Hinky Dink SEO almost back to normal

Lots of shit hit the fan back in April. It seemed like everyone wanted to put the smackdown on the Dinkster after that security announcement about PPLiveAV—those damned port 9415 proxies in China—hit the wire.

As if the GoDaddy DMCA takedown wasn't bad enough—taking out both ProxyObsession and MrHinkyDink.com—the next insult hit my "brand" like a rock. Some stupid cop show announced an episode titled "Bathhouse and Hinky Dink" and in the process snatched up all my Google search hits. (See also here).

Motherfuckers couldn't even spell "BOT House" right. heh. (If you don't play UT on my server you won't get it.)

FOX finally cancelled Chicago Code. I rejoiced, but it took a long time for the "Bathhouse and Hinky Dink" hits to go away.

As we say in UT, "DIE BITCH!"

This was the latest Hinky Dink hit...


... which is the new link on the "Hinky Links" side panel on the right. It is my public PGP key, with which you can use to send me encrypted email (dink-at-mrhinkydink-dot-you-know-what). I should have done that long ago, but I didn't.

You may have noticed other changes to the right-hand sidebar. Just trying to clean things up a bit. The link to the Proxy List was removed when it was taken down and I never put link back in. It has been restored. The Twitter bar was moved up and the search box was moved down. The BOT House tweets are gone since that hasn't worked for months (it was fun while it lasted).

Of things not working, the World Domination link is still down. I haven't fixed that yet. I wonder if it will ever get fixed because Google has lately made some "improvements" to the Maps API that are driving me nuts elsewhere. Never, ever depend on someone else's code because you'll always get screwed in the end.

Chicago Code Is Killing My Brand

In fact, the only reason I mention it is to ride the SEO bandwagon.

So here's the mandatory link.

If you're looking for The List, please be patient.

And don't ask.

All will be revealed in time.

SoftLayer == Niche Player

Anyone who's ever followed Gartner's Magic Quadrants knows the lower left corner is usually the Loser's Quadrant.  If you can't make it to at least the "Challengers" quad (losers with attitude), there's not much your marketing department can do to help you spin the news.

Whenever an MQ is unleashed unto the world, the press releases start to flow from the Gartner-proclaimed  Challengers, Visionaries, and Leaders.

Not so much from the Niche Players.

So it's somewhat surpising to see SoftLayer strutting their stuff over their Niche Player status in the latest Gartner MQ for "Cloud Infrastructure as a Service and Web Hosting" (Price US$1,995).

Well, good for them.  They've had a checkered past.  Nice to see they're finally cleaning up their act.

Author #6236

Last week, I got an invitation from Packet Storm to set up my author account.  They gave me a page all to myself, which you can find right here.  Here's an excerpt from the nice email they sent...

Packet Storm was recently redesigned and one of the new features makes it so you can customize your profile and author page. All you have to do is sign up with your current email address. We noticed that you have 3 files on your author page.

We have found that our users sometimes have questions for authors. By signing up, you will be able to have a direct conversations with the people most interested in your releases. 

Well, I guess I'm honored, and I'm always looking for ways to "pump the brand", but I'm not sure having "direct conversations" with those people is something I want to do.  I'm not quite sure who those people are or if they even exist, since most of the conversation around here is with Cameroonian puppy scammers and people who are pissed off because they got banned at BOT House (StinkFly).

In fact, no one seems to give a rat's ass about the Websense bypasses I have uncovered in the past.  With the possible exception of Websense (you out there, Hubbard?).  And besides, this is the place to come to for that anyway.

I might bite because it seems more Websense Fun is on the way.

NoScript + gmail = NoLove

Hard to pin down, but some combination of Firefox, NoScript, and a dozen or so other FF plug-ins trashed gmail for me for a couple of weeks. Chat stopped working completely and I lost the ability to create filters.

Following as many security lists as I do, I need to create filters just to keep may gmailbox in order. You can just tell when a Full Disclosure thread is going to go Full Troll (like this one) and I really don't need that bullshit. After deleting plug-ins, and even removing NoScript, those particular features were still broken, so I moved all my gmailing over to Chrome.

Then, after a few days, there was a NoScript update and everything was fine again.

I can't really blame it all on NoScript because I have other FF browsers with NoScript and the problem never affected them. Just one browser on one machine.

And during this same time period Google had one of its worst vulnerabilities that hit all their apps.

Just makes you want to say what-the-fucking-fuck.

A Case of the Stickies

I have no clue what happened, but yesterday I took the joint down cold to check out the UPS hooked up to BOT House, an APC BackUPS x1500.

