Comments for Static in the Ether http://lair.moria.org/blog Unix, Information Security & Systems Administration Mon, 01 Dec 2008 21:26:44 +0000 http://wordpress.org/?v=2.6.3 Comment on XP failing to hibernate by wobtap http://lair.moria.org/blog/archives/14#comment-1587 wobtap Tue, 25 Nov 2008 08:47:19 +0000 http://lair.moria.org/blog/?p=14#comment-1587 Shot. I have been struggling to ask Google the right question! Shot. I have been struggling to ask Google the right question!

]]> Comment on A Mafia take on the OSI stack by Daemon http://lair.moria.org/blog/archives/163#comment-1169 Daemon Wed, 12 Nov 2008 19:14:21 +0000 http://lair.moria.org/blog/?p=163#comment-1169 All People Seem To Need Data Pipes All
People
Seem
To
Need
Data
Pipes

]]> Comment on Phishing on Phacebook ? by mh http://lair.moria.org/blog/archives/150#comment-777 mh Sat, 25 Oct 2008 09:26:05 +0000 http://lair.moria.org/blog/?p=150#comment-777 Interestingly enough, this months fortune magazine (or forbes - i cant quite recall) has a regular columnist whining about being caught in exactly such a scam. His creds were then used to send in facebook spam [with a sim. message) to his >1000 friends.. He complained about FaceBook's lameness at not protecting him, and ended with their lameness at not warning their users of using the same creds they use on other sites like internet banking.. /mh ps: for the redaction a) the image is called domphishing - a casae insensitive search for dom on ur blog gives u a first hit winner b) a fb search for rhodes - gives u b irwin as hit 1, and a dom as hit 2 (ooh, same pic) c) if anyone in gauteng ever drove past a hair style like that, the image wld be burned in their mind forever and i submit it wld be more memorable than a name tag at a conf! Interestingly enough, this months fortune magazine (or forbes - i cant quite recall) has a regular columnist whining about being caught in exactly such a scam. His creds were then used to send in facebook spam [with a sim. message) to his >1000 friends..
He complained about FaceBook’s lameness at not protecting him, and ended with their lameness at not warning their users of using the same creds they use on other sites like internet banking..
/mh
ps: for the redaction
a) the image is called domphishing - a casae insensitive search for dom on ur blog gives u a first hit winner
b) a fb search for rhodes - gives u b irwin as hit 1, and a dom as hit 2 (ooh, same pic)
c) if anyone in gauteng ever drove past a hair style like that, the image wld be burned in their mind forever and i submit it wld be more memorable than a name tag at a conf!

]]> Comment on BibTeX frequency table by Recent URLs tagged Lyx - Urlrecorder http://lair.moria.org/blog/archives/36#comment-207 Recent URLs tagged Lyx - Urlrecorder Tue, 16 Sep 2008 06:58:50 +0000 http://lair.moria.org/blog/?p=36#comment-207 [...] Recent public urls tagged "lyx" → BibTeX frequency table [...] [...] Recent public urls tagged “lyx” → BibTeX frequency table [...]

]]> Comment on Defcon16 Toolsets by pascals.blog : L'été a été chaud... http://lair.moria.org/blog/archives/94#comment-113 pascals.blog : L'été a été chaud... Thu, 04 Sep 2008 17:09:25 +0000 http://lair.moria.org/blog/?p=94#comment-113 [...] présentations de l'été sont disponibles : Black Hat, DEFCON, ainsi que des compilations d'outils diffusés lors du [...] [...] présentations de l’été sont disponibles : Black Hat, DEFCON, ainsi que des compilations d’outils diffusés lors du [...]

]]> Comment on Security and Networks Research Group (SNRG) Site launch by Barry Irwin http://lair.moria.org/blog/archives/129#comment-86 Barry Irwin Tue, 02 Sep 2008 11:02:28 +0000 http://lair.moria.org/blog/?p=129#comment-86 Loving the technical SNAFU's!!! Problem will be resolved by the next available..... Loving the technical SNAFU’s!!! Problem will be resolved by the next available…..

