Confessions of a G33k

for my syndication readers

The main blog url and syndication feeds have changed to cleverhack.com. Change your links accordingly.

Iraq war photos

I found this site featuring photos apparently taken by a German photojournalist during the early part of the Iraq war via blogsnob. Nevermind your politics, go look now.

The Mac is a Harsh Mistress

I was clickity, clicking along in my daily blog reading and found this gem...The Mac is a harsh mistress

Microsoft, ladies and gentlemen, is a cheap whore. She lives on the fringes of the law, but there�s no getting rid of her because she fulfils a certain need in our society. People want what she is selling.
There�s a certain painted-on mystique to her, of course. We�ve all been indoctrinated with the propaganda, the hooker with the heart of gold, the disturbingly wide-mouthed Pretty Woman. When you find her, though, beneath the paint she�s really quite plain. You take what you need from her, but reluctantly and because you have no alternative. You get what you want, but she is almost peripheral to the act.

Apple is a lover.

From the moment you meet her, you know that she wants you to be happy. She wants to be a part of your life, and you can�t help but be drawn into wanting to be a part of hers. She is beautiful and elegant in ways that the layers of paint on the Microsoft street-walker can only desperately try to imitate.

RIAA sues single mom making $21K/yr

Good going guys.

Here's a question to be posed....Is it fair to sue a 41 year old single Mom who ostensibly had a computer in her house to encourage her daughter's education, but who herself could not use that computer?

I agree

Michelle Malkin, on the media embrace of a certain two female bloggers.

But give The Washington Post two vain, young, trash-mouthed skanks who couldn't care less about what their parents think of their sex-drenched infamy, and the newspaper can't wait to help make them full-fledged members of the media elite.

As a wise person once told me, "Anyone can talk dirty, real women have class."

Live capture comment spammer logs

Yesterday afternoon I went to take a quick look at my logs, only to notice that a comment spammer was hitting me in real time. When I realized what was occurring, I immediately went to ban the offending IPs as they appeared. Here's the logs, and I want to point out a few things to y'all.

First, take a look at the HTTP error codes.
HTTP 403 - are IP's I've banned. It appears that some of the IPs that hit me on Tuesday were ones that were used in previous comment spamming attacks. This means that the comment spammers probably only have a set amount of cracked machines that they can use. This also means that IP banning after being attacked will help alleviate the problem.
HTTP 405 - method not allowed. I've throttled MT to only accept comments after a certain amount of time. And the idiot who created this script apparently was unaware of this limitation, thusly his comments are being rejected.

Host: 64.124.222.172 [Attack script on webserver - IP WHOIS resolves to above.net]
Url: /blog/archives/001202.html
Http Code : 403
Date: May 25 16:18:53
Http Version: HTTP/1.1"
Size in Bytes: 1010

Host: 24.97.4.148
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 16:01:19
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 200.202.216.162
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 16:01:18
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 66.186.173.42
Url: /blog/archives/001202.html
Http Code : 403
Date: May 25 16:01:16
Http Version: HTTP/1.0"
Size in Bytes: 998
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 69.10.70.130
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 16:01:16
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 64.124.222.172 [Attack script]
Url: /blog/archives/001202.html
Http Code : 403
Date: May 25 16:01:15
Http Version: HTTP/1.1"
Size in Bytes: 1010

Host: 219.117.212.87
Url: /blog/archives/001202.html
Http Code : 200
Date: May 25 16:01:15
Http Version: HTTP/1.0"
Size in Bytes: 8602
Referer: -
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 213.171.57.162 [Surprise, this IP is from .ru]
Url: /blog/styles-site.css
Http Code : 200
Date: May 25 16:00:45
Http Version: HTTP/1.1"
Size in Bytes: 6026
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) [Looks like a legit browser.]

Host: 200.180.247.230
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:57:19
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 198.26.130.36
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:57:17
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 61.120.94.198
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:57:16
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 80.82.139.21
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:57:14
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 203.22.206.51
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:57:02
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 212.25.77.189
Url: /blog/archives/001202.html
Http Code : 403
Date: May 25 15:57:00
Http Version: HTTP/1.0"
Size in Bytes: 998
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 203.122.54.129
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:56:58
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 80.49.24.15
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:56:55
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 63.171.110.188
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:56:48
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

Host: 200.163.234.2
Url: /blog/archives/001202.html
Http Code : 405
Date: May 25 15:56:36
Http Version: HTTP/1.0"
Size in Bytes: 318
Referer: http://www.cleverhack.com/blog/archives/001202.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

I'm around

Nick Berg emails from Iraq

The Philadelphia Inquirer (reg. required for site access) has published some of the emails sent from Nick Berg in Iraq.

