21
Jun

Yahoo! Mail XSS Proof of Concept Code

Trend Micro has revealed the existence of a proof-of-concept (PoC), cross-site scripting (XSS) code that affects Yahoo! Mail.

From their blog:

Here’s how the exploit works. The first component (which is written in Perl) is installed on a web server. This code is supposed to execute whenever a user visits a web page that is hosted on that server. The path of the CGI script on the web server is then parsed by the second component and appends a Yahoo URL string to it. An entirely new URL is generated. This URL can be sent to an unsuspecting user through an innocent-looking email or YM message. When the user clicks on the URL, his Yahoo account becomes compromised.

The Trend Micro Virus Encyclopedia entry for EXPL_YAHOXSS.A is more descriptive:

The link to the Web site where this code is hosted may arrive embedded in spammed email messages. The said link may appear as the following:

http://search.yahoo.com/web/advanced?ei=UTF-8&p=%22%3E….

The said link tricks the user into thinking that it is related to Yahoo! search results.

Once clicked, it connects to a Web site with an embedded Perl script. The said script, which automatically runs when accessed, steals cookies related to the affected user’s Yahoo! Mail account. This allows a remote malicious user to take control of an active Yahoo! Mail session while the affected user is logged in.

If you notice your browser’s address bar when viewing Yahoo! Mail, it has a lot of seemingly-random strings of text. XSS is dangerous because if a target Web site doesn’t validate a URL, anything can happen, depending on the script used by that Web site. This problem had manifested in LiveJournal (which led to change in user URLs, from www.livejournal.com/users/user_name to user-name.livejournal.com) and MySpace.

While this problem is just a proof of concept, the fact that the PoC exists proves that it can be done. All it takes is a very good programmer to get the PoC code, tinker with it, and release it in the wild.

Again, be careful when handling links/URLs being sent to you via email or IM, even if they come from trusted sources (remember SOHANAD?).

20
Jun

Repent or perish

He is at it. Again.

In his latest rant, Bill Esposo fears that Joseph Estrada will stage a comeback in 2010 if and when Erap is acquitted by the Sandiganbayan. And he’s blaming the Genuine Opposition for it!

What goes around comes around.

Esposo is just reaping what he had sown. As part of that group called Council on Philippine Affairs or COPA, had they not conspired with everyone else to unseat Estrada? (Read this post by John Marzan about an article by Ellen Tordesillas.)

If they had followed the rule of law instead of taking the law into their own hands, there will never be an Erap restoration! Ever! And now, rule of law is dead, no thanks to COPA et al.

Anyway, he thinks that Manny Villar is the biggest loser among the 2010 presidentiables. One of Esposo’s reasons:

He allowed his Wednesday Club to divide rather than consolidate under the Opposition. Villar, Joker Arroyo, Ralph Recto and Kiko Pangilinan would have all won had they ran under the GO banner. That would have also made Villar, not Estrada, the big winner in the last elections and would have inhibited others in the Opposition from clamoring for a change in the Senate leadership.

Sinisi pa sya sa katigasan ng ulo ni Joker, Ralph, at Kiko.

I just hope it is not bitterness on the part of Mr. Esposo; afterall, he proposed a third force that is anchored on the Wednesday group, only to see everything falter because Arroyo, Recto, and Pangilinan had other ideas. I myself proposed such a group, but I had since moved on; I had accepted the true issues of the 2007 elections, and discarded the frames that Esposo and the Fortress by the Pasig had thrown at us. It is not a Gloria v. Erap fight. It is People of the Philippines v. Gloria Arroyo! And the Trillanes win is the verdict!

I hope Mr. Esposo can accept the fact that everything that he rues now is due to EDSA 2. That before he points fingers at anyone, he should look at what he did back then.

(And, no, I don’t think there will be an Erap restoration. While the surveys acknowledge that he has a high trust rating as compared to Gloria Arroyo, I don’t believe it will translate into votes come 2010.)

19
Jun

Blogging Zelda

Found this coolness via Joystiq.

A blogger named Grownup Gamer has a mission: to blog in detail about all the Legend of Zelda games!

The first Zelda is one tough game to finish, and I still have to finish the second Zelda, A Link to the Past, and The Wind Waker. The Minish Cap had been my companion on the way home from the office. I still have to play a lot of Zelda games, so Blogging Zelda is a nice trip to every iteration of Hyrule.

I just hope the blogger doesn’t lose steam. He has to cover fifteen games, and so far he has finished the first Zelda.

