G-Loaded Journal » Review

Cheap Biometrics – Use Keystroke Dynamics to Identify and Verify Users

George Notaras — Thu, 08 May 2008 17:49:25 +0000

You may have obtained my password, but you can’t type it like me!

This could be the summary of the excellent article, titled Identify and verify users based on how they type by Nathan Harrington, which demonstrates how it is possible to enhance a computer system’s security by using a special algorithm which, in addition to the validity of the password, checks whether the keyboard buttons have been pressed/released in the user’s pre-recorded and unique way of typing that particular password. The author provides all the necessary code in order to add this biometric technique to the GNOME Display Manager (GDM).

It may sound like a relatively easy implementation, but, taking into account that it is almost impossible for our neuro-myo-skeletal system to produce two identical patterns while performing a complicated action such as typing, user identification and verification using this biometric technique becomes a real challenge. The article author notes:

As a biometric, keystroke dynamics are relatively imprecise. Unlike Iris scans or fingerprints, even the most highly repetitive individuals make subtle variations in their typing patterns. The challenge in using keystroke dynamics in an authentication or verification context is to discern acceptable variations from incorrect credentials.

One could say that the pros and cons of such an implementation are quite obvious.

Unlike iris or fingerprint scanners, this biometric does not require any special hardware equipment. It is just an algorithm that can be compiled and run on any computer system. This generally means: cheap biometric methods.
It can be added on top of the currently used authentication systems without requiring any extra action from the users at all.
The combination of such a biometric method with the existing user/password authentication scheme greatly enhances security.

On the other hand::

It is extremely easy for anyone who has privileged access to the computer system to record each user’s typing pattern. This could be done by using keylogging software or, worse, using a specially crafted keyboard in case of physical access to the system.
It requires that the users are actually familiar with the keyboard, at least to the extend that they are able to repeat the password typing pattern without big variations.
Depending on the strictness of the algorithm, false negatives might occur.

I didn’t have the necessary free time to patch GDM with the provided code, compile it and test the algorithm’s effectiveness.

I mainly found this article very interesting because it is proof that we have just scratched the surface of biometrics. The simplicity of the concept behind this biometric method indicates that there are many new human identification techniques to be discovered and implemented (not only in computer systems), possibly at a cost in terms of personal freedom as a result of misuse of such technologies. But, I guess this has always been the problem with the technological progress, so, once again, we will have to deal with and resolve any issues that may arise in the future.

Cheap Biometrics – Use Keystroke Dynamics to Identify and Verify Users, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Security Guides for Operating Systems by the NSA

George Notaras — Sun, 16 Dec 2007 11:59:21 +0000

The National Security Agency (NSA) of the USA has published some security configuration guides for various popular Operating Systems. Linux is covered by the Red Hat Enterprise Linux 5 security guide, but most of the included information can be easily translated to other Linux distributions. As it is clearly stated in the guide’s disclaimer, all the included information only constitutes “recommended security changes” and not changes that should be made to all OS setups. Anyhow, even from the quick look I had inside, I can say that this is professional work. This document is an excellent read regardless of the Linux distribution you use. Guides for other operating systems, such as Microsoft Windows, Apple MacOS X, Sun Solaris 8/9, exist as well. I learned about these guides while browsing the mailing list archives of the Fedora Documentation Project (FDP) some days ago, so all credit goes to the person who posted it there in the first place.

Security Guides for Operating Systems by the NSA, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Adobe Reader 8 for Linux

George Notaras — Fri, 19 Oct 2007 05:24:04 +0000

I don’t know since when Adobe Reader 8 (8.1.1 actually) has become available for the Linux platform, but, as soon as I found out, I downloaded and installed it in the hope that it will improve the overall poor PDF reading experience. To my surprise, the 8th version of Adobe Reader not only looks and feels like a Linux native application with an excellently re-designed interface, but its performance is also greatly improved. Needless to say that it completely outperforms Evince, so the switch to the new adobe reader was instant. I highly recommend that you download and install Adobe Reader 8, if you care about reading those PDF files.

