Singtel fcuks up again!

I am a bit boilling to talk abt the whole incident, but I would like to archive the letter to Singtel here. I will talk about it in another post.

To singtel :
I had placed an order 100****** online because I wish to avoid the queue at the shop. I had followed all the intruction, scanned the student pass for the student line etc, However, next working day I got a call to say the order is cancelled!!!I was told that ST cannot honor the signup done online and I had to do it at the Hello Shop? WTF? Then why have Singtelshop.com at all? It even wasted mt time to scan and upload the image!
Then I checked at the HelloShop... The price of the handphone is doubled!!! Why do you published price which you cannot honor at all? You had totally wasted my time and my opportunity to sign up with SH or M1!!! If you so desire to do so, you might as well put all your phone at $1 on Singtelshop.com since you cant honor the pricing anyway!

Goodbye Xiao P

Xiao P has past away on 2nd September after he was with me for over 2 years. I would estimate he lived about 2 yrs 3 months at least which is already far longer than an average pudding. He was still ok 2 night before when I played with him in his playground and I gave him a lot of his favorite food. He was still digging through them playfully.

Then the night before I saw him lying down weird. I knew the day was finally coming. After giving him some honey water, he seems better and he seems to do his very best to run around just to show me he is ok. What makes the whole thing even more sad... I comforted him and transfer him to somewhere quiet. Then after a while he slept peacfully and quietly. I couldn't sleep that night.

At about 5am I woke up and he was still and starts to harden. I did what I had to and give him a proper buiral.

I will alwasy miss you Xiao P. I have to stop here...

Facebook DoS PoC

An Facebook app call Photo of the Day :
http://www.facebook.com/apps/application.php?id=8752912084
demostrated a PoC of how Facebook can DoS another site. This app basically in short show 1 photos from National Geographic. But downloads 3 more huge files from somewhere else. Or for that matters, you can do upload, posts, requests or whatever you can imagine using hte Facebook API. Effectively, all you need is millions of people to sign up your app, then when they log in, they become your botnet to DoS someone.

For example, I can up my site counter to millions easily by creating a bogus app that gives free paypal money when you refer someone. Of course on the side line, I can con some paypal accounts as well. :) Then I can make a hidden read to my site in the app and not disaply it. Once millions sign up, millions will visit my site. OK, shake this off your head. This is a (C)Copyright idea... Hahaha. Seriously, its that simple. Make you wonder why it hasn't happen yet. (Or is has... We just did not hear of it)

Anyway, here is the full whitepaper :
http://blogs.zdnet.com/security/images/facebotisc08.pdf

Google Chrome Updates to v0.2.149.29

Quietly, Chrome has issued an update (which should happen quietly too) to v0.2.149.29 from v0.2.149.27. The older version is vulnerable to at least 1 auto downloading bug and at least 4 DoS / crashes error. I can't be bother to post these exploit here anymore because almost everyone will be updated and I will get tons of "How come it does not work?" post...

The good thing is Google is putting this in spotlight and fixing as we move along. Of course, thanks to the millions of Beta testers like you and me who is trying so hard to 0 days this. I guess I will work on something else now...

IE8? Maybe...

发誓 TVB剧集《搜神传》片尾曲 ~ 钟嘉欣

Legend Of The Demigods 搜神传 主题曲

Google Chrome - Zero Day Buffer Overflow

Yes, Google's browser is out. And Yes, a zero day can be found within 24 hours. Now you have to see it to believe it.

BTW, Google Chrome can be downloaded via :
http://www.google.com/chrome

After installing, just type this into the URL :
xiaop:%

or if you are lazy, browse to Crash Chrome

Yes, immediately, Google super friendly error message will greet you :


Well, if you had installed the right stuff, you can kinda find out what happen :

Of course, this is a buffer overflow.

Well, if this doesn't worry you about the way Google release this software, take a look at this :

This won't look too good if you had been surfing content rich multimedia sites (which Chrome is optimized for) such as Playboy or something...

Get your free 120 days Windows Home Server Trial now

Its available even for international order now! Grab it at :
http://www.microsoft.com/windows/products/winfamily/windowshomeserver/countries.mspx

Enabling Hibernation in Windows Vista

For desktop, in some cases, Hibernation has been disabled. There are many reasons why this is so including BIOS settings etc... However, there is a way to set it on if you are sure you want it and it works.

First, you have to ensure its not already on. Look for the file Hiberfil.sys. If you use the Disk Cleanup function, sometimes this file is delete and Hibernation, as a result, is turned off.

