[08/10] Linux Security Summit 2010 slides published

I've updated the papers section of the site to include my slides from the Linux Security Summit 2010. The title of the presentation was "Linux Security in 10 Years". In the presentation, I demonstrated the threat of kernel exploitation, how kernel exploitation subverts access control/container-based security, the need to have a broader view of system protection, in particular the need for kernel self-protection.

# grsecurity

Havij v1.13 Advanced SQL Injection

Description:

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetching data from the database, running SQL statements and even accessing the underlying file system and executing commands on the operating system.

The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.

The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.


What's New?

* Oracle error based database added with ability to execute query.
* Getting tables and column when database name is unknown added (mysql)
* Another method added for finding columns count and string column in PostgreSQL
* Automatic keyword finder optimized and some bugs fixed.
* A bug in finding valid string column in mysql fixed.
* 'Key is not unique' bug fixed
* Getting data starts from row 2 when All in One fails - bug fixed
* Run time error when finding keyword fixed.
* False table finding in access fixed.
* keyword correction method made better
* A bug in getting current data base in mssql fixed.
* A secondary method added when input value doesn't return a normal page (usually 404 not found)
* Data extraction bug in html-encoded pages fixed.
* String or integer type detection made better.
* A bug in https injection fixed.

How to use

This tool is for exploiting SQL Injection bugs in web application.

For using this tool you should know a little about SQL Injections.

Enter target url and select http method then click Analyze.

Note: Try to url be valid input that returns a normal page not a 404 or error page.



Licence

The free version of Havij is free software. We hope it be useful for you.
This software is provided "as is" without warranties.
Feel free to share and distribute it anywhere but please keep the files original!

There is a commerical version of Havij that is not free.
To purchase Pro version of Havij please visit Here


Disclaimer

We are NOT responsible for any damage or illegal actions caused by the use of this program. Use on your own risk!

Follow the link below to download Havij 1.13 free version:

Havij v1.13 Free (MD5 checksum: 276a84bda58a9def55eef35bf2838a77)


#indonesiancoder.com

How do I update Ubuntu Linux softwares?

Q. I have latest version of Ubuntu Linux. How do I update Ubuntu Linux for security and application fix or upgrades?

A. Ubuntu Linux can be upgraded using GUI tools or using traditional command line tools.

Using apt-get command line tool

apt-get is the command-line tool for handling packages. You can use following command options:

=> apt-get update : Update is used to resynchronize the package index files from their sources via Internet.

=> apt-get install package-name : install is followed by one or more packages desired for installation. If package is already installed it will try to update to latest version.

a) Open terminal and type following two commands (Application > Accessories > Terminal):

b) Get update software list, enter:

tukulesto:~# sudo apt-get update

c) Update software(s) i.e. apply updates:

tukulesto:~# sudo apt-get upgrade

d) Please note that above two command will fetch files from Internet. The location of update pages is specified in /etc/apt/sources.list (repositories). You need NOT to make any changes to this file until and unless you need extra repositories for your setup.

e) To upgrade individual software called foo type command:

tukulesto:~# sudo apt-get install foo

Using Ubuntu Update Manager tool

This is GUI tool. It works like Microsoft / Red Hat update manager i.e. you will see a little icon in the kicker bar/taskbar when there are updates. It will only appear when new upgrades are available. All you have to do is click on it and follow the online instructions.

You can also start GUI tool by Clicking System > Administration > Update Manager

That's all.

Regards

Don Tukulesto

# www.indonesiancoder.com

Remove an old Ubuntu Kernels

Someone has asked to me "how to remove old Ubuntu Kernels"

Every time Ubuntu installs a new Linux kernel, the old one is left behind. This means that if you are regularly updating an Ubuntu system the Grub boot menu becomes longer and longer with kernels you don’t need anymore.

The old kernels are deliberately left installed and on the menu so you can boot a previous kernel if you have trouble with a new one. But if the new one works, you can safely uninstall the old kernel, which will also result in the Grub menu being cleaned up.

First you need to find out what your current kernel is. Open a terminal and run the following command:

uname -r

It will print the version of the Linux kernel you are running, this is the one you want to keep. It should look something like this:

2.6.31-14-generic

This is the old trick, you just open the Synaptic package manager from the System->Administration menu.

Click the “Search” button on the tool bar and search for linux-image-2.

The results should show every available and installed kernel. A green box on the left indicates that the package is installed. The only linux-image you want installed is the latest one. Find the package corresponding to the kernel to you running currently (this is the kernel you found in the terminal window). Make sure you keep that one. Now you can uninstall the old kernels from the list by clicking their boxes and selecting “Mark for Removal”.

Caution! Be careful of what you remove. Ensure that you don’t remove your current kernel, or anything that is not a linux-image. It is possible to break Ubuntu if you remove the wrong kernel.

Click the apply button on the tool bar to complete the changes.

Your computer and Grub menu should now be free of old kernels.

That's all.


# www.indonesiancoder.com

Broadcasting from your own server: Setting up the SHOUTcast Radio DNAS Application

This tutorial is recommended for advanced users.

If you chose to setup your own server, you will need lots of bandwidth and a stable connection to the Internet. What do we mean by "your own server"? By that we mean a computer host, usually a pretty powerful one, which you can use to serve websites from. In that regard, a SHOUTcast server will be responsible for identifying in the SHOUTcast Radio Directory your radio to your listeners.

Downloading the SHOUTcast DNAS application and setting up your server should take approximately 45 minutes of your time, but may take longer depending on your level of technical expertise.

Ready? Let's get started:

Installation instructions for each platform are below:

Windows 98/ME/2000/XP:

1. Download the SHOUTcast DNAS application for Windows by proceeding to this link
2. Once the download has finished, extract all the files into a folder and create a shortcut for SC_SERV.EXE on the Desktop.
3. Start up the SHOUTcast Radio server by double-clicking on SC_SERV.EXE
4. Click on the "Edit Config" menu option located at the top. This will start the default text editor, opening the configuration file for SHOUTcast DNAS application. Follow all the directions that are written into the configuration file.
5. Once you are done making changes, save the file, close the editor, and restart the SHOUTcast Radio DNAS application.

UNIX, LINUX, FreeBSD and MAC OSX:

1. Download the SHOUTcast DNAS application version appropriate to your system by proceeding to this link.
2. Gunzip the distribution and un-tar the archive.
3. Use a text editor to configure the sc_serv.conf file (Please see the SHOUTcast DNAS application section of the Documentation page for more information on what each field in this config file means ).
4. Note that the user you run the server as requires read access to the config file, and write access for the files you define for file storage and log storage.

The configuration parameters and what they all mean, including how you can choose whether to make your station public are explained in the Documentation.

GLOSSARY of Terms

SHOUTcast Radio DNAS - The SHOUTcast Distributed Network Audio Software (DNAS) is a software application that you install on your computer server that handles the actual streaming of your internet radio station content out to listeners.

SHOUTcast Radio DSP - Software plug-in for Winamp that is used to broadcast your Winamp playlist or a live source.

# www.indonesiancoder.com

Broadcasting through a third-party server or stream hosting solution: Using Winamp with the SHOUTcast Radio DSP Plug-in

If you would like to start your own internet radio station without the hassle of running your own server this is the solution for you. You can host your radio broadcast through a willing third party that will handle the actual streaming for you, leaving you to only worry about what you want to play on your internet radio station! You can search the Internet for the streaming host solution that fits you needs and your budget.

Once you have a streaming host in place, you can use the Winamp media player along with the SHOUTcast DSP plug-in to start broadcasting. This plug-in is responsible for sending the audio source feed of your internet radio station to your streaming server, from where it is broadcasted out to your listeners.

Instructions - Windows

1. Download Winamp by going to the Winamp site or here.

2. Download the SHOUTcast Radio DSP plug-in for Winamp. The DSP plug-in is available here.

3. Once you have downloaded the SHOUTcast Radio DSP plug-in, close Winamp if its already running and double-click the installer file that you downloaded in step 2 above, and follow the onscreen instructions to install.


4. Start Winamp and open Preferences (CTRL-P) and click on the DSP/effects subcategory under the Plug-ins tree. See below for example:



5. Once you have the SHOUTcast Radio DSP plug-in setup and properly configured, it will broadcast whatever is currently playing on Winamp on your internet radio station in real time!Please refer to the README that comes with the DSP installer for more instructions on how to use the SHOUTcast Radio DSP, including how you can chose whether to make your station public (i.e., list on the SHOUTcast Radio directory).

Instructions - Unix, Linux & MAC OSX

Not a Windows or Winamp user? Don't worry, we've got you covered! For our advanced users on Mac OS X, Linux and Unix, the UNIX/Linux version of the SHOUTcast Radio DSP permits input from a soundcard in addition to MP3 files on disk. Please refer to the example .conf file included with the archive for more information. Please note that this method of broadcasting is currently in beta and therefore unsupported. Please use at your own risk. Download the SHOUTcast Radio DSP for Unix/Linux/MAC OSX here.


