Wi-Fi and the Kindle

A lot of people are running into trouble getting their Kindle to connect to wi-fi networks - generally problems with "passwords". In many cases, it's confusion over exactly what password is required. Let's look at typical home wireless networks first:

Home Wireless Networks

Most people set up their home network using one of two different types of device;. They might have a wi-fi access point like the NetGear WG602, particularly if they already have some other devices to provide their Internet connection. Or they might have a wireless router, like the NetGear DG834G, which combines the wireless access point with a router (and perhaps also an ADSL or cable modem), all in the one box. Now, to the "passwords":

A home network wi-fi access point has two (2) different "passwords"; a wireless router has three (3). These are:

1) the administration password
2) the wireless network encryption key
3) the login name and password to authenticate to your ISP

Taking each of these in turn:

1) Admin password. This lets you log in to the access point or router through a browser interface and administer it (change settings, etc.) When you log in to the device, you will see something like the screenshot below. Your Kindle and other network devices do not need to know this password.


Fig 1. The login prompt for a NetGear WG602 wireless access point

2) Wireless encryption key. This is used to encrypt the wireless traffic so that bad guys can't sniff it and see what you're doing, or join your network and use your Internet connection to download pr0n, leaving you with explaining to do when the Feds come knocking. The key is really a long binary number, but because humans aren't very good at choosing - let alone remembering - long binary numbers, wireless devices also have an option that will turn a passphrase (not necessarily word) into the key. All devices that connect to the wireless network have to use the same key or passphrase, including any Kindles.

This passphrase is set when you configure the wireless side of your router, as shown here. Other things you should note are your network name or SSID, and the type of encryption in use - I recommend WPA2 with Pre-Shared Key (WPA2-PSK) as WEP and WPA are easily crackable.


Fig 2. Wireless settings on a NetGear DG834G wireless ADSL router.

For WPA2, the key is 256 bits long, and some routers will let you directly enter it as a string of 64 hexadecimal digits (that is, the digits 0-9 and a-f [upper or lower case]). However, you can enter a passphrase of up to 63 characters, and the router's logic will combine that with your network name (technically known as the SSID) in order to generate the 256-bit key. Because the SSID is also used in this process, it's a good idea to choose an unusual SSID (not the default, for sure) and then a passphrase of as few as 16 characters will keep you adequately secure.

Keeping the passphrase short is a good idea when you have to enter it into devices like the Kindle, where the keyboard isn't the greatest or there's no keyboard at all. Entering the 64-hex-digit key directly probably isn't a great idea, because not all devices can support that - it's best to stick with the passphrase technique.

But remember: it's still generating an encryption key, and it's best to keep calling it that to distinguish it from the other passwords involved.

[For the technically-minded, the way the router generates the key is using an algorithm called PBKDF2 (Password Based Key Derivation Function 2), which applies the keyed HMAC-SHA1 function 4096 times over, using the SSID as salt, which makes rainbow tables attacks infeasible].

If you didn't set up your encryption key (good grief, why not? It's your network!) then you might find the default value on a label attached to the bottom of the device. But it's good practice to come up with your own passphrase/key.

3) Routers also have a username and password which authenticates the router to your Internet service provider via your cable or ADSL connection. No other devices need to know this information.

So there you have it. Make sure all these bits of information are written down somewhere and stuck in the book where you record all your important computer information. And, notice, the Kindle only needs item 2), the WEP/WPA/WPA2 encryption key, which you will usually enter in the form of a passphrase (though I still insist on calling it a key. Because that's what it is).

To set up the Kindle, press "Home", "Menu" and then select "Settings". The Kindle may ask if it's OK to turn wireless on - click "OK". A list of visible wi-fi networks will appear, and you should see your own, with the SSID that you set up on your access point or router. Select it and you will be prompted to enter the WPA2 passphrase discussed above. Your Kindle should now connect.

Your network might not appear because it is set to not broadcast its SSID (a weak security measure). If that's the case, then use "enter other Wi-Fi network" to enter its SSID and password. Generally, the Kindle will detect the type of encryption being used, but you can also click on the "advanced" button and set that manually.

