Latest IE7 version is nothing but a malware

The message body runs as below:

-----------------------------------------------------------------------------------------------
Download the latest version Internet Explorer 7.0! About this mailing:
You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the "Unsubscribe" link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers' content nor any of the goods or service advertised. Prices and item availability subject to change without notice.

�2008 Microsoft | Unsubscribe | More Newsletters | Privacy

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052
-----------------------------------------------------------------------------------------------


Warning: Dont click the link above; it will download a malware, that even AV vendors are confused how they gonna name it :) See: http://www.virustotal.com/analisis/18b97fb3bc30251051a8542a90401b6f

AV's have good coverage though for this piece of malware :-)

Christina Aguilera Interesting video

Video of Christina Aguilera is currently being spammed by some malware.
Dont temp to download if you dont like to be infected :-)

The mail looks like below:


When you click the link, it will go to a website that will download the file videoXXX67h8.exe (72,704 bytes). Virustotal shows several AV vendors detecting it as malicious: http://www.virustotal.com/analisis/fa5924ec4f51bc1c16a83b280756b3da

You can ofcourse check the header to manually search and download the malware from the link in the screenshot:

Canadian Pharmacy scam has resurfaced, and shifted its spam strategy. The Canadian Pharmacy had been very active in the past. Its new strategy, though not new in spam world, is to compose emails with long message body, then inserts a hyperlink somewhere in any part of the email content. I've observed some spam emails from this botnet-operated pharmacy that slips from the spam filtering software, but it wont take that lonf for sure.

Figure 1 is an example of the spam mail. The message may look legit, but when you read it's content, its nothing but random words or phrases.The link to the canadian pharmacy wbsite is inserted as a small hyperlink, and when you view the included image, Figure 2 will be revealed. Familiar?

Figure 1. Canadian Pharmacy Spam mail

Figure 2. Loaded image

If you're still in doubt, try to click the image area which will redirect you to the actual canadian pharmacy website (See Figure 3)

Figure 3. Canadian Pharmacy website

OpenPacket.org

This looks pretty helpful when you deal with network/packet research:
Check: https://www.openpacket.org/

Angelina is in your (Spam) mailbox!

While most of us simply ignoring the spam mailbox, sometimes its a good idea to check them once in a while. But be ready as viruses mostly are lurking in your spammed mails.
So always wear some protection - use sandboxie while browser. It's not 100% malware proof but most of the time its enough layer of protection against web based exploits and malware.

I will be using my gmail account for demonstration.

1. Browse the Spam folder and slect anything cathces your interest.
2. Spams range from medicines, watches, and of course porn.

3. Hmmm..look at that subject above (highlighted in red):
"Angelina Jolie naked - WATCH". Isnt it interesting??

4. Google is so security conscious. By default, the objects that may contain malicious code, eg. graphics files, are not displayed by default. OK lets open it! Woaah!
5. As you can see, there is a watch link thats waiting for you to click if you wanna see more of Angelina!

6. But be cautious! This is the most common strategy of malware author spamming their malicious programs (or virus) to unsoliciting recipients.

Tip. You can check the SMTP header and the html code to see any malicious objects, like links to executable files or other javascripts. You can do it by clicking the small rectangular button in the picture below:

Clicking the "Show original" will show you the SMTP header and the HTML inside the mail as similar below:

7. Gotcha! You next step now is to manually download the exe file and send it to AV vendors if you can't analyze it by yourself. Or send it to online sandboxing services like Anubis (my favorite), Norman, CWsandbox, and free virus scanning Virustotal or virusscan.

Tamarin

http://hecker.org/mozilla/adobe-mozilla-and-tamarin

Security tools/RCE tools

Thanks to people for maintaining the ff links. Very helpful in our field.

Security Tools:
http://securitytools.wikidot.com/

RCE Tools:
http://www.woodmann.com/collaborative/tools/index.php/Category:RCE_Tools

Google hacking could lead to Zlob infection!

Link:http://www.fortiguardcenter.com/analysis/googlehackzlob.html

Hello World v0.2!

Its time to facelift this blogsite and be more active =P
This was my previous personal online notepad, but thanks to Google for its online notepad so I wont need this anymore. Instead, I will convert this into MALWARE, SECURITY and REVERSE ENGINEERING blogsite!!!
Stay tuned! lolz!!

How to detect version of MS Visual Studio or compiler in compilation time?

To do this you should use _MSC_VER define like in this code:
#if _MSC_VER >= 1400 // this is Visual C++ 2005
#elif _MSC_VER >= 1310 // this is Visual C++ .NET 2003
#elif _MSC_VER > 1300 // this is Visual C++ .NET 2002

KDE4 Problem ?

I experienced a problem with Kubuntu.