# www.indonesiancoder.com

Task Manager User Name column is empty (username at task manager)

When you open Task Manager, the User Name field might be blank, as shows in the Fig. This happens if the Terminal Service is not started. The default startup type for this service need to be set to Automatic and it must be started. Follow this procedure:

* Click Start, Run and type Services.msc
* Locate Terminal Services and double-click it
* Set the Startup type to Automatic, and click Apply
* Click the Start button to launch the service manually.
* Now Task Manager User Name field will show up.



# www.indonesiancoder.com

How to edit the Boot.ini file in Windows XP

Save a Backup Copy of Boot.ini

1. Right-click My Computer, and then click Properties.
-or-
Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, click Settings under Startup and Recovery.
3. Under System Startup, click Edit. This opens the file in Notepad ready for editing.
4. In Notepad, click File on the Menu bar, and then click Save As.
5. Right click in an empty area of the Save As dialog box, point to New in the context menu, and then click Folder.
6. Type a name for the new folder, for example temp, and then press the ENTER key to create the folder named temp.
7. Double-click the new folder named temp, and then click the Save button to save a backup copy of the Boot.ini file.

Edit the Boot.ini File
To view and edit the Boot.ini file:

1. Right-click My Computer, and then click Properties.
-or-
Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, click Settings under Startup and Recovery.
3. Under System Startup, click Edit.

Sample Boot.ini File
This is a sample of a default Boot.ini file from a Windows XP Professional computer.

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

This is a sample of the above Boot.ini file with a previous installation of Windows 2000 on a separate partition.

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Professional" /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINNT="Windows 2000 Professional" /fastdetect

Modifying the Boot.ini
While you can modify the Boot.ini file using the Startup and Recovery dialog, where you can select the default operating system, change the timeout value, or manually edit the file, the following method uses the command line utility, Bootcfg.exe.

Note The Bootcfg.exe utility is only available in Windows XP Professional. This utility is not available in Microsoft Windows XP Home Edition. Therefore, this section does not apply to Windows XP Home Edition.

1. Click Start, and then click Run.
2. In the Open text box, type cmd.
3. At the command prompt, type bootcfg /?.
4. The help and parameters for BOOTCFG.exe will display.

Adding an Operating System
At the command prompt, type:
bootcfg /copy /d Operating System Description /ID#
Where Operating System Description is a text description (e.g. Windows XP Home Edition), and where # specifies the boot entry ID in the operating systems section of the BOOT.INI file from which the copy has to be made.


Removing an Operating System
At the command prompt, type:
bootcfg /delete /ID#
Where # specifies the boot entry ID that you want to be deleted from the operating systems section of the BOOT.INI file (e.g. 2 for the second Operating system that is listed.


Setting the Default Operating System
At the command prompt, type:
bootcfg /default /ID#
Where # specifies the boot entry id in the operating systems section of the BOOT.INI file to be made the default operating system.


Setting the Time Out
At the command prompt, type: bootcfg /timeout# Where # specifies the time in seconds after which default operating system will be loaded.


Open the Boot.ini File to Verify Changes

1. Right-click My Computer, and then click Properties.
-or-
Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, click Settings under Startup and Recovery.
3. Under System Startup, click Edit.


# www.indonesiancoder.com

NTLDR is Missing

Issue:

NTLDR is Missing.

Related errors:

Below are the full error messages that may be seen when the computer is booting.

NTLDR is Missing
Press any key to restart

Boot: Couldn't find NTLDR
Please insert another disk

NTLDR is missing
Press Ctrl Alt Del to Restart

Cause:

1. Computer is booting from a non-bootable source.
2. Computer hard disk drive is not properly setup in BIOS.
3. Corrupt NTLDR and/or NTDETECT.COM file.
4. Misconfiguration with the boot.ini file.
5. Attempting to upgrade from a Windows 95, 98, or ME computer that is using FAT32.
6. New hard disk drive being added.
7. Corrupt boot sector / master boot record.
8. Seriously corrupted version of Windows 2000 or Windows XP.
9. Loose or Faulty IDE/EIDE hard disk drive cable.

Solutions:

Computer is booting from a non-bootable source

Many times this error is caused when the computer is attempting to boot from a non-bootable floppy disk or CD-ROM. First verify that no floppy diskette is in the computer, unless you are attempting to boot from a diskette.

If you are attempting to boot from a floppy diskette and are receiving this error message it is likely that the diskette does not have all the necessary files and/or is corrupt.

If you are attempting to install Windows XP or Windows 2000 and are receiving this error message as the computer is booting verify that your computer BIOS has the proper boot settings. For example, if you are attempting to run the install from the CD-ROM make sure the CD-ROM is the first boot device, and not the hard disk drive.

Second, when the computer is booting you should receive the below prompt.

Press any key to boot from the CD

Important: When you see this message press any key such as the Enter key immediately, otherwise it will try booting from the hard drive and likely get the NTLDR error again.

Note: If you are not receiving the above message and your BIOS boot options are set properly it's also possible that your CD-ROM drive may not be booting from the CD-ROM properly. Verify the jumpers are set properly on the CD-ROM drive. Additional information about checking the CD-ROM drive connections can be found on document CH000213.

Additional information: This error has also been known to occur when a memory stick is in a card reader and the computer is attempting to boot from it. If you have any type of card reader or flash reader make sure that no memory stick is inside the computer.

Computer hard disk drive is not properly setup in BIOS

Verify that your computer hard disk drive is properly setup in the BIOS / CMOS setup. Improper settings can cause this error. Additional information on how to enter the BIOS / CMOS setup can be found in document CH000192.

Corrupt NTLDR and/or NTDETECT.COM file

Windows 2000 users
Windows XP users

Windows 2000 users

If your computer is using Microsoft Windows 2000 and you are encountering the NTLDR error. Create the below boot.ini file on the floppy diskette drive.

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Professional" /fastdetect

Copy the NTLDR and NTDETECT.COM files from another computer using the same operating system. Both of these files are located in the root directory of the primary hard disk drive. For example, C:\NTLDR and C:\NTDETECT.COM should be the locations of these files on many computers.

*

Please keep in mind that these files are hidden system files, if you need additional help with viewing hidden files in Windows please see document CH000516.

Once these files have been copied to a floppy diskette reboot the computer and copy the NTLDR and NTDETECT.COM files to the root directory of the primary hard disk drive. Below is an example of what commonly should be performed from the A:\> drive.

copy ntldr c:
copy ntdetect.com c:

After the above two files have been copied, remove the floppy diskette and reboot the computer.

Windows XP users

1. Insert the Windows XP bootable CD into the computer.
2. When prompted to press any key to boot from the CD, press any key.
3. Once in the Windows XP setup menu press the "R" key to repair Windows.
4. Log into your Windows installation by pressing the "1" key and pressing enter.
5. You will then be prompted for your administrator password, enter that password.
6. Copy the below two files to the root directory of the primary hard disk. In the below example we are copying these files from the CD-ROM drive letter, which in this case is "e." This letter may be different on your computer.

copy e:\i386\ntldr c:\
copy e:\i386\ntdetect.com c:\

7. Once both of these files have been successfully copied, remove the CD from the computer and reboot.

Misconfiguration with the boot.ini file

Edit the boot.ini on the root directory of the hard disk drive and verify that it is pointing to the correct location of your Windows operating system and that the partitions are properly defined. Additional information about the boot.ini can be found on document CH000492.

Attempting to upgrade from a Windows 95, 98, or ME computer that is using FAT32

If you are getting this error message while you are attempting to upgrade to Windows 2000 or Windows XP from Windows 95, Windows 98, or Windows ME running FAT32 please try the below recommendations.

1. Boot the computer with a Windows 95, Windows 98 or Windows ME bootable diskette.
2. At the A:\> prompt type:

sys c:

3. After pressing enter you should receive the "System Transferred" message. Once this has been completed remove the floppy diskette and reboot the computer.

New hard disk drive being added

If you are attempting to add a new hard disk drive to the computer make sure that drive is a blank drive. Adding a new hard disk drive to a computer that already has Windows installed on it may cause the NTLDR error to occur.

If you are unsure if the new drive is blank or not try booting from a bootable diskette and format the new hard disk drive.

Corrupt boot sector / master boot record

It's possible your computer's hard disk drive may have a corrupt boot sector and/or master boot record. These can be repaired through the Microsoft Windows Recovery console by running the fixboot and fixmbr commands.

Additional information and help in getting into the Microsoft Windows Recovery console can be found on document CH000627.

Seriously corrupted version of Windows 2000 or Windows XP

If you have tried each of the above recommendations that apply to your situation and you continue to experience this issue it is possible you may have a seriously corrupted version of Microsoft Windows. Therefore we would recommend you reinstall Microsoft Windows 2000 and Windows XP.

