My Personal Blog

Mempodipper Bug

2012-01-27T22:42:00.000+07:00

For those who's using Linux Kernel 3.x, there's a serious bug in the Linux Kernel which can be misued to have a local privilege escalation via suid which is well explained on this site.

The solution is quite easy: all you need is to upgrade to the latest Linux Kernel 3.2.2 and you should be safe.

Here's what you will get when you are running a vulnerable kernel:

bash-4.1$ ./mempodipper
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/3765/mem in child.
[+] Sending fd 5 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Ptracing su to find next instruction without reading binary.
[+] Resolved exit@plt to 0x80499e8.
[+] Calculating su padding.
[+] Seeking to offset 0x80499dc.
[+] Executing su with shellcode.
sh-4.1# id
uid=0(root) gid=0(root)

Quite nasty huh? So what are you waiting for? Go to the kernel site and grab the latest version (3.2.2 at minimum)

KDe 4.8.0 is Out

2012-01-26T06:31:00.000+07:00

KDE 4.8.0 is now released by the KDE developers and it's dubbed as a major release, no longer a maintenance update like the previous release. This new release brings a major improvements to all components, such as Plasma Workspaces, Applications, and as a Platform.

I have been running KDE 4.8.0 for few hours as i have just upgraded using AlienBOB's package on Slackware-Current and it feels so good. It's faster than previous release and i'm happy with it.

KDE 4.8.0 will shortly be landing in your Linux distribution, so just wait and see to feel it. With this release, KDE 4.8.x branch will start it's monthly-release journey starting on February where they will deliver a maintenance release.

Alsa 1.0.25 is Out

2012-01-25T22:01:00.000+07:00

ALSA (Advanced Linux Sound Architecture) has just released a new major version after around one year without any update. This new major release brings a lot of changes to users along with many new drivers to extend support for new hardwares.

This package is also builds against the newer Linux 3.x kernels which is likely to be the default kernel being used in many Linux distributions released this year.

For those who wanted to see more detailed changes, please visit the changelog

Absinthe Updated to Support Linux

2012-01-24T20:17:00.000+07:00

Afte releasing Absinthe for Mac and Windows, the developer didn't stop at that point. They released an update for this tool and they even release this version that support Linux platform as well. So, basically from this moment, you can use Linux to jailbreak your A5 devices and no longer dependent on Windows/Mac.

Unfortunately, iTunes for Linux is not going to be available as Apple willy only support Windows and Mac for the time being (and probably forever).

File Hosting Status Updates

2012-01-24T10:21:00.001+07:00

After Megaupload is taken down by the FBI, the rest of the file hosting services are just as anxious as the prior because they could be the next victim of this process.

Here's the status updates from the rest of the file hosting i got from Fiohnel Fiver on Google+:

MegaUpload - Closed.
FileServe - Closing does not sell premium.
FileJungle - Deleting files. Locked in the U.S.
UploadStation - Locked in the U.S.
FileSonic - The news is arbitrary (under FBI investigation).
VideoBB - Closed! would disappear soon.
Uploaded - Banned U.S. and the FBI went after the owners who are gone.
FilePost - Deleting all material (so will leave executables, pdfs, txts)
Videoz - closed and locked in the countries affiliated with the USA.
4shared - Deleting files with copyright and waits in line at the FBI.
MediaFire - Called to testify in the next 90 days and it will open doors pro FBI
Org torrent - could vanish with everything within 30 days "he is under criminal investigation"
Network Share mIRC - awaiting the decision of the case to continue or terminate Torrent everything.
Koshiki - operating 100% Japan will not join the SOPA / PIPA.
Shienko Box - 100% working china / korea will not join the SOPA / PIPA
ShareX BR - group UOL / BOL / iG say they will join the SOPA / PIPA

Japan, China and Korea have a say NO to the FBI and that even if laws are passed in the USA will not have any value within the sovereignty of their countries!

P/S: mediafire has start deleting copyright protected files. Only left is the personal files.

Back to Normal Activities

2012-01-24T08:07:00.000+07:00

It's Tuesday and it's now time to move on to normal activities after a long weekend and of course a Chinese New Year celebration yesterday where i spent the whole day with my wife visiting our relatives to greet them.

As always, Tuesday is one of my two bussiest day in a week, so i should get prepared for anything that could happened today. One positive thought i have is that i will be teaching my favorite courses, so there's nothing to worry about it.