Yeah, that one. The new one.

This little bitch is pissing me off. Very occasionally it will go "click click" and BOT House will hang, requiring a reboot.

That is not what a UPS is for.

Everything was hooked up correctly, so I did the only thing I could do. I just plugged it in to a different outlet on the UPS.

I fired BH up and played a few games. I kept getting stuck, and I noticed bots kept getting stuck. Players, too. WTF?

So I took the place down again and did what I did on EXP4 that fixed that particular problem; I tied the game down to one CPU (with taskset). That doesn't make sense, since it's a single CPU system, but it is hyperthreaded, so it thinks it has two CPUs. I started it back up and the problem went away.

It's been running fine ever since.

Worst Browsers: IE8 & Opera 10.6

This is not a review. This is a rant about Windows browsers. I run Firefox with AdBlock Plus and NoScript because I can't tolerate ads. On top of the that, the home proxy runs SQUID with AdZapper. True, lots of sites can't run without Javascript, but for those I use the "Chrome View" Firefox plug-in. And now that there's an AdBlock for Chrome, I hardly see any ads with either browser.

The absolute best of both worlds. FF+ABP+NS for security and Chrome+AB for speed.

Internet Explorer 8

This browser, aside from the problems of its pedigree, is simply dog shit SLOW.

The slowness is evident whenever you hit the "new tab" button. It can take up to five seconds for the new tab to appear and then you get that "WTF do you want to do now?" page.

Just give me a blank page and do it now! No stupid questions!

Next is the dedicated clipboard embedded in IE 8. This is totally unnecessary. Not only does it have "enhancements" I never use, but like the new tab button, it takes forever to pop up after you highlight and right-click.

90% of the time all I want to do is cut and paste.

And, this new clipboard is a resource hog. If you do a lot of highlight, copy, paste in a browser window it will eventually stop working. Ctrl-C and Ctrl-V still work, but the popup menu is gone until you kill IE and restart it.

And what is the point of "grouped tabs"? Most of the time the added pastel colors are offensive. I end up ungrouping the tabs so I don't have to look at it.

Why can't I shut that off?

Opera 10.6

Straight up I'll say at this very moment I'm writing this with Opera, but I'm doing it on my Linux (CentOS) laptop. It's fast and responsive on Linux and a great option when Chrome won't run on your distro.

On Windows it's different story unless Opera is the only browser you're running. I've been known to run four or five different browsers at a time—FF, IE, Chrome, Comodo, SRWare Iron, Safari—you name it, I run it.

Opera doesn't like that. It likes to be your one & only browser. I don't know why that is, but, like Safari and to a lesser extent Chrome, Opera uses IE's guts and it's doesn't like to share.

For me, that makes it unusable, which is a shame because I like Opera. But when IE and Opera are open at the same time, dog shit slow IE wins the speed contest.

If you're a one browser kind of guy, Opera isn't a bad choice. You can do worse.

Also-Rans

SRWare Iron was a great browser.

In 2008.

But they haven't updated it since. I have a hard time believing it's that well made. Still, it's a good alternate when I'm already running Chrome and I want to switch to a different proxy, which is just a command-line switch away.

I don't have any real objections to Safari. I just don't use it much. Primarily I don't like the looks of it. I like my windows to match the system colors, and the burnished stainlees steel look simply doesn't. And since it's tied to IE 8's proxy settings—which wasn't always the case—it's less than useful for my purposes.

While I'm at it I'll throw some turds at Iceweasel 2.0, although it's not a browser anyone uses anymore and it's only available on older distros of Linux. Me, I'm stuck on Debian 4.0 for a number of reasons, the main one being they never fixed the issues with VNC 4.0 on the newer version, Lenny.

The burning issue I have is Debian's insistence that "copy on select"—highlighting automatically copies into the clipboard—is the right thing to do everywhere. Blogspot simply disagrees. I disagree. That is not how the Universe works.

But, I'm stuck with it. If I upgraded to Lenny I could have Chrome and Opera. But not VNC 4.

New Look For Fall!

Well, I finally did it. I gave Blogger a few months to come up with some new templates but they disappointed me. Same shit, different day. And although I've criticized the look of "Dark-Ass Security Blogs" in the past, the other options are just too happy, trendy, or touchy-feely for my tastes.

After all, this place is about HAXX and FLACK, not puppies and flowers.

So it's back to the same old, same old but with more horizontal space. The old style always seemed so cramped.

(EDITORS: STORY CAN END HERE)

I ran across a variation of the phrase in the blog title in this news article just minutes ago. I concluded (I think rightly) that it was a "serving suggestion" by the journalist/author to the copy editor of whatever publication was considering the article. I Googled the phrase and found the one above. I Googled that one and came up with over a quarter of a million results.

