Helpful Telescope Spreadsheets.

I have been into astronomy for... well as long as I can remember really. I think it started when my Dad got me a CAD print out of the space shuttle Columbia, OV-102. This was about the time I was getting into radio as well, and as a 7 year old typed a letter out on a typewriter to NASA asking about their Deep Space Network system. I didn't get much info about the DSN, but I got a ton of images from from Hubble and other deep space probes they had sent out over the years.

Sadly I wasn't really able to do much in the field with it because of a lack of money and my poor understanding of optics at the time. So it just kind of sat in the background, coming out as more of a obsession with all things NASA, ESA, and AMSAT.

This all changed when recently a member of our pod gave me a pair of telescopes she no longer had need for. This got me going viewing celestial object directly again, and after a few viewings of Jupiter and its moons, Saturn and it's Rings, and trying to find Apollo landing sites on the moon I was hooked again!!!

On top of this my cash flow had been increasing due to some contract jobs I was doing and this gave me a chance to improve my equipment. But after looking at what is out there the question was raised, "what do I really need, and what do I really get for this stuff?" OFF TO RESEARCH!!!!

After my optical principle research frenzy I came back with some very good info! Which I was able to distill down into this GDoc Spreadsheet.

 Telescope/Eyepiece combo info

The Basics:

Now before you go and run off to look at the spreadsheet, I would like to explain a few things here, just to fill you in on the details.

The basic idea of an optical telescope is that it gathers light from distant sources use its Objective optical device, a parabolic mirror or convexed lense, and focuses that light on to a focal plane. This inverted image of the distance object is then magnified via the eyepiece and then sent to your eye. This basic system allows you see objects that are normally too dim for your eyes to see. Or for objects that you can see, it allows you to resolve more detail on those objects. Now there is a lot of math and such that can get involved here, but I want to start out with the practical details first, then we can get to the meat of it. ;)

Terms:

So lets getting a few terms down before we move forward:

Focal length: Distance between the Objective Optical device and the focal Plane, In millimeters.

Eyepiece Focal length: The distance between the focal plane and the the end element of the eyepiece, in millimeters.

Apparent View: How big the magnified chunk the sky looks to your, in degrees.

Actual view: The chunk of the sky that is being magnified. Most the time measured in Degrees.

Magnification: A relative number that tells you how much more you are seeing then your naked eyes.

Arcseconds: A polar measurement of an area of the sky. one arcsecond=1/3600th of a degree.

The Math:

Now, let dig into to this, first lets hit magnification. To get an idea of magnification we need to know how much you can see with your eye. Most humans have an effective view of view of 114 degrees, or about 410,400 arcseconds of the sky. Reference:Wikipedia:Field_of_view You can resolve down to about  60 arcseconds with your eye, or about 0.016 degrees.Reference: darkskydiary:arcminutes-and-arcseconds 

Magnification:

So the idea here is that the telescope should be able to give use some degree more resoultion and hence a small field of view. The math for this is basic, it the focal length of the telescope over the focal eyepiece of the telescope. So you can say that magnification is inversely proportional to focal length of the eyepiece. So if your telescope has a focal length of 1100mm, and you are using a 15mm eyepiece. 1100/15=73.3 But this doesn't really give us much info, how much of the sky can you now see, what kind of resolution can you expect?

Field of View:

Lets now go through the math for figuring out the field of view now. Each eyepiece you buy for you telescope will have a spec called "apparent field of view". This is the field of view that it will magnify the chunk of the sky to so you can see. Because your field of view and resolution of vision is fixed. From this number and the magnification we can figure out the "actual field of view", which is size of the area of the sky you are actually looking at. So if we use our example above we should be able to figure out how much we can see with our 1100mm telescope and 15mm eyepiece. Now, lets assume our eyepiece has a 52 degree apparent field of view. We take this number and divide it by the magnification, in other words our actual field of view is inversely proportional to the magnification. (52/73.3=0.709 degrees) We can convert this into arcseconds to get 2,553.8. 

Now, what does this number really mean?? Well we can compare this the apparent diameter of different celestial objects.

Celestial body	Angular diameter	Relative size (10 pixels per arcsecond)
Sun	31.6′ – 32.7′	28.7–29.7 times the maximum value for Venus (orange bar below) / 1896–1962″
Moon	29.3′ – 34.1′	26.6–31.0 times the maximum value for Venus (orange bar below) / 1758–2046″
Venus	9.565″ – 66.012″
Jupiter	29.800″ – 50.115″
Saturn	14.991″ – 20.790″
Mars	3.492″ – 25.113″
Mercury	4.535″ – 13.019″
Uranus	3.340″ – 4.084″
Neptune	2.179″ – 2.373″
Ceres	0.330″ – 0.840″
Vesta	0.20" – 0.64"
Pluto	0.063″ – 0.115″
R Doradus	0.052″ – 0.062″
Betelgeuse	0.049″ – 0.060″
Eris	0.034" – 0.089″
Alphard	0.00909″
Alpha Centauri A	0.007″
Canopus	0.006″
Sirius	0.005936″
Altair	0.003″
Deneb	0.002″
Proxima Centauri	0.001″

Source: Wikipedia:Angular_diameter

So if we compare this to the sun, with an angular diameter of 32.7 arcminutes, or 1,962 arcseconds, we can see our view with this setup will be 1.3 times greater in size. Or to put it a different way, if you centered the sun(while using a sun filter on your telescope, not doing that could damage your eyes) in your telescopes view with the 15mm eyepiece there would be 295.9 arcsecond on each side of the your view. So the sun would fill up a little over half your view.

