text:
As someone who's responsible for a number of Ruby projects, both open-source and commercially developed, I'm always on the look out for new ways to improve how they are secured and delivered to end-users.
The most common method for delivering Ruby code to end-users is in the form of a Ruby gem. A Gem is a simple container for code and other relevant bits that can be installed by end users with a single command.
For example, if a user wants to install c7decrypt (a tool for decrypting Cisco passwords), they would install the gem like so:
$ gem install c7decrypt
It has been my experience in working with security-focused Ruby developers that the topic of "signed gems" comes up every now and again, but I always fail to make time to check it out. The reason why a developer would want to publish signed gems is because it helps ensure that the gem was not tampered with.
In this post, I'll explain how I cryptographically signed the Ruby gems that are now produced by the c7decrypt project as of version 0.3.2.
Create a Self-Signed Gem Cert
First, you need to create the certificate you will use to sign your gems:
$ gem cert --build firstname.lastname@example.com
Passphrase for your Private Key:
Please repeat the passphrase for your Private Key:
Certificate: /Users/jclaudius/.ssh/gem-public_cert.pem
Private Key: /Users/jclaudius/.ssh/gem-private_key.pem
Don't forget to move the key file to somewhere private!
Next, you need to set the permissions on those .pem files:
$ chmod 600 gem-p*
Add Public Cert to the Project
Create a certs folder in your project and add the public cert to it
$ mkdir certs
$ cp ~/.ssh/gem-public_cert.pem certs/claudijd.pem
Add a cert reference to your projects gemspec file so it knows where to look
s.cert_chain = ['certs/claudijd.pem']
s.signing_key = File.expand_path("~/.ssh/gem-private_key.pem") if $0 =~ /gem\z/
Build the signed gem
This is no different than building a gem normally, with the added step of having to supply the cert password, like so:
$ gem build c7decrypt.gemspec
Enter PEM pass phrase:
Successfully built RubyGem
Name: c7decrypt
Version: 0.3.2
File: c7decrypt-0.3.2.gem
Next, you can publish that gem to your gem hosting provider, like RubyGems:
$ gem push c7decrypt-0.3.2.gem
Pushing gem to https://rubygems.org...
Successfully registered gem: c7decrypt (0.3.2)
Install the signed gem
Now that you have signed the gem and pushed it to the server, it's time for end-users to do their part. With users that don't care about whether the gem is signed or not, their process doesn't change:
$ gem install c7decrypt
Successfully installed c7decrypt-0.3.2
Parsing documentation for c7decrypt-0.3.2
Installing ri documentation for c7decrypt-0.3.2
Done installing documentation for c7decrypt after 0 seconds
1 gem installed
For users that care about whether the gem is signed, they will need to download the public cert file, trust it, and then install the gem with either a HighSecurity or MediumSecurity trust policy.
$ gem cert --add <(curl -Ls https://raw.github.com/claudijd/c7decrypt/master/certs/claudijd.pem)
Added '/CN=claudijd/DC=yahoo/DC=com'
$ gem install c7decrypt -P HighSecurity
Successfully installed c7decrypt-0.3.2
Parsing documentation for c7decrypt-0.3.2
Done installing documentation for c7decrypt after 0 seconds
1 gem installed
In contrast, if a user who cared about the authenticity of the gem tried to install using the HighSecurity trust policy, and either we didn't do this process or the gem was tampered with, they could expect this behavior, which would fail to install the gem:
$ gem install c7decrypt -P HighSecurity
Fetching: c7decrypt-0.3.2.gem (100%)
ERROR: While executing gem ... (Gem::Security::Exception)
root cert /CN=claudijd/DC=yahoo/DC=com is not trusted
Parting Thoughts
So, as you can see, the process of building and using signed Ruby gems for your smaller Ruby projects is quite easy to do and it can help add some confidence for end-users who are more security conscious. One thing I'm still looking into, and which may be a topic for a future post, is how to better make this process scale to my larger projects, such as those that have multiple gem dependency tiers. If you have any suggestions on that topic, please feel free to contact me directly or submit a comment on this post.
@bascule of @Square made me aware of an effort they are working on to integrate the update framework (aka: TUF) with RubyGems for better Gem security. I'm providing links to their excellent blog series and TUF if you'd like to learn more about what they're doing to improve gem security.
For those of you not familiar with monkey patching, it's a mechanism to "extend or modify the run-time code of dynamic languages without altering the original source code". Previously, I demonstrated how monkey patching can modify the logic of a Ruby gem dependency to work around hardcoded configuration settings. As you might imagine, this technique, if used in the movie the Matrix, would have been a great advantage to our favorite "hacker" Neo in his quest to be "The One".
In this blog post, I'll be showing some real world Matrix code examples that demonstrate how you (a hacker) can upgrade your guns, learn karate, and avoid being shot by the lady in the red dress.
The choice is yours…
If the Matrix were written in Ruby, the code to define a semi-automatic weapon could look something like this:
What you'll notice about this gun implementation is that it honors the traditional constraints of a real semi-automatic weapon. This means that every time the trigger is pulled the gun fires only one shot, like so:
Now, if you were in a fight with, say, Agent Smith; you might need a slightly higher rate of fire. We can achieve this is by redefining Gun at run-time. We do this by requiring in a monkey-patched version of Gun, which looks like the original, but with the trigger redefined to fire three shots instead of one:
By requiring this modified code, we effectively convert our pre-existing semi-automatic gun to support 3-round bursts.
You'll notice that the object ID has not changed (same id), but magically the behavior is no longer the same.
Using this technique, we can define what methods do to alter pre-existing and new objects even if we don't control the source code of gun.rb. This ability allows us to change the run-time behavior of Gun and bend reality to our will.
Learning Kung Fu (Instance Variable Stomping)
Now, I can attest as an avid movie watcher than many times you need more than big guns to beat the bad guy. Sometimes you're required to think on your feet and learn something new to overcome your adversary. Luckily for Neo, Morpheous had a way to upload new skills so that anyone could learn things like flying a helicopter or learning Kung Fu.
If I had to imagine how Neo's brain was originally implemented in the Matrix, it probably would have looked something like this:
Before Morpheus' magic upload process, you could pretty much assume this would be a likely outcome for Neo if he ever ran into an agent.
But... through the magic of what I can only assume to be monkey patching, Neo can actually learn new skills almost immediately.
Again, you'll notice our object ID's are the same, but the brain now has new capabilities after getting new skills.
Using this technique, we can successfully overwrite instance variables that previously were not directly accessible interfaces of the brain. This allows us to define new methods like we saw with the gun example, but it also shows how to override instance variables that determine how it ultimately behaves.
Lady in the Red Dress (Inheritance Hijacking)
I've always wondered how agents in the Matrix can take control of other people. It reminds me of the simulation where the woman in the red dress changes into an agent and points a gun right in Neo's face.
Again, assuming the Matrix is written in Ruby, the woman in the red dress could be implemented like so:
Now, we could always override the #do_something method using the same techniques we've already discussed. This would be effective, but in the Matrix it would mean that agents would need to seek out each individual to make this an effective strategy for tracking down Neo.
