text:
Posts Tagged "Chicago"
Generally speaking, if somebody greets me with the phrase, "Hey bro! Happy [insert any day of the week]!" I pretty much want to stab them in the neck. It's obnoxiously chipper and means literally nothing except that you're an idiot who probably shouldn't be happy, when every single day of the week is equally happy, happily prancing along the trajectory of the great lie that is your miserable life. But today… today is an exception. Happy fucking Friday everyone. We made it.
Before we get into anything else, I'd just like to direct your attention to this, for all of my viewers who are like me and only leave the confines of their secluded fortress under the cover of darkness.
That is, I'm pretty certain, what people are referring to when they say that something is "the shit." For those of you who don't know, 69 degrees is actually the constant temperature of God's crotch, the temperature from which all other good temperatures were decided. It's true, ask a priest some time. Anyway…
Didn't really plan this post ahead of time so I just went with an old standby — some of Dedleg's trademarked sunset shots. It had been a while since I had posted anything up from Chicago anyway, although with these two I've pretty much exhausted my backlog of photos from when I was living there. In fact, these are the last two sunset shots in particular — I actually took them the day I was moving out. Let me tell you, that was not a happy Friday.
Blue and yellow, blue and yellow
Towards the end of September, I meandered over to Chicago's magical Painted Forest after catching glimpses of it from the drunken haze of a late night cab ride down Lake Shore Drive many times during my tenure in the Windy City. It's not quite a whole forest, more like a handful of dead trees the Park District decided to give the Dr. Seuss treatment as something of an artistic statement, but mostly as a way to mark them for eventual removal. Nonetheless, they are pretty eye-catching and the whole project certainly gives new meaning to the phrase "the trees are turning colors", to make the worst possible joke I could have there.
To be totally honest, however, the Lily Pond just a short walk away feels considerably more magical, even if it is less surreal. The Painted Forest looks a lot more interesting from the highway than when you're actually there, standing next to a parking lot while people power-walk past you. Still, it was worth checking out just because, you know, most trees aren't blue and novelty goes a hell of a long way.
The trees were scheduled for removal this fall — in fact, when I arrived some of them were already gone, so it wouldn't surprise me if they had all made it to the great wood-chipper in the sky by now. Hopefully, anyway, since I heard the lead poisoning levels in Lincoln Park's squirrel population was unusually high this year.
I gotta feel the wind chill again before I get old
At long last, here is the final batch of photos from my long and drawn-out North Beach series. But I may never see Lake Michigan again, and taking photographs is a good way to back up your mind's eye.
The amount of random shit you find on a beach is astounding. Well, "random" might not be the best word… considering the vast majority of the litter is alcohol containers. And when you think about it, this abandoned corsage probably isn't all that random either. These photos were taken in September, so it could very well be some of the wreckage left behind by some post-Homecoming-dance carousing. Which certainly would explain all the bottles of Smirnoff Ice.
Speaking of astounding — water. As usual. Astounding that the same water that existed on the earth millions of years ago is the water we're drinking today. Astounding that much of the universe's water was produced as a byproduct of star formation, and by logical conclusion, that means that we're made up of star shit. And astounding how some bloodless executive at a soft drink company board meeting figured out they can make obscene profits from soda without any of the flavor or carbonation, indeed, from the same substance that covers over 70% of the entire planet: water.
Ebb and flow
If you're any kind of self-respecting human being, you love water. I love water so much, somebody once asked me, "If you love water so much, why don't you marry it?" But I told them that relationship would be at least 35% incestuous, since all humans bodies are about 60% water. I may love me some H20, but… but let's not get crazy.
And speaking of water, I'm trying to keep my head above it — back to work
Northern Exposure
As promised (or perhaps threatened), and in continuing celebration of this ridiculously cold season, here are more wintry photos from Chicago's North Beach.
Sometimes getting a nice shot has less to do with actual skill or experience, and considerably more to do with sheer luck and how quickly you can click the shutter. For example…
In warmer months, North Beach is one of the Windy City's preeminent illegal public drinking spaces. Although, if you said it was peerless, people might get confused
Speaking of peers, sort of… I'm not entirely sure what the story is behind these cables, but they seem to form in a grid within the entire pier — I imagine to strengthen the concrete and keep it from gradually crumbling into the lake. Somehow I think these ones aren't quite doing their job.
Mmm-hmm! Just look at that product placement. Advertisers, what are you waiting for? There's another eager corporate shill right here, waiting for your loving arms.
Movin' to the country, gonna eat a lot of beaches
Back when I lived in Chicago, I'd often pass North Beach on the highway between downtown and my neighborhood, which was farther north. That seemingly endless row of scattered pilings always caught my eye. Due almost entirely to laziness, despite my constant intentions, in two years I never made it down there to take pictures. So finally, with the moving van's proverbial gun to my head, I paid North Beach a visit.
The beach's proximity to downtown Chicago makes it a complete frenzy in the summer, but that's only about 5% of the year there, and the rest of the time it looks sad and desolate — just how I like it.
Sure, those pilings photograph well, but they're actually there to keep the lake from consuming the beach — a body of water the size of Lake Michigan has a big appetite. There is a strip of sheet steel running between the pilings under the water, which, aside from making swimming there extra deadly, also keeps all the sand from being washed out into the lake.
North Beach is huge — I underestimated its size when accounting for time and found myself rushing against the waning daylight to see everything. Nonetheless, I managed to take somewhere around a billion pictures before the light and the cold won out.
So, needless to say, there's more where that came from.
In a surprise move (not really), I slacked off all weekend and didn't work on anything I set out to do. Coincidentally, this is what happens more or less every weekend since I moved back to New York. Weird…
To solemnly remember slower, quieter life in the little Midwestern village that is Chicago, here are a number of random flicks from the Windy City that I've been sitting on for a while.
Oh, and I should note… these are some of the last sunset shots out of that notoriously western-facing window. Not the absolute last, but we're almost scraping bottom here. Something tells me I might be able to find some new ones in New York though…
It's been a couple weeks since I posted up a pile of pictures taken out of my old apartment's kitchen window. And yeah, you've seen it all before, but the days of Chicago sunsets are in their twilight (see what I did there?) Savor them while they last, since just like an actual sunset, they'll be gone before you know it.
For the sake of diversity, I threw in a shot of a shoe filled with spoiled food and/or barf. Kind of the same thing, I suppose, just in different stages of its life.
I woulda taken them home, since they're pretty fly kicks (aside from the, you know, actual flies), but unfortunately they weren't quite my size.
To make matters more random, here's a picture of a metal grate with one of Chicago's most active young vandals, Mental 312. He's sort of like Austin 3:16, only without the Biblical nonsense and steroids. Although, to be honest, it's really not all that random… it's all loosely related to color, which is particularly relevant given the subject matter of sunsets. And that's how you box your way out of a corner.
Time's fun when you're having flies
Now, I know it seems like all I care about around here is blunts, beer and bitches (in that order), but regular readers can attest to the fact that I also have a sensitive side that likes nature, appreciates quiet time alone, and yes, occasionally forgets to wear deodorant. I'm definitely not a hippie, but I'm not a totally vapid hipster either. I'm… hippsterie. Somehow that sounds worse than just "hipster"… weird.
Anyway, Chicago has a pretty awesome and serene lily pond in Lincoln Park, and it's rare that you see something with both those qualities attached, so I'd advise you and all your hippsterie friends to check it out if you're in the area.
I'm not sure what kind of desolate swampland it looks like at this time of year, but when I took these pictures back in September it was like slipping into my very own secret garden, just without any creepy little boys in wheelchairs, so that's obviously fucking fantastic.
If you can temporarily separate from your inner tough guy, or if your tough guy happens to enjoy walks through the woods, it's a really great way to escape the city. Occasionally, there are obnoxious children running around screaming loud enough to scare the lily pads away, but that's nothing a subtle kick into the pond when the parents are busy with their iPhones can't solve. Well, not really… the screaming will almost definitely continue, but it might make you feel better about it, at the very least.
Vegetative State
When setting the table for formal occasions, such as a Halloween-themed dinner parties where the spaghetti looks like a brain and the cocktails have gummy worms floating in them, it's important to remember the sterling silver cutlery is placed in the order of its use, with the implements to be used first farthest from the plate. The salad fork is placed next to the left of the plate, then the meat fork. Just to the right of the plate is the cucumber and on the outside, another cucumber.
That's all for now. My weekend was mostly consumed by All Binger's Eve celebrations and other related activities, so this post is a little half-baked. Also, I'm a little half-baked.
When I go down
Here's a new batch of street slime from Chicago's slimiest and grimiest. Although that's a gross (heh heh) exaggeration. In my neighborhood, the bums would ask you for change with a stolen Big Gulp cup. In the South Side, they ask you for change with a stolen Smith & Wesson. The rents are cheap, and so are the prostitutes, but I don't know, it just isn't worth the risk as far as I'm concerned.
Contest a world where popsicles are in short supply, amiright?
It seemed to me, you lived your life like a plastic tiger attached to a toy parachute in the wind.
Before I moved, I noticed a lot of these strange, hateful (literally, hate-filled — no room for anything but hate here) scribbles popping up all over my neighborhood. This brilliant essayist goes by the pen name The Angry Jew, and given the number of times he mentions killing, shitting on, or otherwise harming and humiliating Nazis I'd say it's a pretty accurate nom de plume.
Torture, rob, murder you dumb nazi ass white gook cowardly dog gay dirty bastard blobs! Kill you darkassed nazis, including brownassed gook niggers also shit on, murder you gook long-haired white gay scatterbrained shitassed fag crackpot blobs! Shit and
Judging from what appears to be an arrow, our scribe actually meant to say, "murder you gook long-haired white gay scatterbrained shitassed fag crackpot shit and blobs!" Which, I think you'll all agree, is a far more eloquent way to end the poem.
To think that generations from now, perhaps after our society has been annihilated by resource wars, economic collapse or ecological catastrophe, alien travelers might look to these few words for an insight into our culture. And the saddest part is, it's actually a semi accurate peek into our fucked up little steaming shit in the communal toilet of human history. And although The Angry Jew seems to have a wide range of criticisms to throw around, in addition to a whole lot of hypocrisy, at the very least, it's pretty hard to not get behind hating Nazis. If the alien explorers can also manage to dig up a Nintendo Wii and a bag of shake, it won't be so bad.


