Paster.

I recently got pretty sick and tired of sending across source via httpd, if I wanted advice on it and so on. I did a quick search, and discovered on Windows32 there are some implementations of source code uploading applications.

The one I prefer on Windows, is Paster, it was made by Comrade. Take a look at it here at the sourceforge download page, if you're interested in it. It was released under the BSD lisence, thus it's free and open sourced. 😉

I'd highly recommend this, if you program or draw up configurations to rafb.net.

~Omsarti

Status.

It’s been about a year since my last post; I just pretty much got sick of the blogging affair, and needed to do work on things. Now, however I’m going to be doing this, and documenting ideas I have, and reactions to certain things which are implemented.

~Omsarti

Snake Bytes: New DOS Attack Is a Killer

With thanks to Darkreading

SEPTEMBER 30, 2008 | 2:45 PM — Things are a-brewin’ in Sweden. Sweden is not just home of the infamous bikini team, it is also the home of Outpost 24, an equally sexy software-as-a-service network scanning service, and the employer of my friend Robert E. Lee and his colleague Jack C. Louis. These guys are the inventors of UnicornScan, a user-land TCP stack turned into a port scanner. Never heard of it? Use Nmap exclusively? Well if you run Linux, I suggest checking it out, especially if missed ports in your portscan is inexcusable. But I digress.

Robert and Jack are smart dudes. I’ve known them for years, and they’ve always been one step ahead of the game. A couple of years ago, Jack found some anomalies in which machines would stop working in some very specific circumstances while being scanned. A few experiments, tons of reading through documentation, and one mysteriously named tool called “sockstress” later, and the two are now touting a nearly universal denial-of-service (DoS) attack that can be performed on almost any normal broadband Internet connection — in just a few seconds.

How bad is it? Well, in an interview — (fast-forward five minutes in to hear it in English), the two were asked if they could take out a data center. While they’ve never tried, it appears to be a totally plausible attack. Worse yet, unlike most DoS attacks, the machines often do not come back online once the attack is over. The victim system just doesn’t respond any more. Great, huh?

Robert and I talk a lot, and I asked him if he’d be willing to DoS us, and he flatly said, “Unfortunately, it may affect other devices between here and there so it’s not really a good idea.” Got an idea of what we’re talking about now? This appears not to be a single bug, but in fact at least five, and maybe as many as 30 different potential problems. They just haven’t dug far enough into it to really know how bad it can get. The results range from complete shutdown of the vulnerable machine, to dropping legitimate traffic.

The two researchers have already contacted multiple vendors since the beginning of September (I’ve had a small hand in getting them in contact with one of the vendors). Robert and Jack are waiting with no specific timeline to hear back from the affected TCP stack vendors. Think firewalls, OSes, Web-enabled devices, and so on. Yup, they’ll all need to be hardened, if the vendors can come up with a good solution to the problem. IPv6 services appear to be more affected by the fact that they require more resources and are no more secure since they still reside on top of an unhardened TCP stack.

Jack and Robert are both trying to be as forthcoming as possible with the affected vendors without giving any specific information on how the attack works to the public at large — openly acknowledging how dangerous the attack really is. Their hope is that the vendors appreciate the problem and come up with fixes that may not be initially obvious to them. I asked Robert when they planned to release their tool, to which he said he wasn’t sure he would “ever release sockstress.” The details, however, will be forthcoming once vendor patches are available. There are no mitigating short-term fixes, folks.

I feel winter slowly coming, and it would be a shame if entire power grids could be taken offline with a few keystrokes, or if supply chains could be interrupted. I hear it gets awfully cold in Scandinavia.

The Muslim Brotherhood: A Moderate Islamic Alternative to al-Qaeda or a Partner in Global Jihad?

From JihadWatch

Lt. Col. (res.) Jonathan D. Halevi, a senior researcher of the Middle East and radical Islam at the Jerusalem Center for Public Affairs. Here (thanks to Sr. Soph) he takes on and demolishes utterly the Robert Leiken/Steven Brooke contention that the Muslim Brotherhood is a moderate, democratic organization with which the U.S. can and should deal.