Now if you tied to look at Pluto, with an apparent diameter of only 0.115 arcseconds you would have a hard time see it as it would only be .004% of your view. That is far below the resolution of the human eye and you would need a shorter focal length eyepiece for that.

How to pick the right eyepiece for the job.

So now that we have some of our basic math down, how do you know which eyepiece to use? We that depends on what you are doing. Using the chart from above you can figure out the size of the object you want to view. If the object is not on the list there are many sites out there that can help you figure out what it's angular diameter is. Once you figure that out, go to the spreadsheet, Telescope/Eyepiece combo info, and fill in the info for the eyepieces you have and your telescope. BINGO, you have the area each of your eyepieces can see! But what if it's not enough? There is a device for that!

The Barlow.

A Barlow is a device that multiples the magnification of you eyepiece. Your place the device in between your eyepiece and your telescope. So if you put it between the 1100mm telescope and our 15mm eyepiece it would be the same as using a 7.5mm eyepiece. Now on the spreadsheet, Telescope/Eyepiece combo info, I have a second sheet that includes a column for a Barlow. Now the effect on the actual view is not proportional to the barlow, so second sheet will help you figure out how much area you can see by putting the Barlow in. 

Conclusion.

I hope this post has helped fill in some of the gaps about the practical details of what you need to get a good view of the sky. I also hope the spreadsheet will help speed things up. Now I have filled it in with examples, just replace those with your values.

If you have any questions or comments please leave them below.

I also want to thank  Jay Reynolds Freeman for his page http://old.observers.org/beginner/eyepieces.freeman.html

It was the main inspiration for this post and the source of the math in the spreadsheet and this post. He has a lot of good practical info on the page, you should really check it out.

Things you wouldn't think of as a "hack".

There are many people out there that think you have to know something about coding or electronics to be a hacker. But there are many non-tech ways to hack.
A good example is a guest post my partner Andrea did on Offbeat Home.
Why damaged tablecloths may be the most surprisingly useful item in your home
Here simply simply asking about damaged tablecloths at your local rental store could get you some useful gear.
This is also a great example of look in places that you wouldn't think of looking.
Andrea also found found a good portion of the parts for this DIY thresher.
*soon to come post from Andrea on that*

One of our local scrap places sells these used plastic barrels for $20. I had the steel 75 gallon drum sitting around my farm. The strap was found along the rail road tracks. The motor was sitting in my pole barn, and the better arms where built out of old lumber laying around both of our places.
There are no microcontrollers, no computers at all, just good old fashion farm hacking.

And this is just example of this, there are many many more out there on the net.
So just remember, you don't have to be a tech wizard to be a hacker.

Keep on hack'n!!

OATS!! Small Scale Harvest, and Processing.

            Most people thinking of hacking as longs nights in a dark room in front of computer screens. Or a long day sitting working with oscilloscopes and soldering irons. But in my view that is only part of it, Sometimes hacking looks like this:

Cutting the heads off of the oats for harvest. 

According to my Dad this cicle has been the family for over 100 years.
Credit: Andrea Parrish

This what it looks like to harvest oats by hand. Today I'll talk about what I like to call "farm hacking." Farmers have been doing it for ever and I would like to share my modern twist on it.

Why Oats?

So why did I plant oats? Well, for a lot of reasons. In the last few years I opened up more land on my property to farm. I did this for a few reasons, A: I hate grass, B: I wanted my land to be more productive than just some place to dump water and get useless green stuff. So I opened up part of my front yard, and a sizable part of my back yard. That was 8,000 square feet of open land that was just about dead from over farming and too many years of fertilizers. After a year of trying to keep the ground bare, which took lots and lots of hours and didn't work, I figured there had to be a better way. A lot of research I did pointed to cover crops being the best bet. The idea is that no matter what you do, if there is open soil some thing will grow there. So you might as well make sure it's what you want!

I chose oats for a few reason,  they are very fast growing and will out compete most everything else. Two, you can eat them! Oats can be used for bread, power bars(in combo with local fruit), beer, cookies, etc,etc. It's a multifunction crop, because I won't have single function things around my house. In combo with the oats I planted two different clover as well. The clover help because when inoculated with rhizobacteria they fix nitrogen into the soil. This helps to rebuild the damage from over farming which depleted the soil. The clover also make from a great smoother crop as it fills in the spaces between the oats, thus keeping weeds down even better. You clover isn't the best to eat, but it will make for a great grass replacement if I don't put oats back into these areas again.

How to do it.

I have to say out of all the crops I have grown this is the easiest to grow. I used a variety of oats call "Viking" which is bred to grow between two and three feet tall. For the clover I planted Duch white, which is a vine clover, and Kenland Red, which is your traditional looking big leaf clover. I used a grass seeder to spread the seed and small scale to measure out the seed. I did 4 pounds of oats for every 1k square feet, .25 pounds of Kenland red per 1k square feet, and .5 pounds of  Dutch white per 1k square feet.

My Measuring setup for getting my seeding rate right.
I use the canning jars to hold pre measured amounts of seed for each area.

I then roughly measured out 1,000 square foot blocks in the fields and just started spreading seed. I was able to do this in about a days worth of work without too much trouble. I then took my Dad's tractor with a chain drag behind it to cover the seeds. In the areas that I couldn't get the tractor in I just used a rack to cover the seed. Then I just watered and within 2 weeks I had oat and clover coming up.

Oats and Clover starting to come up.