text:
VIEWS: 97 PAGES: 15 CATEGORY: Communications & Infrastructure POSTED ON: 11/15/2012 Public Domain
VERTICAL HANDOVER APPROACHES BASED ON IEEE 802.21 MIH STANDARDS For HETEROGENEOUS NETWORKS Presented by M.HARIKRISHNAN(EC1106) Under the Guidance of Dr.G.SIVARADJE OBJECTIVE The design goal of this project is to provide an efficient vertical handover decision algorithm based on IEEE 802.21 standard for best quality of service. Seamlessly transfer to best access link among all available candidate with no perceivable interruption. Probability of handover failure, unnecessary Handover initiation, Ping-Pong effect should be minimized. HANDOVER DECISION BASED ON IEEE 802.21 MIH STANDARDS The decision to initiate handovers in 3G networks has traditionally based on the received signal strength and availability of resources in a new cell. Such traditional handover decisions use RSS as the only criteria. In order to enable seamless vertical handovers, IEEE 802.21 aims to improve user experience of MTs by enabling handovers between heterogeneous technologies while maintaining session continuity. CONTINUED In a heterogeneous network, handover decisions could also be initiated for other reasons including RSS, network connection time, security, bandwidth, data rate and user preferences. VERTICAL HANDOVER DECISION BASED ON MIHF(MIES,MICS,MIIS) CONTINUED MIH can provide Link up, Link down and Link going down events (MIES) to monitor the link status continuously. Handoff is prepared if the link going down, then the MIH user provides MICS command to the users to switch links. The ASCONF-Path Failure sends from MN to CN to notify that the IP address is going to fail. The client gets the available network information from the information server through MIIS queries and responses. Best candidate is selected. MN sends ASCONF-Delete old IP to indicate CN to delete old IP address and add new IP address VERTICAL HANDOVER DECISION BASED ON MIH STANDARD The above mentioned idea is implemented based on conditional probability of link down (RSSi-1) and link going down (RSSi). For assumption, in a time (i-1) mobile station is in WLAN coverage, therefore RSS value is greater than the RSS threshold and in a time i mobile station is not in WLAN coverage, therefore RSS value is less than the RSS threshold. The probability of handover from WLAN to cellular network is predicted by conditional probability CONTINUED • Assume RSSi <RSSthr = x and RSSi-1 >RSSthr =y P{RSSi <RSSthr ,RSSi-1 >RSSthr }=P(x,y) Therefore, 2 1 1 x − µx 2 x − µx y − µy y − µy P x, y = exp − − 2ρ + 2Πσx σy 1−ρ2 2(1 − ρ2 σx σx σy σy Thus the probability of handover from WLAN to Cellular networks was found and will reduces the number of handover occurring by taking periodic RSS sample into account. MINIMIZATION OF HANDOVER FAILURE PROBABILITY AND UNNECESSARY HANDOVER (RSS MEASUREMENT) In order to maintain seamless user roaming and optimize network resource usage, it is desirable to minimize handover failures and unnecessary handovers. It takes various network parameters in to account, AP power level, RSS samples, radius of the network, and velocity of mobile terminal etc. RSS measurement fluctuates because of fading (Fast and shadow fading) and affects accuracy of time prediction. To reduce the impact of shadow fading, collect more RSS samples and average them in a sliding window. CONTINUED Log distance path loss model is given by Yj (i)=Pj -L j (i)-A j (i) Pj - power transmitted from BSj, Lj(i) - mean path-loss Aj(i) - shadowing loss The Received Signal Strength is estimated by lop RSSi =Ptx +Pref -10nlog +ε d ref Ptx - transmitted power from AP n - path loss exponent - Gaussian distributed random MEAN RSS VARIATION DUE TO SHADOW FADING WITH RESPECT TO DISTANCE 40 Beta=3 20 Beta=4 Beta=5 0 Beta=8 -20 RSS Variation (dB) -40 -60 -80 -100 -120 -140 0 10 20 30 40 50 60 70 80 90 100 Distance (m) HANDOVER FAILURE PROBABILITY 0.18 Fixed RSS method 0.16 Hysteresis method MIH method 0.14 Handover failure probability 0.12 0.1 0.08 0.06 0.04 0.02 0 0 50 100 150 Velocity of Mobile Terminal (km/h) PROBABILITY OF UNNECESSARY HANDOVER 0.25 Fixed RSS method Hysteresis method 0.2 MIH method Unnecessary Handover probability 0.15 0.1 0.05 0 0 50 100 150 Velocity of Mobile Terminal (km/h) CONCLUSION A IEEE 802.21 Media Independent Handover scheme has been presented for seamless vertical handover between heterogeneous networks for best QoS. Results show that proposed method outperforms the existing methods which are based on received signal strength and hysteresis margin. The probability of unnecessary handover and handover failure for the proposed method is minimized by considering shadow fading and velocity of the mobile terminals into account. REFERENCES [1] Daniel Corujo, Carlos Guimaraes, Bruno Santos and Rui L. Aguiar,"Using an Open- Source IEEE 802.21 Implementation for Network-Based Localized Mobility Management", IEEE Communication Magazine, pp. 114-123, 2011. [2] Xiaohuan Yan, Y.Ahmet Sekercioglu, and Sathya Narayanan, "A Survey of Vertical Handover Decision Algorithms in Fourth Generation Heterogeneous Wireless Networks", Computer Networks, Vol. 54, pp. 1848-1863, 2010. [3] A. H. Zahran, B. Liang, and A. Saleh,"Signal Threshold Adaptation for Vertical Handoff in Heterogeneous Wireless Networks, Mobile Networks and Applications", 11(4): pp. 625–640, August 2006. [4] S. Mohanty and I. F. Akyildiz," A Cross-layer (layer2 + 3) Handover Management Protocol for Next-Generation Wireless Systems", IEEE Transactions on Mobile Computing, 5:1347–1360, October 2006. [5] X. Yan, N. Mani, and Y. A. Sekercioglu, "A Traveling Distance Prediction Based Method to Minimize Unnecessary Handovers from Cellular Networks to WLANs", IEEE Communications letters, 12(1): pp. 14–16, January 2008.
Pages to are hidden for
"HARI PRJ1"Please download to view full document

subset: commoncrawl


text:
Whenever you shop online, your only effort is to get the best quality product at the lowest available rate. For this reason, you browse through several websites, spend hours in research and sometimes if you choose the wrong online store then pay more than the real cost of the product too. But not anymore! LowerThis is the first site which helps you to get the most amazing products for your money.
LowerThis is a community of trade professionals who help you to find the lowest price of all the purchases you wish to make. All you need to do is to inform about the product which you want to buy and its price. Paste the link of the lowest price which you have seen of the product. The experts at LowerThis analyze the product, its price and quality with its accuracy and then notify you about the lowest price on your email address.
People always search for deals which are available at the best price. And LowerThis provides you with it. It not only saves your time but also provides you with the best quality product at the lowest site from the most trustworthy resources. It renders amazing results and that too without any effort from your site. Be it any commodity whether electronics, clothing, appliance, travel, it is helpful for anything and everything. It fins out the lowest price of the product you want within the deadline you indicate. The more time you give it for the research, the better results of low rates it provides you with!
Just try out for yourself and you'll find LowerThis really works. It has expertise ranging from forum warrior, PhD students, web nerds, techs and online store warriors. You will get notified through email, LowerThis dashboard and mobile. The best part is that it is available for free. Be a delight purchaser and ensure that all your deals are right. Share your question, queries and thoughts and it will get back to you as quick as possible. Do try this! It is simple, time saving and simply great.


text:
Is Ye Selling Booty or Selling Shoes?
Saw these pics a few days ago and thought it was a cute little artistic photo shoot from Kamber. Well….that's until I realized it was to promote Kanye's $800 Louis Vuitton sneakers. If I was a man I'd def consider buying the azz before the shoe but what do I know….
babyrn2004@necolebitchie I think the Amber ad is degrading, telling women that we should strip in order to promote a product.
MrMarcusX@necolebitchie Another rapper exploiting a desperate whore!!! Shout out to all my dignified ladies!!!
bougiebee@necolebitchie looks like a pimp exploiting his hoe…they coulda did somethin just as simple in a better way
TheRealChokolat@necolebitchie I think their add would be nice if she weren't naked. Yes she's an ex stripper but she doesn't HAVE to go out like that
youngsinick@necolebitchie I found it a bit distasteful/degrading, but then I realized she's a stripper. Maybe I set my expectations too high.
dcgirl627@necolebitchie the real question is what do the WHITE ppl who frequent LV think (yes we do frequent LV too) but u kno they got us beat
For Amber an LV ad is a sweet come up! Even if it lowers the value of Louis in the process…


text:
"Winning isn't everything, it's the only thing." – Vince Lombardi
America seems obsessed with winning …especially this sort of "I'm number one" nonsense.
Maybe watching Brett Favre lose his final game in such a glorious way has me noodling on the idea of what "winning" is all about.
Winning in America is adults ardently pursuing Boy Scout badges.
Beauty pageants pit luscious young ladies answering elementary school questions and performing some lame talent when in reality … it's all about strutting your stuff sweetheart … and everyone knows it. Toss in some arm wrestling, crossword puzzle solving and a 5k in heels and it becomes a competition. Till then best T & A gets the to wear the tiara.
We see this distorted "I'm #1″ nonsense on reality TV shows. American Idol is the ultimate. Each week a few contestants are given shiny bright gold stars or more likely they are told they suck by some asshole with an English accent. And finally, after weeks of public humiliations, one is crowned "THE WINNER" and within minutes is shuttled off to semi-obscurity and instant B – status celebrity.
What price do winners pay to be winners? Do the names Barry Bonds, Mark McGuire conjure up the word winner or cheater? Look at the soap opera surrounding the worlds greatest golfer Tiger Woods. These guys sacrifice a lot to win; they sacrifice their health, their integrity and their families … but as singer Bobby Bare says "… guess that makes me the WINNER!"***
This competitive winning obsession has leached down into the bedrock of culture … parenting. We have parents pumping up their little darlings with rah-rah speeches in kindergarten, dragging them to training camps in the second grade so they can play professional sports and all so Mom and Dad can be proud of their little winners … which makes them winners … vicariously.
From Darwin's perspective life is a competitive sport of sorts and the survivors, namely us, are the winners … but that's not what we are talking about here … it's boy scout badges and beauty pageants,
Since I opened with a football quote lets end on one.
"Being in politics is like being a football coach. You have to be smart enough to understand the game and dumb enough to think it's important." - Eugene J. McCarthy


text:
Facing flat funding, SUNY and CUNY activists, students, and union leaders are fighting for more money.
Governor Andrew Cuomo's proposed budget keeps funding for the state's universities and colleges flat.
Union leaders say, state aid for SUNY, CUNY, and other state's community colleges has not kept up with costs.
"Over the last four years, higher education has lost $1.7 billion dollars in funding and so here we are," Phil Smith, UUP President, said.
At the same time, enrollment continues to grow, which has many pushing lawmakers for more funding.
Both the Senate and the Assembly seem receptive to the idea, with both Houses proposing an extra $125 per community college student in their budgets.
Lobbyists are also pressuring lawmakers to pass the Dream Act, which would help children of illegal immigrants get access to public tuition assistance.
It has support in the Assembly, but it's unlikely to be taken up by the Senate.


