Tell Me Now (What You See) King Arthur 2004 SoundTrack ~ Moya Brennan

Long Ago,
Your name a shadow,
In my dreams, the white,
Brave still searching,
Raining Winds, fall apart.
I believe, your heart.

Tell me now,
What you see.
Tell me what you feel,
Now you're here.

Tell me.
Tell me now,
What you know.
Never let me go.
Tell me now,
What you see.

Who Cries from the hill?
The mist creeps from your eyes,
Your banner will promise,
Let's remember the start,
I believe, your heart.

Tell me now,
What you know.
Never let me go.
Tell me what,
You see.
Tell me now,
What you see.
Tell me what you feel,
Now your here, tell me,
Tell me now.
What you know,
Never let me go.
Tell me now,

Long Ago,
Your name a shadow,
In my dreams, the white,
Brave still searching,
Raining Winds, fall apart.
I believe, your heart.

Tell me now,
What you see.
Tell me what you feel,
Now you're here.
Tell me.
Tell me now,
What you know.
Never let me go.
Tell me now,
What you see.

Who Cries from the hill?
The mist creeps from your eyes,
Your banner will promise,
Let's remember the start,
I believe, your heart.

Tell me now,
What you know.
Never let me go.
Tell me what,
You see.
Tell me now,
What you see.
Tell me what you feel,
Now your here, tell me,
Tell me now.
What you know,
Never let me go.
Tell me now,
What you see.
What you see.

Windows XP SP2 End of Life on 13th July 2010

It had been a long 6 years and XP SP2 can be said as one of the longest lasting OS from Microsoft. But still even today, many will still clinge on to SP2. What actually happens when Microsoft says it is end of life for support?

Info:
http://support.microsoft.com/lifecycle/search/default.aspx?alpha=Windows+XP

Basically, you will not get patches anymore from Microsoft that support Windows XP SP2 32 Bits specificly as well as its other component including media player, IE, Outlook Express etc. Wait, you will notice that I mention 32 Bits, that is because 64 bits is still support as there is no such thing as SP3 for 64 Bits.

Some people may decide to hang on for whatever reasons, claiming that if they drop IE and uses Firefox, Outlook Express for Thunderbird and WMP for VLC, they will still continue to get updates. True. But do not forget that some components are still presents, especially those of IE, which arguablely is part of the OS.

Why not simply live a better life and have some peaceful sleep by upgrading to Windows XP SP3? Or even better to Windows 7? Let me know the reason if you happen to be one of those who still need to hang on with XP SP2...

Citibank forces clients to use older (vulnerable) version of Java Runtime (JRE)

Source :

http://packetstormsecurity.org/1007-advisories/citibank-java.txt

Basically in short, Citibank forces their client to use a vulnerable JRE because only that version is compatible with their application. No wonder Citibank is always on the frontpage getting hacked for at least a few times per year. Why doesn't Citibank upgrade their application? Lazy programmers? No budget? To pentest it (again) is too expensive?

Well, its all up to guesses, but seriously, to protect yourself, it is extremely important to uninstall all older version of JRE (btw, in case you did not know, upgrading doesn't really remove the older version in some cases - flagged as vulnerability in 07) so that application such as the above will not work (without telling you).

Also, as a side note, there is also a simply utility called JavaRa to remove older version of JRE:
http://sourceforge.net/projects/javara/

ALZIP 8 and its time to say good bye to another junkware

While ALZip looks cute, there is absolutely nothing that freeware like &-zip cannot do except the special ALZ format, which is in no way faster ot compress better as compare to other formats. The other possible reason you may want to use this may be the cute icons.

So, it finally upgraded to v8.0 and suddenly my license is no longer valid. Naturally I will not pay another $30 for this crap since 7-zip (which is free) does all the same and I had actually never encounter another ALZ files since then.