If you are encountering this issue during your setup you may wish to completely erase your computer hard disk drive and all of its existing data and then install Microsoft Windows 2000 / Windows XP. Additional information about erasing the computer and starting over can be found on document CH000186.


Loose or Faulty IDE/EIDE hard disk drive cable

This issue has been known to be caused by a loose or fault IDE/EIDE cable. If the above recommendation does not resolve your issue and your computer hard disk drive is using an IDE or EIDE interface. Verify the computer hard disk drive cable is firmly connected by disconnected and reconnecting the cable.

If the issue continues it is also a possibility that the computer has a faulty cable, try replacing the hard disk drive cable with another cable and/or a new cable.


# www.indonesiancoder.com

Prevent DNS problems with this tip for Windows XP

When you visit a website, Windows XP tries to speed things up by placing the DNS information about that site, into a DNS cache on your PC.

This is OK until there are problems with the network, DNS server or even the website!

You see the DNS Windows XP cache stores BOTH negative and positive entries. The positive entries are those that the DNS lookup was successful and you could connect to the website.

Negative entries are those where the DNS lookup failed and you could not connect to the website.

A problem can arise here because if the DNS cache hold a negative entry and the website you want to view is now OK to view, Windows XP will still give you a DNS error!

By default these negative entries are cached for 5 mins. But we can tweak the registry to NOT store negative entries at all!

There is ALSO another potential pitfall with the Windows XP DNS cache...

Most ISP's and Domain name registrar's now update their DNS information (TTL) every 4 hours instead of the twice daily updates that were common few years ago.

This means that your DNS Windows XP cache may be out of date for certain entries!

So lets look at how we can tweak the registry to prevent these problems occurring:

Flush DNS

First of all it would be a good idea to flush the local DNS cache so we are starting with a clean sheet!

To do this simply enter: ipconfig /flushdns in a command prompt. You will then get the following window appear confirming the flush,



Successful DNS Flush

Now we have a clean DNS cache lets make the changes to the registry.


Block Negative Entries

To force Windows XP NOT to cache negative entries we need to add a new DWORD to the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters

DWORD: MaxNegativeCacheTtl

Value: 0

This will now ensure NO negative entries are stored.


Cache TTL

To force Windows XP to keep positive entries in DNS Cache for only 4 hours instead of the default 24 hours we need to apply the following change to the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters

DWORD: MaxCacheTtl

Value: 14400

NB - make sure you enter the 14400 (seconds) as Decimal Base and NOT Hexadecimal Base!

Now your registry key should look similar to this







VIVA INDONESIAN CODER TEAM
Fear Nothing. Risk Everything.

"This operation has been cancelled due to restrictions in effect on this computer."

A very common question in the Microsoft public newsgroups goes something like this:

When clicking on a hyperlink in an e-mail, I get this Message : "This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator." I get this message every time that I attempt to use the hyperlink. I am the administrator on this stand alone computer. How do I deactivate this feature so that I activate hyperlinks ?

This is not an Outlook error. The most common cause is a corrupt registry key in Internet Explorer 6. The registry key found at

HKEY_Local_Machine\Software\Classes\htmlfile\shell\open\command

is either damaged or corrupt.

To fix it, try resetting Web settings in Internet Explorer. If this does not resolve the issue, you'll need to import the registry key from another computer.

Reset Web Settings

To Reset Web settings

1. Open Internet Explorer.
2. On the Tools menu, click Internet Options.
3. Click the Programs tab, and then click the Reset Web Settings button.
4. Under Internet programs, verify that the correct e-mail program is selected.
5. Click to select the Internet Explorer should check to see whether it is the default browser check box.
6. Click Apply, and then click OK.

If you receive a message when Internet Explorer starts telling you that IE is not currently your default browser, click Yes to make it your default.

Import the Registry Key

When resetting the web settings doesn't help, you'll need to recreate the corrupt key. The easiest way to do this is by exporting the key from another computer.

To save exporting it from another computer, right click here to download a registry key exported from my computer. Choose Save target as and change the file extension from txt to reg and double click on it to run it.

If you prefer to use a key from a computer you have access to, follow the instructions in You receive an error message when you click a hyperlink in Outlook.

Set Program Access in Control Panel

Windows XP and Vista allow you to control program defaults through Control Panel, Add and Remove Programs, Set Program Access and Defaults. If the above methods fail, use this method to set the default browser.

Other Causes

There are several other causes of this error. In most cases, they do not affect hyperlinks in Outlook. If you found this page searching for the error message, check out the following pages. Note that if you receive this error on a computer at work, you should contact your administrator, they may want access to applications restricted for security reasons.

You receive the message when:
# Using Outlook 2002 SP3
# Trying to run a program
# Saving a document (Windows 2000)
# Accessing file open dialog
# Starting Windows Explorer

Search Microsoft (using Google) for additional articles

More Information

You receive an error message when you click a hyperlink in Outlook


VIVA INDONESIAN CODER TEAM
Fear Nothing. Risk Everything.

Make a PHP info file

This tutorial will show you how to display Apache PHP configuration.
It is useful in cases when you are going to install a particular application which needs specific requirements like register_globals or long_array turned On or Off.

This can be done by simply uploading one file, for example 'info.php' with the following code included inside:

// Print all information.
phpinfo();

// Output only the module information.
phpinfo(INFO_MODULES);

?>

create one text file with your favorite text editor like Notepad, then copy and paste the code above into it. Save the file for example like info.php and then upload it to your server.
Then you are ready type : http://yourdomain.tld/info.php and you should see a table with the current PHP configuration and module information.




VIVA INDONESIAN CODER TEAM
Fear Nothing. Risk Everything.

SSH Explorer SSH Client

SSH Explorer is a new generation SSH/Telnet client and terminal emulator that makes remote Linux server administration look like much more fun than it actually is.
File View panel lets you navigate through and operate with remote directories and files as effortlessly as if they were on your home computer.

The integrated text editor will be a great tool for people who don't like the awkward vi and emacs interface.

SSH Explorer also includes a pack of useful Linux commands and allows you to create your own snippets so you don't have to remember and type them anymore. VT100 terminal emulation, SSH1, SSH2 and Telnet protocols are supported.

PCWIN[dot]COM

VIVA INDONESIAN CODER TEAM
Fear Nothing. Risk Everything.

DALnet Servers

CA Servers

maple.ix.ca.dal.net
toronto.on.ca.dal.net

EU Servers

arcor.de.eu.dal.net
brain.hub.eu.dal.net
gaston.se.eu.dal.net
genesis-r.uk.eu.dal.net
matrix.de.eu.dal.net
mozilla.se.eu.dal.net
powertech.no.eu.dal.net
waffle.ix.eu.dal.net

AS Servers

hotspeed.sg.as.dal.net
mesra.kl.my.dal.net

US Servers

aeon.nj.us.dal.net
broadway.ny.us.dal.net
hollywood.ix.us.dal.net
jade.va.us.dal.net
jingo.ix.us.dal.net
loyalty.ix.us.dal.net
masters.ix.us.dal.net
novel.fl.us.dal.net
punch.va.us.dal.net
rangers.ix.us.dal.net
redemption.ix.us.dal.net
riga-r.ca.us.dal.net
rumble.fl.us.dal.net
serenity.ix.us.dal.net
soho.ix.us.dal.net
swiftco.wa.us.dal.net

dal.net


VIVA INDONESIAN CODER TEAM

Widows Shortcuts Part 2

Windows XP Shortcuts:

Code:
ALT+- (ALT+hyphen) Displays the Multiple Document Interface (MDI) child window's System menu
ALT+ENTER View properties for the selected item
ALT+ESC Cycle through items in the order they were opened
ALT+F4 Close the active item, or quit the active program
ALT+SPACEBAR Display the System menu for the active window
ALT+TAB Switch between open items
ALT+Underlined letter Display the corresponding menu
BACKSPACE View the folder one level up in My Computer or Windows Explorer
CTRL+A Select all
CTRL+B Bold
CTRL+C Copy
CTRL+I Italics
CTRL+O Open an item
CTRL+U Underline
CTRL+V Paste
CTRL+X Cut
CTRL+Z Undo
CTRL+F4 Close the active document
CTRL while dragging Copy selected item
CTRL+SHIFT while dragging Create shortcut to selected iteM
CTRL+RIGHT ARROW Move the insertion point to the beginning of the next word
CTRL+LEFT ARROW Move the insertion point to the beginning of the previous word
CTRL+DOWN ARROW Move the insertion point to the beginning of the next paragraph
CTRL+UP ARROW Move the insertion point to the beginning of the previous paragraph
SHIFT+DELETE Delete selected item permanently without placing the item in the Recycle Bin
ESC Cancel the current task
F1 Displays Help
F2 Rename selected item
F3 Search for a file or folder
F4 Display the Address bar list in My Computer or Windows Explorer
F5 Refresh the active window
F6 Cycle through screen elements in a window or on the desktop
F10 Activate the menu bar in the active program
SHIFT+F10 Display the shortcut menu for the selected item
CTRL+ESC Display the Start menu
SHIFT+CTRL+ESC Launches Task Manager
SHIFT when you insert a CD Prevent the CD from automatically playing
WIN Display or hide the Start menu
WIN+BREAK Display the System Properties dialog box
WIN+D Minimizes all Windows and shows the Desktop
WIN+E Open Windows Explorer
WIN+F Search for a file or folder
WIN+F+CTRL Search for computers
WIN+L Locks the desktop
WIN+M Minimize or restore all windows
WIN+R Open the Run dialog box
WIN+TAB Switch between open items