However, a slightly more indirect solution is more likely. Instead of going after the individual, lets go after the esssence of what makes them human. In the Matrix this is some form of source code. When we look at Ruby objects, they maintain an inheritance tree where many Ruby objects inherit from Object. My guess is that in order for agents to take control over any person, they simply override primitive methods on Object like so:
The net effective of this is as follows:
Obviously, this is some really tricky business conducted by the agents. I can only imagine why those that came before Neo weren't able to figure it out. I guess it was only a matter of time before Neo realized that although Object is commonly thought of as the top of the food chain, it actually inherits from a more primitive beginning BasicObject. BasicObject is is often overlooked and I'm guessing that's how Neo took control with this little gem once the agents finally tried to get inside him to see who this guy was:
Now, the key to this mystery is that when Neo finally ruffled Agent Smith's feathers, he had to figure who our hero really was, and that was his big mistake. In Ruby, if you ever want to see what uniquely identifies an object you can always refer to its object id. So when Agent Smith looked into who Neo really was he actually managed to set the rest of the matrix free, like so:
Parting Thoughts
I've had a lot of fun talking about the Matrix and how monkey patching likely played an important part in the story line. I hope you enjoyed it too.
On a more serious note, I think monkey patching, especially in the Ruby community, can have a negative undertone. I'm sure you can find all sorts of blog posts telling you why it's bad.
My goal here is not to encourage developers to increase their use of monkey patching but to make security professionals aware of its existence. As an application security assessor, monkey patching can be an extremely useful tool in digging further into an application than was previously thought possible. Achieving this level of depth is done by "bending reality" just like we did today in the Matrix examples so that you can do more than you ever thought you could - just like Neo.
The Trustwave SpiderLabs Research team is committed to making ModSecurity the best open source WAF possible. To this end, we have deployed Buildbot platforms and revamped regression tests for our different ports to ensure code quality and reliability. But we want to take it even further. The question is, how else can we improve ModSecurity development and support?
To best answer that question, we need some basic insight into the ModSecurity user community:
With this sort of information, we could more easily prioritize issue resolution based on the amount of users of each version or feature and deliver new features and fixes more quickly. To gather this sort of insight, today we are introducing a new real-time status reporting mechanism.
We are introducing a new DNS-based reporting mechanism to ModSecurity with the inclusion of the "SecStatusEngine" directive. When enabled, this directive will send the following data to the ModSecurity Project team:
Once the HTTP server is started, ModSecurity gathers this "status" data and then encodes it using Base32. This encoded string is tempered with dots in a given regular space, after that a suffix is added. This suffix is the subdomain "status" which is part of the domain "modsecurity.org". Below it is an example of the information that is transmitted. Figure 1.a. contains the information in plain text, and the Figure 1.b. contains the very same information encoded. As you can see, it looks like a normal DNS name, except for the length.
Figure 1: (a) Plain/text data; (b) Encoded data.
Here is an example of what would be reporting in the local web server log files upon ModSecurity startup:
[Mon Jan 20 10:55:22.000876 2014] [:notice] [pid 18231:tid 140735189168512] ModSecurity for Apache/2.7.7 (http://www.modsecurity.org/) configured. [Mon Jan 20 10:55:22.000937 2014] [:notice] [pid 18231:tid 140735189168512] ModSecurity: APR compiled version="1.4.6"; loaded version="1.4.6" [Mon Jan 20 10:55:22.000944 2014] [:notice] [pid 18231:tid 140735189168512] ModSecurity: PCRE compiled version="8.32 "; loaded version="8.32 2012-11-30" [Mon Jan 20 10:55:22.000948 2014] [:notice] [pid 18231:tid 140735189168512] ModSecurity: LUA compiled version="Lua 5.1" [Mon Jan 20 10:55:22.000951 2014] [:notice] [pid 18231:tid 140735189168512] ModSecurity: LIBXML compiled version="2.7.8" [Mon Jan 20 10:55:22.001020 2014] [:notice] [pid 18231:tid 140735189168512] ModSecurity: StatusEngine call: "2.7.7,Apache/2.4.4 (Unix),1.4.6/1.4.6, 8.32 /8.32 2012-11-30,Lua 5.1/(null),2.7.8/(null),96ce9ba3c2fb71f7a8bb92a88d560d44dbe459b8" [Mon Jan 20 10:55:22.089012 2014] [:notice] [pid 18231:tid 140735189168512] ModSecurity: StatusEngine call successfully submitted.
ModSecurity will then perform a DNS query to a subdomain under ".status.modsecurity.org", by performing a normal name resolution (DNS lookup). The DNS protocol was selected as most organizations deploy their web servers behind a firewall with restricted egress filtering that do not allow outbound HTTPs calls or any other kind of connection to the Internet. Although outbound connections are very restrictive from DMZs, DNS queries are often allowed. We use a special configured tinydns (DNS Server) that responds to all subdomains under the "status.modsecurity.org" domain. Every time that a query is received, the server responds to it by pointing to an IP address, and then it saves the request in the log file. This log file is parsed by a script which decodes the Base32 information and gathers other information, such as date and time of the request. With the information in plaintext, the content is saved in a database.
Once the data is saved in our database, it is exported to a public web page through a JSON API. Since we don't have any significant data yet, the API is working with very limited information – it basically returns results that were gathered in a given space of time (this time slice can be chosen by the API user). Figure 2. illustrates an example of how the JSON looks. In this particular example, the information between epoch (Unix format) 0 and 1390252267 was requested, this specific set of data was collected from internal tests. The url used to generate this example was: http://status.modsecurity.org/api/0/1390252267. For more information about the API, have a look on the API documentation: https://github.com/SpiderLabs/ModSecurity-status/wiki/API-Documentation
Figure 2. JSON data returned by the API.
The geolocation data presented is based on the IP address of the DNS server that sent the final query to our servers. This information is not obtained from the server that is actually running ModSecurity. Assuming that the DNS server is somewhat near the ModSecurity host (in order to avoid latency), it is possible to retrieve the approximate geolocation information without exposing the server/user. Another concern for the ModSecurity Project team was to decide exactly what data to report. For instance: it is necessary to uniquely identify each server, otherwise we would fail to distinguish between a server that was restarted and a server that just started to use ModSecurity. In order to do that, without retrieving any information about the user, a SHA-1 hash was generated. It uses as input some information extracted from the server, like server name and MAC address of the network device. But, to protect the user's data and privacy, it never exchanges the name or the MAC address in plaintext. Even with these precautions, users may still be uncomfortable to sharing information. It is for this reason that this feature is disabled by default. In order to participate and "opt-in" users have to set SecEngineStatus On within their ModSecurity configuration files. If you use the modsecurity.conf-recommended file in the modsec_status GitHub branch, this setting is already enabled.
You are also invited to have a look at our status map. This last piece of the status reporting feature shows a live listing "heatmap" of servers that are using ModSecurity and can be found at http://status.modsecurity.org. Since we are in beta, we have just a few registrations. Figure 3. illustrates what we do expect to have in a near future (the heatmap was randomly generated).
Figure 3. Example on how the data will be displayed at http://status.modsecurity.org website.
We need help from the community testing this new feature. Since the code is in a beta state, it is not merged into ModSecurity mainline, but it is available under our GitHub repository in the branch "modsec_status". Don't forget to set SecEngineStatus to On. By using it, you may notice the log entry regarding SecSatusEngine in your error.log.
The code from all the components used by SecStatusEngine (web, scripts, etc.) are open source and published under the SpiderLabs GitHub Repo: https://github.com/SpiderLabs/ModSecurity-status. Patches for ModSecurity itself are available under ModSecurity git repo at: https://github.com/SpiderLabs/ModSecurity.
The next steps we will take in developing this feature will be including charts and a richer API with filters and more data. This will allow us to retrieve more valuable information from this raw data. But first we need some significant raw data because it is very hard to plot any chart without it.
This project is open source. So if you are interested in any particular data from this database, feel free to get your hands dirty and submit a patch or provide suggestions. Both are very welcomed!
