ESXi 4

VMware released free version of it's supervisor ESXi 4 somewhere around the previous weekend. I managed to install it into VMware Workstation and to give it a quick try. Until I have more to say, here are a few differences that I noted during and immediatelly after installation process finished:

• Minimum of 2GB RAM in order to be installed and used. I tried to lower memory size after installation finished but it hasn't worked.
• Root password has complexity requirements and it requires you to use some better password.
• busybox upgraded to version 1.9.1, but still only a subset of tools are compiled, installed.
• python preinstalled
• IPv6 support
• ipkg package manager

I'll eventually update my page about ESXi as well as pages about hacks I discovered to reflect new version.

Nokia N96

Note: This post has been transferred from my old home page on January 4th, 2020 and the date of the publication is only approximate.

At the end of the October 2008 I bought new Nokia N96 mobile phone. On this page I'll write about my experiences with this phone. You'll also find pointers and tips&tricks I gathered on the Internet.

Phone review

I'll start with my personal review of this phone. Because you can read everywhere what the phone _can_ do and what's good in it, I'll mention what I think are it's shortcomings. Note that I updated the phone to the newest software version available on the Nokia's site.

1. For a start, the software is slow. Sometime so slow that it starts to iritate.
2. Once, or twice, some application frozed and I couldn't do anything with a phone but to reset it. This happened when I was setting up the wireless connection. All the details are below, where I describe how to connect the phone to a corporate WiFi network.
3. MAJOR OBJECTION to this phone is the lack of VoIP client. Lately, Fring seems to work, but I haven't had much success with it. Gizmo5 doesn't work yet, don't even try.
4. When you install new application you don't know where it was installed so you have to search for it.
5. Battery doesn't last for a long if you use WiFi and/or Radio.
6. I'm using alarm on the phone to get up on time in the morning. Once, I slept because the battery drained during the night, phone turned off, and it didn't ring. Now, I would expect that in such cases the phone turns off with some reserve in the battery and that the alarm is activated. Anyway, before I went to sleep, I think the battery was well charged, but it seems I left WLAN scanning on.
7. Bluetooth is a special story. Still, my requirements are specific so I want count them into general problems.
8. WiFi to setup is clumsy or impossible. If you have simple home network everything is OK, almost. But if the network consist of multiple APs, uses EAP and/or 802.1x, you'll have much work to perform in order to setup it. Furthermore, debugging options are close to none!
9. While we are at WiFi, the second problem is that it seems to be very sensitive on signal strength. My laptops works well with the lower strength signal in my bedroom, but N96 doesn't work at all!
10. I didn't used GPS much, and this is not the definite opinion. But, the time I used it it spent more time waiting for better GPS accuracy then it was showing where to go.

Ok, there are more objections but they are now specific so you'll find them scattered in the sections below.

Connecting Nokia N96 to corporate WiFi network

Here is current situation regarding connecting N96 to a corporate network. This network uses EAP-PEAP and MS-CHAPv2 inside. So here are some notes what happens when you try to do something like this. And BTW, I didn't succeeded in my intentions.
The first problem is where to define a wireless network. You have at least three options:

1. The first one is available immediately on the main screen. There is an option WLAN scanning off. Obviously, you can turn it on.
2. Then, there is a second option. Go to the main menu and select Tools. You'll see option WLAN wiz..
3. Finally, if you select the Settings option, then Connection and finally Destionation you'll come to third option, Access point - Add new acc. pt..

