I live in the Midwest - Northern IN/IL area to be exact.  Early January is usually a time for snow.  Here are a few pictures of the snow we got on New Years Eve.  Typical of this area.

But a week later, mother nature had other plans.   A member of my storm chasing team, Tony, started to warn me of a possible storm system and to ready the storm chasing equipment.  Honestly, I didn’t give that statement much weight because it was January.  He said it will happen on January 7.  Even that morning, I checked SPC’s daily forecast, this is what it was:

It wasn’t very encouraging.  It seemed that the NWS wasn’t prepared for a winter severe weather event.   Later that day, the SPC did issue a Slight Risk, but that was far too south for us to reach.  It wasn’t until their afternoon outlook that they iussued a wide-spread Slight Risk.

That was good enough for me.  We hit the road shortly after that outlook was published.  It took me so long to write up a post about it, so I don’t remember that much about it.  What I do remember was that it was like Spring.  It was well in the 60s and humid.  The funniest thing was that we still saw snow in some of the ditches and Christmas decorations on some houses…and we were chasing storms.  When we got to our destination, it was already starting to get dark (remember, It’s January), so the pictures weren’t very impressive.  We did not see any tornadoes, just the usual wall clouds.  It turned out that 75 tornadoes touched down before the day was over.  Kudos to Tony that predicted it way ahead of the SPC, and if this is a sign of things to come this Spring, hold on your your hats.

I will start out with the most common mistake that I see:

SELECT * FROM Users WHERE user = $_POST['user'] && password = $_POST['password']

The query above in itself is correct. Assuming the HTML form posts the correct data, the query will correctly process the information and find whether the website user provided the correct credentials to sign in to their account.

…but what if I, being the malicious user that I am (not really), inserted the following data?

User: admin
Pass: something’ or ‘x’='x

That would make the query equal to this:

SELECT * FROM Users WHERE user = ‘admin‘ && password = ‘something’ or ‘x’='x‘

Since ‘x’ always equals ‘x’, the following query would grant me access as the user, admin! It sound like a simple attack, and surely web database programmers know to protect themselves from attacks like this. The sad truth is that this happens all the time.

If you are a programmer that writes SQL queries, I hope you know about this method of exploitation. If you don’t, please, please, please read over the following articles, because it’s critical to write queries that go beyond “just working”. You must make them secure.

Further Reading

Typing “sql injection” into Google returns several good articles, and here are a few of them that are worth reading over.

SQL Injection Attacks by Example - The people from unixwiz.net were asked to review an intranet site for a customer. The site had some exploitable areas, and they show what steps they took to compromise an admin-level account. It’s very interesting to know what malicious users go through to gain unauthorized access to your site. By knowing this, you can help keep them out.

SQL Injection - A definition and couple examples from Wikipedia.

Exploits of a Mom - Ok, so it’s not an informative article, but it’s funny.

1. The first task is to create a user for our test version of Firefox. Click on the System (Gnome Menu) -> Administration -> Users and Groups.
2. Click on Add User.
3. Type in ‘fftest’ for the user name and choose a password. Then, click OK.
4. Fire up a terminal, su into your new user and go to your home directory by typing the following commands.
   

   su fftest
   cd ~

5. Download Firefox 3.0b2:
   

   wget http://ftp-mozilla.netscape.com/pub/mozilla.org/firefox/releases/3.0b2/linux-i686/en-US/firefox-3.0b2.tar.bz2

6. Extract the archive.
   

   tar -jxvf firefox-3.0b2.tar.bz2

7. Type in this command to tell Firefox not to use an existing session.
   

   export MOZ_NO_REMOTE=1

8. Start Firefox
   

   ./firefox/firefox

9. If you get an error like this…
   

   Xlib: connection to “:0.0″ refused by server
   Xlib: No protocol specified

   (firefox-bin:5160): Gtk-WARNING **: cannot open display:

   …that means that you need to let the ‘fftest’ user launch applications that interface with the current GUI. In order to do that, you will need to fire up a new terminal that is under your desktop user, and type in the following command:

   xhost +local:fftest

   Then start Firefox again.

   ./firefox/firefox

10. You should now see the Firefox start page.
    
    This Firefox session is completely independent from your current version, you can run them side-by-side.
    
    
11. Repeat steps 7-10 to run Firefox 3.0b2 in the future. When you are done testing, just delete the user ‘fftest’.

If you find any issues or problems with this tutorial, please contact me or post a comment.  I always want to ensure that I’m posting accurate instructions.
Reference: http://www.captain.at/firefox-run-different-versions.php

I will show you how to do this using Ubuntu 7.10 using the Generic desktop kernel. This tutorial can probably be adapted to other Linux/Unix distros. I tried it with the Ubuntu server kernel, but had no success. If you can get it, please post how you did it.

