Bauer-Power Media

A few months ago I wrote about using CyanogenMOD along with a number of security tools to try to limit the amount of spying the NSA can do on your phone. Sure, some things you can't prevent. Things like the NSA capturing your cell phone location information from towers and such, but my article should have been able to prevent anything from Google (Complicit in the PRISM program) from sending your information to the NSA.

Well I just upgraded my phone to CyangogenMOD 10.2.0 and after the upgrade I went to check my version to ensure the upgrade went okay and I noticed the following:

Yes, you saw that correctly. CyanogenMOD ships with SELinux installed by default. You are probably saying, "so what?"

If you've never heard of SELinux here is a description from the NSA's website (NSA is the creator of SELinux):

As part of its Information Assurance mission, the National Security Agency has long been involved with the computer security research community in investigating a wide range of computer security topics including operating system security. Recognizing the critical role of operating system security mechanisms in supporting security at higher levels, researchers from NSA's Trusted Systems Research Group, formerly the National Information Assurance Research Laboratory, have been investigating an architecture that can provide the necessary security functionality in a manner that can meet the security needs of a wide range of computing environments.

That architecture is SELinux. That's right, the very people I was trying to protect against makes some of the software! That means a very REAL possibility of a backdoor in CyanogenMOD!

Of course CyanogenMOD says this about SELinux:

SELinux is not a backdoor for government agencies to spy on you. It is not PRISM, PROMIS, CARNIVORE, The Great Firewall or any other ominous Big Brother-like initiative.

Oh really CyanogenMOD? Why do you say that? Because the NSA told you so, and they have been so trustworthy lately? Nonsense!

No, if CyanogenMOD really wanted to protect user's data they would scrap SELinux, and go for a true open source alternative like AppArmor.

I guess there really is no good way to try and prevent NSA spying on your personal devices. Not when the NSA is collaborating with most smartphone manufacturers. The only real option is to wait on Ubuntu phones to hit the market. Hopefully that will come to the market sooner rather than later.

Read more »

(Photo credit: Wikipedia)

I mentioned a little while back that I had replaced all of my Windows machines at home with Ubuntu. Well, one of the machines that I replaced was running a weekly backup job using WinSCP to go out and pull backup files from my personal email server so I would have a copy off site from my cloud hosting provider.

Since that machine is now running Ubuntu, I had to do the same thing, but use a shell script with SCP and SSH instead. SCP pulls the files from the email server, and I then use SSH to clean up the files once I have them copied. The problem is that when you use SSH or SCP you are normally prompted with a password right?

Well to remedy this all you have to do is generate a key pair to use for authentication instead. To do that do the following from a terminal as root (sudo su):

ssh-keygen -t rsa
ssh-copy-id -i ~/.ssh/id_rsa.pub user@remotehost

If your remote server uses an alternative port for SSH like mine does, you can add the -p option after ssh-copy-id like this:

ssh-copy-id -p PORTNUMBER -i ~/.ssh/id_rsa.pub user@remotehost

Please note that when you run ssh-keygen -r rsa just hit enter after all the prompts so no password is necessary. YOU NEED TO MAKE SURE THIS KEY IS SECURED THOUGH. I for one use full disk encryption at home, so this key should be pretty well secured.

Once that is done you can now run SCP or SSH without being prompted for a password. Here are the commands I added to my shell script to first pull the backup files I wanted, then once I had them downloaded SSH deletes them from the server:

scp -P PORTNUMBER user@remotehost:/bak/*.cpt .
ssh -p PORTNUMBER user@remotehost rm /bak/*.cpt

If you are wondering what the *.cpt extension is, I explained that I first encrypt my backups in a previous post. Also the '.' at the end of the first command assumes you want the files downloaded to you current directory. You need to change that if you want it downloaded somewhere else.

Anyway, now I have my script being run as root weekly via cron on my home computer, and once again I have some peace of mind!

Read more »

(Photo credit: ElectronicFrontierFoundation)

Do you share files? Do you download files via bit torrent? Do you use AT&T as your Internet provider? Well get ready for their latest patent that allows them to detect file-sharers on their network, perform risk assessment of said files, and limit access to file sharing sites!

From RT:

Internet service provider AT&T recently added a new anti-piracy patent which features technology that can detect file-sharers on its own network, assigning risk assessment to users and potentially limiting alleged pirates’ access to file-sharing sites.

A new patent awarded to the telecom giant’s Intellectual Property division depicts a system that can classify unauthorized file-sharing users, designate them within a “risk category,” and take actions to counter future objectionable behavior.

The patent, titled “Methods, devices and computer program products for regulating network activity using a subscriber scoring system,” seems mostly aimed at combating online piracy - an ongoing target of internet service providers like AT&T, entertainment lobby groups such as the MPAA, and the Obama administration alike.

In the article there is no mention of using VPN services like TorrentPrivacy to keep your ISP from snooping on your file sharing activities though. I would venture to say that if you are using a VPN service you will probably be safe because those tunnels are encrypted which prevents ISP's like AT&T from seeing what you are really doing.

What are your thoughts on this? Let us know in the comments!