This blog was co-authored by Felipe "Zimmerle" Costa and Ryan Barnett.
I have been using Backtrack for a while now and decided to switch to Kali Linux, a new open source distribution by the creators of Backtrack. It's built on Debian and is FHS compliant, which is a very good thing.
So I downloaded the VMware image from the Kali Linux download page and ran it using VMware Fusion. The first thing I did (and I guess everybody does) was run an "apt-get update && apt-get dist-upgrade" to upgrade the system. Immediately after that, I found an annoying issue when trying to drag and drop files from the host into the VM. Here is the error message I got each time I tried to copy a file:
"There was an error getting information about …"
Apparently, the VMware Tools needed to be upgraded and, believe me, it was not an easy task.
To install the VMware Tools, I selected "Reinstall VMware Tools" from the "Virtual Machine" menu (I am using VMware Fusion 5.0.3 on Mac OS X, but the same procedure should apply on other platforms and versions).
This automatically mounted a virtual CD containing the installation software.
My next step would be to copy the compressed file, untar it and run the installer (the version at the time of writing was 9.2.2-893683). This process is not as easy as it might appear:
# cp /media/cdrom/VMwareTools-9.2.2-893683.tar.gz . # tar xzvf VMwareTools-9.2.2-893683.tar.gz # cd vmware-tools-distrib/ # ./vmware-install.pl
After answering some questions with the default options, I ended up with the following:
I needed to dig deeper into the vmware-config-tools.pl code to understand what was going on.
When I opened the file /usr/bin/vmware-config-tools.pl with my favorite editor and searched for the string "is not a valid path to," I found this at line 6152:
Apparently, $kh_path was empty (""), and I needed to find out why. The first parameter of the getValidKernelHeadersPath() function is $kh_path and upon further review I found the code responsible for setting its value (line 6192):
$gKernelHeaders = `$modconfig --get-kernel-headers $mcKverOpt $appLoaderArgs`;
I just added this code right after the line 6192 in vmware-config-tools.pl to find out what the command actually is:
print("$modconfig --get-kernel-headers $mcKverOpt $appLoaderArgs");
Running the tool again gave me this:
Next I tried executing this command:
As I expected, nothing happened. I had to plunge further and find out which files the tool was calling. I suspected that missing files might have been the issue.
Tracing the system calls with strace I found the following:
# apt-get install strace # strace '/usr/lib/vmware-tools/sbin32/vmware-modconfig-console' --validate-kernel-headers -k 3.7-trunk-686-pae "" -- -l "/usr/lib/vmware-tools"
Here is the interesting part:
...[SNIP]... access("/lib/modules/3.7-trunk-686-pae/build/include/linux/version.h", F_OK) = -1 ENOENT (No such file or directory) ...[SNIP]...
With that, I'd discovered the issue: the file /lib/modules/3.7-trunk-686-pae/build/include/linux/version.h was missing.
To fix it, I used this:
# cd /lib/modules/3.7-trunk-686-pae/build/include/ # ln -s /usr/src/linux-headers-3.7-trunk-686-pae/include/generated/uapi/linux/version.h linux/version.h
And I was presented with the following after running vmware-config-tools.pl again:
"Excellent," I thought, "it's fixed." In actuality, there was more work to do:
Some of the services reported an error, and one in particular did not start:
...[SNIP]... /etc/init.d/vmware-tools: 1088: local: ': bad variable name Blocking file system: failed ...[SNIP]...
It seems that the service initialization script also needed to be fixed. For more details, I opened the /etc/init.d/vmware-tools file to see what lies at line 1088:
local run_kver=`get_version_integer`
The get_version_integer() function is defined as follows:
As you can see above, the script gets the kernel version number by running the "uname –r" command and parsing the result string.
Running the command gave me this:
# uname –r 3.7-trunk-686-pae
The issue here is that the script is expecting a set of three numbers (kernel version, major revision and minor revision), but here the uname command only returns two numbers: the kernel version and the major revision (3.7).
When the script called the kernel_version_integer() function, the calling parameter values were wrong:
v1="3" v2="7-trunk-686-pae" v3=""
Here is the kernel_version_integer() function definition:
kernel_version_integer() { echo $(((($1 * 256) + $2) * 256 + $3)) }
The error was that the following operation was executed and, obviously, it failed:
((3 * 256) + 7-trunk-686-pae) * 256 +
The correct operation should be:
((3 * 256) + 7) * 256 + 0
So we have two issues here: v2 is not correctly parsed and v3 is not set to zero.
Here is how I quickly fixed the code of the get_version_integer() function:
get_version_integer() { local version_uts local v1 local v2 local v3 version_uts=`uname -r` # There is no double quote around the back-quoted expression on purpose # There is no double quote around $version_uts on purpose set `IFS='.'; echo $version_uts` v1="$1" v2="$2" v3="$3" # There is no double quote around the back-quoted expression on purpose # There is no double quote around $v3 on purpose if [ -z "$v1" ]; then v1="0" else set `IFS='-ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz'; echo $v1` v1="$1" fi if [ -z "$v2" ]; then v2="0" else set `IFS='-ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz'; echo $v2` v2="$1" fi if [ -z "$v3" ]; then v3="0" else set `IFS='-ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz'; echo $v3` v3="$1" fi kernel_version_integer "$v1" "$v2" "$v3" }
I found that this resolved the error:
Perfect! The services started successfully.
Keep in mind that I ran vmware-config-tools.pl. If you want to re-run the whole installation with vmware-install.pl, the file /etc/init.d/vmware-tools will be overwritten. In that case, you would need to modify the file vmware-tools-distrib/installer/services.sh in the VMware Tools installation directory because it will overwrite /etc/init.d/vmware-tools.
It is not always easy to update VMware Tools utility, especially when using non-common Linux distributions. I haven't tried the VMware Fusion 6.0 yet and don't know if these issues are still there, but I'm sure you will have to adapt the fixes according to the errors you may find.
I hope this post will be useful and will save you some time. But remember, debugging basics are important, and you may have to repeat the process for the next kernel or VMware upgrade.
On July 30th, we announced our public ModSecurity XSS Evasion Challenge. This blog post will provide an overview of the challenge and results.
First of all, I would like to thank all those people that participated in the challenge. All told, we had > 730 participants (based on unique IP addresses) which is a tremendous turn out. This type of community testing has helped to both validate the strengths and expose the weaknesses of the XSS blacklist filter protections of the OWASP ModSecurity Core Rule Set Project. The end result of this challenge is that the XSS Injection rules within the CRS have been updated within the Trunk release in GitHub.
We activated updated XSS filters from the OWASP ModSecurity Core Rule Set (CRS). When clients send attack payloads, they are evaluated by the CRS rules and then the detection scores are popagated to the HTML form as such:
CRS XSS Anomaly Score Exceeded (score 10): NoScript XSS InjectionChecker: HTML Injection
We added XSS filter regular expressions from the following 3rd party sources:
This defensive layer uses ModSecurity's Data Modification capability (@rsub operator) to dynamically insert Gareth Heyes' (@garethheyes) JS Sandbox called MentalJS to the beginning of html responses.
It is important to understand what a JS sandbox is and how it works. You may be able to execute JS code however it is in a sandboxed environment. For example - preventing a JS alert popup box is not the goal here but rather protecting DOM elements from being accessed.