There is a great deal to his argument — read it all. Here is a sample. He quotes Leiken and Brooke saying this:

The Muslim Brotherhood is a collection of national groups with differing outlooks, and the various factions disagree about how best to advance its mission. But all reject global jihad while embracing elections and other features of democracy….The [Muslim Brotherhood] followed the path of toleration and eventually came to find democracy compatible with its notion of slow Islamization.
All reject global jihad? Leiken and Brooke just don’t realize that “slow Islamization” is just a different method of arriving at the same goal. And Halevi notes:

However, according to the Muslim Brotherhood, jihad, that is, holy war against the infidels, is one of the fundamental elements spread by the Muslim Brotherhood. The organization’s ideology, as it appears on its official website, regards “the prophet Muhammad as its leader and ruler, and jihad as its path.”17 Jihad has a global strategy beyond self-defense, it is the unceasing attack on every infidel rule, intended to widen the borders of the Islamic state until all mankind lives under the Islamic flag.
Clicking the links “The Goals of the Muslim Brotherhood” and “Muslim Brotherhood Measures” leads to explanations of jihad based on the writings of Muslim Brotherhood founder Hassan al-Banna. Jihad, it is noted, is Islam’s most important tool in effecting a gradual takeover, beginning with the Muslim countries, moving on to reestablishing the Caliphate over three continents in preparation for a conquest of the West, and finally instituting a global Islamic state. The following are quotations from the organization’s website:

We want a Muslim individual, a Muslim home, a Muslim people, a Muslim government and state that will lead the Islamic countries and bring into the fold the Muslim Diaspora and the lands robbed from Islam and will then bear the standard of jihad and the call [da’wah] to Allah. [Then the] world will happily accept the precepts of Islam….The problems of conquering the world will only end when the flag of Islam waves and jihad has been proclaimed.18
The goal is to establish one Islamic state of united Islamic countries, one nation under one leadership whose mission will be to reinforce adherence to the law of Allah…and the strengthening of the Islamic presence in the world arena….The goal…is the establishment of a world Islamic state.19

And if prayer is a pillar of the faith, then jihad is its summit…and death in the path of Allah is the summit of aspiration.20

From Halevi’s conclusion:

The thesis presented by Leiken and Brooke was inspired by impressions received during conversations with members of the Muslim Brotherhood, whose names are not mentioned and who are quoted neither fully nor accurately. It is clear that both Leiken and Brooke were duped by the ambiguity of their interlocutors’ rhetoric, which was tailored for Western ears and meant to lull suspicions and hide genuine intentions. Leiken and Brooke were deeply impressed by the support given by the Muslim Brotherhood for “democracy,” but they failed to understand that for the Muslim Brotherhood and the West, the word has two completely different meanings. As far as the Muslim Brotherhood is concerned, Islamic rule expresses “true democracy,” and that is the only kind to which they are committed.
The Muslim Brotherhood poses a serious threat to the West. It hides behind ambiguous terminology, which makes the organization appear moderate and enables it to operate freely in its host countries, thereby establishing a convenient base from which to disseminate radical Islamic ideology among the growing Muslim communities. Once that has been achieved, demography and radically-minded public opinion will enable the Muslim Brotherhood to take over a government by “democratic” means. That will signal the last day of Western democracy in that country and the installation of an Islamic government, whose objective will be to export radical Islamic rule to other countries, the next step in realizing the vision of a world Caliphate. In Europe the sand is running out, and a showdown with the Muslim Brotherhood is closer than anyone suspects. However, to a certain extent, the focus on the Israeli-Palestinian conflict delays the realization of Islamic aspirations in Western Europe.

Don’t fail to read it all.

Illegal immigrant, Muslim from Lebanon, worked for FBI, CIA, stole info, passed it to Hizballah

With thanks to Robert Spencer, of Jihadwatch.
Whew. This story has everything: an illegal immigration angle, a Keystone Kops angle, an espionage angle, a moderate-Muslims-condemn-terror-or-do-they angle, and more. It would make a great movie. If this kind of thing doesn’t kill us first.

The illegal immigration angle is of course that illegal immigration is a national security issue, and that illegal immigrants have no business working for the FBI and the CIA. That in turn leads to the Keystone Kops angle: what on earth was the FBI and the CIA thinking, giving this woman key jobs? Of course, no one would dream of asking Nada Nadim Prouty or anyone like her sensitive questions about where they stand on the jihad ideology and Islamic supremacism. Why, you’re automatically a bigot just for thinking that such questions should be asked. But when you don’t ask, of course, and make no effort to investigate in any other way, you don’t get answers.

