Berkeley CSUA MOTD:Entry 33794
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2024/11/23 [General] UID:1000 Activity:popular
11/23   

2004/9/28-29 [Computer/SW/Virus, Computer/SW/OS/Windows, Computer/SW/OS] UID:33794 Activity:nil
9/28    First JPEG virus spotted in the wild, posted to:
        alt.binaries.multimedia.transexuals and
        alt.binaries.erotica.beanie-babies among others.
        If you and your kin haven't patched your systems, get on it!
        http://www.easynews.com/virus.txt
        \_ Worth mentioning that even if you patch your OS, any number of
           programs may include their own version of the GDI+ library, and thus
           be vulnerable.
2024/11/23 [General] UID:1000 Activity:popular
11/23   

You may also be interested in these entries...
2011/11/8-30 [Computer/SW/Security, Computer/SW/OS/Windows] UID:54218 Activity:nil
11/8    ObM$Sucks
        http://technet.microsoft.com/en-us/security/bulletin/ms11-083
        \_ How is this different from the hundreds of other M$ security
           vulnerabilities that people have been finding?
           \_ "The vulnerability could allow remote code execution if an
               attacker sends a continuous flow of specially crafted UDP
	...
2011/3/31-4/20 [Health/Disease/AIDS, Health/Disease/General, Computer/SW/Virus] UID:54067 Activity:nil
3/21    what are these virus phages? Can they be repurposed?
        \_ are you <b>insane?</b> you really want to start messing with
           recombinant <ul>rna</ul> crap when we don't even understand
           the normal virus lifecycle?
	...
2009/5/7-14 [Computer/HW/Laptop, Computer/SW/Virus, Computer/SW/OS/OsX] UID:52968 Activity:nil
5/7     Help, I think something's wrong with my network setting. I'd go to
        a web site, and then it would say "cannot find address". Then I'd
        reload again, occassionally 3 times, to load the page. Is this
        due to DNS being too slow, TTL setting, or something else?
        \_ windows mac or linux ?
           \_ windows (company issued laptop, no alternative)
	...
2008/12/2-6 [Computer/SW/Apps, Academia/Berkeley/CSUA/Motd] UID:52140 Activity:kinda low
12/1    Just curious -- what do you guys generally use soda for? Why do you
        log on? Personally, I use it to keep a presence on IRC and AIM/gTalk
        at all times, and mess around with some Python programming (been
        setting up Twisted and such so I can play with making an irc bot).
        --toulouse
        \_ I use it to post SHIT, er, I mean, spill my guts about the company
	...
2008/3/4-7 [Computer/SW/Virus] UID:49325 Activity:kinda low
3/4     Hi, what's the best free anti-virus software for XP?  What about
        anti-spyware?  Currently I'm using Active Virus Shield and Spybot.
        Thanks.
        \_ I've used: avg, spybot s&d, adaware, trend micro's housecall.
           \_ Does Spybot S&D protect Firefox?  It soulds like the injection
              feature only supports IE.
	...
2013/3/25-5/18 [Computer/SW/OS/Windows] UID:54639 Activity:nil
3/25    It's strange that only every other Windows version is a hit.
        NT 4.0: hit
        2000:   flop
        XP:     hit
        Vista:  flop
        7:      hit
	...
2013/2/19-3/26 [Computer/SW/OS/OsX] UID:54611 Activity:nil
2/19    I program a lot by sshing to a Linux cluster.  So I'm used to using
        Xemacs to code.  This works fine from a Linux or Windows workstation,
        but sometimes I have to use a Mac.  On Mac, the meta is usually
        bound to option, but that often doesn't work over ssh for some reason.
        This makes using emacs a real pain.  Any suggestions on how to fix it?
        (Other than "use vi")
	...
2012/3/15-6/1 [Computer/SW/Languages, Computer/SW/OS/Windows] UID:54340 Activity:nil
3/15    Why does MS put double-quotes around the '8' in Windows Server 8, like
        the following?
        - Windows 8
        - Windows Server "8"
        \_ Because when they didn't do it, code didn't see the '\0'
           and went over?  Looks better than '8','\0' *shrug*
	...
2012/2/23-3/26 [Computer/SW/OS/Windows] UID:54312 Activity:nil
2/23    fixboot wrote FAT boot sector to my WinXP hard drive.  How can I convert
        the drive back to NTFS?
        \_ Does C:\WINDOWS\system32\convert.exe work?
	...
2011/12/21-2012/2/6 [Computer/HW/Laptop, Computer/SW/Editors/Emacs] UID:54269 Activity:nil
12/21   In Emacs, how do I make it so that it will resize its screen
        when the maximum resolution of my monitor changes? When I
        use my laptop, my emacs is too big (and I can't resize it
        because the bottom-right corner is not accessible).
        \_ Which OS?  Can't you drag the top border (not a corner) to resize
           the height to be smaller?
	...
2011/5/19-7/30 [Computer/SW/Security] UID:54110 Activity:nil
5/19    Uh, is anyone still using this? Please mark here if you post and
        haven't added this yet. I'll start:
        \_ person k
        \_ ausman, I check in about once a week.
        \_ erikred, twice a week or so.
        \_ mehlhaff, I login when I actually own my home directory instead of
	...
2011/2/14-4/20 [Computer/SW/Unix] UID:54039 Activity:nil
2/14    You sure soda isn't running windows in disguise?  It would explain the
        uptimes.
        \_ hardly, My winbox stays up longer.
        \_ Nobody cares about uptime anymore brother, that's what web2.0 has
           taught us.  Everything is "stateless".
           \_ You;d think gamers would care more about uptime.