Public Networks

Many coffee shops, libraries and other public spaces now offer free wi-fi to customers. Generally, the Kindle will connect automatically - just use "Home", "Menu", Settings", "Wi-Fi Settings" and look for the network by name.

Sometimes such networks require you to indicate acceptance of their terms and conditions, and they do this by getting you to click on a button on a web page. Until you do this, the wi-fi connection will not work. In some cases, the Kindle detects this and will pop up a little message that asks you if you want to use the browser to connect to the network - you should do this and read the resulting page, then navigate to and click on the button.

Company networks, university wi-fi networks and others may also require you to have an account and log in, via user name, student ID and password. Again, the Kindle usually detects this and will offer to start the browser. It attempts to load the Amazon home page, but this will be redirected to the enterprise network authentication page, and you will need to navigate to the right fields and enter your credentials in order to log in. Once this has been done, the browser then usually proceeds to load the Amazon page; at this point, you can either continue web surfing or press "Home" and proceed to sync, download books or whatever you need to do.

The important point is that for some, semi-private, networks you cannot sync and cannot download books, periodicals, etc. until you have authenticated through the browser. So if the Kindle is not downloading properly, it's generally a good idea to see what the browser is showing.

Other Problems

Generally, attention to the above points - especially correct setup of a WPA2 key - will get your Kindle connected. However, occasionally it may fail to connect. Here's some general advice:

Disable MAC filtering. It does no good at all from a security perspective, since an attacker can observe which MAC (Media Access Control) addresses are in use on your network and set his device to use one of them, thereby bypassing that particular defense. Really, it does no good and just makes work for you, the network owner.

If you have an older N-type router or access point, make sure that you upgrade to the latest firmware for it. Many manufacturers announced and shipped "N" devices before the IEEE 802.11n standard was ratified, with the intention of fixing any incompatibilities later, with firmware upgrades. Also make sure that it supports both 20 and 40 MHz channel widths - 802.11b/g devices use 20 MHz only, so if the router is set to 40 MHz only, it will not be compatible. So make sure that you've upgraded the firmware. In some cases, I'd guess that a firmware upgrade alone won't do the trick, and the answer might be to disable "N' mode (configure the router to use only 802.11-g and/or 802.11b), or to buy a new router or access point. It might also be worth disabling "N" mode as a test.

Update (13/1/2012): It seems that the Kindle 4 and Kindle Touch use an Atheros AR6103 wi-fi chip. Looking at the "Product Bulletin" for that chip, it appears to implement only a small subset of the IEEE 802.11n standard. There are several new technologies that make 802.11n so much more effective: operation on both 2.4 GHz and 5 GHz bands simultaneously, use of multiple streams simultaneously over multiple MIMO (Multiple Input / Multiple Output) antennas, and the use of 40 MHz channel widths. However the AR6103 only utilises a single stream, and appears to utilise 64 QAM encoding over a single 20 MHz channel only. As a result, it achieves a maximum data rate of 72.2 Mbps only, which is not much improvement over 802.11g's 56 Mbps.

Worse still, it looks like this partial implementation of the 802.11n standard is what is "confusing" many routers and access points, so that the Kindles cannot associate with them. As described above, firmware upgrades, at least enabling b/g compatibility or even disabling "n" operation might be required, as might disabling 40 MHz-only channel widths.

As to what's in the Kindle Fire, I'm still in the dark. It seems to be a Texas Instruments WiLink 6.0 chip, but whether it's a WL1271 (b/g/n only) or the less likely WL1273 (a/b/g/n) is still unknown.

Hopefully, this will help folks get their Kindles connected.

Under the Cover of the Amazon Kindle Collections Feature

The Kindle is a lovely reading device - light, highly legible, convenient. One of its features is its ability to organise books into multiple collections, including the ability to have books in more than one collection. Although the Kindle runs Linux, it can't be using subdirectories and (sym)links for this purpose, so how does it work?

