On March 10th the exploit was added to the MetaSploit Framework, and instructions on how to use the exploit immediately being spread on many hacker boards. It was first seen on the replacement for Milw0rm, XpltDB: Exploit-DB.com.

You can find some more info at Gary Warner’s blog (from where I got the news) or at Rec-Sec.com.

The Microsoft Bulletin is here:

ms10-018.

Some of the issues addressed include:

CVE-2010-0267 – Uninitialized Memory Corruption Vulnerability
CVE-2010-0488 – Post Encoding Information Disclosure Vulnerability
CVE-2010-0489 – Race Condition Memory Corruption Vulnerability
CVE-2010-0490 – Uninitialized Memory Corruption Vulnerability
CVE-2010-0491 – HTML Object Memory Corruption Vulnerability
CVE-2010-0492 – HTML Object Memory Corruption Vulnerability
CVE-2010-0494 – HTML Element Cross-Domain Vulnerability
CVE-2010-0805 – Memory Corruption Vulnerability
CVE-2010-0806 – Uninitialized Memory Corruption Vulnerability
CVE-2010-0807 – HTML Rendering Memory Corruption Vulnerability

The Energizer DUO, a USB-powered battery recharger, was confirmed on Friday by Energizer Holdings to contain malicious code. According to this Energizer Press Release, they were notified by the CERT Coordination Center that the Windows software that ships with their DUO Charger “contains a vulnerability”.

Energizer has discontinued sale of this product and has removed the site to download the software. In addition, the company is directing consumers that downloaded the Windows version of the software to uninstall or otherwise remove the software from your computer. This will eliminate the vulnerability. In addition CERT and Energizer recommend that users remove a file that may remain after the software has been removed. The file name is Arucer.dll, which can be found in the Window system32 directory.

Energizer is currently working with both CERT and U.S. government officials to understand how the code was inserted in the software. Additional technical information can be found at http://www.kb.cert.org/vuls/id/154421.

Apparently Unix tutorial author Ed Schaller was the one who reported the malware to US-CERT. US-CERT then asked Symantec to evaluate the malware, which was written up by Liam Murchu in the Symantec Security Response Blog.

According to the US-CERT article, Arucer.dll is launched in the traditional way, with a “rundll32″ call from the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key.

The hashes for the malware file, Arucer.dll, which is 28,672 bytes in size, are:

MD5: 1070be3e60a1868d2cd62fc90d76c861
SHA1: d102b1d2538d8771be85403272e5a22a4b3f81ad

US-CERT indicates that the file properties indicate the file was written on a Chinese computer. (Language set = 0×0804)

The detection on that malware as of last night is still pretty sketchy according to VirusTotal. In this VirusTotal Report for Arucer.dll it showed that only 9 of 42 anti-virus products would have triggered on this malware. Microsoft, Sunbelt, and Symantec are now detecting it as “Arugizer” (or Arurizer in Microsoft’s case). F-secure, Fortinet, McAfee, and Sophos are also detecting.

Although Symantec’s Liam indicates they were able to download the software from the Energizer website on Friday, all links we could find for the downloadable package, formerly at:
hxxp://www.energizer.com/usbcharger/download/UsbCharger_setup_V1_1_1.exe
now redirect to an Energizer homepage.

If you REALLY want to trojan yourself, perhaps your best bet is to buy one of these systems from a third party, such as Amazon.com who still offers Energizer Charger USB Duo for $16.99.