Adobe Reader 8 for Linux, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Zim – a Desktop Wiki

George Notaras — Fri, 19 Oct 2007 04:01:41 +0000

While browsing the archives of Linux Screw, I came across a very interesting post about Zim. Zim is a wiki-style note taking system for the desktop. Its text editor, being an 100% WYSIWYG wiki text edtor, does not require any knowledge of wiki syntax. One could say that Zim is a more advanced and feature-rich implementation of Tomboy. Notes can be organized in “repositories” pretty much like the “namespace” concept of web-based wikis, which results in better categorization of the notes than what is currently possible with Tomboy. Some other things I particularly liked are the fact that all the available formatting can be applied to the text by using keyboard shortcuts (unlike Tomboy) and the support for a custom USR1 signal which can be used to programmatically toggle the visibility of Zim by assigning a custom global keyboard shortcut that triggers the execution of a very simple BASH script (you can find it in the Zim FAQ). For Tomboy users who consider switching to Zim (count me in), there is a Tomboy-to-Zim converter available. It did not work out of the box, but it seems that it is easy to fix. Although I’ve been using it only for some minutes, Zim is definitely a keeper. If advanced note-taking is in the standard procedures of your everyday computing, I highly recommend trying Zim.

Zim – a Desktop Wiki, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

CloneZilla instead of Partimage

George Notaras — Sat, 15 Sep 2007 16:17:35 +0000

Until now I have been creating partition images with Partimage, which has never failed. Another very popular tool nowadays is CloneZilla. This software, which happens to include partimage among various other utilities, has wider filesystem support and a better set of features – taking/restoring backups across the network is supported. The fact that this is an active project is one of the major reasons alone for switching to this software for creating partition or entire hard disk backups. Apart from the official Clonezilla Live CD (probably the most up to date), there must be several live CDs that are built around CloneZilla, but here are two of them on which I have recently stumbled upon:

GParted-CloneZilla Live CD – This project by LarryT combines the gparted hard disk partitioning tool with CloneZilla.
Clonezilla-SysRescCD – This is another excellent combination of tools made by Spiros Georgaras. This liveCD combines the system repair and data recovery collection of tools of the SysRescCD with CloneZilla.

CloneZilla instead of Partimage, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Featured Epiphany Plugins

George Notaras — Fri, 14 Sep 2007 00:45:37 +0000

My two plugins – extensions – for the Epiphany web browser, Tab-Session-Management and Tab-Links, have been featured on the official Epiphany blog. Thanks Dieguito! ;-) By reading all the entries on the blog, it is quite clear that the people behind this project are very happy to be involved. I assume this is a determinant factor for the project’s future, as it guarantees the constant improvement of the browser’s key features.

For all those who have not tried Epiphany yet, I’d like to say the following:

Using Epiphany is not about reaching the sense of uniqueness by using a less popular browser. It is also nowhere near trying to seem elite. Moreover, you will never manage to impress the ladies by using it…

Epiphany is a tool; a stable, lightweight piece of software, which offers better integration into the GNOME environment than any other browser, the powerful engine of Firefox and some of the most futuristic features that are available among today’s web browsers, for example tagged bookmarks.

Featured Epiphany Plugins, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Mailing List Manager

George Notaras — Mon, 20 Aug 2007 13:29:51 +0000

If you are looking for a lean, mean mailing list manager (MLM), look no further. The software you are looking for is called: the Minimalist. Despite the fact that the Minimalist is just a Perl script with a filesize of 70Kb, it is a full featured MLM which will satisfy almost all users. Do not expect to find any extra functionality in that script like web interfaces, email archivers, etc. The Minimalist has been designed to serve one purpose: manage mailing lists; that is supporting some commands which are sent to the program by email and taking the relevant actions upon their arrival. The mailing list archives can be converted to HTML pages by using one of the popular email archivers: MHonArc and HyperMail (there is also Pipermail which is included in the Mailman suite).

I’ve been experimenting with the Minimalist for the last days and all I can say is that this software Just Works™ … and I like it when software works! Actually, I liked it so much that I have devoted a significant amount of time in writing a program that acts as a bridge between the Minimalist’s mailing list archives and MHonArc. This program (a MHonArc wrapper actually), which also includes a set of resource files in order to heavily customize MHonArc’s HTML output (in an attempt to be like the popular Mailman web archives), is called BenzinArc (Benzin Archiver) and can be used both as a cron job and as a standalone application. BenzinArc is still work in progress. No code has been released yet. An overview of the HTML version of the CodeTRAX Mailing List Archives is available. Currently, only one read-only mailing list, codetrax-bugs, exists. This is a dedicated list to the bug reports of all projects hosted by CodeTRAX, but it is enough to serve as an example.