Windows Explorer Shortcuts:

Code:
ALT+SPACEBAR - Display the current window’s system menu
SHIFT+F10 - Display the item's context menu
CTRL+ESC - Display the Start menu
ALT+TAB - Switch to the window you last used
ALT+F4 - Close the current window or quit
CTRL+A - Select all items
CTRL+X - Cut selected item(s)
CTRL+C - Copy selected item(s)
CTRL+V - Paste item(s)
CTRL+Z - Undo last action
CTRL+(+) - Automatically resize the columns in the right hand pane
TAB - Move forward through options
ALT+RIGHT ARROW - Move forward to a previous view
ALT+LEFT ARROW - Move backward to a previous view
SHIFT+DELETE - Delete an item immediately
BACKSPACE - View the folder one level up
ALT+ENTER - View an item’s properties
F10 - Activate the menu bar in programs
F6 - Switch between left and right panes
F5 - Refresh window contents
F3 - Display Find application
F2 - Rename selected item

Internet Explorer Shortcuts:

Code:
CTRL+A - Select all items on the current page
CTRL+D - Add the current page to your Favorites
CTRL+E - Open the Search bar
CTRL+F - Find on this page
CTRL+H - Open the History bar
CTRL+I - Open the Favorites bar
CTRL+N - Open a new window
CTRL+O - Go to a new location
CTRL+P - Print the current page or active frame
CTRL+S - Save the current page
CTRL+W - Close current browser window
CTRL+ENTER - Adds the http://www. (url) .com
SHIFT+CLICK - Open link in new window
BACKSPACE - Go to the previous page
ALT+HOME - Go to your Home page
HOME - Move to the beginning of a document
TAB - Move forward through items on a page
END - Move to the end of a document
ESC - Stop downloading a page
F11 - Toggle full-screen view
F5 - Refresh the current page
F4 - Display list of typed addresses
F6 - Change Address bar and page focus
ALT+RIGHT ARROW - Go to the next page
SHIFT+CTRL+TAB - Move back between frames
SHIFT+F10 - Display a shortcut menu for a link
SHIFT+TAB - Move back through the items on a page
CTRL+TAB - Move forward between frames
CTRL+C - Copy selected items to the clipboard
CTRL+V - Insert contents of the clipboard
ENTER - Activate a selected link
HOME - Move to the beginning of a document
END - Move to the end of a document
F1 - Display Internet Explorer Help

VIVA INDONESIAN CODER TEAM

Widows Shortcuts

Run Commands:

Code:
compmgmt.msc - Computer management
devmgmt.msc - Device manager
diskmgmt.msc - Disk management
dfrg.msc - Disk defrag
eventvwr.msc - Event viewer
fsmgmt.msc - Shared folders
gpedit.msc - Group policies
lusrmgr.msc - Local users and groups
perfmon.msc - Performance monitor
rsop.msc - Resultant set of policies
secpol.msc - Local security settings
services.msc - Various Services
msconfig - System Configuration Utility
regedit - Registry Editor
msinfo32 _ System Information
sysedit _ System Edit
win.ini _ windows loading information(also system.ini)
winver _ Shows current version of windows
mailto: _ Opens default email client
command _ Opens command prompt

Run Commands to access the control panel:

Code:
Add/Remove Programs control appwiz.cpl
Date/Time Properties control timedate.cpl
Display Properties control desk.cpl
FindFast control findfast.cpl
Fonts Folder control fonts
Internet Properties control inetcpl.cpl
Keyboard Properties control main.cpl keyboard
Mouse Properties control main.cpl
Multimedia Properties control mmsys.cpl
Network Properties control netcpl.cpl
Password Properties control password.cpl
Printers Folder control printers
Sound Properties control mmsys.cpl sounds
System Properties control sysdm.cpl

Command Prompt:

Code:
ANSI.SYS Defines functions that change display graphics, control cursor movement, and reassign keys.
APPEND Causes MS-DOS to look in other directories when editing a file or running a command.
ARP Displays, adds, and removes arp information from network devices.
ASSIGN Assign a drive letter to an alternate letter.
ASSOC View the file associations.
AT Schedule a time to execute commands or programs.
ATMADM Lists connections and addresses seen by Windows ATM call manager.
ATTRIB Display and change file attributes.
BATCH Recovery console command that executes a series of commands in a file.
BOOTCFG Recovery console command that allows a user to view, modify, and rebuild the boot.ini
BREAK Enable / disable CTRL + C feature.
CACLS View and modify file ACL's.
CALL Calls a batch file from another batch file.
CD Changes directories.
CHCP Supplement the International keyboard and character set information.
CHDIR Changes directories.
CHKDSK Check the hard disk drive running FAT for errors.
CHKNTFS Check the hard disk drive running NTFS for errors.
CHOICE Specify a listing of multiple options within a batch file.
CLS Clears the screen.
CMD Opens the command interpreter.
COLOR Easily change the foreground and background color of the MS-DOS window.
COMP Compares files.
COMPACT Compresses and uncompress files.
CONTROL Open control panel icons from the MS-DOS prompt.
CONVERT Convert FAT to NTFS.
COPY Copy one or more files to an alternate location.
CTTY Change the computers input/output devices.
DATE View or change the systems date.
DEBUG Debug utility to create assembly programs to modify hardware settings.
DEFRAG Re-arrange the hard disk drive to help with loading programs.
DEL Deletes one or more files.
DELETE Recovery console command that deletes a file.
DELTREE Deletes one or more files and/or directories.
DIR List the contents of one or more directory.
DISABLE Recovery console command that disables Windows system services or drivers.
DISKCOMP Compare a disk with another disk.
DISKCOPY Copy the contents of one disk and place them on another disk.
DOSKEY Command to view and execute commands that have been run in the past.
DOSSHELL A GUI to help with early MS-DOS users.
DRIVPARM Enables overwrite of original device drivers.
ECHO Displays messages and enables and disables echo.
EDIT View and edit files.
EDLIN View and edit files.
EMM386 Load extended Memory Manager.
ENABLE Recovery console command to enable a disable service or driver.
ENDLOCAL Stops the localization of the environment changes enabled by the setlocal command.
ERASE Erase files from computer.
EXIT Exit from the command interpreter.
EXPAND Expand a M*cros*ft Windows file back to it's original format.
EXTRACT Extract files from the M*cros*ft Windows cabinets.
FASTHELP Displays a listing of MS-DOS commands and information about them.
FC Compare files.
FDISK Utility used to create partitions on the hard disk drive.
FIND Search for text within a file.
FINDSTR Searches for a string of text within a file.
FIXBOOT Writes a new boot sector.
FIXMBR Writes a new boot record to a disk drive.
FOR Boolean used in batch files.
FORMAT Command to erase and prepare a disk drive.
FTP Command to connect and operate on a FTP server.
FTYPE Displays or modifies file types used in file extension associations.
GOTO Moves a batch file to a specific label or location.
GRAFTABL Show extended characters in graphics mode.
HELP Display a listing of commands and brief explanation.
IF Allows for batch files to perform conditional processing.
IFSHLP.SYS 32-bit file manager.
IPCONFIG Network command to view network adapter settings and assigned values.
KEYB Change layout of keyboard.
LABEL Change the label of a disk drive.
LH Load a device driver in to high memory.
LISTSVC Recovery console command that displays the services and drivers.
LOADFIX Load a program above the first 64k.
LOADHIGH Load a device driver in to high memory.
LOCK Lock the hard disk drive.
LOGON Recovery console command to list installations and enable administrator login.
MAP Displays the device name of a drive.
MD Command to create a new directory.
MEM Display memory on system.
MKDIR Command to create a new directory.
MODE Modify the port or display settings.
MORE Display one page at a time.
MOVE Move one or more files from one directory to another directory.
MSAV Early M*cros*ft Virus scanner.
MSD Diagnostics utility.
MSCDEX Utility used to load and provide access to the CD-ROM.
NBTSTAT Displays protocol statistics and current TCP/IP connections using NBT
NET Update, fix, or view the network or network settings
NETSH Configure dynamic and static network information from MS-DOS.
NETSTAT Display the TCP/IP network protocol statistics and information.
NLSFUNC Load country specific information.
NSLOOKUP Look up an IP address of a domain or host on a network.
PATH View and modify the computers path location.
PATHPING View and locate locations of network latency.
PAUSE Command used in batch files to stop the processing of a command.
PING Test / send information to another network computer or network device.
POPD Changes to the directory or network path stored by the pushd command.
POWER Conserve power with computer portables.
PRINT Prints data to a printer port.
PROMPT View and change the MS-DOS prompt.
PUSHD Stores a directory or network path in memory so it can be returned to at any time.
QBASIC Open the QBasic.
RD Removes an empty directory.
REN Renames a file or directory.
RENAME Renames a file or directory.
RMDIR Removes an empty directory.
ROUTE View and configure windows network route tables.
RUNAS Enables a user to execute a program on another computer.
SCANDISK Run the scandisk utility.
SCANREG Scan registry and recover registry from errors.
SET Change one variable or string to another.
SETLOCAL Enables local environments to be changed without affecting anything else.
SETVER Change MS-DOS version to trick older MS-DOS programs.
SHARE Installs support for file sharing and locking capabilities.
SHIFT Changes the position of replaceable parameters in a batch program.
SHUTDOWN Shutdown the computer from the MS-DOS prompt.
SMARTDRV Create a disk cache in conventional memory or extended memory.
SORT Sorts the input and displays the output to the screen.
START Start a separate window in Windows from the MS-DOS prompt.
SUBST Substitute a folder on your computer for another drive letter.
SWITCHES Remove add functions from MS-DOS.
SYS Transfer system files to disk drive.
TELNET Telnet to another computer / device from the prompt.
TIME View or modify the system time.
TITLE Change the title of their MS-DOS window.
TRACERT Visually view a network packets route across a network.
TREE View a visual tree of the hard disk drive.
TYPE Display the contents of a file.
UNDELETE Undelete a file that has been deleted.
UNFORMAT Unformat a hard disk drive.
UNLOCK Unlock a disk drive.
VER Display the version information.
VERIFY Enables or disables the feature to determine if files have been written properly.
VOL Displays the volume information about the designated drive.
XCOPY Copy multiple files, directories, and/or drives from one location to another.
TRUENAME When placed before a file, will display the whole directory in which it exists
TASKKILL It allows you to kill those unneeded or locked up applications