text:
West Chester, PA Paving Contractors
Ross Landscape & Paving Services
Ross Landscape & Paving Services is a complete property maintenance and paving contractor that has been serving West Chester, PA since 1989. Our company is geared toward the needs of the residential customer. We handle each project with prompt and professional service. Whether your vision is clear or not, our team of experienced artisans will work with you to create the results that you are looking for. You can count on us to provide quality work and attentive service.
Our Services Include:
Paving Services
- Driveway and parking lot paving and resurfacing
- Driveway and parking lot add-ons and repairs
- Seal coating (emulsion sand and sealer mix) with a long-lasting finish
- Speed bump and interlocking paver driveway installation
- Seamless asphalt spot repairs for driveways and parking lots (infrared repairs)
- Line striping for parking lots and athletic courts
Excavation and Grading Services
- Backhoe and skid-steer services
- Erosion control installation
- Hillside and stream bank stabilization
- Lawn installation and repair
We provide our services throughout Chester County and the surrounding communities.
We are a member of the National Concrete Masonry Association, SIMA, and ICPI.
Call Ross Landscape & Paving Services today at 610-701-0317. If you have any other questions or comments, please contact us at firstname.lastname@example.com.
Contact Information
Hours of Business:
Call Monday to Friday


text:
An online journal about visual art, the urban landscape and design. Mary Louise Schumacher, the Journal Sentinel's art and architecture critic, leads the discussion and a community of writers contribute to the dialogue.
David Gordon writes about museum openness
David Gordon, the former director of the Milwaukee Art Museum, has a piece in The Art Newspaper this morning about the accessibility of art museums. The Art Newspaper is a monthly newspaper about the visual arts based in London. While not widely distributed, it is influential and caters to art-world professionals.
Gordon makes a case for not looking at the cost of admission -- which has gone up dramtically at museums like the Metrpolitan Museum of Art and the Museum of Modern Art -- and the number of days that such musums are open in isolation.
He believes that hefty ticket prices are in some cases justified if museums offer opportunities for free days or hours and are generally more accessible, he argues. Many of the mega museums in New York, for instance, are jammed with humans during their free hours, making those opportunities less appealing and in effect less accessible, he writes.
The Milwaukee Art Museum was open daily under Gordon. It is currently open six days a week. Admission is currently free on the first Thursday of the month, thanks to a sponsorship from Target.
In addtion to running MAM, Gordon was the secretary of London's Royal Academy and editor of The Economist magazine. He is currently working as a consultant.
Comments »
Read and share your thoughts on this story.


text:
Seniors beware, Medicare will never e-mail you or call you to verify your information, they already have it.
Seniors continue to be targets for scam artists because the the scams keep working.
Some recent scams that are crisscrossing the US include:
The new Medicare card scam.
A new version of an ongoing scam is one where an "official" with Medicare is calling because Medicare is sending out new cards and he or she needs to verify some of your information. Of course the information they are looking for is your banking account information. Even the savviest seniors fall victim to these types of scams.
Why? Because the caller is very convincing as they often appear to have some of your banking information al-ready. This makes them seem legit and the senior tends to let their guard down.
Never give out your bank information, Social Security number, or your Medicare number to a stranger. Treat it as you would a credit card.
Once a scammer knows where you bank, your bank routing number is public knowledge and all the scam artist needs now to access your money is your bank account number.
June 30 Deadline – Verify You're Eligibility & Enrollment scam!
A current scam regarding the Medicare Enrolment period is popping up in beneficiaries' e-mail boxes across the nation. The email claims to be for open enrollment and asks you to verify your Part D eligibility and enrollment by a June 30 deadline. Open enrolment is Oct. 15 thru Dec. 7, 2013. Do not respond to this e-mail.
If you believe that you have been a target of these scams, the Missouri SMP (Senior Medicare Patrol) can help with any questions or concerns you may have at 888-515-6565.
The SMP Mission is to empower and assist Medicare beneficiaries, their families, and caregivers to prevent, detect, and report healthcare fraud, errors, and abuse through outreach, counseling, and education.


text:
Learn more about the five boroughs that make up New York City with our complete guide.
Discover what to do, where to stay and what to see in New York City with our planning tool.
Ready for una aventura in NYC? Let Dora guide you to the most family-friendly things. ¡Vámonos!
Enjoy the New York Film Festival, New York City Marathon, Macy's Thanksgiving Day Parade and more.
Download your free copy or order a guide online today.
Wireless Internet is available at locations throughout NYC—including many parks and libraries.
Get tips, maps and everything else you'll need during your stay.
These NYC-centric mobile apps put the City at your fingertips.
See NYC's iconic sights at discounted rates.
Get the best prices at NYC's bars, clubs and restaurants.
Stay in New York City and save with these offers.
New York City is made up of five boroughs: the Bronx, Brooklyn, Manhattan, Queens and Staten Island. Each one has enough attractions—and enough personality—to be a city all its own. Learn more about them with this guide.
The patron saint of the White Horse Tavern is unmistakably Dylan Thomas. Although other luminaries including Bob Dylan, James Baldwin and Delmore Schwartz were known to wet their whistles here, it was Thomas' prodigious and ultimately fatal boozing that put this spot on the map. Revered since the 1950s for the bohemian crowd that came to drink, scheme and argue, today's clientele is less literary: a blend of tourists, yuppies and locals, on what could be the same stools.


text:
There's been more money spent attacking health care reform than supporting it in TV ads, Kantar Media's Campaign Media Analysis Group said today.
Since it was enacted two years ago, groups on both side of the debate have poured in $262 million in TV ads. Critics of the law have taken out more than $204 million in TV ads, while supporters have bought about $57.9 million in air time, CMAG found.
The groups opposed to the law and spending ad money outnumber the supporting groups: 410 advertisers have aired over 1,000 separate ads criticizing the law, while 48 advertisers have created 90 positive ads.
The two sides also cater to different audiences with their ads, according to CMAG. The law's opponents have targeted swing states, while supporters have launched a national campaign, in addition to focusing on California.
Don't Miss Today's Top Stories
Rick, Executive Director for Policy
Concise coverage of everything I wish I had hours to read about."
Chuck, Graduate Student
The day's action in one quick read."
Stacy, Director of Communications
I find them informative and appreciate the daily news updates and enjoy the humor as well."
Richard, VP of Government Affairs
Chock full of usable information on today's issues. "
Michael, Executive Director