So, it time to say goodbye and uninstall another piece of software which is basically wasting space and slowing down my PC in the right click context menu. Moreover, it did not really work well,. Often I get files extracted to the wrong places and all over the places actually when there are nested directories. Well, but thats my opinion, you can still give it a shot and buy it if you like.

Stealing information via USB devices

I know it had been known for a long time. But does anyone cares? You should. That innocent looking China-made hello kitty cup warmer or the free thumbdrive from some company in Blackhat. Are they really as innocent as they look? How can you be sure that those are not just means to obtain information by other entities?

In short, devices can "mimic" any other devices by coding in the ID into ttheir chip while in fact they are totally not that device and can be performing other functions such as storing keystrokes or send out files to nearby wifi devices etc. Its all up to the maker to create.

Read about it at:
http://gizmodo.com/5578183/usb-coffee+cup-warmer-could-be-stealing-your-data

D-Link from Starhub will NEVER fix the HNAP vulnerability?

Earlier this year in Jan, SourceSec Security Research published a exploit which in fact is just a SOAP packet which allow users to set admin passwords (in the LAN, unless someone finds a way to use HNAP over WAN) on some of the routers. I have reasons to believe in fact it is all routers supporting HNAP.

The details:
http://www.sourcesec.com/tag/hnap/

D-Link replied and stated somethings which I think was stupid such as it can only be exploited with the software (which I see is nothing more than injecting a SOAP packet because there is no authentication). I believe anyone with some SOAP knowledge is able to just send the packet over or simply run the bash scripts available on the website.

The argument about which firmware is probably some overlook by the security researcher, but D-Link should spend more time checking which are the affected firmware instead of check out which of the listed firmware did not exist!

BUT, this is the best part. Singapore telco Starhub has some promotion for their users to get D-Link products (for free I guess) and D-Link has even created a special page for Starhub users.

Here is the "Download" page for the Starhub equipment on D-Link:
http://www.dlink.com.sg/Starhub/downloads.asp

The best part is, look at those firmware. They are ancient! The link still works though, but it seems like this page is totally forgotten and they will probably not update it any further. What this means is that all Starhub users who follows this link will believe that this is the latest firmware available for their routers. And take for example DIR-655. The vulnerability is only fixed in 1.33NA which has the following update notes:

¤ Fixed: Correct HNAP issue.
¤ Fixed: DNS relay issue ( WAN Slowdown )
¤ Added: Advanced DNS descriptions

And we still have 1.11 on the Starhub page. To add some damage to this, 1.33NA is essentially for North America. I had tried looking for 1.33WW (world Wide) and this only thing that came close is from the Russia FTP which may very well end up giving you a Russian web interface (unconfirmed).

Has D-Link forsaken the rest of the world on DIR-655? Well share your thoughts here in the comments.

Disciples 3 Renaissance Gameplay

It is finally released and available for purchase. Hope they dun screw it up like the HOMM series.

Gundam 30th Anniversary Special MTV 高達30週年紀念_MTV

Reverse...

There is a reason why sometimes you need to press the horn (loudly). And this is one of them:

心竅 -《蒲松齡》主題曲 ~ 馬浚偉

《蒲松齡》主題曲：心竅-馬浚偉

作曲 鄧智偉
填詞 張美賢
編曲 Johnny Yim
監製 鄧智偉

迷惑太多 能望見太多 明白太少
預計長夜深 終於天曉
暗黑的心 才最叵測 難料

雲象太多　而道理太多　提示太少
直到長夜深　星光普照
聽風的笑　能盡世間　奇妙

如夢初醒　無言才動聽心的呼叫
鏡中緣　霧裡花　在美好　從未需要
如夢不醒　芒然流淚過荒島身照
愛很長　夜再深　還有破曉

迷惑太多　能望見太多　明白太少
預計長夜深　終於天曉
暗黑的心　才最叵測　難料

同伴太多 沿路過太多 留下太少
別算人或妖 鬼影 心竅
有酒今宵 讓最困擾 忘掉

如夢初醒 明明還在笑怎麼哭了
鏡中緣 霧裡花 最假的 才越心跳
如夢不醒 明明流淚了怎麼失笑
怨很長 恨太多 唯愛太少

Onee and his house

Onee is not much of a home maker and actually make a mess of it. Well, this one is taken BEFORE he messes it up.