VIVA INDONESIAN CODER TEAM

Learn how to send your own fake email

So, you want to learn how to send your own fake mail? It's extraordinarily easy to do, and requires no extra software installed on your PC at all. It can be done with Windows, Macintosh, Linux - any modern PC that has an internet connection will do it.

There are a just a few simple steps. First, you'll need to decide on the FROM and the TO email addresses. If the FROM address that you're choosing isn't a real one, make sure that the domain name (the bit after the @ sign) is a real one. If it's not a real one, it almost certainly won't work.

For the purpose of this tutorial, we'll be sending from bush@whitehouse.gov to dummy@deadfake.com.

Second, you'll need to find out the mail server that your recipient is using.

Windows User :

Click Start, Run, enter "CMD", then presss OK. In the window that comes up, type nslookup -q=MX deadfake.com

MAC User :

Go to Applications, Utilities, and choose Terminal. In the window that comes up, type nslookup -q=MX deadfake.com

Linux User :

Bring up your favourite shell, and type nslookup -q=MX deadfake.com

There will be a lot of information on the screen - all you need to look for is a line that talks about a mail exchanger. If there are several, pick the one with the lowest "preference number".

deadfake.com MX preference = 10, mail exchanger = mail.deadfake.com

Now, you'll need to connect to this mail exchanger using telnet. This is the same for any PC, but Vista users may not have it installed by default - see this note about getting telnet on Vista before you continue. When you're ready, type:

telnet mail.deadfake.com 25

Press enter, and after a short pause, you should see a welcome message from the server.


Ok, so now you're connected. You need to enter the following information - press ENTER at each new line. You won't be able to press backspace to delete a mistake, so you'll need to type everything correctly first time!

HELO whitehouse.gov

This tells the mail server that we are "whitehouse.gov".

MAIL FROM:

This tells the server who is sending the mail.

RCPT TO:

This tells the server who to deliver the mail to. At this point, if the recipient doesn't exist, you may see a warning message (but not always).

DATA

This tells the server that we're ready to start writing our message. It should acknowledge, telling you to end your message with a full stop (period) on a single line. All we need to do now, is write our message and don't forget that full stop at the end.

Hello dummy@deadfake, I managed to send a fake mail all by myself!
.

Dont forget that last dot. When you've done that, and pressed enter, simply enter QUIT and your mail should be delivered.

There's a little bit more to it, of course. You'll need to enter proper "headers" if you want the mail to look more believable. After doing the DATA command, I'd recommend pasting in the following "headers" to make sure it looks realistic when viewed in Outlook, Hotmail, etc.

Example :

Date: Fri, 01 Apr 2007 01:10:13 +0700 (GMT)
From: tukulesto
To: tux
Subject: Test

Hello World, I managed to send a fake mail all by myself!
.

And that's all there is to it.

VIVA INDONESIA CODER TEAM
Get The Code and Fell The SOUL

Boot and Run Ubuntu from a Flash Drive

Running an operating system, like Windows, off of your flash drive can be very useful sometimes. You can recover your data from a hard drive and copy it to an external hard drive if that computer won't boot up or scan that computer for viruses and so on... This Instructable will show you how to install, boot, and run the popular Linux distro, Ubuntu from your flash drive. You will be able to automatically save your changes and settings back to the flash drive and restore them on each boot using a second partition.

You can run Ubuntu will all your settings and files, even if you don't have your own computer with you. You will have a whole, powerful operating system in your pocket!

Sorry for the not very helpful pictures. It was to hard to document each little step for each step. Hopefully it is still easy to follow...

I'm not liable for any damage done to your computer and/or flash drive. However, I haven't ever had a problem. Just make sure to follow each step carefully.




Here are the materials needed:

• USB 2.0 Flash drive (at least 1G) (You could use USB 1.1, but everything will take 5x longer)
• Computer w/ CD Drive (Must be able to boot from USB. Newer motherboards will work. Motherboards older than 2 years old probably won't work. A BIOS update from your computer manufacturer might work.)
• Ubuntu LiveCD (You don't need this if your computer already has Ubuntu installed on it)
• You should also be somewhat computer-savvy and comfortable with command prompt/ terminal.

I used a 4GB Sandisk Cruzer Micro and Ubuntu 7.10 (current one at time of writing)

You can get the Ubuntu LiveCD at ubuntu.com. Download the Ubuntu Desktop LiveCD iso and burn it on a CD using Nero or another program. You could also request a free Ubuntu CD but that takes 6-10 weeks to ship.

We will need to change the boot order of your BIOS throughout this Instructable. Turn on your computer and while it turns on press the button to access the BIOS Setup Utility. Usually F2 or Delete. Navigate around the setup until you find something about the boot order. You can change it so if that first device is their, it will boot up from that device. If the device isn't their, it will keep going down the order/list until their is one with that device plugged in.

Also, when you boot up you might have an option to temporarily boot up from a certain device. You could use this if you want to only boot up from a device once.



Once you have Ubuntu, turn off your computer and stick the CD in it. Turn on you computer and setup the BIOS to boot from the CD. It will load and then you will see Ubuntu!

You can skip this if your computer has Ubuntu installed on it. Just turn it on and log in.

Now that you're in Ubuntu, it is time to format the flash drive. We will make two partitions, one for the actual Ubuntu OS, and another to automatically save your changes and settings back to the flash drive and restore them on each boot. You can also store personal data on the second partition.

Backup all your data on your flash drive before doing this. This will erase all your files on you flash drive

0. Backup the data on your flash drive.

1. Open Terminal, under Applications

2. Type in "sudo su"

3. Type in "fdisk -l", and identify which device is your flash drive. Mine was "sdb". Whenever I type "sdb", put in your flash drive identification. For example, if your flash drive was sda, and I typed "format sdb1" then you would type "format sda1".

4. Type "umount /dev/sdb1"

5. Type "fdisk /dev/sdb"

• type p to show the existing partition and d to delete it
• type p again to show any remaining partitions (if partitions exist, repeat the previous step)
• type n to make a new partition
• type p for primary partition
• type 1 to make this the first partition
• hit enter to use the default 1st cylinder
• type +750M to set the partition size
• type a to make this partition active
• type 1 to select partition 1
• type t to change the partition filesystem
• type 6 to select the fat16 file system
• type n to make another new partition
• type p for primary partition
• type 2 to make this the second partition
• hit enter to use the default cylinder
• hit enter again to use the default last cylinder
• type w to write the new partition table

6. Type "umount /dev/sdb1", then "umount /dev/sdb2".

7. Type "mkfs.vfat -F 16 -n Ubuntu /dev/sdb1". This formats the first partition.

8. Next, type "mkfs.ext2 -b 4096 -L casper-rw /dev/sdb2", to format the second partition.

9. Exit terminal, then unplug your flash drive.


Now that you have finished formatting the drive, you can now install Ubuntu onto the flash drive partitions.

