tuxexchange.com A new cryptocurrency exchange

tuxexchange.com is a new cryptocurrency exchange that offers spot trading in most popular cryptocurrencies. Check it out www.tuxexchange.com

CVE-2015-5477 - DNS bind TKEY query handling DoS Proof of concept exploit

Here is a quick PoC exploit for the TKEY bind vulnerability.

DNS Stress testing with hping3

1. Compile our program to generate the DNS payload (sipher@utensil)(~/dnsstress)$ gcc gr2.c -o gr2 2. Generate DNS payload (sipher@utensil)(~/dnsstress)$ ./gr2 (sipher@utensil)(~/dnsstress)$ hexdump -C dns.txt 00000000 24 1a 01 00 00 01 00 00 00 00 00 00 06 67 6f 6f |$............goo| 00000010 67 6c 65 03 63 6f 6d 00 00 01 00 01 |gle.com.....| 0000001c 3. Get the size of the request (Important for passing to hping3 -d paramater) (sipher@utensil)(~/dnsstress)$ ls -lah |grep dns.txt -rw-rw-r-- 1 striemer striemer 28 Apr 17 10:30 dns.txt (sipher@utensil)(~/dnsstress)$ 4. Fire!! use --flood if you're brave. Use --rand-source to test state tables. (sipher@utensil)(~/dnsstress)$ sudo hping3 localhost --udp -V -p 53 --file /home/sipher/dnsstress/dns.txt -d 28 --fast Alternate way to deliver the packets... NOTE: Won't be as fast since it's not using raw sockets and it's waiting for reply. (sipher@utensil)(~/dnsstress)$ nc -u localhost 53 < dns.txt

DNS Cache busting

DNS Cache busting is a very simple attack against a caching DNS server. All you need is a domain which is confiured to answer for a wild card (Example: *.domain.com,asd.domain.com etc.).
This attack is being used in the wild.

UPDATE: ISC has since introduced some features to bind to mitigate this attack.

https://kb.isc.org/article/AA-01178/0/Recursive-Client-Rate-limiting-in-BIND-9.9-Subscription-Version.html

fetches-per-zone The maximum number of simultaneous iterative queries to any one domain that the server will permit before blocking new queries for data in or beneath that zone. This value should reflect how many fetches would normally be sent to any one zone in the time it would take to resolve them. It should be smaller than recursive-clients. When many clients simultaneously query for the same name and type, the clients will all be attached to the same fetch, up to the max-clients-per-query limit, and only one iterative query will be sent. However, when clients are simultaneously querying for different names or types, multiple queries will be sent and max-clients-per-query is not effective as a limit.

Apple Pay...Just another way to use a credit card

Is Apple pay really that revolutionary? What does this mean for the world of crypto-currency?
My opinion is that Apple Pay doesn't address any of the features delivered by Bitcoin (and similar altcoins). For example, the decentralized ledger which automates accounting or the ability to transfer funds anywhere in the world with limited infrastructure. The list goes on. Apply Pay just another way to use a credit card in a brick and motar market.

iptables log traffic to port

Here is a rule to log traffic to SSH.

iptables -A INPUT -p tcp --dport 22 -j LOG

Crypto shake up

XRP, Stellar, Paycoin, Counterparty? WTF is going on in the crypto world? Is bitcoin in trouble?
Buy EVERYTHING!!?

Justice for mintpal

What a debacle this has been...again. This is what gives crypto a bad name.
http://www.mintpaljustice.com/

Android Google Authenticator Backup 2FA codes

I have been trying to find a method to recover the 200 accounts I have 2FA configured for. Here is the magic sauce.
This is pretty straight forward on Ubuntu. You can now key in the code manually.

Bitcoin price on the move, breaks 400

Finally some action in the world of crypto. Bitcoin's price is rallying after a long down trend. Welcome back :)