Now, isn't that nice. Three options, why?
Ok, whichever you select, you'll bump into another problem. Let us first try with the first option. Turn WLAN scanning on and wait a second. Then, you'll see either that it found some particular WLAN, or if there are more of them, then it will only show that WLAN networks were found. If you now open this WLAN option, it will present you with a list of found wireless networks. Select the desired WLAN, and here is a problem. It asks you for WEP key WHICH I DON'T HAVE.
Now, let's select the second option, WLAN wiz.. When you open this wizard it will scan for available networks and present you with the found ones. Very nice, except one simple problem, it doesn't allow you to configure this network! It allows you to Start web browsing, Refresh network list and see Details. But where the hell I'm configuring it?!
Let's try with the third option. Going to Access point - Add new acc. pt. option. It will ask you if you wish to automatically check for available access points. Either way it will scan for the network. The difference is that in the "manual" case it asks you for SSID and than scans for this particular network, otherwise scans for all the networks and presents you a list from which you have to select one. Now, the biggest stupidity of all, it asks you for WEP key. Well, I don't have WEP key, I know my username and password and I wont to enter them somewhere. So, it turns out you have to provide WEP key, anything, to pass this step. Ok, it doesn't try to connect or anything like that. It only asks you to select for which use/destination you'll use this connection. I suppose it's used for the Internet.
So, now you have an option to modify the network. Enter all the details. It wont try to connect. In order to connect, I suppose you have to go to the browser. It will open, you'll go through few menus, and finally it will ask you which AP to use. The only problem is that it doesn't show the access point you just defined!
Ok, VoIP application fring is, it seems, a bit smarter. It presents me a list of access points and I can select the one I just configured. Errr, except one small problem. It doesn't work and I don't know why?! It would be very nice if Nokia placed something like Test connection somewhere! Even more useful would be if I could see some diagnostic information about failed connections!
All in all, this WLAN is totaly messed up!!!

Nokia N96 and MacOS X

Synchronizing

Well, synchronization here works almost perfectly although I still have to try it more. You'll have to download iSync plugin for N96. It can be found on the Nokia Web site.

Development environment for N96 on Mac OS X

Nokia N96 and (Fedora) Linux

Here are some hints on setting up Nokia N96 to work with Linux. I'm using
Fedora 9Fedora 11, but I believe that with minor tweaks it will work on other distributions too. Also, I'm using T61p.

Using N96 as headset

Using PC as a headset/handsfree

Finally I was able to make some progress with this. I'm not there yet, but it is satisfactory for now. Everything started when I stumbled upon this thread. From the give thread I learned for the ProjectBluezHandsfree. You can download sources there (or get a local copy). There are two executables in the archive, headset and handsfree. Headset is used as a phone set, while handsfree emulates phones and microphone. handsfree is relatively complicated as the author apparently envisioned it to be used as a controllable component. It reads and executes commands from the pipe (/tmp/cmd) or stdin if there is no pipe.
Still, I had a problem with this code. It was written for ALSA and I didn't make it work on Fedora 11. Then, I hacked a code bit (correcting few interesting bugs along a way) and also included Pulse for the audio. The changed code is here. This code also has problems. Frist, headset works even though there are glitches in the audio. handsfree doesn't work because I have problems reading microphone output and sending data to the mobile device.
I also found nohands program when I was reading the following thread. This program promises to be much better than the previous code (which also means it made my tries to hack that code useless) but again I had problems with ALSA.
The procedure to connect your PC as a headset or handsfree to a mobile device consists of two parts. The first part has to be done only once for pairing PC with a mobile phone, while the second part has to be done every time you want to use handsfree.
The goal of the first part is to pair devices. The pairing has to be done in such a way that the mobile phone recognizes you PC as a headset. So, first issue the following commands:

$ sdptool add hf
$ hciconfig hci0 class 0xff0408

After you executed these commands PC will be recognized as a handsfree/headset by the mobile phone. Next, you have to do pairing of the devices. Also, mark the devices as authorized to always connect. After you paired those devices and mobile phone remembered the handset it doesn't perform any checks any more, at list this is the case with my Nokias N73 and N96.
Links
HFP for Linux Bluetooth Hands Free

Synchronizing Evolution with N96

Configuring T61p as an AP for N96

Configuring N96 as an AP

http://my-symbian.com/forum/viewtopic.php?t=34048

Using N96 as a modem

Accessing Internet on N96 via bluetooth

http://bluez.sourceforge.net/contrib/HOWTO-PAN http://blogs.forum.nokia.com/blog/open-source-bluetooth-pans-forum-nokia-blog/page/7 http://discussion.forum.nokia.com/forum/showthread.php?t=128271
gnubox

Development environment for N96 on Linux

Some tips

To find out MAC address of WLAN device enter the following code to mobile device *#62209526# (aka *#mac0wlan#).

