infoSecond Blog

Here is a rather lengthy but interesting description of the general exploits that are possible against MS SQL server. The article also includes suggestions for countermeasures.

Hacking a SQL Server

---

Here is a link to the KDE office equivalent to the MS office website. You will find templates, forms and other usefull business tools here. The collection is still a little sparse as the sight grows, but here's to hoping it takes off.

KDE-Files.org

---

Rexx is a language that has been around for decades, going back to the AmigaOS. I remember that at the time, Amiga was reported to have a scripting language as easy to use as everyday speech. Claims like that always fall short, but there are immediate benefits to a language where problem solving takes the focus more than wrestling with syntax.

A program is nothing more than a detailed document on how a problem is solved. Like any other document, it should be easy to read, easy to follow, and make its point succinctly. Writing a script is like asking your computer to do you a favor. Using a language with an easy syntax allows one to get used to this way of thinking before venturing into other languages.

I am always looking for different languages that can be brought to those who are convinced they cannot be programmers. Look into Rexx, and while you are at it, look into Python too.

Using Rexx for easy Desktop Linux scripting

---

Forensic tools provide a means to aquire and analyse data from a system in a way that disturbes that data as little as possible. This article provides a description of several important and freely available tools common to many investigations and professionals in the industry.

This is a collection of utilities and libraries intended for forensic use

---

Here is an interesting page that lists the traffic stats by country of origin for phishing scams.

Phishiest Countries

---

Common Versioning System is a way for prgrammers to share code and collaborate on programming assignments. Although there are many platforms available, CVS is used by sourceforge, and for security professionals being able to download source code now and then is a helpful skill.

This page discusses how to use CVS and where to get the necessary clients.

SourceForge.net: CVS Repository

---

Being called as an expert witness places an important responsibility onto your shoulders. In the IT industry, it is always possible that any one of us might someday be asked to do it. This article discusses some important things to keep in mind shoudl you ever have to serve in this capacity.

Testifying in a Computer Crimes Case

---

As the saying goes "No good deed goes unpunished." A customer service rep doing a favor gets his company into trouble. But there is an interesting dilema in the article below, caused by the fact that niether party really new what they were doing. The customer should not have been in the situation in the first place and the rep should have known better.

The primary security flaw in an any system is always ignorance. But there is a certain amount of ingorance built-in to every situation becuase no one can know everything all the time.

On another angle; think this article over the next time you walk into a Circuit City store and the employee says "Can you give my your social security number please" Out loud and in a crowd of other customers.


Circuit City Claims No Obligation to Protect Customer’s Most Personal Data - Reported by Aunty Spam's Net Patrol

---

I read a story recently where a study was conducted that found people were getting brainlazy as a result of computers. The article concluded that due to IM, Chat rooms, Blogs, Text Messaging and terse email, people are changing the way they communicate for the worse. As an affect of these technologies, we discuss issues in brief fragments that do not require us to assemble complex thoughts or unravel topics that involve an interplay of emotion and logic. I tend to agree.

I have to admit that one of my pet-peeves is people that have only 3 seconds to talk or remind you at the onset of a conversation just how busy they are. I know we live in a complex and demanding world, but starting a conversation off by telling the other person that they just aren't important enough to warrant a potential small inconvenience of time management is not a good way to strengthen a connection.

Technologies that make short spurts of communication possible cause conversations to be more of an omnipresent interruption than a cohesive interactive event.

This article is a more humorous look at the 'dumbing down' problem. The question being that as long as computers are able to compute, have people lost the desire to think?


Opinion Column by PC Magazine: The Dumbing Down of America

---

Tom's Hardware is featuring an interesting article about the process of using a lab service to recover data from a crashed hard drive. Sometimes data is recoverable after replacing failed parts of the drive. But this must be done in a clean room because exposing the inside of a drive to dust particles might make matters worse. If the data is that valuable in the first place, why take chances.

Saving Your Data After a Head Crash: An Inside Look at a Disk Recovery Service

---

PUBLICip is a Linux based WiFi access point soultion. You can turn any laptop or small computer into a firewalled router to share internet access or otherwise. The product boots of a CD-ROM and unlike similar solutions it can be configured even if you are not familiar with Linux.

PUBLICip - Free WiFi Solutions for Free WiFi Access

---

In a previous posting, I provided a link to a list of 200 things you can do to revive a hard drive. In case none of those ideas will work, try these freeware utilities to resotre or delete your important data.