Onee loves Grasshopper

Onee simply loves grasshopper. Here is the proof:

Flash Flood in Orchard Road

Zebraman 2 - Zebra City's Counter Attack Released in Tokyo

Its been like 6 years since we had Zebraman in 2004. It is a funny comedy directed by Takeshi Miike. Here is the trailer if you had missed it:



And now, in 2010, we finally get a sequel. Here is the Zebraman 2 Trailer:

13 Assassins (2010)

This is a remake I will look forward to, especially since it is directed by Takeshi Miike.

How to install Nessus on Backtrack 4

Things has not changed much in the previous versions, of both BackTrack (except it's now Ubuntu) and Nessus. However, it is always good to post something here so that I can refer back to it when I need to.

What you will need is to Download Nessus via:
http://www.nessus.org/download/

The version I get now is 4.2.2. You probably want the GUI as well, which I am not very sure if it is still supported since the version is still at 4.0.2:
http://www.nessus.org/download/index.php?product=NessusClient

In your BackTrack, open a command prompt (or shell) and run:
dpkg -i
for both the Server and the Client (if you want the GUI).

For Nessus Server, the following steps are required:

1. 1. Make the certificates
   
   

   /opt/nessus/sbin/nessus-mkcert

2. Register the scanner in order to download update
   

   /opt/nessus/bin/nessus-fetch –register XXXX-XXXX-XXXX-XXXX-XXXX

   Nessus will fetch the update once it finish register. Btw, I presumed you know how this works, if not, you can refer to: http://www.nessus.org/register/

3. Create a Nessus User
   

   
   /opt/nessus/sbin/nessus-adduser
   
   

4. Start Nessus Server
   

   
   /etc/init.d/nessusd start
   
   

5. Start Nessus Client
   
   

   Backtrack -> Internet -> NessusClient or from CLI: /opt/nessus/bin/NessusClient

That's all to it.

Apple refuses to fix Safari on OSX even after it had been fixed for 2 years on Windows

Source:
http://www.networkworld.com/news/2010/052510-two-years-later-apple-still.html?source=nww_rss

Still remember the carpet bombing attack on Safari? Well, it is still not fix on OSX simply because Apple did not find a way to exploit it. Bottom line, the file is saved automatically on OSX in the download directory, but it is still not yet possible to exploit it (yet).

Guess this will be a ticking timebomb. As soon as a remote binary execution exploit is found for OSX. That will either be the day some guy get famous because of this combine attack or the day that many Mac get compromised.

Well, remember that you heard this first from me. And do not come banging my wall when it happen. It ISNT me!

Power Supply Calculator

Asus has a Power Calculator that never seem to work for me:
http://support.asus.com/PowerSupplyCalculator/PowerSupplyCalculator_right.aspx

It is probably designed for a very old version of IE or something.
But what I want to introduce is this:
http://www.extreme.outervision.com/PSUEngine

This page has a good inventory to take into consideration all type of CPU, Graphics card etc. It is always good to calculate how much you need before you go ahead to buy your PSU.

IBM free thumbdrive comes free with malware!

Yes, the title says what happened, except it is not ONE, but TWO malware which were detectable since 2007.

IBM security. What do you think of them now?

Read about it:
http://www.networkworld.com/news/2010/052110-ibm-red-faced-after-handing-out.html?source=NWWNLE_nlt_security_2010-05-24

8 Steps to remove a generic malware

Here is a link to an article which shows 8 basic steps on the removal of a malware.
http://www.techspot.com/vb/topic58138.html

I guess it is good to have it printed out in case of a rainy day.