I couldn't login to the X window, and even manually starting the X window after logging in via console, sometimes doesn't work. Well, (un)fortunately, I'm not the only one experiencing this problem. Thanks to this link and it solves my problem: http://ubuntuforums.org/showthread.php?p=4320584

So if you think we have the same problem, open the file 'xsession-errors' at your home directory with any text editor (vi/vim/etc) or commands like tail,less,etc:

~$ tail -20 ~/.xsession-errors

And look at the end of the file for something similar below:
:
kdecore (KLocale): WARNING: Definition of PluralForm is none of NoPlural/TwoForms/French/OneTwoRest/Russian/Polish/ Slovenian/Lithuanian/Czech/Slovak/Arabic/Balcan/Ma cedonian/Gaeilge/Maltese: Definition of PluralForm - to be set by the translator of kdelibs.po
:

This is a language pack problem. So removing the following will fix the problem (atleast for me).

~$ sudo aptitude remove language-pack-kde-en
~$ sudo aptitude remove language-pack-kde-en-base

PHP/Obfu.A

http://pastebin.com/fbccb9f2
http://www.ecks90.com/?id=42

Obfuscated python

http://www.p-nand-q.com/python/obfuscated_python.html

portbunny is out!

another port scanner, written in C, wrapped in python
check this out! http://www.recurity-labs.com/portbunny/portbunny.html

ClamAV setup

Download location (HTTP):

http://www.clamav.net/

Installation of Clamav

First is to add a dedicated group and user for the clamav daemons and
environment.

groupadd -g 40 clamav
useradd -c "CLAMAV Owner" -m -d /var/lib/clamav -g clamav -u 40 -s
/bin/bash clamav

Notes
. all the others daemons (clamsmtpd and freshclam) and scripts will be
running under the same account: clamav.
This account needs a valid shell and home directory for executing a
shell-script when a virus is found.
. the number 40 for the groupidnr and useridnr is arbitraty. You can
choose one suitable for you.

With the new account create an environment:

cd /var/lib/clamav
mkdir {bin,db,log,run,template,tmp}
chown -R clamav:clamav /var/lib/clamav
chmod 700 /var/lib/clamav

Configuring, compiling and installing the software. Note I use a one
directory: /var/lib/clamav.

./configure --prefix=/usr \
--sysconfdir=/etc \
--localstatdir=/var \
--libexecdir=/usr/sbin \
--disable-clamuko \
--with-user=clamav \
--with-group=clamav \
--with-dbdir=/var/lib/clamav/db
make
make install

Clamd, clamscan, clamdscan and freshclam are all part of this package.
I only use clamd and freshclam.
The daemons clamd and freshclam are installed in /usr/sbin, and the
configurationfiles clamav.conf and freshclam.conf are in /etc.
A database with signatures of virusses is installed in
/var/lib/clamav/db, which is an old version. It will be updated as soon
as the freshclam daemon is running.

Configuration of Clamav

The configurationfile of the clamd-daemon is /etc/clamd.conf. The
settings I use are:
(only the most important are shown)

# Example
LogFile /var/lib/clamav/log/clamd.log
#LogFileUnlock
LogTime
LogSyslog
#PidFile

TemporaryDirectory /var/lib/clamav/tmp
DatabaseDirectory /var/lib/clamav/db
LocalSocket /var/lib/clamav/run/clamd.sock
FixStaleSocket
#TCPSocket

User Clamav

ScanPE
ScanOLE2
ScanMail
ScanHTML
#ScanArchive
ScanRAR

Benchmarking programming languages?

Or just visit: http://shootout.alioth.debian.org/ to know how they
benchmark programming languages. Its good to know if your favorite
language beats the other "alternatives".

"How can we benchmark a programming language?
We can't - we benchmark programming language implementations.

How can we benchmark language implementations?
We can't - we measure particular programs."

Pinoy News Links

http://www.abyznewslinks.com/phili.htm

40 Tips for optimizing your php Code

I'm not a PHP coder, but maybe someday I might need to code html and that, I might consider noting these tips:

1. If a method can be static, declare it static. Speed improvement is by a factor of 4.
2. echo is faster than print.
3. Use echo's multiple parameters instead of string concatenation.
4. Set the maxvalue for your for-loops before and not in the loop.
5. Unset your variables to free memory, especially large arrays.
6. Avoid magic like __get, __set, __autoload
7. require_once() is expensive
8. Use full paths in includes and requires, less time spent on resolving the OS paths.
9. If you need to find out the time when the script started executing, $_SERVER[’REQUEST_TIME’] is preferred to time()
10. See if you can use strncasecmp, strpbrk and stripos instead of regex
11. str_replace is faster than preg_replace, but strtr is faster than str_replace by a factor of 4
12. If the function, such as string replacement function, accepts both arrays and single characters as arguments, and if your argument list is not too long, consider writing a few redundant replacement statements, passing one character at a time, instead of one line of code that accepts arrays as search and replace arguments.
13. It's better to use select statements than multi if, else if, statements.
14. Error suppression with @ is very slow.
15. Turn on apache's mod_deflate
16. Close your database connections when you're done with them
17. $row[’id’] is 7 times faster than $row[id]
18. Error messages are expensive
19. Do not use functions inside of for loop, such as for ($x=0; $x <>
20. Incrementing a local variable in a method is the fastest. Nearly the same as calling a local variable in a function.
21. Incrementing a global variable is 2 times slow than a local var.
22. Incrementing an object property (eg. $this->prop++) is 3 times slower than a local variable.
23. Incrementing an undefined local variable is 9-10 times slower than a pre-initialized one.
24. Just declaring a global variable without using it in a function also slows things down (by about the same amount as incrementing a local var). PHP probably does a check to see if the global exists.
25. Method invocation appears to be independent of the number of methods defined in the class because I added 10 more methods to the test class (before and after the test method) with no change in performance.
26. Methods in derived classes run faster than ones defined in the base class.
27. A function call with one parameter and an empty function body takes about the same time as doing 7-8 $localvar++ operations. A similar method call is of course about 15 $localvar++ operations.
28. Surrounding your string by ' instead of " will make things interpret a little faster since php looks for variables inside "..." but not inside '...'. Of course you can only do this when you don't need to have variables in the string.
29. When echoing strings it's faster to separate them by comma instead of dot. Note: This only works with echo, which is a function that can take several strings as arguments.
30. A PHP script will be served at least 2-10 times slower than a static HTML page by Apache. Try to use more static HTML pages and fewer scripts.
31. Your PHP scripts are recompiled every time unless the scripts are cached. Install a PHP caching product to typically increase performance by 25-100% by removing compile times.
32. Cache as much as possible. Use memcached - memcached is a high-performance memory object caching system intended to speed up dynamic web applications by alleviating database load. OP code caches are useful so that your script does not have to be compiled on every request
33. When working with strings and you need to check that the string is either of a certain length you'd understandably would want to use the strlen() function. This function is pretty quick since it's operation does not perform any calculation but merely return the already known length of a string available in the zval structure (internal C struct used to store variables in PHP). However because strlen() is a function it is still somewhat slow because the function call requires several operations such as lowercase & hashtable lookup followed by the execution of said function. In some instance you can improve the speed of your code by using an isset() trick.
    
    Ex.
    if (strlen($foo) <>
34. When incrementing or decrementing the value of the variable $i++ happens to be a tad slower then ++$i. This is something PHP specific and does not apply to other languages, so don't go modifying your C or Java code thinking it'll suddenly become faster, it won't. ++$i happens to be faster in PHP because instead of 4 opcodes used for $i++ you only need 3. Post incrementation actually causes in the creation of a temporary var that is then incremented. While pre-incrementation increases the original value directly. This is one of the optimization that opcode optimized like Zend's PHP optimizer. It is a still a good idea to keep in mind since not all opcode optimizers perform this optimization and there are plenty of ISPs and servers running without an opcode optimizer.
35. Not everything has to be OOP, often it is too much overhead, each method and object call consumes a lot of memory.
36. Do not implement every data structure as a class, arrays are useful, too
37. Don't split methods too much, think, which code you will really re-use
38. You can always split the code of a method later, when needed
39. Make use of the countless predefined functions
40. If you have very time consuming functions in your code, consider writing them as C extensions
41. Profile your code. A profiler shows you, which parts of your code consumes how many time. The Xdebug debugger already contains a profiler. Profiling shows you the bottlenecks in overview
42. mod_gzip which is available as an Apache module compresses your data on the fly and can reduce the data to transfer up to 80%
43. Excellent Article about optimizing php by John Lim

Credit: http://reinholdweber.com/

Setup tftp server on Ubuntu/Kubuntu

1. Install needed software

$sudo apt-get install xinetd tftpd tftp

2. vim /etc/xinetd.d/tftp and put this entry:

service tftp
{
protocol = udp
port = 69
socket_type = dgram
wait = yes
user = root
server = /usr/sbin/in.tftpd
server_args = -s /tftpboot
disable = no
}

3. Make /tftpboot directory

$ sudo mkdir /tftpboot
$ sudo chmod -R 777 /tftpboot
$ sudo chown -R nobody /tftpboot

4. Start tftpd through xinetd

$ sudo /etc/init.d/xinetd start

5. Testing. Transfer file rex.rex from 10.10.1.1 (Client using tftp) to
192.168.1.100 (Server 10.10.1.1):

root@BIKOL:/# touch rex.rex
root@BIKOL:/# chmod 777 rex.rex
root@BIKOL:/# tftp 10.10.1.1
tftp> put test.txt
tftp> quit
root@BIKOL:/# ls /tftpboot/ -l
total 0
-rw------- 1 nobody nogroup 0 2007-10-26 13:45 rex.rex

Credits: http://www.davidsudjiman.info/?p=93

Basic Syslog Configuration on Linux/Ubuntu

When I was learning the basics of syslog configuration, I needed to take
a look on this page
(http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch05_:_Troubleshooting_Linux_with_syslog)
whenever my syslog is not working (ie when something is broken,
misconfigured, etc). Thats when I was learning the Fortigate device, and
testing/tuning some IPS signatures.