In some cases, MentalJS prevents the injected code from executing at all. In other cases, the code will execute, however it does so from within a JS sandbox. The result is that the code is not able to access DOM elements outside of the sandbox. For instance, if an injection attempts to access document.cookie, it returns data as "undefined" -
You must execute a reflected XSS attack accessing one of the DOM elements listed below WITHOUT triggering an XSS filter alert. Example -
No CRS XSS Filter Alerts Triggered (score 0)
Depending on the payload, you may need to review the raw HTML to verify the CRS score.
Example -
You may toggle On/Off the defenses by checking the box in the form below. This includes disable the MentalJS Sandbox injection and also will add the X-XSS-Protection: 0 response header to temporarily disable any browser side XSS filtering. This will help to facilitate testing of working XSS payloads.
While various community submissions did include bypasses for each of the two protection layers individually, there were no official winners who were able to bypass BOTH the CRS filters and break out of the MentalJS sandbox all within a single payload. That being said, we do want to highlight the individual component bypasses as they still have value for the community.
Security Researcher Rafay Baloch actually was a bit ahead of the curve on this challenge as he notified us of a bypass using Nul Bytes within the JS script tag name just prior to the XSS Evasion Challenge being publicly announced.
He was testing our public Smoke Test page here.
As you can see from the output, rule ID 960901 triggered and was specifically designed to flag the presence of Nul Bytes. We took this approach rather than attempting to deal with Nul Bytes within every remaining rule. That being said, there is still a valid point here - if a Nul Byte can be used to obfuscate payloads and evade detections then this should be addressed specifically.
If we research Gareth Heyes' Shazzer online fuzzer info, we find that indeed IE v9 allows the use of Nul Bytes within the script tag name -
The JSON export API shows the example vector payloads -
So, by adding %00 within the script tag name, many of the XSS regular expression checks would not match and IE9 would still parse the tag correct and execute javascript... Perfect.
To combat this tactic, we added the "t:removeNulls" transformation function action to our XSS filters:
This Nul Byte issue demonstrates just one different is browser parsing quirks. There are many, many others... It is for this reason that we decided for regression testing of XSS filters we needed to leverage the Shazzer dataset to identify payloads that trigger JS across multiple browser types and versions. I created a number of ruby scripts that interact with the Shazzer API that can extract successful fuzz payloads and test them against the live XSS evasion challenge page running the latest OWASP ModSecurity CRS rules.
Again Rafay Baloch sent in a submission that used this technique -
We also received a similar submission from ONsec_lab:
There are a number of characters that browsers will treat as "spaces" characters. Here is a table of these characters for each browser type:
IExplorer = [0x09,0x0B,0x0C,0x20,0x3B] Chrome = [0x09,0x20,0x28,0x2C,0x3B] Safari = [0x2C,0x3B] FireFox = [0x09,0x20,0x28,0x2C,0x3B] Opera = [0x09,0x20,0x2C,0x3B] Android = [0x09,0x20,0x28,0x2C,0x3B]
The evasion method used by both of these submissions was to place one of the characters in between the "onevent" name attribute (such as onmouseover and onfocus) and the equal sign (=) character -
As you can see from the table above, Internet Explorer (IE) would treat the %0B character as a space and parse/execute the payload however it would bypass blacklist regular expression filters such as this -
The problem with this regex is the use of the "\s" meta-character where %0B is not within the class.
Similar to the Evasion #1 - we can utilize Shazzer Fuzz DB data to obtain payloads with these non-space chars separating on-event handlers.
We modified our regex rules to catch these non-space characters:
Here is what the updatd regex visual looks like:
We then ran our ruby scripts to extract and test this Shazzer Fuzz data against our rules to verify that they were caught:
The second half of the challenge was to try and escape from the MentalJS sandbox and access the DOM elements. There were a few people who were successful. Remember, however, that while these payloads were able to break out of the MentalJS sandbox they were all caught by the regular expression filters.
The most interesting MentalJS bypass submission was from Roman Shafigullin which included a method of breaking the parser. My analyzing the JS, he found that he could break the parsing by setting an emply script tag:
With this as the payload, it then brok this section of the MentalJS parsing:
He was then able to set the "src" attribute to anything he wanted and chose to pull in a JS file hosted from his own server:
When resulting full payload returned the following:
Guiseppe Trotta sent in the first succesful submission.
Here were the payloads he used -
There were others who submitted similar payloads that used document.body.innerHTML to override the MentalJS sandboxing-
There are a few DOM events that are not covered within the current version of MentalJS including:
Ok, so in this conclusion section, I am going to hit you with some Earth-shattering revelations! No, not really. What I will cover here, however is information that re-enforces security themes you have heard before with relevant attack testing data.
Trust, but Verify - Ronald Reagan.
Our rules are of a high quality because they have been field tested by the community. Only when top-tier web app pentesters focus some QA effort on the rules will they become better. It is through these types of public, community hacking challenges that we are able to strenthen our rules. The question is - what are other WAF vendors doing to test their rules???
Negative security models used on their own is not enough to prevent a determined attacker. It is only a matter of time before they are able to identify an evasion method. While this is true, negative security models do still have value:
There are many other methods of detecting malicious payloads besides regular expressions. Some other examples are:
The combination of server-side blacklist filtering and client-side javascript challenge proved to be extremely effective. While some submissions were successful in evading the filters, they were not able to break out of the MentalJS sandbox. On the flip side, those submissions that were able to break out of the MentalJS sandbox, were not able to evade the filters. Use multple different methods of identifying attacks to increase coverage and to compensate for weaknesses in other layers.
Last week, I was making some performance enhancements to the VNC protocol implementations in the TrustKeeper Scanning Engine. Unfortunately, in my mission to "Go Fast!", I managed to trigger a Denial of Service (DoS) vulnerability in Vino. Vino is the VNC server for the GNOME desktop environment and also happens be to the default VNC server for popular Linux distributions like Ubuntu.
Shortly after finding the vulnerability, we reached out to the GNOME project and the security team there was nothing short of awesome for us to work with. They patched the vulnerability the same day (link) and they notified the major Linux distributions with a fix the day after (link).
The vulnerability should be fixed in Vino 3.9.92 (and 3.8.2 if there is a future release in the 3.8 branch). At the time of this writing, it doesn't appear that the patch has made it's way down to the Ubuntu distribution just yet, but I hope it will be there and in other distributions very soon.
If you want more details about the vulnerability, including PoC code, please see our detailed advisory.
***UPDATE – October 2, 2013***
Ubuntu released USN-1980 to address this vulnerability on September 30th, 2013.
During a recent code review for a client, I also took a brief look at a tool they were using to manage their MongoDB platform. The tool, called RockMongo, provides similar functionality for MongoDB NoSQL databases as PHPMyAdmin does for MySQL. Fortunately this client follows recommended practices and has restricted this tool to internal access only.
We have attempted multiple times to contact the RockMongo developers to disclose these vulnerabilities to them. However, we have received no response. Our recommendation is to restrict access to this tool and not expose it to the Internet. Additionally, I will be providing mitigation recommendations in this post.