Very simply, actually. The collection data is stored in a text file, in JSON format. It's easy to view, too - here's how (instructions for Windows, but easily adapted for users of other platforms):

Plug your Kindle into your PC via its USB cable. Use "My Computer" to navigate to it - it mounts as F: on my desktop box. The collections are stored in the "system" folder, which is normally hidden - to view it, in Windows Explorer choose "Tools" -> "Folder Options...", then select the "View" tab. In the "Advanced Settings" box, select"Hidden files and folders" / "Show hidden files and folders"as shown below:


Click on OK to close the dialog. You should now see the various folders on the Kindle: "audible", "documents", etc. and "system", slightly fainter to indicate it's normally hidden. Open "system" and you'll see various files one shouldn't normally tinker with, including "collections.json". You can open this file with WordPad to see its contents - be warned, it's pretty ugly, but we can do something about that, as you'll see - by right-clicking, choosing "Open" and selecting "Select the program from a list" and then "WordPad" from the resulting dialog (probably best to uncheck "Always use the selected program to open this kind of file" at this stage.

To make sense of what you see, use an online JSON viewer: http://jsonviewer.stack.hu/ You can select all the text in the WordPad window (Ctrl+A), then copy (Ctrl+C) and paste (Ctrl+V) the text into the JSON viewer's text area. It still looks pretty ugly, but click on the "Format" button at the top and it looks a lot better:



Click on the "Viewer" tab and you'll see a much better representation of your collections. As you can see, each collection has a locale string appended to it, and then there's an array of items, each of which is typically the ASIN number of the book. This is correlated with the ASIN strings in the filenames of the book files themselves, in the "documents" folder.




This structure only allows for one level of collections - no nested subcollections. However, JSON - which stands for JavaScript Object Notations is a very simple format to handle in many programming languages, making it easy to write programs which could read the "collections.json" file, allow you to rearrange it in various ways and then rewrite it. There's not much more one can do with this, unfortunately - the Kindle software would get very upset if you tried to change the JSON structure. But it's not terribly complex, and in the future, Amazon probably could extend it without too much trouble. And the fact they are using an open standard like JSON means that any utilities could be adapted to any future formats without too much trouble.

For more details on JSON, see http://www.json.org/.

Fun with lastb

So, I have a few servers on the Internet, and a couple of them have a /var/log/btmp file (the others don't, so they haven't been collecting this stuff). The btmp file collects bad login info, which can be displayed with the lastb command. Although I rate-limit SSH connections to those machines to 3 per minute before blocking the connecting IP address, they still some of the usual SSH bf bot login attempts, so the file has grown over the last year or so. I wondered what names the Bad Guys thought might get them in. A quick bit of pipelinery (lastb | cut -f1 -d' '|sort|uniq -c|sort -nr|less) later, here's the top 20 or so names on the machines:

Machine 1 (mail gateway and squid proxy):
968 admin
892 sales
863 test
781 staff
596 guest
197 fluffy
194 oracle
188 user
162 info
154 www
137 data
136 web
129 http
128 support
128 jeff
127 mike
126 john
126 install
126 cvs
124 tim
123 steve
117 demo
91 eaguilar

Machine 2 (mail gateway and web server):
355 admin
258 staff
118 sales
103 test
83 guest
54 eaguilar
53 user
47 globus
39 cisco
33 t1na
28 oracle
24 PlcmSpIp
24 lesbell
23 webmaste
23 a
22 alexis
16 mlmb
14 nagios
14 adam
13 lpd
12 raimundo
11 supporte
11 administ

OK, so it's obviously a bad idea to create accounts like admin, staff, test and sales, especially with weak passwords. And there must be a lot of Jeffs, Mikes, Johns and Tims out there.

But "fluffy"? I mean, really, who ever has a Unix account called "fluffy"? And who is this "eaguilar", who rates so highly? Not to mention "PlcmSplp" (and the lower-case variant, "plcmspip"); I guess it must have worked somewhere, once, or it wouldn't be on their list.

Looking at the log generally, it's interesting to see account names like "218-214-" (obviously derived from a reverse DNS lookup on the machine's IP address), not to mention snippets of HTML.

Can Windows Be Any More Intuitive?

Now here's a prime example of how intuitive Windows is: in an Explorer window, I selected some MPEG files - videos I'd recorded and watched - and pressed the Delete key. To free up some space, you know? And a few seconds later, I was confronted by this:

Right. . . You can't delete a file because there isn't enough disk space. And your suggested fix for this is to delete a file?