Are you a Zelda fan? What is the appeal of this game series to you?

19
Jun

Lakbayan: Proudly Philippine Made

I met Eugene Villar at iBlog3. He’s one cool guy. After all, he created his own content management system that powers his blog, vaes9, and is now leveraging the power of Google Earth to drive Vista Pinas.

Another feather in his cap is Lakbayan. Lakbayan notes down the places in the Philippines where you had passed through/visited/lived, and then gives you a grade.

(How much of the Philippines have you visited? Find out at Lakbayan.)

Go give it a try!

Now, I am waiting for the nitty-gritty details on how he came up with this project (like how the grade is computed).

My suggestion at this point is not really technical, but I guess to make the grade more representative of one’s travels, all the cities/towns of a province should be listed. I am not sure if Alcala, Pangasinan is east or west Pangasinan. And as Eugene himself has said, “just because you’ve been to Boracay doesn’t really mean that you’ve “seen” Aklan, right?” Since I had been in La Trinidad in Benguet, I just can’t select Benguet.

Great work, Eugene!

18
Jun

Taking shortcuts really does not work

I’ve been thinking about the Joseph Estrada plunder case. Now that the case is submitted for resolution and a 3-month wait (max), it has been a six-year trial. What have we accomplished? What have we gained?

This case is special because of the implications and complications that it may cause. As DJB calls it, it is a political dilemma – to be fair or to be right. Read his post for background.

I think the prosecution’s appeal to history is wrong. History can go both ways; it can go against their way. Besides, there is something wrong with this assertion:

It is a rare occasion, indeed, for the country to have a second chance at attempting a fundamental change in its administration of justice — after the failure to obtain swift and timely justice against the Marcoses and their cronies, many cases against whom are still pending with courts after more than 20 years…
xxx
(Estrada’s acquittal will) sound the final death knell for good governance in our country and irreversibly doom our generation and the succeeding generations to decades of abject poverty caused by the pernicious effects of continuing pervasive corruption.

“Non sequitur” is a Latin phrase that means “it does not follow. In formal logic, this fallacy is committed when the conclusion arrived at is not supported by the given premises.

The prosecutors made two assertions: (1) if Estrada is acquitted, there can no longer be a fundamental change in the administration of justice; and (2) an acquittal will lead to more problems of poverty. Either the prosecutors are prescient, or they are appealing to emotions, not reason. Again, an acquittal does not necessarily mean that the justice system will fail, that poverty will worsen. Also, a conviction does not necessarily mean that good governance is enhanced.

This nation is in a bind, in a dilemma. Whatever course of action we take, we will be suffering from it. Let’s say for example Erap is convicted and his motion for reconsideration is denied. His next course of action is to appeal to the Supreme Court, who in 2001 decided that Joseph Estrada has resigned the presidency. Three of the justices who concurred in that decision are still in the Court, including the current Chief Justice, Reynato Puno (who wrote the decision). The Court should decide on the basis of evidence. An acquittal will put the Supreme Court in a moral quagmire, and throws it back to where it all started, EDSA 2.

An affirmation of the conviction will probably re-open the wounds caused by EDSA 2 (wounds that have not healed), which will probably divide this country (hopefully not).

The major problem is this: can we trust the Supreme Court to reach a fair and right decision? After all, the very same Court has put us in this dilemma in the first place!

Is it going to be fair to Estrada if the Sandiganbayan convicts him, even if reasonable doubt exists, just to pay lip service to history, to good governance? As Patsada Karajaw puts it:

What they are saying is that Erap should be convicted to showcase that our justice system works. In effect, some people want Erap to be the sacrificial lamb. This is not how our justice system should work. The case must be decided on the merits; based on the evidence presented and not because there is a need for us to convict one man to show that our system works. In its zeal to jail corrupt people, our courts must see to it that someones right is not also denied.

And think about the consequences of an acquittal. The political pressure for a conviction is high. And why is that? Ellen Tordesillas answers:

While an acquittal would salve the pain and anger over the unjust ouster of Estrada from the presidency, what would that make of Gloria Arroyo’s six-year presidency? If Estrada did not commit plunder, what then was the rationale for his ouster in 2001?

An acquittal verdict would nullify the basis of the first three years of Arroyo’s presidency, which put her in a position to bastardize the 2004 elections to remain in power.

It seems all our political troubles began on that day in January 2001. And the Sandiganbayan’s decision will not probably end it. Heaven knows how this will end.