The first vulnerability identified was Reflected Cross-Site Scripting (XSS) in the main login page of the application. It was as simple as this…
The interesting thing about this vulnerability was that they actually have a means to mitigate it in their code already. This is the function in "rock.php" that gets the parameters from the URL…
* 获取参数的值
* 与x($name)不同的是,该函数获取的参数不会被自动过滤(通过trim和htmlspecialchars)
* @param string $name 参数名
* @return mixed
* @see x
function xn($name = nil) {
if ($name == nil) {
array_merge(rock_filter_param($GLOBALS["ROCK_HTTP_VARS"], false), $GLOBALS["ROCK_USER_VARS"]);
if (array_key_exists($name,
return $GLOBALS["ROCK_USER_VARS"][$name];
if (array_key_exists($name,
rock_filter_param($GLOBALS["ROCK_HTTP_VARS"][$name], false);
return null;
When the comments are translated, we find this "the parameters of this function are not automatically get filtered (through the trim and htmlspecialchars)". Filtering is normally provided by another function…
* 过滤参数
* @param string $param 参数
* @param boolean $filter 是否过滤
* @return mixed
function rock_filter_param($param, $filter = true) {
if (!is_array($param) && !is_object($param)) {
if (ini_get("magic_quotes_gpc")) {
$param = stripslashes($param);
return $filter ? htmlspecialchars(trim($param)) : $param;
foreach ($param as $key => $value) {
$param[$key] = rock_filter_param($value, $filter);
return $param;
As you can see in the xn() function, they are explicitly disabling the filter [rock_filter_param($GLOBALS["ROCK_HTTP_VARS"], false)]. As such, anywhere that function gets used is vulnerable. Until an official patch is available from the vendor, you might consider changing this second parameter to true in the calls to rock_filter_param() from the xn() function.
The second vulnerability discovered was a Local File Inclusion (LFI) and Path Traversal vulnerability. This vulnerability is also pre-authentication. It allows an attacker to read arbitrary files on the server and possibly execute arbitrary code.
The vulnerability lies with the use of the "ROCK_LANG" cookie. The application uses this cookie's value in the included path to a language file, and since the platform runs on PHP it also suffers from NULL byte injection. The following example shows how this can be used to display the server's "/etc/password" file.
Here is the request to the server…GET
/index.php?action=login.index&host=0 HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0
(Macintosh; Intel Mac OS X 10.8; rv:18.0) Gecko/20100101 Firefox/18.0
Accept-Encoding: gzip,
Connection: keep-alive
…with the following result.
There appear to be two functions that are vulnerable to this attack, rock_lang() in "rock.php" and message() in "app/lib/page/RPage.php". For example in "rock.php", the __LANG__ constant gets set from rock_init_lang() function…
function rock_init_lang()
if (isset($_COOKIE["ROCK_LANG"])) {
define("__LANG__", $_COOKIE["ROCK_LANG"]);
…which is then included in the rock_lang() function.
function rock_lang($code)
if (!isset($GLOBALS["ROCK_LANGS"])) {
$file = __ROOT__ . "/langs/" . __LANG__ . "/message.php";
Until the developer can provide a patch, you may consider validating the __LANG__ parameter in "rock.php" with a regular expression like so…
function rock_init_lang()
if (isset($_COOKIE["ROCK_LANG"])) {
if (preg_match('/^[a-z]{2}_[a-z]{2}$/', $_COOKIE["ROCK_LANG"]) {
else {
define("__LANG__", "en_en");
I would also recommend you keep checking back with the developer to see if they release a patch. The latest version of RockMongo can be downloaded here.
Our advisory can be found here:


text:
Football Bowl Subdivision | ||||||||||||||||||||||||||||
· Conferences · Gaming Matchup · Injuries (A-M) · Injuries (N-Z) · News · Current Odds · Live Odds · Schedule · Top-25 Scoreboard |
· Full Scoreboard · Statistics · Top-25 Results · Transactions · Weather Polls: · AP · CFP · Legends · Amway |
More Football · Arena · CFL · DIV II College · DIV III College · FCS College · NFL |
NCAA Game Summary - South Florida at UCF (Saturday, September 6th) Final Score: (17) South Florida 31, UCF 24 (1-OT) Orlando, FL (Sports Network) - Matt Grothe threw a 25-yard touchdown pass to Taurus Johnson in the only overtime and the 17th-ranked South Florida Bulls held off the UCF Knights, 31-24. Grothe completed 23-of-40 passes for 346 yards with three touchdowns and two interceptions for the Bulls (2-0). Johnson caught six passes for 143 yards. Cedric Hill added four grabs for 62 yards and two scores, and Carlton Mitchell had three for 65. Moise Plancher ran for 50 yards and one score on nine carries. Michael Greco completed 17-of-32 passes for 150 and two touchdowns for the Knights (1-1), who fell to 0-18 all-time against ranked opponents. Rocky Ross had eight receptions for 90 yards, including one score. UCF was down 14 points late in the fourth quarter, but Greco threw touchdown passes of 13 yards to Corey Rabazinski and 31 yards to Ross within a span of 66 seconds to tie the game at 24 with 1:40 to go in regulation. The Bulls then embarked on a 12-play drive, advancing the ball to the UCF 25. The contest, though, went to overtime after Delbert Alvarado missed a 42-yard field goal in the closing seconds. In the extra session, Grothe hooked up with Johnson for the go-ahead score. Two straight runs by UCF's Ronnie Weaver set up a 3rd-and-one from the USF 16. Weaver was then stopped for no gain and after a false start infraction forced the Knights into a 4th-and-five situation, Greco tried to run for the first down, but came up just short of the marker. South Florida scored on its first possession of the game. A 27-yard run by Plancher on 2nd-and-two moved the ball to the UCF 23. Three plays later, Plancher rumbled 14 yards into the end zone for a 7-0 Bulls lead. The advantage was short-lived as Joe Burnett returned the ensuing kickoff 91 yards for a score. The Bulls then put together an epic 12-play, 82-yard drive that ate up nearly six minutes of the clock. Facing 3rd-and-10 from their own 26, Grothe threw a 16-yard pass to Johnson to move the chains. South Florida eventually marched to the UCF 3 before settling for a 20-yard Alvarado field goal. A 38-yarder from Nick Cattoi tied the game at 10 with 2:49 to go in the first half. South Florida added to its lead as Grothe threw a pair of third-quarter touchdown passes -- 18 and 27 yards -- to Hill. Game Notes South Florida had 25 first downs compared to UCF's 12...The Bulls outgained the Knights 504-226...UCF was whistled for 12 penalties (148 yards)...South Florida was 9-of-19 on third downs, while UCF finished 5-of-16. 09/07 01:20:43 ET |

subset: commoncrawl


text:
Soap for Kids Original Scent, 8 oz, From Rainbow Research
See all products in:
Hair Spray Gel Mousse
Children's Multi Vitamin
Body Wash For Kids
Liquid Soap Bar
Rainbow Research
Customer Reviews:
Stock #:
Manufacturer Part #:
In Stock - Usually Ships Within 24 - 48 Hours
We Ship To:
Shipping Rates
Ground Shipping
Order Under $100:$6.99
Order over $100:FREE SHIPPING
Soap for Kids Original Scent by Rainbow Research
BUBBLE BATH Aloe Vera and Vitamin E have been added to help moisturize the skin. The bubbles are rich and long lasting, providing fun in the bathtub, hot tub or whirlpool. SHAMPOO for Kids is a gentle, non-irritating formula that brings out natural shine and adds body. SPRAY DETANGLER for Kids contains the herbal extracts of Chamomile, Clover, Comfrey, and Balsam. Sprayed on after a shampoo and combed through, even the curliest hair can be combed and styled easily. Can also be used on dry hair. ANTI-BACTERIAL LIQUID SOAP for Kids contains triclosan, a safe antibacterial ingredient that helps prevent bacterial growth on children's skin. Aloe Vera and Vitamin E have been added to give the skin a soft, smooth feel.
Rainbow Antibacterial Soap for Kids is the gentle way to wash away germs and bacteria. Perfect for bathroom. kitchen, or in the playroom. This formula contains Triclosan, an organic, safe, antibacterial ingredient, along with Tea Tree Oil, Aloe Vera, and Vitamin E. This bottle is recyclable and made from PET. Biodegradable. No Animal Testing, Animal Ingredients, or Artificial Colors.