OK, I totally get that when you delete a file, Windows doesn't delete it because you are too stupid to know whether you really wanted to delete it or not and will probably cry when you later discover that delete actually means delete. But, for the love of all that is logical, why does Windows go through the motions of actually copying the file, rather than just relinking it into a hidden directory somewhere for the "Recycle Bin" (just a fancy way of saying "Trash Can", anyway)? This would not require any additional space anywhere and files could be deleted in a fraction of a second instead of the minutes it sometimes takes. And it certainly wouldn't give rise to incredibly stupid and counterintuitive error messages like this one.

Thank $DEITY for the command line, where you can get the computer to do what you want, rather than what some UI genius thinks an idiot user ought to get.

Privacy Isn't Just Confidentiality

I've been following some discussion, in a private security-related mailing list, on the topic of what constitutes sensitive information. What's interesting is that many participants seem to have completely missed the point about privacy, as opposed to security.

The whole thing started with a query as to whether a person's date of birth could be considered sensitive or confidential if combined with other personally identifiable information. The thread then meandered around various topics inclduing privacy, identity theft and authentication. It pretty much ended with various contributors suggesting that any security professional worth his (or her) salt should not need to ask this question, and in particular, the last person to ask it of should be a lawyer. One contributor - who had better remain nameless - stated outright, "No slight intended on lawyers, but if anybody who considers themselves to be an information security professional needs to rely on lawyers to tell them what sensitive information is and how they are to protect it then we are all doomed!".

Bzzt! Thank you for playing, Anonymous! Please bring on the next contestant.

Infosec professionals need to be aware of the law in this area, as in many others. And, the law being what it is, the best approach is to consult a lawyer. Certainly, one should have some degree of familiarity with the relevant local law; for me, here in Australia, this is the Privacy Act (C'wealth) (1988) [1] which defines personal information that is subject to the Act, as well as "sensitive information" which is subject to additional safeguards.

The Act defines personal information as "information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion."

It further defines "sensitive information", which requires specific treatment under the Act as:

"(a) information or an opinion about an individual's:

(i) racial or ethnic origin; or

(ii) political opinions; or

(iii) membership of a political association; or

(iv) religious beliefs or affiliations; or

(v) philosophical beliefs; or

(vi) membership of a professional or trade association; or

(vii) membership of a trade union; or

(viii) sexual preferences or practices; or

(ix) criminal record;

that is also personal information; or

(b) health information about an individual; or

(c) genetic information about an individual that is not otherwise health information. "

If you're like me when I first read that list, you are probably surprised at some of the items on it, but upon mature reflection you'll probably come to agree and perhaps think of additional elements that should be added. All of which suggests that our intuitive understanding of privacy is often incomplete.

Notions of privacy vary enormously around the world; furthermore there is often a considerable gap between what an enterprise thinks it ought to know about its customers/clients/employees and what those individuals would like the enterprise to know and do with what it knows.

The essential difference between security/confidentiality and privacy is who has control; for security in general, the owner of the information has control, but for privacy, the subject of the information has control. As an individual, the subject clearly has little influence and especially not authority over what an enterprise information owner does; hence the mechanism by which subjects collectively exert that control is legislation.

Security professionals tend to focus on how to assure the confidentiality, integrity and availability of the information in the systems in their care. We put a lot of effort into making sure the bad guys can't get access to our information. But privacy legislation is written to make sure that we aren't the bad guys - that we don't collect information we shouldn't, and that we don't use information in ways we shouldn't. Sometimes that poses ethical conflicts, when our employers think it would be a good idea to collect or aggregate personal information contrary to legislation; in that case, we have to advise against this and require compliance with the law.

For the individual, the decision to disclose personal information is a trust decision. In some cases - when dealing with other individuals, for example - we are able to rely on their benevolence. But massive corporations, by and large, are not benevolent and not possessed of individual free will. We have to rely much more on their competence, their integrity in the sense of willingness to be bound to privacy compliance, and their ability to resist security breaches. Individuals are therefore forced to rely on what is sometimes called deterence-based trust - the existence of legal sanctions which ensure that penalties for breach of trust will exceed any potential benefits from opportunistic behaviour.

