Archive for October, 2008

08
Oct

Hacked by Microsoft?

It’s the day after Patch Tuesday, and I swear I shut Automatic Downloads off, but the server went down and hasn’t come back up yet.

I’m at work now and slightly blind, but I can tell it was a controlled shutdown because the PuTTy shell I had open declared it so before it died.

I saw a single report about continuous rebooting after yesterday’s patches and I’m hoping that’s not what happened.

I knew I was going to regret complaining that this project was getting boring.

05
Oct

Maintenance Mode

I’ve been in class all week.  A worthless CompTIA Security+ class our CSO forced us all to take.  100% Windows-centric. 

I learned nothing new and reinforced my belief that security “professionals” are know-nothing blowhards and that those who can’t, teach (and we all know those who can’t teach, manage).  The only thing I got out of the class was three licensed Windows 2003 Server VMs (I copied them over the Net during class and converted them from VirtualPC to VMWare in the evening).  Not sure what I’ll do with them, but I have them nonetheless.

Although I had all my remote tools, I only ran a few purge/rescan cycles and the system took care of itself for the duration.  It is so dependable it’s getting boring.  I need a new project (and yes I haven’t forgotten the SOCKS issue), something to make this new and exciting again.  I’m seriously thinking of moving it all over to the AMD64x2 system, which is faster, quieter, and sucks much less power than this aging P4 monster.  Unfortunately, the AMD box is my MythTV project, which is almost ready to go into production mode.

Meanwhile, I’m still eating my own dog food.  I found a nice little TurkTeleKom transparent proxy that’s been alive for a few weeks now.  Turkey has never let me down.  Their proxies are always fast (enough) and they tolerate you for a long time.   You definitely need a Turkish translator to decode the proxy error messages.  Here’s one that’s a real head-scratcher…

Address is dominated by a mistake and stood at the following: * Banned Access to [URL]. You want to control access to information from your reservations. If you possibilities that the desired access to information, please contact contacted about service provider.

The strangest sites are banned for no apparent reason.  For instance, I often like to badger – via proxy of course - a harmless geek (and former co-worker) who runs an “I’m so cool” .Net development blog – the guy is a complete nobody but the Turks have banned his hosting provider.  Other sites that are normally banned in, say, Saudi Arabia, are fine with the Turks.  It makes no sense.

If ypu were paying attention on the 3rd & 4th you may have noticed a slew of transparent German proxies popped up.  They were all out of Frankfurt Am Main and most had “.11″ in the last octet.  Some had proxies on multiple ports on the same address.  What was that all about?   They came from this German ISP and disappeared as quickly as they showed up.

I love a good mystery!