Mr.HinkyDink's UT Blog

McAfee Relay Server 5.2.3 (Port 6515)

2012-01-09T12:04:00.001-05:00

Earlier today I noticed I was getting a lot of TCP port 6515 proxies on The List. Curious, I checked one and it gave me a VIA header of 1.1 Fran-PC (McAfee Relay Server 5.2.3) Then I took a peek at the database. Nearly 1900 of these things since December 1st, 2011. Although the name of the PC above is a dead giveaway that this is some sort of consumer product ("[name-of-owner]-PC" is

Disappearing APs...

2012-01-02T04:05:00.002-05:00

Related? I wouldn't characterize the issue I've been seeing here as the access point "crashing" because it's still controllable after the ESSID disappears from the airwaves. And of course I don't have a Dlink AP. If I did I probably give it an ESSID of "Hlinky". :o) If you didn't know it already, Harald is not just some random guy on the Internet (like me). If he says someone is

I am disappoint

2011-12-26T10:08:00.000-05:00

That's my "oh FUCK IT" face right there. As you know it's been a Very Bad Year for the hardware that populates DinkNET. Not a single box that was running in January 2011 is still running in December 2011. The one, tiny little bright spot in all this carnage was the fact that all the replacement hardware, a motley collection of refurbs and loss leader deals, came with 10/100/1000 NICs, making

TCP Port 36081

2011-12-25T03:47:00.006-05:00

Happy Annual Gift Day!I woke up bleary-eyed this morning at around 3AM, disappointing the cats who thought it was breakfast time, and sat down at the computer and pulled up the proxy list. I was greeted with a smattering of new proxies on port 36081.This struck me as unusual so I did a quick check of the database to see how long it's been going on.And it's only been going on for the last five

PoTTY v.0.62 Testing Begins!

2011-12-16T12:22:00.005-05:00

Last week, Simon Tatham announced the release of PuTTY v.0.62 which included a security fix that seemed serious enough to fire up the old compiler and shit out a new version of PoTTY.I got to work on it last night and have the working binaries ready to rock and roll as soon as I can get them all tested.This has gone much faster than the last time. I started hacking away at 1AM this morning and

The Unending Saga Of the Disappearing Access Point

2011-11-20T07:29:00.003-05:00

Yeah... about that.I rewrote my scripts to double-check the availability of the AP. It waits 30 seconds and checks again. The "problem" disappeared immediately.That lasted about a month before it came back. Now, it dies about twice a week. Seven times since rewriting the script, and only once when anyone was at home to notice it (and no one did).It's not a power failure issue, since it's on

BT5 on a Stick

2011-11-19T14:46:00.004-05:00

A STICK!!!!I've been running BT5[r1] as a "disposable OS" almost every day on a laptop for months now, booting up from a CD. Great stuff. Boot up, do your dirty work, shut down, and all the evidence is gone.A few weeks back I installed the BT5 ISO to a USB stick with UNetbootin and tossed the CD forever. Excellent perfomance. Now it boots up fast and quiet. But there's one tiny issue: it

Proxy Browser Round-Up October 2011

2011-10-16T12:22:00.004-04:00

The other day it dawned on me I had not run Internet Explorer for a very long time. IE9 may be better than sliced shit for all I know. I have it, never use it. It's different back at the Salt Mines. Some "intranet applications" simply barf on anything else, or flat out refuse to run.Last year, on the ill-fated Proxy Obsession blog, I proclaimed SRWare Iron as the best browser ever for using

KB921245.exe

2011-10-07T09:20:00.002-04:00

Hey look! This link's not in Chinese!My advice: don't run it.If you ran it, you're probably fucked. But you should try running MSRT to get rid of it. Maybe it'll work. Maybe it won't.Have a nice day!

I ain't lyin'

2011-09-26T20:55:00.005-04:00

When the Proxy List came back online in May, I added this little warning...Times have changed, little ones. You cannot hide. By using a proxy you attract the attention of Powerful Forces™. The consequences will never be the same.Recent events have shown this to be Sage Advice. They may try to convince you they're hiding your ass, but when the chips are down, they'll cover their own ass first.

The Amazing, Disappearing SSID, Part II

2011-09-23T19:06:00.004-04:00

The replacement access point arrived yesterday. I set it up identically to the old AP. I rewrote my kidscript to work with the new AP's Web interface, rebooting it when iwlist can't find the SSID anymore. It's been up for slightly more than 24 hours now.In that time, the SSID has dropped seven times. We can now conclude that either a) there was nothing wrong with the original AP, or b) that

SSID: "XDA-Wifi-Sharing"

2011-09-20T22:28:00.003-04:00

So my analysis of my Wacky WiFi access point continues while I wait for the new one to arrive. I watched it drop about three times so far today, with the same results on the airodump-ng screen: my AP disappears and a dozen other SSIDs disappear as well. It comes back up and so do the missing APs. All the novelty is gone. It just happens now. It's almost predictable, but not quite.But a new

GoDaddy DNS Issues Finally Explained?