PCWorld.com - Free Hard Disk Utilities: Recover Deleted Files and Lost Data

---

As cheap as Hard Disks are these days it hardly seems worth the effort, unless its your data on that drive. Several reasons exist for banging on that drive with a screwdriver or putting it in the freezer on top of the ice cubes:

• Didn't back up that large mp3 collection


• This is the second failure of a RAID and you're screwed


• There is forensic data on that drive


• You have emotional attachment to this disk


• If it can be saved, why not?

See what other readers of Tech Republic had to say about it:

Get IT Done: 200 ways to revive a hard drive

---

Excerpted from a posting on Fyodor's Nmap site (link below), here is a list of the securituy websites that were submitted by readers of the site (I didn't take the time to do links, just copy and paste into your browser. The number is the count of votes from the submissions).

276 securityfocus.com
159 packetstormsecurity.nl
92 sans.org
86 cert.org
46 securiteam.com
38 linuxsecurity.com
37 phrack.org
30 neworder.box.sk
29 slashdot.org
24 google.com
18 securitynewsportal.com
17 infosyssec.com
15 snort.org
15 honeynet.org
15 dshield.org
15 astalavista.com
13 whitehats.com
13 incidents.org
12 microsoft.com
12 iss.net
11 cisecurity.org
10 networkintrusion.co.uk
10 isc.incidents.org
10 grc.com
10 foundstone.com
10 cve.mitre.org
10 atstake.com
10 astalavista.box.sk
9 security-forums.com
9 packetstorm.org
9 net-security.org
9 nessus.org
9 hack.co.za
9 deadly.org
9 attrition.org
8 samspade.org
7 zone-h.org
7 secureroot.com
7 packetfactory.net
7 openbsd.org
7 counterpane.com
7 2600.com
6 theregister.co.uk
6 thc.org
6 team-teso.net
6 symantec.com
6 securitytracker.com
6 phoneboy.com
6 ntbugtraq.com
6 netsys.com
6 neohapsis.com
6 heise.de
6 antionline.com
5 tlsecurity.net
5 sourceforge.net
5 icat.nist.gov
5 hackingexposed.com
5 eeye.com
5 cotse.com
5 ccc.de
5 archives.neohapsis.com
4 wiretrip.net
4 vulnwatch.org
4 thehackerschoice.com
4 security.nl
4 nsa.gov
4 nipc.gov
4 infosecuritymag.com
4 immunitysec.com
4 freshmeat.net
4 csrc.nist.gov
4 cert.uni-stuttgart.de
4 astalavista.net
3 windowssecurity.com
3 w00w00.org
3 uksecurityonline.com
3 symlink.ch
3 sun.com
3 spitzner.net
3 seifried.org
3 securityresponse.symantec.com
3 securite.org
3 razor.bindview.com
3 owasp.org
3 network-tools.com
3 netfilter.org
3 megasecurity.org
3 marc.theaimsgroup.com
3 isc2.org
3 iana.org
3 hammerofgod.com
3 debian.org
3 cyberarmy.com
3 blackhat.com
3 blackcode.com
2 zonelabs.com
2 xfocus.org
2 xakep.ru
2 wiretapped.net
2 webmin.com
2 webattack.com
2 ussrback.com
2 treachery.net
2 techrepublic.com
2 sysinternals.com
2 st.ryukoku.ac.jp
2 sqlsecurity.com
2 sleuthkit.org
2 security.ziffdavis.com
2 securityspace.com
2 securityportal.com
2 security.nnov.ru
2 securitybugware.com
2 rootshell.com
2 rootsecure.net
2 redhat.com
2 portsdb.org
2 porcupine.org
2 pivx.com
2 phenoelit.de
2 packetattack.com
2 osvdb.org
2 ossr.net
2 osnews.com
2 openssh.org
2 nmrc.org
2 newsnow.co.uk
2 news.netcraft.com
2 news.ists.dartmouth.edu
2 netric.org
2 mitre.org
2 kill-hup.com
2 isecom.org
2 internetpulse.net
2 hsc.fr
2 hispasec.com
2 hackerthreads.org
2 hackers.inside.net
2 gnupg.org
2 freebsd.org
2 extremetech.com
2 dnsstuff.com
2 digital-root.com
2 cymru.com
2 cultdeadcow.com
2 corsaire.com
2 ciac.org
2 cerias.purdue.edu
2 bugtraq.com
2 blacksun.box.sk
2 bastille-linux.org
2 apocalypseonline.com
2 abuse.net



Nmap Hackers: Nmap book; Silly Microsoft; Top Security Sites

---

Here are a few pages and references on files systems that I am filing away in this posting (sorry).

