News archive 2005 - Koos van den Hout

I will marry Mirjam on 13 June 2006!

Boxing day walk with camera: snow in the backyard, Park de Watertoren, Park de Watertoren, Apartment buildings, christmas decorations and more christmas decorations.

More cat pictures: all three having breakfast, Vlekkie looking out the window.

Chasing cats with the camera: Vlekkie in a grumpy mood, Moppie after drinking and Vlekkie on the stairs.

Nice picture by Thomas Schlijper.

Wardriving results (according to WiGLE) Sunday - Wednesday: 1778 networks seen, 151 new with GPS. Some days I had detours, mostly just the normal route work/home. There are predictable patterns in wardriving in the city: neighbourhoods with modern or old owned houses will have a high density of wireless networks, neighbourhoods with mostly rental houses will have a lower density.

I wrote a bit about how I configure OpenSSH to make it less susceptible to break-in via password guessing.

Minor updates to the Generating Alcatel Speedtouch graphs micro-howto. Some day I should redo it in docbook, just like newer howtos.

I am reading Using Open Source Web Software with Windows. Yes, I am looking at it from a unix/linux perspective. It focuses mainly on setting up your own 'wamp' server (windows, apache, mysql, php). Having your own testing server that acts like your live webhost is a good idea.

Surveillance state? Or is it just 'protecting the children'? Students Ride Orwell Express the Travado IBUS technology, which records the students riding each bus, where the buses go, as well as recording video.

Redid the design of my webcam page. May look almost the same, but it's a lot cleaner in html. Fun thing is people still visit the site daily (40-50 visits a day is quite normal). Lots of webcam pages still link to it.

Today I tried to actually install mysql and make it do something. I had a negative opinion about mysql before ("not a real database" and associated things).. and it got even more negative trying to make it actually do something useful. This was mysql 4.1 (default stable version with centos). The help did not match the actual database version (ok, this is more a package problem than a mysql problem probably) and what I think are normal commands for user management aren't supported. Creating users is a side effect of granting them rights (like wtf?) and user@localhost has different rights from user@% (the rest of the hosts, where you can also use other hostsmasks, including those depending on dns.. brrr!). Time to get back to real databases.

Updated the home server page a bit with the latest bits of history (well, a few years of backlog to be precise). It will be updated soonish as I want /home on newer disks *and* I'd like to move away from reiserfs.

Only minor detours wardriving between other busy stuff... results for Wednesday and Thursday: 1497 networks seen, 74 new with GPS.

Wardriving some small streets in Utrecht, using several maps to find the last uncharted street.. Tuesday: 643 networks seen, 40 new with GPS. And new networks even keep popping up on the standard route between home and work.

Learned today: To see if write caching is active on a Sun A1000 raid array, use the command raidutil -c unit -V lun. In the answer is WCE for write cache enabled.

WiGLE did a new site design. Looks really great! My wardriving results for Tuesday-Monday (where Wednesday and Friday were a purpose detours through somewhat yuppie parts of Utrecht): 3609 networks seen, 633 new networks with GPS locations.

Picture I made: sunrise this morning.

Doing the rounds, a really great story about a guy stopping a filesharer hogging the wireless network in a hotel. Also makes you think about (lack of) wireless network security and/or certain operating systems more than willing to share information about you.

WiGLE is catching up again, so I can post results quite fast. Saturday - Monday: 1954 networks seen, 278 new with GPS. Current WiGLE stats: 11447 Total New Discovered Networks with GPS, 691 Networks This Month with GPS.

The Register has an article Who owns your Wikipedia bio? looking at the problems with the quality of articles in Wikipedia, especially when it comes to pages about public or less-public persons. Jason Scott (the same guy from the BBS documentary) also did a good article The Great Failure of Wikipedia where he explains how Wikipedia will be a failure in the long run. Especially with Wikipedia being mentioned more and more, people that like to cause mischief will be able to do more damage. And vandals are easy to see (browse the edit history of the user page of Linuxbeak for samples of when someone is very interested in keeping a page correct or at least with his version of facts) but minor changes that look legitimate but are in fact incorrect can cause enormous damages (a few cases have been very visible recently).

WiGLE is slow in processing wardrive uploads at the moment, so results lag a few days. Up until Friday: 2337 networks seen, 412 new with GPS.

RIAA Bans Telling Friends About Songs

The Recording Industry Association of America announced Tuesday that it will be taking legal action against anyone discovered telling friends, acquaintances, or associates about new songs, artists, or albums.

No more enthusiast reviews, before you know it you have to explain them to the police.

In August 2003 I already ranted about unhelpful anti virus software replying to the faked From: of virusses. It seems like some anti virus software has slowly learned that this is wrong. One piece of software is still doing a special type of this bad behaviour: Norman Virus Control. Today, more than 2 years later, I still get mail with the announcement: Norman Virus Control heeft de oorspronkelijke e-mail verwijderd omdat deze door het virus is geonfecteerd W32/Sober.AA@mm (in Dutch, wrong grammar is their original). Which translates to something like Norman Virus Control removed the original e-mail because of a virus... And what is the info to me, besides increasing my annoyance at Norman? GRRRRRRR! I will continue to tell anyone who mentions Norman Virus Control that it is BAD software that is VERY ANNOYING and shoud be removed immidiately and replaced by less annoying antivirus software (or upgrade your OS to something that is better by design).