All this mailing-list-related stuff has kept me away from working on the 0.7.1 release of the TraxAuth Account System, but I assume all that was absolutely necessary. Although my free time will be very little in the upcoming weeks, I guess I will be able to release a new version of TraxAuth and the first public test release of BenzinArc.

Mailing List Manager, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Next time, come prepared

George Notaras — Fri, 17 Aug 2007 18:02:34 +0000

I had no idea that at the time I was adding a mailing-list manager in the list of software that constitute the infrastructure of the CodeTRAX facility, I also added a factor that would cause serious delay in the preparation of the whole project. But, mailing lists are a mandatory feature of the facility’s notification services. Despite the popularity of notifications via RSS/Atom feeds, email notifications are still the de facto method of delivering the news. The mailing list manager I initially used was the Mailman. This is an extremely popular piece of software as it is the backend for the majority of mailing lists worldwide. Having spent over two days with its configuration, I suddenly decided to completely get rid of it and try another list manager. I still cannot figure out what was the main reason for making such a decision, but the following have played a significant part in it:

The Mailman is too bloated. I admit it has (almost) all the features one would need, but much of this stuff is not actually that useful. Its sources alone consume 22+ MB of disk space.
The actions (configuration) that need to be performed in order to make the software work on an SSL virtual host are not obvious and are only stated into the FAQ, but not in the main installation documentation. This means merciless waste of time.
As soon as I finished configuring the Mailman, I realized that this 22MB software which supports features that would satisfy the Earth’s most weird users and whose main reason of existence is to send emails to lists of email addresses does not support SMTP authentication. This means that if your SMTP service requires authentication in order to send emails to domains for which it is not the final destination or if the SMTP service runs on a separate machine, you will have to loosen the server’s security in order to make the SMTPdirect mailman’s delivery method work. (fixing this by hacking the SMTPDirect.py source is rather easy, but – for me – not acceptable when it comes to the flagship of mailing list managers)

Currently, I experiment with another (less popular) mailing list manager, which seems to be lean and mean enough for my needs – allow me not to disclose the software’s name at this moment. If all goes well, I will publish a guide on how to set it up.

I admit that I should have done some research before sticking with the mailman. This was a lesson.

Next time, come prepared, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

SSL-enabled Name-based Apache Virtual Hosts with mod_gnutls

George Notaras — Fri, 10 Aug 2007 05:35:49 +0000

This article describes how to implement SSL-enabled name-based vhosts – that is secure virtual hosts which share the same IP address and port – with the SNI-capable mod_gnutls module for Apache’s httpd web server.

Server Name Indication (SNI), as described in section 3.1 of the RFC3546, is a TLS extension which makes the configuration of SSL-enabled name-based virtual hosts possible. This extention eliminates the need for the assignment of one IP address per secure virtual host, therefore the cost for secure web hosting is greatly reduced, as all secure virtual hosts can share the same IP address and port combination. SNI is a huge step forward as it promotes security by making secure web services easier and cheaper to implement. The current version of OpenSSL – 0.98 at the time of writing – does not support SNI yet, but this is planned for the upcoming 0.99 release. On the other hand, mod_gnutls, an experimental module for Apache’s httpd which has been around for 2+ years, includes support for SNI.

Introduction

Searching the web for mod_gnutls binary distribution packages or information on how to set it up returned very few relevant results. This was a surprise, as, at this moment, the only implementation that supports SNI is mod_gnutls. So, I decided to write a tutorial on how to set things up for a test. I hope you find it useful.

The test that is described in this guide includes:

The compilation of the mod_gnutls module.
The generation of SSL certificates.
The configuration of the SSL-enabled name-based virtual hosts.

This test was performed on a server that runs Fedora 7.

Installation

In order to compile mod_gnutls, you will need the development tools for Fedora:

# yum groupinstall "Development Tools"

Install the mod_gnutls dependencies:

# yum install httpd-devel gnutls-devel

As an unprivileged user, download the mod_gnutls distribution and compile it.