]]> Comment on Security and Networks Research Group (SNRG) Site launch by mh http://lair.moria.org/blog/archives/129#comment-85 mh Tue, 02 Sep 2008 10:19:10 +0000 http://lair.moria.org/blog/?p=129#comment-85 sanfu #n+1: HTTP/1.1 403 Forbidden Your site works by IP, so: wh00t:~ haroon$ telnet snrg.ict.ru.ac.za 80 Trying 146.231.120.74... Connected to spiderman4.ict.ru.ac.za. Escape character is '^]'. GET / HTTP/1.0 HTTP/1.1 200 OK is cool... but: wh00t:~ haroon$ telnet snrg.ict.ru.ac.za 80 Trying 146.231.120.74... Connected to spiderman4.ict.ru.ac.za. Escape character is '^]'. GET / HTTP/1.1 Host: snrg.ict.ru.ac.za HTTP/1.1 403 Forbidden /mh sanfu #n+1: HTTP/1.1 403 Forbidden

Your site works by IP, so:
wh00t:~ haroon$ telnet snrg.ict.ru.ac.za 80
Trying 146.231.120.74…
Connected to spiderman4.ict.ru.ac.za.
Escape character is ‘^]’.
GET / HTTP/1.0

HTTP/1.1 200 OK

is cool…

but:
wh00t:~ haroon$ telnet snrg.ict.ru.ac.za 80
Trying 146.231.120.74…
Connected to spiderman4.ict.ru.ac.za.
Escape character is ‘^]’.
GET / HTTP/1.1
Host: snrg.ict.ru.ac.za

HTTP/1.1 403 Forbidden

/mh

]]> Comment on Verifying Smime content with openSSL by Shaun Dewberry http://lair.moria.org/blog/archives/123#comment-79 Shaun Dewberry Mon, 01 Sep 2008 22:23:17 +0000 http://lair.moria.org/blog/?p=123#comment-79 Ah yes, the old corporate email disclaimer that gets bolted on haphazardly at the mail gateway, often using nothing more than a sendmail rewrite kluge. I've been fighting the battle against email disclaimers for over 5 years, specifically because of the integrity damage it does to a message. (and also cos its just a damned waste of bandwidth) I came up with three solutions - 1. Add an extra message header at the gateway, which references the URL of a message disclaimer (i.e. X-Disclaimer: Visit http://x.y/disclaimer). Not sure how well this gets through the legal minefield, but at least it doesn't mess with the email. 2. Plead ignorance, stupidity or incompetence when asked to add this functionality to corporate mail servers. ("Sorry boss, I have no idea how to do that, but I think if we spend $$$++ we can get it") 3. Try and get everyone to add the standard corporate sig/disclaimer directly in their email client. Perhaps some sort of "network notaries" system could be setup similar to Firefox extension Perspectives (http://www.cs.cmu.edu/~perspectives/firefox.html) which could turn the above "strip and verify" manual process into something more automated. Ah yes, the old corporate email disclaimer that gets bolted on haphazardly at the mail gateway, often using nothing more than a sendmail rewrite kluge. I’ve been fighting the battle against email disclaimers for over 5 years, specifically because of the integrity damage it does to a message. (and also cos its just a damned waste of bandwidth)

I came up with three solutions -
1. Add an extra message header at the gateway, which references the URL of a message disclaimer (i.e. X-Disclaimer: Visit http://x.y/disclaimer). Not sure how well this gets through the legal minefield, but at least it doesn’t mess with the email.
2. Plead ignorance, stupidity or incompetence when asked to add this functionality to corporate mail servers. (”Sorry boss, I have no idea how to do that, but I think if we spend $$$++ we can get it”)
3. Try and get everyone to add the standard corporate sig/disclaimer directly in their email client.

Perhaps some sort of “network notaries” system could be setup similar to Firefox extension Perspectives (http://www.cs.cmu.edu/~perspectives/firefox.html) which could turn the above “strip and verify” manual process into something more automated.