For those who live in the Western area, enjoy your Chinese New Year celebration with your family

New Feature

2012-01-23T21:39:00.000+07:00

I have just added a new feature in Indonesian Linux Forum which is RSS feed that can be customized based on each account. This feature was requested by Walecha on his Twitter posts (here and here) to me and i find quite a nice mod called SmartFeed which is available for phpBB3 engine and it's quite customizable, suited for my need.

I downloaded the mod and upload it to the server and start installing it. The installation is very straightforward, but there are a lot of steps to be done in order to complete this process. Don't worry, everything is well written on the documentation file, so don't be lazy to read it.

After completing all the steps, the final step must be done manually, which is to refresh all the templates, stylesheets, and imagesets for the current theme. Basically this will delete all cache entries and force every users to get a copy of the latest file from the server again so that they will see the new feature.

This feature is very customizable and it's based on user preferences. Meaning that every users might choose their's preferences. For example, i might be interested to see only posts from Slackware section and not the rest. It's also possible to set the time intervals between updates or the display method of the RSS. Try it for yourself and let me know if you have any problems with this new feature

Let's just say this is my gift for this Chinese New Year event. I hope all of the members enjoy this feature and happy holiday

Absinthe for Windows Platform

2012-01-22T07:18:00.000+07:00

Oh my... less than 24 hours and Absinthe for Windows has been released by p0sixninja and the Chronic DevTeam and it's ready to make your dream come true: having an A5 devices jailbroken with untethered mode.

Using Absinthe is way easier than Redsn0w or any other jailbreaking tools, since you only need to plug the devices and hit the button once (yes, once). It will do it's magic automatically and when it's done, you can safely reboot your devices and got the untethered.

Small warning, taken from FreakGeeks

Important notice for those who are wishing to get the iPhone 4S unlock, don’t update your device to the latest iOS 5.0.1 because the iPhone DevTeam has announced that they got a exploit for the iPhone 4S unlock. So stay on the iOS 5.0 with the very first buggy baseband. The iOS 5.0.1 Absinthe also works on the iOS 5.0, that means you can jailbreak your device while staying at iOS 5.0.

Performing Untethered Jailbreak on Windows

2012-01-21T21:32:00.000+07:00

For Windows users that have been waiting for the untethered jailbreak on A5 devices, the wait is not over yet, since the developers only released Mac version of Absinthe, the tool that can jailbreak A5 devices (iPhone 4S and iPad 2).

Well, few hours later, the developer has released a CLI-only tool that also works for Windows, but it requires more technical skill than the GUI version. Head over to FreakGeeks for the tutorial on how to jailbreak using CLI in Windows.

Please always remind yourself to perform the backup before proceeding with this process

Untethered Jailbreak for A5 Devices

2012-01-21T08:07:00.000+07:00

Finally, the untethered jailbreak for A5 devices (iPhone 4S and iPad 2) is out after pod2g find his dream team (iOS hacker teams, the iPhone DevTeam and Chronic Dev Team) were joining in to get this jailbreak come true. The combination team released a new tool called Absinthe.

FreakGeeks has posted a short tutorial in order to have your iDevices jailbreaked along with a video tutorial just in case it's your first time jailbreaking an iDevice.

Along with this release, new version of Cydia is also released (1.1.4) with supports for the new A5 untethered jailbreak devices.

As always, first try is not always a perfect one, so FreakGeeks has mentioned some known problem when you try to perform this actions and how to fix it. The developers has released an updated version of Absinthe to fix this problem.

My suggestion is that for few days until it has calm down a bit and then start performing your upgrade. There are too many people who have waited for this jailbreak and they will cripple the servers in no time. Just update to iOS 5.0.1 first and then you can start your upgrade process later. Be sure to make a backup of your data first, because everything can go wrong and you can't blame the developers for that kind of problems.

Megaupload is Down

2012-01-20T20:17:00.000+07:00

One of the biggest file sharing, Megaupload has been taken down by FBI because they take financial advantage from illegal files that are being shared by their users and also from advertising (up to $175 million). Even though they have signed up DMCA agent with the US government, provide an abuse tool, and given rightsholders access, they are still taken down by the FBI.

This event doesn't stop like that. While most users that have Megaupload premium account can't do anything about it, Anonymous group launched a retaliation attack to several US sites, such as DoD and Universal Music Group. They will launch another attack on MPAA and also on White House, and probably many US sites in the future.

If Megaupload can be taken down so easy, what about the others? There are still a lot of file sharing services out there that have the same (or similar) business process with Megaupload, but they are still operating at this moment.