2011-09-20T17:26:00.003-04:00

It's all water under the bridge now, but I just ran across this link in the outages mailing list. Most of my original complaints about GoDaddy DNS were on the old ProxyObsession blog, so you may have missed it. What it came down to was I couldn't resolve my own domain name from home, but I could resolve it from anywhere else. GoDaddy finally fixed it but then that whole DMCA nastiness hit the

The Amazing, Disappearing SSID

2011-09-19T19:46:00.004-04:00

Lately, after running dependably for several years, my wireless access point has started to disappear from the airwaves.Firmware upgrade? Got it, no luck. I went from rev 1.0 (2006) to rev 2.12 (2009) with the same issue.Here's an odd side effect: while troubleshooting this problem, I've been running airodump-ng on a wired PC. Normally I can "see" ~16 access points. When my access point dies,

PowerDNS 3.0

2011-09-11T08:24:00.002-04:00

PowerDNS 3.0 came out in May of this year and I've been fucking around with it ever since, in between other things like the PoTTY upgrade, those crazy Chinese proxies, and replacing hardware on DinkNet.I started running pdns in February of 2009 after my jerkwater ISP started "improving my online experience" by hijacking DNS requests. Two years later I got on IPv6 through Hurricane Electric, but

awmproxy.com

2011-09-07T21:27:00.005-04:00

There's a lot of buzz lately about the guy who runs/ran awmproxy.com as being the "kingpin" behind the TDSS botnet, which was the bug responsible for all those port 27977 SOCKS proxies.Not surprisingly, I used to scrape that site all the time, from the Fall of 2008 until early Winter 2010. According to the Krebs article, awmproxy started offering up proxies on March 16, 2008 which

"subrepticious"

2011-09-02T21:08:00.003-04:00

About 3,870 results.Srsly?UPDATE: 09/05/2011I now have the #1 Google hit for this silly non-word. However, when searching for it, I spelled it right and discovered "subreptitious" is a real adjective derived from from the noun "subreption", which means: A calculated misrepresentation through concealment of the facts. An inference drawn from such a misrepresentation.I did not know that.Neither

4.1 million proxies!

2011-08-28T06:18:00.007-04:00

Almost a month after the 4,000,000 mark, that's about right. 100K proxies per month is a little high, just a little above average. Here's the thing: that 0.1 million is 100% TCP port 8909 proxies. Between midnight August 1st and this very moment (6AM on the 28th) I've snarfed up 105,272 of these suckers. That's over 2.5% of the entire database. It looks like I was right about the demise of

PoTTY 0.61 released

2011-08-27T18:07:00.002-04:00

Now available at the PoTTY Download Page! For completeness, PoTTY now consists of all of the PuTTY utilitiesThe DLL injection issue has been fixedRestoring the Obfuscated Keyword from the Registry now worksPrivate key authentication with *.ppk files has been fixed

PoTTY: BUG hunts & dirty tricks

2011-08-24T17:33:00.008-04:00

PoTTY 0.61 field testing marches on this week. Sunday night I really thought I had it hammered, but Monday morning brought a surprise. I was testing out all my stored SSH profiles and ran across one that just hung at a black screen. No logon prompt at all. It just timed out and died. I exported the Registry entry for that profile and imported it into another machine. PoTTY 0.60 handles it

PoTTY version 0.61

2011-08-20T13:19:00.010-04:00

heh... "clean potty" That always cracks me up. The first time at least. After a few hours, not so much. So anyway Simon Tatham released version 0.61 of PuTTY a few months ago and I knew that sooner or later I'd have to dig up the PoTTY code, do some cutting and pasting, and pull a new version out of my ass. I really wasn't looking forward to it, since as far as I know nobody uses it. In

Skipped a beat... or two

2011-08-14T10:20:00.004-04:00

Make that three. I woke up this morning at about 6:15AM—which is late for me, but it's a weekend—and checked the proxy list to find there had been no updates since 4AM. I did a hard Ctrl-F5 and came up with a "Host not found". This is not the first time this has happened, and I've been waiting for it to happen again. The first thing I did was do an nslookup on www.mrhinkydink.com. SERVFAIL

Port 8118 Proxies in the UAE

2011-08-13T12:58:00.007-04:00

Besides all that proxy action going down in China, there have also been numerous flash mobs of port 8118 proxies lately in Muslim countries, especially the United Arab Emirates. But don't go rushing off to the List to find any. At the moment there's only one live port 8118 proxy in there. Here is the breakdown by country. You can see the UAE (listed as AE below) is responsible for half of the

The Last Days of Port 9415?