text:
DVLabs: Blogs
MindshaRE: Debugging via Code Injection with Python
Update: Peter was kind enough to whip up some legit web 2.0-ish graphing with some IDAPython to visualize the read() function referenced in this blog post. Check it out here (its draggable, and stuff).
Quite often at the ZDI we receive submissions that go something like this:
"When this fuzzed file is loaded into process X it causes an access violation. Here is the assembly at the point of the crash and a call stack:
0:030> g (530.758): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=020108d8 ebx=015d0178 ecx=02012bf0 edx=41414141 esi=020108d0 edi=015d0000 eip=7c82a99f esp=015afd20 ebp=015afdf0 iopl=0 nv up ei ng nz na pe cy cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010287 ntdll!RtlFreeHeap+0x4bd: 7c82a99f 8902 mov dword ptr [edx],eax ds:0023:41414141=???????? 0:030> kv ChildEBP RetAddr Args to Child 015afdf0 78134c39 015d0000 00000000 020108d8 ntdll!RtlFreeHeap+0x4bd 015afe3c 0042f18c 020108d8 00000000 00000000 MSVCR90!free+0xcd 015aff58 009737e6 01c663c0 01bb2380 020108d8 x+0x2f18c 015aff78 781329bb 01c663c0 8113a173 00000000 x+0x846fa 015affb0 78132a47 00000000 77e64829 015d4c88 MSVCR90!_callthreadstartex+0x1b 015affb8 77e64829 015d4c88 00000000 00000000 MSVCR90!_threadstartex+0x66 015affec 00000000 781329e1 015d4c88 00000000 kernel32!BaseThreadStart+0x34 Please make an offer on this information, !exploitable says its exploitable. I do not have the original non-fuzzed file anymore due to disk space problems."
Now, this is obviously heap corruption as the backtrace shows us that a heap chunk's metadata was probably corrupted due to some prior operation and is being used in a free or coalesce. What we are seeing are the effects of the corruption... and unfortunately this doesn't give us too much information that will help us locate the root cause of the bug. Trying to debug from this point is what I usually refer to as "bottom-up" reversing and its usually a bit trickier than reversing "top-down"--that is, reversing from the point of user input to the problematic code.
The process of reversing from user input can be a tedious one and it can be sped up by making use of hardware breakpoints. The idea is that if we find where our user data is first read into the process, we can set a memory breakpoint on it and find the first operation that acts upon it. Now, after you've done this on hundreds of bugs it might occur to you that this can be automated. Indeed, we can automate a lot of this using a debugger, however we'd have to use software breakpoints (int 3) and those require a context switch which can be inefficient.
Summary In this blog post I will walk through an alternate way to perform this debugging process that can be abstracted to solve a bunch of different problems. Additionally, the example code we'll use here requires simply Python and it's built-in ctypes module.
First off, let's start with an overview of the technique we're going to code the functionality for. The following example will be automating the discovery of the point at which a program reads in user data using MSVCR90.dll!read. This just so happens to be the way that Adobe Shockwave reads in DIR files via Internet Explorer, so we'll use that as an example.
So, first off... we need to disassemble MSCVR90.dll and check out it's read() function. Here's a screenshot of it:
Now, we'd like to hook this function at two points. One to catch the arguments that were passed to the function, and the other to search the data that was read in for the value we want to find.
Hook Point #1 When we hook, we are going to need to clobber 5 bytes worth of instructions. This is because what we'll effectively be doing is patching in a jump (5 opcode bytes) that points to our hook code that we want to run.
Here is an ideal location to hook:
.text:78586EB5 8B C8 mov ecx, eax .text:78586EB7 C1 F9 05 sar ecx, 5 .text:78586EBA 8D 1C 8D A0 D6 5B 78 lea ebx, ___pioinfo[ecx*4]
We choose this location for several reasons. Firstly, its near the function prologue and the arguments that were pushed to read should be easily retrieved from the stack. Secondly, within 5 bytes from 0x78586EB5 there are no jump instructions. If we were to lift this code out and it had a jump instruction, it would be a near jump. Thus if we relocated it, we'd have to promote the branch to a jmp in order for it to disassemble properly (and thats out of scope for this post).
Hook Point #2 The second ideal location to hook is the following:
.text:78586F35 C7 45 FC FE FF FF FF mov [ebp+ms_exc.disabled], 0FFFFFFFEh
This location is ideal as it is near the end of the function and thus the user data would have been read into the destination buffer that was pushed to read() by this point. So, what we'll end up doing is patching in another jump here that will jump to our code that will search that buffer for the value we care about.
Side-note: We don't actually need 2 hook points to accomplish this task, but I'm showing how to do 2 so the ideas can be abstracted for other purposes...
Overview of Injection Plan Here's the plan... we are going to patch those code locations with jumps. But, jumps to what?
Basically, we're going to set up an "arena" in the heap in which to stuff our custom code to run as well as the code we "lifted" from MSVCR90!read (we want our code to run, then we want to run the original code, and then return execution back to MSVCR90). So, here's what the memory arena will look like:
Offset Contains 0x00 our code to grab read()'s arguments off the stack followed by a jump to offset 0x60 0x20 our code to search the destination buffer for our value followed by a jump to offset 0x80 0x60 the original code from MSVCR90!read (0x78586EB5) that we are "lifting" to here 0x80 the original code from MSVCR90!read (0x78586F35) that we are "lifting" to here
The offsets were chosen arbitrarily (I just ensured they were large enough to contain the code we're going to put there).
So, the first thing we need to do is write the code that we want to run at the first hook point. In other words, the code that will grab the arguments off the stack (specifically the destination buffer pointer and the size passed to read). Here's what I cobbled together:
[BITS 32] ; save registers we'll use push ecx push esi mov ecx, [esp+0x10] ; grab the size passed to read mov esi, [esp+0x0c] ; grab the destination pointer mov [0x41414141], ecx ; write it to memory at 0x41414141 mov [0x42424242], esi ; write it to memory at 0x42424242 pop esi pop ecx
Now, you'll notice I used two static addresses there, 0x41414141 and 0x42424242. I will replace those addresses with Python when we inject this code.
At this point we need to assemble that into its opcodes. We'll use nasm for that task:
[deft@host v90]$ nasm -f bin -o grab_args grab_args.asm [deft@host v90]$ xxd grab_args 0000000: 5156 8b4c 2408 8b74 2404 890d 4141 4141 QV.L$..t$...AAAA 0000010: 8935 4242 4242 5e59 .5BBBB^Y [deft@host v90]$
In Python-speak, this will be:
args_hook = "\x51\x56\x8b\x4c\x24\x10\x8b\x74\x24\x0c\x89\x0d" args_hook += saved_size + "\x89\x35" + saved_dst + "\x5e\x59"
We obviously dont want to write those values to those static addresses (0x41414141 and 0x42424242), so what we'll end up doing is allocating some memory to hold them. We'll get to that later but you'll note we have two variables, saved_dst and saved_size.
The second hook is a bit more complicated because it will actually be searching for a 4-byte value in the memory that read() wrote user data to. Here it is:
[BITS 32] ; save registers+flags pushad pushfd ; ecx = the size passed to read (retrieved from our first hook) mov ecx, 0x61616161 ; esi = the address of the buffer that ; read wrote to (as retrieved by our first hook) mov esi, 0x62626262 ; divide for 4-byte search shr ecx, 2 ; eax = the value we want to find ; this will be changed in our python mov eax, 0x41414141 TEXT .loop cmp [esi], eax jnz .increment jz .success .increment lea esi, [esi+4] dec ecx jz .fail jmp .loop .success ; on success, throw an int3 to the debugger int3 ; and esi will point to the value in memory jmp .exit .fail ; explicitness ;) jmp .exit .exit popfd popad
And here's what it looks like assembled:
[deft@host v90]$ nasm -f bin -o search search.asm [deft@host v90]$ xxd search 0000000: 609c b961 6161 61be 6262 6262 c1e9 02b8 `..aaaa.bbbb.... 0000010: 4141 4141 3906 7502 7408 8d76 0449 7408 AAAA9.u.t..v.It. 0000020: ebf2 cce9 0500 0000 e900 0000 009d 61 ..............a [deft@host v90]$
...and in Python:
search_hook = "\x60\x9c\x8b\x0d" + "A"*4 + "\x8b\x35" + "B"*4 + "\xc1\xe9\x02\xb8" + needle search_hook += "\x39\x06\x75\x02\x74\x08\x8d\x76\x04\x49\x74\x08\xeb\xf2\xcc\xe9\x05\x00" search_hook += \x00\x00\xe9\x00\x00\x00\x00\x9d\x61"
where needle is the 4 byte value we are looking for.
Injection with Python In order to accomplish this code injection fu, we're going to need the ability to allocate memory in a remote process as well as write to its memory space (and change memory permissions where needed).
We are going to use Python's ctypes module which allow us to load DLLs and call their functions. The module we're going to need is kernel32.dll. Specifically, we're going to use the following functions:
To utilize the allocation routines and WriteProcessMemory in a remote process, we're going to need a handle to it. So, we need to start off with a call to OpenProcess. Here's the relevant Python:
import ctypes kernel32 = ctypes.WinDLL('kernel32.dll') def get_handle(pid): PROCESS_VM_OPERATION = 0x0008 PROCESS_VM_READ = 0x0010 PROCESS_VM_WRITE = 0x0020 PROCESS_SET_INFORMATION = 0x0200 PROCESS_QUERY_INFORMATION = 0x0400 PROCESS_INFO_ALL = PROCESS_QUERY_INFORMATION|PROCESS_SET_INFORMATION PROCESS_VM_ALL = PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE res = kernel32.OpenProcess(PROCESS_INFO_ALL | PROCESS_VM_ALL, False, pid) print "Returning handle %d" % res return res
Once we have a handle, we can allocate memory and change memory permissions. Our first step at this point is to allocate our heap arena to hold MSVCR90's lifted code as well as our hooks. To do this we'll need to use VirtualAllocEx:
def allocate(handle, size): MEM_COMMIT = 0x1000 MEM_RESERVE = 0x2000 PAGE_EXECUTE_READWRITE = 0x40 count = size perms = MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE res = kernel32.VirtualAllocEx(handle, 0x0, count * 0x1000, perms) print "Allocated memory for handle %d at 0x%08x" % (handle, res) return res
Then, we'll want to write our hooks and lifted code to the address returned by allocate. But first, we want to make two more allocations to hold the saved destination pointer and the saved size:
saved_size = struct.pack("L", allocate(handle, 4)) saved_dst = struct.pack("L", allocate(handle, 4))
Now, when we inject out hooks we can use those addresses and thus dynamically change our injected opcodes. Also, let's go ahead and define the "needle", or the four bytes we are going to look for. In this case, we're going to search for the first 4 bytes of any DIR file (Shockwave director) which is "RIFX" as can be seen in this partial hexdump of a DIR file:
0000h: 52 49 46 58 00 00 DC 50 4D 56 39 33 69 6D 61 70 RIFX..�PMV93imap 0010h: 00 00 00 18 00 00 00 01 00 00 00 2C 00 00 07 3A ...........,...: 0020h: 00 00 00 00 00 00 00 00 00 00 00 00 6D 6D 61 70 ............mmap 0030h: 00 00 0F E0 00 18 00 14 00 00 00 CA 00 00 00 97 ...�.......�...,
Here is the dynamic replacement we perform on our hook's opcodes:
needle = "RIFX" args_hook = "\x51\x56\x8b\x4c\x24\x10\x8b\x74\x24\x0c\x89\x0d" + saved_size + args_hook += "\x89\x35" + saved_dst + "\x5e\x59" search_hook = "\x60\x9c\x8b\x0d" + saved_size + "\x8b\x35" + saved_dst search_hook += "\xc1\xe9\x02\xb8" + needle search_hook += "\x39\x06\x75\x02\x74\x08\x8d\x76\x04\x49\x74\x08" search_hook += "\xeb\xf2\xcc\xe9\x05\x00\x00\x00\xe9\x00\x00\x00\x00\x9d\x61"
Also, let's go ahead and define the original opcode bytes for the code we are lifting out:
# .text:78586EB5 8B C8 mov ecx, eax # .text:78586EB7 C1 F9 05 sar ecx, 5 # .text:78586EBA 8D 1C 8D A0 D6 5B 78 lea ebx, ___pioinfo[ecx*4] hook1_orig = "\x8b\xc8\xc1\xf9\x05\x8d\x1c\x8d\xa0\xd6\x5b\x78" # .text:78586F35 C7 45 FC FE FF FF FF mov [ebp+ms_exc.disabled], 0FFFFFFFEh hook2_orig = "\xc7\x45\xfc\xfe\xff\xff\xff"
Now that we have all the opcodes ready for injection, let's review the offsets we're going to use. Remember:
Offset Contains 0x00 our code to grab read()'s arguments off the stack followed by a jump to offset 0x60 0x20 our code to search the destination buffer for our value followed by a jump to offset 0x80 0x60 the original code from MSVCR90!read (0x78586EB5) that we are "lifting" to here 0x80 the original code from MSVCR90!read (0x78586F35) that we are "lifting" to here
And after each of those chunks of code we're going to want some jumps. The order of execution should be something like this:
MSVCR90!read is called. At 0x78586EB5 the execution will hit a jump we will patch in. This will jump to our heap arena at offset 0x00. After our hook executes, it will jump to our heap arena at offset 0x60 to execute the original code we lifted from 0x78586EB5. After that executes, it will jump back to read() at 0x78586EC1 (right after what we lifted). Execution will continue normally until our hook at 0x78586F35 is hit. Then, the process will hit our patched jump that will go to our heap arena at offset 0x20. After our hook executes, we will jump to the original lifted code at our heap arena offset 0x80. After that's done, it will either throw an INT 3 if it finds our needle, or it will jump back to read() at 0x78586F3C (right after what we lifted). Make sense?
So let's make this easier on ourselves by writing some functions to make these jumps (opcode 0xE9 is a jump instruction):
def makejump(start, target, length): print "Asked to make a jump from 0x%08x to 0x%08x" % (start, target) if start < target: buf = "\xe9" + struct.pack("L", target-start-5) buf += "\x90"*(length-len(buf)) else: buf = "\xe9" + struct.pack("L", target-start-5) buf += "\x90"*(length-len(buf)) return buf def patchjump(handle, x, y, length): opcodes = makejump(x, y, length) dst = ctypes.cast(x, ctypes.c_char_p) src = ctypes.c_char_p(opcodes) print "Patching jump from 0x%08x to 0x%08x" % (x, y) res = ctypes.windll.kernel32.WriteProcessMemory(handle, dst, src, length, 0x0) print "WriteProcessMemory returned 0x%08x" % res return res
At this point we should have the ability to allocate memory and to write our opcodes to it. Now we can actually start "doing stuff".
To begin, we should change the permissions on MSCVR90.dll's .text segment to ensure we can actually write our jump there. Its default permissions are the following (from WinDBG):
0:021> !address 0x78586EB5 78520000 : 78521000 - 00096000 Type 01000000 MEM_IMAGE Protect 00000020 PAGE_EXECUTE_READ State 00001000 MEM_COMMIT Usage RegionUsageImage FullPath C:\WINDOWS\system32\MSVCR90.dll We need to change the Protect flags to 0x40 (PAGE_EXECUTE_READWRITE).
This can be accomplished with a call to VirtualProtectEx:
def vprotect(handle, address): PAGE_EXECUTE_READWRITE = 0x40 crap = ctypes.byref(ctypes.create_string_buffer("\x00"*4)) res = kernel32.VirtualProtectEx(handle, address, 0x1000, PAGE_EXECUTE_READWRITE, crap) print "VirtualProtecEx returned 0x%08x" % res return res
Once we've run this on the process, we can verify with WinDBG that the permissions were changed:
0:021> !address 0x78586EB5 78520000 : 78586000 - 00001000 Type 01000000 MEM_IMAGE Protect 00000040 PAGE_EXECUTE_READWRITE State 00001000 MEM_COMMIT Usage RegionUsageImage FullPath C:\WINDOWS\system32\MSVCR90.dll
Now, let's allocate our memory and then write our jumps into read()'s code:
addr = allocate(handle, 1024) # .text:78586EB5 8B C8 mov ecx, eax # .text:78586EB7 C1 F9 05 sar ecx, 5 # .text:78586EBA 8D 1C 8D A0 D6 5B 78 lea ebx, ___pioinfo[ecx*4] hook1_orig = "\x8b\xc8\xc1\xf9\x05\x8d\x1c\x8d\xa0\xd6\x5b\x78" # patch a jump from hook1 to addr patchjump(handle, hook1, addr+0x00, 12) # .text:78586F35 C7 45 FC FE FF FF FF mov [ebp+ms_exc.disabled], 0FFFFFFFEh hook2_orig = "\xc7\x45\xfc\xfe\xff\xff\xff" # patch a jump from hook2 to addr+0x20 patchjump(handle, hook2, addr+0x20, 7)
At this point we can verify that our jumps were patched in to the process properly:
0:001> u 0x78586EB5 MSVCR90!_read+0x5e 78586eb5 e946918c95 jmp +0xde4ffff (0de50000) 78586eba 90 nop 78586ebb 90 nop 78586ebc 90 nop 0:001> u 78586F35 MSVCR90!_read+0xde: 78586f35 e9e6908c95 jmp +0xde5001f (0de50020) 78586f3a 90 nop 78586f3b 90 nop
You should notice that the first hook jumps to offset 0x00 and the second jumps to offset 0x20, which makes sense.
Now, let's implement a quick function to write to memory so that we can copy our opcodes to our heap arena:
def writemem(handle, mem, data): src = ctypes.c_char_p(data) dst = ctypes.cast(mem, ctypes.c_char_p) length = ctypes.c_int(len(data)) res = ctypes.windll.kernel32.WriteProcessMemory(handle, dst, src, length, 0x0) return res
And to use it:
# write the lifted code to our heap arena writemem(handle, addr+0x60, hook1_orig) writemem(handle, addr+0x80, hook2_orig)
And now we can write our jumps from the end of our hooks to the lifted code as well as the jumps back from the lifted code back to read():
