Archive for January, 2010

30
Jan

Czech PWNAG3?

By hinkydink 0 Comments
Categories: Uncategorized

In just one run today there were a slew of Czech proxies, all on the 77.104.212.0/24 subnet, all on port 8080, all transparent, and the property of this ISP.

But with a ping time of 230+ milliseconds, nothing to write home about.  I’ve used a lot of Czech proxies in the past (hotels, Internet cafes, educational institutions, et cetera), but they’ve always been faster than that.  230ms is pathetic.

And if you telnet to them they’re running good old Mikrotik, so they must be some sort of residential or public access devices.

And yes, I checked.  They’ve changed the default password.  Dang.

Business seems to be picking up lately.  I added a new “supplier” a couple of weeks ago and it seems to be good for at least a page per day of new proxies.  A lot of these are Euro Zone proxies.  And a lot of them seem to be running Mikrotik Httproxy.

Coincidence?

Yeah, probably.

But it sure is nice having some perky German, Spanish, French, and Italian proxies again.  It’s just like the Old Days.  There’s even some UK proxies in there for the Cameroonians, who seem to have deserted me lately.

They’re not the only ones.  Traffic to the List has dropped off precipitously since November.  I’m down to a tenth of the traffic I had back then.  That would probably piss me off if I were depending on ad revenue but I don’t so it doesn’t.  These things are just cyclical.  Always have been, always will.

I’ve been waiting for another Bahrain-like incident.  Last summer we had the Canadian Health Care problem, which was fixed fairly fast.  Then there was the Macau Madness last April.  Koobface wasn’t exactly the same kind of thing, since it was a malware infection.

No, this Czech thing, like Bahrain and CHC, is more like a massive “Ooops”.  Shit happens.

I don’t expect it to last and since it’s a Class C subnet I don’t expect it to spread much.  Time will tell.

21
Jan

Technical Difficulties

By hinkydink 0 Comments
Categories: Uncategorized

Once again there was another power dip and the gateway died. After that the netfilter ftp modules failed to insert and all the page updates died.

Things should be back to normal around 10AM EST.

19
Jan

Top Ten CHOKED

By hinkydink 0 Comments
Categories: Uncategorized

I just noticed the Top Ten list died on Sunday.

Sunday was a Bad Day.  Among other things, the power “dipped”.  Although it’s been on a UPS for years, for some reason this didn’t save the router/gateway/UT99 server known as “BOT House” from dieing.  The proxy project VM, which is not power protected, failed to hook up with an NFS share exported by that system when it came back up.  This effectively killed the Top Ten list.

So I added Yet Another Cron Job to check to make sure the NFS drives are always attached (making sure to include the FUCKING BLANK LINE AT THE END OF THE FILE that always screws me over with cron – grrrrrr).

It will probably be back to normal later today.  Right now it has a dupe line in there but I really don’t want to mess with it now.

16
Jan

OpenVPN Via Proxy

By hinkydink 0 Comments
Categories: Uncategorized

I’ve been running OpenVPN for about eight years.  Besides being a World Renown Proxy Expert, I am also the King of Covert Tunnels.

Lately, I have been doing most of my tunneling through ssh, primarily because it’s simple to set up multiple backup tunnels, whereas with OpenVPN you usually have just one.  In fact, I switched from OpenVPN tto ssh tunnels because over the years I’ve had nothing but problems (many of my own making) with OpenVPN.

The first time I used OpenVPN (version one-point-something) I set it up through the proxy at my workplace.  It RAWKED for about three years.  Then one day the network folks did an “upgrade” to the network and it all went to Hell.

Before the upgrade I was getting a 35-45ms ping through the OpenVPN tunnel.  After the upgrade it went to 150ms, which is about the speed of dialup.  At that time I switched over to running OpenVPN over UDP, which is actually a better way to go from a performance standpoint, but it’s extremely hard to get the proper UDP ports open without explicitly asking for them (at which point it’s no longer a covert tunnel – that takes all the fun out of it!).

And now, we have an ISA 2004 server (originally I used – or rather was forced to work with -MS Proxy 2.0 and ISA 2000).  The ISA firewall client (FWC) is handy since we can’t use “SecureNAT”, but it doesn’t work on Linux (which was why I used the proxy in the first place).

I solved that by hijacking an Open Source UDP proxy (originally written as an Unreal Tournament utility) and porting it over to Windows as a service.  That way, I could bounce the OpenVPN UDP packets from the Linux box through my XP workstation and on to the ISA firewall service, using my logged in account for authentication.  The ping over the tunnel dropped down to 25ms, faster than it ever was over the ISA proxy (which is a completely different thing from the ISA firewall service, a fact I can’t seem to get through my fellow security coworkers’ thick skulls).

