Digital Choke Daynotes

The "Russian Hack" problem has settled down a bit, but there are still concerns. Here's just a couple of them.

• They shut down web site that was in the exploit code downloaded to the user's computer just by visiting an infected web site. This is good, but just for the short term. If the hacker has control of a computer, then they could just send up a new version of the back-door program that sends the data to a different web site.
• It's not clear how the web sites were infected in the first place. Some are saying that the web sites hadn't installed the MS04-011 patch, and that vulnerability was used to get into the web server. Others are saying that there might be a new vulnerability (as yet un-patched) that allowed the hacker access to the web server.
• There are additional reports that the web sites were hacked 'manually', instead of a scripted or automated attack. Nothing firm on this one yet.
• As I understand it, the hacker had to change an entry in the web server's properties. There is a setting in there that specifies a file that can be added to every page (like a signature block is added to your email message). If the hacker would have to place an html file (with some javascript code) on the web server, then make that change of the 'footer' setting to point to that new file. The javascript code would need to take advantage of a vulnerability (non-patched) on the user's computer to allow a program to be installed on that computer. That sequence of events is pretty complex (and somewhat clever).

And a bit scary.

Two main things done at work today. First was the modification of an existing Cold Fusion application that displays database information. With a reorganization of the hosting (owning) department, there was a need to add similar information to the database. There were three groups of data, each with it's own web page. They wanted to combine it all into one web page, but still have the three categories of data. Since the data structure was (or could be adjusted to be) similar, it wasn't too hard to figure out a way to do that.

Basically, there are three groups of variables to filter the data, and to display the data text labels. Each group is slightly different. So it was fairly simple to add a field to the database for the data grouping type. Then a data selection screen allows the user to specify which data groups they are interested in. A similar design would be a customer database, with screens that would allow you to select several different states or areas for display.

Not a very difficult process, just slightly time-consuming. So I worked on that all morning, and made good progress.

The other big project is to prepare a laptop for a security class I am taking next week. It's a "hacking" class, and we'll be using our notebook computers to hack into ourselves. Since the class will probably have some that are more advanced, I am bringing down a second computer to use in the classroom. It will contain only the basics, with no personal or corporate data. If it gets hacked, there won't be any danger of data loss.

So I grabbed an old Twinhead laptop, and installed WinXP SP1 on it as the base operating system. Then I'll add vmWare, and then two vmWare partitions: one for another copy of WinXP SP1, and one for a Red Hat Linux installation. It's an older laptop with a slower processor, but it will be good enough for the class. And it will be a good test box for continuing to learn as I hack myself.

The classes will be very good, and the venue will be nice. It's in Monterey (CA), although I suspect that I won't have much time for enjoying the area. This class is pretty intense, six full days, and there are several after-hours sessions that will be interesting to attend, along with some vendor exhibitions and demonstrations.

So I spent the afternoon starting the Win2K installation (while working on the Cold Fusion program during the waiting time). Tomorrow, I'll get all the patches current, then start the vmWare and Linux installations. And I'll be keeping track of things in my little notepad (low-tech version); with any luck, I won't repeat the mistakes that I've done before.

Pam and I had a pleasant evening. The weather here has been nice the past couple of days. Daytime temps are in the 90's, but the evenings have been nice. Right now, I'm out in the back yard on the patio. The sun is almost setting (it's about 8pm now), and there is a nice cool breeze cooling things off. Although the weather here can get hot (we do get some 100+ degree days), it doesn't usually get humid. And the temps cool off in the evenings to a pleasant 70 degree range.

Sacramento (CA) is a good area to live in, although the housing prices are getting high. Prices are jumping up about 20-30% per year. Which is good if you stay put, but bad if you are trying to buy a house. A 2000 square foot new house is in the $350K range. Not as high as Silicon Valley, but getting there. It makes you wonder how your children will be able to afford to buy a house.

I've been spending a lot of time configuring the sacrificial laptop for the hacking class next week. I've borrowed two so far, neither had the capabilities I needed.

So I got hold of a new IBM T41 laptop, brand new out of the box. It came with WInXP, so I got all the updates installed, added McAfee anti-virus program, then ZoneAlarm (the free version), along with enabling the Windows XP Firewall. Then installed vmWare for Windows. And started a full backup of the system with it's internal program that puts up to three backups in a hidden partition of the hard drive.

Tomorrow I'll continue with a vmWare installation of Windows XP Pro and Red Hat Enterprise Linux. So we'll see how that works.

Another nice evening tonight, so spent a bit of time out on the patio after dinner. Then Pam and I had a short fit of cleaning: she did the kitchen floor while I vacuumed. Then the usual evening routine: Pam reads, I surf while watching TV.

And, I put in an automatic date stamp up there at the top. PHP code courtesy of Greg Lincoln (Muse Root). One less thing to remember to change every day. Thanks, Greg!

... more later ...
Last Week	Next Week	Prior Weeks	mail	bookmark	The Digital Choke story