1. Insert flash drive.

2. Open Terminal.

3. Type "apt-get update".

4. Go to Ubuntu Packages and download Mtools and install. Afterward, download Syslinux and install.

5. In terminal, type "syslinux -sf /dev/sdb1".

6. Type "cd /cdrom"

7. Type "cp -rf casper disctree dists install pics pool preseed .disk isolinux/* md5sum.txt README.diskdefines ubuntu.ico casper/vmlinuz casper/initrd.gz /media/Ubuntu/".

• Ignore any "cannot create symbolic link" errors.

8. Go to first partition of the first flash drive and rename "isolinux.cfg" to "syslinux.cfg".

9. Edit "syslinux.cfg" so that it looks like the attached text file.

Finally... You are done!



Syslinux Config :

DEFAULT persistent
GFXBOOT bootlogo
GFXBOOT-BACKGROUND 0xB6875A
APPEND file=preseed/ubuntu.seed boot=casper initrd=initrd.gz ramdisk_size=1048576 root=/dev/ram rw quiet splash --
LABEL persistent
menu label ^Start Ubuntu in persistent mode
kernel vmlinuz
append file=preseed/ubuntu.seed boot=casper persistent initrd=initrd.gz ramdisk_size=1048576 root=/dev/ram rw quiet splash --
LABEL live
menu label ^Start or install Ubuntu
kernel vmlinuz
append file=preseed/ubuntu.seed boot=casper initrd=initrd.gz ramdisk_size=1048576 root=/dev/ram rw quiet splash --
LABEL xforcevesa
menu label Start Ubuntu in safe ^graphics mode
kernel vmlinuz
append file=preseed/ubuntu.seed boot=casper xforcevesa initrd=initrd.gz ramdisk_size=1048576 root=/dev/ram rw quiet splash --
LABEL check
menu label ^Check CD for defects
kernel vmlinuz
append boot=casper integrity-check initrd=initrd.gz ramdisk_size=1048576 root=/dev/ram rw quiet splash --
LABEL memtest
menu label ^Memory test
kernel mt86plus
append -
LABEL hd
menu label ^Boot from first hard disk
localboot 0x80
append -
DISPLAY isolinux.txt
TIMEOUT 300
PROMPT 1
F1 f1.txt
F2 f2.txt
F3 f3.txt
F4 f4.txt
F5 f5.txt
F6 f6.txt
F7 f7.txt
F8 f8.txt
F9 f9.txt
F0 f10.txt

Now you're done! Just reboot the computer, set it to boot from the flash drive in the BIOS, and let it load!

If your can't get Ubuntu to boot, your flash drive may have a corrupted MBR. To repair the MBR of your USB device, at the terminal in Ubuntu type "sudo apt-get install lilo " followed by "lilo -M /dev/sdb".

You can now run Ubuntu anywhere and still have all your settings and files.






VIVA INDONESIA CODER TEAM
Get The Code and Fell The SOUL

Firewall Protection - How to, Big one

What is a Firewall?
A firewall is a tool that monitors communication to and from your computer. It sits between your computer and the rest of the network, and according to some criteria, it decides which communication to allow, and which communication to block. It may also use some other criteria to decide about which communication or communication request to report to you (either by adding the information to a log file that you may browse whenever you wish, or in an alert message on the screen), and what not to report.

What Is It Good For?
Identifying and blocking remote access Trojans. Perhaps the most common way to break into a home computer and gain control, is by using a remote access Trojan (RAT). (sometimes it is called "backdoor Trojan" or "backdoor program". Many people simply call it a "Trojan horse" although the term "Trojan horse" is much more generic). A Trojan horse, is a program that claims to do something really innocent, but in fact does something much less innocent. This goes to the days where the Greek soldiers succeeded to enter through the gates of Troy by building a big wooden horse, and giving it as a present to the king of Troy. The soldiers allowed the sculpture to enter through their gates, and then at night, when the soldiers were busy guarding against an outside attack, many Greek soldiers who were hiding inside the horse went out and attacked Troy from the inside. This story, which may or may not be true, is an example of something which looks like something innocent and is used for some less innocent purpose. The same thing happens in computers. You may sometimes get some program, via ICQ, or via Usenet, or via IRC, and believe this program to be something good, while in fact running it will do something less nice to your computer. Such programs are called Trojan horses. It is accepted to say that the difference between a Trojan horse and a virus, is that a virus has the ability to self-replicate and to distribute itself, while a Trojan horse lacks this ability. A special type of Trojan horses, is RATs (Remote Access Trojans, some say "remote admin Trojans"). These Trojans once executed in the victim's computer, start to listen to incoming communication from a remote matching program that the attacker uses. When they get instructions from the remote program, they act accordingly, and thus let the user of the remote program to execute commands on the victim's computer. To name a few famous RATs, the most common are Netbus, Back-Orifice, and SubSeven (which is also known as Backdoor-G). In order for the attacker to use this method, your computer must first be infected by a RAT.
Prevention of infections by RATs is no different than prevention of infection by viruses. Antivirus programs can identify and remove most of the more common RATs. Personal firewalls can identify and block remote communication efforts to the more common RATs and by thus blocking the attacker, and identifying the RAT.


Blocking/Identifying Other Types of Trojans and WQorms?
There are many other types of Trojan horses which may try to communicate with the outside from your computer. Whether they are e-mail worms trying to distribute themselves using their own SMTP engine, or they might be password stealers, or anything else. Many of them can be identified and blocked by a personal firewall.

Identifying/Blocking Spyware's/Adbots?
The term "spyware" is a slang which is not well defined. It is commonly used mainly for various adware (and adware is a program that is supported by presenting advertisements to the user), and that during their installation process, they install an independent program which we shall call "adbot". The adbot runs independently even if the hosting adware is not running, and it maintains the advertisements, downloads them from the remote server, and provides information to the remote server. The adbot is usually hidden. There are many companies that offer adbots, and advertisements services to adware. The information that the adbots deliver to their servers from the computer where the adbot is installed, is "how much time each advertisement is shown, which was the hosting adware, and whether the user clicked on the advertisement. This is important so that the advertisements server will be able to know how much money to get from each of the advertised companies, and how much from it to deliver to each of the adware maintainers. Some of the adbots also collect other information in order to better choose the advertisements to the users. The term "spyware" is more generic, but most of the spyware fall into this category. Many types of adbots can be identified and blocked by personal firewalls.

Blocking Advertisements?
Some of the better personal firewalls can be set to block communication with specific sites. This can be used in order to prevent downloading of advertisements in web pages, and thus to accelerate the download process of the web sites. This is not a very common use of a personal firewall, though.

Preventing Communication to Tracking Sites?
Some web pages contain references to tracking sites. e.g. instruct the web browser to download a small picture (sometimes invisible) from tracking sites. Sometimes, the pictures are visible and provide some statistics about the site. Those tracking sites will try to save a small text either as a small file in a special directory, or as a line in a special file (depending on what is your browser), and your browser will usually allow the saving site to read the text that it saved on your computer. This is called "web cookies" or sometimes simply "cookies". Cookies allow a web site to keep information that it saved some time when you entered it, to be read whenever you enter the site again. This allow the web site to customize itself for you, and to keep track on everything that you did on that site. It does not have to keep that information on your computer. All it has to save on your computer is a unique identifying number, and then it can keep in the server's side information regarding what has been done by the browser that used that cookie. Yet, by this method, a web site can get only information regarding your visits in it. Some sites such as "doubleclick" or "hitbox" can collect information from various affiliated sites, by putting a small reference in the affiliated pages to some picture on their servers. When you enter one of the affiliated web pages, your browser will communicate with the tracking site, and this will allow the tracking site to put or to read a cookie that identifies your computer uniquely, and it can also know what was the web page that referred to it, and any other information that the affiliated web site wanted to deliver to the tracking site. This way tracking sites can correlate information from many affiliated sites, to build information that for example will allow them to better customize the advertisements that are put on those sites when you browse them.
Some personal firewalls can be set to block communication to tracking sites. It is not a common use of a personal firewall, though, and a personal firewall is not the best tool for that, but if you already have one, this is yet another possible use of it.