2011-08-13T09:01:00.008-04:00

I just ran some quick numbers on the proxy database to see what's going on with ports 8909 and 9415. I did a couple of blog entries in May and June about port 9415, but I dropped the ball in July and then got distracted by port 8909 the first week of August. What I found was this... Port 9415 (blue) is indeed dropping like a rock and port 8909 (red) is becoming the dominant port. Considering

Hinky Dink SEO almost back to normal

2011-08-12T10:12:00.005-04:00

Lots of shit hit the fan back in April. It seemed like everyone wanted to put the smackdown on the Dinkster after that security announcement about PPLiveAV—those damned port 9415 proxies in China—hit the wire. As if the GoDaddy DMCA takedown wasn't bad enough—taking out both ProxyObsession and MrHinkyDink.com—the next insult hit my "brand" like a rock. Some stupid cop show announced an episode

AT&T Hiring Hot Streetwalkers

2011-08-11T10:52:00.003-04:00

Oh, my. That's what I'm talkin' 'bout. Had she been selling anything else, I probably would have bought it. This girl is definitely in the wrong industry. No, I don't mean that industry. Maybe she couldn't make it as a suitcase Suzie for Big Pharma. But pushing AT&T U-verse® door-to-door? That's sinking pretty low. Then again, times are tough. You take what you can get in this economy.

The things I do for you kidz

2011-08-10T08:03:00.002-04:00

You may recall in March of this year, before the Great GoDaddy DMCA Takedown Incident, the machine running the Proxy Project died a terrible death. The sucker popped a heat sink and burnt itself out. I moved the project to a physical box—it had been a VM—and restored everything from backup. More precisely, I built a new box and restored the project—database and kidscripts—from backup. I

Hinky Hack - ipconv.c

2011-08-09T11:21:00.005-04:00

This little program takes a dotted-quad IP and returns the 32 bit unsigned integer that is the "real" address. Given a 32 bit "real" address, it will return the dotted-quad representation. Given an FQDN it will return 0. I already know there are a zillion different ways to do this, so spare me your Better Way. #include #include #include #include

TCP Port 8909 Proxies

2011-08-06T08:34:00.007-04:00

If you've been paying attention to the Proxy List you will have noticed the ramp up of Chinese proxies on port 8909. In May, I pulled a paltry 32. Things picked up in June. I scraped up 185. In July things took off for port 8909, with a grand total of 23807. Less than a week into the month of August, I have over 16,000 new ones! At this point I have only scraped the surface of this, but it

Insecure Storage Of Liquid Confections

2011-08-05T13:58:00.001-04:00

Recently it was disclosed that a giant, well-known, multinational confection supplier was hacked. Their proprietary recipes were altered—for reasons unknown—by malicious actors. Seasoned security professionals can only shake their heads and sigh. To them the security flaws of this company are legendary, although in the past the company has managed to escape publicity and accountability for

3.99 Million Proxies

2011-08-03T08:47:00.003-04:00

We'll probably hit the 4 million mark tomorrow morning during the 4AM run, but there's a slight chance of it happening before midnight. 3,425 to go. Right on schedule. We always seem to roll over another mill in August. The List is here, in case you forgot. The count is buried in the HTML, in a comment under the closing "head" tag. UPDATE08/04/2011 0615 — Hung at 3,999,984 proxies. 6AM run

Windows Horrors: HP Photoshit Software

2011-08-03T08:07:00.002-04:00

I don't see how your average Windows user survives day-to-day life. The malware is bad enough, with millions of infected PCs across the globe, but it gets worse when so-called "trusted" hardware manufacturers pass out buggy software with their devices. Of course, I'm talking about HP. I swore off HP printer hardware for many years because of their crappy software and their snooty corporate

Mystery RFID

2011-08-02T20:56:00.006-04:00

Lately I've been reading a lot of E.L. Doctorow. I'm not sure why. The latest is Loon Lake, shown at left. I bought it at a Half Price Books store. In fact I buy all my books at Half Price because I'm a cheap bastard (I might buy a Kindle when they get the cost down to $29.95). I started with a collection of Doctorow's short stories—I forget the title—and really enjoyed it, but it's all been

Observations On Evil Access Points

2011-08-01T14:53:00.003-04:00

This is not a HOWTO. There are gazillions of those on the Interwebs, which is how I got started into this. BT5's intro in April really boosted the interest in wireless hacking, especially considering Vivek Ramachandran's Megaprimer on SecurityTube, which leveraged the fuck out of BT5. This brings me to my first observation: it only works on BT5. Now, before you protest and tell me about your

datallurgis

2011-07-31T05:51:00.002-04:00

This word does not exist. Were it to exist, I believe it would be a noun. datallurgii plural datallurgid adj. - having the quality of a datallurgis datallurgology n. - the study of datallurgii datallurgia n. - a collection of datallurgii

I'm Not As Stupid As I Look

2011-07-30T11:51:00.001-04:00

I'm not saying I'm not stupid. I'm simply not as stupid as I look. Many years ago, I was in the First Grade. They taught us how to read. The teacher (Mrs. Rodriguez, if memory serves me right) divided us into three groups: The Blue Stars The Red Balls The Green Leaves The Blues were the stars, of course (duh!). The Reds were the average kids. The Greens were the idiots. Mrs. R took one

18 shitzillion IPv6 addresses and I get a duplicate

2011-07-23T10:33:00.000-04:00

Of course, it was my fault. When BOT House died, I swapped out the hard drive to EXP V's box, leaving everything pretty much the same. I gutted the corpse of BH and scattered the parts to the winds. Today I'm dicking around with the new, improved EXP V. Even though it's off the laptop now, I'm still getting herky jerky sessions. So I do a tcpdump while playing to see if it's some kind of

What's the deal with AMD & UT99?

