- Talk - lists.gtalug.org

Swap and Hibernate on SSDs
by Giles Orr 28 Jan '18

28 Jan '18

In the early days of SSDs, there was a lot of talk in the Linux community that you shouldn't have a swap partition on an SSD. An indirect side effect of that is that it becomes impossible to suspend-to-disk (aka "hibernate") on a SSD-only system. Although I suppose that you could have the swap partition and set swappiness to 0. So I have a new SSD system, and was wondering the current state of these things: - is it considered okay to have a swap partition on an SSD drive? - how should I set the swappiness? - is it considered okay to hibernate to an SSD? -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

4 3

War Story
by Jonasz, Randall 21 Jan '18

21 Jan '18

A diegesis about my experience moving Windows 10 from a 512GB SSD to a 1TB SSD. I had EaseUS Todo Backup which promised to do the job for me. Alas when I inserted the 1TB disk into my SATA USB connector Windows 10 would not recognize the disk. So I installed the 1TB disk into my laptop and put the 512GB system disk into the adapter. All was good. The BIOS recognized both disks. I then used a bootable USB stick to load up ToDo Easeus Backup. It refused to clone the 512GB drive! What the $%@!. It said the disks were offline. :( Ok, I had enough of wasting time on Windows software. I had a bootable USB stick with Linux handy and loaded that on my laptop. Linux recognized both drives just fine. Thinking like a Linux sysadmin, I used dd command to copy sector for sector from the 512GB drive to the 1GB drive. It completed without an error. Now the moment of truth. I tried to boot Windows. Windows immediately went into recovery mode and wiped out the GPT entries for the first two partitions! Needless to say Windows did not boot. This is now 5am and I resolved not to be defeated by Microsoft! So using another laptop I created a bootable USB stick with Clonezilla; a Debian based distribution which promises to clone drives and partitions. I then booted my Windows laptop into Clonezilla. As expected it recognized both drives. I selected device to device copy with all of the default parameters. After 50 minutes Clonezilla announced the copy to be completed. Now the moment of truth. I booted Windows.....and it worked! I now had Windows 10 running off of my 1TB drive. Alas I still had one problem. Clonezilla was so thorough that it copied the disk geometry in the GPT table from the 512GB disk to the 1TB disk. Windows, being as smart as it is, thought the 1TB disk was only 512GB in size. Even though I should have known better, I tried EaseUS Partition Master to fix the GPT table. It said there was no problem with the disk$#%#$#@%! Back to Linux I went. I booted the Linux live USB again. I started gParted which immediately notified me that the GPT table was reporting the wrong size of the disk. Being a helpful Linux utility it offered to fix the problem for me. I accepted. Back to Windows 10 I went. This time Windows said the disk was 1TB in size. Yay! Now, since I use Bitlocker on my drives, when I went to resize the C drive to occupy the rest of the disk, both Windows 10 and EaseUS Partition Master said it couldn't be done. What the ^$#@! I've done this in Linux many times. Resizing encrypted partitions is not trivial but certainly doable in Linux. So after Googling I realized I had to first turn Bitlocker off. When I tried to do this, Windows 10 notified me it had to decrypt every file on my drives which could take hours. What the %$#@! I left it running and finally went to bed for four hours. When I got up, Windows 10 said Bitlocker was turned off. I then tried EaseUS Partition Master to resize the C drive. It took less than a second for it do so. I now have my 1TB SSD as my main disk in my laptop. Thank goodness Linux was available to save the day er night.A diegesis about my experience moving Windows 10 from a 512GB SSD to a 1TB SSD. I had EaseUS Todo Backup which promised to do the job for me. Alas when I inserted the 1TB disk into my SATA USB connector Windows 10 would not recognize the disk. So I installed the 1TB disk into my laptop and put the 512GB system disk into the adapter. All was good. The BIOS recognized both disks. I then used a bootable USB stick to load up ToDo Easeus Backup. It refused to clone the 512GB drive! What the $%@!. It said the disks were offline. :( Ok, I had enough of wasting time on Windows software. I had a bootable USB stick with Linux handy and loaded that on my laptop. Linux recognized both drives just fine. Thinking like a Linux sysadmin, I used dd command to copy sector for sector from the 512GB drive to the 1GB drive. It completed without an error. Now the moment of truth. I tried to boot Windows. Windows immediately went into recovery mode and wiped out the GPT entries for the first two partitions! Needless to say Windows did not boot. This is now 5am and I resolved not to be defeated by Microsoft! So using another laptop I created a bootable USB stick with Clonezilla; a Debian based distribution which promises to clone drives and partitions. I then booted my Windows laptop into Clonezilla. As expected it recognized both drives. I selected device to device copy with all of the default parameters. After 50 minutes Clonezilla announced the copy to be completed. Now the moment of truth. I booted Windows.....and it worked! I now had Windows 10 running off of my 1TB drive. Alas I still had one problem. Clonezilla was so thorough that it copied the disk geometry in the GPT table from the 512GB disk to the 1TB disk. Windows, being as smart as it is, thought the 1TB disk was only 512GB in size. Even though I should have known better, I tried EaseUS Partition Master to fix the GPT table. It said there was no problem with the disk$#%#$#@%! Back to Linux I went. I booted the Linux live USB again. I started gParted which immediately notified me that the GPT table was reporting the wrong size of the disk. Being a helpful Linux utility it offered to fix the problem for me. I accepted. Back to Windows 10 I went. This time Windows said the disk was 1TB in size. Yay! Now, since I use Bitlocker on my drives, when I went to resize the C drive to occupy the rest of the disk, both Windows 10 and EaseUS Partition Master said it couldn't be done. What the ^$#@! I've done this in Linux many times. Resizing encrypted partitions is not trivial but certainly doable in Linux. So after Googling I realized I had to first turn Bitlocker off. When I tried to do this, Windows 10 notified me it had to decrypt every file on my drives which could take hours. What the %$#@! I left it running and finally went to bed for four hours. When I got up, Windows 10 said Bitlocker was turned off. I then tried EaseUS Partition Master to resize the C drive. It took less than a second for it do so. I now have my 1TB SSD as my main disk in my laptop. Thank goodness Linux was available to save the day er night. Randy Know something about everything and everything about something --John Stuart Mill --- This email has been checked for viruses by AVG. http://www.avg.com