Online Again

2012-01-20T00:03:00.000+07:00

Some websites has came back to operational after they shut down their services for 24 hours due to anti-SOPA campaign. The campaign itself demonstrated what would happened if those websites are taken down due to intellectual or patent infringement just because one of their users post an information on that site.

It's really frightening to imagine what would happened about Internet's future if this bill is approved by the Congress? Innovation will start to decrease and Internet will not be the same as it is right now.

SOPA

2012-01-19T07:25:00.006+07:00

Many web sites are closing their operations due to SOPA that are now being reviewed by the US Congress, including Wordpress and Wikipedia. They are two of many web sites that disagrees with SOPA along with many other organizations around the world.

It seems that if this bill is passed, the US government will have an ultimate power to control many web sites and behave like China's great firewall. We will have to wait until the review process is done and see the results.

For those who wanted to prepare for the worst, please have a look on DeSopa (DNS Evasion to Stop Oppressive Policy in America) plugins for Firefox

Fedora Packages Announced

2012-01-18T06:32:00.000+07:00

Fedora users will soon be able to find Fedora packages easier as their engineer, Máirín Duffy has introduced Fedora Packages website, a place where you can find the source of a package, including all patches and RPM spec files which can be used to build the package. It also contains all the changelog has been made to the repository so users can track what has been changed in the latest build.

Another new website that was introduced along with Fedora Packages is Fedora Tagger, which can be used to add tags to packages. The developers hope that lots of packages will be tagged, thus making it easier for developers and users to find specific software.

Read the detailed information along with the official announcement and photos here.

Three Sessions in a Row

2012-01-17T21:39:00.000+07:00

Tuesday and Wednesday will be my busiest day in a week since i have three classes in a row and i will skip my lunch. Luckily, i have taught that classes before, so i don't really need to prepare too much a night before.

The only new class for me for this semester is the Information Technology Architecture in which i will discuss a variety of computer system architecture out there in the Internet.

New ISOs: pcBSD 9.0

2012-01-17T09:29:00.000+07:00

As promised, i finally finished downloading pcBSD 9.0 ISOs and i have put them on my ISO Server. You will not get the complete ISOs on the server, but i only downloaded the DVD and also full USB ISOs. The only reason for this is lack of space and also people like the full edition much better than the slim edition.

Enjoy the pcBSD 9.0 ISO and feel the power of FreeBSD on your desktop

ReFS, new File System from Microsoft

2012-01-17T07:39:00.000+07:00

Microsoft has introduced ReFS (Resilient File System), a new filesystem built on top of NTFS, which will be part of Windows Servers 8 that focuses on storage only.

Taken from TheVerge:

The main advantages of the new file system include the ability for Windows 8 to detect all forms of disk corruption, data striping support for performance, and an allocate on write model known as copy-on-write. Microsoft has used copy-on-write (COW) concepts in its SQL Server products and Volume Shadow Copy Service previously, enabling quick snapshots of large data sets.

ReFS cannot be used on removable media, nor can it be used to boot an operating system — it's simply for storage right now. Microsoft says the new file system will only be introduced as part of Windows Server 8, but Windows 8 client will be able to access and read ReFS volumes until it's fully supported in client operating systems in the future.

I wonder when will this filesystem be available on Linux kernel as well. In the past, Linux communities has managed to work with FAT32 and NTFS very well and they are now considered stable and mature enough to be used in production machines.

I believe Windows 8 will be a hot topic when it came out later. Not only they will use new filesystems, new design, but also new controversial policy of UEFI which will force vendors to lock their product to Windows product only, disabling users to install another operating system.

SE Android

2012-01-17T07:18:00.000+07:00

Once upon a time, we had SELinux, and now, we have SE Android, a security enhanced version of Google's Android operating system. It came from USA's NSA which deals with this kind of area.

By enabling SELinux functionality on Android, they hoped to isolate and prevent privilege escalation by applications, but it still can't help users against kernel vulnerabilities and misconfiguration of the security policy.

SEAndroid is only available as source and is built by cloning the Android Open Source Project (AOSP) git repository, and then applying the SE Android modifications from the project's git repository.

Please have a look on the presentation by Stephen Smalley of the NSA in 2011 Linux Security Summit for more detail.

Keeping Plugins Up To Date

2012-01-16T22:47:00.000+07:00

Plugins in browser is like a double-edged sword. In other side, it can enhance your browser's capabilities, but in the other hand, it could be a gateway to attack your system. The only solution is to use the latest version and stay up to date.