The espionage angle: why did the FBI and CIA, clueless again, give her access to sensitive information? And of course finally there is the moderate-Muslims-condemn-terror-or-do-they angle: the FBI and CIA people who hired her were probably avid to get Muslims on staff so that they wouldn’t appear anti-Muslim, and she no doubt had pluperfect bona fides as a moderate. If she was then funnelling information to Hizballah, it only underscores the fact that there is no reliable way to distinguish a peaceful Muslim who rejects today’s jihad from one who subscribes to that jihad.

There is also the Arab American Institute link: last week I wrote about La Shish, the restaurant chain owned by Prouty’s brother, who has fled the country to escape indictment for evading taxes and sending the restaurant money to Hizballah (to the tune of $20 million). La Shish was one of the sponsors, despite this indictment, of the AAI’s recent conference, where Democratic presidential candidates and Ron Paul were falling all over themselves to condemn “racial profiling” — anti-terror efforts be damned — and grovel for the Arab vote. And now here comes yet more evidence of just whom they were groveling before.

“U.S. prosecutors: Illegal immigrant worked for FBI, CIA, stole info: Woman was sister-in-law of fugitive La Shish restaurant owner, stole info on investigation,” by David Ashenfelter for the Detroit Free Press (thanks to Jeffrey Imm):

The sister-in-law of the indicted fugitive owner of the La Shish restaurant chain got sensitive jobs at the FBI and CIA, despite being an illegal immigrant, federal prosecutors said in court documents unsealed today in Detroit.
The woman, Nada Nadim Prouty, 37, of Vienna, Va., also tapped into a sensitive FBI computer to find out what federal investigators knew about her, La Shish restaurant owner Talal Chahine, and her sister, who is married to Chahine.

Prosecutors said she took an unknown quantity of classified information home with her. It’s unclear what happened, or what she did with the information, prosecutors said.

The information pertained to a federal investigation of Chahine and his possible involvement with Hizballah, which has been declared a terrorist organization by the U.S State Department….

It may be unclear what she did with the classified information that she took home, but here’s a clue, from “Former FBI Agent Accused Of Leaking Info,” from CBS News (thanks again to Jeffrey Imm):

A woman who previously worked as an FBI agent and a CIA analyst is expected to plead guilty to charges she disclosed unauthorized information to people outside the government, CBS News has learned.
Sources say the woman, from Lebanon, entered the United States on a student visa and earned citizenship through a sham marriage.

While officials say there is no evidence of actual espionage and no evidence that she was working as a spy, she is accused of passing information to sympathizers of Hezbollah, a group the US has labeled a terrorist organization.

Some useful information comes also from “Prosecutors: LaShish owner’s sister-in-law infiltrated CIA, FBI,” by Paul Egan for The Detroit News (thanks yet again to Jeffrey Imm):

DETROIT — An illegal alien with links to Hezbollah penetrated the Central Intelligence Agency and the FBI, federal prosecutors in Detroit said today.
Nada Nadim Prouty, 37, of Vienna, Va., a sister-in-law of fugitive LaShish Restaurants owner Talal Chahine, pleaded guilty in federal court today to conspiracy to defraud the United States, unauthorized computer access, and naturalization fraud.

According to an information unsealed today, Lebanese-born Prouty gained U.S. citizenship in 1994 through a fraudulent marriage, joined the FBI’s Washington Field Office as special agent in 1999 and joined the CIA in June, 2003.

She resigned her CIA post, described as “mid-level,” last week, officials said.

Feel safer?

Too Late

When we look back someday at the catastrophe that was the Bush administration, we will think of many things: the tragedy of the Iraq war, the shame of Guantánamo and Abu Ghraib, the erosion of civil liberties. The damage done to the American economy does not make front-page headlines every day, but the repercussions will be felt beyond the lifetime of anyone reading this page.