$ wget http://www.outoforder.cc/downloads/mod_gnutls/mod_gnutls-0.2.0.tar.bz2
$ tar -xjvf mod_gnutls-0.2.0.tar.bz2
$ cd mod_gnutls-0.2.0
$ ./configure --prefix=/usr
$ make

Do not use the ‘make install‘ script, but perform the installation manually – it is only one library.

As root, copy libmod_gnutls.so to the directory that holds the Apache modules (usually /usr/lib/httpd/modules) and rename it to mod_gnutls.so for consistency:

# cp mod_gnutls-0.2.0/src/.libs/libmod_gnutls.so /usr/lib/httpd/modules/mod_gnutls.so

During the compilation, two keys, dhfile and rsafile, have been generated in the mod_gnutls-0.2.0/data/ directory. It is absolutely important to copy these files in httpd’s configuration directory (usually /etc/httpd/conf/), otherwise mod_gnutls will never work. This is undocumented, and I found out about it after some trial&error.

As root:

# cp mod_gnutls-0.2.0/data/{dh,rsa}file /etc/httpd/conf/

Installation is complete.

SSL certificates

In this test installation, two virtual hosts will be used. Thus, two SSL certificates will be required. Please read my article on how to generate SSL certificates for your servers, as this information is beyond the scope of this document. Alternatively, you may use a ready-made script which will create those certificates for you quickly. Such scripts are shipped will almost all Linux distributions. Please consult your distribution’s documentation for more information.

HTTPd Configuration

The configuration of the Apache web server includes two phases:

The configuration of the main server.
The configuration of the virtual hosts.

In the following instructions, some brief notes about what each directive does is included. For more detailed information, please consult the mod_gnutls documentation.

Main Server Configuration

This includes setting some general mod_gnutls options, which will be inherited by all virtual hosts.

But, first of all, httpd needs to be set to listen on port 443 (in addition to port 80). Instead of specifying the SSL port only (Listen 443) which will lead httpd to listen to all the available network interfaces, you may specify the exact network interface on which the server will listen. For example:

Listen 192.168.0.1:443

Next, load mod_gnutls:

LoadModule gnutls_module modules/mod_gnutls.so

Add some MIME-types for downloading Certificates and CRLs from your web sites (taken from the mod_ssl configuration):

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

It is suggested that you use a session cache for mod_gnutls. This will increase its performance. In this example, the dbm cache type is used. This cache type requires a directory where mod_gnutls will actually save SSL session data. So, creating a directory for this purpose and giving ownership to the user that runs Apache (usually apache or www-data) is needed. Assuming that the Apache user is apache, as root issue the commands:

# mkdir -m 0700 /var/cache/mod_gnutls_cache
# chown apache:apache /var/cache/mod_gnutls_cache

Now, back to the Apache configuration. The following directive sets the dbm SSL Session Cache for mod_gnutls:

GnuTLSCache dbm "/var/cache/mod_gnutls_cache"

Set a timeout for the SSL Session Cache entries. Usually, this is set to 300 seconds:

GnuTLSCacheTimeout 300

Finally, specify that on the 192.168.0.1:443 interface and port there will be name-based virtual hosts; that is vhosts that share the specified interface and port:

NameVirtualHost 192.168.0.1:443

Virtual Host Configuration

The example virtual hosts are: v1.example.org and v2.example.org. It is assumed that two SSL certificates with the canonical name (CN) correctly set to each of the aforementioned vhost domains have been generated.

In the following vhost configs, only the absolutely required directives have been used. The rest of the options are inherited from the main server.


    ServerName v1.example.org:443
    GnuTLSEnable on
    GnuTLSCertificateFile /etc/pki_custom/certs/v1.example.org.crt
    GnuTLSKeyFile /etc/pki_custom/private/v1.example.org.key
    DocumentRoot "/var/www/v1/public_html"



    ServerName v2.example.org:443
    GnuTLSEnable on
    GnuTLSCertificateFile /etc/pki_custom/certs/v2.example.org.crt
    GnuTLSKeyFile /etc/pki_custom/private/v2.example.org.key
    DocumentRoot "/var/www/v2/public_html"

Testing the setup

Having finished with the configuration, review the changes, restart the server and check the error logs for any errors.