Interesting notes

SIP calls via N96

http://conversations.nokia.com/home/2008/08/the-report-of-t.html Thread

Crashed Symbian

Well, I managed to crash symbian on N96. I was in File manager when I connected the phone to a PC and I did not select which mode to connect as but by default it was Mass storage. On PC I copied and moved some files and then did unmount of device but I did not disconnect the cable. Then, on the phone I tried to use File manager but it said that the memory is in use. Then I pluged off the cable and in that moment Symbian crashed.

Useful & cool links

http://mynewn95.blogspot.com/
http://davehall.com.au/blog/dave/2007/11/18/my-new-toy-nokia-n95
http://sjc-123.blogspot.com/2007/09/best-tips-and-tricks-for-nokia-n95.html
http://www.n96users.com/
How to share the GPS in your N95 with your laptop via Bluetooth in Linux (this works for N96 too)
How to read and create “barcodes” (Mobile Codes) on the Nokia N95 (this is really really cool, and of course, works on N96 :))

http://conversations.nokia.com/home/2008/08/the-report-of-t.html
Thread
p3nfs HOWTO: Share your Ubuntu connection with Symbian phones

Development

http://www.martin.st/symbian/
http://symbiangeek.blogspot.com/2007/09/symbian-development-on-linux.html
http://pepper.troll.no/s60prereleases/
Hack a Mobile Phone with Linux and Python

Security through obscurity - is it useless?

For a few weeks now I've been thinking about security through obscurity (STO). It is a common wisdom that it's a bad way to build security of anything. But, this doesn't have to be necessarily true, as I'll explain in the moment. What made me write this post is that a similar comment about usefulness of STO was given in a Matt Bishop's artice in IEEE Security & Privacy journal (About Penetration Testing, November/December 2007, pp 84-87). He notes that:

Contrary to widespread opinion, this defense [STO] is valid, providing that it’s used with several defensive mechanisms (“defense in depth”). In this way, the attacker must still overcome other defenses after discovering the information. That said, the conventional wisdom is correct in that hiding information should never be the only defensive mechanism.

His note goes right to the point. So, to explain this point, first I'll explain what STO is and why it is problematic. Then I'll explain what actually security is, and finally, how in this context STO can be actually useful.

STO is a principle that you are secure if the attacker doesn't know how you protect yourself. For example, if you invent new crypto algorithm and don't tell anyone how it works, then the one that invented algorithm believes it's more secure. Instead of crypto algorithm, you can take almost anything you want. Good example would be communication protocol. Now, the problem with this approach was that usually crypto algorithms, or protocols, were very poorly desinged! So, the moment someone reverse engineered those he was able to break in! Now, think for the moment if this secret algorithm is actually AES? Would discovery of algorithm mean that STO is bad? I suppose not, and so should you, but let us first see what security is.

Security is complex topic, and I believe we could discuss it for days without reaching it's true definition. But, one key point about security is that there is no such thing as perfect security. You are always vulnerable, that is, in any real world situation. So, to be secure actually means too hard for attacker to break in. When attacker breaks in, he doesn't attack from some void, but he has to have some information. So, the more information attacker has about it's target, it's more likely he'll succeed.

Now, how this goes along with STO? Imagine to implementations, completly identical, apart from the first implementation beeing secret. In the first case attacker has first to find information about implementation and then he can try some attack, while in the second case the attacker can immediately start attack.

So, STO can make security better, but with precautions. First, it must not be the only way of protection, i.e. bad algorithm/protocol/implementation. Second, you have to be ceratin that sooner or later someone will reverse engineer your secret, depending on how popular your implementation is.

To conclude, STO could help make security better, but only if used with caution. What you can be almost certain, is that if you go to invent new crypto algorithm, new protocol, or something similar you'll certainly make an error that will make the design, as well as implementation, very weak! Thus, this was of using STO might be usefull only for biggest ones with plenty of resources and skills, like e.g. NSA. :)