Symantec reports that after infection, the machine begins to listen on port 7777. Valid commands which can be sent to that port are in the form of XOR’ed CLSIDs, with the list being:

{E2AC5089-3820-43fe-8A4D-A7028FAD8C28}
{F6C43E1A-1551-4000-A483-C361969AEC41}
{EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}
{783EACBF-EF8B-498e-A059-F0B5BD12641E}
{0174D2FC-7CB6-4a22-87C7-7BB72A32F19F}
{98D958FC-D0A2-4f1c-B841-232AB357E7C8}
{4F4F0D88-E715-4b1f-B311-61E530C2C8FC}
{384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}
{8AF1C164-EBD6-4b2b-BC1F-64674E98A710}

US-CERT has released Snort rules for these various detects, which it has named:

Arucer Command Execution
Arucer DIR Listing
Arucer WRITE FILE command
Arucer READ FILE command
Arucer NOP command
Arucer FIND FILE command
Arucer YES command
Arucer ADD RUN ONCE command
Arucer DEL FILE command

which seems to indicate a wide-range of possibilities from this trojan.

Gregg Keizer wrote a nice piece for ComputerWorld on this topic: Energizer Bunny’s software infects PCs, which reminds us that in 2007 Seagate shipped trojaned drives, and Apple shipped some trojaned iPods, and that in 2008 Best Buy sold Digital Picture frames with attack code in them.

One of the elements that are available to Mac developers are called “sheets”. In particular, sheets are those things that slide out of the title bar of a window. In fact, a sheet is just a NSPanel that is being attached to the application window at runtime. You can see a sheet in action when actually opening or saving a file.

What is the difference between a sheet that slides out and a modal window that pops up? Well, there are some serious considerations. You may also want to check out this tutorial by Erik. J. Barzeski on CocoaDevCentral which I used as a informational and textual base for this post. There you can find a little bit more about modal windows which I don’t want to explain right here in depth.

In short, sheets are a very stylish way to let the user know that a certain action needs to be done or that there is something wrong and that need to be fixed.

A Simple Example

Create a new Cocoa application project in XCode. Choose the Classes folder from the “Groups & Files” list on the left and add a new Cocoa class. Rename the file to “SheetController.m” and check the box right below where you type in the file name so XCode will generate both, the .h and .m file.

For a simple example application you don’t need to worry about any actions or outlets for any of the various controls. Instead, only two outlets are needed – one to the sheet and one to the main application window. Additionally add two actions – one for the window to call the sheet and one for the sheet to close.

Edit your header file to look like this:

#import <Cocoa/Cocoa.h>

@interface SheetController : NSWindowController
{
   IBOutlet id mainWindow;
   IBOutlet id panel;
}

- (IBAction)add:(id)sender;
- (IBAction)complete:(id)sender;
- (IBAction)cancelOperation:(id)sender;

@end

If you like to work from within Interface Builder you can simply subclass NSWindowController and add the appropriate outlets and actions and generate the files.

Otherwise, double-click MainMenu.xib in your project’s Resources folder to launch Interface Builder and drag your “SheetController.h” file into the MainMenu.xib window. Interface Builder will then parse the header and automatically add the needed object.

Sheets are of type NSPanel typically. Create a new panel and set it’s attributes like this:

Give the panel a Title and set the attributes to your liking. You can safely disable close, resize and minimize as you don’t need them anyway. If you want the panel to be textured you should enable this option as well as leaving the shadow option enabled.

Be sure that you disable “visible at launch”, otherwise the panel would be visible when the application start and that not what we want here.

Sheets can be of type NSWindow, too. You would, in any case, set the same settings for the window as for the panel. In this example everything was prepared using Interface Builder but you could also create everything from code.

Go ahead and add some controls to the panel and be sure to add a button for closing the sheet again – typically named “Done”.

Next we’ll connect the outlets and actions and finally write the code to get the sheet running fine.

Connect (control-drag) from each of the buttons to your controller and attach them to the correct action. Likewise, control-drag from your controller to each of the windows (either in the MainMenu.xib window or to the actual on-screen layout representation).

Save your MainMenu.xib file and quit Interface Builder. It’s time to write some code.

