Privilege Escalation on all Windows

Whilst looking for potential privilege escalation vulnerability, I found this gem regarding to kernel exploitation:
Windows VDM Zero Page Race Condition Privilege Escalation (MS07-022; BID=23367; CVE-2007-1206)

i can't right click and i can't see the source

I found an interesting site whilst looking for photos of myself. It's at http://www.myeventphoto.co.uk If you dig further in the site, you will find galleries where you would have to pay for photos. I think to myself I just want a little snapshot. But the site looks to have Javascript code to stop you viewing the source and right-clicking. It looks well looked down.

However, remember files maybe stored in Internet temporary directories and sure enough I found a photo of myself in there. You could stop prohibitive nature of the application by disabling Javascript!

Facebook can used against you

It was reported that the university authorities are using facebook to throw the book at students at Oxford University. The student union are urging students to tighten their security settings so that not much details can be viewed.

Have a look at: http://news.bbc.co.uk/1/hi/education/6902333.stm

Also in a news article, I saw these interesting facts:
*
* A survey of 600 British companies showed that 1 in 5 had logged on to Facebook and similar websites to vet potential workers.
* Five students were banned from a school trip in Toronto after disparaging remarks about teachers were found on Facebook.
* A US consultancy rejected an applicant after reading that is interest included "smokin' blunts with the homies"

To be fair, I've started using facebook to catch up on old friends. But trying to keep myself as anonymous as possible. If you can call it that. But I am beginning to find already, it's not what *you* put on facebook that could give information leakage. It's what other people put in their facebooks about you. e.g. photos, etc.
But as I say to myself. There's enough information out there about me to paint a picture. But nothing substantial.

Java and flash patches

I'm falling behind guys because my social life gets in the way. I'll try my best to throw lil tidbits from now on in and show what is in my empty head of mine...

Interesting how vulnerabilities and patches were released for both Java and Flash on Friday the 13th. I'm still not superstitious!

Have a look at: The Register's take on those two patches.

Careful what you say...

I remember an old work colleague telling me, "Look I'm going to tell you something really important about work but I'll tell you later". The reason I found out later was that you never know who was on board that train from London. And you know he is right. When you are in public, you represent a number of things, yourself, your family, your religion, your country and your workplace. You have to be careful what you say. Admittedly, you are not likely to be famous and no-one is likely to care. But people will overhear and remember things like anger, swearing and anything illicit. I remember from a kid's story that the 'corn has ears' and can pass messages when the wind blows through the cornfields.

I am a firm believer in keeping a low profile and not drawing too much attention to oneself. You will always leak information about yourself but you can certainly control the amount you give. The little information you give, the less information people have to use against you and chances of such things of id theft happening become slimmer.

Similarly that's why I am not keen on social networks, I mean all the data going into the databases. For example check out: mobuzz on facebook and does what happens in the facebook stay in the facebook
Now I do have a myspace and a facebook but I am trying to leak as little information as possible. The only correct thing you should need is an email address. But again in a public arena, with data bound to be logged, you do still have be careful what you announce. Hmmm is everything we say logged? I mean I was a bit mortified to release all my gtalk discussions was logged within gmail. I mean all your most intimate conversations are logged if someone broke into this feature then that would cause all kinds of brown stuff to hit the fans. Can we trust yahoo or hotmail in the same vein?

Referring to the mobuzz video once more, amazon and ebay appear to store information about you and that's become more apparent with the fact that you cannot close your accounts with them....

So in summary, be careful what you reveal about yourself...
BE CAREFUL WHAT YOU SAY!!!

getopt revisited

Well been tidying some scripts that will generate a list of mp3s and modify them as need be so that that they are wooshy-friendly. As much as you should write modules, there's nothing like getting a quick 10-line script that uses a module.

Anyhow perl's getopt modules have got a little complicated over time. i.e. there are 7 or 8 of them available and they can get confusing. Namely, can mix up getopt::std and getopt::simple quite easily. The fact that getopt::simple is actually a wrapper for getopt::long makes it worse. So in actual fact getopt::simple is not all that simple at all.

I would use getopt::std if you want something quickly done with some options albeit in the form of one dash / one letter. Something a bit more complicated go for getopt::long. Forget the rest...

Links:

• Getopt:*


• McGill's Getopts

Google Keywords: perl, getopt, getopts

Sample Perl Code:
#!/usr/bin/perl

# The Std version of Getopt allows for the processing of single
# character switches
use Getopt::Std;

# The hash %options is initialized and will store the switch as
# the key and the switch argument as the value
my %options=();

# the "\" is simply a pointer to the %options hash
# "a" is treated like a flag while "b" needs an argument after
# the switch is called indicated by the ":"
getopts("ab:",\%options);

# "defined" is a perl function that will return a boolean depending
# on if the variable in question has been previously defined
if (defined $options{a}) {
print "You have selected the option -a and its value is \"$options{a}\"\n";
}

# This if statement will return the same thing as the above example
# using the perl function "defined"
if ($options{b}) {
print "You have selected the option -b and its value is \"$options{b}\"\n";
}

Google is your friend - You can find anything, well almost anything

As a friend once said to me, 'Google is your friend' and you can find anything.
Some searches are easy, some are hard and some are downright frustrating. Looking for something popular, e.g. perl, mysql or david hasselhoff, it's very easy as what you are looking for is usually at the top of the list and on the first page of Google.

Looking for something in particular and generally not as well known is a little harder as what you are looking for is unlikely to be at the top. Take 'Jo King' for example. There are probably more popular people and organisations with that name. Naturally, you would enter some additional points to identify your 'Jo King'. Even then you still have to be even more specific. That's the frustrating and time-consuming part.

Just as frustrating is when you can't find any details about the subject or the exact context.
e.g. you are searching for an example of how to do a perl build...

Conversely, I am trying to get my name out from the Google search engine as much as I can but
unfortunately my name is tarnished and a few results pop up albeit it's old stuff. A few months ago, I discovered my name and address listed on alexa due to the fact that a previous domain that I let expire still had my details even though it was bought out by someone else. It was a bit of a mission getting a contact to erase these details. I remember I had to change these details in two places as well.

Anyone doesn't have their name found in Google is doing a great job. I have pay due to my ex. I can't find anything on her!

Anyways you can find a lot of stuff about companies. One thing I am getting good at is finding ip address ranges of companies just by name/location. The first thing to do is find a domain name. Most companies will have a site. The next thing to do is to whois is on it. You will probably find the domain is hosted. However, it is likely that the company if they are connected to the
Internet will have other services like mail services, proxies, etc. All these services should connect somewhere to the Internet and like I say, 'like Shakira's hips, the logs don't lie'.
Logs can be found by searching Google. So do a random search on the domain name found plus a keyword that would trigger log-files being found (e.g. log, vpn...)
Once you have a sub-domain, do a lookup and whois to get their range and see if they own it.