VitaDigest offer Asian Entree Soy Ginger Noodle 6 Pack 1.9 oz (54 g) , Product Review For Dr. McDougall's Formula and Information, Exclusive Reivews for Asian Entree Soy Ginger Noodle 6 Pack 1.9 oz (54 g) Dr. McDougall's
The products and the claims made about specific products on or through this site have not been evaluated by the United States Food and Drug Administration and are not approved to diagnose, treat, cure or prevent disease. The information provided on this site is for informational purposes only and is not intended as a substitute for advice from your physician or other health care professional.
Products image are NOT always exactly as shown on the photographs. We try to be as accurate as possible with photos. Please check the Title carefully before ordering.
All models are 18 yrs or older.
Copyright © 2002-2014 VitaDigest.com. All Rights Reserved.


text:
Is there such a thing prior to fermentation? I just started my 2nd batch of hard cider yesterday and used considerably more sugars than my previous attempt-- not sure why, just feeling adventurous I guess. My recipe is below-- what I am wondering is, given the yeast and the amount of sugar used (my SG was around 1.082) am I going to get vinegar... or jet fuel... or good cider? 4.5 gal pasteurized apple juice .25 gal pure cherry juice 24oz pure clover honey 4lbs Dextrose Wyeast #4766 cider yeast Any thoughts, comments, criticisms, recommendations? Thanks!
Primary: Reagan's Ragin' Apple Cider Secondary: n/a Bottled: Cherry Apple Sparkling Cider Next:
That OG would be "wine". My wines are usually 1.085-1.100, depending on what I'm making.
Yooper-- very true. Apfelwine is fine with me (since that is sort of what the last batch was and came out excellent!) I just want to make sure that the large amount of sugar in my batch is not going to create vinegar (not sure what makes this stuff go the vinegar route at all) rather than wine/cider. My first batch had an OG around 1.054 and dropped to 0.998 after fermentation. I think it was around 12% at that point and I ended up backsweetening prior to bottling (and consequently blew up about two dozen bottles trying to pasteurize them on the stove-- oops!)
Excellent, that was exactly the info I needed. Many thanks, Yooper! Cheers!
There is a point where there is too much sugar in solution for the yeast to ferment, I'm not sure what point that is. I know that if you were to put yeast into some honey, it wouldn't be able to ferment it due to osmotic shock (a much higher concentration of solutes outside of the cell when compared to inside of the cell).


text:
DL News Staff
Author Content
Oct. 2, 1924-Nov. 26, 2010 Robert H. Medaris, 86, of Park Rapids, died Friday, November 26, 2010 at the home of his daughter Valerie in Detroit Lakes, surrounded in love by his family, and under the care of Hospice of the Red River Valley. Robert Henry Medaris was born to Henry and Amalia (Kopke) Medaris on October 2, 1924 in Mankato, Minn. He lived and attended school in Minneapolis. In 1946, he attended the Beck School for Radio in Minneapolis and the Coyne Electrical School. On December 20, 1946 Robert married Helen Emelia Pearson at Mount Olivet Lutheran Church in Minneapolis.
June 27, 1949-Nov. 24, 2010 Larry L. Wanner, 61, of Frazee died Wednesday, November 24, 2010 at the VA Medical Center in Fargo. Larry Lee Wanner was born to Alvin and Sarah (Heinle) Wanner on June 27, 1949 in Bismarck, N.D. As a young boy, he moved to Lake Park and attended school there. He later graduated from Detroit Lakes High School. Larry then served in the United States Air Force from 1968-1972. Following his discharge from the Air Force, he returned to the Detroit Lakes area.
Luella E. Gandrud, 96, of Detroit Lakes, passed away Tuesday, November 16, 2010 in North Oaks, Minn. Luella was born to Martha (Klug) Meyer and Frederick Meyer on November 30, 1913 in Luce, Ottertail County, Minn. She was educated at Luce, Perham and Frazee, graduating from Frazee High School in 1932. During her high school years Luella worked at Pettibone Lodge at Shoreham. After graduating from Lawrence Beauty School in Minneapolis, Luella was a licensed cosmetologist and was employed in Detroit Lakes at Mickey's Beauty Shop. In 1937 Luella married K.I.
July 31, 1977-Nov. 19, 2010 Anna M. Levy, 33, of Ogema, died Friday, November 19, 2010 as a result of injuries received in an automobile accident near Waubun. Friends may call from 4 p.m. Friday, Nov. 26 until 9:30 a.m. Saturday, Nov. 27 at the White Earth Community Center in White Earth. Funeral services are set for 11 a.m. Saturday at St. Columba Episcopal Church in White Earth, with Reverend Coke Smith officiating. Interment will be in the church cemetery. Anna Marie Levy was born to Selim "Deet" Keezer and Sandra Levy on July 31, 1977 in Detroit Lakes.
Jan. 31, 1925-Nov. 20, 2010 John E. Ista, 85, of Detroit Lakes, died Saturday, November 20, 2010 at St. Mary's-Essentia Health in Detroit Lakes. Friends may call from 4 to 8 p.m. Friday, Nov. 26 at the David Donehower Funeral Home in Detroit Lakes. There will be a prayer service at 7 p.m. The visitation will continue for one hour prior to services at the church on Saturday. Funeral services are set for 11 a.m. Saturday, Nov.
Former Red Lake, Minn., resident Rhonda Susan Graves (Ojibwe name, "Benasii Equay"), 60, of Detroit Lakes, died Wednesday, November 17, 2010 at St. Mary's Essentia Health Hospital in Detroit Lakes. A wake will begin on Saturday morning at the Redby Community Center in Redby and will continue until the time of services on Monday. Traditional funeral services will be held at 10 a.m. Monday, Nov. 22 in the Redby Community Center in Redby, Minn., with interment at the Fox Point Cemetery in Redby, under the direction of the Cease Family Funeral Home of Bemidji.
Sept. 12, 1916-Nov. 12, 2010 Former longtime Detroit Lakes resident Virginia E. Sprafka, 94, of St. Paul, died Friday, Nov. 12, 2010, at the Health and Rehabilitation Center of New Brighton in New Brighton, Minn. A Mass of Christian Burial for Virginia was conducted at St. Agnes Catholic Church in St. Paul on Tuesday, Nov. 16. Interment was in the St. Stanislaus Catholic Cemetery in Perham. Virginia was born to Edwin and Mary Huseby on Sept. 12, 1916, in Medicine Hat, Alberta, Canada. She grew up and attended schools in the Prairie Provinces of Canada.
Sept. 24, 1966-Nov. 1, 2010 Former Fargo resident Jerome F. Riley, Jr., 44, Largo, Fla., died Monday, November 1, 2010 at his home in Largo. A mass of Christian burial is set for 11 a.m. Wednesday, Nov. 24 at Holy Rosary Catholic Church in Detroit Lakes, with Monsignor Timothy McGee officiating. Friends may call at the church one hour prior to the service on Wednesday. Interment will be in St. Mary of the Lakes Catholic Cemetery near Pelican Lake. Jerome F. Riley Jr. was born to Jerome F. and Mary (Volk) Riley on September 24, 1966 in Fargo.
Jan. 9, 1944-Oct. 30, 2010 Orrin Clifford Espe, 66, died on Saturday, October 30, 2010 at his home in Trion, Georgia at the age of 66. Orrin was born the son of Orval and Beatrice (Gilbertson) Espe on January 9, 1944. He attended school in Mahnomen and graduated with the class of 1962. After graduation he worked as a truck driver for Swifts turkey plant for many years. He married Karen Toczek in 1963 and together they had three sons. In 1975, he moved to Detroit Lakes and married Jeanette Templin, and together they had a daughter.
