Standard Chartered Bank in CBD Caught Fire

Rarely I am into writing about fire. However, this time I am on site when it happened and it involved a big bank. The roller gateway were closed from the MRT access and there were around 4 fire engines big and small on size along with a few police vehicles.

I approached and asked the police what had happened and obviously they said "No Comments". So what happened? I guess I can only wait till the newspaper reports this. Was the CEO burning his chair up because of the bad final year results? Was some managers burning away some audit trails which proves fatal for his career? Or simple, leaking battery in server cause fire in server room?

Only time will tell.

What I do for a living (The Not-So-Good)

There is always those times when you simply hate some of the projects. I am sure some of you know what I am talking about. Usually this are projects where the difficulties usually do not comes from the technical aspect of hacking. For example, in a company where there is a fight between internal audit and the IT department. IA always knew IT were up to something that breaks compliance, but there are fierce resistance to the audit. This is one case where an external auditor is called in to do the dirty work. Well, not that IT will give these guys any better days, but it creates a opportunity to weed out those skeletons in the closets. Sometimes, this type of assignment can be nightmarish, especially if it not supported from the top by CIO / CEO etc.

In another case, the person or group you are auditing or hacking against is simply against you and refuse to co operate in any way. This is not as bad because usually in these situations, you are called in by a higher power to pull out these holes. As long as the higher power gives you the authority, many things is simple not a big issues. For example, network access. If the IT department refused to tell you what network and how to connect, there is always Wireshark to sniff out the segment and probably guess the gateway etc. In 5 minutes you will be in. Usually this situation can be solved using technical means.

There is yet another situation in my daily work which I really hate. And to be fair, it happens because nothing is perfect. That is crushing the network / server during the testing. While it is high desirable to avoid this situation, it is not within our power to ensure it never happens. Some legacy switches or poorly designed server will simply die even with a few pings. If you have a great team to support you, that would be good. Otherwise, there will be lots of finger pointing and flaming going on that actually prevents you from doing your job. But to be honest, if the network cannot survive a reasonable scanning or hacking attempts, this should be viewed as a audit failure because some other day, it won't be you crushing the resource. And these other guys will not be so easy and nice.

Chu Chu, we miss you!

Its one whole year already. How times flies. Like I said, new year will never be the same again. Although I had plenty of time, I did not wrote much here. I tidied up Chu Chu's place on this anniversary on 4th Jan 2009. I starts to see some resemblances with Fion. Especially when Fion make her face very untidy with hair running around that day. They almost looked alike, other then the size itself. Chu Chu was much smaller though.

I know what is gone is gone. I choose this day to watch the movie "10 promises I made to my Dog" as a remembrance to Chu Chu. It was sad, but I know this means I still remember Chu Chu deeply inside. I will always remember those great time we had and how we played together. I will also treasure what I have now more.

Chu Chu, I really miss you.

春のかたみ (怪 ED) ~ 元ちとせ

This is the ending song of Ayakashi by Hajime Chitose. Loved it. A nice haunting song to kick start this year spring!

Tokyo Gore Police 東京残酷警察 Trailer

If you love Azumi and Versus, there is no reason you should skip this! Lots of blood, gore, violent and nudity!

Live Messenger 2009 is out!

Yes, its true and final. Download it at :
http://download.live.com/

Well, if you hate advertisements like me, you will probably want to "patch" your messenger with A-Patch:
http://apatch.org/downloads.php

Its a pity that mess.be is still far behind the patching. I like that better.

What I do for a living (The Good)

Often it is I get this question. Or rather message since most of the time people just ask for asking. They did not really expect much of an answer. While many of my peer will probably make up lies and say things like I work in Consultancy or IT services, which in effect is still technically correct. One night while chatting on IRC and I gave that answer again, I really feel myself to be some what hippocratic. 

The fact of life is I HACK. The word has been colorized by far too much movies and negative reports. Well, not that it is not what it is, but the differences is some people do it with permission while others do not. I kinda belong to those who had the permission. But that certain do not make you a white hat automatically.

Really? Ya, that what I get if I used the above answer which is why I prefer to say Consultancy or hell even I work in McDonald's sometimes. The client give me an application, I break it apart and tell them what I can see inside. The client give me a website, I hack into the accounts and demonstrate to them what damage can be done. If you think that sound cool, good for you. 

At some point of time, I almost felt there is no more challenge out there. In terms of network, applications almost every single one has some problem one way or another. But then again, nothing is perfect. But that what I do for a living. Its nothing like in the movies, where you disarm crazy looking security systems to save millions of lives or prevent the SDI satellite from starting WW3. It is just not that.