And to end this post, let me post John Marzan‘s answer to DJB’s question:

Kung sasagutin yan ng mga edsa dos supporters at veterans na ngayo’y tacit supporters na ng pagnakaw ng election ni Arroyo noong 2004–sasabog ang ulo nila.

18
Jun

Raising Awareness thru MyBlogLog Community Exchange

It’s time to use the power of a meme to a greater cause.

Started by Tingog.com as a writing project for Musa Dimasidsing, spawning 21 entries, it is now time for others to do something about it. This meme is just a small way of showing our awareness about current events.

The rules of this meme are simple:

* Join all of the MyBlogLog communities on the list below.
* Copy the list and create a new post on your blog on the victims of electoral violence and paste the list onto your post.
* Write a brief paragraph that explains what the meme is above the list (just as I have done here).
* Add your Blog using the URL of your entry on Victims of Electoral Violence plus 2 or 3 more MyBlogLog communities to the list and then publish the post.
* If you want to be added to this list, simply drop me a comment below with your Blog Name/URL and MyBlogLog URL.

The Raising Awareness thru MyBlogLog Community Exchange List:

* Pedestrian Observer | Join MyBlogLog
* Thirty Thousand Fishes | Join MyBlogLog
* Tingog.com | Join MyBlogLog
* An OFW Living in HK | Join MyBlogLog
* Prudence and Madness | Join MyBlogLog
* The Construct by Alex Maximo | Join MyBlogLog
* Blog @ AWBHoldings.com | Join MyBlogLog
* Miguel Paraz/Migs | Join MyBlogLog
* Add Your Site here | Join The Above. Drop A Comment Below!

17
Jun

Half Full

Someone told me that I always see the glass half empty (if not fully empty) when it comes to my personal life. So, fine, let’s see it as half full:

1. You don’t have to wait for anyone when you go on a date. Heaven knows how I hate Filipino time.
2. You can always go anywhere you like without being burdened by a companion’s whims and fancies.
3. It is cheaper to go on it alone.
4. You get to think without the distractions.

(Will add more soon.)

16
Jun

G*g* ka rin!

Have you heard that stupid sound bite from the liar and eternal disappointment that is Senator Miriam Santiago?

Essentially she called stupid those who refuses to accept pork barrel.

If I were Fred Lim or Ping Lacson, I only have three words for her:

(No, it’s not PI)

G*g* ka rin!

Sorry, Uniffors, Gaudencio Rosales is not my cardinal. Filipino Roman Catholics must be thinking hard of professing another faith, or go atheists.

15
Jun

Things to do this weekend

Visit ToyCon 2007 at SM Megamall Megatrade Hall. Mister Vader will be there to perform his magic tricks, street style. I might be there tomorrow afternoon.

The Bloomfields will perform at the Music Hall of SM Mall of Asia this Sunday at 5PM. I might be there, too.

15
Jun

The Road to the 10 Emerging Influential Blogs, Three

It’s now the third installment for my take on The Top Ten Emerging Influential Blogs of 2007. Here are the blogs in consideration for this week:

Tingog.com – The Voice of the Filipino: A political blog in the context of someone residing in the Visayas. This blog was a finalist at the 2007 Philippine Blog Awards under the uber heavy Socio-Political Blogs category. Isn’t that enough to label this blog as influential?

SugoiStuff: I met one of their bloggers at iBlog3. As I like Jpop/Jrock/Anime in general, what’s there to dislike about this blog? I just hope it gets updated regularly (as in daily). One of my sources for Jpop/Anime news.

Filipinayzd: It is tough writing in Filipino. I should know; that’s why I rarely blog in Filipino. Reading this blog can be tough and for most times I wince. I really don’t like the current “kung anong bigkas ay siyang baybay” rule. I think it will be a great practice if I read this blog regularly. How’s that for being influential?

Alright. So now, I exercise my right to strike out from my list, so I have eight blogs out of ten:

Week 1:
Fire Eyed Boy
Be Seen | Be Heard
Past Lives
Week 2:
Mobility Philippines
The Patsada Karajaw Nation
Week 3:
Tingog.com – The Voice of the Filipino
SugoiStuff
Filipinayzd

Mam Janette must be pulling her hair for this. Sorry.

If you want your blog to be nominated or if you want to nominate other blogs, please leave the URL on the comments (as long as the blog’s start date is not before August 2006). Remember, I can always strike out blogs in my list to accommodate more influential blogs.