2011-07-17T15:54:00.001-04:00

I just finished playing a few games on the temporary laptop server & was disappointed with the results. It was herky-jerky in a lot of places, especially near walls and doors. It was never like that even way back in the day when BOT House was running on a K6 (basically a hot shit 80486 processor—AMD's answer to the Pentium line), except when EXP IV was running on a dual core AMD64 and the OS

Brain Transplant

2011-07-16T07:57:00.001-04:00

Friday I closed The House temporarily while I pondered my options after the meltdown. It survived the day in its minimal role as firewall and proxy, but when I came home to check it after a hard day at the Salt Mines it hung tight the first time I touched the keyboard. After bouncing the box, it did the same thing. Then after a few more bounces and hangs it refused to boot. Time for Plan B.

BOT House Meltdown 07/14/2011

2011-07-14T23:16:00.001-04:00

I've been waiting for this day. It's been a bad year for hardware. Boxes have been dropping like flies. The 'House itself is over six years old, and it's the oldest running box on DinkNet at this point (the oldest runnable box was shut down on Windependence Day). I've always had a Bad Feeling about this box. It has a non-standard power supply with a teensy-weensy fan in it. Not an easy

Windependence Day!

2011-07-04T19:06:00.003-04:00

After all my hardware issues this year I've been waiting for the other shoe to drop, namely, my 12 year old PIII Windows 2003 server. I have officially declared HinkyNet link local, so a local DNS domain name and server are no longer required. Out goes the Windows DNS server. I've been running a PowerDNS slave server for over two years now and it handles everything that's not local well,

Almost filled the HD... AGAIN

2011-06-26T10:24:00.000-04:00

It never ceases to amaze me that Internet Explorer 8.0, the browser I am using now, takes ~10 seconds to connect to my home page, about:blank. This is but one of the many reasons I seldom use it, not the least of which being its dismal security record. Today Debian dropped 64 updates on me, and while I was installing them I noticed the /var partition was at 95%. As luck would have it, my IP

Amazon EC2 Proxies

2011-06-11T15:43:00.000-04:00

Back on Proxy Obsession, before I was so ignominiously bounced from GoDaddy, I mentioned an Irish proxy that was stable and fast. The IP belonged to Amazon Advanced Web Services, having a hostname ending in amazonaws.com. I didn't think much about it at the time, other than to mention it, but it appears there are lots of folks putting up "private"—or so they believe—proxies on Amazon's "

TCP 9415 Report for May 2011

2011-06-11T09:00:00.001-04:00

Since my disclosure of the Chinese proxy issue back in April, I've been keeping an eye on the number of port 9415 proxies that pop up in the various lists I scrape every day. This is how the numbers shook out for May 2011... The month's total was up by ~16,000 proxies compared to April 2011, but the TCP 9415 percentage was down by 16 points. April saw a 50/50 split between 9415 proxies and

Corporative Nets Attack

2011-06-10T07:48:00.000-04:00

WTF is that supposed to mean? My best professional guess is "something lost in translation". (Yes, I did it for the Google search result.) You get five points if you know where it came from.

End of the SOCKS Bubble?

2011-06-09T17:19:00.000-04:00

Let me say right up front that I haven't run the numbers in depth yet, but it looks like the SOCKS boom is BUSTED in proxyland. At this point in time, glancing over The List you'll see a few on the traditional SOCKS port (1080) and those mysterious port 27977 proxies. Just last month there were pages and pages and pages of port-hopping SOCKS4 proxies. Where are they now? Did someone take down

Happy World IPv6 Day!

2011-06-07T20:07:00.001-04:00

About two minutes into it and everything is going fine. I had one surprise: my vintage 2005 wireless access point, which makes no claims about IPv6 support, compatibility, etc. I was confused at first to find it worked flwlessly with IPv6, but when I gave the issue a few brain cells, it dawned on me that it's a switch. That's Layer 2 shit! IPv6 is Layer 3, so it's all good. I mean, you could

Belated BT5 LiveDVD Review

2011-06-05T11:34:00.001-04:00

When Backtrack5 came out, Blogger was down, which probably aggravated a lot of security blogtards because they wanted to get their two cents out to the masses as soon as possible. I was one of them, but I didn't really have anything to say except I was glad that BT5 finally included JFS support. Maybe "glad" is the wrong word. It was more like "no longer pissed off". I mean—for fuck's

Gunz, Lulz, and InfraGard

2011-06-04T11:16:00.001-04:00

Being an 80s vintage hacker, I have often claimed that I don't own a hat... black, white, gray, or otherwise, although it might be proper to refer to me as a "tinfoil hat hacker" at times. I'm just not that into hats. Or people who wear hats, metaphorical or physical. But lately, in the people-who-wear-hats security universe, a battle is going on between the white hats and the black hats, and

Has Google Been Shitting Itself Lately?