Use a web browser to visit each of the virtual hosts by using the HTTPS protocol:


https://v1.example.org/

https://v2.example.org/

Until now, the web server did not support the SNI TLS extension. Therefore, when visiting the v2.example.org virtual host, you would see two warnings in your browser. The first one would be because the vhost’s certificate has not been issued by a trusted Certificate Authority – this is normal as it was you who issued that certificate – and the other one because on a server without SNI support it is actually the V1 vhost’s certificate that is used when visiting V2 vhost over https. Remember the limitation with SSL and name-based virtual hosts?

With mod_gnutls, the server supports the SNI TLS extension. Although the virtual hosts are name-based, no matter which one you visit, the relevant certificate for each vhost is used and the only warning you see is the one about the certificates being self-signed. You can get rid of these by purchasing a certificate that is issued by a trusted Certificate Authority.

Conclusion

mod_gnutls works. Actually, it was a real pleasure to see SNI work!

It is important to note though that mod_gnutls is still in experimental phase. Therefore, performance issues should be considered as normal when using it.

At the moment of writing, my server uses Fedora 7 as an operating system. As I haven’t upgraded my desktop to F7 yet and my server does not have any development tools installed, I compiled mod_gnutls on a Fedora 6 system and used it on Fedora 7. I do not know if that was the reason – and I did not have the necessary free time to investigate – or anything else, but, during the use of mod_gnutls, my server’s load average increased significantly.

I will test mod_gnutls again soon and post the new results, if they are different than the ones I present in this article. I highly recommend that you try it, as it is currently the only way to easily achieve SSL-enabled name-based virtual hosts using the SNI TLS extension. Note, that this extension will be supported by openssl 0.99, so the moment that SNI goes mainstream and such a setup becomes easy and cheap to implement with any Linux distribution is close.

One last thing that has not been mentioned at all is about SNI support in web browsers. Currently, with the exception of Safari (this is unconfirmed, please correct me if I am wrong), the latest versions of all major web browsers, Firefox and other Mozilla-based browsers, Internet Explorer, Opera, support SNI.

SSL-enabled Name-based Apache Virtual Hosts with mod_gnutls, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

The Athens Affair – Wiretapping at its best

George Notaras — Mon, 06 Aug 2007 14:52:23 +0000

Today I had the opportunity to read “The Athens Affair” article, a very popular document during the last couple of weeks, written by Vassilis Prevelakis and Diomidis Spinellis. I have enjoyed reading it so much, that I decided to go a bit off-topic on my blog and write a post about it.

In this article, the authors, whose knowledge and competence are undisputed, try and succeed in providing all the technical details of how a major mobile phone wiretapping incident, such as the one that took place in Vodafone Greece‘s servers, can be accomplished. This is probably the most complete article I have read about that cellphone wiretapping incident. I can safely say that it was hundreds of times more informative than any other article I have read in the Greek Press, as it focuses on the technical aspect of the incident without wasting more than the required space with speculation of who might have done it.

I highly recommend that all – not only the Greek readers – read the article. I suggest you download the PDF version from this page, so you can enjoy, together with the excellent content, the creative and informative illustration as well.

More information and links to news sites that host comments about the article can be found in this blog post by Diomidis Spinellis.

The Athens Affair – Wiretapping at its best, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

G-Loaded Journal » Review

Cheap Biometrics – Use Keystroke Dynamics to Identify and Verify Users

Related Articles

Security Guides for Operating Systems by the NSA

Related Articles

Adobe Reader 8 for Linux

Related Articles

Zim – a Desktop Wiki

Related Articles

CloneZilla instead of Partimage

Related Articles

Featured Epiphany Plugins

Related Articles

Mailing List Manager

Related Articles

Next time, come prepared

Related Articles

SSL-enabled Name-based Apache Virtual Hosts with mod_gnutls

Introduction

Installation

SSL certificates

HTTPd Configuration

Main Server Configuration

Virtual Host Configuration

Testing the setup

Conclusion

Related Articles

The Athens Affair – Wiretapping at its best

Related Articles