Wheels o' Fun

It looks like I'm a Ferris Wheel, although playing around with the poll revealed that I was almost a “kiddie ride” instead.

See what amusement park ride you are.

[Thanks to Christopher.]

Open for Business Back Online, Hack Explained

On April 1, 2004, a single, carefully crafted URL was sent to OfB.biz, returning a set of encrypted strings. The same request was reissued in the midst of thousands of normal requests on April 2 and 7. The requests came from Tehran, Cairo and Sarajevo. Then there was a week of silence. Late on April 13, however, another string of requests came, this time from various ISP's in Tel Aviv.

The strings taken from the previous week were encrypted together to form the administrative access cookie for PHP-Nuke. After forming the cookie, the new requests were used to insert multiple superuser users providing complete access to all of PHP-Nuke's functionality. The accounts were systematically added from different IP addresses over a period of several hours going well into April 14. After creating these superuser accounts and moving the original superuser account to a semi-removable status, the perpetrator then entered the block administrator and placed obfuscated JavaScript code hidden near the JavaScript code for the advertising banners.

The JavaScript code reported back information concerning visitor hits using a unique ID and then forwarded users to a pornographic web site before they knew anything had happened. The attack was complete. The attacker then moved onto other sites, defacing PCLinuxOnline on the same day and Linux and Main on April 15.

Three days later, I have hand checked the nearly 300 articles on Open for Business, cleaned out the JavaScript and successfully brought OfB back online with a number of security patches. However, with this being the second time that the poor design of PHP-Nuke has allowed the site to be attacked, my days using PHP-Nuke are numbered. Assuming that SAFARI eventually is finished (I've been talking about that for how many years now?), I will be moving over to that and escaping this security mess forever.

What Happened

Well, over the past day, I've come to understand a lot more about what happened to Open for Business yesterday. Unfortunately, the same cracker hit my friend and colleague Dennis Powell's Linux and Main site today. While I'd like to post more about what happened, I'm still gathering a few things that I don't want to mess up by saying too much, so I will probably need to wait until tomorrow before I can say exactly what happened (or at least what I think happened).

It's a good day overall, though, I've figured out WAY more than I expected concerning the issue. I hope to have the issues on the site resolved in the next few days rather than a few weeks. That's very good news to say the least.

Cracked.

Open for Business was cracked (hacked is a more commonly used but incorrect term for what happened) today. I might post more on this later. Right now I have a lot of work ahead of me.

Easter Meditation

He is RISEN! What a joyous day it is — I hope everyone reading this had a wonderful and blessed Easter!

{1} Early on Sunday morning, as the new day was dawning, Mary Magdalene and the other Mary went out to see the tomb. {2} Suddenly there was a great earthquake, because an angel of the Lord came down from heaven and rolled aside the stone and sat on it. {3} His face shone like lightning, and his clothing was as white as snow. {4} The guards shook with fear when they saw him, and they fell into a dead faint. {5} Then the angel spoke to the women. “Don't be afraid!” he said. “I know you are looking for Jesus, who was crucified. {6} He isn't here! He has been raised from the dead, just as he said would happen. Come, see where his body was lying. {7} And now, go quickly and tell his disciples he has been raised from the dead, and he is going ahead of you to Galilee. You will see him there. Remember, I have told you.”

What Wondrous Love Is This, Oh My Soul?

The Crucifixion
{20} When they had mocked him, they took the purple off of him, and put his own garments on him. They led him out to crucify him. {21} They compelled one passing by, coming from the country, Simon of Cyrene, the father of Alexander and Rufus, to go with them, that he might bear his cross. {22} They brought him to the place called Golgotha, which is, being interpreted, “The place of a skull.” {23} They offered him wine mixed with myrrh to drink, but he didn’t take it.

{24} Crucifying him, they parted his garments among them, casting lots on them, what each should take. {25} It was the third hour, and they crucified him. {26} The superscription of his accusation was written over him, “THE KING OF THE JEWS.” {27} With him they crucified two robbers; one on his right hand, and one on his left. {28} The Scripture was fulfilled, which says, “He was numbered with transgressors.”

{29} Those who passed by blasphemed him, wagging their heads, and saying, “Ha! You who destroy the temple, and build it in three days, {30} save yourself, and come down from the cross!”

{31} Likewise, also the chief priests mocking among themselves with the scribes said, “He saved others. He can’t save himself. {32} Let the Christ, the King of Israel, now come down from the cross, that we may see and believe him.” Those who were crucified with him insulted him.

{33} When the sixth hour had come, there was darkness over the whole land until the ninth hour. {34} At the ninth hour Jesus cried with a loud voice, saying, “Eloi, Eloi, lama sabachthani?” which is, being interpreted, “My God, my God, why have you forsaken me?”*

{35} Some of those who stood by, when they heard it, said, “Behold, he is calling Elijah.”

{36} One ran, and filling a sponge full of vinegar, put it on a reed, and gave it to him to drink, saying, “Let him be. Let’s see whether Elijah comes to take him down.”