1 0

Carrytel.ca -- 75M/10M at $35/month
by William Park 21 Jan '18

21 Jan '18

I think I posted about Carrytel.ca, about whom I found out about from KWLUG. Today, I switched to Carrytel Cable75 (75M/10M, unlimited, $35/month). That's $25 cheaper than Teksavvy's equivalent. So far, it performs as promised. -- William Park <opengeometry(a)yahoo.ca>

1 0

Shopping for bluetooth headphone... which brand?
by William Park 21 Jan '18

21 Jan '18

To audio experts, I'm shopping for bluetooth headphone (over-ear), and I can't believe the prices. Is there a good brand that you'd recommend at $100 range? -- William Park <opengeometry(a)yahoo.ca>

7 9

xset and DPMS
by Giles Orr 18 Jan '18

18 Jan '18

I have a new monitor that's notoriously prone to burn-in ... This is an IPS monitor, and none of us thought burn-in even existed anymore. But I don't think this is quite the same as what it was with plasmas - in this case, I think the "burn-in" lasts a matter of hours rather than being permanent? I'm not sure because I don't care to experiment. Yes, I knew this before I bought the monitor, but it's other advantages outweighed this problem. And yes - it's an incredibly stupid problem to have with a monitor where things stay in the same place for hours, months, and sometimes years. So one of the computers I attach to it (a middle-aged Chromebook) has Debian stable installed, and I'm running Fluxbox on it. I use this: $ xset +dpms $ xset -q ... # DPMS confirmed on $ xset dpms 240 1800 1800 To turn on DPMS and set the time-outs. But ... every time the screen blanks, it apparently disables DPMS again. This can be confirmed with 'xset -q' again, which now says "disabled." Is this a system setting or service, Debian or Fluxbox or something else that resets itself every time DPMS is activated? I have no such problem under Fedora 26/Openbox. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