2011-06-04T08:46:00.000-04:00

I just used that search box over on the right to look for references to RaLink wireless adapters here. Nothing came up. Then I did your standard Google-Fu against the site and got 13 hits, going back to 2007. WTF? I have also been having issues with Google Maps since early April, the latest being the inability to save street intersections to the M/S 2011 Map. Any plain old street number

Somebody play with rimo

2011-05-21T09:46:00.000-04:00

This guy, rimo, hangs around the Classic3 UT99 server—there's no idle timeout there—until someone shows up. Or, until he notices someone has shown up. Then he plays his little heart out. GeoIPCity says he's in Stockholm. He's not very good but he tries.

SOCKS Floaters

2011-05-19T18:32:00.002-04:00

Here are two good examples of floating SOCKS proxies, taken from the latest database run. The highlighted address was listening on two ports at the same time, but had also been seen on no less than six other ports during the same run. The non-highlighted address was also listening on two distinct ports. Those ports will eventually close and both addresses will reappear sooner or later on

FOX Cancels "Chicago Code"

2011-05-12T06:31:00.000-04:00

MUHAHAHAHAHAHAHAHA Story here. Now maybe I can get my search results back. I thought "Chicago Code" was a bad name because it always instantly reminded me of Windows 95 (Codename "Chicago"). Well, good riddance.

23,000 IPs: 104 Proxies

2011-05-10T19:28:00.001-04:00

The smackdown is on for 23,000 BitTorrent users who downloaded a Sylvester Stallone B-movie no one has ever heard of. You can find the story at Wired. You can also find a list of all the IP addresses here (PDF). I figured this was right up my alley, so I compared the 23,000 addresses with the 3.7 million proxies in the database and got 104 hits (a whopping 0.45%). 149 if you count repeat

Buyer's Remorse

2011-05-09T22:18:00.002-04:00

Well, this hosting provider appears to be a loser. This time around, I'm not mentioning names, but it shouldn't be too hard to figure out who they are. Their ftp server seems to be out in the weeds. The List is supposed to be updated every hour... as long as there's an ftp server on the other end. Right now, it's been almost three hours since the List was updated. I send a SYN for the

It's Heeeeeeeeeeeere!

2011-05-07T14:00:00.000-04:00

It seems that the Universe is conspiring against me, trying everything in its power to prevent the resurrection of the List. But it's back now, and the Cameroonian puppy scammers are whacking it like there's no tomorrow. They way things are going, they might be right. Last night, after I tweeted the announcement of the List's imminent rebirth, my system died. That makes three so far this year

keep ur pance on

2011-05-06T23:59:00.000-04:00

I just put mrhinkydink.com back online and the place is getting hammered. The list isn't there yet, but apparently there are a zillion or so page scraping bots hammering the place. Gosh folks, I'm speechless. You guys with the proxy mining bots should really think about putting a fake referrer in your headers. Talk about rubbing it in. And get rid of the Wget User-Agent! Most proxy lists

Tonight on Chicago Code: BOT House & Hinky Dink

2011-05-02T06:26:00.001-04:00

The Chicago Code airs on FOX on Monday, May 2, 2011 at 8PM Central Time. Once this dog goes off the air I can get my search results back. (EDITORS: STORY CAN END HERE) UPDATE: 10.9cI can't believe I wasted an hour of my life on that crap. I'll take my search results back now, plz.

De-bit.ly-fying a URL

2011-05-01T18:14:00.000-04:00

Ever since the URL shortening services began with tinyurl.com, I've been extremely suspicious of them, probably because back in The Old Days it was a popular way to put up a goatse or a tubgirl link (if you don't know, don't ask) for the newbs. Fortunately, that kind of abuse is A Thing Of The Past now. But... you never know. Just today, I got somebody else's SPAM in my mailbox (long

Why I Love Wikipedia

2011-05-01T14:47:00.000-04:00

Shit like this always makes my day. Whoever did it, thanks. I needed that.

How To Cut The "Proxy Problem" In Half

2011-05-01T13:57:00.001-04:00

For those who don't know (and you know who you are), I have been professionally involved with proxies of one sort or another for over fifteen years. For the past three years I've taken it upon myself to study the issue of open proxies in depth. I scrape all the well-known proxy lists available on the Web, geolocate the IP addresses and collect the whole mess in a MySQL database. Besides the

Is Chrome crashing on you?

2011-05-01T08:31:00.000-04:00

Specifically, version "11.0.696.60 unknown" (32-bit Windows)? My system hung twice at ipv6.cnn.com, so thinking that must've been an IPv6 issue and knowing that CNN has been flaky on IPv6 in the past, I went back to the IPv4 version of CNN and it hung again. Hung tight. No keyboard. No mouse. No network. CPU went to 100% and a crash dump started. Tight. That made three strikes for CNN, so

Chicago Code Is Killing My Brand

2011-04-29T17:36:00.000-04:00

In fact, the only reason I mention it is to ride the SEO bandwagon. So here's the mandatory link. If you're looking for The List, please be patient. And don't ask. All will be revealed in time.

OMG WTF?

2011-04-28T21:17:00.000-04:00

Yes, the List is down. It will be back. You explain away 100,000,000 open Chinese proxies and what happens? Some people get jelluz. lulz You can't stop True Talent™.