Read more »

The technology world always has a new version, generation or model available, and as an entrepreneur you might decide you need them all. Keep in mind that the ideal gadgets might not always be the newest and shiniest—focus on the gadgets that help boost your business' productivity, both on-site and while traveling. Here are a few innovative tech items that are expected to make their mark on businesses in 2014. Make sure to keep your eye on them—they may just be a game changer for your business.

All Inclusive Tablet

Photo by Guillem Alsina via Wikimedia Commons

Tablets are rapidly overtaking laptops as the mobile computing option of choice. As popular as tablets are, however, there is still a need for laptops. Microsoft's Surface Pro 2 solves offers the hardware of a portable laptop, condensed into a Windows 8.1 tablet body that works well for traditional tablet applications. It offers more power than the iPad and Android based tablets, along with Windows 8.1, which is tailor made for touchscreen computers.

Google Glass

Photo by giuseppe.costantino via Flickr

Google Glass gives users a heads up display with voice controlled apps and a great deal of flexibility when it comes to working with typical business needs. For example, you can create a Google Glass app that measures inventory based on what you see in your visual field, while remaining hands-free to check meeting notes. Google Glass is not yet available for retail sale, as an invite is required from Google. However, you can purchase them on the secondary market.

Near Field Communication

Photo by Emerson Alecrim via Wikimedia Commons

Near field communication (NFC) is not new technology, but more smartphones are beginning to incorporate it into their designs. NFC allows users to communicate over short distances for the purposes of payment processing, such as contactless credit cards, or other similar applications. Some phones that support NFC include the Acer Cloud Mobile, Blackberry Q10, Google Nexus 5, and HTG EVO 4G LTE.

Mobile Payment

Photo by sokokyu via Flickr

Mobile payment options are becoming popular in many business sectors, particularly those with a sales staff and traditional checkout counters and registers. Some mobile payment options work with an existing merchant account, while others handle all aspects of processing on their own. When looking at a mobile processing option such as GoPayment, look into the rates, availability of the card reader, and usability of the associated app.

3D Printers

Photo by dreamexplorer via Flickr

3D printing is another up and coming technology trend, allowing businesses to create and design complex, intricate parts in-house rather than costly outsourcing. While it may not apply to all businesses, it's unarguably a game-changer in a wide range of industries such as tech development, health, motor sports, and more. The costs and availability of 3D printers are beginning to expand, with consumer grade models soon to launch.

Read more »

While troubleshooting my greylisting issues yesterday, I went ahead and just deleted my mail.log which is located in /var/log. I wanted to start the logs from scratch to see if I can catch the right IP's that were being greylisted.

Well, after I deleted mail.log, and restarted postfix, the log didn't automatically get recreated. So I had to manually create it. Well I created a new mail.log file as root, but the permissions were wrong. So I had to change the permissions ans the file owner. Here's exactly what I did:

Create a new mail.log file
sudo touch /var/log/mail.log

Change the owner to syslog:adm
sudo chown syslog:adm /var/log/mail.log

Change the permissions to -rw-r----- on mail.log
sudo chmod 640 mail.log

That's it, then after restarting services mail.log starting updating again!

Read more »

I mentioned the other day that I disabled greylisting on my email server because Cluebringer was greylisting MX Guard Dog's smtp servers. Well ever since I did that I've been getting a lot of spam again.

I figured out how I can keep greylisting enabled, and white list individual IP's.

What I did was I opened up /var/log/mail.log and searched for action=reject. I found a string similar to this:

module=Greylisting, action=reject, host=66.85.178.50, helo=s480b.ik2.com

I copied the IP address then went into my Cluebringer administration page at https://mainserver/cluebringer. I logged in with my iRedmail admin credentials and on the left I found Greylisting Whitelist. In there I added the host IP to the white list, then set disabled to no.

After that I restarted the Cluebringer daemon by running:

service postfix-cluebringer restart

After that email started flowing correcly again, yet I get to keep the protection of greylisting enabled! Win win!

Read more »

As I mentioned last week I started using MXGuardDog as a cloud based spam filter, and it's been working great! The problem I recently encountered though was that my mail server was greylisting MXGuardDog's smtp servers for some reason, and mailflow was affected.

I am using iRedMail for my email server and it has built in spam filtering using Amavis, but it rather sucks. Ever since I setup this mail server I've been bombarded with spam! That is why I switched to MXGuardDog, which has been doing a great job thwarting spam.

So like I said though, people started reporting bounce-backs with an error message that said:

Recipient address rejected: Greylisting in effect, sending server blacklisted

I figured since I'm using MXGuardDog I didn't really need the greylisting feature after all, so this is what I did to turn it off:

Edited /etc/cluebringer/cluebringer.conf

Changed

# Greylisting module
[Greylisting]
enable=1

to
# Greylisting module
[Greylisting]
enable=0

Then I restarted the postfix-cluebringer daemon to make the change take effect!

sudo service postfix-cluebringer restart

After that mailflow worked again, and I let MXGuardJob do it's job.

Read more »

Dec 19, 2013

I Was So Wrong About CyanogenMOD For Prism-Breaking Your Android Device

Dec 18, 2013

Simple Script To Backup Files From a Linux Server Via SCP and SSH

Dec 17, 2013

AT&T Adds New Patent That Can Detect File Sharing and Block Access to File Sharing Sites

Dec 4, 2013