Credit:Andrea Parrish

Harvest:

I stopped watering when I saw a majority of the oats turning brown from the bottom up. It seem to start at the edges of the field and work it's way in. I figured it was near time because they were  turning brown despite water. I then waited about a month before I could harvest. I tested it by chewing on the oat seeds, if they were still soft in the middle, then it was too early. When I was able to get hard seed samples from multiple locations in the field then it was time to go to work.

Now this may have been the easiest to grow, but by far it is the hardest to harvest. I don't have any tractor equipment to harvest oats. Plus many of the fields are too small to get a tractor in so I had to do it all by hand.

Pete cutting down the straw with my Dad's 100+ year old scythe.

Below is a video I took showing the process for all of this.

Results:

After all of that was said and done we found that for the approximate 1,000 square feet we harvested we got about 100 gallons worth of oat heads and top straw. After the processing we got it down to about 10 gallons of oats, or about 40 pounds worth. The seeding rate was 4 pounds per 1,000 square feet, and the yield is 40 pounds per 1,000 square feet. So its a 10 time greater yield, which I'm quite happy about.
In recent days after the first two weekends of work we have had heavy storms and rain come through the area which have put a stop to our harvest. This is because the oats have to be very dry, if they have moisture in them they can start to mold in storage and destroy the crop in the storage container.
For Storage containers I am using 5 gallon buckets with airtight lids, the buckets are then stacked in my basement for storage.

I could not keep doing this without the help of my Pod/Chosen family and friends. Here are some pictures of all the help I've gotten thus far.

Pete and I striping heads off in the living room on old table cloths.

Credit:Andrea Parrish

Friends helping processes oats while I was away on a contract job. <3

Credit:Andrea Parrish

Even the kids get to have fun with it.

Credit: Skullflake Studios

Training.

Credit: Skullflake Studios

Conclusion:

It seems that small scale grain production is doable. It's a great way to keep weeds down, put ground to good use, and have some food security. But it requires a lot of work in the harvest to put it all to use. It is by far something you need a "tribe" to help out with. I am also finding that you are far more at the whim of the weather than with other crops. Over all I think thus far it is well worth the work. I do think it would be best to have oats be part of a crop rotation so that a person can get a range of grains over to time into their stores. All in all, I will see how it works as time moves on. 

PVIR:Solar Power panel using both visible and IR light.

                As I've been working on my house power sources are an ever recurring theme. Right now my house is power via the electrical mains from the local power company. I'm luck where I live because power is very cheap, about $.07 USD per Kw/h. But recently we lost power during one of our later summer storms that hit us with 60mph winds. I was able to hook a battery and get things back up, but what if this happens for a long period of time?? How will I recharge my batteries then? Well that is what brought about this project.

               This is part of a 4 part project that I will working on between a few other things. I'll have some blog post up about the other 3 parts later on this month. The other parts being: The battery Bank, The wind turbine, and the Rectifier system. I hope also to build a control for the whole system but I'm not sure when that will come. The idea behind all of this is to build a system that will have multiple ways of charging my battery backups so that I will also have some kind of power source no matter what happens to the mains. I hope that down the line I'll be able to build a grid tie in system and sell power back to the system, but the cost of those systems are quite high now.

So this part the project will be like a Solar panel PLUS!!!  But before I geek out too much, lets get into some theory first.

Theory of Solar Panel Operation

            So the way that Solar Panels, or Photovoltaic cells, work is wonderfully simple. A photon of 1100mn or shorter in wavelength hit a silicon molecule. This excites one of the electrons in the valence shell of the atom which bumps it up an orbit. This causes a potential difference in the doped silicon which will give you the ability to charge batteries or power a device with enough of it. Now there are a few shortcomings of this system. First any and all wavelengths longer than 1100 nm are just absorbed by the device and converted into heat. As we move to shorter wavelengths than 1100 nm less and less of photons energy is used to create current, so that excess energy also goes into heating the device. So there is a whole lot of heating going on, unless you are only getting 1100 nm wavelength of light. 

So, lets put this into some more practical info, shale we?

Source:http://www.viridiansolar.co.uk/Solar_Energy_Guide_5_2.htm

The above figure gives you a rough breakdown of the spectrum emitted from our star. Peaking around 550 nm or and tapering off from there. Keep in mind that IR is 700 nm and longer, Visible is 700 nm to about 400 nm. UV is about 400 nm and short in wavelength.  Now as you can see from the figure a fair portion of this spectrum is absorbed by our atmosphere. Via that you can see the spectral lines for H20, O2, N, and CO2.  The green section is the section which we want to look at, this is the septicum which with work with silicon PV cells. Everything else that hits our panel with be converted into heat! 

On top of this we will need a transparent material to allow photons of different wavelengths through to our PV cells but keep rain and such out. Luck for us most polycarbonate transparent materials will do the trick.

Source:http://www.plasticgenius.com/2011/05/infrared-and-ultraviolet-transmission.html

We can see here that the bandpass of Makrolon is from about 400nm to about 1700nm. This is plenty to help our panel work. (Note:Lexen and other polycarbonate materials should have a bandpass about like this.)

But we run into a problem, what do we do with all the energy the PV cell can't convert to current??

Converting IR to Current:

             After look at the info above I've guessing it's quite clear that PV cells are not the most efficient power source in the world. In fact the ideal PV cell can only convert 31% of the photons that hit it into current. The remaining 69% will just heat things up. Now there isn't much out there yet in production that is a "solar cell for UV", yet! There are a few things still in testing that may fix this problem later. But until that point we are left just letting the 400nm+ spectrum to hit our devices and heat them up. 