lofiadm: /dev/lofictl: No such file or directory, Solaris non-global zone

To avoid the above error in Solaris 10 non-global zone, we need to expose lofi to solaris non-global zone: /opt/VRTSvcs/bin/hagrp -offline platenggrp -any Change zonecfg on both nodes in VCS cluster for this non-global zone: bash-3.00# zonecfg -z plateng01p zonecfg:plateng01p> info zonename: plateng01p zonepath: /zones/plateng01p brand: native autoboot: true bootargs: pool: limitpriv: scheduling-class: ip-type: shared inherit-pkg-dir: dir: /lib inherit-pkg-dir: dir: /platform inherit-pkg-dir: dir: /sbin inherit-pkg-dir: dir: /usr fs: dir: /usr/local special: /zones/plateng01p/local raw not specified type: lofs options: [] fs: dir: /usr/openv special: /zones/plateng01p/openv raw not specified type: lofs options: [] net: address: xx.xx.xx.xx physical: e1000g0 zonecfg:plateng01p> zonecfg:plateng01p> add device zonecfg:plateng01p:device> set match=/dev/lofictl zonecfg:plateng01p:device> end zonecfg:plateng01p> add device zonecfg:plateng01p:device> set match=/dev/lofi/* zonecfg:plateng01p:device> end zonecfg:plateng01p> add device zonecfg:plateng01p:device> set match=/dev/rlofi/* zonecfg:plateng01p:device> end zonecfg:plateng01p> exit bash-3.00# zonecfg -z plateng01p info zonename: plateng01p zonepath: /zones/plateng01p brand: native autoboot: true bootargs: pool: limitpriv: scheduling-class: ip-type: shared inherit-pkg-dir: dir: /lib inherit-pkg-dir: dir: /platform inherit-pkg-dir: dir: /sbin inherit-pkg-dir: dir: /usr fs: dir: /usr/local special: /zones/plateng01p/local raw not specified type: lofs options: [] fs: dir: /usr/openv special: /zones/plateng01p/openv raw not specified type: lofs options: [] net: address: xx.xx.xx.xx physical: e1000g0 device match: /dev/lofictl device match: /dev/lofi/* device match: /dev/rlofi/* bash-3.00# bash-3.00# /opt/VRTSvcs/bin/hagrp -online platenggrp -any bash-3.00# lofiadm -a /root/sol-10-u7-ga-sparc-dvd.iso /dev/lofi/1 bash-3.00# lofiadm Block Device File /dev/lofi/1 /root/sol-10-u7-ga-sparc-dvd.iso bash-3.00# bash-3.00# mount -F hsfs -o ro /dev/lofi/1 /mnt/solaris bash-3.00# df -kh | grep mnt mnttab 0K 0K 0K 0% /etc/mnttab /dev/lofi/1 2.5G 2.5G 0K 100% /mnt/solaris bash-3.00#

Brute foricing brainwallet

If you're using a weak passphrase for your brainwallet. You should consider this :)



You need pyBrainwallet to run this. It can be found here.

MintPal hacked, 30% of Vericoin stolen

Yes. This is real. Mintpal has been hacked and a large amount of coins have been stolen. You can read the statement released by Vericoin here
Here is what MintPal is saying. You can read the original post HERE

A few hours ago we were unfortunately the subject of a successful attack against the exchange. Our investigations have shown that whilst our security was breached, VeriCoin was the target. We would like to stress that VeriCoin and the VeriCoin network has not been in any way compromised. We have worked to secure the exchange and the withdraw process from any further attack. As it stands at the moment the following applies: 1) We lost a considerable amount of VeriCoin in the attack, however we have been working with the VRC developers and all major exchanges to hard fork the coin at a position before the attack. This will allow us to retrieve the stolen coins and facilitate all withdrawals. We are also working with various exchanges to accommodate any losses they may encouter as a result of the required fork. 2) We are currently processing withdrawals for all other coins. As I'm sure you will appreciate, our support channels will most likely be very busy over the coming hours/days so please bear with us. We would like to personally extend our thanks to the VeriCoin developers and the other exchanges who have pulled out all of the stops to ensure that your VRC funds are safe.

Oracle ILOM CMM reset via CLI

Here is how to reset Oracle ILOM CMM from the command line.

1. Login to CMM/ILOM CLI
2. Type the following command


You should now have access to CMM/ILOM!

Newegg the latest retailer to accept Bitcoin

Bitcoin is now being accepted by one of the largest PC retailers on the market. This is a big boost to Bitcoin especially on the heels of the NSA's SilkRoad Bitcoin auction.

You can read the full story here

Ubuntu Fortinet SSL VPN client install

First things first, download Forinet SSL VPN Software

In order to install the Fortinet SSL VPN under Ubuntu 14.04 64 bit, you will need to install some dependencies to get it to execute.

bash: ./forticlientsslvpn: No such file or directory

This means you do not have 32 bit compatibility installed.

Issue the following commands to install the require software to run Fortinet SSL VPN.



You should now be able to VPN into your coorporate network without issue.

bitcoin is a virus...or wait a minute...

The Bitcoin block chain is inadvertently being flagged as a virus since byte code matching a virus signature has been appended to the block chain. Microsoft Security essentials has been flagging the "Malware" along with other reputable AV vendors. Have a look here to read the MS forum thread. To get an excellent technical write up about this check out Steven's blog here

Nautiluscoin sponsoring MMA fighter Jon Fitch

Nautiluscoin will sponsoring once UFC fighter Jon Fitch. This is an interesting combination! I love MMA and crypto currency. Who knows maybe this will encourage me to buy some Nautiluscoin.

Read the Bitcointalk thread here.

Why ASIC's are not bad for Litecoin

Everybody seems to think ASIC's are a bad thing for Litecoin, when in fact it is quite the opposite. As we witness many small scrypt coins threatened with 51% attacks as scrypt miners come online, it demonstrates the need to have a distributed and significant hashrate. What I'm suggesting is that the network is more secure because of the hash power delivered by these mining devices. There is not a coin on the market today that can claim to be ASIC proof (excluding pure PoS coins). Any coin that garners any significant market share will be ripe for ASIC development. What is Security worth to you? This is why mining is so important. I find the concept of hybrid Pow/Pos coins very attractive (Snuggles Peercoin). Myriadcoin provides multiple algorithms that can be used.

Litecoin's physically minted..sorta

It's not often I click on Google Ads, but I was captured by the coinographic name :) I had to click it (I didn't even know what it was. pathetic I know)!

These look beautiful! Check out Coinographic.com