IPv6 & mDNS are the SHIT

2011-04-24T13:02:00.000-04:00

I would not lie to you, bois & grrlz. During the last UT99 server IP change, my IPv6 tunnel with Hurricane Electric , which had been running fine since February, got fucked. One thing led to another and I never got around to fixing it until today. Once I fixed it I realized my IPv6 name resolution was not optimal and I fixed that, too. It was just a minor PowerDNS tweak to tell the recursor

Insecure Defaults In PPLiveVA Client

2011-04-23T05:36:00.008-04:00

Insecure Defaults In PPLiveVA Client====================================The Great Firewall is full of holes.From http://www.synacast.com/en/ ..."PPLive has more than 200 million user installations and its active monthly user base (as of Dec 2010) is 104 million, i.e, PPLive has a 43% penetration of Chinese internet users. With its innovative user experiences, such as live chatting, and SNS,

Server IP Change

2011-04-11T12:23:00.004-04:00

If you bookmarked BOT House, BITCH House, et. al., in UT99 your bookmarks are now out of date. This time it wasn't a power outage. It just had to be done. Last week, I ragged on GoDaddy's DNS services (I didn't say one word about Bob Parsons shooting the elephant... not one word!). By early Saturday morning, between 1AM and 2AM they took away my ability to resolve my own DNS name through

Dropping the -ly

2011-04-03T18:47:00.011-04:00

A few years back I started hearing certain people in everyday conversation dropping the -ly in adverbs. For example, instead of saying... I am literally swamped with work. ... they would say... I am literal swamped with work. ... dropping the -ly from "literally". This drives me nuts. Not because I'm a grammar cop. It simply hurts my ear. ("It simple hurts my ear." - can you stand that

EXP5 UPGRADE!

2011-04-03T12:37:00.000-04:00

I doubled the RAM, from 1G to 2G, on EXP5 today. This is a "salvage upgrade" of pieces/parts from my old—circa 2003—Windows XP box, which suffered a fatal hardware malfunction. The heatsink on the chipset sproinged off and cooked it, causing numerous spontaneous reboots. This is the second time in ten years this kind of heatsink failure has happened to one of my boxes. Otherwise, it was a

EXP5 Down Temporarily

2011-03-21T15:39:00.000-04:00

I've had some hard luck on the hardware front and have taken EXP5 offline while I use it for data recovery. At this point I'm not sure how long that will take. BOT House is up. BOT House Twitter feeds have been down for some time. I think they finally fixed that Android hack I've been using to get around their new security policies. It was fun while it lasted. Anyway, I've been considering

"Press any key to access system."

2011-03-07T23:40:00.001-05:00

Yeah, I don't believe it either. You'd think that phrase would show up somewhere on the Web, but Google has never seen it. Go figure. It took them a few minutes to get it, but I now have the #2 hit without quotes and the #1 hit with quotes. So why does this phrase not exist? I at least expected to find it in a user manual for the network device I stumbled on the other day, but no. I suppose

IPv6 @ DinkNet

2011-02-23T23:03:00.000-05:00

Since the IPv4 address pool ran dry this month I decided it was high time I started practicing what I've been preaching for these last seven years and get DinkNet ready for World IPv6 Day on June 8th. Having dealt with the brain-dead technical support folks at my ISP too many times (once) in the past, I knew that wasn't the route to go, so I logged on to Hurricane Electric's IPv6 tunnelbroker

SoftLayer == Niche Player

2011-01-22T10:14:00.000-05:00

Anyone who's ever followed Gartner's Magic Quadrants knows the lower left corner is usually the Loser's Quadrant. If you can't make it to at least the "Challengers" quad (losers with attitude), there's not much your marketing department can do to help you spin the news. Whenever an MQ is unleashed unto the world, the press releases start to flow from the Gartner-proclaimed Challengers,

NegotiateHOST/(machine_name)

2011-01-20T18:16:00.000-05:00

Did Google bring you here? I ask because last time I Googled "NegotiateHOST" (Did you mean Negotiate HOST?) I got nothing. As in Jack Shit. And that never, ever happens. Kind of a jaw-dropper. I mean, Google has everything. So I decided to get the #1 (for now) Google hit for "NegotiateHOST". Just because I can. Anyway, there is this sevice called "lsiagent.exe" (and its little buddy,

Life During Cyber Wartime

2011-01-17T12:49:00.000-05:00

Heard of a Prius that's loaded with iPhones Packed up and ready to go Heard of a Web site, up on GoDaddy A place where nobody goes The sound of noobies, off in the distance I'm getting used to it now Squatted in a mantion, squatted in a rental I squat all over this dump This ain't no Facebook, this ain't no Twitter This ain't no surfing around No time for blogging, or online dating I ain't got

Author #6236

2011-01-16T08:58:00.000-05:00

Last week, I got an invitation from Packet Storm to set up my author account. They gave me a page all to myself, which you can find right here. Here's an excerpt from the nice email they sent... Packet Storm was recently redesigned and one of the new features makes it so you can customize your profile and author page. All you have to do is sign up with your current email address. We noticed

