Archive for January, 2008

My own Time-Zone

Tuesday, January 29th, 2008

I just got my own time-zone, look at the photo below:

guya_net_timezone1

My time zone is GMT-1 when most of my co-workers are GMT+2. Actually this started as some kind of a joke on my expense but I like it a lot, it clears things up to others. Don’t ask if I’ve arrived yet just look at the clocks, it’s not even morning in my region :D

Social Engineering Exploits using Flash

Sunday, January 27th, 2008

Apparently Adobe has fixed the bug I've found that enables a swf file to crash the browser, with the last version of the Flash Player (9,0,115,0). I don't know if it's related to my post, but, anyway it's good that it's been fixed.

Since it's already fixed, I just want to give an example of how this could have been exploited with a little Social Engineering. This example might look stupid to you and you would have never fall for it but remember, first, it's only an idea, the real attacker might be more creative, second, some Internet users are far from savvy and might fall for crazier stuff then this.

In this example, the naive user will reach a web site with this text: "I've installed a virus on your windows machine and now have full control of it and your FireFox browser. You have exactly 1:00 minute to donate 10$ to my account, click here to donate. If you fail to donate in the appropriate time I will disable your browser for a few minutes. This will be your first and last warning. Afterwards you have exactly 10 minutes to return to this page and complete your donation or your system and personal data will be compromised and damaged permanently. The only way you can remove the virus from your machine is to donate from this page".

The details like OS and browser will be interchangeable with the real user spec. The user will see the 1:00 minute timer counting, when it'll reach 0:00, boom! the browser crashes using the Flash bug, if the user try to close the browser or the tab, Javascript's onbeforeunload can be used to crash the browser and also add some scary alert.

JavaScript:
  1. window.onbeforeunload = function()
  2. {
  3. //flash.kill();
  4. return "If you leave this page without donating your system will be lost!!!";
  5. }

Some of the users will have enough fear in them to return and donate to the attackers PayPal account. Sound crazy?! Some have been known to fall for crazier phishing tricks. I personally know a few. Take care of the dummies near you.

A nice SilverLight showoff by Microsoft

Sunday, January 6th, 2008

Microsoft recently released the SilverLight version of their Download Center. Its a nice demonstration of the SilverLight technology. But, looking under the hood reveals the huge amount of Javascript used to run this website. I can't see the benefit this has over DHTML if all the logic is anyway implemented by Javascript. The only thing that was maybe more natural doing using SL is the small rotating arrows on the right floating menu. Obviously that won't make it as a good argument for selecting the right technology for a project.

SilverLight_menu

It reminds me of when SilverLight was getting solidified into the final 1.0 version still named WPF/E. The only thing that came to my mind was WTF/E is this cr*p?! After all we were promised, all this buildup, this is what we're getting?! A stupid rendering layer with no logic?! Neitherless to say that it was very disappointing.

MS hurry to release SL bigger brother "SilverLight 1.1 Alpha" that is now going to be named SilverLight 2.0. This version will have a subset of the .NET CLR, logic written in C# and all king of goodies. Hopefully MS can keep up to some of it's promises with this release.

I have finally closed all of my TABs

Tuesday, January 1st, 2008

This happens to me once in a few months, I managed to clear all of my FireFox tabs. Read 'em all, all the stuff I "have to" read later, some wait there as an opened tab for weeks before it gets read and closed. It feels like a fresh start every time I managed to do so. Just the FireFox starting page without anything else. I'd better not go to any interesting website right now, especially not one of these aggregators that can lead to tenths of opened tabs in a minute. Lets savor the moment.

Along with some other issues like, CSRF, Tab surfing mainly hurt our time management (lake of) skills. With the old browsers, though you could have opened a lot of windows, but, it felt crowded after 10 and when it crashed and it generally did (i.e. IE), it didn't gave you the "favor" of restoring all the windows. These days when using a browser like FF it's easy to open tons of tabs without even noticing. The only thing that could have saved us, is the small memory leakage in FF that force us to restarts the browser every so often. Sadly enough there are add-ons like Tab Mix that will restore all of the tabs. Or what I generally do is just kill the process and launch FF again to get back all of my tabs with a clean FF memory. You can't just lose the tabs you need to read it!

I was starving for something that will help my condition. There are lots of tab related addons for FireFox that do all kind of tricks, but look at this one I found here named, Read It Later. Look at the name, it'll help me to, you guessed it, read it later. I don't need my tabs to sing or be colorful I just won't to be able to close the tabs and not feel like I'm loosing anything.

So far so good, but, will I really read these tabs later coz sometimes it's worth it, reading later, that is. And I believe I wont because Read It Later reminds me too much of this "uber" technic I have of dragging all the links from the address-bar into a folder. This way you clear the tabs, you have it all saved, but you never even open this folder again. Read it later generates a plain list which has no appealing, and doesn't really convince me to get back to it, especially when it gets crowded with lots of links.

Luckily there is yet another tab saver that focus on tab saving named Taboo. The obvious benefit of Taboo is that it generates thumbnails out of the saved links. Which helps to distinguish between the good saves to the lesser good ones. Taboo also can show you the saved tabs inside a calendar. For me that's all I wont, give me the saved tab and tell me how old it is. The only thing that is missing from Taboo is that you can't right click on a link and save it, it has to be an opened tab. And also no offline reading but who needs it anyway, just open the tabs before you go online if you ever do, go offline. Taboo adds just two buttons near the address bar, and been working fine for me so far.
Taboo buttons

There are other tab savers that try to do too much, they wonna be more then a simple tab saver, and loose their purpose by doing that. For ex. scrapbook, which do too much IMHO. Scrapbook has the nerve of adding itself in too many places and even in my FF main menu, just after my bookmark menu button. Does the Scrapbook saved tabs are equal to my main FF Bookmarks?! I don't think so!

ScrapBook

Maybe I need to sell my Ferari, not that I own a Ferari (yet), you know, metaphorically speaking. Unplug the switch, disconnect, get a life, bring a hammer and break my laptop into tiny pieces. Wait, that's the company's laptop, I don't think they'll like that.

Anyway, this post has become quite of a rant and, I would finally say that tab surfing is a too good feature, maybe I was better off without it, but it's here to stay and I'm not gonna quit using it so I'd better find some way to complete it. I have all of these add-ons and more still installed and I'd let you know how it's working.