Naar aanleiding van de vragen die ik kreeg op de HCC dagen over draadloze netwerken heb ik eens een document opgezet, Draadloos netwerk uitleg en installatie waarin ik allerlei dingen over draadloze netwerken op een rijtje wil hebben voor beginnende gebruikers.

In wardriving for the last week and a half: 4536 total networks seen, 434 new to WiGLE with GPS.

Kudos to the PLD Rescue CD that helped me recover a non-booting Debian server easy (saturday morning, half an hour before the network at our booth at the computer fair had to work!).

I finally got around to building a script around the archives I kept of webcam.idefix.net when it was still at my previous house. Now you can see the view from any date that was archived (there is a small hole in the archive) at the Webcam Beneluxlaan Utrecht archive.

HCC dagen 2005 (yes, it's that time of year again). As always, the HCC dagen PCgg webcam is online (link removed as it is now back offline).
Last image:

From the it might be obvious, but we'll spell it out for you anyway department: the Disclaimer for Nelson Rocks Preserve. More nature areas should have a sign like this.

This weekend I got around to watching the first bits of the BBS documentary (see, it only took 4 months to find time for it). Lots of wonderful stuff to remember from the past, such as getting to the point of buying a faster modem (from 2400 to 14k4! the enormous speed!). As the dvdset itself recommends not watching all of it at once, I'm taking my time and using the memory function of the dvd player. And in the normal wardriving results news: Friday and Saturday: 1872 networks seen, 319 new to WiGLE with gps. Current ranking: 10266 discovered networks with GPS (66th), 3093 networks this month with GPS (18th, there are a lot of very active people at wigle)

Some evenings in Amsterdam this week, a day off from work so I did some purpose warbiking and a trainride to 'previously uncharted territories' gave some remarkable wardriving results: 4183 networks seen, 1251 new to WiGLE with GPS coordinates. New Rikaline rs232 cable still working without a flaw.

Good results from the new cable, and a bit of extra detours today: 1232 networks seen, 437 new to WiGLE.

Finally, the RS-232 cable for the GPS unit arrived Friday. Good, because the usb driver started extra weird behaviour: complete hangs of serial-over-usb communication needing a reboot. I visited a 'new' part of Utrecht a few times last week and visited the center of the city, giving me a load of new networks (older houses which are expensive to buy seem to have a load of wireless networks). Total results Tue-Fri: 2457 networks seen, 501 new with GPS, according to (you guessed it right!) WiGLE. Wardrivemap.nl for Utrecht starts to look different too, with over 10000 networks.

I recorded a bit of audio for Chub Creek which got used in Chub Creek episode 33. Check for the Dutch language lesson. Including my very own theme song.

In wardriving, bike trips through parts of the city have a much higher yield than driving long distances by car. Results at WiGLE for Friday and Monday: 1571 networks seen, 384 new with GPS location.

Good article in Wired: The Cover-Up Is the Crime, about the rootkit installed by a Sony audio CD with copy protection. Sony tries to focus on the file hiding bit with making fixes available, but as Wired (and others) write: Sony is breaking into your computer, tresspassing. Also a good comment in Freedom to Tinker, and seen in The Register: Removing Sony's CD 'rootkit' kills Windows.

Mention a certain script often enough and it will have to strike. It works! Results for 2 and 3 November: 1317 networks seen, 124 new to WiGLE, all logged with GPS location.

No detour this morning, still 10 networks new (all with GPS) to WiGLE, 185 networks in total. Wireless networks keep popping up. With the start of a new month, this led to an interesting screenshot of the WiGLE monthstats, where I am 'ahead' of the normal numbers 1 and 2 at WiGLE. This lasted about 10 minutes ;) This evening I took a detour through previously 'uncharted' bits of downtown Utrecht, 174 new networks with GPS, 175 new total, 630 networks seen. The scripts still watch the gps software for any sign of hickups, but still haven't had to strike yet.

I hacked together a script that keeps a close eye on the gpsd status and restarts it as soon as any sign is shown of the gps losing usb connectivity. Sofar, this script watching the whole deal seems to help, it hasn't had to act yet. One minor detour and one major detour today: 973 networks total, 158 new to WiGLE, all of those with gps! Since I'm not going out wardriving this evening, this closes my WiGLE stats for October at 4594 new networks with GPS found. My all-time WiGLE rank is now at 101, so next is the top 100... during the month I got pushed up to 16th rank for networks this month. The image is an animated gif of the development in networks found this October (not only by me!) according to wardrivemap.nl.

Mixed wardriving results, I keep getting problems with the communications with the gps stopping. I got so desperate I even tested it using Windows.. where the same failure happens. It is something related to usb (either the cable doing 'hickup' or some other part of the chain). So I ordered the old-fashioned RS232 cable online. Networks seen in that week, according to WiGLE: 3418 total, 444 new in all, 255 new with gps (the difference between the last 2 is what annoys me).

