Phoenix Network Forums

CUTs is a procmail "hack" that basically enables you to use a normal cellphone as a Unix/Linux terminal. From anywhere.

If you have a cellphone capable of short text messages, a cellphone service provider that enables you to send and receive emails as short messages (or similar), a computer connected to the Internet (running sendmail/procmail) and a domain, ... Then you can have access to an online Unix/Linux box from anywhere, aswell!

http://codewar.net/cuts/

:!: If you listen to anything.. listen to this.. bad idea..
The whole think is a bad bad idea. SMTP direct execution screams bad idea.
This code has absolutely no authentication.. !! Only FW based filtering.. that can not get everything. You can not implecitly trust your ISP.. bad idea.

IF YOU WANT TO USE A REMOTE SHELL.. use SSH.

Cell phones now have SSH. Look here.
Idokorro Mobile SSH
You can download a trial 30xuse app for free.
All you need is a JAVA enabled phone works great.
http://www.idokorro.com

SSH via cell-phone is bad as well. You can't trust the software or your cell-phone. Also if you don't use proper authentication (like public keys), then there is no gain in security. You can't know what the cell-phone is sending to the phone company. Maybe everything. And if there is a curious member of the company, he could easily attack you as the man in the middle; you wouldn't even notice it.

If you really want to contact your home host, then create an SSH public key (ssh-keygen(1)), activate public key authentication (/etc/ssh/sshd-config - "PubKeyAuthentication on"), and finally set your key to be an authorized key (make a copy of id_rsa.pub or id_dsa.pub (whichever of RSA or DSA you use) and call it ~/.ssh/authorized_keys). Then copy id_rsa or id_dsa (protected by a wisely chosen passphrase - ssh-keygen will ask for one) to a floppy disk, Take it with you.

Now if you have access to a trusted host (an internet cafe is NOT trusted!), then you can log into your machine and have fun.

--Mobile SSH -------------------------------------------------------------
Idokorro is "On Device" SSH. There is no open transmit to the Provider. The SSH keys are generated on the phone and the ssh protocol is implemented on device. It is just as secure as any ssh terminal. The source is available for review and so you can tie SDK kits for say Sidekicks, or RIM phones and develope secure communication tunnels.

Data is encrypted from the device all the way to the SSH server, so there are no intermediary or proxy components where the data might be unencrypted and vulnerable to attack. Industry and government-standard TDES and AES encryption methods are supported, and SSH connections can be made to any SSH (1 or 2) server. SSH 2 key authentication is also supported for enhanced security.

--Public Key Topic----------------------------------------------------------
More information on Understanding PKI/MITM Attacks

Man in the middle SSH model
http://www.vandyke.com/solutions/ssh_overview/ssh_overview_threats.html
The problem with this is that the keys have to be comprimised.

Good White Paper:
Man-in-the-Middle:
Vulnerabilities in Public-key/SSH
http://xperts.sce.carleton.ca/2004-05/MITMV/docs/SYSC4907_Group69_8-4.pdf

Ten Risks of PKI: What You’re not Being
Told about Public Key Infrastructure
http://www.schneier.com/paper-pki.pdf
--Keylogger Topic---------------------------------------
If you trust that the kernel doesnt have some key logger than your generally going to be secure, as long as hardware isnt comprimised.

Windows 3rd Party "Hidden"
Lame Key loggers - http://www.actualkeylogger.com/

Linux Kernel
Kernel Level loggers - http://www.phrack.org/phrack/59/p59-0x0e.txt

::Physical Loggers::
Better Keyloggers (PS2) - http://www.keyghost.com/sx/

Best - http://www.keyghost.com/securekb.htm

goose, you didn't read my post entirely.

mm_freak wrote:goose, you didn't read my post entirely.