Setting it Up

1. Plug in your USB CM19a Module. Then fire up a terminal and type:
   

   dmesg

   The last several lines should look like this:

   [ 4037.694734] usb 1-2.2: new low speed USB device using uhci_hcd and address 6
   [ 4037.834968] usb 1-2.2: configuration #1 chosen from 1 choice
   [ 4038.121493] input: X10 Wireless Technology Inc USB Transceiver as /class/input/input7
   [ 4038.123803] usbcore: registered new interface driver ati_remote
   [ 4038.124444] /build/buildd/linux-source-2.6.22-2.6.22/drivers/input/misc/ati_remote.c: Registered USB driver ATI/X10 RF USB Remote Control v. 2.2.1
   [ 4038.128544] /build/buildd/linux-source-2.6.22-2.6.22/drivers/input/misc/ati_remote.c: Weird data, len=1 ff 00 00 00 00 00 …
   [ 4038.212107] lirc_dev: IR Remote Control driver registered, at major 61
   [ 4038.235359]
   [ 4038.235365] lirc_atiusb: USB remote driver for LIRC $Revision: 1.61 $
   [ 4038.235379] lirc_atiusb: Paul Miller <pmiller9@users.sourceforge.net>
   [ 4038.276958] usbcore: registered new interface driver lirc_atiusb

   The important thing to note is that it is using the “lirc_atiusb” driver. This doesn’t work with this device. We need to find a better one.

2. Download X10MMS and extract it.
3. Go back to your terminal, and cd into that extracted directory.
4. As per the instructions in the software’s readme file, run the following commands:
   

   sudo make
   sudo make install
   sudo modprobe x10-cm19a

   We’re not done yet. If you were to plug in your device, and run dmesg again, you would notice that it’s still running that pesky lirc_atiusb driver, so let’s blacklist it.

5. Type in a terminal:
   

   sudo gedit /etc/modprobe.d/blacklist

6. Then add to the end of the file:
   

   # causes the custom cm19a driver to fail
   blacklist lirc_atiusb

7. Type in a terminal:
   

   sudo rmmod lirc_atiusb

8. One last thing…this step allows all users to access the device. Some may say this is a security risk, but I don’t want to be root to use it.Type in the following command to open the udev rules file:
   

   sudo gedit /etc/udev/rules.d/40-permissions.rules

9. Add the following to the end of the file:
   

   KERNEL==”cm19a0″, MODE=”0666″

10. One last commad to run:
    

    sudo chmod 0666 /dev/cm19a0

11. You’re done, yay! Now it’s time to test it out. Remember, this driver only provides an interface to the module. You will have to write your own software / scripts / cron jobs to make it useful.The interface works by sending strings to it. To turn on A1, we send +A1 to it. To turn off C4, we send -C5 to it. In practice, type in the following command to turn on A1:
    

    echo +A1 > /dev/cm19a0

    Hopefully, your transeiver module will turn on.

Troubleshooting

If your test commands are not working, make sure that the driver is being loaded properly. Disconnect the module, wait a few seconds, and reconnect the device. Then type this in a terminal:

dmesg

The last several lines should look like this:

[ 7110.487961] usb 1-2.2: new low speed USB device using uhci_hcd and address 12
[ 7110.629155] usb 1-2.2: configuration #1 chosen from 1 choice
[ 7110.632117] x10-cm19a: Probing x10-cm19a…
[ 7110.632136] x10-cm19a: Found input endpoint: 81, and output endpoint: 2
[ 7110.637872] x10-cm19a: freeing buffer in callback (0xd78eb0c0/0×178eb0c0)
[ 7111.197615] x10-cm19a: freeing buffer in callback (0xd78eb0c0/0×178eb0c0)
[ 7111.197863] x10-cm19a: X10 CM19A USB RF Transceiver connected.
[ 7111.197870] x10-cm19a: X10 CM19A USB RF Transceiver initialized to listen for remote controls.
[ 7111.205631] x10-cm19a: freeing buffer in callback (0xd78eb0c0/0×178eb0c0)

If they don’t, make sure you followed all the steps. If you didn’t understand one of them, please post a question.

More Information

A couple of tips were taken from Dan at Zenlike.ca -> Another homebrew Linux X10 Dawn simulator

The software driver mentioned in this entry can be found here -> X10MMS

Checking your Inventory

Before we can go on, here are the supplies you will need to get the ball rolling.

1. CM17a Firecracker Module.
   These can be bought from x10.com or eBay.
2. X10 Transceiver (TM751 or RR501)
3. Lamp Module (LM465) or Appliance Module (AM466)
   Note: The X10 Transceiver also functions as an appliance module.
4. Palm Pad Remote (HR12a)
   The remote is optional since we will be using our computer to send commands.

If you need to purchase all items in the list above: consider purchasing a bundle kit, like the CK18A 4 Piece Home Kit.

The items listed above are the minimum to get your X10 home automation started. If you are looking for more geeky automation toys, go to x10.com. Be careful though, it’s easy to spend money on cool stuff like this.

Installing the Software

I use Heyu to control my devices. It’s a simple command-line tool that you can easily integrate into a front-end, or use it as-is out of the box. Combining the command line tool with cron jobs is enough to make it worth it.

Download a copy of the software at Heyu’s Download Page. This is software that you will have to download and compile yourself. If you are used to deb packages and RPM’s, don’t worry. It’s not bad. Download the software and extract it. Fire up a terminal window and cd to that directory. Follow the Quickstart instructions in the INSTALL text file.

Testing the Interface

Now is the time to connect the hardware. Connect the firecracker interface to your primary serial port and connect your other modules. Make note of the house code that you set and the unit code. The house code is the code that all of your devices will adhere to. For example, if your transceiver is on house code D, then all of your devices have to have house code D. I recommend not using A because the Smith’s next door might be too lazy to switch it off of the default as well. The unit code is the unit’s unique ID. Make note of what you set on that as well.

For the purpose of this tutorial, I will be using house code A. Please change accordingly as you read through this.

Once you have everything ready to go, fire up a terminal on your computer with the interface, and type in the following:

heyu fon A1

Then type:

heyu foff A1

If you did everything correctly, you should have heard your transceiver switch on and off. (assuming your transceiver was off to begin with)

Understanding the Command

The two commands above are simple commands using the heyu program. View the man page of the ‘heyu’ command to see all others.

For example, if I wanted to turn off the appliance that has the unit code ‘6′ and is on house code ‘A’, I would type this:

heyu foff A6

If I wanted to dim a lamp that was already on that has the unit code ‘7′ and house code ‘A’, I would type this:

heyu fdim A7

Simple, no?

Extend the Knowledge

Now that you know how the program works, it’s time to put it to use. Since, these methods of implementation are beyond the scope of this article, I will only be providing the ideas, not a step-by-step. If you need help on the implementation of some of these ideas, please post a question in the comments area, and I will expand on it in another post.

Cron Jobs: Use simple cron jobs to time lights or appliances in your house such as lamps, Christmas lights, etc.

Web Interface: Forgot to turn on your porch light? Now you can from work, your Internet-enabled PDA, wherever! If your server has web server capabilities, make a PHP/HTML front-end to your home’s devices. Here is an example of how you can do it in PHP: X10 PHP Example

Have others? Post it in the comments section below.

Desktop Effects

I didn’t come to Ubuntu to be wowed with eye candy, but I confess it is currently enabled on my computer…because it’s really cool and far surpasses Vista’s eye candy. I ran both Compiz and Beryl in previous versions of Ubuntu with little success. It crashed often and lagged the rest of the time due to poor driver support. Now, it runs good enough for me to have it enabled all the time. I have a GeForce FX 5200 w/ 128M video memory on an Athlon 3200+ computer. (More on video performance in the restricted drivers section.)

Restricted Drivers

If you’ve been using Ubuntu for a while, I’m sure you know all to well about restricted / closed source drivers. If you were looking for an easy way to get your restricted video driver installed easily, Envy or Automatix probably rings a bell. Thankfully, third party software is no longer needed to install restricted drivers. Although this utility was present in previous versions, more drivers and components are supported. I installed this on my laptop, and it showed restricted drivers for both my wireless adapter and modem. No more configuring ndiswrapper for me! Here is a screenshoot of how simple it is to get my nvidia card working. All I had to do was check the box.

New nVidia Driver

Apparently, a new nVidia driver was included with this release: version 100.14.19. Desktop effects and general video performance has improved dramatically with this new driver. The black window bug was also supposedly resolved in this version although it does come back to haunt me every once in a while, but it’s tolerable. I’m probably pushing it with my 128M card and need to get one with more memory.

Restricted Software

Before it was a nightmare to get restricted extras such as a flash plugin or codecs to work properly. In this version, I fired up Firefox and went to a flash site, and Firefox installed the flash plugin by itself! I was amazed!! On top of that, if you want codecs, DVD support, mp3 support, etc., all you need to do is install the one package that makes Automatix obsolete: ubuntu-restricted-extras. Install it on your computer using apt-get or find the package by using the Add/Remove application.

Graphical Display Utility

Unfortunately, this one is a disappointment. It was hyped that the graphical utility was going to eliminate the need to hack the xorg.conf file, but the utility lacks the options it needs. When I installed Ubuntu 7.10 on my desktop (fresh install), using the graphical utility broke my desktop effects because it messed something up. The only way I was able to get it working was by restoring my old config file with the previous version. Oh well, I’m sure it will be made more powerful and usable in the next version.

Themes

This may be trivial, but I do not like the original Ubuntu theme. I don’t like the brown/tan look, so I always switch it to a blue theme. It’s not necessarially issue because it could be changed. I should note, however, that themes can turn new users away. When I was a Linux newbie, I preferred Fedora over Ubuntu because it has a better mouse busy cursor. (Fedora has that animated blue ball flying around the cursor, while Ubuntu has a cheap-looking Ajax whirly thing). Nothing against Fedora, but I learned to like Ubuntu better because the package manager is easier to use with dependencies and such, and I quickly found the Fedora cursor theme to install on my Ubuntu machine.

Conclusion

Although I will admit that Windows still has the edge in the desktop market in terms of user-friendliness, Ubuntu is catching up, and they already have me preferring Ubuntu over other OS’s. I was excited to install this since the day it came out. I’ve also had a copy Windows Vista Business that I got through my University for $10. I have yet to install it. I’m only going to install it when my clients start using it and call me with their problems. Oops, I just made it a Win vs. Linux article.

Change the Icon Sizes

1. Open a Nautilus window. The easiest way to do that is by clicking on Places -> Home Folder from your main Gnome menu.
2. Click on Edit -> Preferences in that Nautilus window.
3. Adjust the Icon View Defaults percentage accordingly.

Change the Font Sizes

This will change the font sizes on Gnome globally.

1. Click on System -> Preferences -> Appearance from your Gnome menu.
2. Click on the fonts tab.
3. Click on the Details… button.
4. Change the value in the Resolution box.

Easy Way

The easiest way is to install gtweakui. If your scared of the terminal, click on Applications menu, and then Add/Remove. Type ‘gtweakui’ in the search box.

If you are not afraid of the terminal, run this command to install gtweakui:

sudo apt-get install gtweakui

This will install four front-end config windows. You can view them all, but we are only concerned about one of them. Click on System -> Preferences -> gTweakUI - Nautilus. Check as needed and close the window.

Hard but More Options Way

The more difficult but more options way would be to fire up the gconf-editor. Hit Alt+F2 on your keyboard and type in gconf-editor.

Follow this path: apps -> nautilus -> desktop. Check boxes as needed.

If you selected all the check boxes, your desktop should have these (or similar):

1. Do not install software unless it is completely necessary. Extra software slows down your system. If you don’t need it, don’t install it. In fact, go into your control panel, select ‘Add/Remove Programs’, and remove any programs that you don’t use. Make sure that you don’t need it before removing it or consult an IT specialist to be sure.
2. Do not install toolbars. If a program requests permission to install a toolbar in your version of MS Internet Explorer, just say no. Most toolbars contain spyware and malware that will slow your system down.
3. Keep your startup programs to a minimum. Look in your system tray and see all the icons there (small little icons next to your system clock). Chances are, there are several programs that you don’t even know about. Configure those programs so that they do not run at startup (check that program’s documentation or consult an IT specialist).
4. Defragment your drive regularly. Run the defragment utility by going to Start > Programs> Accessories > System Tools about once a month. This makes sure that your hard drive files are in order and they can be accessed quickly.
5. Keep your anti-virus and anti-spyware software up to date. I recommend AVG Anti-Virus for Windows computers. They have a free version for personal use as well as inexpensive versions for companies. I also recommend Adaware and Spybot Search & Destroy to keep spyware off your computer. Always remember to keep these programs up to date as well.
6. Be careful of the websites you visit. Viruses and spyware can enter your computer through websites that have malicious code in them.
7. Configure your computer for automatic updates. I don’t like Microsoft automatically updating any system, but is the best way to keep your computer secure. Go into your control panel and click on Automatic Updates. Adjust those settings accordingly.