While it sound fun to uncover security problem and help clients fix them before millions of dollars are hacked out by people from the dark side. The result is unseen. That makes my job looks like nothing had happened although no news is good news in this case. Therefore you can see not many people require this type of services. Most do because it necessary by law or its better to do so that you do not need to take the fall if something happens. People who truly believe in the value is few that I had seen.

So, I guess the next question is I lost my yahoo account, can you hack it for me? I want to see if my girlfriend is dating someone else, please hack her Facebook for me? Ya, I get that all the time. I guess the main difference of the good guys and the bad guys is both knows how to do it. Just that the good guys do not exactly do it. 

So, will I hack you? Nah, being mercs as ever, I do not do anything for free... haha :) Just kidding. I am suppose to be the good guy right?

Free Legal version of IObits Advance SystemCare Pro V3

This software is not bad. Comparable to Tuneup Utilities 2008. Just too bad there is no native 64 bits version. Grab it at :

FREE IObit Advanced SystemCare PRO v3 License Key Codes Exclusive for Raymond.CC Readers

Install Fedora 10 on Virtual PC 2007 SP1

The graphics mode pretty much does not work, at least for me. The whole installation was done in Text mode. This is weird because I remembered I managed to get it working in Fedora 9. In any case, to make the WORST happens, I installed everything, which WAS a mistake. The sensible thing to do is to NOT select virtualization. The reason being it doesnt help much in a already virtualized environment. Unless someone has a paper which prove me wrong about VoV (Virtualization on Virtualization).

Ok, I will only flag out the hard part, the rest is standard protocol. 

For the file system, it may make sense to use a normal non-RAID partition because in the VM, there should not be any performance improvement (or rather its probably going to cause performance issue). So, what I did was a simple 1 x swap and 1 x ext3 partition. If you free you want to secure your /boot, you can split that out too.

The rest goes as per normal. After the reboot, you will realized you see nothing (or some garbage) on the screen and cannot see anything. To fix this, you have to get into grub menu. Edit the kernel... line adding "vga=0x32D" at the end. That should allow you to boot up into text mode at least.

Now once you are in text mode, you will want to fix this once and for all. Go to /boot/grub and change the menu.lst according with the vga=0x32D on the line.

You will also notice the screen is huge and its not very friendly for some of us using a laptop with tiny screen. To fix that, you will need internet to install some modules. Once you confirm that internet is up, do :

yum install system-config-display

and then after the installation, run :

system-config-display --reconfigure

You X should now run properly in whichever resolution your choose. The rest, should be easy.

Afterdark Horrorfest 3

http://www.horrorfestonline.com/

The 8 films for the Afterdark Horrorfest 3 is confirmed as:

• The Broken
  
• Slaughter
  
• Perkins 14
  
• Butterfly Effect : Revelation
  
• From Within
  
• Dying Breed
  
• Autopsy
  
• Voices
  

Publishing source codes onto Blogger

You cannot imagine how bad it is... All your lines gone, errors on symbols etc...

Fortunate for you, I had found something that converts all the special characters for Blogger because I was trying to make my previous entry.

You can use this online convertor to convert your source code for publishing on Blogger:

http://www.stanleyshilov.com/online-tools/convert-special-characters-into-html-entities/

List to Range in Excel

I know that range means something else in Excel, what we are talking about here is making a list of numbers into a list of ranges. For example, we have :

1 3 4 6 8 9 10 14 15 19 20 22

Imagine we have this on the first column of an Excel sheet. What we want on the second column is:

1 3-4 6 8-10 14-15 19-20 22


Sound dead simple right? Ok, maybe you can skip reading this then. While its sound simple, it took me 15 minutes after a cup of 7-11 Slurpee Brainfreeze to write this :

Option Explicit

Sub Rangemaker()

     

    Dim i As Long

    Dim col As Long

    Dim sRow As Long

    Dim wRow As Long

    Dim seq As Boolean

    Dim LastRow As Long

     

    '  speed

    Application.ScreenUpdating = False

     

    '***begin change***

    '

    'init start row: CHANGE TO SUIT

    sRow = 1

    'set column to put results on: CHANGE TO SUIT

    col = 2

    '

    '***end change***

     

     

    'get last row of data to process

    LastRow = Cells(65536, 1).End(xlUp).Row

     

    'init dest row

    seq = False

    wRow = 1

     

    'do all rows from sRow

    For i = sRow To LastRow

        'see if next row is continuous

        If CLng(Cells(i + 1, 1)) <> CLng(Cells(i, 1)) + 1 Then

            'Not Continous

            If (seq <> False) Then

                'is part of a seq

                Cells(wRow, col) = Cells(wRow, col) & " - " & Cells(i, 1)

                wRow = wRow + 1

                seq = False

            Else

                'is not a seq but single number

                Cells(wRow, col) = Cells(i, 1)

                wRow = wRow + 1

                seq = False

            End If

        Else

            'Continous

            If (seq <> True) Then

                Cells(wRow, col) = Cells(i, 1)

            End If

            seq = True

        End If

    Next i

    

   

    'reset

    Application.ScreenUpdating = True

     

End Sub

Lets run through this a bit. I had added in as much comments as possible. Basically, you can play with 2 variables for your need.

