Friday, June 15, 2012

Fox News proudly shows off its racism and fake Latino support

Fox News proudly shows off its racism and fake Latino support


This morning, the White House announced that it is essentially ordering Immigration not to deport illegal immigrants that meet 'good citizen' requirements.

This is huge for the Latino community (and for detained-forever Space Aliens in Roswell a well as for Apocalyptic Zombies in Florida)

The requirements are pretty simple: Don't be a criminal, have a diploma or GED (or be a military vet), be a resident for over five continuous years and be between sixteen and thirty years old.  This is pretty similar to Dream Act legislation that failed earlier this year.


Thursday, April 19, 2012

Oops! Google blacklists .. Google. on iGoogle.

 
For anyone with the snark to post 
"Google gives preferential treatment to itself," or that 
"Google lets its own properties float to the top," 
I submit : 
  Suck it.  

Wednesday, December 7, 2011

Alec Baldwin, Avionics, 800 MHz and the Wireless Spectrum

Recently, Alec Baldwin was kicked off of an American Airlines flight for allegedly playing "Words with Friends," a Scrabble(R)-like game which momentarily transmits data on each player move  (Imagine a Scrabble(R) game that takes two weeks). As an engineer who has worked in avionics and is rather familiar with the reality of "air-to-ground" and "air-to-air" interference, I submit to you my ubernerd explanation/suggestion that there's some serious bullshit going on:
  • A long time ago, the FCC was dealing with new cell-phones and towers .. using AMPS (analog).
  • The FCC, in response to high-powered AMPS cellular phones (old days, analog, you would transmit on the order of Watts and not Milli-watts), issued a ruling that essentially banned cellular devices from being active on aircraft.
This was, in its time, a great idea.  It's why the FCC exists.  Some random person with a suitcase-phone pushing out three watts, trying to terminate(make) a phone call, might piss off some of the instrumentation onboard.  But: It would only affect it in the realm of electromagnetic interference in general;  All devices that transmit signals are subject to strict licensing as to not interfere with critical communications (fcc parts A/B)  (in other words, they can't "talk" in the same airwave-space .. or, if they do, they must secede/suspend activity if a Licensed transmission is seeking airtime).
Well, this kind of leaked in the worst ways, and is nothing short, in 2011, of a Snopes "are you serious?  dude. it's been fine for /years/, and AMPS doesn't exist anymore.  Anywhere." article:

  • AMPS (the high-powered broader-spectrum "O.G." cellular phone carrier grab of the wireless spectrum) was phased out over the course of many years, and has been gone for quite some time.
  • FURTHER: There are no information, control, avionics, distress, alert, SOS or other systems that work in the frequencies that the FCC was concerned about.  
    • The International Aviation Assoc. picked 121 and 253 MHz for mil / intl trouble frequencies. New ELT (locator beacon) devices work in the 400's.
    • Avionics in general operate from 29-50118-175, 406-512 and >900 MHz freqencies.  (Basicall,y, 30-175, 400-500, >900).  
  • Even if all of what I just said is complete and total bullshit (which it's not), it's the job, purpose and function of the FCC to be the arbiter and licensee of radio-frequency spectrum and wattage limitations. to push a rule that prohibits cellphones on an aircraft because of an oversight on their part in the allocation of spectrum is, in my opinion, a statement of "We screwed up, big-time, and our spinsters are going to figure out how to blame YOU if something happens."
  • One more thing:  Is it really the A-listers playing brain games with others that you fear are going to take down a plane, or would it be the person who carefully studied command/control systems and brought a cellphone on the plain that specifically interrupts/harms avionics? 
I Really Don't Think I'll Ever See A Story Where Angry Birds(tm) Tanked a Commercial Flight.
 
But if anyone got my vote to be able to do it, it'd be Alec Baldwin or Martin Sheen.
.. anyway :
  • The iPhone works on 800 and 1575 MHz.  Nowhere close.
  • Alec was playing a game on his phone.  Were they sure his phone was malicious?  Did they walk around the cabin with spectral analysers?  .. I'd bet the farm the answer was no.
  • The FCC specifically licensed narrowband 800MHz frequencies (which was their initial concern in the first place, that couldn't be used because it might cause interference) for the specific purpose of air-to-ground telephone services.

What all this boils down to, is that  Mr. Baldwin was shafted by an hourly skywhore having a pissy day.
I only have two questions:
  1. Alec:  Why weren't you on Delta?  I mean.. Hell-o!.
  2. Can I be your WWF buddy?  :)

Saturday, December 3, 2011

Vulnerabilities in Yahoo! messenger client. Active 0-day attack 3-dec 2012


There are multiple vulnerabilities in Yahoo Messenger's clients, breaking and ramping up in scale and permeation today.  
A Romanian security researcher last night published evidence of this attack, and a few sites (including me) and (Bitdefender, etc) have picked up it. "Allegedly[1]:" If you use Yahoo messenger -- there's a zero-day (unfixed and in the wild right now) exploit in which all versions including the latest (11.5.0.152-us) are vulnerable. Easy stop gap: Change your Yahoo messenger preferences to block anyone not on your contacts list. Or, use a non-Yahoo IM client. There are many out there; my recommendations are Trillian, Adium X[osx] and perhaps Pidgin [win/mac/unix].  Or, rock it shell/xterm style with naim. :) This is a hard one to get around otherwise, because of its focus on users' buddy lists for name gathering (I'm going to go out on a limb here and suggest that there's a possibility that contact names are being collected, creating a healthy "confirmed usernames" database, for future use in directed attacks) There are two exploit mechanisms being reported.  One via status-msg updates and another via user file trading.  Both overlap using the same tactic: 1. The status-msg exploit uses a mechanism that, via the status update control, is able to update another user's status without their knowing or permission. 
  • The exploit changes your away/status/"tagline" to an attention-grabbing one, with an embedded in an HTML IFRAME  (inline frame, which can be made invisible) that loads malicious code.  
  • The victim/targe surreptitiously load the iframe automatically (the client itself does), that has content directing the user to a multi-exploit page.  It's pretty crafty - The pages are said to include :
    • (A) a PDF bug (a recent favorite), 
    • (B) an exploit to a locally installed (inline) flash vulnerability, 
    • (C) a Java exploit, 
    • (D) an Intenet Explorer based attack (for those runnung IE as default), 
  • So, prettymuch anyone has the potential to be owned
Since status messages generally have a really high "click thru rate" (percent of clicks vs. those that pass), this piggybacks on the oldest hack in the book: Social engineering 2. The second mechanism uses the same tactics, but embeds the iframe in the text of a message within what users/buddies would see when receiving a file-send request.  
  • With that handy exploit, even if you refuse the file being offered, the code's been sent to you already via the iframe -- game's up.
(Update) 3. A third (unconfirmed) augment uses the "phone tree" method to cascade new iframe data to already-infected users to get around landing pages being taken down. 
  • Bitdefender further suggests that the exploit can be used for affiliate clickfraud dollars (you'd be "clicking on links" and ads that you never see, but the person nonetheless gets paid for, because he's paid to direct traffic towards a site, and he's paid based on the number of clicks).
  • Regardless, Yahoo's decision to allow open html (iframes? really?) throughout their product is clearly a bad one.  It shouldn't be too hard for Yahoo engineers to write an inline html stripper, but then again, a deploy of that scale would have the service down for hours.
We'll see what happens.. [1] C&D /that/, lawyer bitches. [2] http://rstcenter.com/forum/44158-rst-schimbarea-statusului-y-messenger-explicatii-teoretice-si-tehnice.rst