Now we do have some options for using all of that radiation below 1100nm coming off the sun and our devices. Heat has for a long time been used to produce power one way or the other, and this is where will with add the "IR" to our "PVIR" panel.

The most well known way to convert IR into current without any moving parts is with a peltier diode pack. These devices are used to both generate current as well as sense thermal shifts. The way this works is as the temperature shifts the forward voltage for the diode changes. The benefit of this is that if you heat one side up and cool off the other it will create current. 

The other way we can create some current from our IR is to use the heat to move other things, like air, or steam. By making sure the area behind the PV cells will absorb as much IR as it can we will be able to transfer that energy into water. This can be via mount the PV cells onto a thermally conductive pad, like sil-pad, then mounting this on to a copper plate.  You can then solder copper pipes to the back of the plate. The water running through the pipes will heat up and this heat change can be used create steam.(Note: Not test yet!)

Another way would be to heat air up in the are behind the PV cells, this air would then rise through a vent which could have "wind turbine" on the opening. This would then spin to give us some more current.
The water idea can also be used with our Peltier diode packs, attaching one side to the PV Cell copper plate/heatsink and the other side to a copper block soldered to the water in take we will create a thermal difference. This could also work by using the air intake as a cooler as well.

The PV Cells:

              Now this is where things get a bit confusing. Data on PV cells can be a bit flaky, at best. In my search for cheap cells I found a few good deals, with ZERO documentation! So I'm going to have to wing this a bit and hope I can figure out some better specs as I go.

Most solar cells have ratings such as this:

Source:www.spectrolab.com/DataSheets/SJCell/sj.pdf

These are the specs for 7cm x 7cm high output cells. These guys are a bit price and not what we will be working with, but they are the best datasheet I could find. 

Here you can see our current/voltage, Efficiency/wavelength, and the specs of open and short circuit voltage/current. We also have the temp coefficients which will tell use how the out put will change over a range of temps. Based on most the data I have seen the current/voltage is very standard as well as the efficiency/wavelength. Also the open circuit, closed circuit data seems very standard as well. But I couldn't find much info on how the output of the panels changed over a temperature range. I found some sources that state it change up to 33% between 0C and 75C.(Source:jeldev.org/9Tayyan.pdf) Now this is a very extreme shift in temperature, but it gives you some idea of how what your PV cells will be doing over days and year. 

From talking to many people who have built panels before as well as some info on google it seems the standard is 36 cells to charge a 12VDC battery system. Now I questioned this as most sites show 0.5VDC as the Avg voltage for a cell. Well for the above cell that would be right, but now looks at a cheap cell.

Source:http://www.hebesolar.com/solution/Photovoltaic-Cells-2.html

This a data sheet for a cell that is close to the one I'm buying for this project, a 150mmx150mm multicrystalline silicon cell. Here you can see the roll off voltage is right around 0.45 and 0.5VDC. That sure as hell doesn't look average to me!!! This will be very important to keep in mind when we desgin our panel's layout and order the cells we need.

A final note before first design:

                The biggest thing that I took away from my research on this is that PV power sources are by no means very efficient. In fact I would say they are one of the lowest efficiency sources out there, with only a 31% max and an effective 10% - 19%(based on info seen in my produce searches) there is a lot of energy that is been lost to heat in these systems. So I feel it is important to keep an eye on this and see how you can make the best use of that heat to add to our final system output. 

I think the other important thing to keep in mind here is that this will not be the only source, this will only be one part in a larger picture of power sources. So lets make sure not to put all our electrons in one place. 

I hope this was a good primer on photovoltaic cells and some of the practical elements involved. Next time I'll cover some of the first design idea I have and what will be going into to the first build. 

until that time, keep on hacking!

NTP MON_LIST DDOS attacks. How to spot the hole.

Greetings and happy V-day.

This week I had an old forgotten server compromised by several attacks and added to a bot net. Most of them were well knowns, but the one the got my attention was a high usage of the NTP ports to a wide range of IPs.
Now I figure they were just using the NTP port for command and control ports until I saw that traffic even after I rebuilt the server. After confirming the traffic wasn't coming from an application on the server I did some more digging. With the help found out about this exploit.
DRDoS / Amplification Attack using ntpdc monlist command

Here we found some great info on what the attack was about and how to check for it.
 I won't go into too many details here, but it seems that many OSs out there have this issue which makes this even more important to beef up your systems.

Be in the Know!

So there are a few ways you can get your self in the know with this exploit. Lets start with the basics of what it preys on. NTP has a function called MONLIST, this is called by a datagram with an NTP request code of 42(MON_GETLIST_1). If you are being hit by this you will some thing like this in wireshark.

This is after I have shut down the NTP port. But you will see a lot of this one way or the other. This seems to be the thiey method, just spray requests until you get something.

The way they do this is quite simple. On Linux you can use both nmap and the ntpdc program.
ntpdc is the NTP daemon control program, with the "-c monlist" command line switch you can see if it will respond tot he MON_GETLIST_1 function. You can also use the sysinfo, version, and kerninfo switches to scrap just about everything about the service.