Edit your code file to look like this:

#import "SheetController.h"

@implementation SheetController

- (IBAction)add:(id)sender
{
    [NSApp beginSheet:panel modalForWindow:mainWindow modalDelegate:self
    didEndSelector:NULL contextInfo:nil];
}

- (IBAction)complete:(id)sender
{
    [panel orderOut:nil];
    [NSApp endSheet:panel];
}

- (IBAction)cancelOperation:(id)sender
{
    [panel orderOut:nil];
    [NSApp endSheet:panel];
}

@end

So this is how a sheet would basically look like. If you’ve never seen NSApp before, it’s essentially a pointer to your application object. The next two portions of the method, beginSheet: and modalForWindow: tell your application which window/panel is the sheet, and which window to which it should attach the sheet.

I haven’t defined a delegate, so the sheet can act as its own delegate. The didEndSelector: and contextInfo: pieces are not necessary for simple sheets, so we pass them NULL and nil.

To get rid of the sheet, tell it to orderOut: (go away) and then tell the application to endSheet: – note that this is like a bookend to beginSheet:. And that’s literally all we’ve got to do. Of course, if we wanted to read in the changes made in the sheet, we’d need outlets to all of the controls, buttons, text fields, etc.

That’s it! Save, Build, Run. Click the button. Watch the sheet appear.

Basically if you often do any changes to your CSS the old version of the file will normally be served to your visitors as the cache expiration header is set to a far future time.

To remedy this a parameter needs to be added to the CSS file URL that will make it distinct every time you change it. Best way to do it is by using the timestamp of the file.

<style type="text/css" media="screen">
   @import url(<?php echo bloginfo('stylesheet_url'). '?' .
filemtime(get_stylesheet_directory() . '/style.css'); ?>);
</style>

For example here is how my CSS URL looks like:

<style type="text/css" media="screen">
   @import url(http://blog.datenkompost.de/wp-content/themes/barecity_1.5/
style.css?1266235697);
</style>

Found in the abyss: glitch13.com via archive.org.

Tuesday, August 2nd, 2005 @ 02:28 pm
Posted By Brent

Last week my little brother had a bit of a delimma, one that he knew could only be solved by yours truly. After a quick diagnosis it was quite apparent that this man was having severe video game withdrawal and needed to pwn some n00bs as soon as possible. I quickly instructed him that Half Life 2 bundled with Counter Strike: Source was his best bet for relieving himself of this ailment, so forty dollars and two hours later he’s at his house installing Half Life 2. Unfortunately, he couldn’t get Steam to connect and authenticate his install, so I came over to help troubleshoot and lend moral support. So begins the events that would lead up to the design and construction of The Ghettotenna.

First thing I noticed was that he could browse the web just fine, it was only Steam that couldn’t get out. Actually the first thing I noticed was that his computer was littered with spyware, but that’s a different post all together. Second thing I noticed was that his wifi connection was on the rather Piss-Poor end of the spectrum. Thinking the signal strength may be the cause for this sketchy behavior, I set out to boost his reception to see if it would solve the problem.

Luckily, he was using one those USB wifi fobs on a cord for his wifi adaptor. Being the genius I am, and having read quite a bit about people boosting wifi signals with chinese wok utensils and Pringles cans, I knew I could whip up a ghetto solution in no time flat. Here is where we enter the meat of this post and the explanation of that weird ass piece of crap up there.

I start calling out to my brother for materials: Scissors, check. Shoe Box, check. Aluminum foil, check. Tape. Tape. Tape? No go on the tape so I quickly raid his closet and find a pristine box of Band-Aids. I won’t let this mission be grounded by a simple missing ingredient, so I throw all my materials (and the Band-Aids) together in a pile and get to work.

First, I take the lid to the shoe box and cut the angled lip off the edges so that it’s just a flat piece of cardboard a little larger than a standard sheet of paper. Next I wrap said sheet of cardboard multiple times in aluminum foil and tape Band-Aid it in place. Now that I have my signal reflecting surface, I roll in into a half-circle and tape Band-Aid one of the strips I cut off in step one across the opening to make it retain its shape. Once all of this was assembled I taped Band-Aided the adaptor to the shape-retaining strip of cardboard so that it would be in the dead center of the semi circle.