That worked well, and there were already some streaming media UDP ports open, but I never hacked any failover into the the UDP proxy service.  The OpenVPN connection would simply die every now and then and the service would have to be restarted.

One thing led to another and I started using ssh tunnels for the sole purpose of connecting back to my workstation just to restart the UDP proxy and OpenVPN.  And I was running all the ssh tunnels through the ISA proxy, so I was basically back to where I started from.

Eventually, I installed redundant backup ssh tunnels and installed logic to switch proxies in case of an outage and started using the OpenVPN tunnel less and less.

And besides, the performance of the ssh tunnels was as fast as the OpenVPN connection over UDP anyway!  The only issue was the forwarding of ungodly numbers of ports.

Another initial problem was the “robustitude” of the ssh connections, as PuTTy users may already know (PuTTy’s stability is non-existent through a proxy).  An idle proxy connection is kicked after two minutes on ISA server.  You have to use the connect-proxy utility (source code here) to keep the tunnel up and running.  Note to Cygwin hacks: connect-proxy compiles nicely on Cygwin.

Why compile it?  Why not use the package?  I have a little “Secret Sauce” – three or four lines of C code – I add that helps me fly under the radar, so my version is “special”.  wink wink

Anyway, sometime last year OpenVPN went commercial, but they still offer the “community version” so I decided to give it a shot.

I decided to run it over the ISA proxy, primarily because of the Secret Sauce I have developed.  I hacked the sauce into the OpenVPN code, compiled, and installed.  The results were similar to what I got eight years ago, but this time 25-45ms pings!

This has gone so well I’m considering trashing the UDP OpenVPN connection permanently.

Or at least leaving it dormant as a potential emergency backup.

After all, I’m all about proxies!  That’s how I roll!

12
Jan

I Suppose I Should Be Flattered But…

By hinkydink 0 Comments
Categories: Uncategorized

As I have mentioned several times before, I leverage Google News Alerts to keep track of my “brand”.  Well, today I got a doozy…

Isn’t that sweet!  Someone took my Websense hack from 2007 – which I’m very proud of but sadly no longer works – and made linkbait out of it!

The link itself is weird.  Unfortunately (?), the domain name potokovoe.100webspace.net resolves to 127.0.0.1 (a.k.a. “localhost” for you newbs out there), so when I clicked on it nothing happened.

No problem.  Just check Google’s cache, right? Well, when I did that, this is what I got redirected to…

DOH!

I hate when that happens!  Especially because it never happens to me.  Normally I’m cruisin’ the Interwebs with Firefox & NoScript, but not this time!  Caught with my pants down and ass hangin’ out.

At least it wasn’t Internet Exploder or I’d probably be seriously pwn3d by now (if you can’t tell just by looking, it’s Google Chrome).

I’m not quite sure how I should feel about this.  On one hand, it’s cool to be Web-famous enough for some malware scammer to be using me for SEO (I do have the #1 Google search for “Websense Policy Bypass”, thank you), but on the other hand now my Brand Name is associated with fucking malware!  I suppose the FBI/DHS/CIA has my number now.

Dang.

What did I do to deserve this?  I suppose it has something to do with all the .ru blog SPAM I’ve put in the trash since I started this site because I’m certain the Cameroonian puppy scammers would never pull that kind of bullshit.

So listen guys, I’ll run your SPAM if that’s what it takes to stop this crap, but if this shit keeps up I’m going to have to start charging royalties.

10
Jan

R.I.P. Proxy4Free.com

By hinkydink 1 Comment
Categories: Uncategorized

Actually, it’s not quite dead yet.

Proxy4Free has jumped onto the CGI proxy bandwagon, most likely for ad revenue reasons.

What the Hell, you gotta eat.

And why not?  For the last few years all they’ve published is dead proxies anyway.  In fact Proxy4Free is probably more alive than it has been in years, since everybody and his brother has hopped onto the CGI proxy gravy train for exactly that reason.  And of course since nobody cares about Old School proxies anymore.

It’s never been a secret that I based the layout of The List on Proxy4Free’s old layout, although I never came out and said it before.

Proxy4Free was the first proxy list I ever scraped and the first proxy list that ever disappointed me.  Since The List started I’ve scraped it every night during the 4AM run.  There are probably tens of thousands of (dead) proxies in the database that were originally posted on Proxy4Free.

