Chinese Government Shows 'Interest'

It's no surprise that a lot of cyberattacks originate from the the 'excellent' People's Republic of China. Some of these attacks are funded by or even originating from the Chinese government. Well, the latter is definitely true.

My (private) ssh server is a point of interest to the Chinese government, since they are trying to get in.

Every couple minutes a possible break-in entry is recorded in my logs. I guess that they decided not to hammer the front door, in order to evade automatic blacklisting of the originating IP.

reverse mapping checking getaddrinfo for mail.zdpri.gov.cn [218.108.28.189] failed - POSSIBLE BREAK-IN ATTEMPT!

I checked the IP and it seems to host the web-mail for the Zhejang prov. Development Planning & Research Institute [1].

I guess it's time to tighten the timers on blacklisting.....

B.t.w. The reporting on the IP was provided by Splunk. Excellent tool for digging in logfiles and reporting.

Comment Spammers Do Research

Lately, the comment spam rose exponentially. The is done by automated scripts, usually from compromised PC around the world. This way the original spammer will remain anonymous.

The last couple of days I noticed weird search queries (Google search referrers) in my logging;

Looks like someone (probably in the Hong Kong area) is searching the Internet for specific blogs (I guess SquareSpace blogs looking at the query) that contain certain words / fiels, indicating that commenting is allowed. These keywords match 100% with the field / words in and around the blog comment area. Shortly after these searches, the comment spam came pouring in.

At the moment, the only remedy against these spam comments is to screen every newly submitted comment by an editor, since the automated spam detection on the Squarespace platform is basically worthless. Too bad, since they rock at everything else.

Microsoft Cryptographic Store and Passwords

We've been experimenting with with the use of user certificates for VPN access to the lab. Issuing, and using them isn't the problem. The problem is that there's no way of enforcing a password on the use of the private key. You can use private key protection on the certificate template, but that still doesn't enforce a password requirement. The user still has the option to choosing for the notification instead of a password.

Certificate Template - Request Handling OptionsThere's an option to enforce a password, but that's system wide for the Microsoft Cryptographic Service Provider, and we don't want to enforce passwords for ALL certificates. We just want to enforce passwords for this specific template.

Click to read more ...

OS X Kerberos / Open Directory Logging

Ever since I switched to OS X server at home I use Splunk> to see what's happening 'underneath the hood'. This revealed that there's a lot (really a whole lot) of Kerberos logging going on. Each and every day I get thousands of log entries regarding krb5kdc which results in over 1 million log entries only for krb5kdc in little over a week.

These syslog messages only contain the following 'text';

krb5kdc[16179](debug): routing msg not interesting
krb5kdc[16179](info): got routing msg type 5(RTM_LOSING) v5
krb5kdc[16179](info): routing socket readable

Looks like that the debugging level is set to debug (why??). And why can't we change it? Others seem to have this problem as well.

Looks like that the following command seems to work:

sudo defaults write /Library/Preferences/DirectoryService/DirectoryServiceDebug "Debug Logging Priority Level" FALSE

After entering that 1 line I haven't seen any new logentries in the kdc logs. More info on that command can be found @ Apple.

Nevermind......

Slow Open Directory on OS X Server

Ever since I've been playing with my Mac mini with OS X server 10.6.4 I have had on-and-off problems in the authentication/Open Directory area.

• Some accounts authenticate really quick, while others take minutes to authenticate.
• Accessing the Open Directory through the Workgroup Manager is as slow as a slow boat to China. Changing users (just by selecting them) takes another boat along the Pacific.

So it was time to start digging into the phenomenon called 'Open Directory'.

The manual from Apple isn't much help in troubleshooting a slow Open Directory, so it was time to search the interwebs and start experimenting. If it didn't work, I can always reinstall the entire server from scratch.

Click to read more ...

The Problems with Apple OS X (10.6.4) Server

Updated on Monday, July 12, 2010 at 21:48 by Willem

It has finally been done. I've switched off the old Windows 2003 server at home and officially replaced it with an Apple Mac mini server. For now... And with 'for now' I really mean for now. It turns out that Apple OS X Server doesn't resemble its client counterpart at all. Where the client is stable and intuitive, the server edition lacks both.

