Wireshark and Java API for packet sniffing

Here is a nice tutorial I found on the web for basics of networking.It gave a decent very high level overview of Network Topology, OSI Layers, Protocols  and Routing.

If you want to look more on how your network traffic looks you can try a packet sniffer called wireshark.Works extremely well for me on both Windows and Linux(Ubuntu).Wireshark is open source software that depends on another open source package called libpcap.You can set filters in wireshark on pretty much anything so you see only those packets for example show only ARP packets, Show only DNS requests requesting for facebook.com etc. If you are on a ethernet network, it is probably based on CDMA/CD so if you sniff your Network Interface Card in promiscous mode you will pick up not just packets meant for you but probably also other packets on the wire

If you like to use Java for packet sniffing , there is also an open source API for that - JpCap .It basically is against based on libpcap and has tons of native calls.Nothing like trying to debug a ArrayIndexOutOfBoundsException you get from within the native code ! :-)

Anyways here is what I had to do to be able to run the code from eclipse on my Ubuntu

1. sudo apt-get install build-essential (for libpcap compilation)
2. sudo apt-get install (for libpcap compilation)
3. sudo apt-get install bison (for libpcap compilation)
4. sudo apt-get install autoconf (for libpcap compilation)
5. Then get libcap from here 
6. Then pretty much ran ./autoconf, ./configure, ./make and sudo make install from within the libcap source directory
7. sudo apt-get Install openjdk6
8. sudo apt-get install eclipse
9. Download the source for jpcap from here.
10. The source has both Java and C code, so if you want to get it into eclipse, create a regular Java project and just copy the Java files under the src folder and dump the rest directly under the Project folder itself.
11. You'll need to compile the C code first into object code.I had to update the makefile to use -fPIC flags for gcc.This is needed apparently if you are running on 64 bit machine else gcc will complain.
12. copied libjpcap.so from above step to here /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/libjpcap.so
13. sudo cp *libpcap* /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/
14. Run eclipse with root priveleges i.e. sudo eclipse to launch the IDE

Botnets

If you still think that cyber crime is just over hyped and not that serious like real crime  and "hacking" is just done by a bunch of smart kids who have disproportionate amount of free time - think again! check this video out from Google Tech Talks How to Steal a Botnet and What Can Happen When You Do

Here is a text summary from another blog.The UCSB folks took control of the botnet by figuring out the domain name generation algorithm and then creating the domains before the bad guys could create it.Of course once the bad guys figured out, they changed the domain generation algorithm code and downloaded the new version on the infected machines.The interesting part was I watched this video around the time Google - China stand off was going on and then the video also mentions Torpig downloads a list of about 200 banks from around the world to launch its phishing attacks and then they mention for some reason in the video that not one of the banks was from China :-)

The gist is that when you typically visit sites you are not supposed to visit(you know the type I am talking about) this may happen.

1. They entice you with a irresistible pop up to click on or they may exploit some vulnerability of the browser to install the mebroot rootkit on your system.This is called as Drive By Download i.e. downloads which you did not explicitly ask for.
2. Mebroot is a rootkit which infects the Master Boot Record.I always thought messing with the MBR wasn't that easy but Symantec says otherwise "The main problem is that some versions of Microsoft Windows allow programs to overwrite disk sectors directly (including the MBR) from user mode, without restrictions. As such, writing a new MBR into Sector0 as a standard user is a relatively easy task."
3. Next Mebroot opens up a backdoor and downloads another Trojan horse called Torpig  
4. And then you are pretty much screwed.Torpig injects itself into to some 29 different dlls and actively sends everything from your key strokes (keylogger) to your Http Form data back to command and control servers.It also does phishing attacks from your browser

• You can't just block the ip of its command and control server from your firewall because it uses an extensive algorithm to calculate the domain names of the command and control servers almost every day and the criminals create the new domains for running command and control servers
• Using https does not help because torpig has already injected itself into your browser, so it will send the form POST data even before the browser can encrypt it
• Anti-Phising software won't help because again since Torpig is part of your browser now, you will see bankofamerica.com on your browser window and not some fake URL, but the page it shows is still fake and it will just send the details you enter to the command and control servers
• And it can use the mebroot backdoor to update its executable code regularly, so the algorithms keep changing

my home page

I guess that is what happens if you have ten bucks to spare and a weekend to kill - you get yourself a home page on the intertubes and here is mine http://home.bgurupra.org/.The weird name bgurupra is because it is the auto generated short id for my email at work and I am so used to that short id after using it for 8 years that I use it almost everywhere

Wubi Baby!

I was getting a little tired of using Ubuntu over VMWare because it was really slow and decided to install full fledged Ubuntu on my laptop and this thing called Wubi HAS to be the easiest way to install Ubuntu on Windows EVER!.

It runs like a windows installer.All it asked me was how much space I want to allocate for Linux and what is the user id and password I would like.period.Then it took about 30 mins to download the installation files.Next it asked me to reboot and by then it had added Ubuntu to the windows boot menu, I selected Ubuntu - another 15 mins for it to setup( It did not ask me for ONE SINGLE THING during this whole process).Then restarted again and that is it - Ubuntu installed!

It does not need you to partition your disk like the regular installation, instead it just creates a big files under windows and Linux treats that big file as the entire hard disk.And when I am want to uninstall - just need to uninstall from the regular Add/Remove Programs on Windows.Pretty neat huh?

oh and don't worry if you see it downloading amd64 installation for your Intel 64 Bit machine - apparently the amd64 installation works both on AMD and Intel,that is listed on the FAQs on Wubi site and I do have an Intel machine and the amd64 installation is working for me.

This is why I love Google

How many companies in this especially "capitalistic" world will even talk about moving away from the biggest market in the world just for the sake of values?

http://googleblog.blogspot.com/2010/01/new-approach-to-china.html

Stupid Interview Questions - Hilarious

Hilarious! http://exold.com/article/stupid-interview-questions

Running SSHD in Cygwin

http://www.noah.org/ssh/cygwin-sshd.html