I am going to trackback to OTB since James has a latest news roundup there.

wifi, free as in beer?

Outside the Beltway linked to this post by Phil Libin advocating folks to not secure their wifi access points because "it's too hard" for the average person to set up their WAP securely. I wrote a quickie response at OTB about some concerns, and I also found this article at Security Focus covering the legal aspects of wifi use.

As with any shared network, there are a host of issues to consider when providing access to others. What if the person sharing your network downloads something illegal? Are you keeping logs tracking who is who? If you are unable to secure a WAP, who is to say that you've properly secured your own computers? What about if your provider shuts you down for excess bandwith usage?

In other words, if you are thinking of setting up an open WAP, think long and hard about the implications, both technical and legal. While it's great to talk about ubiquitious wifi connectivity, we're still in a tangled web of undefined legal risks. If nothing else, you're putting yourself at the mercy of others who may be able to take advantage of you.

ATTN: Floridians

Be on the lookout for Giant African Land Snails!

From this hobbyist page about Giant African Land Snails.

scottrichter422@yahoo.com

Slashdot had a thread this morning about infamous spammer Scott Richter and his OptInRealBig organization winning a temporary restraining order against SpamCop. In fact, Scott Richter is such an infamous spammer that this blog has mentioned him before.

What made my morning, however, was buried in the Slashdot thread. Apparently, the Daily Show had interviewed Scott "High Volume Email Deployer" Richter at some point and the resulting video is hilarious. And his email address was included in the end.

I think they need some girlfriends

Host: 12.159.150.10
Url: /ccbill/secure/ccbill.log
Http Code : 404

Date: May 11 15:05:49
Http Version: HTTP/1.0"
Size in Bytes: 624

Referer: -
Agent: -

This is an attempt at trying to download a ccbill.log file, which is apparently part of a streaming video management package (i.e. for those subscription only Adult sites) called ccbill. What's scary is that I merely typed in ccbill.log on google and the first result was a page which describes how to use the .log file to grab password information.

There really is a Googleblog

Remember the hubbub that erupted when someone found a blank page at www.google.com/blog? Well, it seems as though Evan Williams ne� Blogger now Google fame really did convince someone at Google to create a Googleblog.

Some security concerns about Bluetooth...

Bluetooth, that wireless networking technology which allows computers, mobile phones and other devices to communicate apparently has some security concerns, namely bluesnarfing and bluejacking. And don't forget that British pastime of toothing.

Not that I would know, even though I own a spiffy PowerBook running OS X Panther, my wireless provider does not offer Bluetooth ready phones.

Spammers doing it by hand....

Host: 203.115.12.41
Url: /blog/archives/001245.html
Http Code : 200

Date: May 10 19:42:06
Http Version: HTTP/1.0"
Size in Bytes: 10375

Referer: http://www.cleverhack.com/blog/archives/001245.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

------------------------------------------------------------------------------

Host: 64.124.222.172
Url: /blog/archives/001245.html
Http Code : 200

Date: May 10 19:41:49
Http Version: HTTP/1.1"
Size in Bytes: 8505

-----------------------------------------------------------------------------

Host: 217.117.14.167
Url: /blog/archives/001258.html
Http Code : 200

Date: May 10 19:41:45
Http Version: HTTP/1.0"
Size in Bytes: 9985

Referer: http://www.cleverhack.com/blog/archives/001258.html
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

What you see above are three entries from my logs. Two are comment spams and the middle entry, sans user agent info, is what I think is a probe. (My "recent visitors listing" only shows the last page someone requested.) You see, yesterday, I renamed my mt-comments.cgi file to something more prosaic in hopes of killing off the automated comment spam. As you can see, that move lasted all of 24 hours, with the spammers apparently probing (the WHOIS for the probe machine) to find out the new filename.

Anyway, renaming mt-comments.cgi doesn't work. And aside from IP banning the client machines posting the comment, I can't think of anything more creative to do at the moment.