then run, drop the backpack, extende the antenna, insert both keys and turn.
then run back.
 
@FaheemMitha And how they know MDR infections ?
 
@Jesse_b So I think (but no one every actually told me) I was trained to set off nuclear bombs behind enemy lines...
That's the military for you: Don't think; execute!
checking on soup... BRB.
10 more minutes and soup is ready...
 
7:59 PM
@FaheemMitha Have you considered talking with a therapist?
 
8:13 PM
@PrabhjotSingh They did a culture. Sorry for slow response. I just fell asleep in my chair, I think.
@Jesse_b What kind of therapist?
 
@FaheemMitha I'm not sure, but I'm sure some specialize in grief, but even a general purpose one would likely help. I think sometimes we just need someone to talk to
 
@Jesse_b I think I may have asked, but got blank looks.
 
@FaheemMitha Asked a therapist?
 
@Jesse_b Asked about counselling.
But I'm not sure. Certainly, nobody has offered.
 
@Jesse_b Just had a look at your profile. Is that a recursive statement? ;-)
 
8:28 PM
Which statement?
 
@Jesse_b Only a spy for the CIA would say they're not a spy for the CIA...
;-)
 
@Fabby Hah, I think @FaheemMitha accused me of being a spy because I had nothing in my profile so I added that
 
I need 11 more rep before I can close Kali questions too!
@Jesse_b :D :D :D
Good one! Luckily no one is around or they would have heard me LOL
BRB! Soup time!
Tom Ka soup came out well... Too hot to eat though...
 
@Jesse_b I am Cody Banks not you or anyone else
@FaheemMitha C/S. Then it would be MDR. Is infection bacterial or mixed ?
 
@PrabhjotSingh Bacteria, I think. What is mixed? I can give you the names if you want - they're quite standard nasty bugs.
 
8:41 PM
I was diagnosed with MRSA once without any testing
They just started throwing really strong antibiotics at me
 
@Jesse_b That sounds really scary.
 
@FaheemMitha two or more types of bacteria if found in culture then it is mixed.
 
@PrabhjotSingh Oh. Yes, there were two different types mentioned.
 
MRSA common in SSTIs.
 
@PrabhjotSingh I'm pretty sure I got it from sticking my finger in a kangaroo's pouch
 
8:50 PM
@FaheemMitha in long standing or in indoor patients it is common.
 
@PrabhjotSingh Indoor?
 
@Jesse_b US have kangaroos ? I
 
@PrabhjotSingh No I was in australia at the time
It also may have just been some bug bite, we were sleeping in a tent for over a month while I was there
 
@FaheemMitha IPD.
 
@PrabhjotSingh Ok, Inpatient Department.
 
8:54 PM
@FaheemMitha if an infection is not treated or this remains a long standing infection, a simple infection can turn into mixed inf.
 
@PrabhjotSingh ok
 
@Jesse_b interestingly these days MRSA have a different meaning. It is used to classify strains of different bacteria.
@FaheemMitha Mixed infections could also be hospital acquired. nosocomial infections
 
9:12 PM
@PrabhjotSingh Yes, in this case it definitely was.
 
9:46 PM
3K Woohoo!
Now let's go close dome Kali questions!
 
 
1 hour later…
11:06 PM
@Jesse_b yes it's possible: See newest answer...
(saw you voted to close as "unclear")
Anyway: to all of our American Brethren/sistern before I go to sleep:
Happy Thanksgiving!
 

« first day (2965 days earlier)      last day (2000 days later) »