Lowyat.NET: Latest topics by da3shou3

Latest Security Risk on iOS 7 & 8 - Masque Attack

da3shou3 — Tue, 11 Nov 2014 22:54:27 +0800

Masque Attack, articles from all over the web:
http://www.theregister.co.uk/2014/11/10/ios_masque_attack/
http://thenextweb.com/apple/2014/11/10/ios...nes-data-theft/
http://9to5mac.com/2014/11/10/masque-attac...law-wirelurker/
http://www.macrumors.com/2014/11/10/masque...-vulnerability/

More details in technical (from FireEye, the security firm who released vulnerability information):
http://www.fireeye.com/blog/technical/cybe...long-to-us.html

In short, iOS doesn't enforce matching certificates for apps with the same bundle identifier (which is a unique string used by OS to identify an app to a device). Combining that with the behavior of iOS where app's local data wasn't removed when the original app was replaced, allowing malicious app to disguise and access that data leading to leakage of sensitive information (e.g. credit card number, passwords, social security number).

iOS version is so far identified to be affected: 7 & 8.

As precaution, do not install app from unknown sources, especially from SMS and e-mail which is the usual channel to exploit social engineering.
Non-jailbroken devices can be attacked using enterprise provisioning profiles in this manner.
(No this doesn't only affect enterprise users as there are services out there like testflightapp.com which attackers can leverage to obtain a signed IPA package)

Login Page

da3shou3 — Thu, 06 May 2010 15:23:46 +0800

I just realize we've been transferring clear text over the network when I did login again today.

Is LYN plan to implement some sort of security on its login page? E.g. TLS/SSL.

Late Night Supper

da3shou3 — Sat, 03 Apr 2010 03:11:42 +0800

Was hungry in the middle of the night so I made myself supper.

Inspired by and in response to Goldy's recent post, so I thought I shoot my food too.

Photos are taken using D40 mounted on a tripod with ISO 200. No flash fired cause I sux at it. As usual, C&C are utmost welcome.

» Click to show Spoiler - click again to hide... «

Crispy Ikan Bilis~!

» Click to show Spoiler - click again to hide... «

Yum Yum.

And a by-product while preparing the food..

» Click to show Spoiler - click again to hide... «

Question about PayPal

da3shou3 — Mon, 08 Dec 2008 22:06:52 +0800

I'm not sure if this is the appropriate section to ask. But anyway, here's my question:

Let's say if you registered a paypal account and you linked it with a verified credit card, when you make purchase using that paypal account which in turn bill it to your credit card, what will show up in your credit card statement?

The exact item name or some paypal random codes?

WD MyBook, Firewire & Vista x64

da3shou3 — Fri, 08 Aug 2008 16:29:02 +0800

Hi all,

Does any of you happen to own a WD MyBook (Home Edition), able to connect the device using Firewire 400 (4-pin to 6-pin cable) to a Vista x64 machine and have it work without problem?

I'm using a laptop here and I don't have other PC with Firewire port to test 6-pin to 6-pin cable connectivity.

My laptop seems unable to detect that external hard drive when connected through Firewire 400 using 4-pin to 6-pin cable (checked in device manager, nothing shows up).

That external hard drive when connected through USB to my laptop (Dell M1330) on the other hand works fine.

My laptop (Dell M1330) comes with Ricoh OHCI Compliance IEEE1394 Host Controller. It is running Vista x64 with SP1.

Any thought/idea/solution?

绝对SHOWTIME校园爆唱赛

da3shou3 — Thu, 10 Jul 2008 16:36:27 +0800

01

02

03

04

05

06

07

08

09

10

(Product) Red Vista

da3shou3 — Fri, 06 Jun 2008 00:02:36 +0800

Hi all,

Does anyone know if the (Product) Red version of Vista that come with some Dell units is the retail or OEM equivalence?

Ebay - COD?

da3shou3 — Wed, 04 Jun 2008 20:50:24 +0800

Hi all,

Personally I have never used Ebay before. There's one item I saw with the CoD option for the payment.

I wonder how it works?

Appreciate if someone can explain in details.

Questions About HDR

da3shou3 — Thu, 03 Apr 2008 23:29:55 +0800

Now, we all know that to perform PP for HDR, we need multiple exposure.

Let says if you shoot in RAW. Do you still need multiple actual shoots of different exposure time or you can actually just generate the images from one RAW shoot with different EV values?

Which is is better? Or why is it necessary to take multiple actual shoots?

Problem installing Snortalog GUI

da3shou3 — Tue, 29 May 2007 15:24:10 +0800

I'm a starter for linux and recently got myself into IDS analyzer. I've found this Snortalog that can summarize firewall logs into something informative. However, I was able only to run it using terminal with text only. There's a GUI for it but I ran into trouble compiling/install the dependencies.

It requires Tk and Tk-Perl which I was not able to install. There's some error when I tried to install. The error is in the spoiler section.

» Click to show Spoiler - click again to hide... «

How can I get pass/fix this error?
Anyone with successful installation experience in Debian-based linux (e.g ubuntu)?

I could use some help here.

For the list of requirements or dependencies for anyone wanna try help you can refer to http://jeremy.chartier.free.fr/snortalog/

[addedon]May 30, 2007, 12:20 am[/addedon]Anyone?

Warcraft 3: Playing games over VPN built over Internet

da3shou3 — Fri, 15 Apr 2005 08:56:29 +0800

This is the email that I sent them yesterday.

QUOTE

Hi,

Recent, I found that there are people playing games on private
networks that resembles LAN created using VPN and this issue was
discuss in one of the forums that I visited. Since the VPN itself is
legal technology, but with VPN, games played on LAN-like networks that
build on top of the Internet somehow confused me about the legal
issues which is included in Blizzard's website.

"Does Blizzard Entertainment® allow or support other Battle.net® like
or emulation servers? Can I host one of these rogue servers?

No. Except as set forth in the next paragraph, Blizzard Entertainment®
does not support or condone network play of its games anywhere but
Battle.net®. Specifically, you may not host or provide matchmaking
services for any of our games or emulate or redirect the communication
protocols used by Blizzard Entertainment® in the network feature of
its games, through protocol emulation, tunneling, modifying or adding
components to the game(s), use of a utility program or any other
techniques now known or hereafter developed, for any purpose
including, but not limited to network play over the Internet, network
play utilizing commercial or non-commercial gaming networks or as part
of content aggregation networks without the prior written consent of
Blizzard Entertainment®. "

- taken from http://www.blizzard.com/legalfaq.shtml

Now with that, perhaps Blizzard can provide some guidelines and give
me some clearer explanation of whether the senario I provide above
legal or not.

Regards,
da3`shou3

And I got this reply from them

QUOTE

Hi there,

You are allowed to play over a LAN with friends but connecting to a third party server that emulates battle.net code is illegal. These servers are shut down as we find them. If you are playing with a set group of friends and connecting to a game hosted by a friend you will have no problems. It is when people host servers and start advertising or something similar attempting to make a profit where it becomes illegal most of the times.

There are too many legal questions that can arise and I am not qualified to answer them all but if you just play with your friends, whether you host the game yourself or another friend does there shouldn't be any problems.

Regards,
Peter N
Blizzard Entertainment