{37} Jesus cried out with a loud voice, and gave up the spirit. {38} The veil of the temple was torn in two from the top to the bottom. {39} When the centurion, who stood by opposite him, saw that he cried out like this and breathed his last, he said, “Truly this man was the Son of God!”

From Mark chapter 15 (WEB)

The Explaination
{3} He was despised, and rejected by men; a man of suffering, and acquainted with disease. He was despised as one from whom men hide their face; and we didn’t respect him.

{4} Surely he has borne our sickness,and carried our suffering; yet we considered him plagued, struck by God, and afflicted.

{5} But he was pierced for our transgressions. He was crushed for our iniquities. The punishment that brought our peace was on him; and by his wounds we are healed.

{6} All we like sheep have gone astray. Everyone has turned to his own way; and Yahweh has laid on him the iniquity of us all. {7} He was oppressed, yet when he was afflicted he didn’t open his mouth. As a lamb that is led to the slaughter, and as a sheep that before its shearers is mute, so he didn’t open his mouth.

{8} He was taken away by oppression and judgment; and as for his generation, who considered that he was cut off out of the land of the living and stricken for the disobedience of my people?

{9} They made his grave with the wicked, and with a rich man in his death; although he had done no violence, neither was any deceit in his mouth. {10} Yet it pleased Yahweh to bruise him. He has caused him to suffer. When you make his soul an offering for sin, he shall see his seed. He shall prolong his days, and the pleasure of Yahweh shall prosper in his hand.

{11} After the suffering of his soul, he will see the lightand be satisfied. My righteous servant will justify many by the knowledge of himself; and he will bear their iniquities.

{12} Therefore will I divide him a portion with the great, and he shall divide the spoil with the strong; because he poured out his soul to death, and was numbered with the transgressors; yet he bore the sin of many, and made intercession for the transgressors.

From Isaiah chapter 53 (WEB)

Not So Victorious

Well, my votes didn't go so well today. Mayor Tom Brown, who has been considered virtually invincible in the past, lost by over 10% of the vote. Two tax hikes passed, one for $.86 per $100 going to the Francis Howell School district (who has had money “disappear” — as accounting fraud and the like — in recent years and was claiming the hike was necessary to save extracirricular activities such as sports). FH School District really should learn how to manage the money it has before getting yet another tax hike.

Depressing. I'm especially disappointed to see our long-time mayor lose. The new guy (Shawn Brown, no relation to Tom Brown) made his big campaign issue the fact that the new mayor's salary increases by $3,000 a year, and thus Mayor Brown would have been paid $100,000 this year ($40,000 base + $3,000 for each of his twenty years of service as mayor). On the other hand the new Brown only gets the $40,000 for his first year. It is too bad, Mayor Brown has been good for the area.

In lighter news, here's the latest quiz (thanks go to Kevin):

You are a GRAMMAR GOD!

Behold the Power of Cheese

Here's another quiz from Christopher — he really picked a cheesy quiz and even made a cheesy joke about it.

Cheese Test: What type of cheese are you?

Interesting.

Trying OneBase Linux

I've been meaning to try a source-based Linux distribution for some time. For those of you who aren't sure what that is, it's a distribution where you build all of the software from the source (and thus it is all optimized for your hardware). Josiah is a big fan of Gentoo, which is one such distribution.

My problem with Gentoo and other previous source based distributions is that they leave all of the configuration work for you to do yourself. I never have that much time. I'll admit it — I like my operating system to do most of the work for me. I'll tweak things when and if I have time, thank-you very much. Thus, up until today, I never even bothered trying a source-based distribution.

Then I started reading about OneBase Linux. OneBase is a source-based distribution that autodetects most of your hardware for you. It allows you to choose between source and binary packages at any time. This sounds pretty nice, I think. So, I fired up my test box (the Shuttle XPC I mentioned last fall) and gave it a freshly burned OneBase 2004-R2 CD. I booted the system up just about three and a half hours ago. The initial installation and compilation process took about two and a half hours. A few minutes ago I told it to start the next set of compilations (insanely simple to do — I want GNOME, so I typed olm -s gnome, and it does the rest).

At any rate, I'm anxiously awaiting the finish of these compiling tasks to see how usable this system turns out to be.

Life Mimicks Humor

Remember last year when I joked about being Dan Richardson? Well, now I'm in trouble. It seems like the real Dan Richardson read that post and is suing me now for tarnishing his name. Here's the letter I got today from his attorney:

Johkin, Laffen and Funknee, LLP

Dear Mr. Butler:
Our client has notified us that you have engaged in acts of impersonation of his identity on your site. Our client has since received questions from potential employers who found this information when searching the Google search engine about him. We have calculated a net loss of over $28,000 in actual damages since you posted this message last year.

This is your official notice that our client is filing suit against you and shall attempt to retreive the $28,000 plus punitive damages for this disgraceful action on your part. If you are interested in settling this dispute, our client is open to accepting $26,000 upfront to drop litigation.

Thank-you,
Arntu Laffen
Johkin, Laffen and Funknee, LLP