Nmap has a scrip, ntp-monlist, which will do about the same for you
----------------------------------------------------------------------------
Nmap scan report for xxx.xxx.xxx.xxx
Host is up (0.041s latency).
PORT    STATE SERVICE
123/udp open  ntp
| ntp-monlist:
|   Public Servers (3)
|       199.233.236.226 209.114.111.1   217.7.239.199
|   Public Clients (52)
|       12.91.144.54    72.10.7.90      216.229.166.132 216.229.185.71
|       64.35.139.168   198.36.182.163  216.229.166.187 216.229.185.72
|       64.35.139.169   206.63.184.116  216.229.173.6   216.229.185.73
|       64.35.139.170   208.107.61.154  216.229.176.122 216.229.185.74
|       66.117.72.169   216.229.160.1   216.229.177.38  216.229.185.76
|       66.201.136.10   216.229.160.39  216.229.177.46  216.229.185.78
|       66.201.155.222  216.229.161.137 216.229.177.134 216.229.185.80
|       66.225.8.16     216.229.161.142 216.229.185.34  216.229.185.81
|       66.225.8.21     216.229.162.134 216.229.185.63  216.229.185.84
|       66.225.8.62     216.229.166.21  216.229.185.65  216.229.185.85
|       66.225.29.8     216.229.166.84  216.229.185.67  216.229.185.86
|       69.41.148.253   216.229.166.115 216.229.185.69  216.229.185.87
|       69.41.151.18    216.229.166.131 216.229.185.70  216.229.185.88
|   Other Associations (1)
|_      216.229.187.153 (You?) seen 5 times. last tx was unicast v2 mode 7

---------------------------------------------------------------------------------

Here is what ntpdc would give you:

--------------------------------------------------------------------------------

host:~ # ntpdc -c version xxx.xxx.xxx.xxx

ntpdc 4.2.6p5@1.2349-o Mon Jan 28 10:56:47 UTC 2013 (1)

host:~ # ntpdc -c sysinfo xxx.xxx.xxx.xxx

system peer:          0.0.0.0

system peer mode:     unspec

leap indicator:       11

stratum:              16

precision:            -20

root distance:        0.00000 s

root dispersion:      0.00195 s

reference ID:         [73.78.73.84]

reference time:       00000000.00000000  Wed, Feb  6 2036 22:28:16.000

system flags:         auth monitor ntp kernel stats 

jitter:               0.000000 s

stability:            0.000 ppm

broadcastdelay:       0.003998 s

authdelay:            0.000000 s

host:~ # ntpdc -c monlist xxx.xxx.xxx.xxx

remote address          port local address      count m ver rstr avgint  lstint

===============================================================================

216.229.187.153        38995 216.229.160.10         3 7 2    180      7       0

66.225.29.8              123 216.229.160.10         1 3 4    180      0       1

ppp70-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0       5

spk.go180.net            511 216.229.160.10        12 1 3    180     10       5

209.118.204.201          123 216.229.160.10         3 4 4      1     65       5

206.63.184.116           333 216.229.160.10        27 3 4      1      4       7

lanip-177-46.go180.net   123 216.229.160.10         2 3 4    180    130       7

ntp3.Housing.Berkeley.   123 216.229.160.10         3 4 4      1     63       8

12.91.144.54             123 216.229.160.10         3 1 3      1     64       9

69.41.148.253            123 216.229.160.10         5 3 4      1     32      11

ns2.deakin.edu.au        123 216.229.160.10         3 4 4      1     63      11

64-35-139-171.gohighsp   123 216.229.160.10         1 1 3    180      0      13

ppp71-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0      15

198.36.182.163         38026 216.229.160.10         7 3 3      1     20      19

66-117-72-169.gohighsp   123 216.229.160.10         2 3 4    180     65      20

as2-pdt.go180.net        123 216.229.160.10         2 1 3      1     64      25

lanip-177-38.go180.net   123 216.229.160.10         1 3 4    180      0      26

host-154-61-107-208-st    10 216.229.160.10         4 1 3      1     13      26

216.229.173.6            123 216.229.160.10         1 3 4    180      0      26

sc2200-secondary.highs   123 216.229.160.10         2 3 3    180     64      26

srp5-0-br6-levy-spk.go   123 216.229.160.10         2 3 4    180     66      28

srp5-0-levy-spk.go180.   123 216.229.160.10         2 1 4    180     64      30

66.225.8.16              123 216.229.160.10         1 3 4    180      0      30

ppp76-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0      31

ppp78-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0      32

ppp88-as1-spk.go180.ne   123 216.229.160.10         2 3 4    180     63      40

vlan101.cr2.spk.go180.   123 216.229.160.10         2 1 4    180     65      44

barracuda.ci.walla-wal   110 216.229.160.10         2 3 3      1     64      45

ppp80-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0      46

66.201.155.222           123 216.229.160.10         2 1 3      1     64      46

mail.disimaging.com      123 216.229.160.10         1 3 4    180      0      48

ppp74-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0      49

69.41.151.18             123 216.229.160.10         2 3 4      1     64      53

ppp63-as1-spk.go180.ne   123 216.229.160.10         2 3 4    180     63      54

as2-levy-spk.go180.net   123 216.229.160.10         1 1 3    180      0      56

66-117-72-218.gohighsp   123 216.229.160.10         1 3 4    180      0      57

f0-0-br2-wal.go180.net   123 216.229.160.10         1 1 4    180      0      72

ppp34-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0      79

ppp73-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0      85

66.225.8.21              123 216.229.160.10         1 3 4    180      0      85

sc2200-primary.highspe   123 216.229.160.10         1 3 3    180      0      88

ppp67-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0      94

ppp81-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0     101

216.229.166.121          123 216.229.160.10         1 1 3    180      0     101

ppp84-as1-spk.go180.ne   123 216.229.160.10         1 3 4    180      0     101

64-35-142-218.gohighsp   134 216.229.160.10         1 1 3    180      0     105

66.225.8.62              123 216.229.160.10         1 3 4    180      0     116

con1-psc.go180.net       123 216.229.160.10         1 1 3    180      0     135

host:~ # 

------------------------------------------

You can see that ntpdc gives you quite a bit more, but nmap makes much quicker work of it.