Here’s a diagram of where my thought processes were going with this. The black represents the semi-circular reflector, the grey spot is the adaptor, and the green represents magic wifi signals that I can’t actually prove exist. Or bounce off aluminum. Or remotely resemble crappy green dotted lines. Click on it to get a larger picture of it. Yeah, I know. Drink in its beauty.

With everything together, I plugged it in, pointed the open end of it in the general direction of the access point, and BAM! His signal shot from “Low” to hovering between “Very Good” and “Excellent”(a two to three bar jump on a five bar scale). Once my brother’s roommate witnessed this, he sprang into action, his movements a blur of Band-Aids and aluminum foil.

This story is not without heartbreak, unfortunately. As anyone well versed in wifi knows, a low signal, as long as it is steady and doesn’t fluctuate, is perfectly fine and doesn’t interfere with connectivity at all. He still couldn’t get Steam to connect, and it wasn’t until I got his neighbor’s router login info did I realize what the problem was. Someone had filtered a handful of ports that, for reasons unknown, included the ports that Steam uses to communicate on. So our story ends on a high note, our hero is rewarded with a higher wifi signal and unadulterated n00b pwnage.

PS. For anyone interested, Jason modeled and rendered the beautiful image up there in Blender, an open source 3D Studio Max alternative. Here are examples of the source materials I gave him to base his model off of:

I feel sorry for all those people that threw thousands down the toilet for an engineering degree. Some people are just born with it, holmes.

The Objective-C runtime lets you modify the mappings from a selector (method name) to an implementation (the method code itself). This allows you to “patch” methods in code you don’t have the source to (AppKit, FoundationKit, etc).

Unlike creating a category method with the same name as the original method (effectively replacing the original method), MethodSwizzling lets your replacement method make use of the original method, almost like subclassing.

This is best used in cases where a single method needs substitution or extension but if you need to modify many behaviors of a class, you may be better off using ClassPosing.

But I found this article way more informative and that, in turn, led my way to the SIMBL Framework which I can greatly recommend.

After thinking about this a couple of minutes you’ll also find a huge amount of possibilities and hack-arounds. But seriously, there are some things to consider like this.

To make it short, Kevin Ballards code did fail in the 10.5 Mac OS X release and had to be rewritten. In fact, many code had to be rewritten which somehow led to JRSwizzle, a very good implementation that runs under Leopard and Snow Leopard.

So either using SIMBL or MethodSwizzling (JRSwizzle in particular) does the trick. It’s absolutely obvious to be very careful when swizzling methods or creating plugins via SIMBL – but the possibilities appear very clear and vast to me.

Another great possibility to hack around with Cocoa is F-Script by Philippe Mougin and F-ScriptAnywhere by Ken Ferry. Two very essential tools when hacking just for fun or seriously developing Cocoa applications.

Quick Chess Board uses small fragments of Viper007Bond’s Templatedia plugin.

Download details:

Filename: quickchessboard.zip
File size: 55.188 Bytes
Operating system: N/A
Additional requirements: Wordpress 2.7+
MD5: 9f4b646d071358ff1cd2da59290379d2

Changes:

Quick Chess Board 1.0.0
* Initial release

Example:

Kings Gambit

The price of a typical gadget reflects two factors: the cost of making it and the price its inventor is charging for the intellectual property in it. Often the second can be many times the first (as in the case of an Intel processor chip, for example, which costs just a few dollars to make but can sell for hundreds of dollars).

But if you don’t charge for intellectual property, gadgets can get a lot cheaper, and potentially reach a much larger market. That’s the philosophy behind “open source hardware”. You give away all the intellectual property (schematics, PCB files, firmware, software, assembly instructions, etc.) but sell the completed units, charging only a set markup on the cost of the hardware itself, which you disclose.

But what’s the right markup that leads to the lowest cost for consumers and still makes money for you? With the help of some open source hardware experts (Lenore Edman, Limor Fried and Phillip Torrone), Chris Anderson found the business model he settled on.