April 2, 1934-Nov. 15, 2010 Francis "Jeep" Monroe, 76, of Waubun, died Monday, November 15, 2010 at the Twin Valley Living Center in Twin Valley. Jeep was born the son of Robert and Lenore (Bergen) Monroe on April 2, 1934 in White Earth. As a young boy, he attended the Mission School in White Earth. He entered the United States Navy in October of 1951, was honorably discharged on April 4, 1955, and then made his home in White Bear Lake, Minn. He was married and to this union, three children were born.


text:
Ready Set for MLA 2013
The online registration for MLA 2013, "One Health: Information in an Interdependent World," on May 3-8, 2013, in Boston, MA is open. http://www.mlanet.org/am/am2013/register/register.html .
Wondering what will be presented at the meeting? Check out the preliminary program (now available) to check out the plenary speakers, CE courses, various events, and the concurrent program sessions.
Finally, make sure you are keeping up with all MLA'13 news by subscribing to the blog http://npc.mlanet.org/mla13/. You can either subscribe to it via RSS or via email (bottom right).
Hope to see you in Boston!
Share on FacebookCategories: Annual Meeting Tags:
Give Your Imput on MLA 14 NOW!
When I was co-chair of the MLA 12 annual meeting in Seattle, we solicited the membership for ideas and suggestions for programs, CE, speakers, etc. I am pretty confident in saying that Teresa and I were up for almost anything. We wanted it to be a fun but relevant meeting for people (the two are not exclusive).
The BIG thing to remember is that much of the annual meeting is planned WAY in advance. So if you are at the 2013 thinking of suggesting a speaker, CE, or program for the 2014 meeting…it is most likely too late. Those things have been decided and are being finalized. The jetway doors have closed and the plane is on the tarmac talking to the tower.
So that is why I am forwarding this request from MLA'14. If you don't submit your ideas NOW you will have to wait to track down and give them to the 2015 NPC people.
Submit Ideas for MLA '14 CE Courses and Symposia Now!
The MLA Continuing Education Committee (CEC) wants to hear from you! What new topics or courses have caught your eye? Who is teaching a class or has expertise you would like to tap into? What classes from past meetings would you like to see offered again? Are you currently a course instructor or would you like to create a new course? You may nominate yourself. MLA is accepting ideas for exciting and innovative courses and symposia to offer at MLA '14 in Chicago, IL. Suggestions must be submitted by Friday, December 14, for consideration by the MLA CEC at its midwinter meeting. More information and forms are available on MLANET.
You only have a week to do it, so don't hesitate. Every year I hear somebody who bemoans that MLA is only for this or that type of medical librarian. Or there weren't any CEs and programs on certain topics. Part of me wants to turn around ask them if they suggested anything to the NPC ahead of time. Because if they didn't, well then whose fault is it?
So stop being reactive, be proactive! Submit your ideas for MLA'14 now.
Share on FacebookCategories: Annual Meeting Tags:
Win a Trip to MLA 2013 in Boston
NN/LM Middle Atlantic Region members, you have a chance to win a trip to MLA 2013 in Boston! It all centers around National Medical Librarians Month which is right now, in October.
(re-posted from the MARquee)
MAR would like to celebrate medical librarians in our region. National Medical Librarians Month gives information professionals an opportunity to market their services and highlight their contributions to research, education and improved patient outcomes. Are you doing something to celebrate Medical Librarians Month? If so, share your story by sending to nnlmmar[atsign]pitt.edu. If applicable, also share a photo depicting your activities/events.
MAR will be collecting your stories and highlighting them in our blog and weekly postings throughout October. All those that submit a story before Oct. 31st will be entered into a random drawing to receive an award to cover registration and airfare to MLA 2013. Please, only one entry per library.
NOTE: There has been a change to the entry rules. Multiple entries may be received from the same library, but only ONE entry per person.
I love these kind of opportunities and I wish there was a central area where medical librarians could look up all possible funding opportunities to attend the annual meeting. So, if you are a Chapter, Section, or other group giving away a scholarship, grant, contest, etc. to attend the 2013 MLA Annual Meeting, please email me or comment and I will post it on my blog so that more people know about it. Please don't consider my blog to be the central area to find this sort of thing, so if you are advertising or search about funding opportunities please make sure you look in multiple places. I just want to promote them as best as possible, so people who don't get institutional travel money have one more place to read and find out about them.
Share on FacebookCategories: Annual Meeting Tags:
Mark Funk's Janet Doe Lecture Video
If you weren't at MLA in Seattle this year then you missed hearing some great speakers, one of which was Mark Funk and his Janet Doe Lecture. If you paid for MLA e-conference package you can catch the other speakers from MLA's online meeting content site. But you can also catch Mark's phenomenal lecture at https://vimeo.com/45367116
In preparation for the Doe Lecture, Mark chose to analyze word usage from the content in the MLA Bulletin from 1960-2010. The words we chose while writing in the Bulletin tell a story of medical librarianship through the years. Mark spend 225 hours analyzing the words came up with 4 basic categories: Environment, Management, Technology, and Research. It was very interesting as well humorous. By looking at the word usage you can see how trends have come and gone and how some things like Reference has consistently stayed on our minds through the years.
Check out Mark's lecture https://vimeo.com/45367116 and the blog posts from Annie Hughes and Natalie Clairoux MLA about his lecture.
Personally, it is a freaking great lecture.
Share on FacebookCategories: Annual Meeting, Other Medical Library Stuff, Technology Tags:
Midwest MLA Call for Papers and Posters
Since I'm in the Midwest I thought I would forward along the call for papers and posters. This year the Midwest Chapter's meeting will be in Rochester, MN at the Mayo Civic Center from October 6-9, 2012.
The deadline to submit your paper or poster abstract is July 13, 2012!
So you have about 2 weeks left.
New this year will be an option to compete for a new Research Award. (See http://midwestmla.org/midline/?p=1347 for more information, and watch your inboxes for more details from the Professional Practice Committee.)
(Official call below)
Call for Papers and Posters
The Program Committee invites proposals for contributed papers and posters for the conference theme of "Growing Opportunities." Papers and posters may highlight practical problem-solving approaches, document collaborative efforts or outreach activities, describe innovative programs, or report on research in librarianship, resources or services. Contributed paper and poster topics are as unlimited as your imagination.
Contributed papers will be presented on Sunday, October 7. Posters will be on display on Monday, October 8 from 8:00 am until 3:30 pm. Presenters should be available to discuss their posters during the poster reception from 11:00 am – noon on October 8. For inspiration, take a look at the abundant and varied papers and posters presented at the 2011 Midwest Chapter meeting.
For contributed paper proposals and poster proposals submit a 250 word abstract describing your paper or poster. Include your name, position title, address, phone number and email address on all submissions. Email your abstracts to Ann Farrell, farrell[atsign]mayo[dot]edu, or snail them to her at Plummer Library, Mayo Clinic, 2001st SW, Rochester, MN, 55905. The deadline for abstract submission is July 13, 2012. Notifications of paper/poster acceptance/rejection will be made by July 27, 2012.
For more information on the Midwest Chapter meeting, see the conference web site: http://midwestmla.org/conference2012/
Share on FacebookCategories: Annual Meeting, MLA Events/News, Other Medical Library Stuff Tags:
What Can MLA Do For You?