Mozilla Firefox has been quite nice to have a Plugin Check service which allows us to check our plugins. All you need is to visit the site and it will list all the plugins you have on your system. Another service that you can use and it's very easy to use is Browser Check from Qualys. Both are working in Linux platform as well (and probably Mac OS X too, but i don't have Mac-based machine, so i will leave it to anyone who can confirm this).

New ISOs: FreeBSD 9.0

2012-01-16T07:37:00.000+07:00

FreeBSD 9.0 has been released and last night, i started to download the ISOs via torrent and they are now completed and has been placed in the proper place in our ISO Server. Please enjoy the ISO collection if you are a FreeBSD users.

You might want to see the release announcement to see what changes has been included in this release. Please note that i only provide the MD5SUM checksum, which i think is enough. No one would tamper the ISOs that big just to inject small malicious code. It's not worthed i guess.

My next target will be PC-BSD 9.0, which is also based on FreeBSD 9.0. I hope to complete this download by tonight and it will be ready by tomorrow. For now, please enjoy the FreeBSD 9.0

Arrived in Jogja

2012-01-15T19:10:00.000+07:00

I have just arrived in Jogja few hours ago after i spent three days in Jakarta with my wife and my mother-in-law visiting my first nephew (my sister's first son). We took Lion Air airways for this trip and it was my first Lion Air flight without any delays. Just because there were a group got late, our flight got postponed for a few minutes.

The trip to Jogja was quite nice, except that there were some bumps due to cloudy weather. The pilot said that we might be redirected to Surabaya due to bad weather in Jogja, but he would make an approach first. Finally, the weather was cooperating and we could land in Jogja safely.

It's my last day of holiday and as of tomorrow, i will start working again and with a new semester (and also new students), i guess it would be a perfect timing to have a fresh start again.

Power Consumption Fixes in Linux Kernel 3.3

2012-01-14T06:50:00.000+07:00

Since 2011, Linux users has been suffering from power consumption in most Linux distribution (most likely Ubuntu-based) that were released using previous version of Linux Kernel prior to Linux Kernel 3.2. This problem has been spotted by Michael Larabel from Phoronix and it was traced down to ASPM bad handling on Linux that are not the same as in Windows.

Since then, so many efforts has been spent on fixing this problem, and Matthew Garrett is one of the developer who is working on this problem. He finished the rework of the ASPM code, but then the merge window for Linux Kernel 3.2 had been closed by Linus and he was strict about it. So the work must be postponed for the next release and here we are. Since the merge window for Linux Kernel 3.3 is now open, Jesse Barnes had asked Linus to pull his work which contain the ASPM reworked code by Matthew.

Since many Linux distribution that will be released this year will be based on Linux Kernel 3.2 (Ubuntu and Fedora for example), this feature will not be included unless the developer back-ported this patch into their kernel stock.

It's good to know that this problem is finally resolved and only a matter of time before the kernel gets released by Linus and users may enjoy the benefit of this work.

Linux Mint 12 KDE RC

2012-01-13T06:01:00.014+07:00

Linux Mint 12 was a phenomenal release and the lead developer wanted to continue his work by working on KDE-based Linux Mint release. He has just released the Release Candidate version for the upcoming Linux Mint 12 KDE which is based on Kubuntu 11.10, but with the latest KDE version available, KDE 4.7.4.

This version comes as a Hybrid ISO, which means you can simply use the "dd" command or a graphical frontend to make a bootable USB stick with no efforts which acts exactly like a liveDVD.

There are some known issues on this release which are mentioned on the release notes. Please read them to know the solution for those problems.

Linux Kernel 3.2.1

2012-01-13T05:36:00.002+07:00

If you are having problems with USB-based flash drives after upgrading to Linux Kernel 3.2, then you are not alone. My workstation would ended up kernel panic when i insterted my flash drive, works with it, and then unmount it.

There's a new stable kernel released by Greg which happened to have a lot of usb fixes. Hopefully this update works like charm to fix my problem (and yours). Strange thing is that it didn't happen on my desktop. All flash drives are working just fine.

PHP 5.3.9 Released

2012-01-12T07:04:00.001+07:00

PHP 5.3.9 is now released by PHP Team and it includes security fixes and other numerous changes to improve the overal quality of PHP. There are two security enhancements in PHP 5.3.9:

Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885)
Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566)

For those who wanted to stay up to date with security update, please update to this version as soon as possible. For those who wanted to try the major update will have to wait until PHP 5.4 comes out later on.