Blocking or Limiting the NetBIOS Communication? (as well as other default services)
The two common methods of intruders to break into home computers, are through a RAT (which was discussed in II.3a) and through the NetBIOS communication. The NetBIOS is a standard for naming computers in small networks, developed long ago by IBM and Microsoft. There are a few communication standards which are used in relation to the NetBIOS. The ones that are relevant for Microsoft Windows operating systems, are: NBT (NetBIOS over TCP/IP), IPX/SPX, and NetBEUI. The communication standard which is used over the Internet, is NBT. If it is enabled, and there is no firewall or something else in the middle, it means that your computer is listening for communications over the Internet via this standard, and will react according to the different NBT commands that it gets from the remote programs. It is thus that the NBT (which sometimes loosely called "NetBIOS") is acting as a server. So the next question should be "what remote NBT commands the NBT server will do on the local computer". The answer to this question depends on the specific setting on your computer. You may set your computer to allow file and print sharing. If also NBT is enabled, it means that you allow remote users to share your files or printers. This is a big problem. It is true that in principle the remote user has to know your password for that computer, but many users do not set a password for their user on Windows, or set a trivial password. Older versions of Win95 had file and print sharing over NetBIOS enabled by default. On Win98, and WinMe it was disabled by default, but many technicians, when they set a home network, they enable the file and print sharing, without being aware that it influences also the authorizations of a remote Internet user. There are even worms and viruses who use the File sharing option to spread in the Internet. Anyway, no matter whether you need it for some reason or just are not aware of it, a personal firewall can identify and block any external effort to communicate with the NetBIOS server on your computer. The more flexible personal firewalls can be set to restrict the authorization to communicate with the NetBIOS. Some Windows operating systems, especially those which are not meant for home uses, offer other public services by default, such as RPC. A firewall can identify communication efforts to them, and block them. Since such services listen to remote communications, there is a potential risk when there are efforts to exploit security holes in the programs that offer the services, if there are such security holes. A firewall may block or limit the communication to those services.

Hiding Your Computer on the Internet?
Without a firewall, on a typical computer, even if well maintained, a remote person will still be able to know that the communication effort has reached some computer, and perhaps some information about the operating system on that computer. If that computer is handled well, the remote user will not be able to get much more information from your computer, but might still be able to identify also who your ISP is, and might decide to invest further time in cracking into your computer.
With a firewall, you can set the firewall so that any communication effort from remote users (in the better firewalls you may define an exception list) will not be responded at all. This way the remote user will not be able to even know that it reached a live computer. This might discourage the remote attacker from investing further time in effort to crack into your computer.

The Non-Firewall Defenses

We've discussed a few situations where a personal firewall can provide defense. Yet, in many cases a computer maintainer can deal with those situations even without a firewall. Those "alternative" defenses, in many cases are recommended regardless of whether you use a firewall or not.

Remote Access Trojans?
The best way to defend against remote access Trojans (RATs) is to prevent them from being installed in the first place on your computer. A RAT should first infect your computer in order to start to listen to remote communication efforts. The infection techniques are very similar to the infection techniques that viruses use, and hence the defense against Trojan horses is similar to the defense against viruses. Trojan horses do not distribute themselves (although they might be companions of another Internet worm or virus that distributes them. Yet, because in most cases they do not distribute themselves, it is likely that you will get them from anonymous sources, such as instant messengers, Kazaa, IRC, or a newsgroup. adopting a suspicious policy regarding downloads from such places, will save you not only from viruses but also from getting infected with Trojan horses, including RATs. Because Trojan horses are similar in some ways to viruses, almost all antivirus programs can identify, block from being installed, and remove most of the Trojan horses, including all the common ones. There are also some programs (sometimes called antiTrojan programs) which specialize in the identification and removal of Trojan horses. For a list of those programs, and for comparison on how well different antivirus, and antiTrojan programs identify different Trojan horses, see Hackfix (http://www.hackfix.org), under "Software test results". Hackfix also has information on the more common RATS (such as the Netbus and the Subseven) and on how to remove them manually. There are some tools and web sites, such port scanners, and some ways with a use of more generic tools such as telnet, msconfig, and netstat, which may help you to identify a RAT.

Other types of Trojans and worms?
Also here your main interest should be to prevent them from infecting your computer in the first place, rather than blocking their communication. A good antivirus and a good policy regarding the prevention of virus infections, should be the first and most important defense.

Spyware and Adbots?
The term spyware is sometimes misleading. In my view, it is the responsibility of the adware developer to present the fact that the adware installation will install or use an independent adbots, and to provide the information on how this adbot communicates, and which information it delivers, in a fair place and manner before the adware is installed. It is also a responsibility to provide this information in their web sites, so that people will be aware of that before they even download the software. Yet, in general, those adbots do not pose any security threat, and in many cases also their privacy threat is negligible for many people (e.g. the computer with adbot number 1127533 has been exposed to advertisements a, b, c, such and such times, while using adware x, while on computer with adbot number 1127534 has been exposed to advertisements a,d, and e, such amount of time, with the use of adware y, and clicked on ads number d). It should be fully legitimate for software developers to offer an advertisement supported programs, and it is up to the user to decide whether the use of the program worth the ads and the adbot, or not. Preventing adbot from communicating is generally not a moral thing. If you decide to use an adware, you should pay the price of letting the adbot work. If you don't want it, please remove the adware, and only if for some reason the adbot continue to work even if no hosting adware that uses it is installed, you may remove the adbot. Anyway, there are some very useful tools to identify whether a program is a "spyware", or whether a "spyware" is installed on your computer, and you are certainly entitled to this information. Two useful programs are "AdAware" which identifies "spyware" components on your computer and allows you to remove them, and Ad-Search which allows you to provide a name of a program, and it tells you whether this program is a "spyware" and which adbot it uses. It is useful to assist you in choosing whether to install a program or not. You may find those programs in http://www.lavasoft.nu (or, if it doesn't work, you may try http://www.lavasoftusa.com). Those programs are useful, mainly because many adware developers are not fair enough to present this information in a fair manner. AdAware allows you to also remove those adbot components from your computer. This might, however, terminate your license to use the hosting adware programs, and might even cause them to stop functioning. A website which offers to check whether a specific program that you wish to install is "spyware" or not, is http://www.spychecker.com .

Blocking Advertisements?
Leaving aside the moral aspect of blocking advertisements, a personal firewall is not the best tool for that anyway. This is not the main purpose of a firewall, and neither its main strength. Some of them can block some of the advertisements from being downloaded, if you know how to configure them for that. Yet, there are better tools for that, such as Proxomitron (http://www.proxomitron.org), CookieCop 2 (search for the word cookiecop on http://www.pcmag.com), or Naviscope (http://www.naviscope.com), and there are many other programs as well. You may check for other alternatives, e.g. in Tucows (http://www.tucows.com/adkiller95.html).

Blocking Tracking Sites?
Also here, a personal firewall is not the best tool for that, and there are other tools and ways which are more effective. These are cookie utilities. Since a tracking site uses a cookie to identify and relate the information gathered to the same person (or computer), by preventing the cookie from being installed. The tracking site will lose its ability to track things. There are plenty of cookie management utilities. Some of them are freeware, and some are not. CookieCop which was mentioned in the former section is one of them. WebWasher (http://www.webwasher.com) is another recommended one, and there are plenty of other alternatives such as cookie-crusher, cookie-pal, pop-up killer, etc. You may search for other alternatives, in Tucows (http://www.tucows.com/cookie95.html).

NetBIOS and Other Services?
The NetBIOS over TCP/IP (NBT) which is sometimes loosely called "NetBIOS", is a service which has some security problems with it. It is enabled by default in Windows default installations, and it is very common to see that a firewall does the job of preventing the efforts to get access to your computer via NBT. Yet, in almost all cases, this service is not needed, and thus can be disabled. To disable NBT in Win95/98/ME is not as simple as it is in Win2K/XP, but can still be done reliably. We explain how to do this in another article (#to be written soon). It is needless to say, that if NBT is disabled, there is no need for a firewall to block communication to it. Also, in the case of other services, such as RPC services, and others, in many cases you simply don't need those services and better disable them from within Windows rather than use the firewall to block them. There are various ways to know which services are running on your computer, and which of them are listening for communications from the outside. If there are ones that you don't need, they should be disabled.

Hiding the Computer?
In web sites of many personal firewall companies, they are putting a lot of weight on the ability of their firewall to hide the computer on the Internet. Yet, exposing your home computer on the Internet is by itself, neither a security nor a privacy threat. If you provide some services to the Internet on your computer, for example, you put a web server on your computer to allow other people to view web pages, then you might get rid of some of the crackers, by setting your firewall to unhide only this type of communications. Some attackers will not make a full scan of your computer, but only a partial scan, and if they did not scan for the specific service that you provided, they will not see your computer. Yet, if the service is a common one, there is a good chance for many of them to scan it and thus find the existence of your computer. If they "see" the existence of your computer, they might decide to scan it further, and find out the services you are providing, and scan it for security holes to use. Yet, there is no much meaning to it when we speak about simple home computers.

What a Firewall Cannot Do!