3 2

Linus comments on retpoline mitigations
by Russell 17 Jan '18

17 Jan '18

tl;dr "Go forth and test. It all looks pretty solid to me, Linus" https://lkml.org/lkml/2018/1/14/210 -- Russell

1 0

Fwd: Spectre attacks: exploiting speculative execution
by David Collier-Brown 16 Jan '18

16 Jan '18

And another on Spectre --dave -------- Forwarded Message -------- Subject: Spectre attacks: exploiting speculative execution Date: Tue, 16 Jan 2018 06:00:00 +0000 From: adriancolyer <> https://blog.acolyer.org/2018/01/16/spectre-attacks-exploiting-speculative-… Spectre attacks: exploiting speculative execution Spectre attacks: exploiting speculative execution <https://spectreattack.com/spectre.pdf> Kocher et al., /2018/ Yesterday we looked at Meltdown and some of the background on how modern CPUs speculatively execute instructions. Today it’s the turn of Spectre of course, which shares some of the same foundations but is a different attack, not mitigated by KAISER. On a technical front, Spectre is as fascinating as it is terrifying, introducing a whole new twist on ROP <https://blog.acolyer.org/2017/12/06/the-dynamics-of-innocent-flesh-on-the-b…>. This paper describes practical attacks that combine methodology from side-channel attacks, fault attacks, and return-oriented programming that can read arbitrary memory from the victim’s process… These attacks represent a serious threat to actual systems, since vulnerable speculative execution capabilities are found in microprocessors from Intel, AMD, and ARM that are used in billions of devices. Spectre is a step-up from the already very bad Meltdown: * it applies to AMD and ARM-based processors (so works on mobile phones, tablets, and so on) * it only assumes that speculatively executed instructions can read from memory the victim process could access normally (i.e., no page fault or exception is triggered) * the attack can be mounted in just a few lines of JavaScript – and a few lines of JavaScript can easily be delivered to your system from, for example, an ad displayed on a site that you would otherwise trust. … in order to mount a Spectre attack, an attacker starts by locating a sequence of instructions within the process address space which when executed acts as a covert channel transmitter which leaks the victim’s memory or register contents. The attacker then tricks the CPU into speculatively and erroneously executing this instruction sequence… Let’s play tennis You’re watching an epic clay-court tennis match with long rallies from the baseline. Every time the ball is received deep in the forehand side of the court, our would-be-champion plays a strong cross-court forehand. Her opponent plays the ball deep into the forehand side of the court once more, and almost reflexively starts moving across the court to get into position for the expected return. But this time her speculative execution is in vain — the ball is played down the line at pace leaving her wrong-footed. By forcing a branch misprediction the now champion tennis player has won the point, game, set and match! Spectre exploits speculative execution of instructions following a branch. Inside the CPU, a /Branch Target Buffer/ (BTB) keeps a mapping from addresses of recently executed branch instructions to destination addresses. The BTB is used to predict future code addresses (“it’s going to be a cross-court forehand”) even before decoding the branch instructions. Speculative execution of the predicted branch improves performance. Attack foundations Consider this simple code fragment: if (x < array1_size) y = array2[array1[x] * 256]; On line 1 we test to see whether |x| is in bounds for |array1|, and if it is, we use the value of |x| as in index into |array1| on line 2. We can execute this code fragment lots of times, always providing a value of x that is in bounds (the cross-court forehand). The BTB learns to predict that the condition will evaluate to true, causing speculative execution of line 2. Then, wham, we play the forehand down-the-line, passing a value of x which is out of bounds. Speculative execution of line 2 goes ahead anyway, before we figure out that actually the condition was false this time. Suppose we want to know the value of sensitive memory at address $a$. We can set |x = a - (base address of array1)| and then the lookup of |array1[x]| on line 2 will resolve to the secret byte at $a$. If we ensure that |array1_size| and |array_2| are not present in the processor’s cache (e.g., via a clflush) before executing this code, then we can leak the sensitive value. When the code runs… 1. The processor compares the malicious value of |x| against |array1_size|. This results in a cache miss. 2. While waiting for |array1_size| to be fetched, speculative execution of line 2 occurs, reading the data, $k$, at the target address. 3. We then compute |k * 256| and use this as an index into |array2|. That’s not in the cache either, so off we go to fetch it. 4. Meanwhile, the value of |array1_size| arrives from DRAM, the processor realises that the speculative execution was erroneous in this case, and rewinds its register state. But /crucially, the access of array2 affects the cache as we saw yesterday with Meltdown/. 