Creepy Convergence

2011-01-08T08:40:00.003-05:00

One early Sunday morning back in October, Gastonia (NC) police found a 2009 Hyundai Sante Fe parked in their own parking lot. Inside were a pair of bodies, the victim and perp of a murder/suicide. Tragic, but it happens every day. On average, it happens about twice a day. There is no avoiding it. It happens. This always triggers a number of events. The police have to investigate. The

CentOS vs. RDP

2010-12-04T08:36:00.004-05:00

Since I've been wrapping up the proxy project for the last few months, I've been spending a lot of time on my CentOS laptop writing my magnum opus, although due to format constraints I have to use Word in Windows over an RDP (Remote Desktop Protocol) session. And I'm finding CentOS—or maybe CentOS's implementation of X—has some problems. See below (click for full size). For the most part RDP

"Heartless Bastards In Cameroon"

2010-12-03T17:40:00.003-05:00

Attention Pappa Dollars, STARVO, Dabbleed, et. al. Try to be nice, OK? You're pissing people off. They're calling you names now. Thanks and remain blessed, Хинки UPDATE!12/04/2010 — Thanks for the link, Cameroon!

NoScript + gmail = NoLove

2010-11-25T14:03:00.000-05:00

Hard to pin down, but some combination of Firefox, NoScript, and a dozen or so other FF plug-ins trashed gmail for me for a couple of weeks. Chat stopped working completely and I lost the ability to create filters. Following as many security lists as I do, I need to create filters just to keep may gmailbox in order. You can just tell when a Full Disclosure thread is going to go Full Troll (

Sic Transit Gloria Mundi

2010-11-20T10:58:00.000-05:00

Thus passes the glory of the world. Three years ago this month the Salt Mines got their first Chief Security Officer. At the time I was busy with other things, most notably My Very First Websense Hack. I didn't get around to mentioning the re-org until several months later, at which time I made a prediction that the newly formed Security Group would eventually dwindle down to four to six

Another One Bites The Dust

2010-10-24T15:21:00.000-04:00

Sadly, EXP3 died today. In fact, given its pedigree, it took EXP 1&2 with it. So I got about 48 months out of that dog, which was a Tiger Direct refurb to begin with. I didn't actually croak. It's still operational. One of its 256MB DIMMs took a shit on itself and the box became unbootable. An fsck with bad RAM finished off the boot disk, so at this point it's just euthanasia. It's just as

What a bunch of PANSIES!

2010-10-17T12:15:00.001-04:00

Seriously, Auto-AutoAdjust isn't THAT bad, people! Even you hot shots get your feelings hurt when the bots start slamming you (see how it feels, huh?). Don't like it? Then don't get a huge point spread. That, or FIGHT BACK! It's not impossible to beat them. I've seen it done a number of times already and I've even beaten them myself! And I SUCK! So anyway, I twiddled the kick-in spread to

Map Death & Resurrection

2010-10-17T07:29:00.000-04:00

I brought back two maps on EXP5 and got rid of one. BOT House & BITCH House remain the same. Gone: MorpheusI never did like that map, but I don't know why. I just can't put it into words, but it's always a groaner for me whenever it comes up in the rotation. I used to love hitting Thummy with the Redeemer whenever she camped out in the tower with the sniper rifle. But alas, she's gone and

EXPERIMENTAL 5 Online!

2010-09-26T17:03:00.000-04:00

Ain't she a beauty, boys and girls? Yep, a genuine off-lease, refurbed IBM ThinkCentre corporate type PC! Vintage 2006! It's not so bad as it looks. It has the good old P4 3.4gHz CPU and a gig of RAM. Hey, 32 bits is all you really need! Not much to speak of in disk space (40G), but it's really not needed for a lowly UT99 server. And, as usual, it was cheap! What else do you expect from

So Long, Ubuntu!

2010-09-25T11:50:00.000-04:00

I have to admit I'm a little behind the curve on Ubuntu. 10.4 LTS has been around for months now, but all I've done is throw it on a VM and play with it a bit. That, and a disastrous upgrade attempt on a VirtualBox VM. But the other day I installed Xubuntu 10.4 (the Xcfe version) and I really liked what I saw, especially after installing Chrome on it. In fact it was just about set up to my

Five Hour FAIL

2010-09-22T23:22:00.001-04:00

Today, on the Autumnal Equinox, a powerful storm blew through the area during rush hour. Driving through it was a serious BITCH, and when Pinky & I finally got home, the power was out and the house was dark. According to the one analog clock in this house, it shut down a 5PM. It finally came back on after 10PM. On the bright(-ish) side, all four UPSes shut down perfectly, even the new APC

FUCK Adobe

2010-09-20T15:39:00.000-04:00

And the horse they rode in on. I patched Firefox for a Flash 0day and I got this horseshit along with it (click for a larger view)... I didn't want "New York Times Reader" and they never asked. I avoid the NYT like the plague. The first time I ever logged in to NYT was in 1997. I did not know SPAM before that day. Afterwards, my inbox was trash. What's even worse is I haven't found out how

BOT House is BACK ON TWITTER!!!