Wardriving Wednesday was normal home/work trip and to the same spot in Amsterdam as two weeks ago. Still, 136 new networks with GPS (1069 total). Thursday I visited a friend by bike, giving me 428 new networks with GPS and 1255 total.

First time the wardriving setup kept working in the city center! 121 new networks with GPS found today.

Wardrive results: Some detours on Friday, 485 networks total, 54 new networks. Saturday/Sunday, driving over highways to relatives in the southern part of the Netherlands and back, 510 networks total, 228 new networks. Weird failure in the locations again: all networks on the last leg of the drive were logged in the same spot. Monday morning some experiments in software versions resulting in no results at all, Monday afternoon I had to be in the city after work and this time the stuff kept running for a bit longer than on previous attempts, 302 networks total, 41 new. Right after checking my laptop in the city center somehow the software failed.

I was to the city center yesterday evening, and again the communication between kismet and gpsd failed, just like a week ago. WiGLE results: new networks with GPS: 113, new networks in total: 310, total networks seen: 950. I'm trying a newer version of gpsd, which sofar does ok in testing.

Wednesday saw some interesting wardriving results: 270 new networks with some major detours to/from work. And 47 new networks (30 one way and 17 the other) driving a bit of road that we also drove three weeks ago. The wireless networks keep popping up like mushrooms!

It seems to be customary to post a picture of your wardriving vehicle, so a picture of mine was in order (also trying a new camera). Tuesday: 327 networks seen, 123 new with gps (WiGLE stats).

Wardriving Monday: minor detours from the normal commute, trying white spots on the map. Quite effective: 464 networks seen, 106 new with gps, 107 new total (according to WiGLE).

Wardriving stats for Friday (just the commute)/Saturday (purpose wardrive through an uncharted bit of the city)/Sunday(60 kilometers of biking): 2256 networks seen, 935 new with gps (951 new total) at WiGLE.

I was in Amsterdam yesterday evening (club meet of the Dutch lockpicking club Toool) and took the laptop and gps for a wardrive. New networks: 134. Most new networks were in the little streets I crossed looking for a parking spot! Biking back today via a detour through the city did not give very good results as the gps unit somehow failed in the middle of the city (in all the small streets gps signals can have a problem) but didn't start to work again. New networks: 275 with gps, 483 total.

Did some wardriving by train/bus (or rather, had to go some places with train and bus and took the laptop and gps with me). It made me feel a bit awkward, sitting there with a big bag on my shoulder with some wires sticking out (the cable to the GPS unit). After reading about someone who got arrested in London for having technical stuff in his backpack and acting like a techie, I am sure I won't do this in London! Total 104 new networks, I guess those paths get scanned regularly.

Zondag naar het Spoorwegmuseum in Utrecht geweest. Drie uur tijd was eigenlijk weinig om alles te bekijken (zeker voor een treinengek ;)).

Started a wardrive by bike Saturday evening, and at the last part it started to rain hard so I got soaking wet. I did find 667 new networks. It is funny to see that I biked through areas were one or two networks were logged before (say, about a year ago) and I log dozens of them in the same area.

I discovered gpsmap, part of Kismet. Using gpsmap it is possible to draw nice maps of wardriving results (given a lot of parameter tweaking). Results: 2 tracks made on 27 September and All tracks made in September sofar. The idea is that gpsmap can use images from mapsources such as terraserver for source, but none of those sources decided to cooperate today.

Ok, some compiling of Linux 2.4.31, pcmcia-cs 3.2.8 and orinoco 0.13e+patch later, it's running now, with working usbserial and wireless scanning. Updated the Dell Latitude C640 laptop and Linux page with the latest info.

Some more wardriving actions: yesterday morning normal home to work: 14 new networks. Yesterday afternoon after work, a different route through parts of Utrecht Wilhelminapark: 116 new networks (according to WiGLE which is what I use for counting, Wardrivemap NL has better maps to find unexplored areas of the city but no personal stats).

I ordered a Rikaline 6010-X5 gps receiver from GPS Plaza. This GPS receiver is advertised as having a faster fix and a much better receiver. Well, first tests showed very good results: fix within 5 minutes of unpacking and laying the receiver in the windowsill. The downside is that it uses a pl2303 usbserial chip to talk to my laptop and usbserial likes to go 'Oops' on serial closes on 2.4.26.

Looking at the Wigle stats page I found a wardriver with very high stats (logged 51084 new networks with gps this month). A google search gave me a link to his website, aptly named Chronicles of a wardriver. That is one dedicated wardriver, who goes out almost daily by car in Los Angeles (so he logs the fuel prices too).

Uit nl.comp.os.linux.netwerken.. iemand die 'even' een hosting bedrijf wil beginnen om miljonair te worden en nog even wat tips nodig heeft hoe je zoiets eigenlijk moet beheren. Google groups: Toegang tot je server aan hosting gebruikers. Sterkte ermee! ;)

First time for me: A real wardrive as in finding access-points with the car. Mirjam was driving and found the gps antenna on the roof funny. Score: 247 networks found, one missing gps fix.