If the file is missing, do this :

1. Click Start, and then type cmd in the Start Search box.
2. In the search results list, right-click Command Prompt, and then click Run as Administrator.
3. When you are prompted by User Account Control, click Continue.
4. At the command prompt, type powercfg.exe /hibernate off, and then press ENTER. Actually I found that powercfg /h on will work too.
5. Type dir c:\hiberfil.sys. You should see the file now.
5. Type exit, and then press ENTER.

Then, obviously, if you want to turn it off, replace the on with the off.

Now, the next step is that if you have not reboot, the hibernation function is not yet enabled on you shutdown menu in Vista. And if you are stuck with a damn long process which can be paused, but cannot be resumed if you restart.. then its time to force a hibernation immediately.

To do that :
1. Click Start, and then type cmd in the Start Search box.
2. In the search results list, right-click Command Prompt, and then click Run as Administrator. Note that it may or may not need administrator rights to hibernate the computer.
3. When you are prompted by User Account Control, click Continue.
4. At the command prompt, type shutdown.exe /h, and then press .

Oh, you have pressed. There it goes. If for any chance you want to abort the shutdown, just execute shutdown.exe /a. This is a damn good way to do debugging for the RPC worm if you remember.

Gundam 00 Season 2

More information has been release on the official web site :
http://www.sunrise-anime.jp/news/gundam00/

I am quite anticipating the season and really looking forward to see how the story will unfold. But (SPOILER) one thing is for sure, all the C.B. pilots survived. Its just 1 plus month away.

Creative use of CVE-2008-2281 and Evilgrade Demo

Here is the demo I mentioned a while back but have not gotten the time to upload it. I had split the demo into 2 sections. Like how a magician does it. The first one here you will see what will happen, but not how it is done. In another post later, I will show you how it is done and why this is happening.

任潔玲 ~ 我們有沒有愛過

I remember losing sleep in camp during the night waiting for this MTV to come on and its usually the last one cos its No 1 on the charts. Well, its still a classic.

大海 ~ 张雨生

This is the original by 张雨生. I am sure we miss his voice. This is one song I will not attempt so that I can keep a good memory of it. And, btw, I can't unless its down a few octave... :P

大海 ~ 楊培安

从那遥远海边慢慢消失的你
本来模糊的脸竟然渐渐清晰
想要说些什麽又不知从何说起
只有把它放在心底

茫然走在海边看那潮来潮去
徒劳无功想把每朵浪花记清
想要说声爱你却被吹散在风里
猛然回头你在那里

如果大海能够唤回曾经的爱
就让我用一生等待
如果深情往事你已不再留恋
就让它随风飘远
如果大海能够带走我的哀愁
就像带走每条河流
所有受过的伤
所有流过的泪
我的爱
请全部带走

This song was one of my favorite originally by the late 张雨生. I am happy to see that 楊培安 has sang it very well indeed. This song does bring back memory of a story at a certain seaside on a rainy night...

三国志全日本超级动画主题 《风姿花传》~ 谷村新司

風は叫ぶ人の世の哀しみを
星に抱かれた静寂の中で
胸を開けば燃ゆる 血潮の赫は
共に混ざりて大いなる流れに

人は夢見る　ゆえにはかなく
人は夢見る　ゆえに生きるもの
嗚呼 嗚呼 誰も知らない 　
嗚呼 嗚呼 明日散る花さえも

固い契り爛漫の花の下
月を飲み千す宴の
君は歸らず殘されて伫めば
肩にあの子の誓いの花吹雪 　　

人は信じて　そして破れて
人は信じて　そして生きるもの
嗚呼 嗚呼 誰も知らない
嗚呼 嗚呼 明日散る花さえも

国は破れて 城も破れて
草き枯れても 風は鳴き渡る
嗚呼 嗚呼 誰も知らない
嗚呼 嗚呼 風のその姿を
嗚呼 嗚呼　花が傳える
嗚呼 嗚呼 風のその姿を

风呜咽，低诉人间愁怨;
夜寂静，怀揽繁星满天;
心胸开，热血有如烈焰;激流汇，化作洪流闪电。

梦中人，渐已入梦;梦中梦，人生如梦;
呜呼 呜呼 谁人知晓？呜呼 呜呼 明朝花落多少？

花烂漫，见证无悔誓言;共举杯，同饮月影一片;
望君还，孤独伫立此间;花已残，化雪轻洒我肩。

人有信，而言无信;有信人，为信而生;
呜呼 呜呼 谁人知晓？呜呼 呜呼 明朝花落多少？

国已破，城亦陷，枯草黄，风呜咽。
呜呼 呜呼 谁人知晓？呜呼 呜呼 风姿如此窈窕。
呜呼 呜呼且问飞花。呜呼 呜呼 风姿如此窈窕…

Wii Sex ~ Ouch...