I can hear an irritated counterthrust already. The president has not driven the United States into a recession during his almost seven years in office. Unemployment stands at a respectable 4.6 percent. Well, fine. But the other side of the ledger groans with distress: a tax code that has become hideously biased in favor of the rich; a national debt that will probably have grown 70 percent by the time this president leaves Washington; a swelling cascade of mortgage defaults; a record near-$850 billion trade deficit; oil prices that are higher than they have ever been; and a dollar so weak that for an American to buy a cup of coffee in London or Paris—or even the Yukon—becomes a venture in high finance.

And it gets worse. After almost seven years of this president, the United States is less prepared than ever to face the future. We have not been educating enough engineers and scientists, people with the skills we will need to compete with China and India. We have not been investing in the kinds of basic research that made us the technological powerhouse of the late 20th century. And although the president now understands—or so he says—that we must begin to wean ourselves from oil and coal, we have on his watch become more deeply dependent on both.

{ Vanity Fair | Continue reading }

Life doesn’t imitate art, it imitates bad television.’ — Woody Allen

Things went horribly wrong during the filming of South Africa’s second season of Big Brother. A woman got incredibly drunk, passed out, at which point her housemate sexually abused her. And to top it off, producers apparently thought it was totally okay to air.

Ofunneka Molokwu is a 29-year-old medical assistant who decided to spend the day drinking. She black out after an extended period of vomiting. That’s when 24 year old housemate Richard Bezuidenhout decided to take advantage of the woman. As another housemate begged him to stop, Bezuidenhout “penetrated her vagina with his fingers” while Molokwu lay unconscious. He then sat down in a chair across the room and sniffed his fingers for a while. Seriously. This actually happened on television, while people watched at home.

Viewers flooded newspapers and Internet message boards with emails expressing outrage. Many of the emails contained photo clips from the program, which appeared to show housemate Richard Bezuidenhout assaulting Ofunneka Molokwu.

The pay-TV channel insists that no such attack took place, even though people watched it occur. The channel took the high road: “There is no indication that [Molokwu] was unconscious at the time,” M-Net executive Joseph Hundah said.

Riiiight. I guess that is why producers called paramedics after the attack and cut the live feed, because all was well. Oh, and go fuck yourself.

In South Africa a woman is assaulted every 40 seconds. Bezuidenhout’s actions constitute rape under South African law. Bezuidenhout decided to top the assault by being an even bigger asshole when he opened his Neanderthal mouth to explain his actions to his other housemates. “Well, this is Africa,” he said.

Well, then maybe we can get you killed by a lion.

Now, in an even more hideous turn of events, the controversy is being called “Fingergate.” Seriously.

Solaris on a Macbook

After getting a macbook, it was with the hope that I would be able to get OpenSolaris running on it and I was fairly successful. Here’s a quick rundown:

What works
Dual-booting!
Ethernet
Wireless
X (at 1280×800 with XOrg)
CD Burner, Just Works with cdrw
Keyboard
battery applet (in frkit, in snv_63+)
What doesn’t work
Trackpad
Camera (made no effort as of yet)
Sound Card (had partial success with oss)
Reading OSX partition (not aware of any way of doing this)

Steps
0. I started with a fresh install of OSX as I had tried a bunch of different things to try and get it dual-booting and wanted a clean slate. I got the details on how to set it up to dual boot from Paul Mitchell’s blog, see link below. I have a 150G disk in my system.

1. From OSX, shrink the HFS+ partition that OSX is installed into to make room. Like this:
diskutil resizeVolume disk0s2 100G “MS-DOS FAT32” “Windows” 48G

You will either need to sudo the above or enable the root account in OSX like I did. Bear in mind that the sizes I have above correspond to my disk, you will likely have different values.

2. Boot from the OSX install disk. When the installer starts, fire up a terminal from the tools menu. Unmount the internal disk:
umount /dev/disk0

Change the EFI partition’s ID:
fdisk -e /dev/rdisk0
setpid 1
AF
write
quit
3. Boot from the Nevada install DVD/CD. You need to power on the system and as soon as you see the grey screen hold down the option key (alt for people from PC world). You will see two icons, one for OSX and one labeled Windows for the CD/DVD. Select the “Windows” disk. You should be able to proceed almost all the way through the install, it will fail right at the end though when it starts to actually write to the disk. This is OK though. You just need to reboot the system and start the install again. It seems that fdisk writes something to the disk that is useful, but still fails out. When you boot off the disk again and start the install again, it should work.

