Evilcoder.org

Hmm! Today i noticed in my webserver logs that I got an increase in the XML_RPC_PHP Remote Execution vulnerability. After a little search (yes ofcourse little, it’s my job to know this and where to look, in this case on dshield.org), i found out that dshield.org reported a new worm that is making use of vulnerabilities within XML_RPC(Pear and PHP extension). 

What does that have to do with me? why do you write about it? Well basically, if my webserver gets hit by this, and dshield puts out an alert, then guess what you will be affected as well. You are vulnerable if you have a version of XML_RPC which is not up to date yet.

Dshield reports the following(http://isc.sans.org/diary.php?storyid=829):

19518 - phpAdsNew / phpPgAds < 2.0.6 Multiple Vulnerabilities
18600 - Serendipity XML-RPC for PHP Remote Code Injection Vulnerability
18601 - WordPress < 1.5.1.2 Multiple Vulnerabilities
18640 - Drupal XML-RPC for PHP Remote Code Injection Vulnerability
16189 - AWStats configdir parameter arbitrary cmd exec

are being slammed in the wild. As you can see these are all popular applications used on the world wide internet. To see what you can do about it, please read the VuXML pages of FreeBSD. They have a very well documented item about it and also give references to the solution, the actual problem and such. You can find it here: http://www.vuxml.org/freebsd/e65ad1bf-0d8b-11da-90d0-00304823c0d3.html

So do everybody a favor and patch yourself for this. Thanks!
 

Continue reading »

written by Remko

WOEHOE, was the first thing i said when i left the karttrack. You will get a very big load of energy if you are karting with high speed (well it feels like high speed) and you need to calm down a bit afterwards. How did it went? Well to be honest, the first heat was the only i lost in every possible way. People passed me a couple(!) of times, leaving me wondering why everyone could pass me while i was hitting the gas 100% all the time. With my weight (60kg) i was the one that should have had a lot of speed, though all my rounds were slow and i got a blue flag every possible way. So after 14 rounds(!) the marshalls gave me a red flag (why was the thing i asked at that moment). With all the adreline in my body it was difficult to get up, but in the meanwhile the marshall was jumping on my karttires, and why? Well the left rear tire was -dead-, i understood instantly why everybody could pass me so easily. I got a different kart and drove like a madman (well sortoff, i got used to the other kart and this one actually responded to the steering and gas peddle). I had 2 collisions with the new kart, causing my brother to slam into me 2 times! In the final lap i had my fastest one which was significantly faster then the previous rounds in total! So that was the first heat.

The second heat was an hour later because of an other party that was driving with 2 girls driving at 10km/hr. They could not even get up the track because of their slow speed. A bit sad because the driving was very bad for everyone (they slammed into eachother and hit the tires a LOT). Our second heat was at 23.00 and i got kart "30" which was different then the 2 karts i had before. I started at the 4th or 5th place and i flew over the track. I took all corners very sharp and i enjoyed much much more then the previous heat. Simply because i could go and pass people (and darn, they tried catching me as well). Though i didn’t loose my people in front of me, i drove near Rik and my brother for ages and when i made a steering error i lost them in the 4 meter series (They were at 10 meter at that moment). I finished 4th (out of which was a major improvement. If you see my laptimes you will see the difference. First heat around 35seconds per round, secondheat 28seconds per round, which is a "slight" difference

Perhaps we will do this again next month, after my bluespots and backpain is gone again (well it does not hurt that much but you feel it in the back, side and knee) .

Yesterday before i left my causine called me. "remko my msn is broken, can you help me please?" Well i tried from remote but it seemed that i was unable to. I asked her to give me a yell tommorrow (today) if the problem still occured. and ofcourse it still occured so i went to see them all. I fixed MSN (firewalling issue) and tried reparing the DVD drive which ejected the tray all the time. Sad because it was an hardware issue but well. I talked with my aunt for a little and we drunk a couple of coffee before i decided to head back home.

Now i am in my pyjama again (my throat hurts a bit) and i am watching Formula A1 (country racing). I will beat my PCTV Pro card first, because there seems to be an problem. The tv works great, but the sound is 4 seconds faster then the movie screen itself. It seems that i am unable to solve it (tried a couple of things already) so i am a bit annoyed by that since "CRASH" and when i look the car isn’t even crashed yet.. strange and such. Ah well, tonight some FreeBSD work and early to bed to get rid of the throat pain.

Continue reading »

written by Remko

Tonight i will go karting with my brother, father, Rik, some friends of my brother and ow yeah myself. Rik is taking along his girlfriend who will support him (he needs the support, because ofcourse i will get passed him and i will show him a couple of corners). Sadly everyone says that they will beat me and i tell everyone that i will beat them, so lets have a look at what happends tonight. This is the first time since a couple of years (last time i Karted was with my boss) and i hope that i am still able to drive hard and good :D.

More information tonight or tommorrow…

Continue reading »

written by Remko

Ew, people that are reading the topic are thinking: Remko? Shopping? Huh? Did i miss something?

Well, i do not mind shopping actually; no really i do not mind! Denise asked whether it was a good idea to go shopping with her and Luca. Well? Eh Ofcourse! Denise needed some clothes and some new boots. She found some new clothes but the boots were a bit more difficult :). I saw a LOT of boots, never saw that many boots I was pretty amazed to see that the shop with that many boots did not have the right ones for her. Ah well, perhaps because when I see shoes that I need i just buy them and not wonder around in a big shop. Though it was pretty interesting to see :-). After that we went shopping for some clothes for Denise and Luca and I went to watch a movie (at the shop) and play around a bit. I have to admit that Luca was very lovely :-).

After a while his mother came back and we went on walking around and shopping a bit. We ate a hot (stroopwafel) which was really nice :-). So after a period of walking around, shopping around we decided to head back to home. Denise walked into a college-student and her boyfriend and she chatted a bit with them. Luca and i went to see some cars. We drove home (Which went better then i expected since it was during the most busy part of the day) and i enjoyed a cup of soup at Denise’s place.

So in short i had a great day and I enjoyed shopping with Denise and Luca

Continue reading »

written by Remko

Yesterday I upgraded to FreeBSD 6.0 (Which works like a charm, i think this is a real good release! You should try it :-)). And after that i decided to upgrade php, which was a very stupid call. From experience it is known that upgrading packages quickly after the release means getting a lot of troubles on your head.

So ofcourse PHP broke down and disabled apache2+mod_rewrite functionality (which is used on this website and a lot of other sites that I host); causing all major sites to mallfunction. Really great to break your setup late in the evening after doing an rather big upgrade..

Be aware; do not insta-update your packages, you might get hurt

Continue reading »

written by Remko

As people might know, i have a mirror of the www.honeynet.org project at www.honeynet.nl. Recently Lance Spitzner and I reviewed some of the mirrors and since it takes a little time I thought it would be good if there is an automated script available.

Currently the script checks what the last modification time of the index file is (of the official server first) and then scans the other mirrors to see their last modification time. They should be the same after about an week (not sure how we can check that though).

And ofcourse since my script is BSD licensed; i attached it below (click on the read more link).

If you have suggestions on how to make the script better. Please let me know. I will also put this script in the download section and make a reference to an text file so that you can use it.

Continue reading »

written by Remko