Disgaea - Afternoon of Darkness End Save

This great remake of the PS2 Disgaea for the PSP is really worth taking a look especially if you are a big fan of SLG like Jeanne D' Arc etc. Anyway, go check it out, but you will realized to get all the endings involves multi replay, killing over 200 levels of extras etc... I decide that someone out there will want this.

This package includes all 9 endings (Etna Story ending as well). Just unpack them and read the DOAD.txt in the main directory and put the rest into your PSP where saves are.

Hope this help you see all the ending without having to go through what I had done for you. Please leave me a comment here when you download ok?

Disgaea End save :
http://rapidshare.com/files/134899145/Disgaea.rar

Creative use of CVE-2008-2281 and Evilgrade

I was working my ass off to try and get CVE-2008-1447 up for demo. However, I am still quite unable to execute it within a reasonable time. I sure hope they have better luck than me at Blackhat 2008. But to talk about the ends of the means, I find out there was a much much easier way to execute DNS hijack without using CVE-2008-1447. Yes, the treasure is CVE-2008-2281. And yes, its still NOT fixed even today! Works for all your favorite IE6, IE7 and IE8. I would want to shoot down Firefox eventually, but for now. This will have to be it...

Well, what I am going to demo here is not state-of-the-arts and neither it is 0-day. Well, at least the vulnerability is not 0-day, but the way to make use of this sure is... :) CVE-2008-2281 is just a less critical or low vulnerability. But combine with the newly release Evilgrade (well, I could had done it with my own web server too, but why waste time on things that others had already done up for you?).

A bit of background on the 2 things I will use here. CVE-2008-2281 is referred to as the Print Table of Links vulnerability. I will put up some links about this at the end of this. But in short, this affect you when you print using IE6,7,8 (beta for now) and under options, select "Print Table of Links". By far, only librarian uses them as far as I know.

The second thing I use is call Evilgrade. In short Evil upgrade. It can emulate upgrade servers of popular software from Java, Winzip to many others. Windows Updates is not possible due to the signing of the package. (For Now). So I guess you already know what I am going to do...

Well, keep guessing. But I will release my video soon as soon as I get the recording working.

Secure Computing Sidewinder vulnerable to DNS Query Port Weakness

Yes, the so invulnerable Sidewinder is finally flagged with a workable and exploitable vulnerability. So, for those of you who keep saying its a Sidewinder, I do not need to patch it, this is haha on your face...

No, seriously. You should patch this and this is a serious problem. This is related to the famous DNS poison exploit that is running wild with is tagged with CVE-2008-1447. It affects both Sidewinder and Sidewinder G2.

So, go patch it before someone "patches" your DNS for you.
P.S. Working codes is out for BIND 9.x and Metasploit framework. Go play with it now.

Windows Home Server Power Pack 1 RTM

Its finally here... The greatest improvement (other than fixing the corruption bug) is the Remote Access which now you can see your pictures in thumbnail view. For IE6 and IE7 (officially), you will be able to drag and drop to upload and download now. Its also a (few) click to download multiple files via ZIP now!

The other improvements includes backup enhancements including the ability to backup to USB connect drive, backup your WHS share folders. Of course, the power consumption has been fixed to give it a more green environment friendly feel.

Download WHS PP1 from :
http://www.microsoft.com/downloads/details.aspx?FamilyId=1A6AEF46-DB57-401F-814F-6EFA26E7A1E8&displaylang=en

Put that onto your WHS onto the software directory. Remote desktop into it and launch the installer. After that you will need to go onto each of your client machine and follow the instruction to upgrade the client connector software. Its goes something like http://(WHSServer):55000 to download the upgrade for each machine.

My advice is to immediately launch the connector software and perform a backup. Why? If you do so, you will released your security suite will detect the connector software has changed and it will prompt you for allow/deny the backup engine. Imagine if you have not done so and leave it overnight hoping it would somehow worked, well it won't. You will have to allow it and save the config this once. Well, if you have no such issue, I suggest STRONGLY that you get a client side security software. I am using Microsoft OneCare which has report it doesn't play nice with WHS. It worked for me anyway now that I am on OneCare 2.5 anyway.