]]> Comment on Points Transfer with CAcert by Barry Irwin http://lair.moria.org/blog/archives/84#comment-47 Barry Irwin Tue, 26 Aug 2008 11:07:59 +0000 http://lair.moria.org/blog/?p=84#comment-47 I Can generate Valid signed certificates from the CACert site, however these require the explicit installation of the CAcert Class 1 certificate in order to be seamlessly used with browsers. This has to do with the current non-inclusion of the cert in the CApacks commonly used by browser vendors. CAcert is currently getting its ducks in a row with hopeful inclusion in the next edition of Firefox. In effect CAcert simply makes life a lot easier for peopole currently wanting to use Certificate bases systems without coing to the hastle of setting up their own CA system. I Can generate Valid signed certificates from the CACert site, however these require the explicit installation of the CAcert Class 1 certificate in order to be seamlessly used with browsers. This has to do with the current non-inclusion of the cert in the CApacks commonly used by browser vendors.

CAcert is currently getting its ducks in a row with hopeful inclusion in the next edition of Firefox.

In effect CAcert simply makes life a lot easier for peopole currently wanting to use Certificate bases systems without coing to the hastle of setting up their own CA system.

]]> Comment on Verifying Smime content with openSSL by Barry Irwin http://lair.moria.org/blog/archives/123#comment-46 Barry Irwin Tue, 26 Aug 2008 11:04:30 +0000 http://lair.moria.org/blog/?p=123#comment-46 Yes this does seem to be a failing in the way Thunderbird processes the S/MIME packaging. With encrypted content it does seem to work however. The question also comes on whether the CERTIFICATE is valid, or whether the Signature is valid? It would appear that no warning is issued when the signature of the .s7m is found to be valid. Certificates are ignored it appears. Yes this does seem to be a failing in the way Thunderbird processes the S/MIME packaging. With encrypted content it does seem to work however. The question also comes on whether the CERTIFICATE is valid, or whether the Signature is valid? It would appear that no warning is issued when the signature of the .s7m is found to be valid. Certificates are ignored it appears.

]]> Comment on Points Transfer with CAcert by Anonymous http://lair.moria.org/blog/archives/84#comment-43 Anonymous Mon, 25 Aug 2008 20:20:01 +0000 http://lair.moria.org/blog/?p=84#comment-43 Do you get a valid cert trusted by your mother's browser? Do you get a valid cert trusted by your mother’s browser?

]]> Comment on Verifying Smime content with openSSL by Anonymous http://lair.moria.org/blog/archives/123#comment-42 Anonymous Mon, 25 Aug 2008 20:19:10 +0000 http://lair.moria.org/blog/?p=123#comment-42 So, if I tell Outlook to just send the signed bit and not send the clear text mail as well, Thunderbird reads and displays the e-mail just fine, and the sif relay attaches the disclaimer as a seperate attachment (because there is no text portion for it to append to). But, to Thunderbird's discredit, it has happily parsed the .s7m attachment, without mentioning whether the cert is valid! So, if I tell Outlook to just send the signed bit and not send the clear text mail as well, Thunderbird reads and displays the e-mail just fine, and the sif relay attaches the disclaimer as a seperate attachment (because there is no text portion for it to append to). But, to Thunderbird’s discredit, it has happily parsed the .s7m attachment, without mentioning whether the cert is valid!

]]> Comment on Defcon16 Toolsets by DEFCON 16 http://lair.moria.org/blog/archives/94#comment-33 DEFCON 16 Sun, 24 Aug 2008 18:01:39 +0000 http://lair.moria.org/blog/?p=94#comment-33 [...] http://lair.moria.org/blog/archives/94 [...] [...] http://lair.moria.org/blog/archives/94 [...]

]]> Comment on Implementing Captchas by Dominic White http://lair.moria.org/blog/archives/110#comment-32 Dominic White Sun, 24 Aug 2008 17:41:52 +0000 http://lair.moria.org/blog/?p=110#comment-32 Yay, I'm glad to see that the security onion is catching on. Yay, I’m glad to see that the security onion is catching on.

]]> Comment on Free Windows CD authoring and image burning by Recent Faves Tagged With "gplv2" : MyNetFaves http://lair.moria.org/blog/archives/80#comment-30 Recent Faves Tagged With "gplv2" : MyNetFaves Sun, 24 Aug 2008 13:14:08 +0000 http://lair.moria.org/blog/?p=80#comment-30 [...] public links >> gplv2 License Compliance Engineering First saved by nullwert | 0 days ago Free Windows CD authoring and image burning First saved by hollygraham | 2 days [...] [...] public links >> gplv2 License Compliance Engineering First saved by nullwert | 0 days ago Free Windows CD authoring and image burning First saved by hollygraham | 2 days [...]