An excellent example from Icelandic usage of population genomics databases [2] illustrates the deeper complexities; most individuals have given virtually no thought to the privacy implications of releasing their DNA for research purposes, but fortunately medical and legal ethicists have been thinking about it and proposing additional safeguards. (Thanks to Graciela Pataro for this example).

So to say that security professionals don't need to consult a lawyer is disingenuous. Winging it and assuming that defending our systems against external threats simply isn't enough.

References:

[1] Privacy Act, 1988, as amended, Commonwealth Government of Australia. Available online at http://www.comlaw.gov.au/comlaw/management.nsf/lookupindexpagesbyid/IP200401860

[2] Herman T. Tavani, "The Case of DeCODE Genetics, Inc" in Chapter 1, "Ethics at the Intersection of Computing and Genomics" in Herman T. Tavani (ed.), "Ethics, Computing and Genomics", Jones & Bartlett Publishers, 2005. ISBN 0763736201, 9780763736200. Available online at http://books.google.com.au/books?id=wlrPaPRshesC&pg=PA15&dq=the+case+of+DECODE+Genetics+Inc#v=onepage&q=the%20case%20of%20DECODE%20Genetics%20Inc&f=false

You've Got to Love TCP

You've got to love the robustness of the TCP protocol. I have a 'client' for whom I set up a Linux box with a specialised Perl/MySQL application which pretty much runs their business. This was back on 2000, and the box is still going, although at the back of my mind, I realise that the inevitable disaster can't be far off. Anyway, when we set it up, we also installed a modem on one of their phone lines and every Sunday I run a script which dials into their system, does a backup of their database and scp's it down to my main office server, from where it will be backed up as part of our regular cycle.

Now that the database has grown, the backup gzip file is around 3.5 MB in size, and takes a while to download. I don't care; it generally runs in the background while I'm doing other stuff and the phone line is only used for inbound faxes, which are mostly spam these days, anyway. But today, the line dropped and pppd died, about 20% of the way into the download. So I had it redial, the other end picked up the line, pppd did its thing, and we were connected again - and a few seconds later, the scp file transfer started ticking over again.

This happened twice more - must be some line problems somewhere. But each time, I just kicked off another pppd, and scp picked up where it left off. The pauses were sometimes a couple of minutes long, but that still wasn't a problem. In this particular case, the IP addresses remained the same, being pre-allocated at both ends, but I suspect that even if one of them had changed, it wouldn't have made much difference - a lot of TCP implementations rely on the sequence numbers, rather than IP addresses and port numbers, to distinguish sessions and so it would probably have still kept going.

You've got to love technology that is resilient enough to keep going in the face of line dropouts.

And yes, an ADSL modem would be faster, plus they could probably eliminate a monthly line rental so that it would pay for itself pretty quickly (assuming a really cheap ADSL plan). But I'd have to update their ancient Linux installation, and that would probably mean a major memory or even machine upgrade, so that can wait until the inevitable disaster I mentioned above.

Infosec Darwin Award Nomination

There ought to be a special category in the Darwin Awards for people who do stupid things with computers - in fact, this category alone could probably swamp all the others, were it not for the Darwin Awards' somewhat onerous requirement for the nominee to have removed themselves from the gene pool.

However, today's news brings word of someone - probably more than one, in fact - who looks likely to remove themselves from society at large in a spectacularly dumb way. This genius planted a fake ATM in a hotel lobby, in order to skim data from the cards of unsuspecting users. Only, they didn't choose just any old hotel. Oh, no.

They chose the Riviera, in Las Vegas.

Just before it was to host the DEFCON hacker convention, this last weekend.

Not many unsuspecting users at DEFCON, I'd say. In fact, the place was probably full of professional paranoids. Not surprisingly, one of the organisers spotted the bogus machine and it was hauled away by local law enforcement.

If the perps weren't awesomely dumb, but actually knew what they were doing, then you have to admire their chutzpah. Naw, on second thoughts, they had to have been dumb as a post.

More details at http://www.computerworld.com/s/article/9136179/Fake_ATM_doesn_t_last_long_at_hacker_meet