4. Boot the OS by holding the option key again and select Windows – only this time it will be a hard disk icon rather than a CD icon.

5. Installing the Ethernet driver: This machine uses the a Marvell Yukon card:
bash-3.00# /usr/X11/bin/scanpci
…
pci bus 0x0001 cardnum 0x00 function 0x00: vendor 0x11ab device 0x4362
Marvell Technology Group Ltd. 88E8053 PCI-E Gigabit Ethernet Controller
…

Install the driver from here. You have to remove the SK98sol package before you install the new SKGEsol package. After that, you need to attach the driver to the device:
update_drv -a -i ‘”pci11ab,5321″‘ skge

The interface name is skge, so:
bash-3.00# ifconfig skge0 plumb
bash-3.00# ifconfig -a
lo0: flags=2001000849 mtu 8232 index 1
inet 127.0.0.1 netmask ff000000
skge0: flags=1004843 mtu 1500 index 2
inet 0.0.0.0 netmask ffffff00 broadcast 255.255.255.255

You can now configure it for DHCP or use the, rather nifty, inetmenu utility.

6. Wireless driver. The Atheros driver from opensolaris.org work very nicely with the macbook’s card. You can get it here. Just pkagadd it and then> attach it to the device:
bash-3.00# rem_drv ath
bash-3.00# add_drv -i ‘”pci106b,86″‘ ath
bash-3.00# ifconfig ath0 plumb
bash-3.00# ifconfig -a
lo0: flags=2001000849 mtu 8232 index 1
inet 127.0.0.1 netmask ff000000
skge0: flags=1004843 mtu 1500 index 2
inet 129.156.226.170 netmask ffffff00 broadcast 129.156.226.255
ether 0:16:cb:8f:cd:a5
ath0: flags=1000842 mtu 1500 index 3
inet 0.0.0.0 netmask 0
ether 0:16:cb:b9:93:98

7. Battery status
Download and install the frkit from here. Battery applet is in there by default now.

8. Getting Xorg working at 1280×800
You need to use the 915resolution app to set the resolution correctly – and believe me, its worth the effort – the screen is so much crisper at the correct resolution. If you want to build this app yourself, you can follow the instructions here to patch the FreeBSD version for Solaris. I had to do this by hand (its not a very big patch), but that could be a lack of ability on my part, rather than a faulty patch. I have a binary here you can use, but don’t blame me if anything goes wrong.

You can list the modes the card can do like this:
bash-3.00# ./915resolution -l
Intel 800/900 Series VBIOS Hack : version 0.5

Chipset: 915GM
BIOS: TYPE 1
Mode Table Offset: $C0000 + $269
Mode Table Entries: 36

Mode 30 : 640×480, 8 bits/pixel
Mode 32 : 800×600, 8 bits/pixel
Mode 34 : 1024×768, 8 bits/pixel
Mode 38 : 1280×800, 8 bits/pixel
Mode 3a : 1600×1200, 8 bits/pixel
Mode 3c : 1920×1440, 8 bits/pixel
Mode 41 : 640×480, 16 bits/pixel
Mode 43 : 800×600, 16 bits/pixel
Mode 45 : 1024×768, 16 bits/pixel
Mode 49 : 1280×800, 16 bits/pixel
Mode 4b : 1600×1200, 16 bits/pixel
Mode 4d : 1920×1440, 16 bits/pixel
Mode 50 : 640×480, 32 bits/pixel
Mode 52 : 800×600, 32 bits/pixel
Mode 54 : 1024×768, 32 bits/pixel
Mode 58 : 1280×1024, 32 bits/pixel
Mode 5a : 1600×1200, 32 bits/pixel
Mode 5c : 1920×1440, 32 bits/pixel

above is my output. You can set the resolution like this:
bash-3.00# ./915resolution 58 1280 800

You need to run this every time you boot. Xorg, at least in b62, will auto-detect the proper 1280×800 resolution of the screen once 915resolution is run.
ToDo
Camera – I believe it firewire based, so maybe dcam stuff will work
Trackpad
Sound Card

Some other pages on similar topics:
Solaris on the Macbook
Installing Solaris on a Mac Mini
Dual Partitioning a Macbook Pro

Shit Talkers in War, Offering Useful Insights Into How They Deal With Problems

What do Anheuser-Busch, The American Bible Society, Snoop Dogg, and the folks who brought you the Girls Gone Wild soft-porn videos have in common? The same public-relations guy: Ronn D. Torossian.