What to do about it?

Well now that you know what is going on, you can stop it, right? Well this depends on your setup.

For very good info on locking down NTP take a look at http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html

Sadly they don't have much for windows for windows and I was unable to find anything about hardening windows NTP servers. With this I would say, as I do about any windows server, don't expose this to the internet!!!!

Proactive!!!!

If you want to be proactive about this there are a few ways you can go about it. 

The best is the limit your public facing NTP ports, this limits what the bot nets can even get to.

If have to have a NTP port public facing then you should check and follow the link above to learn how to harden it.

Use the command 

-----------------

nmap -sU -pU:123 -Pn -n --script=ntp-monlist "Your test host here"

------------------

Once you are locked down you should be good to go!!

Conclusion

I want to mess around more with the NTP exploit to better understand how they go about implementing the attack. So look out for a post about the results of  my honeypot setup for NTP.

How to Change your Product Key on Windows Server 2008 R2

Greetings blog-sphere inhabitants!

Here is a quick post with some useful info on product keys on the CLI of windows server 2008.

I was tasked at work to take a copy of a Hyper-V terminal server from a active server and make it into a new server to use as a back up to the main server in which this new one was a copy of.
So, piece of cake, Right? So I do an export of the Hyper-V session, move it to the new physical host and fire it up without a network connection. Change the IP, hostname, etc. Golden, except the windows product key. I do some digging around and find no easy way to do this at first, CRAP!

Well its tech net to help here, I found a VBS to help with this little project. In doing so I found it to be very useful in troubleshoot problems with product keys as well!

The script is located on all installs in C:\windows\system32 and is named slmgr.vbs. Blow are some screenshots of the options for the script.

As you can see thing little script does a hell of a lot!
To replace the current key use the following commands.
slmgr.vbs /ipk xxxxx-xxxxx-xxxxx-xxxxx-xxxxx
(replace the xxxxx with your product key)
The /ipk option, as you can see above, Replaces the current key with the new entered key.
I then,
slmgr.vbs /dlv
slmgr.vbs /dli
These two commands will give you the key info as well as tell you if the key is active or not. You can then activate the key.
Now, the script says it can do this with the /ato options, it lies. You need to use the command slui.exe which will bring the activations wizard up. Make sure you have a connection the net before you do this.

Once you get that all done you are ready to go.
This worked out great because when I change the product key on the server, the DC saw it as an all new server. But there was no installtion to do, everything I needed was already there and ready to go.

I hope this was a helpful post, it was useful info to me.

Until next time, keep on hacking!!!

Project #1:Determining Android Charging power requirements

Greetings!
Well its been a while, and life got crazy, but I'm back with our next post. This one with ADC good. :)


The Process:
The next step in my project is to determine the power requirements for an android phone while charging. The idea is plot the Voltage vs. Current curve, I.E: power, over the length of time in which it takes to charge. This will show how much power, over what duration of time the solar charging source must to provide.
The method to my madness runs something like this, charge several different types of phone, with different power sources and collect the data. This will confirm if there are any different current draws with different power sources on different phones.
With this in mind there are three different parts to this step to this part of the project, the phones, the power sources, and the data collections. Lets start with the data collections.

Analog to Digital Voltage and Current Sampling  Circuit:
To collect the charge curve data I'm using a BS2px24 Basic stamp PIC connected to a MCP-3002 2 channel analog to digital converter reading voltage from a current shunt in series the USB charge circuit for the phone. See below for the circuit:

Circuit Break down:
There are Three parts to this circuit, the current shunt in the charging circuit, the MCP 3002 and the Basic stamp. Each part is mostly KISS and should be easy to follow, but for those less familiar with Electronics I'll break it down.
First the current shut, this is composed of 4, 10 Ohm, 1/2 Watt resistors in parallel with each other. this will make for about .4 Ohms of resistance in  series with the charging circuit. Now ideally you would want to use precision resistors for this as you will need to be spot on with your measurement here. But I'm building this mostly out of scrap so I just used 10% components and then measured the resistance.
The idea of the current shut is that it will drop a small portion of the voltage from the charge circuity that is directly proportional to the current being used in the circuit  You can use : E/R=I where E=voltage, R=the resistance pack(.4 Ohms) and I=the current. So if you measure .53V DC across the resistor pack that means you have 1.32A DC flowing through the charge circuit.

This voltage that is dropped across the resistor pack, as well as the voltage applied to the charge port of the phone is picked up by the MCP3002.

The voltage from the current shunt is sent to the channel 1 input and the voltage at the phone charge port is sent to channel 0. For those who are not familiar with Analog to Digital converters let me give you a quick run down.
The whole function of a ADC(Analog to Digital Converter) is to take a very fluid analog signal and convert it into a 10 bit binary word which a computer or microprocessor can understand. A microprocessor can only understand predefined states, which in this case is >+5V DC(which is a binary 1) or <2 V DC(which is a binary 0). Well is this is not going to work for my project because I need to measure voltages like .53V DC. If I hooked this up right to the I/O(input output) pin it would read 0 all the time. This is where the ADC comes in. It has a sampler which will sample the voltage at a high rate(in this case 10,000/s), convert it into a binary word and send it to the PIC.
The next step of fun comes in getting this binary word to the PIC. This is done via synchronous serial on the Dout pin of the ADC. But before I get to far lets start with the first step of setting the ADC up.
The MCP-3002, according to the data sheet, has two different input modes, and two different read out modes. To set these, mode command bits need to be sent to the ADC in a predefined order. This also needs to be coupled with pluses on the clock pin for each command as well as toggling of the enable pin.
Below is a timing chart so the states of all the input and out pins over the duration of time it takes to send the input commands and get the 10 bit reading back.

