8
Feb

Two Questions on the Stampede of February 4

I have learned two things in the past few days:

  • The Calibrated Preemptive Response (CPR) is only applied to anti-Arroyo rallies.
  • The government can finish investigations as fast as it want it to.

Questions:

  • They say people began camping at ULTRA Monday, January 30, 2006. A lot of people were there, in a public street. Why didn’t the police apply CPR?
  • If it can finish investigations in 72 hours, how come it takes the government years to solve other crimes, specially corruption?

Also: Pinoys love being in the cameras. And giving them the mike will give them heaven. However, they shoot before they think. Evidence: Justice Secretary Raul Gonzalez and Interior Undersecretary Marius Corpus.

Atty. Lambino to Cito Beltran’s Straight Talk: We are all at fault. I agree.

7
Feb

Who Indeed Will Clean Up Such Mess?

A stinging indictment by the youth of their elders.

However, it does not absolve the youth. Unfortunately, the youth will clean up the crap that their elders had made. I suggest they begin now, as it is a lot of trash to clean. Otherwise, they’ll just repeat the errors of their elders.

6
Feb

MLQ3 Mentions This and the LJ Blog

I was happy to see this blog mentioned and the crossposted LJ blog entry mentioned in the erudite Manuel L. Quezon III’s blog. The LJ entry that he linked to was posted here.

He also mentioned another entry at LJ, which can be found here.

Thanks, Sir MLQ3!

4
Feb

The Stampede of February 4, 2006: Poverty Rears Its Ugly Head

A sad reflection of poverty in the Philippines is the Stampede of February 4, 2006.

Wowowee is one of the flagship noontime shows of ABS-CBN, the country’s largest network. Promising large prizes and highlighting the plight of its winners, many people saw it as their hope to get out of the hellish life that poverty brings. Thousands of people line up in the night to have a chance in getting in the studio for the next day’s show, and hoping to get the top prize.

The show would have celebrated its anniversary by doing a show at the Philsports Arena (formerly ULTRA) today, and thousands of people lined up last night just to get a chance of getting inside the arena. Getting in the arena gives you the chance of winning the top pot. Then, the shocking tragedy happened.

Poverty is a sad reality in this country, and despite the indifference of the affluent, its reality cannot be denied, and its existence will be highlighted. The massive crowd that lined up the streets near the ABS-CBN studios, and indeed, those who lined up at Philsports Arena, is proof of poverty. People see game shows like Wowowee as their last hope, the ticket out of the muck of poverty.

The host lamented the deaths and stated that they only wanted to entertain and give hope. Some individuals chided ABS-CBN for exploiting the poor in order to get higher ratings. One weblog even berated the company for such poor planning and organizing. The said comments are rather unfair; who wanted such tragedy to happen?

ABS-CBN has announced that it will shoulder all medical and funeral expenses of the victims of the Stampede. Well and good. At least it is not shirking on its responsibility, although some skeptics may – again – claim that this action is just damage control.

ABS-CBN should rethink its concepts about Wowowee. It has created false hopes and unduly contributed to the vicious cycle of poverty, feeding to the fast-buck thinking. The intentions are good; their effects are, in the long run, not.

31
Jan

Grew/Nyxem/Blackmal Worm File Deletion on Feb. 3

Antivirus companies warn users about the dangerous payload of the Grew/Nyxem/Blackmal worm. On February 3, 2006 and on the 3rd month thereafter, or 30 minutes after the computer has been restarted, it is scheduled to delete and overwrite common document files (.DOC, .XLS, .PPT, .ZIP and others) with the string “DATA Error [47 0F 94 93 F4 K5]”.

Also, it disables the mouse and the keyboard, deletes files and registry entries of antivirus products, and closes AV windows so that users can’t use them.

Trend Micro’s description for this worm is here.

Best bet: update your AV product then perform a full scan on all of your hard drives. Back up your important or sensitive documents.

27
Jan

Yet Again Another Yahoo! Phishing Attempt

Thanks to Rocky for pointing another desperate attempt to steal Yahoo! login credentials. This link is sent via Yahoo! Messenger. Here’s how the page looks like:


Image hosting by Photobucket

(Click the image to enlarge)

Take note of the URL and the usual Yahoo! Geocities ads at the right.

When a user enters his credentials and clicks on Sign In, the trouble begins. The user is directed at another page of similar nature, only that the pictures are different.


Image hosting by Photobucket

Same link, different page. When you try logging in again, you are directed to an login error message page.


Image hosting by Photobucket

So what happens to the data entered? Now, when you click on Sign In for the first time, Internet Explorer’s status bar displays this:


Image hosting by Photobucket

It is sent to a CGI script! Uh oh. The URL of the CGI script is not apparent when you view the HTML source, since the link was encoded using HTML hexadecimal notation. We can suppose that the CGI script is a mailing script, where it sends the stolen info to an email address which was encoded in the HTML form using the tag. In this image, I highlighted the relevant info that made me arrive at the supposition made earlier.

Image hosting by Photobucket

In the form tag, there is an ACTION attribute, and it is set to a long series of characters in HTML hexadecimal notation. It points to the link you saw in the status bar image. There are four INPUT tags of type HIDDEN – that means these form objects are not visible to the user. Take note of the one whose value is set to a certain email address.

The link was spread via Yahoo! Messenger. Maybe it was a social engineering technique – one user enticing another to send the link. Maybe it was a malware that was somehow capable of interfacing with YM. Checking on the address bar of the browser is no guarantee. There are very good phishing sites that are able to interpose a window so that the true URL is hidden.

Good thing Yahoo! Geocities is ad-supported.

Be careful, again.

21
Jan

LiveJournal Accounts Hijacked Due to XSS Holes

In a blog, a group of hackers known as “Bantown” has hacked “900,000 LJ accounts” to demonstrate that LiveJournal (LJ) is susceptible to cross-site scripting (XSS) through JavaScript. As an LJ user, this is troubling. While LJ claims that these holes were plugged, Bantown claims there are several holes still unplugged.

One of LJ’s solution is to use a new user subdomain.

LJ users: either have a backup blog (try Blogspot, or WordPress.com) or back up your entries. As on how to back up your entries: frankly, the only way I know is copy-paste. Also, Multiply has a feature where you can import your LJ blog to your Multiply blog (if you have an account).

The blog entry is here. Said link is also quoted at the LJ Infosec community.

11
Jan

A New Cellphone – Dead After A Year

What would you do if you find yourself having bought a new cellphone that was the first and the last in line?

Introducing the Nokia 7710:
Continue reading