• Overview of FAT, HPFS, and NTFS File Systems


• Description of the FAT32 file system


• Detailed explanation of FAT boot sector


• Design and implementation of Ext2


• Filestystems HowTo


• NTFS Documentation from the Linux-NTFS project


• FAT32 Structure Information


• FAT16 Structure Information


• How to Read and Write to a Hard Drive

---

Download and listen to these discussions (in mp3 format and others) about Intellectual Property and some of the significant battles currently being fought.

There is a danger of those who think there is a way of owning patterns of sound, characters, and thoughts, of concivincing our government that they should be able to sue anyone who makes something that gets used in the creation of or the design of any product that supports or encourages the manufacturing or deployment of software or hardware that can be used in such a way that the potential may exist for sharing ideas that someone hasn't paid for to who they say should be paid.

IT Conversations

---

A lot of time is spent arguing the topic of intellectual property. I have always wanted to sidestep that whole issue. To me, it boils down to something simple. Businesses want information to be repeatable, something that can be sold over and over again in a perpetual profit stream. Yet human nature rails against this idea. Our pioneering drive says that once something is known, its time to move on.

Emotional services, are sponteaneous and cannot be packaged. This is what drives and motivates people. It is the true meaning of the value of service. As an instructor, I teach people things that can be obtained easily on the web, in a book, or through trial and error. There is something different about having it explained by another person in a unique situation that will never happen exactly the same way ever again. Even if I recorded my teaching sessions on video it would not be the same thing as doing it live.

This article from wired magazine presents some interesting food for thought on the impact of creative thinking on the value of business activity. A subtle point made here is that other nations seem to be good at logic oriented repeatable processes and are therefore prime for outsourcing opportunity. I wonder; is the inexact, sometimes frustrating nature of our country's melting pot society a fertile ground for creative thought? I mean, is that the benefit of encouraging diversity and divergent opinion?

I do believe so.

Wired 13.02: Revenge of the Right Brain

---

In a more lighthearted posting on a Sunday evening, here is a site that shows creativity doesn't have to be expensive. Not necessarily to be cheap, but not to be wasteful, I have always been interesting in what people can do with basic objects laying around.

ThriftDeluxe - DIY For the Hip

---

I am a huge fan of virtual machine technology as a test or experimental environment. Unfortunately, both VMWare and Virtual PC each have their strengths and weaknesses, and they might be out of the budget of many students. I am hoping this Open Source project matures into a terrific product that all can afford, it will be free.

Computer Laboratory - Xen virtual machine monitor

---

As a freeware junkie I wanted to share these links:

• TheOpenCD


• The 16 best ever freeware utilities


• The 46 best ever freeware utilities

TheOpenCD

---

Two good pages of Wardriving information that lead to many other links. (what site on the internet doesn't do that?)

• Jeff Duntemann's Wardriving FAQ


• Google Directory on Wardriving

---

Recently I had a coversation with a student who asked "Why can't they prosecute these spyware vendors?" My answer was "Often times we have agreed to the terms of being spyed upon."

The issue of stopping spyware has many complications. There are arguments about free speech as well as the logistical impossibility of enforcing any laws that deal with this practice.

An effective technique spyware makers can utilize is the most straightforward. The end user agreement that you agree to when voluntarily installing an application. Buried in the dense and boring words are often legal language that allows for the monitoring of your PC whenever the product is in use. If this application is running as a service, it is running all the time !!

Follow this link for an example.

OptOut -- Fine Print Funny Business

---

So now we can have search results syndicated as an RSS feed. Sorry for being a pessimist, but how soon will it be before whatever search you syndicate becomes full of ahem "sponsored links".

I don't mind advertising. I just don't like the amount of advertising I have to deal with everyday and everywhere. Every flat surface is fair game, every electronic media is a marketplace.

I was complaining about a particular site recently when a colleague, who is in the sales profession, said "Well, excuse them for trying to make some money."

I guess my complaint would be, if someone is going to advertise on my site, I should get the money. But, then I thought about it futher. If I want to provide free content, I will end up advertising something for somebody one way or the other. We advertise something in almost every social interaction.