5. The attacker now recovers the secret byte $k$, since accesses to |array2[n*256]| will be fast for the case when $n = k$, and slow otherwise. You can even do this from JavaScript, using code like this: (Enlarge <https://adriancolyer.files.wordpress.com/2018/01/spectre-js.jpeg>) Note that there’s no access to the |clflush| instruction from JavaScript, but reading a series of addresses at 4096-byte intervals out of a large array does the same job. There’s also a small challenge getting the timer accuracy needed to detect the fast access in |array2|. The Web Workers feature of HTML5 provides the answer – creating a separate thread that repeatedly decrements a value in a shared memory location yields a timer that provides sufficient resolution. For a C code example, see appendix A in the paper. Unoptimised, this code can read about 10KB/second an an i7 Surface Pro 3. The art of misdirection With /indirect/ branches we can do something even more special. An indirect branch is one that jumps to an address contained in a register, memory location, or on the stack. If the determination of the destination address is delayed due to a cache miss and the branch predictor has been mistrained with malicious destinations, speculative execution may continue at a location chosen by the adversary. This means we can make the processor speculatively execute instructions from any memory location of our choosing. So all we have to do, as in the gadgets of Return-Oriented Programming <https://blog.acolyer.org/2015/12/01/rop/> (ROP), is find some usable gadgets is the victim binary. … exploitation is similar to return-oriented programming, except that correctly-written software is vulnerable, gadgets are limited in their duration, but need not terminate cleanly (since the CPU will eventually recognize the speculative error), and gadgets must exfiltrate data via side channels rather than explicitly. In other words, this is an even lower barrier than regular ROP gadget chaining. Code executing in one hyper-thread of x86 processors can mistrain the branch predictor for code running on the same CPU in a different hyper-thread. Furthermore, the branch predictor appears to use only the low bits of the virtual address: “/as a result, an adversary does *not* need to be able to even execute code at any of the memory addresses containing the victim’s branch instruction./” A Windows example A proof-of-concept program was written that generates a random key the goes into a infinite loop calling |Sleep(0)|, loading the first bytes of a file, calling Windows crypto functions to compute the SHA-1 hash of the key and file header, and then prints out the hash whenever the header changes. When compiled with optimisation flags, the call to |Sleep(0)| will be made with file data in registers |ebx| and |edi| (normal behaviour, nothing special was done to cause this). In |ntdll.dll| we find the byte sequence |13 BC 13 BD 13 BE 13 12 17|, which when executed corresponds to: adc edi, dword ptr [ebx+edx+13BE13BDh] adc dl, byte ptr [edi] If we control |ebx| and |edi| (which we do, via the file header), then we can control which address will be read by this code fragment. Now the first instruction of the sleep function is |jmp dword ptr ds:[76AE0078h]|, which we can target for branch mistraining. (The actual destination changes per reboot due to ASLR). * Simple pointer operations were used to locate the indirect jump at the entry point for sleep, and the memory location holding the destination for the jump * The memory page containing the destination for the jump was made writable using copy-on-write, and modified to change the jump destination to the gadget address. Use the same method, a |ret 4| instruction was written at the location of the gadget. (These changes are only visible to the attacker, not the victim). * A set of threads are launched to mistrain the branch predictor. This is a bit fiddly (see the details in section 5.2), but once an effective mimic jump sequence is found the attacker is able to read through the victim’s address space. Variations and mitigations Spectre is not really so much an individual attack, as a whole new class of attacks: speculative execution may affect the state of other microarchitectural components, and virtually any observable effect of speculative execution can lead to leaks of sensitive information. Timing effects from memory bus contention, DRAM row address selection status, availability of virtual registers, ALU activity, and the state of the branch predictor itself need to be considered. The conditional branch vulnerability can be mitigated if speculative execution can be halted on potentially-sensitive execution paths… Indirect branch poisoning is even more challenging to mitigate in software. It might be possible to disable hyperthreading and flush branch prediction state during context switches, although there does not appear to be any architecturally-defined method for doing this. Anything we can do in software or microcode though, should at best be seen as stop-gap countermeasures pending further research. The last word The vulnerabilities in this paper, as well as many others, arise from a longstanding focus in the technology industry on maximizing performance. As a result, processors, compilers, device drivers, operating systems, and numerous other critical components have evolved compounding layers of complex optimizations that introduce security risks. As the costs of insecurity rise, these design choices need to be revisited, and in many case alternate implementations optimized for security will be required.

