linux

626 Articles

Starter Guide To Linux Forensics

August 8, 2017 by 11 Comments

The old saying is if your data isn’t backed up at least twice, it’s not backed up at all. For those not wise enough to heed this adage, there are a number of options available to you if you wish your data to be recovered. Assuming the drive itself is just corrupted somehow (maybe a malicious attack, maybe a user error) and not damaged beyond physical repair, the first step is to connect the drive to another computer. If that fails, it might be time to break out the computer forensics skills.

[Luis]’s guide is focused on Linux-specific drives and recovery tools, so this isn’t necessarily a general-purpose how-to. That being said, there is a lot of information in this guide such as how to mount the target drive’s partitions, how to set up various timelines, and which of the Linux system’s logs are important for the forensic analysis. This specific example in the guide also goes into detail about noticing which of the recent files had been accessed, what they might have done, and different approaches to piecing the mystery of this corrupted drive together.

[Luis] points out that the world of Linux forensics is much different from that of Windows, but for anyone looking to get started he suggests starting with a clean Linux install and going from there. There are many other avenues of digital forensics, as well; the field has as many avenues of exploration as there are different types of computers.

Linux Fu: Better Bash Scripting

July 21, 2017 by 85 Comments

It is easy to dismiss bash — the typical Linux shell program — as just a command prompt that allows scripting. Bash, however, is a full-blown programming language. I wouldn’t presume to tell you that it is as fast as a compiled C program, but that’s not why it exists. While a lot of people use shell scripts as an analog to a batch file in MSDOS, it can do so much more than that. Contrary to what you might think after a casual glance, it is entirely possible to write scripts that are reliable and robust enough to use in many embedded systems on a Raspberry Pi or similar computer.

I say that because sometimes bash gets a bad reputation. For one thing, it emphasizes ease-of-use. So while it has features that can promote making a robust script, you have to know to turn those features on. Another issue is that a lot of the functionality you’ll use in writing a bash script doesn’t come from bash, it comes from Linux commands (or whatever environment you are using; I’m going to assume some Linux distribution). If those programs do bad things, that isn’t a problem specific to bash.

One other limiting issue to bash is that many people (and I’m one of them) tend to write scripts using constructs that are compatible with older shells. Often times bash can do things better or neater, but we still use the older ways. For example:

Continue reading “Linux Fu: Better Bash Scripting” →

Linux-Fu: Running Commands

July 7, 2017 by 26 Comments

One of the things that makes Linux and Unix-like systems both powerful and frustrating is that there are many ways to accomplish any particular goal. Take something simple like running a bunch of commands in sequence as an example. The obvious way is to write a shell script which offers a tremendous amount of flexibility. But what if you just want some set of commands to run? It sounds simple, but there are a lot of ways to issue a sequence of commands ranging from just typing them in, to scheduling them, to monitoring them the way a mainframe computer might monitor batch jobs.

Let’s jump in and take a look at a few ways you can execute sequences from bash (and many other Linux shells). This is cover the cron and at commands along with a batch processing system called task spooler. Like most things in Linux, this isn’t even close to a complete list, but it should give you some ideas on ways to control sequences of execution.

Continue reading “Linux-Fu: Running Commands” →

Free As In Beer, Or The Story Of Windows Viruses

July 5, 2017 by 211 Comments

Whenever there’s a new Windows virus out there wreaking global havoc, the Linux types get smug. “That’ll never happen in our open operating system,” they say. “There are many eyes looking over the source code.” But then there’s a Heartbleed vulnerability that keeps them humble for a little while. Anyway, at least patches are propagated faster in the Linux world, right?

While the Linuxers are holier-than-thou, the Windows folks get defensive. They say that the problem isn’t with Windows, it’s just that it’s the number one target because it’s the most popular OS. Wrong, that’d be Android for the last few years, or Linux since forever in the server space. Then they say it’s a failure to apply patches and upgrade their systems, because their users are just less savvy, but that some new update system will solve the problem.

There’s some truth to the viruses and the patching, but when WannaCry is taking over hospitals’ IT systems or the radiation monitoring network at Chernobyl, it’s not likely to be the fault of the stereotypical naive users, and any automatic patch system is only likely to help around the margins.

So why is WannaCry, and variants, hitting unpatched XP machines, managed by professionals, all over the world? Why are there still XP machines in professional environments anyway? And what does any of this have to do with free software? The answer to all of these questions can be found in the ancient root of all evil, the want of money. Linux is more secure, ironically, at least partly because it’s free as in beer, and upgrading to a newer version is simply cheaper.

Continue reading “Free As In Beer, Or The Story Of Windows Viruses” →

Steampunk-Inspired Art Clock!

July 4, 2017 by 6 Comments

Getting paid to do what you enjoy is a special treat. A machinist and fabricator by trade — hobbyist hacker by design — [spdltd] was commissioned to build a mechanical art installation with a steampunk twist. Having complete creative control, he convinced his client to let him make something useful: a giant electro-mechanical clock.

Pieced together from copper, brass, steel, aluminium, and stainless steel, this outlandish design uses an Arduino Yun — a combination Linux and Arduino microcontroller board — to control the stepper motor and query the internet for the local time. Upon boot, the clock auto-calibrates by rotating the clock face until a sensor detects an extra peg and uses that to zero on twelve o’clock; the Yun then grabs the local time over the WiFi and sends the stepper motor a-spinning ’till the correct time is displayed.

At first glance, you may find it hard to get an accurate read of what time it is, but an accent piece’s pegs denote the quarter hour once it lines up with the notch above each hour. At least this one doesn’t require you to match colours or do much math to check the time.

Continue reading “Steampunk-Inspired Art Clock!” →

EV3DEV Lego Linux Updated

June 23, 2017 by 8 Comments

The ev3dev Linux distribution got an update this month. The distribution targets the Lego EV3 which is a CPU Lego provides to drive their Mindstorm robots. The new release includes the most recent kernel and updates from Debian 8.8. It also contains tools needed for some Wi-Fi dongles and other updates.

If you haven’t seen ev3dev before, it is quite simply Linux that boots on the EV3 hardware using an SD card. You don’t have to reflash the computer and if you want to return to stock, just take out the SD card. You can also use ev3dev on a Raspberry Pi or BeagleBone, if you like. There’s a driver framework included for handling sensors, motors, and other items using the file system.

Continue reading “EV3DEV Lego Linux Updated” →

VIM Normalization

June 21, 2017 by 92 Comments

Linux users–including the ones at the Hackaday underground bunker–tend to fall into two groups: those that use vi and those that use emacs. We aren’t going to open that debate up again, but we couldn’t help but notice a new item on GitHub that potentially negates one of the biggest complaints non-vi users have, at least for vim which is the most common variant of vi in use on most modern systems. The vim keybinding makes vim behave like a “normal” editor (and to forestall flames, that’s a quote from the project page).

Normally vi starts out in a command mode that it calls normal mode. Pressing a key will execute an editing command, unlike most other modern editors which just insert characters into the open file. For example, pressing x will delete a character. This surprises most people who aren’t familiar with vi. In all fairness, there are other older editors that work this way, but they usually were not screen-oriented.

Continue reading “VIM Normalization” →