2010-09-13T14:21:00.001-04:00

It's kind of a lulzy state of affairs and it probably won't last long, but BH is back on Twitter! Here's the trick: Twitter sucks. They didn't really get rid of BASIC Authentication, they got rid of it for the Little Guy (that's you and me, boys and girls). If you're a Big Playah, you get a pass and your application can use BASIC Auth. The details can be found here. You will get a chuckle

Chrome on CentOS AT LAST!

2010-09-11T22:56:00.001-04:00

I'm not a big fan of CentOS but I've been compelled to run it for a couple of reasons. The first being I need something compatible (and free) that's compatible with the Red Hat systems we have at the Salt Mines. CentOS is Red Hat with all the branding removed to make it free. The other reason is this old (circa 2005) Sony Vaio laptop I inherited from my kid, Inky Dink, shown at left.

DELETED: Adobe Reader

2010-09-11T10:02:00.001-04:00

I have decided I don' have time for the drama Adobe Reader adds to my life. That, and the incessant reboots the weekly patches require, if they succeed at all. I can live without it, thank you. I am voting with my feet on this issue. I have decided to go minimalist and rely on evince for all my PDF needs. The Windows version is Spartan, but I really don't care. At most all I do with PDFs is

A Case of the Stickies

2010-09-06T18:09:00.002-04:00

I have no clue what happened, but yesterday I took the joint down cold to check out the UPS hooked up to BOT House, an APC BackUPS x1500. Yeah, that one. The new one. This little bitch is pissing me off. Very occasionally it will go "click click" and BOT House will hang, requiring a reboot. That is not what a UPS is for. Everything was hooked up correctly, so I did the only thing I could do

Worst Browsers: IE8 & Opera 10.6

2010-09-05T20:09:00.003-04:00

This is not a review. This is a rant about Windows browsers. I run Firefox with AdBlock Plus and NoScript because I can't tolerate ads. On top of the that, the home proxy runs SQUID with AdZapper. True, lots of sites can't run without Javascript, but for those I use the "Chrome View" Firefox plug-in. And now that there's an AdBlock for Chrome, I hardly see any ads with either browser. The

New Look For Fall!

2010-09-05T07:14:00.000-04:00

Well, I finally did it. I gave Blogger a few months to come up with some new templates but they disappointed me. Same shit, different day. And although I've criticized the look of "Dark-Ass Security Blogs" in the past, the other options are just too happy, trendy, or touchy-feely for my tastes. After all, this place is about HAXX and FLACK, not puppies and flowers. So it's back to the same

Apologies To Shirley In Accounts Payable

2010-09-04T11:55:00.001-04:00

Once again I have managed to get the #1 result in another Google Search No One Ever Uses, "Shirley In Accounts Payable"... Which is odd because at one time—the 90s?—there was an anti-virus ad featuring "Shirley in Accounts Payable" (because nothing can protect your company from her). So... sorry, Shirl... you're just too easy to pick on. I used to work with a Queen Bitch named Shirley (we

Twitter Muzzles BOT House, EXP4

2010-09-03T18:09:00.002-04:00

Twitter updates from BOT House and EXPIV stopped abruptly on September 1st when Twitter stopped supporting BASIC authentication. This is both good and bad. Bad because I have no idea how to use their new authentication model. I'm sure I can hack it out sooner or later, but I have other weenies to roast at the moment. Busy, busy, busy! Good because, face it, BASIC authentication sucks ass.

(EDITORS: STORY CAN END HERE)

2010-08-29T07:42:00.004-04:00

I ran across a variation of the phrase in the blog title in this news article just minutes ago. I concluded (I think rightly) that it was a "serving suggestion" by the journalist/author to the copy editor of whatever publication was considering the article. I Googled the phrase and found the one above. I Googled that one and came up with over a quarter of a million results. I conclude there

PoTTy DLL Hijack Vulnerability

2010-08-27T12:05:00.002-04:00

NAME: PoTTy v0.60 ================= VENDOR: Mr. Hinky Dink ====================== PoTTy, an Open Source, modified version of Simon Tatham's PuTTy (Windows version, v0.60) for Bruce Leidl's Obfuscated-OpenSSH v5.2 server, has been demonstrated vulnerable to the recent Windows DLL hijacking exploit(s). PROOF OF CONCEPT ================ See storm's (storm@gonullyourself.org) exploit code at

SKILLZ--

2010-08-21T12:03:00.000-04:00

A few refinements were made today. First, I bumped the BOTs' skillz downward. Second, if BOTs are in first and second place, AutoAdjust is turned OFF. Lastly, the spread that kicks in AutoAdjust is now HISCORE/3. This makes no difference in BOT House, but it kicks the spread up to 11 in EXPIV. In all, it's easier to kick into AutoAdjust. You just have to work harder when you're winning! I

It's Always Something!

2010-08-19T07:22:00.000-04:00

After I published my first Websense hack back in 2007, my hard drive died. It took out BOT House for a couple of months (just the box itself, the UT servers were jacked around to other boxes and VMs). The second time, RoadRunner died. Now, on the day after the third Websense hack, RoadRunner decides to re-engineer its entire network. They moved the DHCP server and re-IP'd the entire network