More updates to The Virtual Bookcase, separating the amazon.com reviews from The Virtual Bookcase reviews, and adding a lot of amazon.com info in the process. Example: Reviews and details of 'Adventures of Riley: Mission to Madagascar' and Amazon.com info for 'Adventures of Riley: Mission to Madagascar'.

Found this article Finns urge better Wi-Fi security after bank break-in where a bank computer was broken into via an open wi-fi access point (and the original person breaking in traced via the mac address of his wi-fi card). Source: WifiNetNews article.

And Netgear support comes with the bright suggestion of using one of the Windows based tftp servers they suggest. A few days delay there..

Finally got the Netgear FSM726s working better with multiple vlans when the firmware upgrade succeeded (now running 2.6.2). The (windows based) tftpd they suggest works better with the switch (guess the tftp client in there is not too brilliant). Now our vlans work without packets ending up on the wrong vlan interface of our router. And I can select a management vlan, and not have the default selection of 'all' (brrrr). It's still not perfect, an interface to a linux box in dot1q mode isn't functioning yet for all vlans (but it does work with one vlan native and one 'tagged'.. which isn't too great a setup).

Sun is entering the 64-bit x86 server market and they wanted to run some pretty bold ads with some not-so-kind words about the next competitor in the x86 server market.

The continuing story of the Netgear switch... No luck on updating the firmware on the Netgear FSM726s. Boot from tftp hangs. Aaargh. Logged a support call with Netgear.

Borrowed a Bol (Dutch on-line bookstore) url from irc, and was able to shop in the same session and adjust the content of the shopping cart upwards. Someone else borrowed the same url and got his name attached to the session. Lousy security for an on-line store...

First day back at work. Some stuff broke in my absence, so I started submitting Sun service requests. After that I started debugging a weird problem with a Netgear FSM726S managed switch. Some packets seem to end up on the wrong vlan (probably due to the router having the same ethernet address on all vlans). Newer firmware should fix this (why they deliver them with ancient firmware is another question), but the only way to upload firmware is via tftp, via the network, at boot-time, which clashed with the current config (since we do use vlans a lot). Lots of short network outages, and a real broadcast storm, but no success upgrading the firmware.

And our luggage got delivered too (late yesterday evening). The baggage-handling company at Schiphol seemed to think it was a regular issue with all airlines that luggage got delayed. We thought it was a result of our very short transfer at Toronto Pearson airport: run from airplane, bus to infield terminal, board other airplane, less than 15 minutes left before take-off. Luggage handling at Schiphol seems to like to use the same cryptic codes as everything else in airtraffic, the note attached to the luggage says: CT01 GY01 .CT02 GN08 .CT03 GN29 .CT04 GN64 .DD 09sep.

I'm back from a camper holiday in Canada. It was great. Pictures and reports to follow, but first we need our suitcases, because Air Canada did not bring those to Schiphol today.

Looking for some details about a train I found www.phlex.net, the personal site of Dennis Koster. Dennis seems to be a long-time trainspotter who has been photographing trains for years. A lot of his pictures would not look bad in railway magazines.

Strong words from Paul Thurrott (a writer who seems to be quite pro-windows) in his reaction to the IE 7 beta versions still not fixing CSS and other web-standards compliance bugs: My advice is simple: Boycott IE. It's a cancer on the Web that must be stopped. IE isn't secure and isn't standards-compliant, which makes it unworkable both for end users and Web content creators.. Source: Slashdot: Windows Guru Calls For IE7 Boycott

PC-Crash sorgte für Megastau (PC-crashed caused major traffic jam) A crashed PC in the traffic light control system for the Elbe tunnel in Hamburg, Germany kept 2 (out of 4) tunnels closed for hours which led to long traffic jams. Running windows? Probably, the firm delivering the control software is a windows shop. Found through comp.risks 23.95

I am back from WhatTheHack. It was great, saw a lot of people, attended interesting workshops, gave a few lockpicking workshops, competed in the Dutch Open 2005 lockpicking championships (ok, I never got close to the finals, but it was fun to be there). I met people from the German lockpicking club (Sportsfreunde der Sperrtechnik Deutschland e.V.) which was real nice. Best feature was EventPhone who managed to set up a complete network of DECT coverage on the site.

Just after my rant about parcel delivery I got a surprise as the first delivery of my amazon package (with tax to be payed) happened in the evening when I was at home. Now to find time to watch the BBS documentary.

Picked up a package through GLS (formerly Nederlandse Pakket Dienst) today. I keep wondering why those package delivery companies have depots somewhere on some outer industrial area. When you're gone during the day (working, for example) you'll have to find their depot (in this case only open during daytime). Hard or impossible to reach by anything else than a car. Oh, I did meet the delivery van the first try, but I could only pay in cash for the package, not using pin. This does make TPG post look reasonable with their post offices with not completely working-person-friendly opening hours. At least the post office is within the same part of town (for most people..).

Have you already done the Which SF/Fantasy character are you? test?. I like the response from Peter David to his results.

Nice article in populair science: Be your own wireless hotspot. Using a high-speed cellular data connection for Internet access and a solar panel for power. [link broken] Blog entry by Mike Outmesguine (the author of the article) on thewirelessweblog. Found via Wifinetnews article.

After more than 6 (yes. six.) years, microsoft has fixed the begin bug. A bug with seniority, and a long-standing example of how interested Microsoft was in fixing bugs.

The Coffeecam at work is back on-line. The harddisk in the machine died (a 1995 harddisk that had been in use most of the years) last Friday. Re-installing the OS and getting stuff running again (especially the philips webcam driver) was a bit of work as the stock debian is compiled with gcc3 (tsk! the README says to use 2.95), the debian kernel source seemed to be inflicted with some gcc3-isms (tsk! again) and the philips webcam driver is discontinued (I understand his reasons, but the other choice in webcam is 'no webcam at all'). But, I dug up a somewhat compatible kernel, gcc-2.95, waited for the kernel to actually compile (takes quite a while on hardware this old), a binary of the webcam decompressor and now it's back. The one and only Original coffeecam (The Trojan Room Coffee Machine) is now rackmounted at Spiegel online.

I got surprised by rain biking home and found a spot for shelter and taking pictures. A jogger in heavy rain, rain bouncing off a bus, the streets flooding.

My ADSL modem started to show very regular connection drops after what seemed to be an upgrade on the KPN side last Thursday morning. Calling the helpdesk of KPN made me wait more than ten minutes for a live person who got me through a number of standard questions and told me the script was at the point check the splitter (at least he was honest enough to tell me about the script). Without the splitter the problem remained. I also mailed the xs4all helpdesk about it who gave about the same set of suggestions including trying to upgrade the modem firmware. I noted later today that the drops were related to my speedtouchgraph script. So this evening I upgraded the firmware, changed the script to the new commands and disabled the bit where it asks the dslam for its statistics (it wasn't willing to give them anyway), now it's waiting to see if the adsl modem is more stable.

My First Javascript (yes, I never did Javascript until now). Using that famous Google Maps Api I built something that converts DNS LOC records to satellite maps. You can see where I work. I cursed a lot about signed/unsigned large numbers in PHP in the process.

Cool use of the new Google maps api and backstage.bbc.co.uk : gmaptrack central London cameras. Source: Wired News: Map hacks on Crack.

One of my pet peeves: abusing excel as a database. Just because it looks like a stack of cards doesn't mean it is a good idea to use it as such. Maybe a European version of excel would be nice: rip out all this calculating stuff almost nobody uses, just leave the sheets with nice squares. Found in relation: Rory Blyth cartoon about excel abuse and the official word from microsoft After all, Excel is not a database management system. It is spreadsheet software, and it stores units of information in rows and columns of cells, called worksheets..

Got a curry from Jag's Curry to Carry yesterday for dinner. After 60 kilometers of bicycling we weren't that interested in cooking.. The curry tasted very nice. They have a real good concept: for 10 euros you get a selection of dishes, with 2 choices in main dish.

I rewrote the Using Dynamic DNS for your dynamic IP micro-howto using docbook (the previous version was in linuxdoc format). Things look better and I get more flexibility. I had a good look at Making your DocBook/XML HTML output not suck to see how to incorporate a stylesheet and custom stuff.

Went to the Utrecht PGP keysigning party 2005 today. Had quite a number of cases of putting a face to an e-mail address (and associated things like open-source projects). Now the interesting thing is checking the pgp key statistics for my key 0xF0D7C263.

You may be a child of the eighties if . . . . .. contains too many things that sound familiair. A Dutch version might even be scarier.

Found the MaxiMog, a project by Applied Minds. A vehicle with very nice specs (and probably a very nice pricetag). This vehicle reminds me a lot of the expedition vehicle described in the book The Lost World by Michael Crichton (and shown in the the movie The Lost World). Source: Wired news article about Applied minds.

Some further tests show that the gps still isn't too briljant in getting a fix when only part of the sky is visible (what I think is described in brochures as 'canyon view'). That does not help with testing at home where I put the antenna on some windowsil. Maybe time to find a newer gps (usb or serial) for warbiking and start using this one for a gps time reference.

I added a NiCd battery to my gpskit hoping that would improve its performance and shorten the startup time. In a few tests sofar (after a night charging the battery and leaving the antenna out so it could receive full almanac data) it looks like things are working better now. Biking home to work with the warbike setup gave me locations for all access points. New NiCd batteries of the right specs were not available, but an old 386sx mainboard was kind enough to donate one.

On a whim I decided to follow this one..

It linked to http://www.login-paypal-world.com
Interesting reply from whois:

No match for "LOGIN-PAYPAL-WORLD.COM".

But the gtld nameservers are more helpful:

login-paypal-world.com name server pdomns2.msn.com.
login-paypal-world.com name server pdomns1.msn.com.

And it points at:

www.login-paypal-world.com has address 65.54.132.254

Which is hosted by.. microsoft.

OrgName: Microsoft Corp
OrgID: MSFT
Address: One Microsoft Way
City: Redmond
StateProv: WA
PostalCode: 98052
Country: US

NetRange: 65.52.0.0 - 65.55.255.255
CIDR: 65.52.0.0/14
NetName: MICROSOFT-1BLK
NetHandle: NET-65-52-0-0-1
Parent: NET-65-0-0-0-0
NetType: Direct Assignment

Yeah, abuse@microsoft.com. I'd like a usable answer to my previous queries.

Anyway. Asking for it:

$ lynx -head -dump http://www.login-paypal-world.com
HTTP/1.1 302 Found
Connection: close
Date: Fri, 10 Jun 2005 16:30:50 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
X-AspNet-Version: 1.1.4322
Location: http://213.136.105.66/www.paypal.com/account/index.html
Cache-Control: private
Expires: Sat, 01 Jan 2000 08:00:00 GMT
Content-Type: text/html

Later the forward stopped, but the page at the redirect is still up.

A nice redirect to 213.136.105.66 where they have built a complete mockup
of the paypal login page, with all the right buttons pointing at the right
places at paypal.

213.136.105.66 is at afrinic..

inetnum: 213.136.105.0 - 213.136.105.255
netname: AVISONET
descr: ISP Cote d'Ivoire
country: CI
admin-c: ZJ59-AFRINIC
tech-c: AE496-AFRINIC
status: ASSIGNED PA

Some ISP in Cote d' Ivoire (sometimes home to a certain kind of people
from Nigeria with interesting financial propositions)

$ lynx -head -dump http://213.136.105.66/www.paypal.com/account/index.html
HTTP/1.0 200 OK
Date: Fri, 10 Jun 2005 17:03:20 GMT
Server: Apache
Last-Modified: Thu, 05 Aug 2004 16:15:48 GMT
ETag: "341d4-29f6-41125d34"
Accept-Ranges: bytes
Content-Length: 10742
Content-Type: text/html
Age: 17017

The submit is to

http://213.136.105.66/www.paypal.com/account/loginsubmit.php
which redirects to

http://213.136.105.66/www.paypal.com/account/loginsubmit.htm

This page looks like an 'error in your login data' page and asks for the
same login/password again. Funny is that they forgot to copy a pixel from
paypal or forgot to point at the right one, giving 404 errors and a somewhat
distorted page (in firefox).

$ lynx -head -dump http://213.136.105.66/en_US/i/scr/pixel.gif
HTTP/1.0 404 Not Found
Date: Fri, 10 Jun 2005 21:53:46 GMT
Server: Apache
Content-Type: text/html; charset=iso-8859-1

The page submits the data to

http://213.136.105.66/www.paypal.com/account/processing.php

Which redirects to (this is a pattern..)

http://213.136.105.66/www.paypal.com/account/processing.htm

Which gives an advert for a new 'immediate Paypal payment' option.

Another 'continue' button, which gets (using an 'onload' form)

http://213.136.105.66/www.paypal.com/account/agreement.htm?Continue=Continue

with a bit about updated terms and conditions (loads of legalese. I did not
check for 'you just gave us access to all your paypal funds, thank you
very much' hidden in there).

And next comes up a page
http://213.136.105.66/www.paypal.com/account/pp.htm?Submit=Submit

(hey, I never clicked on one of those 'yes, I agree'
buttons..) asking for every last detail such as social security number,
mother's maiden name, drivers license, credit card number and pin for the
credit card. They do their identity theft seriously!

Oops, forgot to fill in the form. Wow, there is a real check for a CC number
in it (16 digits) and other checks for pin lenght, the works. I was not
in the mood to find nonsense values for those. So I asked for the handler at
http://213.136.105.66/www.paypal.com/account/login.php

which redirected to

http://213.136.105.66/www.paypal.com/account/Complete.htm

which says...

"Your information submitted successfully! Your information will be
reviewed shortly."

And a link to 'paypal home' at the real http://www.paypal.com/

Makes me wonder where all that information is sent..

the form name used is 'mailbomber' and a google search for 'paypal' and
'mailbomber' shows that this is a well-known script for paypal account
phishing.

Google sightseeing has links to great finds on the sattelite images at google maps. The one I find the nicest to see is Cheyenne Mountain Operations Center, aka Norad (what they call themselves). I remember Norad from the movie Wargames.

New kismet log views online. Last friday biking house - work and back (in the rain). Slight variations in the route I took (uh oh, signs of wardriving addiction showing up) to find new ones. Funny thing is I start to recognize the kind of buildings that will have lots of access points: student houses and new apartment buildings.

Had another go at finding the ideal combination of drivers and patches for my laptop and wireless network scanning, and got it fixed. Documented it right away, getting the orinoco 0.13e drivers to work on the dell latitude c640 laptop.

Warbiking home yesterday evening. Had to fiddle a lot with the gps unit to make it find itself. On the way home kismet discovered 191 wireless networks (the other 18 on that list are clients seeking their network) and managed to map the location of 173 of them. I fiddled a bit with waypoints in gpsdrive (seems it can't display 173 waypoints at the same time) and managed to create maps of the access-points found. Map 1, Map 2, Map 3.

Interesting people in England: Three hurt in cheese rolling race Three people have been hurt chasing a giant cheese down a steep slope in Gloucestershire. .. interesting hobby (source: BBC news)

Some new pictures in my collection. Walking through park Frankendael in Amsterdam, cat oddness, more cat oddness, other cat (Tender) oddness) and interesting cloud formations and more interesting clouds.

A nice article (ok, it's ment to be in humor, but it makes valid points) on Windows is rapidly approaching desktop usability. There are points that sound like articles of windows users reviewing Linux (hardware support problems), but there is also the valid point of the ease of adding software through package management compared to the hoops the windows user has to jump through.

Een serieus probleem: lokale supermarkten hebben regelmatig geen Grolsch beugels in de winkel. Een zwaar tekort! Diverse supermarkten waar ik langskom getest.

Yes, Windows can be educated to accept the onboard clock in UTC. It's just not documented (duh). But Casper Dik has the answer: how to set solaris and windows to have the onboard rtc in UTC.

Go BBC! The BBC has made lots of RSS feeds available and encourages people to experiment with them and build new stuff in the backstage.bbc.co.uk project. Nice stuff happening like a display of the BBC travel feeds in a simple format. The Travel Feeds are especially nice as they are in tpeg DTD [xml] which is a dedicated xml for travel information, allowing lots of interesting processing.

Mentioning phpbb on my homepage makes for interesting logentries. A perl worm searching for vulnerable phpbb installs was trying to install an irc bot talking to eu.undernet.org

For fun, I tried the iRiver ifp-795 on a Solaris machine. It gets recognized, it mounts nicely and I can even see long filenames. That is very standard USB storage.

My wireless network was failing me this evening and I checked with kismet for other networks. Without getting up from my seat (is this warsitting?) I found 4 networks, and I reconfigured my access-point to pick a quiet channel.

The iRiver ifp-795 arrived. It has everything you would expect from an mp3 player and some more (including options like timed radio recordings). By default, it only supports its own protocol for filetransfer (but there are linux drivers for this ifp protocol). I installed the UMS (USB mass storage) version of the latest firmware. I can now mount it using the usb-storage driver, so I can rsync stuff to it. The user-interface takes a bit getting used to, but the basic functions (play music!) are simple. It can also record from line-in or built-in microphone, I will experiment with that. I filled it with nice podcasts, and I listen to them.

Gadgetry delayed: Ordered Tuesday, sent Tuesday, first delivery attempt Wednesday, second attempt will be Thursday, so I can pick it up (but not too early, and with very 1950s opening hours) at the post office Friday. So much for that 24 hour economy.

Mashup at the Ritz .. mashup (mix) that made me laugh. Walk this way by Aerosmith/Run DMC combined with some Slim Shady lyrics. Made me laugh. Do follow the terms of use.

Door de identificatie plicht in Nederland krijgen gemiddeld 177 mensen per dag een bekeuring. Bron: Bits Of Freedom nieuwsbrief nr 3.9 (als ze de nieuwsbrief on-line zetten ;)). Ook in dit verband: Meldpunt misbruik identificatieplicht.

Bad advertising ideas: You know how there are lots of cars driving around with no sign saying you can't put advertising banners on them? All missed advertising space, and with the daily traffic jams they will be seen. (The same kind of reasoning used by the people invading our e-mail box daily..)

BBC: Pictures of a sandstorm in Iraq.

Gadgetry: I ordered an iRiver ifp-795 at mp3man.nl.. now waiting for delivery, so I don't have to lug around my laptop as a big mp3 player. Link to iRiver ifp-795t at amazon.

At work, I get to read the helpdesk mail. The number one request today..

"I got this mail telling me I sent a mail with a virus! Help!"

Apparently, E-mail virus scanners still don't flag certain virus
types as "fakes From: addresses" and will send a reply on recieving
Outlook virusses telling a virus was found, to a From: address which
is an innocent third party.

Yes, I call them Outlook virusses because Outlook made e-mail virusses
possible.

It is August 2003. Outlook virusses have been widely known since April
2000 (the ILOVEYOU worm) and many of them fake the From: addresses using
addresses found on the infected system.

SysNet Mail Filter has this bug.
Norton AntiVirus For Microsoft Exhange has this bug.
Content Technologies SMTPRS has this bug.
TrendMicro AntiVirus has this bug.
ravmd has this bug.
"Scenarios" has this bug.
Symantec AntiVirus has this bug.
AMaViS has this bug.
ScanMail for Lotus Notes has this bug.
"AntiGen" has this bug.
ScanMail for Microsoft Exchange has this bug.
RAV AntiVirus for Linux has this bug.
Kaspersky Anti-Virus (KAV) for Linux Server has this bug.
Antiviral Toolkit Pro has this bug.
eSafe has this bug.
Brightmail Anti-Virus Technology has this bug.

MailScanner Email Virus Scanner has this bug in older versions. Update!

(more updates follow as I find more in my e-mail or get notified by others)

And the virusscanner that does know when not to reply via mail:

F-prot Aves

chromatic, technical editor of the O'Reilly Network proposes a
One Question Certification Tests for E-Mail Filter Authors
because he gets flooded with those same stupid responses.