Another misconception about personal firewalls is that they are incorrectly thought as if they claim to give an overall protection against "hackers" (i.e. intrusions). They are not.
Defense Against Exploitation of Security Holes
A firewall can allow or deny access to your computer or from your computer according to the type of communication, its source and destination, and according to the question which program on your computer is handling the communication. Yet, its ability to understand the details of the communication is very limited. For example, you may set the firewall to allow or to deny your e-mail program from getting and/or sending messages. It may allow or deny your web browser from browsing the Internet. But if you allowed your e-mail program to communicate with the e-mail servers for sending and receiving messages, (and you are likely to allow it if you want to use your e-mail program), or if you set the firewall to allow your web browser to communicate with web sites, the firewall will not be able to understand the content of the communication much further, and if your web browser has a security hole, and some remote site will try to exploit it, your firewall will not be able to make a distinction between the communication that exploits the security hole, and legitimate communication. The same principle goes with e-mail program. A personal firewall may block you from receiving or sending e-mail messages, but if you allowed it to receive messages, the personal firewall will not make a distinction between a legitimate message and a non-legitimate one (such as a one that carries a virus or a Trojan horse). Security holes in legitimate programs can be exploited and a personal firewall can do practically nothing about it.
I should comment, however, that some personal firewalls come combined with some Trojan horse detection, or intrusion detection. This is not part of the classical definition of a firewall, but it might be useful. Such tasks are usually taken by other tools such as antivirus programs or antiTrojan programs.

Tricks to Bypass or Disable Personal Firewalls
There are also various ways to disable, or bypass personal firewalls. During the time a few tricks to bypass or disable were demonstrated by various programs. Especially, tricks for an internal program to communicate with the outside bypassing or tricking the firewall. For some of them such as the one demonstrated by the Leaktest, and in which a non-legitimate program disguises itself as Internet Explorer, practically today, all personal firewalls are immuned. For other tricks, such as a one demonstrated by Outbound, which uses some non-standard type of communication directly to the network adapters bypassing the components of the operating system which are suppose to deal with Internet communication, and by that bypassing the firewall, are only now being patched against by the various firewalls, and yet other methods, such as the one demonstrated by Tooleaky, which uses Internet Explorer as a messenger to communicate with the outside, and is thus identified as a mere legitimate browsing, are still waiting for most of the personal firewall to find a fix.

Firewalls CANNOT Decide for You What is a Legitimate Communication and What is Not

One of the main problems with personal firewalls, is that you cannot simply install them and forget them, counting on them to do their job. They can deny or permit various types of communications according to some criteria, but what is this criteria, and who decides what is the criteria for whether they should permit or deny some communication?

The answer, is that it is the computer user's job to define the exact criteria when the firewall should allow a communication and when it should block it. The firewall may make it easier for you, but it should not take the decisions. There are too many programs, too many versions, and it is not possible for the firewall to decide accurately when a communication is legitimate and when it is not. One person might think that it is legitimate for some program to deliver some information to the outside in order to get some service, while another will think that it is not. One version of a program might communicate with its home server in order to check whether there is an upgrade, and another version might also install the upgrade even if you do not wish. Some firewalls will try to identify communication efforts which are largely considered as legitimate, and will let you the information so that it will be easier for you to decide whether such should be allowed. Others will suffice with more basic information, making no suggestions (and thus - no incorrect recommendations). One way or another, once you installed a firewall, you will have better means to understand what types of communications are running on your computer, but you will also have to understand them in order to be able to configure your firewall so that it will correctly know which communications to allow and which to block.

Common Problems and Deficiencies Regarding Personal Firewalls

A personal firewall might be a good contribution to security. Yet, if you do not understand much about the topic, then you are likely to be confused and misled by its alerts and queries, and thus find yourself spending hours in chasing after imaginary crackers, fear from imaginary threats, and misconfigure it due to misunderstanding. You may find yourself blocking legitimate and important communication believing it to be cracking efforts, and thus surprised to see why things work slowly or why you are disconnected from the Internet, or you might be misled to allow a non-legitimate communication by some software that tricked you to believe that it is a legitimate one. On the other side, if you are quite knowledgeable on computers and security, then you are likely to effectively defend your computer even without a firewall (by means discussed in section II.4) and it is thus that the role of personal firewall in securing your computer, is extremely small and not much important. We discuss here in brief some of the problems that personal firewalls may generate.

A False Sense of Security

As we've already learned here, a firewall is limited in its ability to secure your computer. Yet, many people believe that if they will install a personal firewall they will be secured against the various security threats. I was even surprised to find out that there are people who believe that give much higher priority in installing a personal firewall than in installing an antivirus program. An always updated antivirus program plays a much more important role in the security of a personal home computer than installing and maintaining a personal firewall. A personal firewall should not come on account of any other security measure that you use.

A False Sense of Insecurity

When you install a firewall and you look at all the communication efforts through it, you might be surprised at the amount of communication efforts from the Internet to your computer. Most of them are blocked by a typically configured firewall. There are all the times efforts to try to communicate with various backdoor Trojans on your computers. If you are not infected, there will be nothing to listen and to respond to those communication efforts, and they are thus practically harmless. There are efforts to communicate with your NBT driver, to see if your computer by mistake allows file sharing. There are other types of probes to see if your computer exists, or various efforts of servers to probe your computer in order to find the best path for legitimate communication to it. There are sometimes remnants of communications that were supposed to go to other computers, but made their way to yours (for advanced readers: because the IP number that your computer uses, were used by some other computer earlier). Those communication efforts are blocked even without a firewall. If your computer is not infected with a RAT, and if your computer don't have NetBIOS over TCP/IP enabled or even it does not have file and print sharing enabled (and on most computers this is disabled by default), then none of these pose any security threat. If your computer is not infected with a SubSeven Trojan, then no matter how often there will be efforts to communicate with it, they are all doomed to be failed.
Yet, some personal firewall (such as Norton Personal Firewall or ZoneAlarm) by default proudly announce that they have just blocked an effort to crack into your computer. Norton may even define those efforts that were blocked as "high security threats" while they were not a threat at all even if your computer didn't have a personal firewall at all. Such firewalls give you the false impression that they save your computer again and again from extremely dangerous threats on the Internet, so that you wonder how did you survive so much time without noticing any intrusion before you installed the firewall. I usually say, that those personal firewalls are set their "report level" to "promotional mode". Namely, the personal firewall is set to give you the false impression that it is much more important than it really is.

Chasing After Ghosts

This is a side effect of the types of misunderstandings that were discussed in the previous subsection.
When a person who starts to learn about the jargon related to personal firewalls, is reported that some "dangerous" communication efforts persist from the same source, the person is decisive to locate and identify the "hacker", and perhaps report about it to the police or to its Internet service provider. However, since many people do not really understand thoroughly how things work, they may sometimes spend many hours in trying to locate a cracker that does not exist, or when the knowledge they need to have, in order to track the cracker, is much higher than what they have, and they might even suspect the wrong person due to lack of knowledge (e.g. the connection person on the Internet service provider that was used by the cracker). More knowledgeable people, usually do not bother to track those "hackers" (which are usually teenagers), but instead are concentrating on the security of their computer.

Blocking Legitimate Communications

No personal firewall is smart enough to decide for the user what is a legitimate communication and what is not. A personal firewall cannot make a distinction between a legitimate program trying to contact its server to check and notify the user when there is a newer version, and a non-legitimate program trying to communicate with its server in order deliver sensitive information such as passwords, unless the user tells it. It is thus up to the user to decide what should be considered as legitimate and what should not. Yet, can we count on the user to be knowledgeable enough to decide what is legitimate and what is not? In many cases the user is not knowledgeable enough, and may thus allow non-legitimate communication or disallow a legitimate and important communication. There are many types of communications handled just to manage other communications. Among this are various types of communications between your computer and the various servers of your Internet service provider. A not knowledgeable user may interpret those types of communications as cracking efforts, and will thus decide to block them. As a result, a connection might become slower, a connection to the Internet service provider might be disconnected quiet often and other types of communication problems.

Being Tricked by Trojans bbb

Just as less knowledgeable users may instruct the firewall to block legitimate communications, they can be tricked by various Trojans to allow them to communicate. Some Trojans are using names resembling or identical to names of legitimate programs, so that the user would think that it is a legitimate programs. Users should be aware of that.

Heavy Software, Buggy Software

Until now we discussed only problems related to lack of appropriate knowledge by the user. Yet, there are other problems regarding personal firewalls. For example, some of them are known to be quite heavy on computer resources, or slow down the communication speed. Different personal firewalls quite vary with regard to that. If you have a new computer with a slow Internet communication (such as regular dial-up networking) then it might not slow down your computer noticeably. Yet, if you use an older computer, and a fast communication, you might find that some personal firewalls will slow down your communication quite drastically. Personal firewalls also vary on how much they are stable.

Advantages of External Firewalls over Personal Firewalls

1. They do not take resources from the computer. This should be clear. This is especially useful when the firewall blocks flooding attacks.
2. It is harder (although in principle still possible) for a Trojan horse to disable it, because it does not reside in the same computer that the Trojan has infected. It is not possible to use the specific communication while totally bypassing the firewall.
3. They can be used without any dependence on the operating system on the computer(s) they defend.
4. No instability problems.



VIVA INDONESIA CODER TEAM
Get The Code and Fell The SOUL