I've labeled the different events on the chart so you can follow along with the flow of things.
Something to clarify for those who are new to this, the clock pluses on the CLK pin control when the ADC will receives or send a bit. This synchronizes the PIC and the ADC so no bits are lost in the course of data transfer.
The other thing to point out is the CS pin, this pin pulls the ADC out of standby mode. With out this pin high, the chip will do nothing!
It is important to see that the information above is critical to the functionality of the project as a whole. With out this reliable data transfer we would never be able to get the data we need for this part of the project.

This leads me into the next part of the project, the Basic Stamp, or as I have been calling it the PIC(Programmable IC)

The BS2px24:
This is where it all comes together, in the PIC. The PIC gathers the data words from the ADC, converts them to decimal numbers, formats them and then sends them out to the RS232 port. To aid us in walking in how the PIC does this lets walk through the code. Below is the code in its entirety  I'll show chunks as we walk through it.

' {$STAMP BS2px}

' {$PBASIC 2.5}

SetupPins:

'Setup the pin Functions.

'P0=RS232 in.

INPUT 0

'P1=RS232 out

OUTPUT 1

'P2=SPI in

INPUT 2

'P3=SPI out

OUTPUT 3

'P4=CS(Chip enable)

OUTPUT 4

'P5=Clk(Clock for syncing the SPI communications)

OUTPUT 5

SetupCons:

'Set freindly names for all the I/O pins.

RS232IN CON 0

RS232OUT CON 1

DIN CON 2

DOUT CON 3

CS CON 4

CLK CON 5

SetVars:

'Setup our Variables.

'VIN will be the 10 bit Value repersenting the Voltage read by the MCP3002

VIN VAR Word

'ACDIN will be the bit flag telling the MCP3002 which port to use.

'port 0 is used for Voltage readings and port 1 is use for Current.

AdcIN VAR Bit

'Setup our timing output

TickVal VAR Word

'And a temp tick Var

TickTemp VAR Word

Main:

'Make Sure our Vars are rest

TickVal=0

TickTemp=0

VIN=0

DO

  'Set our port for Voltage

  AdcIN = 0

  'First we get our Voltage

  GOSUB InitMCP3002

  GOSUB ReciveDataBits

  GOSUB Tick

  GOSUB SerialOut

  'Then our Current

  'Set the port for Current

  AdcIN=1

  GOSUB InitMCP3002

  GOSUB ReciveDataBits

  GOSUB Tick

  GOSUB SerialOut

LOOP

Tick:

'Sets up a processes timer which will time stamp all values sent out.

PAUSE 1

TickTemp=TickVal+1

TickVal=TickTemp

RETURN

InitMCP3002:

'Initaite the MCP3002 by sending config bits and a Start bit

'Set clk and cs pins high to indicate idle

HIGH CS

PULSOUT CLK, 5

'Send the start bits by brings CS low and sending a 1 to CLK and DIN

LOW CS

SHIFTOUT DIN, CLK, 0, [1\1]

'Set Mode to Single Ended Mode by sending a 1 on the DIN

SHIFTOUT DIN, CLK, 0, [1\1]

'Set the input to Port with ADCIN Var.

'0 for port 0 and 1 for port 1.

SHIFTOUT DIN, CLK, 0, [ADCIN\1]

'Setting the Format

SHIFTOUT DIN, CLK, 0, [0\1]

'One more clock cycle for the Null bit

PULSOUT CLK, 5

RETURN

ReciveDataBits:

'Read the 10 bit Digital value from the MCP3002.

'The max input(anything over Vdd) will be 1023.

'Read 10 bits from the DOUT pin

VIN = 0

SHIFTIN DOUT, CLK, 0, [VIN\10]

RETURN

SerialOut:

'This sends the raw values to the RS232 Caputer device for further processing.

'Send the voltage out the RS232 port

IF AdcIN =0 THEN

SEROUT RS232OUT, 3313, [DEC5 TickVal," ,",DEC VIN," ,"]

ELSE

SEROUT RS232OUT, 3313, [DEC5 TickVal," ,",DEC VIN," ,",CR,LF]

ENDIF

RETURN

Before we dig into the code I would like to make a few notes on this PIC. For info on the BS2px24 you can go to The Parallax Web Site see all that they have. The langues is call PBASIC, its a low level langue in the form of a high level langue in that it is formatted much like BASIC, but does more low level functions. You can got the link above and find more info on PBASIC as well. Also Note 'this is a comment.  Anything with a ' in front of it is a comment in this langue. 
Now on to the code!

Setup:

' {$STAMP BS2px}

' {$PBASIC 2.5}

SetupPins:

'Setup the pin Functions.

'P0=RS232 in.