I'll try to explain why I think there's lots of room for improvement. Mainly stuff I ran into while configuring the server/services.
Since the Windows fulfilled several functions, I needed these functions to be available on the OS X server as well. These were;

• Networking services like DNS and DHCP
• Webserver
• Mailserver
• MySQL Database
• SSH Server
• File sharing on the internal network
• Public Key Infrastructure for issuing certificates
• Download station

Evaluating these functions, one would think that this shouldn't be a problem. Well it actually is.... At least some of those features.

Click to read more ...

My iPhone 3GS and iOS 4

Apple released the latest Operating System/software/firmware for the iPhone. This new OS (iOS) adds several new features and lots of enhancements (which I wont be going into).

I upgraded my iPhone earlier this week. No problems with that. The only real hick-up I ran into was the Voicemail number. The phone had forgotten the Voicemail, MMS and Tethering settings, so I needed to add it again. Even tethering was still available on the SIM-lock free iPhone with the KPN carrier.

There's one thing that's not 'Apple' about this update. With the regular Apple operating systems there's always the experience that an upgrade to a new release (10.4 -> 10.5 -> 10.6) leaves you with a faster/snappier OS. Even if the hardware is relatively old. Don't know how they do it, but it's something that Microsoft hasn't accomplished yet since MS-DOS 3.

Anyway, the OS upgrade on the iPhone is completely different. The device is less snappy. It looks like the device goes into some sort of suspended animation and when you need to use it it takes a couple of milliseconds (it's not much, but it's noticeable) for the phone to react. After a couple of seconds it seems to be gone.

For me, the new/improved features are more important than the snappy-ness of the device, so I'll stick to the new iOS for the moment.

SquareSpace Traffic Statistics

First; I would recommend SquareSpace [2] to anyone who wants to run a website with lots of features and easy as 1-2-3. It's extremely easy to use, and no HTML knowledge is required to start modifying the layout etc. (it helps if you do though).

With the website comes a management center (Dashboard) where you can view traffic/visitor statistics (among a dozen of other things regarding the website). Every now and then, I see the traffic increase.

Green = Visiting IP's / Grey = Pageviews

Initially I thought;

Damn, they started the DDoS again....

After that;

They Slashdotted me (one can always hope)

Click to read more ...

The 'Legalized Meaning of Words' According to Wordpress.com

Updated on Wednesday, May 26, 2010 at 19:23 by Willem

I got an e-mail from an 'old' friend Hunter (probably not his real name) today. He helped me out regarding the exposure of online scammers last year. He (and his 'team') offered to continue my work in regards to exposing online retailers that 'forgot' to send the goods, after you payed..... I couldn't go on with this (important) work for several reasons. Reasons I won't go into at this time.
Anyway, he moved the available content to the public (and free) Wordpress platform and continued what I had left behind.

Click to read more ...

Droplets in Photoshop CS5

Every photo I upload to Flickr goes through a watermarking process. To do this, I created a watermarking action within Photoshop (started this in the CS3 days). These actions can be 'converted' to so-called droplets. These are 'shortcuts' you can place on e.g. your desktop. Every image you drag onto this droplet gets opened in Photoshop and the preconfigured actions are applied.

This worked in Photoshop CS3, and CS4 (after some modifications to the original action). But in Photoshop CS5 the droplets won't execute. The action itself runs smoothly within Photoshop, but when you export it as a droplet, the action won't start. You have to start the action manually.....

I even tried to create an action / droplet from scratch in Photoshop CS5, but that one won't run either when I drop a JPEG on the droplet. This is a reason for not upgrading to CS5 on my main machine (which also still runs Leopard for compatibility reasons).

According to the online Adobe Photoshop CS5 helpfiles regarding droplets, the droplets should still function. So I write this of as a bug in the initial release of Photoshop CS5.

Update on Friday, May 7, 2010 at 6:51 by Willem

I posted a bug report @ Adobe after I found out that I'm not the only one having issues with this.

Update on Wednesday, May 26, 2010 at 19:44 by Willem

The discussion on the Adobe Forums have attracted the attention of Adobe employees. So hopefully, we'll see a bugfix soon. I don't want to modify every action I have a droplet for. Especially since I use several actions made by others, which I 'converted' into droplets.

Update on Thursday, July 1, 2010 at 8:05 by Willem

Adobe released an update for Photoshop CS5 (v12.0.1), which fixes the droplet problem in the 32bit mode (I haven't tried the 64bit mode yet). Just launch the Adobe updater and the update will be installed.

And now; continue to evaluate the new features of Adobe CS5, and hope I don't run into more annoying bugs.