Ok, that was a tangent. This article is about syndicating a list of search results using RSS. It can be a cool thing.

A9.com > OpenSearch

---

The article I cite in this blog entry seems geared toward students entering college, but the theme is really about making choices for the future. Many IT students find themselves trying to solve the difficult puzzle of how to deal with the vastness of the industry. It is easy too second guess ourselves into a state of paralysis. We concentrate so intently on the question of wether or not we are doing the most lucrative thing that we cannot see the opportunities we are creating for ourselves in our everyday work.

A few years ago, one of the dominant management fads was the concept of the "Five Year Plan". Trouble is, life changes too rapidly to cast your heart that far into the future. Only a few select individuals are truly sure, down to the core of their soul, that they need to take a certain path at whatever cost or sacrifice.

I like the suggestions in this article, which I can summerize in these short ideas:

• Start where you are, and proceed forward with the next BEST step.


• Work on hard problems.


• Curiosity turns work into play.


• Paths can be a lot more than they seem. Be open to the possibility that unexpected turns are not accidents.


• Do not fall prey to the desire to be better than a competitor, or to know more than someone else. Know different things and do something of value to the person within your most immediate reach.

What You'll Wish You'd Known

---

The CCD is the compnent of a camera that digitizes the light it sees through the lens. In most low end cameras, one CDD must do the job for the whole color spectrum, on a 3CCD camera, one each is used for Red, Green, and Blue respectivly. The result is more accurate colors, at least in good light conditions.

3CCD cameras were normally only found in professional grade cameras used for broadcast quality recording. In the lower end models, resolution, lines per inch, is still not up to professional par. But, I just bought a new 3CCD camera and so far I am very happy with it.

I found a site for other 3CCD camera enthusiasts and it has some good information of the subject.

Panasonic 3CCD Users - powered by vBulletin

---

One of the most frequent "How do they do that?" questions I get is essentially software reverse engineering. This online book provides an in-depth view of these techniques.

Reverse engineering is not easy, it is time consuming and tedious, unless you have adequate motivation. For some, unlocking the mystery of a forbidden knowledge is enough to motivate 20 hour days for weeks. For others, they are being paid good money for it. There is also a culture of those who break open the code simply because it was hidden, and they want to do it "because they can".

I think it is a healthy mental exercise. At a minimum, you will want to parse through this book to have an idea for what is involved. Repeat the general process when solving other problems in life.

Look for the analogy.

Introduction to Reverse Engineering Software

---

Two very large websites with good information on the respective topics. Bookmark 'em !!

• The TCP/IP Guide - The TCP/IP Guide


• Welcome to The PC Guide!

---

I don't sell anything on my website, I don't get kickbacks and I don't generate revenue of any kind. Not that I am against doing that, but this isn't the current objective of this website. I enjoy the freedom of recommending good products and good companies just because they deserve the mention.

I recently bought a set of Grado Grado SR-60 headphones to use as stage monitors and mixing headphones for video editing. I had read many reviews that claimed these were the best headphones for the price, and in my opinion the reviews were correct. I bought the product from a business called "Planet MiniDisc" and they arrived a day earlier than expected, even thought the headphones were on back order and they called me twice to offer alternatives.

Give these things a try, or at the vary least browse the website of this company and see if there is anything else you need. You will get good service and you will be happy with the product you purchase.

Grado SR-60

---

Fascinating quick read in the Bagle virus. Discusses many of the techniques common to several other viruses but it gives the reader good idea for how virus good evolves and how the copycats build on successful foundations.

Viruslist.com - The Bagle botnet

---

In a Steven Segal movie I remember a scene where one of the bad guys saw written on a roll of toilet paper something like "The anticipation of death is worse than death itself". the relative class of that scene aside, (Segal movies are crap, but I still like them) how often do we get worked out over things that don't ever happen?

This article is a good reminder of some of the questions we should ask ourselves about 'the moment'. What professionally, is going on right now, not what you think is happening, but what is really taking place. Before making any decisions, take a breath and consider the questions raised in the article.

---

Looking for wav files, samples or other sound snippets is what I call "Internet Quicksand". You wander around for hours looking at ads, picking up spyware, and the more windows you open the slower your machine gets and the worse your search becomes. Struggling only makes matters worse, the most promising links are the most dangerous ones.

These two sites to the rescue:

• Freesound Project


• Internet Archive

---