1 0

Fan Control on Linux
by Giles Orr 15 Jan '18

15 Jan '18

I have a very old laptop I'm trying to rehabilitate and use with Debian: it's got an AMD Turion chip and 1G of RAM. Works fine. But one annoying problem under Linux: the fan runs flat out all the time. If the 'sensors' command is correct, the CPU has never gone above 35C, so the fan isn't running like that because of the heat. I also used this machine recently to run Darik's Boot And Nuke (aka "DBAN") on a hard drive: that's a Linux kernel, and the fan wasn't running full out. Not sure what that proves, except that the fan doesn't have to run full out under a Linux kernel. I've installed "lm_sensors," I've installed "fancontrol", I've run 'lmsensors-detect' (which is 'sensors-detect' under Fedora and Ubuntu - I've tried three Linux OSes with essentially identical results). I've run 'pwmconfig' which tells me "There are no pwm-capable sensor modules installed." I've written a file into /etc/sensors.d/fan-speed-control.conf that said this: chip "k8temp-pci-*" set fan1_div 4 (This last at the suggestion of ArchWiki, which says reducing the fan multiplier can make it accessible to Linux.) But running 'sensors -s' to reload the config is greeted with "Error: File /etc/sensors.d/fan-speed-control.conf, line 2: Unknown feature name k8temp-pci-00c3: No such subfeature known." On an off-chance I tried "fan0_div" and "fan2_div" but same answer. This has exhausted most of the mainstream remedies suggested by Google. At this point I'm stumped: can anyone else suggest ways to get a handle on this fan? -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

6 6

January 2018 talk recording is available on youtube
by Alex Volkov 15 Jan '18

15 Jan '18

Hi everyone, January 2018 presentation is up on youtube. Play it again, Sam (record and replay tools for load testing) by David Collier-Brown https://youtu.be/KzrIZQx3oAE Alex.

1 0

Netflix Recommendation - HCF
by R360 Design INC 15 Jan '18

15 Jan '18

Hello everyone, Wanted to recommend the AMC Series "Halt and Catch Fire" on Netflix. For those who haven't heard of it, it is an American period drama that depicts a fictionalized insider's view of the personal computer revolution of the 1980s and later the growth of the World Wide Web in the early 1990s. It offered an insider's glimpse into the power struggles from Silicon Prairie of Dallas–Fort Worth to Silicon Valley. r360design.ca

5 6