I sometimes hear people saying, "I don't belong to MLA because what has MLA done for me as a medical librarian." If you are looking for MLA to come in like a knight in shining armor to magically save your job, increase your salary, combat predatory pricing, and bring about universal health care, you are probably a disappointed medical librarian.
I have gotten the most value out of MLA because of my involvement within MLA. Did you catch that? It was my involvement in MLA that began to add value to my MLA membership. Not the other way around. All too often in society we see a lot of reaction type of people and fewer and fewer action type people. You can't sit around and wait for things to happen and expect results. Life is not a spectator's sport, nor is your profession.
I know that is hard to think about in a field that tends to have more than its fair share of introverts among its ranks. Heck, even the average extrovert can go to an MLA meeting for the first time and feel intimidated. However the key to getting the most out MLA (the meeting AND the organization) is by getting involved. I have had the wonderful opportunity to do some cool things like travel to places to be a speaker, sit on various committees, be on two NPC committees, and become a Board Member. However I didn't just land those gigs on my good looks. I got involved. Baby steps at first. I started writing book reviews and my blog, then journal articles. The book reviews let to greater writing confidence and the blog helped feed the topics. Around the same time I became gradually involved in my local medical library organization, Ohio Health Sciences Library Association (OHSLA). From there I started volunteer to work on projects or items as they came about. It was that work that lead to the things I am doing today. Without it I wouldn't be where I am now. Why? Because people wouldn't know who I was and wouldn't know what I could do.
You don't have to start a blog to get involved. (It would probably be a Pinterest board or Tumblr account now days.) But you have to find those areas that you are interested in so that you can get involved. Personally, I think the best way to get involved is to start with your local organization, Chapter, or a MLA Section. Get to know people. Volunteer to do some things. You don't always have to be going to the annual meeting to become involved. There are committees that meet mainly via email. Sections are always looking for section member volunteers to review papers for the annual meeting. You can even teach a class all online without the need for GoToMeeting or some webinar platform. The South Central Chapter just finished providing a FREE online class to MLA members https://sites.google.com/site/getmobilizedmla/home and the course instructors were from across the United States. (I am willing to bet a bag of peanut M&M's they did everything virtually and didn't need to travel to MLA or another meeting to create the class.)
The times we live in allow us more opportunities to connect to one another and provide us more opportunities to become involved. More and more things are done via email and using other online methods. This should provide the individual with more ways to participate. Only by getting involved and participating can you get the most out of your membership. My MLA membership has improved my job, increased my salary and helped me become a better negotiator. But it wasn't the paper membership card that did that. It is my continued involvement within the organization, the people I meet, things I learn, the opportunites and ideas discovered that has done that and continues do that. Now I wouldn't be able to do that without the paper membership card, but the paper membership card doesn't do it on its own.
I am going to badly twist a former United States President's words, but it sums up my thoughts perfectly.
My fellow librarians: ask not what MLA can do for you — ask what you can do for MLA.
Categories: Annual Meeting, MLA Events/News, Other Medical Library Stuff Tags:
What I Learned at MLA
The first thing I learned is that being a Section Chair, NPC co-chair, Board member combined with a 3 hour time change makes Michelle a very tired girl at the MLA meeting. So upon leaving Seattle and returning to Cleveland I decided to take a week break from all things librarian (except for my job) to get some much needed down time.
Now I am back with renewed energy and want to talk/blog again. So I thought I would list a few thing of what I learned at MLA. Some are just small things while, other things are a little bigger and will probably be a future blog post.
- Get involved! So many people asked me and others I know about the best way to get on committees and being a part of MLA. Short answer: Get involved. Long answer: See my "how to" blog post later this week.
- Food is good, but sometimes expensive, think outside the box to lure people to meetings/programs. I was the chair for MIS, I discovered it would cost close to $450 to provide snacks (cookies and soda) for the MIS Business Meeting. That is a lot of money and last year the promise of a free breakfast still had us scrambling for enough members for a quorum. So we got creative and offered an iPad 2 ($400) as an attendance prize. We had people sitting on the floor at meeting. Think of this when you are trying to lure people (doctors, nurses, med students, librarians, etc.) to a meeting or a class.
- Google+ Hangouts might be a good free alternative for small group webinars or conference calls. You can post the documents online and share them with the Google circle. Big thing to note…you will need a laptop to initiate a Hangout. So far you can only attend a Hangout on an iPad not be the one who initiates it.
- I can almost do everything I need to do on iPad and may not need my laptop at meetings anymore. I say almost because if I want to do a Google Hangout (which we did for the MIS Business meeting) I need a laptop. I also needed a laptop for displaying the Twitter feed at the Tech Trends program, but that was more for my comfort.
- Need anything while at the conference? Use Twitter! I had a bad headache and tweeted I needed some Advil and debated about going back to my hotel room to get some. Within one minute 5 people tweeted they had some for me, including one person in the same room. I repaid my Twitter karma by giving Alisha764 some Advil when she tweeted she had a headache.
Other observations:
- More people had iPads or smartphones than I have ever seen in one conference. I think the knitting librarians dropped their needles and yarn and bought iPads. If you doubt me take a look at gabinator's Instagram photo of the conference room when Mark Funk asked people to lift up their mobile devices. It's blurry but look at all of those white screens.
- There is NEVER enough time to see and do everything….that just conference life. That is why the online content is so important now.
- There is probably a need for "How to do an MLA Meeting" online guide for first time attendees.
- You can never have enough power outlets.
- If you do a Google Hangout to include members not at the conference, don't schedule your meeting for Saturday or Sunday.
This is just a list of some of the things I learned and observed. I plan in the next week or two to highlight a few posters and presentations that I found especially helpful or insightful.
Share on Facebook
Categories: Annual Meeting, Other Medical Library Stuff Tags:
Friday Good: MLA Relevant Issues Service Project
The Official MLA'12 Blog has a post about the Relevant Issues Section project for the Pioneer Square Clinic. The section invites MLA 2012 attendees to pack a little extra and bring along new socks and underwear, in all sizes, for both men and women. Extra toiletries from your hotel room may also be donated. A collection box will be set up in the registration area. Pioneer Square Clinic is in the Pioneer Square Neighborhood, serves over 1,000 homeless and low-income patients each month and has been doing so since 1971.
So just before you leave make sure you hit the store so you help others out. Also if you bring your toiletries from the hotel each morning, housekeeping will replace them each day and you can bring more.
Share on FacebookCategories: Annual Meeting, Friday Fun Tags:
Kick Some MLA Butt
I just posted on the MLA'12 blog, Bring Your "A" Game to the Unofficial MLA Kickboxing Class about the opportunity to participate in a kickboxing class taught by Gabe Rios. It will be at the downtown YMCA in Seattle on Tuesday, May 22, 2012 at 7:00am. It is a cardio workout and not a full-contact class. You do not have to be familiar with kickboxing or martial arts to take this class.
I have never taken a kickboxing class ever, but I am interested in trying it. So if you are a Kung Fu Panda like me don't be intimitated, come on try it out and learn from our Master Shifu of MLA.
Share on FacebookCategories: Annual Meeting Tags:
Calling all Shutterbugs
Some of us are camera people and take pictures no matter the event, some of us snap a shot or two with our cellphones if the mood or subject strikes us. Whether you are a budding photo journalist or just an occasional cell phone snapper the NPC would like you to post your MLA'12 photos online for all to see.
Simply join the mlanet group on flickr and upload your photos. More details about the flickr group can be found on the MLA'12 blog. Don't forget to tag your photos with the year!
Share on FacebookCategories: Annual Meeting Tags: