tail -f /var/log/sid77/me

New GPG key: 0x0B60BC5F

2009-08-30T12:58:23Z

Hi all,
I've updated my GnuPG key because the previous one was getting too old.

New key:
pub 1024D/0B60BC5F 2009-08-29 Marco Bonetti (sid77) <marco.bonetti@slackware.it>
Primary key fingerprint: E357 A480 17E2 482D E599 703A 4D8B C9F6 0B60 BC5F

Revoked key:
pub 1024D/86A91047 2005-04-02 Marco Bonetti <marco.bonetti@slackware.it>
Primary key fingerprint: 90D9 1E9C 2840 2B63 CBF2 9B02 C8F2 B0F9 86A9 1047

The new key has been signed with the old one:

uid Marco Bonetti (sid77) <marco.bonetti@slackware.it>
sig!3 0B60BC5F 2009-08-30 [self-signature]
sig! 86A91047 2009-08-29 Marco Bonetti <marco.bonetti@slackware.it>
sig!3 0B60BC5F 2009-08-29 [self-signature]
uid Marco Bonetti (sid77) <marco.bonetti@gmail.com>
sig!3 0B60BC5F 2009-08-29 [self-signature]
sig! 86A91047 2009-08-29 Marco Bonetti <marco.bonetti@slackware.it>
uid Marco Bonetti (sid77) <sid77@slackware.it>
sig!3 0B60BC5F 2009-08-29 [self-signature]
sig! 86A91047 2009-08-29 Marco Bonetti <marco.bonetti@slackware.it>

so I hope everything will be fine :-)
You can get my new key at the following sites:
+ slackware.it: http://slackware.it/files/keys/sid77.asc
+ livejournal.com: http://www.livejournal.com/pubkey.bml?user=sid77
+ on the keyservers: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4D8BC9F60B60BC5F

Testing LJ jabber service

2009-07-30T09:00:39Z

Looks like lj users can post from a jabber client, this is going to be interesting :)

Jeriko patches updated

2009-04-06T15:53:27Z

PDP updated the jeriko trunk with some of the fixes I wrote (the small bug squashes, mostly) and some new interesting features.
Time for an upgrade! Grab the sources and the patch here and there.

Hacking Jeriko

2009-03-06T17:05:03Z

If you read GNUCITIZEN blog you should probably already known of PDP Jeriko framework: it's a shell script based framework to help with the automatic pen testing stuff.
It's a nice idea in an preliminar stage, I've written a patch against the current svn release (r31 at the time of writing) which adds some extra functionality like the ability to run OpenVAS instead of nessus or the ability to load your preferred Metasploit Framework db plugin. I've also fixed some glitches while I was at it and added a bigger jerikorc.

So, go grab a copy of both the project and my patch and give the framework a spin: it surely is something intersting to play with!

Mauro Biani, vignette, comics, satira

2009-03-03T13:30:32Z

Via DNA - Mauro Biani, vignette, comics, satira

La notizia sta qui, intanto ci si dimentica degli altri eventi.

RaiNews24 - Il Vaticano non recepirà più le leggi italiane. Troppe e amorali

2008-12-31T09:57:45Z

Da RaiNews24: "Il Vaticano non recepira' piu' automaticamente, come fonte del proprio diritto, le leggi italiane; innanzitutto per il "loro numero esorbitante", in secondo luogo per "la loro instabilita"' e , infine, per il contrasto "con troppa frequenza evidente, di tali leggi con principi non rinunciabili da parte della Chiesa".

Lo spiega l'Osservatore Romano, presentando la nuova legge della Santa Sede sulle fonti del Diritto, gia' firmata da Benedetto XVI, e che entrera' in vigore il primo gennaio 2009."

Significa che da gennaio possiamo esportare anche a loro un po di pace e democrazia a suon di bombe?

Ouch!

2008-12-31T09:54:54Z

Linus wrote: "It's that magical time of year when I actually play video games. I have one rule for christmas (and bday, for that matter) gifts for Tove: she should buy me toys. No practical gifts, no soft packages with sweaters or socks. I didn't enjoy them when I was little, and I don't enjoy them now. I refuse to grow up."
Raise hand who actually want sweaters or socks or ties for christmas or the birthday, sometimes I feel that every Linux nerd has been built with the same presets of ideas :D
Speaking of presents: my girlfriend gave me a cool iPod radio remote control for this holiday, no more tampering with the jacket in these cold mornings just to change a song, huzzah!