# write jumps after our hooks that goes to the lifted code jmp_hook1 = patchjump(handle, addr+0x00+len(args_hook), addr+0x60, 5) jmp_hook2 = patchjump(handle, addr+0x20+len(search_hook), addr+0x80, 5) # write our hooks to our arena writemem(handle, addr, args_hook) writemem(handle, addr+0x20, search_hook) # write in some patches from the lifted code back to read() patchjump(handle, addr+0x60+len(hook1_orig), hook1+12, 5) patchjump(handle, addr+0x80+len(hook2_orig), hook2+7, 5)
At this point we should be done and we can verify with WinDBG:
0:001> u 0de50000 L9 +0xde4ffff: 0de50000 51 push ecx 0de50001 56 push esi 0de50002 8b4c2410 mov ecx,dword ptr [esp+10h] 0de50006 8b74240c mov esi,dword ptr [esp+0Ch] 0de5000a 890d0000c205 mov dword ptr [+0x5c1ffff (05c20000)],ecx 0de50010 89350400c205 mov dword ptr [+0x5c20003 (05c20004)],esi 0de50016 5e pop esi 0de50017 59 pop ecx 0de50018 e943000000 jmp +0xde5005f (0de50060) 0:001> u 0de50000+0x20 L13 +0xde5001f: 0de50020 60 pushad 0de50021 9c pushfd 0de50022 8b0d0000c205 mov ecx,dword ptr [+0x5c1ffff (05c20000)] 0de50028 8b350400c205 mov esi,dword ptr [+0x5c20003 (05c20004)] 0de5002e c1e902 shr ecx,2 0de50031 b852494658 mov eax,58464952h 0de50036 3906 cmp dword ptr [esi],eax 0de50038 7502 jne +0xde5003b (0de5003c) 0de5003a 7408 je +0xde50043 (0de50044) 0de5003c 8d7604 lea esi,[esi+4] 0de5003f 49 dec ecx 0de50040 7408 je +0xde50049 (0de5004a) 0de50042 ebf2 jmp +0xde50035 (0de50036) 0de50044 cc int 3 0de50045 e905000000 jmp +0xde5004e (0de5004f) 0de5004a e900000000 jmp +0xde5004e (0de5004f) 0de5004f 9d popfd 0de50050 61 popad 0de50051 e92a000000 jmp +0xde5007f (0de50080) 0:001> u 0de50000+0x60 L4 +0xde5005f: 0de50060 8bc8 mov ecx,eax 0de50062 c1f905 sar ecx,5 0de50065 8d1c8da0d65b78 lea ebx,MSVCR90!__pioinfo (785bd6a0)[ecx*4] 0de5006c e9506e736a jmp MSVCR90!_read+0x6a (78586ec1) 0:001> u 0de50000+0x80 L2 +0xde5007f: 0de50080 c745fcfeffffff mov dword ptr [ebp-4],0FFFFFFFEh 0de50087 e9b06e736a jmp MSVCR90!_read+0xe5 (78586f3c)
Now, let's test it out by loading a director file into Internet Explorer with a debugger attached:
0:001> g ModLoad: 01a00000 01a0d000 C:\WINDOWS\system32\Adobe\Shockwave 11\xtras\Speech.x32 ModLoad: 01a20000 01a4d000 C:\WINDOWS\system32\Adobe\Shockwave 11\xtras\Multiusr.x32 ModLoad: 01a10000 01a16000 C:\WINDOWS\system32\Adobe\Shockwave 11\DYNAPLAYER.DLL ModLoad: 69000000 69108000 C:\WINDOWS\system32\Adobe\Shockwave 11\IML32.dll ModLoad: 68000000 681ad000 C:\WINDOWS\system32\Adobe\Shockwave 11\DIRAPI.dll ModLoad: 6c100000 6c119000 C:\WINDOWS\system32\Adobe\Shockwave 11\SwMenu.dll ModLoad: 01ab0000 01ad7000 C:\WINDOWS\system32\Adobe\Shockwave 11\xtras\Netfile.x32 ModLoad: 71ad0000 71ad9000 C:\WINDOWS\system32\WSOCK32.dll ModLoad: 03b10000 03b17000 C:\WINDOWS\system32\Adobe\Shockwave 11\xtras\CBrowser.x32 (11ec.1910): Break instruction exception - code 80000003 (first chance) eax=58464952 ebx=785bd6a0 ecx=00002000 edx=7c90e514 esi=039e2a94 edi=000000c0 eip=0de50044 esp=0160ba3c ebp=0160ba90 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246 Missing image name, possible paged-out or corrupt data. Missing image name, possible paged-out or corrupt data. +0xde50033: 0de50044 cc int 3
As can be seen above, an int3 was thrown at 0x0de50044 (which is inside our heap arena). At this point, we can verify that at ESI is our needle value.
0:008> dc esi 039e2a94 58464952 50dc0000 3339564d 70616d69 RIFX...PMV93imap 039e2aa4 18000000 01000000 2c000000 3a070000 ...........,...: 039e2ab4 00000000 00000000 00000000 70616d6d ............mmap 039e2ac4 e00f0000 14001800 ca000000 97000000 ................ 039e2ad4 90000000 ffffffff 68000000 58464952 ...........hRIFX 039e2ae4 50dc0000 00000000 00000100 00000000 ...P............ 039e2af4 70616d69 18000000 0c000000 00000100 imap............ 039e2b04 24d9af0a 70616d6d e00f0000 2c000000 ...$mmap.......,
At this point we can set a memory breakpoint on that location and it should tell us where Shockwave first decides to parse our data:
0:008> ba r1 039e2a94 0:008> g Breakpoint 0 hit eax=00000052 ebx=0000000c ecx=0000000c edx=0160bb6c esi=039e2a94 edi=0160bb6c eip=69007295 esp=0160ba94 ebp=0160baa0 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200202 IML32!Ordinal9231+0x7295: 69007295 83c601 add esi,1 0:008> ub IML32!Ordinal9231+0x727b: 6900727b 3bc1 cmp eax,ecx 6900727d 7567 jne IML32!Ordinal9231+0x72e6 (690072e6) 6900727f 8b0dfcbc0b69 mov ecx,dword ptr [IML32!Ordinal2344+0x32fac (690bbcfc)] 69007285 8b7d08 mov edi,dword ptr [ebp+8] 69007288 8b750c mov esi,dword ptr [ebp+0Ch] 6900728b f7c707000000 test edi,7 69007291 740f je IML32!Ordinal9231+0x72a2 (690072a2) 69007293 8a06 mov al,byte ptr [esi] 0:008> t eax=00000052 ebx=0000000c ecx=0000000c edx=0160bb6c esi=039e2a95 edi=0160bb6c eip=69007298 esp=0160ba94 ebp=0160baa0 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200206 IML32!Ordinal9231+0x7298: 69007298 8807 mov byte ptr [edi],al ds:0023:0160bb6c=a8 0:008> t eax=00000052 ebx=0000000c ecx=0000000c edx=0160bb6c esi=039e2a95 edi=0160bb6c eip=6900729a esp=0160ba94 ebp=0160baa0 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200206 IML32!Ordinal9231+0x729a: 6900729a 83c701 add edi,1 0:008> ba r1 @edi 0:008> g Breakpoint 1 hit eax=58464952 ebx=00000000 ecx=00000000 edx=058273a8 esi=03af32c0 edi=00000000 eip=68002ffc esp=0160bb5c ebp=0160bb98 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246 DIRAPI+0x2ffc: 68002ffc 3d58464952 cmp eax,52494658h 0:008> .formats @eax Evaluate expression: Hex: 58464952 Decimal: 1481001298 Octal: 13021444522 Binary: 01011000 01000110 01001001 01010010 Chars: XFIR Time: Mon Dec 05 23:14:58 2016 Float: low 8.72073e+014 high 0 Double: 7.31712e-315
So, we can see it first copies it to some other buffer. We set a breakpoint on that new buffer they copied to and when its next hit we can see they are comparing it to RIFX. This is the place we should begin reversing to discover more about their file format and corresponding parsing.
This was how Logan and I accomplished a lot of the Shockwave reversing that we talked about during our CanSecWest presentation (PPTX).
The above code can be snagged here in one .py file: thePublicHooker.py.
Expect some future posts on other tricks that can be accomplished using injection in this manner.
Aaron (@aaronportnoy)
REcon 2011 Training: Bug Hunting and Analysis 0x65
As Recon 2011 in Montreal (July 8-10) is fast approaching we wanted to let ZDI researchers know there is a training being offered by two of the ZDI team members: Bug Hunting and Analysis 0x65.
Some of the case studies offered on day 2 of the training will be submissions that were patched and disclosed through the ZDI. Many researchers have been interested in our analysis of their submissions. Recon is a great place to discuss these cases. If you will be attending and want to request a case study of one of your *patched/disclosed* submissions, send a request via email. We probably have time to get one or two more done before the training, so get your request over ASAP if you're interested.
As always things are better with free stuff, so:
Any new or existing ZDI researchers who wish to attend this class will recieve a 5,000 pt reward bonus credited to their researcher account.
Bug Hunting and Analysis 0x65
This 3 day course is structured to impart upon the students the skills necessary to effectively utilize debuggers, disassemblers, and other tools to discover vulnerabilities in binary code. The curriculum will begin by introducing students to the tools and generic techniques that will enable them to actively participate in reversing applications during the rest of the course.
After gaining a basic understanding of the tools involved, the instructors will spend day 2 walking students through case studies from patched vulnerabilities. That is, we will be choosing specific vulnerabilities and walking the students through the methodology used to verify them (debugging) and how the discoverer likely found them (fuzzing, static reverse engineering, dynamic instrumentation, etc). As each flaw is dissected, we will focus on how the student's arsenal of techniques can be extended to more easily debug applications and eventually discover similar bugs going forward.
On day 3 we will begin focusing on automating our tools to build a checklist that we can use to more efficiently reverse engineer a binary code base. We will walk through a complete audit of a default installation (latest version) of a popular enterprise server application culminating in the discovery of a remote pre-authentication 0day vulnerability. Students will be required to sign a minimal NDA in order to participate in this portion of the training.
Instructors: Aaron Portnoy and Zef Cekaj
Dates: 5-7 July 2010
Availability: 18 Seats
Dates: 11-13 July 2010 Availability: 18 Seats
Price 2600$ CAD before May 15, 3200$ CAD after.
MindshaRE: Extending IDA with Custom Viewers
Anyone who utilizes IDA Pro is very likely familiar with the concept of subviews, the window panes that give a reverser the ability to view and query many characteristics of a binary stored in IDA's database. The default views available in IDA are great for displaying generic characteristics of any disassembled object. However, as is quite often the case, one may wish to collect data about an application (or otherwise) that may be more specifically targeted.
For example, we often find ourselves reversing a file format parser for one reason or another. Many of them support various FourCC-based formats (like MOV, RealMedia, Shockwave, PNG, ICC, ...) and as such usually have code that resembles this:
These compares are useful to locate as they will usually be dealing with an input file and given some complementary runtime data, these locations can help us understand a bit about how the parser may work. So, as Elias Bachaalany demonstrated on the Hex-Rays blog (http://www.hexblog.com/?p=119) IDA supports custom viewer creations. I'll show how to implement a quick, clickable interface to FourCC compares within a binary.
First, we need code to find FourCC compares:
import string
fourccs = []
# loop functions
for func in Functions():
# loop instructions
for instr in FuncItems(func):
# only care about compares
disasm = GetDisasm(instr)
if "cmp" in disasm and "offset" not in disasm:
# ensure immediate compare
if GetOpType(instr, 1) == 5 and GetOpType(instr, 0) == 1:
# ensure at least 3 bytes of ASCII in the immediate
opval = GetOpnd(instr, 1)
opval = int(opval[:-1], 16)
opval = struct.pack('>L', opval)
except ValueError:
oplen = len(opval)
opstrlen = len("".join((x for x in opval if x in string.printable)))
if (opstrlen >= 3):
# change it to character representation in IDA
OpChr(instr, 1)
fourccs.append((instr, opval))
print "0x%08x: %s" % (instr, GetOpnd(instr, 1))
This should output something like the following:
Now, we can build a custom viewer and populate it with our data:
class FourCCViewer(idaapi.simplecustviewer_t):
def __init__(self, data):
self.fourccs = data
print "Launching FourCC subview..."
def Create(self):
title = "FourCCs"
idaapi.simplecustviewer_t.Create(self, title)
comment = idaapi.COLSTR("; Double-click to follow", idaapi.SCOLOR_BINPREF)
comment = idaapi.COLSTR("; Hover for preview", idaapi.SCOLOR_BINPREF)
for item in self.fourccs:
addy = item[0]
immvalue = item[1]
address_element = idaapi.COLSTR("0x%08x: " % addy, idaapi.SCOLOR_REG)
value_element = idaapi.COLSTR("%s" % immvalue, idaapi.SCOLOR_STRING)
line = address_element + value_element
return True
def OnDblClick(self, something):
line = self.GetCurrentLine()
if "0x" not in line: return False
# skip COLSTR formatting, find address
addy = int(line[2:line.find(":")], 16)
return True
def OnHint(self, lineno):
if lineno < 2: return False
else: lineno -= 2
line = self.GetCurrentLine()
if "0x" not in line: return False
# skip COLSTR formatting, find address
addy = int(line[2:line.find(":")], 16)
disasm = idaapi.COLSTR(GetDisasm(addy) + "\n", idaapi.SCOLOR_DREF)
return (1, disasm)
Now we just need to instantiate an instance of FourCCViewer and it should pop up a new subview that looks like so (assuming you've already run the fourCC finding code above):
foo = FourCCViewer(fourccs)
Pretty simple stuff, but it can come in handy when you've got an arsenal of extra analysis runs you perform prior to reversing a complex binary. A slightly more interesting use case for this was when displaying data scraped from a run time histogram of Shockwave's memory manager as Logan and I spoke about at CanSecWest this year:
That's all for now, hopefully we can get some more MindshaRE posts in the pipeline.
BlackHole Exploit Kit
BlackHole exploit kit is yet another in an ongoing wave of attack toolkits flooding the underground market. The kit first appeared on the crimeware market in September of 2010 and ever since then has quickly been gaining market share over its vast number of competitors. In fact, many antivirus vendors now claim that this is one of the most prevalent exploit kits used in the wild. Even Malware Domain List is showing quite a few domains infected with the BlackHole exploit kit. So what is it that makes this attack toolkit stand out above the rest?
While the number of reported infections by BlackHole kit is indeed impressive we think there is nothing truly revolutionary about this exploit kit. Part of its newfound success can be attributed to its rich feature set which it shares in common with myriad of other recent exploit kits such as Siberia Exploit Kit. The other major factor contributing to its success is its flexible pricing scheme. Unlike some other kits out there BlackHole uses a timed licensing plan. Users can purchase the annual license for $1500, semi-annual license for $1000, or just a quarterly license for $700. The license includes free software updates for the duration of the contract. For those malicious users with a commitment phobia the makers of the kit offer yet another solution. You can rent the kit (on the author's servers) for $50 for 24 hours, $200 for 1 week, $300 for 2 weeks, $400 for 3 week, and $500 for 4 weeks. A domain name comes included with the rental agreement, but should you desire to change it you need to pay another $35. There's also an array of other "services" such as changing the encryption method, which can be purchased by users on demand should the need arise. Another popular service is an AV checker that allows you to scan your payload files to make sure they're not detected by any AV vendors. This service is very similar to VirusTotal, except its aimed for criminals because uploaded test files are not reported to any AV vendors. Yet another paid service is a domain change. Should your domain get blacklisted by any security vendors you can pay a small fee to have it changed.
One highly touted feature of BlackHole toolkit is its TDS or Traffic Direction Script. While this is not an entirely new concept in attack toolkits the TDS included her is much more sophisticated and powerful than those in other kits. A TDS is basically an engine that allows redirection of traffic through a set of rules. For example, a user can set up a set of rules that redirect flow to different landing pages on their domain. These rules could be based on operating system, browser, country of origin, exploit, files, etc. One rule might redirect traffic to page A for all users that are running Windows OS from XP to Vista and running IE 8, while another rule can redirect Windows 7 users to page B. Those were just simple example rules. More advanced rules could set expiration dates for certain payloads and replace them with new ones when the date is reached. The TDS included in BlackHole even goes the extra step and allows you to create traffic flows based on these rules and provides management interface for the flows. A savvy malicious user with a lot of experience could easily utilize this rule engine to increase their infection numbers.
From a web application standpoint BlackHole is built just like other kits, consisting of a PHP and MySQL backend. Since the majority of web servers run on the LAMP stack this enabled for very easy application deployment. The user interface for this kit is a cut about the rest, and it definitely looks nicer than almost any other attack kit we've analyzed. It resembles some of the best legitimate web apps we see in the world of commercial software.
Here's a screenshot that shows various payloads delivered by this kit instance along with hit stats and other details:
Here's another screenshot that shows the security module of BlackHole. This allows you to blacklist any addresses that you don't want poking around your exploit kit.
As with any exploit kit this one comes pre-packaged with a bunch of exploits. Below is a list of CVEs that correspond to exploits packaged with BlackHole:
- CVE-2010-1423 Java argument injection vulnerability in the URI handler in Java NPAPI plugin
- CVE-2010-0886 Java Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE
- CVE-2010-0842 Java JRE MixerSequencer Invalid Array Index Remote Code Execution Vulnerability
- CVE-2010-0840 Java trusted Methods Chaining Remote Code Execution Vulnerability
- CVE-2009-1671 Java buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll
- CVE-2009-0927 Adobe Reader Collab GetIcon
- CVE-2008-2992 Adobe Reader util.printf
- CVE-2007-5659 Adobe Reader CollectEmailInfo
Some of these exploits are pretty old, one even dating back to 2006 but that doesn't mean that they're not still effective. Take a look at these infection screens taken from the stats module.
Here's a screenshot showing infection statistics sorted by exploit:
And here we have infection rates sorted by browser:
The following shows infection statistics organized by operating system:
As you can see some of the infection rates recorded in BlackHole kits are very high. Its worth noting that most of the CVEs found in BlackHole are also found in other exploit toolkits. However, what is interesting in this toolkit is the fact it uses Java OBE (in form of a JAR file) to serve up Java exploits. Java OBE (Open Business Engine) is a flexible, modular, standards-compliant open source Java workflow engine. This is something we haven't seen before as other toolkits have not used open source projects like the OBE in the past. The exploits served by Java OBE are CVE-2010-0840 and CVE-2010-0842.
The attack typically works as follows. A victim visits an infected domain which has an iFrame pointing to the server hosting the exploit kit. BlackHole's TDS, which we talked earlier, automatically directs the traffic to an exploit that would be most likely to work on the victim's machine. That could be the Java OBE, IE, Adobe Reader, or any other exploit included. Chances are one of the Java exploits will be used, especially given the fact that 50% of exploits in this kit are Java based. If exploitation is successful malicious payload is delivered to the machine. The payload most often downloaded is the Carberp trojan. Carberp is a very dangerous trojan often compared to the likes of Zeus and has been gaining in popularity lately. Once Carberp is successfully installed on the machine it starts to talk to its C&C server from which it downloads additional modules. It downloads the following:
- - stopav.plug - Disables the antivirus if any is installed on the victim's computer.
- - miniav.plug – Checks for the presence of other Trojans, such as Zeus, and if found, deletes them. This is very similar to SpyEye behavior.
- - passw.plug – Key logger module. It hooks the export table of a number of WININET.dll and USER32.dll functions and will log all username/password combinations, as well as any URLs visited.
Afterwards more malware is installed to the victim's computer, including Trojan.Zefarch and FakeAV. This trend of using Java exploits is becoming increasingly more common. It seems that Java exploits are becoming the weapon of choice by attack toolkit writers because of its cross-platform nature. Fortunately for you, if you're using a TippingPoint IPS you are well protected. DVLabs has filters for 100% of CVEs found in this toolkit. Here are the filters as well as the matching CVEs for the BlackHole exploit kit:
On top of these filters we are also engaged in ongoing research projects where we continuously collect and analyze samples of newest exploit kits (and other types of malware) in order to quickly create filters that protect our customers. We've analyzed over two dozen web exploit kits in the past 6 months and are continuously working on acquiring new kits as soon as they're released. We'll keep you posted with further blogs as we discover new and interesting exploit toolkits.
Cloud Security: Amazon's EC2 serves up 'certified pre-owned' server images
Background behind the problem
Cloud computing has quickly evolved from a hot industry buzz word into a multi-billion dollar emerging market, with all the big names striving to grab a piece of the pie. Amazon, with its Amazon Elastic Computer Cloud (EC2), is arguably the dominant leader of the cloud services market. Even the video streaming giant Netflix moved its operation into Amazon's EC2, opting out of building out its own data centers. With such a high growth technology sector it's no wonder we are starting to see more and more malicious activity spreading in the cloud ecosystem.
Let us quickly go over a typical usage scenario from the view point of an EC2 user, in order to better explain how this attack works. Users sign up for Amazon Web Services because they want to host something on the cloud, be that a web site, web service, or just a data backup. More often than not they want to host a server in the cloud in order to offset the cost of purchasing and maintaining their own hardware. So how does this process work? Well, when a user wants to create a virtual web server, referred to as an instance, they usually have two choices. They can either create a software image to install with, or they can use one of the pre-existing software images available from EC2. These images are called AMIs, or Amazon Machine Images. They're stacks of software created to help users deploy servers quickly. For example, a typical AMI might consist of a SuSE Linux image with Apache web server and MySQL database already installed and configured. Other images may have WordPress, Joomla, Drupal or a number of other content management systems pre-installed for you. You get the picture. The AMIs allow you to deploy a server, for whatever purpose you want to use them for, rather quickly. A user just has to select the type of instance they want to deploy (number of CPU cores + memory) and then pick the image they want to deploy with. The whole process takes less than 5 minutes.
There two major types of AMIs to work with. There are images built by Amazon itself, of which there are 170 at the time of this writing. But then there are also public images, created by the other members of the EC2 community. There are about 7390 of these, all created by other users of Amazon's cloud services and then shared with the rest of the community to help others. Or so you would assume ...
Certified Pre-owned AMI
On April 8th, 2011, Amazon sent out the following email to its Elastic Compute Cloud customers acknowledging the presence of compromised images in their community. In this email they notified the members using the compromised AMIs of the danger they're facing and the necessary course of action to remediate the threat. This is one such email:
The email identifies the affected AMI and warns against any continued use of it. It suggests, and rightfully so, that any server instance running an infected image should be for all intents and purposes considered 100% compromised. All services running on those instances should be migrated to new (clean) images. This is definitely the right recommendation to make to its customers, as nobody can guarantee that the affected servers have not been compromised already. Naturally, they do not disclose the number of instances that have been affected from this AMI but simply judging from the sheer size of EC2 and the number of servers hosted there we can't help but assume the number is not very small. The infected image is comprised of Ubuntu 10.4 server, running Apache and MySQL along with PHP. This is a pretty typical LAMP server setup so we're assuming a lot of users opted to use it, especially if they are hosting a web site. To make things worse the image appears to have been published in October of 2010, which is 6 months ago and we are only hearing about this problem now.
So what exactly happened here? An EC2 user that goes by the name of guru created this image, with the software stack he uses most often and then published it to the Amazon AMI community. This would all be fine and dandy if it wasn't for one simple fact. The image was published with his SSH key still on it. This means that the image publisher, in this case guru, could log into any server instance running his image as the root user. The keys were left in /root/.ssh/authorized_keys and /home/ubuntu/.ssh/authorized_keys. We refer to the resulting image as 'certified pre-owned'. The publisher claims this was purely an accident, a mere result of his inexperience. While this may or may not be true, this incident exposes a major security hole within the EC2 community.
While the ability to publish and use community created AMIs is a nice addition to EC2 it also leaves its community widely exposed to a wide range of security vulnerabilities. A foreign SSH key injected into ~/.ssh/authorized_keys like in the one described in Amazon's email is something that most users would probably never notice. Vast majority of users will simply select the AMI they want to use, pick their instance type and off they go. They will not take time to do a security audit of the system. They might not even know how to do a security audit of the system. Most business are rushing to get their products to market, and cloud is just another shortcut to getting their servers up and running and not having to worry about machine maintenance. To them, the more time they save configuring the systems the more time they have to get their product out of the door quicker. In which case it makes perfect sense to
them to select a community released AMI if it meets all their software requirements. This is exactly why we think this type of attack on the EC2 community can prove to be particularly effective.
Tip of the iceberg
Whether this was an attack or not is uncertain. I suspect it was just an honest mistake, but that is besides the point. What we do know is that if something this transparent took 6 months to get caught than the cloud community is due for a rude awakening. This exposes a real security vulnerability present within the community that needs to addressed as soon as possible. Currently there is no true way for customers of EC2 to trust any of the publicly published AMIs. How could they? These images are created by unknown 3rd parties and there's no real way of knowing how the images were created. A truly malicious user can easily put in a truly hidden backdoor that might never get discovered. They could recompile ssh-daemon with their own backdoor, that would allow their user to be permitted access to the system. Such a backdoor would be near impossible to detect. An attacker could also put a backdoor into the kernel itself, install a rootkit, create a trojan that phones home, etc. The possibilities are endless and the security measures are unfortunately too few. The point here is that any AMI could have a backdoor that is so hard to detect that it would probably never be detected by the community. This sort of vulnerability allows for a lot of blanketed attacks. Much like the AMI mentioned earlier in this email was comprised of widely used software so could a truly malicious AMI created by an attacker. Malicious entities could potentially flood the EC2 community with hundreds of infected AMIs with the most popular software stacks such as LAMP, CMS servers, video/audio streaming servers, etc. These AMIs would then get consumed by the unsuspecting cloud users and their machines compromised.
Cloud security is no small issue, and the problem with compromised AMIs is not one to take lightly. We hope this incident proves to be a tipping point (no pun intended) for the way EC2 manages AMIs. Hopefully Amazon EC2 Security Team finds a way to deal with these challenges. One possibly solution would be for Amazon to become prolific in creating AMIs that the community is demanding. Perhaps have a form where customers can demand certain types of images and Amazon employees create them. Another solution might be create a method of easily creating images from scratch. Perhaps some sort of automated install scripts that create software stacks based on customer needs. Yet another solution would be to create an open community that does peer reviews of published AMIs although this could prove to be an insurmountable task. As it currently stands the EC2 community AMIs are unsafe for use. We suggest all EC2 users to carefully check their running instances for problems such as the ones we described, and optimally they should create and install their own AMI images.
Hammer of the Botgods: A New Variant of the ZeuS Botnet May Be Upon Us
Professionalism in the Underground
It's no secret to those who study illicit (shadow) economies that things change rapidly in order to meet supply and demand. Profit (regardless of how you define it) remains supreme; loss the enemy. This is true in all markets legal or illegal with cybercriminal markets being no exception. Take botnets for example. The market for botnets changes at amazing rate. The purpose, style, functionality, models for acquisition (do I rent or do I own?), size, and effectiveness are dynamic and evolving. Often advanced marketing campaigns (some more formal than others) are employed which showcase the botnet (and author's) vision and dedication to their products. Many times in the course of these marketing campaigns information such as:
- Service Level Agreements
- Technical Assistance Centers (TAC)
- Price guarantees
- Competitive Analysis Intelligence
Winds of Change: ZeuS and SpyEye
No better example of this comes to mind than that of the infamous ZeuS botnet also known as the Zeus banking Trojan (Zbot, PRG, Wsnpoem, Gorhax and Kneber). Not long ago what initially looked like a hostile takeover involving the authors of the SpyEye Trojan and the authors of the ZeuS banking Trojan was underway. The upstart authors of the SpyEye Trojan made international headlines in 2010 when it was discovered that the Trojan had the capability of automatically searching for and removing ZeuS from compromised hosts before installing itself. The team behind SpyEye (called the 'ZeuS Killer' by its author) also made sweeping allegations regarding the inefficiencies of their competitor while touting their strengths. Then something odd occurred. The underground forums rang like cathedral bells when it was made known that a Russian hacker known by the handles "Slavik" and "Monstr" had no future plans for maintaining the now ubiquitous crimeware kit. Instead, according to numerous hacker forums and IRC channels the author decided to transfer the original source code of his Trojan to the authors of the SpyEye Trojan.
Figure1a: Spyeye Advertisement
Figure1b: Spyeye Advertisement
Figure 1c: Spyeye Advertisement
Figure 1d: Spyeye Advertisement
A Possible New Variant of ZeuS?
That this sort of activity is occurring in the underground is occurring is not surprising but it does make me wonder whether or not the authors of ZeuS sold to only one buyer. I believe that they did not based on the following information gather from open sources:
Figure2: New ZeuS Variant
Figure 3: New ZeuS Variant
Figure 4: New ZeuS Variant
Figure 5: New ZeuS Variant
The advent of this new variant may partially explain the uptick in activity that we and our peers are seeing our research. You'll not that in Figure 5 which is a data graph provided by abuse.ch Zeus Tracker, that there appears to be an uptick in ZeuS activity beginning right about the same time when this latest variant was made public. In speaking with researchers in Latin America, and Europe this correlates with the data we at HP DVLabs have collected. You'll note that in Figures 6 and 7 respectively that the light green bar represents unique source IP addresses while the light blue represents unique destination IP addresses.
Figure 6: abuse.ch Zeus Tracker Statistics for February and March 2011
Figure 7: ZeuS Botnet Command and Control Phone Home RequestFigure 7 depicts a phone home attempt (indicative of a backdoor C&C model) made by a compromised host infected with the ZeuS Trojan (botnet). What is interesting to note is the valley occurred between March 13 through the 15 of 2011 as that correlates with the alleged 'transition' period of ZeuS source code from 'Slavik' to 'Harderman', author of the SpyEye Trojan (botnet).
Figure 8: Spyeye Botnet Command and Control Phone Home Request
Similarly Figure 8 depicts a phone home attempt (indicative of a backdoor C&C model) made by a compromised host infected with the SpyEye Trojan (botnet). Note the uptick comparable uptick in activity that closely parallels that seen in our research and that of our peers. As mentioned earlier in this blog, SpyEye is a cleverly crafted mobilized Trojan that has the ability to among other things to:
- Enumerate target hosts for the presence of ZeuS and remove it prior to installing itself
- Monitor keystrokes
- Record username / password combinations
- Harvest credit card numbers
- Upload all acquired data
- Once it has concluded harvesting the data to remote servers for storage and collection
As it stands we will continue to monitor ZeuS's evolution in concert with SpyEye and independent of it as our findings demonstrate that it remains alive and well. This latest variant of ZeuS is being offered for approximately $5500.00 USD payable via a number of means. We predict continued growth and the potential for expansion with respect to this botnet and will monitor its activity moving forward.