	...
2011/4/6-20 [Computer/SW/Mail, Computer/SW/Unix, Industry/Startup] UID:54078 Activity:nil
4/6     My company is evaluating version control systems. Our two candidates
        are Perforce and Subversion. Anyone worked with both and have good
        arguments one way or the other? (These are the only two options we
        have.) We're most interested in client performance, ease of use, and
        reasonable branching.
        \_ I'll be 'that guy'. If perforce and subversion are optins, why isn't
	...
2011/11/29-2012/1/10 [Computer/HW/Printer] UID:54245 Activity:nil
11/29   HP printers might have a remote exploit that could set them on fire:
        http://preview.tinyurl.com/brh9bbq [ars technica]
        \_ Finally a use for the "printer on fire" error code!
           http://en.wikipedia.org/wiki/Lp0_on_fire
	...
2011/11/9-30 [Computer/SW/Security, Computer/SW/OS/OsX] UID:54219 Activity:nil
11/9    Unsigned code execution exploit in iOS 4.3 & 5:
        http://preview.tinyurl.com/bslubtu [arstechnica]
        \_ Fixed in iOS 5.0.1:
           http://preview.tinyurl.com/7l4vq52 [macobserver]
	...
2009/7/26-29 [Computer/SW/Security] UID:53200 Activity:nil
7/25    so is this a remote ssh exploit ?
        http://users.volja.net/database/matasano.PNG
        \_ No but this is:
           soda> ssh anywhere
	...
2009/7/8-16 [Computer/SW/OS/Linux, Computer/SW/Unix] UID:53124 Activity:nil
7/7     what happened to our web presence? http://www.csua.berkeley.edu
        not working
    \_ That would be because we've yet to set them up afaik. Steven *does* have
    a job after all. The idea is that we want a separate computer mounting the
    web directories, so that if an exploit compromises the webserver, the shell
    server (soda) itself will be insulated from the attack.
	...
2009/3/8-17 [Computer/SW/Unix] UID:52685 Activity:kinda low
3/8     I'm reading about an old exploit where someone used a buffer overflow
        in a printer daemon to get "daemon privileges," which allowed them
        to use another exploit on the mail delivery program to get root.  I'm
        not sure what daemon privileges are.  Is there some set of priveleges
        that most daemons run on that is higher than user but lower than root?
        What are they?  I've never heard this before.
	...
2008/12/10-16 [Computer/HW/CPU, Computer/HW/Drives] UID:52220 Activity:moderate
12/9    Another idea for the CSUA that lets you spend money and maybe get some
    cool toys. Instead of buying a beefy server (like say, a massive server
    with 20 386DX processors), buy a few cheap machines (like the ones
    mentioned below) that have good disks and work on failover / load
    balancing. A netscaler or other piece of hardware is complete overkill,
    but maybe hacking an OpenBSD box could do the trick. The idea is that
	...
2008/8/19-21 [Politics/Domestic/Crime, Computer/SW/OS] UID:50907 Activity:high
8/19    Exploit code downloads backdoor from two sources one .cc one local
        box on <DEAD>icq-mail.net<DEAD> (an link:secureserver.net) (upstream isp is sbcglobal
        (now ATT)).  both sources are still serving up the malicious .EXEs
        Who should I report this to?
        \_ are you getting DKAMINSKY DNS EXPLOITED???????????
           \_ no, i'm getting "my users are dumb asses" exploited.
	...
Cache (2670 bytes)
www.easynews.com/virus.txt -> www.easynews.com/virus.html
While this page has the attention of a large intellectual population, I invite you to learn about the global change that is occurring on this planet as we find ourselves unable to meet our energy needs. This is an issue that will affect us all in very dramatic ways and none of our leaders will talk about the problem with us. I hope you, as an smart, thoughtful adult, will learn all you can about our planets energy needs and what we can do to replace oil as our primary source. It paged my cell phone at 6:47pm PDT on 9/26/2004 for the first hit, and 7:52pm PDT on 9/26/2004 for the second hit. Once this JPEG overflowed GDI+, it phoned home, connected to and ftp site and downloaded almost 2megs of stuff. com site, "With Radmin you can work on a remote computer exactly as if you were right there at its keyboard." It phones home to the same IP that is in the usenet post headers. Thank you FoToz for * helping get a grip on the situation. I actually had got * bind jpeg exploit working earlier but I could only * trigger from OllyDbg due to the heap dynamically changing... I know there * are more attack points you can take advantage of if you * look for them.. exe is MAJORALLY exploitable and I know * that would make this exploit far more powerful if I * figured that part out.. I have already exploited it * personally myself but I need to run some more tests to * make things final for everyone... On another side note * for the people out there who think you can only be affected * through viewing or downloading a jpeg attachment.. tif or whatever * and stupid Windows will still treat the file as a JPEG :-p... For instance you * send them the image with a 1,1 width,height and then' * they can't see it in Outlook Express, so there like * man this image has a cool name so I'll try to open the * attachment, then there FUCKED... So * I encourage everyone out there to download SP2, patch your * Windows systems, etc... Of course this won't be a * cure all solution :-/ * * Note: * ===== * If someone wants to take advantage of the bind mode of * attack in this exploit you will need to set up a script * on a web server to check everyone who downloads the * jpeg exploit file and then connect back to them on the * port you wanted to use with the bind attack... One of * the reasons I decided to keep the bind shellcode option * in here is because sometimes as you people know a * firewall will be more restrictive on outbound connections * and there are times where a bind attack will do just right * if the reverse connect attack won't work... tif and dumb Windows program's * (most of them) won't give give a shit and try to load the * jpeg anyways...