]]> Comment on DAVIX live CD looking for Beta Testers by Defcon16 Toolsets | Static in the Ether http://lair.moria.org/blog/archives/55#comment-25 Defcon16 Toolsets | Static in the Ether Wed, 20 Aug 2008 21:29:28 +0000 http://lair.moria.org/blog/?p=55#comment-25 [...] With the 16th incarnation of Defcon having come and gone last week, a number of people have put together a nice list of the various tools released. The ZDnet’s Rob Fuller has done all the hard work of tracking down the various tools and their websites in his article -  entitled “ DEFCON 16: List of tools and stuff released “seems to be the most definitive.   Of all the tools release its DAVIX, that makes me happiest, other than it being a relaly slick Compilation of VizSec tools, it also features InetVis, which is a part of the postgraduate research by one of my students (Jean-Pierre van Riel), which I previously posted about. [...] [...] With the 16th incarnation of Defcon having come and gone last week, a number of people have put together a nice list of the various tools released. The ZDnet’s Rob Fuller has done all the hard work of tracking down the various tools and their websites in his article -  entitled “ DEFCON 16: List of tools and stuff released “seems to be the most definitive.   Of all the tools release its DAVIX, that makes me happiest, other than it being a relaly slick Compilation of VizSec tools, it also features InetVis, which is a part of the postgraduate research by one of my students (Jean-Pierre van Riel), which I previously posted about. [...]

]]> Comment on Migrating URLs with apache and mod_rewrite by RSS feeds have moved | Static in the Ether http://lair.moria.org/blog/archives/47#comment-11 RSS feeds have moved | Static in the Ether Tue, 10 Jun 2008 06:14:44 +0000 http://lair.moria.org/blog/?p=47#comment-11 [...] to my previous post about using mod_rewrite to direct my old feed URLs to the right place, its probably time to notify people who read them in aggregators that the URI [...] [...] to my previous post about using mod_rewrite to direct my old feed URLs to the right place, its probably time to notify people who read them in aggregators that the URI [...]

]]> Comment on RFC BibTeX resource by Another RFC to BibTeX script | Static in the Ether http://lair.moria.org/blog/archives/16#comment-9 Another RFC to BibTeX script | Static in the Ether Mon, 09 Jun 2008 05:43:55 +0000 http://lair.moria.org/blog/?p=16#comment-9 [...] form my earlier post regarding a pre-compiled bibTeX database of all Internet RFCs, I discovered while browsing the CTAN archives that Richard Mortier wrote a awk script back in 2000 [...] [...] form my earlier post regarding a pre-compiled bibTeX database of all Internet RFCs, I discovered while browsing the CTAN archives that Richard Mortier wrote a awk script back in 2000 [...]

]]> Comment on XP failing to hibernate by Wordpress and dealing with incoming hacks | Static in the Ether http://lair.moria.org/blog/archives/14#comment-8 Wordpress and dealing with incoming hacks | Static in the Ether Sat, 07 Jun 2008 17:17:30 +0000 http://lair.moria.org/blog/?p=14#comment-8 [...] rather amusing. Another interesting observation is the number of requests centered around http://lair.moria.org/blog/archives/14 my post relating to a title=”Windows XP failing to hibernate” [...] [...] rather amusing. Another interesting observation is the number of requests centered around http://lair.moria.org/blog/archives/14 my post relating to a title=”Windows XP failing to hibernate” [...]

]]> Comment on Migrating URLs with apache and mod_rewrite by Barry Irwin http://lair.moria.org/blog/archives/47#comment-7 Barry Irwin Fri, 06 Jun 2008 17:41:52 +0000 http://lair.moria.org/blog/?p=47#comment-7 http://www.askapache.com/htaccess/mod_rewrite-tips-and-tricks.html has some other really useful shortcuts. http://www.askapache.com/htaccess/mod_rewrite-tips-and-tricks.html has some other really useful shortcuts.

]]>