Actually I did, and I had a co-worker look over it too.. but if you would clarify what I said was wrong, or misinterperted then I be able to correct myself. I enjoy reading your posts mm.

goose wrote:Actually I did, and I had a co-worker look over it too.. but if you would clarify what I said was wrong, or misinterperted then I be able to correct myself. I enjoy reading your posts mm.

What I meant was that you can't trust the phone itself. If you could, then everything would be okay, but mostly even a computer in an internet cafe is more trustworthy than a mobile phone. You know that phone companies are very curious about their customers, and you also know that the phone sends out data periodically. The signal is much too long to be just a keep-alive-signal.

Also the threats for programmable mobile phones are increasing fast. They are still not flexible enough to be able to run things like Linux. Some working viruses are already out there, and without proper in-depth knowledge, you wouldn't even notice being infected. Some curious attacker could get his hands on your telephone numbers, your messages, your game highscores... and your key/password, hence you'd grant him access to your computer and you wouldn't even notice it.

goose wrote:I enjoy reading your posts mm.

Usually I enjoy reading your posts, too - as long as you don't just post a bunch of external quotes and links. =)

first let me say I don't believe anything is actuall secure, there are just varing degrees of insecurity.

I did use ssh off my treo 600 in the past. Mostly for emergencies. It wasn't ideal but probably easier to use than a regular cell phone.

anything that has no secutity feature other than hiding it's existance is a bad idea. At least hack the script so that it requre's a key word in the message.

If you don't believe us just set it up and tell us the addy so we can try

ravenhair wrote:first let me say I don't believe anything is actuall secure, there are just varing degrees of insecurity.

Take x + y and give the result to someone. He has no way to reconstruct x and y by knowing x + y. This is perfect security. The one-time pad is a system, which makes use of this fact. Anyway, in real world there is no perfect security. A perfectly secure safe would be one, which you couldn't even open yourself. However, current cryptosystems have the security to be unbreakable for the next 500 years and that's enough.

ravenhair wrote:At least hack the script so that it requre's a key word in the message.

There is nothing easier to bruteforce than this. If this password is n characters long, then you would bruteforce-check c - n + 1 passwords simultaneously with a string of c characters. This eliminates the need to check one password after another.

mm_freak wrote:

goose wrote:I enjoy reading your posts mm.

Usually I enjoy reading your posts, too - as long as you don't just post a bunch of external quotes and links. =)

Yeah..lol I do over do it sometimes.. well I hate repeating things that are well documented.. Its my job to reference materials.. so I do it too much when Im typing as well. .. I'll try to give some more original thought... but it tends to come out something like "drink more beer."

I don`t see any point in using this on your phone. It is complicated, and it can be harmful to your fingers... I rather prefer the normal way, using keyboard. And the sofware on your mobile, you can`t trust it That is my opinion

the nokia sidekick isn't all that bad for the fingers

goose wrote:Yeah..lol I do over do it sometimes.. well I hate repeating things that are well documented.. Its my job to reference materials.. so I do it too much when Im typing as well. .. I'll try to give some more original thought... but it tends to come out something like "drink more beer."

I'm always trying to keep fluent context, so that you can tell what's behind a link. A link is worthless, if you don't have much to say about it yourself. That's why I never visit the Links page of homepages. =)

I don't know ...
I'm not tried this ..

mm_freak wrote:

goose wrote:Yeah..lol I do over do it sometimes.. well I hate repeating things that are well documented.. Its my job to reference materials.. so I do it too much when Im typing as well. .. I'll try to give some more original thought... but it tends to come out something like "drink more beer."

I'm always trying to keep fluent context, so that you can tell what's behind a link. A link is worthless, if you don't have much to say about it yourself. That's why I never visit the Links page of homepages. =)

its just showing examples and references.. and I hate to repeat myself and other people. They should be credited with their work. I would never say "hey this exploit is great.. blah blah" with out referencing where I got it. It means you have respect for other peoples ideas and their generosity to share them. plus it cuts down on explainations that are already there.