Negare per credere - Macchianera

2008-12-22T15:37:58Z

"Altrimenti potremmo provare a spiegare alla Chiesa che, nel seppur sempre più complicato e faticoso rispetto della sua imbarazzante versione della società, c’è anche della gente frocia, e che se ne facessero una ragione."
via Macchianera

Post to LiveJournal bookmarklet

2008-12-22T08:25:39Z

Post to LiveJournal bookmarklet
Finally! (posted with the same bookmarlet linked above :-p )

Wow

2008-12-19T19:49:38Z

From here:
"The patches greatly broaden hardware support of the XNU kernel, allowing it to run on Pentium M, Pentium 4, Turion 64, Athlon 64 and Phenom. Like the XNU kernel itself, the patches are released under the Apple Public Source License (APSL), which makes them suitable for inclusion in Darwin-based distributions like the one the PureDarwin project is working on."
I'm greatly tempted to try it out on the EeePC :)

Chat madness vol. 15 - Internet is for porn (almost italian only)

2008-12-15T15:08:07Z

c: "ti ricordi la newsletter sulla tipa biotta?"
me: "ah si
cioè, dai, non era sulla tipa biotta
era con la tipa biotta"
c: "beh com'è come non è ha battuto tutti i record di click"
me: "internet is for porn
internet is for porn
grab your dick and double click
for porn porn porn"

iCTF again!

2008-12-05T16:00:12Z

Another UCSB iCTF is about to start. Go Tower 0f Hanoi!

The Web Application Hacker's Handbook (shameless commercial)

2008-11-18T09:02:23Z

Sheeesh! Almost a month without updating the journal, that's because I'm trapped inside the addictive world of soup.io :)
However, what am I doing? I've just bought this book and I'm reading it while commuting to work, It's well written and easy to read.
It takes the reader into the world of understanding of web applications work, how you can handle them and how you can exploit their weaknesses. It starts from scratch, from describing what a web application is, the HTTP protocol on which they rely upon and how you can take all of this elements on your side while analyzing your target. And it then moves on mapping the application behavior for finding weak spots how to exploit them.
It's a must read, even if you're only vaguely interested in the field.

Why you should keep your computer tidy...

2008-10-14T21:36:23Z

...because cleaning it up, I discovered that almost a year ago I made my name into Tor sources: https://www.torproject.org/svn/trunk/contrib/linux-tor-prio.sh
From the svn log:
r16269@catbus: nickm | 2007-10-29 15:41:16 -0400
Apply linux-tor-prio.sh patch from Marco B by way of Mike.

One year and not knowing it: I'm too lame! Especially because it was even announced in the ChangeLog: http://archives.seul.org/or/talk/Nov-2007/msg00247.html :^)

Well, thanks to Mike Perry for taking the patch into account! All of you: go grab a copy of Tor and try it out with the super-duper priorization script!

By the way, speaking of Tor: I'll be again at SMAU eAcademy this year, talking about the common exploitation techniques used against Tor, see http://smau.it/event/eventview/1118/1/0,0/peeling_the_onion___attacchi_alla_rete_tor

Hope to see you there!

Different twist

2008-09-30T12:31:25Z

From here and here:
"Worm.Win32.AutoRun.nox has a payload that restores the original function pointers back to the kernel's System Service Table (SST). The usual motivation for malware to do this is to remove any SST hooks installed by security software or other malware that might affect its successful operation.

As noted, normally a special driver or the physical memory device is used to get access to kernel-mode memory to restore the pointers. AutoRun.nox is different — it uses "GDI Local Elevation of Privilege Vulnerability (CVE-2006-5758)" to do the job. For malware, its rather unique to see such a technique being used."

Actually, backpatching existing software with an old, vulnerable, version is not that new. It's nice to see this kind of exploit in the wild, though, and good luck to any anti-virus vendor which now has not only to check if a patch is installed, but also if corresponding files are correct :D

Back On Track

2008-09-26T18:26:22Z

No, it's not a cheesy joke on my last post, it's the announcement that http://sidbox.homelinux.org/ is back on the road thanks to the help of ~~Spiff~~ Francesco who brings me a (almost) new ups :)

Thanks my friend!

More EeePC in your Back Track :-P

2008-09-22T22:17:32Z

http://sid77.slackware.it/bt3/
A Back Track 3 lzm to enhance EeePC 700/701 support, enjoy :)
(ehi, ce, would you mind borrow me a nice css? :-P )

Report from MOCA 2008

2008-08-23T17:08:53Z

I'm at the talk zone again, Zanero is talking about the WOMBAT project.
I've taken my second talk today, not bad except:
1) It was TOO hot and sunny
2) My audience was re-routed by a couple of hot young chicks giving free samples od red bull and cola :-/ THAT'S NOT FAIR!!!

Anyway, I'm enjoying my time a lot here :)

Andrea Monti @ MOCA 2008

2008-08-21T20:37:42Z

Flash talk of Andrea Monti about the recent italian Pirate Bay affair.
This talk wasn't scheduled: he's just doing it now because the guy who should bring the talk about hacking satellite tv went missing :-/

However I'menjoying it a lot, the wifi signal is crappy, the weather is hot and pasword are being sniffed :-/ too bad that the vpn sometimes doesn't correctly setup the gateway.

Preparing for MOCA

2008-08-20T23:51:26Z

Uff! it's 01:50am in the morning and the alarm will ring at 6:00am :-/
I've just finished preparing the stuff for moca, I'll pack the last things and I'll crash straight to bed.

See you there!

Talking about Tor @ MOCA 2008

2008-08-06T07:24:02Z

Speaking about Tor, again :)
This time I'll held two talks at MOCA 2008, I hope to see you there!
(Not to mention that the organization put me first in the list instead of following the chronological order, I'm feeling a little under pressure :-p )

Steampunk meme :)

2008-08-01T12:18:13Z

Your result for The Steampunk Style Test...

The Gadgeteer

18% Elegant, 52% Technological, 3% Historical, 52% Adventurous and 51% Playful!

You are the Gadgeteer, the embodiment of steampunk technology. Ironically, many of the things that most define your style are probably too large to easily carry about, but given the opportunity you would prefer to be seen surrounded by boiler engines, gear-driven calculators, and incredible automata. Of all the steampunk fashion styles, you place the greatest emphasis on technological accessories, and you are the most likely to create elaborate gadgets that are as much a part of your outfit as your clothes. You probably have goggles, but unlike most people you consider them to be for more than decoration. Whereas most people might look odd carrying a satchel of tools around, for you they may well be essential. Above all, you remind everyone that what sets the genre apart from Victoriana is simply the level of technology.

Try our other Steampunk test here.

Take The Steampunk Style Test at HelloQuizzy

Do you really want to buy an iPhone in Italy?

2008-07-11T14:52:34Z

Vodafone iPhone: 499€
AT&T iPhone: 199$ = 127€ (126,285062€ according to google calculator)

With the vodafone model you don't have any extra service you'd have to pay for, just a barebone iPhone, a sim and 5€ of phone traffic. So, at least, to compare both of them you'll have to jailbreak the AT&T iPhone, add 0$ (or 0€ if you prefer, the change is in our favor) to the total price of the AT&T model.

499€ or 127€? I can't really choose which one to buy...

Ok, I'm kidding: to buy an AT&T iPhone you'd have to fly over to the US but, seriously, do you really want to buy an iPhone here at that prices?!?

New avatar from today xkcd!

2008-06-27T07:42:03Z

the comic is here: http://xkcd.com/442/
and the reference: http://www.youtube.com/watch?v=V5BxymuiAxQ

I love cryptography!

Slackintosh 12.1

2008-06-12T14:21:05Z

We are proud to announce that Slackintosh 12.1 has been released!

Slackintosh 12.1 includes Linux 2.6.24.5, glibc 2.7, X11 7.3.0 and much more!

Download:
======================================

ISO IMAGES
----------
BitTorrent: http://slackintosh.workaround.ch/pub/rsync/.releases/12.1-torrent/
HTTP : http://slackintosh.workaround.ch/pub/rsync/.releases/12.1-iso/
BT-Magnet : DVD-Torrent: magnet:?xt=urn:btih:7AFOXLOF4VXKWTMA4OV77VOGYRU3D5PR
CD-Torrent : magnet:?xt=urn:btih:P7ECTQG7K4NJOJ3QKID5IHE5A4DUN3DP

PACKAGES
--------
HTTP (CH) : http://slackintosh.workaround.ch/pub/rsync/.releases/12.1/
HTTP (CA) : http://gulus.usherbrooke.ca/pub/distro/slackintosh/12.1/

Note to people who still run Slackintosh 11.0:
We will not provide any security patches for 11.0 anymore, so please
upgrade to 12.0 or 12.1 ASAP.

Best regards,
The Slackintosh-Team (Adrian & Marco)