Now there’s no point.

A moment of silence, please.

09
Jan

Choked Up

By hinkydink 0 Comments
Categories: Uncategorized

Three posts today… a new record.

The VM that runs the project was choking when I woke up this morning.  In fact it appears it’s been choking for a few weeks on the 4AM run.  There was about a week’s worth of 4AM runs running and the box was really bogged down.

I should have seen this coming, because up until a few weeks back, the hourly runs were published usually no more than a couple of minutes after the hour and they had slipped to ten or twelve past the hour.

I stumbled on this while checking the status of the proxy judges with a few ad hoc MySQL queries that took way too long to run.

What I found out during that exercise was that a handful of my proxy judges had gone dark.

This is not good and cause for a certain percentage of false negatives.

So I dug up and verified a whole new batch of judges (on of these days I’m going to publish My Dirty Little Secret about proxy judges – you’re going to love it), rebooted the VM, fixed the issues with the 4AM run, and started resurrecting dead proxies.

Hopefully things will pick up next week.

09
Jan

nginx

By hinkydink 1 Comment
Categories: Uncategorized

If you do any kind of hacking around with Web sites, nginx (“Engine X”) is an awesome Web server.

I do most of my keyboard-banging through a residential ISP, so I’m not technically allowed to run any kind of Web server at my end of the pipe, but I do bang the keyboard from work as well (and I’m not technically allowed to do that, either, so don’t tell anyone).  I run a few Web sites from behind my residential IP address just for educational purposes (my own education).

I decided I needed to educate myself after reading that nginx had plowed it’s way to the #3 spot behind IIS and Apache back in December (it may have happened before that – I just happened to read about it in December).

So I downloaded it and compiled it.  After I set it up and got it working, I shut down Apache for good.

Adios, old friend.  Time has come to part.

What I like most about nginx is its utter simplicity.  They tell me it’s fast as well, but I have it installed on an 800 mHz PIII, so I wouldn’t know (however, it is “fast enough”).  The WordPress sites I’m running – educationally – are served up by nginx, with the MySQL backend on the same virtual machine that runs the proxy project.  At the present time, they are served to a limited set of IP addresses via SQUID reverse-proxy, but this is going to change as soon as I can set up an nginx reverse-proxy on that particular box.

If you’re looking for technical tips and HOWTOs, I’m too much of a beginner to go that deep right now (but I will say watch out for the quick setup guides you can find online – they leave out important stuff in the example configs).  My goal is simply to gush over nginx and tell you how wonderful it is.  It is extremely simple, and if you have an IQ over 85 it should be a snap to set it up.

If you don’t have an IQ over 85, stick with IIS.

09
Jan

ReDoable Haxx

By hinkydink 0 Comments
Categories: Uncategorized

I have been hacking around with a local copy of Proxy Obsession on an old Linux box I had lying around collecting dust.  The result of this hacking (shown below for those who can’t see it) is visible if you are coming through a transparent proxy.

That is, if your request comes through with a “Via:” header.

If not you should see the standard ReDoable theme.

This is a re-hack of the “Get Firefox” feature – and I use the term “feature” loosely – of this WordPress theme.  Theoretically, you can shut the Get Firefox feature off – there is an option on the theme’s configuration page – but it does not work worth a diddly-damn.  It simply bothers any idiot running any version of Internet Explorer to “upgrade” to Firefox 2.0 (yes… two-dot-oh… very old school).

In fact, at first I hacked that “feature” out by hand, before I discovered the option in the config to kill it.  So I un-hacked it and turned it off, which was when I discovered it didn’t fucking work.  Rather than fixing it (not my job), I hacked it around to dig out proxy information from your connection.

Although it’s a nice piece of work, there’s a lot about the ReDoable theme I do not like.  The broken Firefox feature was bad enough.  I hate justified text.  I prefer raggedy-ass right.  This insane preoccupation with justified text has a problematic side-effect: when the last character on the right is a period, the first character on the left on the next line is a space, which fucks up the entire reason for justifying the text in the first place.

And, there is way too much air between the lines – finding the right amount is tricky – and the author has this extremely annoying habit of converting all the headers to FUCKING LOWER CASE.

GAWD that’s aggravating.

I’LL USE ALL CAPS WHEREVER AND WHENEVER I WANT TO, BEOTCH!!!!

I thought about putting more proxy info in the new header, but without poking your proxy back when it hits me there’s really not much more I can do than detect a transparent proxy.  This, of course, is a lie.  The truth is I’m just too damned lazy.