• sRow which is which row to start making the range.
• col which is which column the result will appears.

Basically, it checks through each row and the next row and see if they are in continuous sequence. If no, then check if its already part of a sequence, which you should end with a "- ", otherwise then its a single number. If its in continuous sequence, you set some variables and continue.

For those who like insult to injury, to do this in Perl, its simply :
@a= (1,3,4,6,8,9,10,14,15,19,20,22); 

print num2range(@a); 

sub num2range {  

local $_ = join ',' => @_;  

s/(?<!\d)(\d+)(?:,((??{$++1}))(?!\d))+/$1-$+/g;  

return $_; 

}

Original idea and post:

http://www.ozgrid.com/forum/showthread.php?t=72891

Perl code was found from:

http://www.perlmonks.org/?node_id=87538

First it was Bear Sterns. Then AIG. Then Lehman Brothers. I think this is the beginning of the end? Althought Citibank will survive for now... But only time will tell...

Why RAID 5 stops working in 2009...

Somewhere in July 2009, this was one hot topic that caught my eyes, but I did not care because WHS has a simply, cheaper and more advance way to manage drives then RAID. But it turns out that by mahtematics, ya Q.E.D so to speak, if a 2TB drive in a 12TB RAID 5 config goes KO. Then that will trigger a rebuild. And based on the 6 remaining SATA drives, the error rate is 100%. Therefore you cannot rebuild the RAID array. All 12TB gone. Thats the simple version...

I think the importance here is to stress that BACKUP and RAID are 2 different thing. You should not do without BACKUP, even if you have RAID, which in general is a good and sounding practice. What? Your company don't do that? Then you should quit before 2009 (or upgrading to a 12TB configuration) before shit is on your hand as per say. :)

See the original post and flaming all over in:

http://blogs.zdnet.com/storage/?p=162

Pointsec Virus Protector

Following my previous concept on how a rootkit can be protected on the HDD of a laptop, this idea can be extended thanks to another product call Pointsec Protector:

http://www.checkpoint.com/products/datasecurity/protector/

Basically, this encrypts your USB / External flashdrive, HDD etc. Which in this article, I will conceptional talk about how this can be used to protect the virus in transit. 

Imagine a virus extension of the rootkit. It can be transmitted onto an external device. So we have some USB flashdrive, which in this case is protected by the Pontsec Protector. So the virus is injected on the flashdrive. Now typically, we should be able to scan the USB flashdrive in a clean environment such as Linux, but because its protected by Pointsec Protector, this is not an option here.

So, how about when it get plug into another Windows system? Well, if that windows system does not have the Pointsec Protector software, the virus is safely protected inside. Well, in the case it is. Then doesn't the host based antivirus picks it up immediately and wipe out our virus? It depends. There can be several ways to go about it. One way is to inject itself immediately into the Pointsec address space. That makes it hard to kill and most likely the antivirus will have to take the Pointsec down with it. Then it still leaves our virus intact in the USB flashdrive. However, this technique is not easy at all. Another way is to inject the rootkit immediately so that while the antivirus spends it time cleaning the virus (if it doesn't block it first), we 0wnz the system first hiding its trace. 

As you can see, the encryption here provides it a mechanism to transport the virus straight to the target. The only defend left is the target host based anti-malware. I suppose modern day malware has easily overcome this problem. In the case where the malware does not detect the virus at all, then its game over for the system. However, if in the first scenario is possible, then a virus which is able to target the encryption mechanism, it will provide a more foolproof entry into the system or at least it will disrupt the anti-malware's attempt to clean up the virus. No decryption, no cleaning. 

Conceptional, I believe this is possible. And the impact can be much more serious than to rootkit a hypervisor because of the vector of attack. 

Corporate Windows Update

While corporate spent tons on getting their system protected by anti-virus, IPS/IDS and firewalls, its the very fundermental that they overlook much very often. Yes, I am talking about Windows Update or Microsoft Updates. There is no doubt why the update services is often blocked by the corporate policy is due to a need to test updates before deployment. The excuse that it is not compatible with some of the software is lame in my view. If it is so, that piece of (crap) software should be updated or thrown away. People makes patches to make things work. They do not avoid patching just to keep it working. That's precisely the phase :

"If it's not broken, don't fix it!"