text:
|Page: 1 of 1
|Sort By:
With only eight beds we are one of the really small and cosy hostels - and probably the most northern one so far, too.
We offer rooms with 2-6 beds with free toast and tea for breakfast and a whole lot more...
Ferry services are convenient for trips to Oslo and Gothenburg. The hostel offers meal services and accommodation is in 1-4 bedded rooms
Find a Kiel, Germany hostel and save money on discount lodging. Hosteling in Kiel, Germany offers a different travel experience than staying at traditional accommodations. Youth hostels allow you to meet new people and learn from other international and worldly travelers. Most hostels are conveniently located in the center of the action close to public transportation, including buses and rails. Staying at a Kiel, Germany hostel is a great option whether you are backpacking or traveling on a budget . Browse our hostels and plan your Kiel, Germany vacation today!


text:
Make Contact
Alum are a very important part of the International Studies program. We are always excited to hear from our alum and to be kept up to date on your personal lives and professional accomplishments. Kindly send information regarding your life "post-BW" to Dr. Judy Krutky at email@example.com.
What Are Other INT Graduates Doing?
Here are some examples of what graduates with INT or double majors are now doing to give you some idea of the possibilities. E-mail addresses for many of them are available upon request from the Political Science Department at (440) 826-2311.
Patti Nagy - Import/Export, Regional Manager, Guadalajara, Mexico (International Studies & Business Administration, BW; MBA, Universidad de las Americas, Puebla, Mexico)
Scott Dille - Senior Marketing Manager, OOCL Logistics, USA Inc., New York City (International Studies & Political Science)
Michael Weidokal - President and CEO, ISA-International Strategic Analysis, Americas and Asia-Pacific, Cleveland, OH (International Studies, BW; Master's Degree in International Business, South Carolina State University)
Chanin Wendling - Principal, IBM Global Services (International Studies, BW; M.A., International Relations, Yale University; MBA, Auburn University)
Francesca Norsen Tate - Religion News Editor, Eagle Publishing Company, New York City (International Studies and Communication)
Michael Anuszkiewicz - Custom Research Analyst, Riskmetrics Group, Baltimore, MD (International Studies and French)
Trent Vesely - Sales Manager, Southeast Asia, Diab Group, Bangkok, Thailand (International Studies and Business)
Samantha Stephens - former Manager, Cleveland Council on World Affairs; currently Trade Compliance Specialist, Alcoa Wheel & Forged Products, Randolph, OH (International Studies & Political Science and IMBA, BW)
U.S. and other Countries' Civil Service
Zarema Arutyunova - former International Trade Specialist, Russia & Independent States, U.S. Department of Commerce, currently an attorney with Clifford Chance USLLP, Washington, D.C. (International Studies & Business, BW; JD, American University Law School)
Stacy Knight Drake - Senior Policy Intelligence Analyst, Department of Defense, Omaha, NB (International Studies & Political Science, BW)
Michael Rousek - U.S. Department of State, Foreign Service Officer, currently serving as Deputy Principal Officer at the U.S. Consulate in Medan, Sumatra (Indonesia). Formerly with the U.S. Customs Service, Treasury Department. (International Studies & Political Science, BW; International MBA, BW)
Christine Burkhart - Former Peace Corps Volunteer, Dominican Republic, currently Development Project Manager for Latin America, Red Cross, Washington, DC (International Studies, BW; MA, Johns Hopkins University)
Michael Rogers - International Trade Specialist, Central and East European Business Information Center, U.S. Department of Commerce (International Studies & Political Science, BW; MA, American University)
Haris Hanjalic - Former linguist for U.S. Army in Kosovo (2001-05), currently Assistant Brand Manager, Sara Lee Corp., Chicago, IL (International Studies & Business, BW; MA, Case Western Reserve University)
Karen Gasper - America Votes headquartered in Columbus, Ohio (International Studies & Political Science)
International/National Nongovernmental Organizations
Joe Fisher - Former an analyst at RAND Corporation (International Studies, BW; MA, New York University School of Public Administration, International Health Policy Management, New York
Ann Weeks (Horm) - Vice-President, Underwriters Laboratories, Inc. (International Studies & Economics, BW; MA, American University)
Miki Satake (Japan) - Mathematica Policy Research, Washington, D.C. (International Studies, BW; Master's Degree in Demographics, Georgetown University)
Crystal Thies - Executive Assistant to the President, Cincinnati Museum Center (International Studies & German, BW; MPA, Northern Kentucky University)
Sarah Serfass - Associate Director of Community Outreach, The Diversity Center of Northeast Ohio (International Studies and Political Science)
Mark Lammon - Special Projects Manager, Downtown Cleveland Improvement Corporation (International Studies and Political Science)
Law & Banking
Kristin Walker - Associate, Cowden, Humphrey, Nagorney & Love, Cleveland, OH (International Studies, BW; MBA, Case Western Reserve University)
Christine Shepard - Graduate of DePaul University Law School (International Studies & Political Science)
Doug Nelson - Attorney with the United States Court of Appeals for the Armed Forces(International Studies, Political Science & Spanish, BW; J.D., University of Michigan Law School)
Amy Overton - Attorney in Immigration Law for Barbara Firstenberg & Associates, Co., Cleveland, OH (International Studies & German)
Yuko Higuchi - Paralegal, Orrick Tokyo Offices, Tokyo, Japan (International Studies)
Athena Inembolidis - Personal Bankruptcy Attorney, Columbus, OH (International Studies, BW; J.D. Cleveland Marshall School of Law)
Travel & Tourism
Saleem Jabsheh (Kuwait) - Travel Agent, Rio de Janiero (International Studies & Political Science
Luciana LeMire - International Flight Attendant, Continental Airlines, Cleveland, OH (International Studies)
Teaching and Higher Education
Richard Moeller - Professor of Political Science, The Metropolitan State College of Denver (International Studies, BW; MA, George Washington University; Ph.D. in Political Science, University of Edinburgh, Scotland)
Deanna Voss - Senior Director, Admissions, University of Miami, Coral Gables, Florida (International Studies, BW; MA, University of Miami)
Susan Griffin (Engle) - French & ESL Teacher, Oak Ridge Military Academy; Freelance French Translator (International Studies & French, BW; MA in French Translation, Kent State, K-12 French teaching licensure)
Sarah Rasmussen - Lecturing in English department, University of Salzburg, Austria (International Studies & German, BW; MA, German Studies, Bowling Green State University)
Joanna Kosmidis - Administrator of MBA Program, University of Macedonia, Thessalonki, Greece (International Studies, BW; Master's in Education, University of Reading, England)
Craig Mulling - Associate Dean of Arts and Sciences and Professor of Sociology, Prairie State College, Chicago Heights, IL (International Studies and Sociology, BW; MA, Bowling Green, Ph.D. University of Hawaii)
Kelly Canavan - Foreign Language Instructor, Burnt Hills-Ballston Lake High School, New York (International Studies & German)
Katrina Spillane - External Cooperation Office, National University of Agriculture of Honduras, Catacamas, Honduras, Central America (International Studies & Spanish, BW; Master's in International Development, University of Pittsburgh)
Lori Brindisi - Director of International Student Services, Walsh University, North Canton Ohio (International Studies, BW; M.Ed., Cleveland State University)


