I have a couple of devices at home that provide http servers on my local network. I have them tucked nicely behind my firewall so that they are not accessible from the outside, but occasionally, I would like to login to them to perform some reconfiguration or the like. This is where ssh comes to the rescue: you can use it to create a secure tunnel, a port that I can connect to on my local machine that gets routed to my remote machine through my firewall.

The problem is, I can never remember the command, and it takes me a few minutes of thought to reconstruct it. So, I thought I’d write it down here so I’d remember.

The basic command is:

ssh -f mylogin@myserver.com -L 20000:192.168.1.132:80 -N

When I enter http://localhost:20000 on my machine, it’s as if I was accessing the web page on 192.168.1.132 on my local network. Very useful.

I’ve been interested in TEMPEST and related technologies for a while. Here’s another link to another paper:

This project investigates a novel eavesdropping technique for spying at a distance on data that is displayed on an arbitrary computer screen, including the currently prevalent LCD monitors. Our technique exploits reflections of the screen’s optical emanations in various objects that one commonly finds in close proximity to the screen and uses those reflections to recover the original screen content. Such objects include eyeglasses, tea pots, spoons, plastic bottles, and even the eye of the user.

We have demonstrated that this attack can be successfully mounted to spy on even small fonts using inexpensive, off-the-shelf equipment (less than 1500 dollars) from a distance of up to 10 meters. Relying on more expensive equipment allowed us to conduct this attack from over 30 meters away, demonstrating that similar attacks are feasible from the other side of the street or from a close-by building. We additionally establish theoretical limitations of the attack; these limitations may help to estimate the risk that this attack can be successfully mounted in a given environment.

Compromising Reflections

I’ve bitched before about CSI and their use of “video enhancement” to read displays and the like using low resolution security cameras reflecting off objects. It’s interesting to see what is actually possible using this basic idea though. Link courtesy of Bruce Schneier’s security blog:

Schneier on Security: Spying on Computer Monitors Off Reflective Objects

Matt Blaze and company have a new paper just out entitled Signaling Vulnerabilities in Wiretapping Systems, which details a number of problems with the methods and equipment normally used by law enforcement to tap phone equipment. These include vulnerabilities that allow the surveilled party to make it appear to call numbers other than the one reached, to disable recording of specific calls and to just generally make it hard for tappers. Interesting stuff, and using relatively straightforward ideas and methodology.

Matt is a remarkable guy, I particularly liked his paper Safecracking for the computer scientist.

Slashdot pointed at this kind of cool article on how the hidden code on the Xbox was hacked. I thought it was pretty cool and illuminating.

Boing Boing documents the quick imposition and then reversal of a cell phone ban in the Lincoln and Holland tunnels in NY. Apparently they were concerned over the risk that remotely detonated devices presented, but (as the NYPD apparently pointed out) the idea of having a place where people cannot use their cell phones to inform fire, police or other agencies of emergency situations inside the tunnel is not not without its risks either.

Courtesy of Scoble’s blog, here is a post concerning “Low Rights Internet Explorerer”:

IEBlog : Clarifying Low-Rights IE

Low-rights IE will only be available in Longhorn because it’s based on the new Longhorn security features that make running without Administrator privileges an easy option for users (User Account Protection). When users run programs with limited user privileges, they are safer from attack than when they run with Administrator privileges because Windows can restrict the malicious code from taking damaging actions.

My, that does sound innovative. Kind of like running IE inside a jail or something, maybe with an isolated directory, It’s good to see that Microsoft is on top of things.