I conclude there must be a shortage of copy editors in the world.

And I'm thinking if I try hard enough I can get the number one hit for this search!

UPDATE!

Thar she blows...
I love it when a plan falls together!

Websense/ISA "Via:" Bypass Redux

discovered by mrhinkydink

PRODUCT: Websense Enterprise

EXPOSURE: Trivial Web Policy Bypass (III)


SYNOPSIS
========

On May 29, 2010 I demonstrated that by adding a "Via:" header to an HTTP request it is possible for a user to completely bypass filtering and monitoring in a Websense Enterprise 6.3.3/Microsoft ISA Server (2004 or 2006) proxy integration environment. This was addressed in Websense Knowledge Base article #5117.

However, anyone familiar with the Via bypass technique would have noticed this remediation was insufficient.


PROOF OF CONCEPT
================

The following works in a Websense Enterprise system using the ISA Server integration product in a Cache Array Routing Protocol (CARP, sometimes referred to as "CRAP") configuration, which requires at least two ISA servers.

Assuming there a two ISA servers configured as per Websense Knowledge Base article #5117, one at IP address 10.10.0.1 and another at 10.10.0.2, perform the following:

I. Install Firefox >= 3.5

II. Configure Firefox to use one of the proxy servers in the CARP array (10.10.0.1).

III. Obtain and install the Modify Headers plug-in by Gareth Hunt

IV. Configure the plug-in to add a valid "Via:" header pointing to the other server in the array.

    Example: "Via: 1.0 10.10.0.2"

V. Browse to a filtered Web site

VI. All content is allowed without monitoring or filtering


PoC RESTRICTIONS
================

All restrictions of the original Via Bypass article apply.

See http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html

OTHER USES
==========

Limited only by your imagination! You do have an imagination, don't you?

See http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html


WORK-AROUNDS
============

Install Hotfix 17 provided by Websense.

HISTORY
=======

06/25/2010 - vendor notified

08/13/2010 - vendor releases Hotfix 17

08/18/2010 - PoC published



c. MMX mrhinkydink

New_Laptop_Boi

That's me!

For some unknown reason, The Boss decided I needed a laptop a year and a half after he decided I didn't need a laptop. So, now I have a new laptop.

I liked the old one just fine. It played UT great! I've had nothing but heartache with my own laptop and UT. At first I thought it was Vista, but all the problems remained after I upgraded it to Windows 7 (a.k.a. "Vis7a"). Then, one day I plugged a USB keyboard into it and tried playing. All the problems vanished. Turns out it's the keyboard hardware (or the driver). Still, it's not convenient to play that way.

This new laptop is nothing stellar, a run-of-the-mill HP 6530B with a dual core Centrino, two lousy gigs of RAM, 32-bit Vis7a, and an 80G hard drive (encrypted!).

meh.

I'm not impressed.

But... it runs UT like a champ! So now I can play from the comfort of my own couch. And it's small enough that I can have a cat on my lap at the same time!

It makes playing UT fun again!

So if you see New_Laptop_Boi say "Hi".

Хинки Динк

I spend a lot of time these days doing the IT security geek thing over at Proxy Obsession. For instance, over the last three weeks I've been hacking my own version of PuTTY, the popular Windows ssh client, and blabbering endlessly about my progress (or lack thereof). Real boring shit.

Anyway, since that particular blog is Wordpress, I get a lot of comment SPAM. I'm not sure what it is about Wordpress that attracts the comment spammers, but they love it. They keep spamming me and I keep adding their IP addresses to my .htaccess file.

Mostly I just tolerate it. And by "tolerate" I mean "delete".

A lot of it is vanity SPAM, attempts at schmoozing your way in to get a link. Stuff along the lines of "I love your blog and I'm subscribing to your RSS feed!" or "That was a very well written and thoughtful article!" and other such bullshit.

Slightly less than half of all the SPAM I get is written in Russian. Today I got one that said (translated by Google)...

"You would know that about you write in other blogs :)"

What? I guess he's trying to say that other people write about me in their blogs.

Yeah, right. That doesn't happen. But it got me curious about how often "Hinky Dink" shows up in Russian on the Interwebs, so I did a phonetic translation of "Hinky Dink" into Russian and tried this search.

There was a total of nine hits, and eight of those were about Michael "Hinky Dink" Kenna, the old timey Chicago political boss.

There was nothing about me me me ME, so I figured I would do something about that!

And that's why you're reading this!