Error 25113.Setup failed to generate the JRE SSL keys.

If you do any sort of googling for this, you’ll find people that suggest looking for openssl.exe and renaming it temporarily. I didn’t have openssl.exe so that wasn’t going to work. Another person gave the old windows “fix” of just reboot the box. Guess what, that didn’t work either.

In the end, the fix was pretty straight forward. Remove the old Update Manager install and do a fresh install of the update manager. Pretty painless and works like a champ.

Did someone hack our website? It looks like a Chinese news listing entry has been added with today’s date.

Ballsack!

Time to roll up the sleeves. How bad is the damage?

From the looks of it, other sites on the web server had not been damaged. Doing a search for modified files found nothing out of the ordinary had been changed. Log files sure but nothing out of the ordinary. A search through the web logs of the site showed that this appeared to be an attack on the Content Management System (CMS) for the site.

Whichever jackass wrote that code should be beaten! Get the torches and pitchforks, death to the programmer!! Oh wait, that was me. Death to the evil script kiddie that attacked my beautiful code!!!!!!!!!

Searching through the logs, I started seeing some interesting logs. A bunch of them that had variations such as this:

This one is actually after a lot of hits from the attacker of figuring out the tables and then getting down to the nitty gritty of pulling out a username and password.

The issue was that I had forgotten to sanitize my data. Like a jackass, I didn’t check that $id was an actual integer variable and when they ran thier script they were able to pull out a hex string that, with the use of such tools as this site, you can easily translate this into text.

The Quick Fix

I put in 2 fixes to ensure that we were dealing with an integer value here. First, I did some simple math to the variable that changes its type if it is not an integer.

If you have a string, you’ll get back a zero. If you have an integer value, you’re good to go.

Also in the code, I expanded the if statement that was around the code to grab the specific news item. Instead of just checking to see if the $id variable was set, I now check to see if it is set and greater than zero, another layer in ensuring that we have a number instead of a string of text.

We’re all human and humans make mistakes. This code that was exploited was written 8 years ago at a time when I should have known better, but missed it. It lived in the wild up until last year when it was finally exploited. I’m lucky that it took that long for it to expose itself, but kind of embarrassed that it was there in the first place. While I tend to come down hard on people for not doing these sort of things, its only because I’ve learned my lesson the hard way and have seen people continually mess this stuff up. While this happened to me a while ago, I’ve had friends get bit by this very recently so I figured it was time to finish off this post and get it out the door. An ounce of prevention sort of thing.

To lear more about SQL Inject attacks, here is a good article by Bhanu Mahesh on Quality Software Connection on how to prevent them.

Goal #1: Sleep More! With the help of mercuryapp.com, I’ve been able to track my sleep time and so far for 3 months I’m averaging 6.86 hours of sleep a night. I’m shooting for 7+ so I’m not too far off.

Goal #2: Time for family – Check and check. Work hasn’t gotten in the way too much so that’s all good there.

Goal #3: Ship Code. Have a small idea that I’m working on. Need to find the time. Hopefully this summer.

Goal #4: 5×5. One down, 3 more on my radar. Need one in the fallish timeframe which I think I have 1 or 2 that I’m looking at. I’ve been putting the miles on as I have logged over 70+ miles so far this year.

Goal #5: Top Secret. Still top secret.

Yet, we are in another round of the IT glory days. Read TechCrunch for 5 minutes and you’ll just be shaking your head. What was the .com boom of the late 90s has become the new app explosion of today. Money is flying at companies that have a cool new app with a bunch of users but NO REVENUE!!!

The latest example is an app that I really like. Its being reported that Instagram is raising 40 million dollars with a 500M company valuation. While its great that they can keep the lights on and servers running, but how are they going to make money? Maybe giving away the app wasn’t your best plan. I would have paid $0.99 for the full version with maybe a free version with only a few filters. 27 millions users you say, It would have been rough having 18.9 million (27M * 70% after Apple’s cut) coming in the door if you charged for the app.

I’ve bitched before about FlipBoard doing some of the same shit.

Ladies and Gentlemen…if you want to run a successful company, you need to have money coming in the door. And I’m not talking about VC money. It may help you out in the short term, but guess what, those VC guys and gals expect to get paid at some point. Stop bullshitting us with the “oh we’ll figure out a way to make money in the future, we have X million users now”. If you haven’t figured it out by now, you’re not going to asshole. And the VC that invest in you deserve every bit of loss that they get. Just don’t got public with it, screw up my 401K, and the rest of the stock market in the process.

I’ve been messing with powershell for a while now with VMware, but never really getting into big time scripting with it. Its mainly be something to use to accomplish some various tasks on mutliple hosts. Very little error checking in the scripts since I’m watching them was they run. If I want to put them into a scheduled task or automate them from a web page, more error checking is needed.

Recently, we starting messing around with automation of Exchange 2010 provisioning using Powershell. There are some great cmdlets to accomplish this, but I ran into a particular issue that really bothered me as a programmer and since I spent more than 5 minutes unsuccessfully googling the answer, I figured I’d write this post.

My issue was this, I was attempting to put some wrappers around certain cmdlets to get back whether or not they completed successfully. I hate to be the bearer of bad news, but shit doesn’t always run as you think it would.
I think I found a good way of handling the powershell scripts that do not return a true or false and were causing some false positives.

The issue occurred in the functions such as remove-mailcontact where I would have something along the lines of:

This would alway return the -ERR statement.

So now I have expanded upon that and have the following:

This second method seems to be doing what I want and goes to the appropriate domain controller so I think I’m on the right track…we just need to update the various scripts now. For a little more information on the errorVariable adn other default switches you can pass a cmdlet, check out this blog post from the Microsoft PowerShell Blog.

There were a lot of things different about the Red Flannel Run in 2012 compared to last year. First and foremost, the temps. Last year we were in the mid-30s and I was warm as could be in my gear. This year, I wore pretty much the same thing except the temps were 7 degrees with a -6 windchill. It was cold out there. But with the gear I had on and the running, I warmed up pretty quickly. I just wish I would have had some sort of neck gator on. That would have made a pretty big difference for me. I kept having some breathing issues after the first 1.5 miles and I’m pretty sure it was due to things (mouth, lungs etc) freezing up a bit.

Second big difference, I ran a heck of a lot faster than in 2011. Too fast for the first mile but over all, I shaved off 4+ minutes from the previous year and beat my fastest time from 2011.

The official stats come in as this:
Time: 23:51
Age Group rank: 12
Overall: 70

Not bad for the first time out. I’m hoping for some stronger finishes later in the year when I can get some better training in. Running on the dreadmill is boring and I never want to go more than 2 miles. I’m hoping that once we get over the snow, ice and cold temps I can put some longer runs in and build up the endurance for a faster time.

I’ll be working on getting a screen cast of the demo up in the next week or so. Too many other things distracting me at this moment.