Well, I do not know if I had mentioned this before, but the weakest link on my network was my company laptop. It has easily 20 high findings just after scanning for 5 minutes with a commerical vulnerability scanner. Well, you also notice I use the word WAS. It is no longer. 

There are times that certain updates are necessary. For example, you had needed XML DCOM or MSSQL for some project. But you are then not allowed to update these component after you installed them. This will be the time to ask. Do you want to go as far as to "break" the corporate blocking of the Windows Update? If not, you can do what I do. Prohibits the stupid laptop from connecting to your network. That's one against working from home.

But if you figure to yourself: "Ya hell just do it!". Here is the solution.

Create a registry file (with extension .reg) with :

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\DisableWindowsUpdateAccess] 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoWindowsUpdate"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoWindowsUpdate"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAutoUpdate"=dword:00000000
"AUOptions"=dword:00000000

[-HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDevMgrUpdate"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"NoUpdateCheck"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate]
"DisableWindowsUpdateAccess"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoWindowsUpdate"=dword:00000000  

Save it and run it. Of course if you are hardcore enough, you can manually edit these registry. Make sure you make a backup in any case. There is also a file which is done up so you can download and run it from : Link

Well, happy updating.

Truecrypt 6.1

This must be old news to many of you, but Truecrypt 6.1 is out. This is a file / disk based encryption software. I had a previous complain about the default settings (where you click next, next, next, install, oops, OS screwed up...) where they disabled the swap file. This is truly undesirable and cause a hell to troubleshoot because its hard to know where problem starts especially when you do not know what exactly happened.

Anyway, they got this right this time.

Download it at:
http://www.truecrypt.org/downloads.php

Pointsec Rootkit Protector

This is exactly how encryption can backfire in a corporate environment.

Basically, it applies to all the disk based encryption, more especially on those which cannot be reversed. But I decided to mention Pointsec because this is where I got it working. Most company will encrypt the whole disk especially in banks, military agencies.

Next, we have a concept rootkit, which should be fairly powerful to mask itself from all if not most conventional anti-malware. We can assume in a "perfect" environment where if the rootkit is loaded, it cannot be detected in the same environment. So as long as you have the OS running with the rootkit installed in Ring 0 layer, you are screwed so to speak.

Traditionally, in this case, we would attempt to remove or disable the malware by booting it up with an alternative environment such as WinPE or Linux. Then we can perform a scan on hte FAT/NTFS and wipe out the rootkit. Now, this is where it get tricky. Because disk based encryption is used, there is no way an alternative environment will be able to see the files on the infected Windows. So far I have only encounter Microsoft's Bitlocker which can be decrypted. And in this case, it is possible to remove the rootkit after decrypting it.

By now, I think you can figure out what I am trying to say. The only way to wipe out the rootkit is to destroy the whole encrypted partition. And as long as the partition is still encrypted (in my case using Pointsec), there is virtually no way to even read the partition using another OS. In a way, Pointsec protects the rootkit from being isolated and destroyed. That is in the first place if someone even figures out that there is a rootkit in place.

Where this can be applied? Well, almost everywhere where company can afford to have all their laptop encrypted and pay enough to acquire a really god rootkit. The company can effectively spy on their employee and perform logging or auditing services. And even if the employee finds out, there is nothing they can do. Well at least in countries where privacy is not protected by law.

Ok, I am not going to leave my contact here, but if you think your organization requires such a services, drop me a comment. :)

Microsoft to offer FREE Anti Malware in 2009 codename "Morro"

Read about it here:
http://windowsonecare.spaces.live.com/

In short. Onecare will be discontinued in June 2009 for sale at least. By then, I would expect that Morro will be available in Beta. So, if you did not pay for Onecare, you won't need to for Morro either.

I cannot say how good this may be because it is likely Microsoft will strip off the additional functions such as tuneup, photo sharing, backup etc. So, it may be a give and take thing.

The only advice I can give for those who are facing expiry of their subscription soon: Renew of switch to a new Anti Malware first. Morro will be a while. If your expiry is far, go on with it and wait. By Spring 2009, I will expect a beta of Morro to be available.

D-link DIR-655 Firmware 1.21 with USB support

Read all about it and also about the Secureport managed services which is slammed on several places including Slashdot :
http://tech.slashdot.org/article.pl?sid=08/11/05/2220213&from=rss

The changes are as stated on their support page:
http://support.dlink.com/products/view.asp?productid=DIR%2D655

Anyway, what they did not tell you is that there is a official firmware 1.21 which does not contain the Secureport function and you can download it at:
ftp://ftp.dlink.com/Gateway/dir655/Firmware/dir655_firmware_121_no_securespot.zip