text:
Midwest Boar Stud Managers Conference
August 9th - 10th, 2012 • St. Louis, MO
Past Event:
This conference will make boar stud owners, managers and employees aware of opportunities to improve sperm production and quality. Topics include new thoughts on developing young boars; interpretation of PRRS test results; low-concentration, high-fertility Dutch AI practices and more.
Location Details
St. Louis, Missouri
United States


text:
Fairfield City Police are investigating an alleged home invasion that happened Wednesday. The victim has been identified as Ryan D. Thomason, 23 of Fairfield. The alleged suspect is Andy Bailey, 22 of Cisne. Details of the incident were not immediately available.
43-year-old Shelly L. Wodicker of rural Fairfield was arrested Wednesday evening on a charge of DUI-drugs. City police responded to a report of a woman slumped over the wheel of her vehicle in the 600 block of South First Street at about 6:10 Wednesday evening. Wodicker was cited for DUI-drugs and for being in possession of a controlled substance – prescription drugs.
29-year-old Robert L. Shurn of Alton, IL was injured Wednesday afternoon when the semi he was driving failed to negotiate a turn onto I-64 from U.S. Rt. 45 south of Fairfield. Shurn was injured when the semi overturned. He was taken to Fairfield Memorial Hospital. Shurn was cited for failure to reduce speed to avoid an accident and operating in violation of his drivers' license restrictions.
Arraignment has been for July 11 in St. Clair County in the unlawful videotaping case of suspended Fairfield Community High School teacher Timothy C. Going. Going is accused of placing a hidden camera in a Super-8 Motel room in Fairview Heights to videotape an underage Fairfield girl and her adult attendant. The incident happened last November.
The last concert of the Fairfield City Band concert season is tonight on the Wayne County Courthouse lawn. The performance will begin at 7 p.m. The New Hope School Band is sponsoring a porkburger sale from 5 – 7 this evening ahead of the concert. The school is raising money to go perform at Disney World.


text:
Introducing the Chuck Taylor II, Converse's revamp of the most famous sneaker...
Solar Shield
The lightweight Dermalogica Solar Defense Booster SPF 30 (50ml, $120) is a sunscreen supplement that morphs any existing moisturizer into a weapon against the sunâ??s damaging rays â?? just add a few drops. It provides vitamins C and E to improve skin texture and botanical extracts of Grape seed and Green Tea to fend off environmental damage.
Available at all Leonard Drake Skin Care & Health Spa Centres and Dermalogica-authorised skin care centres
Butter Up
Nourish and protect your dry skin with Thann Body Butter (100g, $25). The thick cream absorbs easily, making it an effective and long-lasting moisturiser for your body. Cocoa butter strengthens, while liquorice extract smoothens the skin.
At Thann Ion Orchard B1-10
Ab Fab
You want love but not the handles. Enhance your six-pack with Clarins Men Ab Firming Body Toning Gel (150ml, $68). Using natural ingredients such as caffeine, the body gel redefines the abdomen and stimulates fat burning. The Adiposlim complex ensures that the gel penetrates deep into the skin. Use it after a workout for best results.
Available at all Clarins counters
The multi functional Shiffa Healing Balm (30ml, $118) can be used for minor skin irritations, chapped skin, scrapes, cracked lips and even stretch marks. Made of pure ingredients such as chamomile, and mango butter, it is a good thing to have on long-haul flights to make sure skin is comfortable and well hydrated.
Available at Sephora Ion 01-05
Thermal Power
Biotherm Homme Aquapower Oligo Thermal Refreshing Lotion (200ml, $46) perfectly hydrates the skin and improves its appearance after a razor blade has left it sore and sensitive. Combining moisturising and soothing agents, it provides a jolt of freshness the way a thermal spa does.
Available at CK Tang Orchard, Tangs Vivocity, Takashimaya, Isetan, Robinsons, Metro Paragon and BHG Bugis
CONTEST: We're giving away FIVE sets each of the Dermalogica Solar Defense Booster SPF 30, Thann Body Butter, Shiffa Healing Balm and Biotherm Homme Aquapower Oligo Thermal Refreshing Lotion. All you have to do is join in our Grooming Group discussion for the month of August!
HOW? Sign up or login to your August Man Profile and join the Grooming Group. Details are in the Group Topics.