Gettin’ hacked

I had an email this morning only five days after my billing cycle started saying that I was close to using my 15GB of data. Normally we spend about 5-10GB, but 15GB in five days is exceptional.

I started digging and after ruling out intentional upload/download from inside my network (using wireshark on my LAN segment) I then started looking at the wireless side of things. I have a server on my LAN that is connected via wireless, and this is also a public facing server with sshd running on it.

I had a quick page through the /var/log/auth.log file and to my surprise I found repeated attempts to log in with various usernames (491 different ones so far) from various locations. These were coming in at the rate of one every four seconds. I can’t see how this would account for 15GB (or 1.5GB for that matter) but when I called Orcon they said they saw a definite increase in traffic over the last two days, which also corresponds to the first entry in the auth.log file.

Here’s what the log entries look like:
Sep 27 13:29:59 pandora sshd[17366]: Failed password for invalid user oracle from 60.190.133.228 port 45662 ssh2
Sep 27 13:30:03 pandora sshd[17368]: Failed password for invalid user michael from 60.190.133.228 port 45857 ssh2
Sep 27 13:30:07 pandora sshd[17374]: Failed password for invalid user ftp from 60.190.133.228 port 46079 ssh2
Sep 27 13:30:12 pandora sshd[17376]: Failed password for invalid user test from 60.190.133.228 port 46301 ssh2
Sep 27 13:30:15 pandora sshd[17379]: Failed password for invalid user webmaster from 60.190.133.228 port 46553 ssh2
and so on …

The requests have come from a range of IP addresses in China, Europe, Canada and Bangladesh. It’s likely to be a distributed and targeted attack.

Interesting. I did install fail2ban some time ago which I was told was supposed to prevent this kind of thing but it was an install-and-forget excercise. I’ll have to research it a bit to find out how it actually works.

Screen recording with Linux

Hello to my future self – I’ve anticipated that I will be back in the future to read this post because I’m sure I would have forgotten how to do this stuff. Firstly, a disclaimer – I am by no means an expert in this field, I just banged it ’till it worked. If you are having trouble doing similar things then I encourage you to post comments where they can be seen and responded to by all.

Secondly, an explanation of what it is I’m doing here. A while back I saw some screencasts re Inkscape at screencasters.heathenx.org. I was impressed – it was a great way to teach people how to use Inkscape.

I had a play around and managed to get to the point where I can now do the following:

• Record my screen, or any particular window
• Use my Logitech USB headset to record the audio
• Play the resulting movie back, sound through speakers or headset

For some reason I seem to be having a ridiculously hard time determining where the audio output goes for my Linux apps. In Windows, when I plug my headset in, it becomes the default audio device for all applications. Currently running applications still use their normal sound output, until restarted. If I dig deep enough I might even be able to find settings in each program that allows me to specify which sound device (headset or sound card) should get the output.

In Linux (Ubuntu 8.04, Gnome to be precise) I discovered under System > Preferences > Sound an application that allows me to adjust the sound preferences. In the dropdown list for each playback type I have seven possible playback device options (Auto, USB Audio, Intel ICH5, Intel ICH5 – IEC958, ALSA, OSS & PulseAudio). It seems that if I set them all to USB Audio then I get lucky and most things play through the headphones. Some things, especially the Adobe Flash Player plugin insists on playing through my desktop speakers regardless. I saw someone complaining that this was Adobe’s fault, not Linux but I can’t comment. In order to avoid all this confusion I found out how to specify the sound device that you want to use for each operation. This is pretty much the crux of this post.

Anyway, here’s what I did …

Recorded My Desktop

There’s a package in the Ubuntu universe repository called recordmydesktop which as the name suggests can be used to record your desktop, with sound. This is great for making recordings of how to do things to share with others. I installed the recordmydesktop package, along with the GTK front end to save me having to look up the commands all the time..

bob@sparkie:~$ sudo apt-get install recordmydesktop gtk-recordmydesktop

Once installed I then hit Alt-F2 (to bring up the Run Application dialog) and typed in gtk-recordmydesktop.

It seemed that by default it was trying to record sound via the mic input on my sound card. Fat chance it would have had because I don’t have a mic in my soundcard, instead I have a USB headset.

After Googling around I discovered that if I click the Advanced button in gtk-recordmydesktop I could then enter the sound device to use to capture audio. I used the device name “plughw:Headset,0,0″ and was able to record sound via my USB headset.

The key to this was finding out what to type in for the device name. I discovered the aplay and arecord utilities that allow you to play and record sound. Each utility has a -l switch which lists the available devices. Here’s the output of my arecord -l:

bob@sparkie:~$ arecord -l
**** List of CAPTURE Hardware Devices ****
card 0: ICH5 [Intel ICH5], device 0: Intel ICH [Intel ICH5]
Subdevices: 1/1
Subdevice #0: subdevice #0
card 0: ICH5 [Intel ICH5], device 1: Intel ICH - MIC ADC [Intel ICH5 - MIC ADC]
Subdevices: 1/1
Subdevice #0: subdevice #0
card 0: ICH5 [Intel ICH5], device 2: Intel ICH - MIC2 ADC [Intel ICH5 - MIC2 ADC]
Subdevices: 1/1
Subdevice #0: subdevice #0
card 0: ICH5 [Intel ICH5], device 3: Intel ICH - ADC2 [Intel ICH5 - ADC2]
Subdevices: 1/1
Subdevice #0: subdevice #0
card 1: Headset [Logitech USB Headset], device 0: USB Audio [USB Audio]
Subdevices: 1/1
Subdevice #0: subdevice #0

You can see beside each “card” there is a device name, either ICH5 (my sound card) or Headset. Each of those cards has a number of subdevices – in the case of the sound card you can see there are four possible subdevices I could have chosen (numbered 0 to 3) and for the headset it’s a free ride because there’s only one to choose from (as I would have expected).

So, now that plughw:Headset,0,0 should make a bit more sense. With that all set up, I hit record, wiggled my mouse around, spoke some gibberish and created a .ogg file of my session.

Sound Recording and Playback

While I was debugging my sound devices I fiddled around a bit with arecord and aplay. Using the command arecord -Dplughw:Headset,0,0 -f S16_LE -c2 -r44100 > myfile.wav I created a 44kHz wav file using the headset mic as my recording device.

When I played it back with aplay myfile.wav, it played through my desktop speakers. To play it through my headset I just specified the device name as I did with the arecord command, thus aplay -Dplughw:Headset,0 myfile.wav

If you want to use mplayer to play something back using a specific device for audio output, this command will do the trick for you: mplayer -ao alsa:device=hw=1.0 ep069.flv. Device 1.0 is card #1, device 0 – and that’s the headset.

If you need to adjust the volume, I found you can use the alsamixer. To control each card you can specify which one with the -c switch. In my case card 0 is the default and internal sound card, and card 1 is the USB Headset: alsamixer -c 1

That’s all for now!