INPUT 0

'P1=RS232 out

OUTPUT 1

'P2=SPI in

INPUT 2

'P3=SPI out

OUTPUT 3

'P4=CS(Chip enable)

OUTPUT 4

'P5=Clk(Clock for syncing the SPI communications)

OUTPUT 5

First we must tell PBASIC how to compile on load to the PIC. The first two lines do this, it tells the compiler that this is a BS2px and that its using PBASIC version 2.5.
BS2px24 PICs have 16 I/O pins labeled P0-P15, before we do anything with these pins we have to tell them what their function is going to be. This is what the "SetupPins:" Subsection is all about. You can see above each pin constant I have put a comment as to its function.

SetupCons:

'Set freindly names for all the I/O pins.

RS232IN CON 0

RS232OUT CON 1

DIN CON 2

DOUT CON 3

CS CON 4

CLK CON 5

Next we set our constants up, these are all names we give to the Pin. I've set the names up to be the function of the pins so it easier to follow the code.

SetVars:

'Setup our Variables.

'VIN will be the 10 bit Value repersenting the Voltage read by the MCP3002

VIN VAR Word

'ACDIN will be the bit flag telling the MCP3002 which port to use.

'port 0 is used for Voltage readings and port 1 is use for Current.

AdcIN VAR Bit

'Setup our timing output

TickVal VAR Word

'And a temp tick Var

TickTemp VAR Word

Here we set the variables used in the in the program, they are self explanatory for the most part. You get some more clarification when you see them used.

Sub-routines:

Tick:

'Sets up a processes timer which will time stamp all values sent out.

PAUSE 1

TickTemp=TickVal+1

TickVal=TickTemp

RETURN

Here we have a simple timing setup. Sadly PBASIC is a little limited in its arithmetic functions, so I had to do the mess with TickTemp=Tickval+1.

InitMCP3002:

'Initaite the MCP3002 by sending config bits and a Start bit

'Set clk and cs pins high to indicate idle

HIGH CS

PULSOUT CLK, 5

'Send the start bits by brings CS low and sending a 1 to CLK and DIN

LOW CS

SHIFTOUT DIN, CLK, 0, [1\1]

'Set Mode to Single Ended Mode by sending a 1 on the DIN

SHIFTOUT DIN, CLK, 0, [1\1]

'Set the input to Port with ADCIN Var.

'0 for port 0 and 1 for port 1.

SHIFTOUT DIN, CLK, 0, [ADCIN\1]

'Setting the Format

SHIFTOUT DIN, CLK, 0, [0\1]

'One more clock cycle for the Null bit

PULSOUT CLK, 5

RETURN

Here is the programming behind the first part of our timing diagram. You can see where we set out CS high and send out a pulse on the CLK pin. Here we doing it for 5 clock cycles, this makes it long enough for the ADC to see it as a clock pluse.
 Next we pull the CS low to turn the chip on and then send a 1 bit out the Din pin and send a clock pulse out. This starts off the set up process on the ADC that we spoke of above. You can see the rest of this in the comments and compare it to the timing diagram.

ReciveDataBits:

'Read the 10 bit Digital value from the MCP3002.

'The max input(anything over Vdd) will be 1023.

'Read 10 bits from the DOUT pin

VIN = 0

SHIFTIN DOUT, CLK, 0, [VIN\10]

RETURN

Here we are shifting in to our 10 bit ADC output value into the VIN variable. If you noticed in the variable set section we set this variable up as a word, which is 16 bits long. This is a limitation of PBASIC in how it sets up it variables. You can have a single bit, a nibble(4 bits), a byte(8 bits), or a word( 16 bytes). This secontion is not quite as clear, the line "SHIFTIN DOUT, CLK, 0, [VIN\10]" is doing the shifting in. The SHIFTIN DOUT is telling the PIC to recive bits on the DOUT pin. Then use the CLK pin to send sync pulse out to the ADC. The 0, [VIN/10] tells the PIC to not change the order the bits come in and to put the bits into VIN and that there are 10 bits to receive.

SerialOut:

'This sends the raw values to the RS232 Caputer device for further processing.

'Send the voltage out the RS232 port

IF AdcIN =0 THEN

SEROUT RS232OUT, 3313, [DEC5 TickVal," ,",DEC VIN," ,"]

ELSE

SEROUT RS232OUT, 3313, [DEC5 TickVal," ,",DEC VIN," ,",CR,LF]

ENDIF

RETURN

This is our last sub-routine,  Here we take our values and send them out to computer's RS232 port. We have to first figure out what port we are reading. If AdcIN is set to 0 then we are reading the port voltage and will send that info out. If we are reading port 1 then we are reading the shunt voltage and we will send that value out. Along with each value we will send out the TickVal so we know how many milliseoncds into the test we are.

Main Code Section:
Here is where it all comes together, we stitch all the sub-routines together and make it work!

Main:

'Make Sure our Vars are rest

TickVal=0

TickTemp=0

VIN=0

DO

  'Set our port for Voltage

  AdcIN = 0

  'First we get our Voltage

  GOSUB InitMCP3002

  GOSUB ReciveDataBits

  GOSUB Tick

  GOSUB SerialOut

  'Then our Current

  'Set the port for Current

  AdcIN=1

  GOSUB InitMCP3002

  GOSUB ReciveDataBits

  GOSUB Tick

  GOSUB SerialOut

LOOP

So first we make sure all variables are set to zero, then we dive into a loop. This keeps the process going none stop so we can just keep making measurements until the PIC is turned off. So in the loop we first read port 0 for our charge port voltage, we set up the ADC, read the bits, count the time, then send it to out the RS232 port. Next we do the same thing on port 1 for the shunt voltage reading. Then we loop till the cows come home!

Next up, Conclusions!!!!
Stay tuned for the test results and what the next testing step will be. :)