A new Windows Outlook virus is doing the rounds and I get to enjoy the bounces (I ranted about before and ranted about McAfee specifically again) again. Brian Martin wrote a nice article - rant about it too. Symantec antivirus has fixed this problem.

Adam Curry made a strategy podcast 2.0 that everybody is trying to download.. So I set up bittorrent and published a torrent at http://podcast.idefix.net/Podshow02.MP3.torrent (now taken offline).

Got vboxgetty running on my home server so it plays digital answering machine. It took a bit of fiddling to find the right settings and the right way to program the correct number to answer on.

Adam Curry discovers a paparazzo hanging around his house. Solution? Take a picture. Source: Adam Curry's weblog

Ch7 Australia off-air due to multiple system failures. Funny thing is that people kept watching the blank screen and did not switch to a different channel. Source: comp.risks newsgroup.

I added an RSS 2.0 feed for my homepage (link in the obligatory style ofcourse).

Found some really great snowboarder pictures by AstroPax source: rec.skiing.snowboard.

Worked a bit on The Virtual Bookcase and added scripts to show items of book news such as the news on the latest Harry Potter book and site news. New stuff is done in html4 (you will see some artefacts of mixed html4 and html3.2 use because some building blocks are imported from other scripts) but slowly I am converting to html4 and thinking about improving the general design.

Port 80 software shows that choosing webserver software can go like any other technical choice in a big corporation: I heard from some guy on the golf-course... Their measurement of 'real' webserver software popularity is by checking the servers of the US fortune 1000. A nice example (to me) of I heard it on the golf-course style of decision making if you follow this. And by the way: all the stuff they sell for IIS is available for Apache for free. Just without the warm fuzzy feeling of having expensive software.

Easter monday activity: building and painting a birdhouse. We (Mirjam and I) got a kit for one as a present last September and finally found the time to put it together. Birds won't like it for this spring, but maybe they can get used to it for next year.

Page restyling has hit my homepage as you see. It may look mostly the same, but the change in source is big. I moved stuff around too, and added the google searchbox to help you find stuff I (re)moved the links for. The interesting part was to build the stylesheet parts to create the page columns without resorting to using tables. Next big restyling project is The Virtual Bookcase where almost all pages are still bad html 3.2.

My this-is-not-a-blog news pages are now improved with a better stylesheet.

A teacher asked for a directory on https://wwwsec.cs.uu.nl/ to be limited to a specific client certificate. Configuring this exact limitation turned out to be quite some searching as I couldn't find it in the modssl documentation (the site being down a lot of the time this week didn't help either). The correct way to write that you want to limit to a certain subject DN turns out to be: %{SSL_CLIENT_S_DN} eq "/C=NL/ST=Utrecht/L=Utrecht/O=Universiteit Utrecht/... "

"A Swiss hygiene inspector calls" .. great reading. Makes cleaning up a rented apartment for holidays sound like a piece of cake. Oh, and (time_t) 1111111111 has passed.

Found a manual How to destroy the earth. This won't happen as easy (or fast) as some of the enviromentalists want us to think. Via Schneier on Security blog.

Meer eighties flashbacks, Tom Schuring mailde me naar aanleiding mijn vorige opmerking dat hij een complete site heeft over The Legendary Curry & van Inkel show .. met mp3s van uitzendingen.

Adam Curry on the "radio", but this time in mp3 format (podcast). It's funny to hear him again in the free format of a podcast, after hearing him on Curry en van Inkel in the eighties. Today's podcast is fun to hear because of some technical problems with a new setup.

I'm becoming an RSS junkie both for reading and writing them. Using Sage within Firefox. So now Camp Wireless has RSS feeds for new forum posts and new campsites.

Surprise this morning: snow in the early morning light.

Back from a week of snowboarding in Les Deux Alpes. Had fun, had enough snow and my snowboarding got better. And it was a good holiday.

Idefix had hardware troubles over the last week leaving it more down than up. But things should be fixed again.

De campagne Gelijk oversteken! vraagt aandacht voor de identificatieplicht in Nederland en het voorkomen van misbruik ervan. Kijk op de site, ken je rechten en doe mee.

Found spamusement.com. Recommended.

Played with the auto-proxy config feature of Firefox. Used an old proxy-config-generating perl script and set up a local wpad alias. It took a bit of testing to find out Firefox uses url http://wpad/wpad.dat. This should also work for the automatic proxy config of that browser not updated since 2001. Details from Auto configuration of browsers although I had to add ServerAlias wpad to the apache config.

First advance fee fraud (aka 419 scam) e-mail received mentioning the tsunami disaster in Asia (in particular Indonesia, using a link with the Netherlands to interest people in this country in being scammed).

The phpbb vulnerability showing up before got even turned into a worm named the Santy worm (zdnet article) which automatically defaced sites running phpbb. Details of Santy worm at Symantec.

A lot of stuff in better places in the new house, the new 'office' even starts to look reasonable. It may be me, but this makes the house a lot more usable. Happy new year everybody!