Even in an industry fueled by hype, Torossian stands out. He claims to have evangelist Pat Robertson and Israel’s Prime Minister on speed dial. He carouses with celebrities. He courts controversy–sliming rivals, scrapping with journalists, lobbing public insults on behalf of clients. And, at 33, he has built his New York-based 5W Public Relations into one of America’s fastest-growing independent agencies. “It’s easy to hire [firms like] Burson-Marsteller or Edelman,” Torossian brags. “It takes guts to hire 5W”–Who, What, Where, When, Why.

Torossian has anointed himself the brash new face of PR. And it’s true that few seem better equipped to navigate a celebrity-obsessed culture. One of his biggest coups was getting a newborn Shiloh Nouvel Jolie-Pitt photographed in a T-shirt sold by a Denver retailer, 5W’s client Belly; the photo then made the cover of People magazine. Torossian–loud, crass, buzz-obsessed–also echoes the raw, unvarnished discourse of the blogosphere, which he claims to understand better than anyone. Brian Connolly, who founded the irreverent PR blog Strumpette, says Torossian represents “what the industry has become.”

Perhaps, but Torossian and his 85-person agency face a conundrum. The tactical provocations may cut through the media noise. They also could sabotage an agency that has worked with the likes of McDonald’s and Coca-Cola but failed to sign many blue-chip companies (though Torossian says there are several he can’t name). Torossian’s rivals quietly suggest he is more fad than change agent and that modern PR is less about generating buzz than backroom strategy. Not that Torossian, a guy who has been known to issue press releases about himself, expresses any self-doubt. “One of the reasons I’ve grown so quickly is that I’m bright,” he says. “Another is that my competitors are not so bright.” (…)

“They are not currently representing us,” says a McDonald’s spokeswoman. Anheuser-Busch declined to comment. One ex- client says: “I saw more press releases on him than any work for my firm.” Torossian seems aware he may have, well, a PR problem.

{ Business Week | Continue reading }

Forgetting Is an Essential Part of Life

Every one of us would like to have a better memory, but would it really be advantageous to have a memory like an elephant? Does an elephant really have a good memory?

Elephants certainly have large brains, which may increase their memory capacity and aid their complex patterns of communication. It is not easy to measure with precision the memory span of an elephant; many working elephants can learn and remember a large number of commands. They also appear to recognise many humans, as well as individuals of their own species – even when separated from them for decades.

In the wild, herds of elephants tend to follow similar paths over the years, suggesting that memories are passed down through the generations. It is said that elephant herds have specific burial places and that they help their sick and infirm to return there to die. Elephant remains are often found in groups near water sources; however, this may be simply because malnourished elephants seek water in the hope of improving their condition. Elderly elephants gravitate towards the same water sources when their teeth become worn, as water plants are softer to eat, and many die there near the remains of others. So herds may remember the locations of water sources, but not primarily because of any elephant remains that may be there.

Some elephants have better memories than others. In 2001, a research team led by Karen McComb studied 21 elephant families over a seven-year period in Amboseli National Park, Kenya. They found that the matriarchs leading the herds develop strong “social” memories that enable them to distinguish friends from foes by smell and by contact calls; the older the matriarch, the better her skills. The research confirmed that the better a matriarch is at recognising friends, the more time other family members have to feed and breed in safety and the more calves they produce.

So do elephants have better memories than other animals? One animal whose memory might rival that of the elephant is the Clark’s nutcracker bird of the high mountain regions of the American West, which hoards food for the winter. In the autumn, each bird stashes away up to 100,000 pine seeds in thousands of different caches, with only five to 10 seeds in each to minimise squirrel theft. The hiding places are dotted around an area of 20km2. Some six months later, the bird finds all these stockpiles, even if the sites are a metre deep in snow.

I think we can agree that elephants – particularly the matriarchs – do have good memories. Whether they deserve their status as the memory experts of the animal kingdom is doubtful: they have a serious rival in Clark’s nutcracker bird. The word “birdbrain”, implying limited intelligence, may not be such an insult after all.

{ The Independent | Continue reading }