The Forty Percent Model

This model is based on a simple rule: transparency about costs and a choice between paying us to make the product or doing it yourself.

The basic process is that we list all the components and other costs of the product and links to where you can buy them yourself, along with instructions on how to put them together. If you want to do it yourself, or perhaps already have some of the parts and don’t need ours, go for it!

But if you want us to make it for you (guaranteed to work), because it’s easier, safer, quicker, etc, we would charge you a 66% markup, which give us 40% profit.

(Aside: People often confuse markup and margin. Think of it this way: if a product costs $1 and you mark it up to $1.66, you have a 40% profit margin. $0.66 is 40% of $1.66.)

Let’s say you want to make your own company and compete with us, charging a lower markup to undercut us in price. Excellent—consumers win! All of our source code and PCB/schematic files are open source and licensed to allow commercial use, and if someone else is making the products, it costs us nothing. If you can make it cheaper or better than us, that’s great—the market will grow and we’ll have more people using our stuff. The only requirement of the license is that you credit us for the design and link back to us.

The Third-Party Catch

Okay, the above is a great model when you’re just selling from your own website. But what if you want your product sold through third-party retailers, who can collectively have far greater reach than any one company? Then the economics get a little more complicated because you need two 40% profit margins, one for you and one for the retailer.

So the markups now go like this: $1 –>$1.66 –>$2.76. Furthermore, you must avoid “channel conflict” by undercutting your retail partners, so you need to charge pretty much the same price everywhere, including your own site. So your $1.66 product must now be priced at $2.76, which is a 64% profit margin for direct sales.

We thought that was too high and would feel like a ripoff when we disclosed all the costs to our customers. What to do?

The answer came in limiting our pricing transparency—we wouldn’t disclose our volume discounts. Because we buy in bulk, our costs are actually much lower than the single-unit costs that we post and would be available to a DIYer. So it’s not total transparency, only as much transparency as we can practically offer given the fact that those discounts change from order to order and suppliers don’t want the exact size of those discounts made public.

So we’ll post single-unit prices available to all, even though we actually pay less for most items. We can’t disclose how much less, but it should average about to 30-40%.

The final model: Semi-Transparent Pricing

1. Disclose the prices for components in single-unit quantities and link to sources people can buy from, but do not list our volume discount prices.

2. Set our direct sales price as the sum of the single-unit prices (call that “apparent cost”) plus 66%. However, our actual costs are lower due to our volume discounts, so our actual margin is higher. The point, however, remains: we will only charge 66% more than it would cost you to DIY.

3. Our wholesale price is the apparent cost, allowing retailers to add the 66% markup for themselves. Our own profit comes from the difference between the apparent cost and whatever our real cost is with volume discounts. The harder we push on those discounts, the more money we make.

Thanks to blogwart for all the testing.

Download details:

Filename: meh.zip
File size: 14.805 Bytes
Operating system: Microsoft Windows 2000, XP & Vista
Additional requirements: Microsoft .NET Framework 2.0 or above
MD5: 0b8a21d5093784c398a611e62f3fb4ac

Changes:

Meh 1.0.0.3
* Initial release

But as the match progressed I found it very boring and way too linear and somehow too static. So I thought about modifications and such, but always ended up changing to many things to call it just a modification. The idea was born.

With all the things in mind I asked some friends if they would like to assist in testing and further developing the game. Fortunately they all agreed, so we collected all our ideas and tried to measure the efforts to get things done.

Here are some of the project goals and features:

• Extend diplomatics
• Tactically helpful and rich detailed map
• Keep the game leader role and slightly giving it more permissions
• More units like: Infantry, Artillery/Tanks, Submarines, Transporters etc.
• Units can have different troop strength
• Implement random events (like card stacks)
• A piece of software that helps managing the game data
• Modified commands and rule-sets

I am currently fiddling the game rules and the world map, as well as all the units, participating nations and such. Most of the things that we’re already written are in German language, so it will take a while till everything is translated.