Enter your password securely

I came across a nifty little utility that just might keep you from having your passwords stolen from you by a keylogger or similar devices and programs. Neo Aplin wrote this tiny little app called Neo's SafeKeys which will let you enter your passwords via a little onscreen keyboard. The really nifty part is that not only are you defeating keyboard loggers, but it places the buttons differently and the program window is a different size each time it's run, thereby defeating any program that attempts to log which button was clicked by mouse placement. All-in-all if you use public computers or even are just paranoid about your own and run Windows, this app's for you! If you missed the above link, here it is again.

Baltimore police- HOW THEY REALLY TREAT PEOPLE

Heres an awesome video of how the Baltimore Police really treat kids who are doing nothing more than skateboarding. As far as I can tell, these kids didn't even provoke this cop to act like a pompous ass, and this one in particular needs to be FIRED! He even says his name on the video so have at him!

Any bluetooth headset can be eavesdropped even while not on!

I just found some disturbing information about bluetooth headsets for all you cellphone happy consumers. Any bluetooth headset can be listened in on, EVEN WHEN YOU'RE NOT ON IT! Watch the video for more.

USB Flash Drive Virus Proof of Concept

I came across something very disturbing a few minutes ago, and I think the world really needs to know about it. I know you all know that Windows is horribly vulnerable to every PC malady that has ever existed, but here's one that is basically built-in on purpose by Microsoft.

This particular exploit utilizes the built in autorun.inf 'feature' in all recent versions of Windows to run its payload, whose source code can be seen at QuantumG's site where I Stumbled Upon it. What the code does, is basically as soon as you insert the flash drive containing this program, opener.exe, and the 4 lines in autorun.inf, it will find any other removable drives, copy itself onto them, and hide itself. The actual process goes like this:

1. Open an explorer window for the drive we're running from.
2. Make sure there is only one copy of opener.exe running.
3. Scan the available drives for any that are removable.
4. Check that there is some free space on the drive.
5. Check that the drive doesn't already have an autorun.inf.
6. Dump the following into autorun.inf:

   [autorun]
   shell\eject=Eject
   shell\eject\command=opener.exe
   shell=eject
   

   This creates a new shell command which I've just randomly named "Eject" and, importantly, makes it the default action.
7. Write a copy of opener.exe to the drive.
8. Mark both autorun.inf and opener.exe as hidden.
9. Do any other removable drives we can find.
10. Wait about a minute.
11. Go back to step 3.

This is very basic virus behavior, but if the author was malicious, absolutely anything they wanted to do could be done. This has very serious implications for users, and needs to be addressed post-haste by Microsoft. Let's get the word out, you can help by Stumbling, Digging, or doing whatever you can to share this post and get it fixed.

Original site at http://rtfm.insomnia.org/~qg/opener.php
Image courtesy of Francois Thé

View password 'asteriskd out' in Firefox

Have you ever needed to see what that password you had Firefox remember last year was because now you can only get on that website from your computer at home, and need it at work? Or something like that. I know it's been awhile since I made a post, but come on guys, nobody has even noticed, have you? Anyways, to see what's behind the ***s, make sure you are on the page you want to get the password from, and it is entered in the box (you can see ****** in the box.) Now, click in the address bar up top, and replace the text in there with the following text: (copy and paste)

javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j<F.length; ++j) { f = F[j]; for (i=0; i<f.length; ++i) { if (f[i].type.toLowerCase() == "password") s += f[i].value + "\n"; } } if (s) alert("Passwords in forms on this page:\n\n" + s); else alert("There are no passwords in forms on this page.");})();

When you press enter, you will get a box revealing the mystery!

Windows Vista important security announcement

It's come to my attention that there is a serious security issue in Windows Vista that all users should be aware of. It involves the use of Unicode characters to change the way that a filename appears in the explorer and desktop to make a dangerous executable in screensaver (.scr) format appear to be a harmless JPG. This vulnerability doesn't appear to exist in XP, only Vista. The following screenshots, as captured by Max Ried, demonstrate the vulnerability and show how serious the problem is.

The file on the XP desktop: The file on the Vista desktop:








As you can see the only way to identify it as not being just a picture is by hovering your mouse over it. It appears to me that this is done by using a particular character, which is actually 2 Unicode characters, one being the circle of commas, the other being the code which causes everything after it to be typed backwards. You can see how it works by copying the character, and pasting it into any text entry box, such as notepad.exe, then start typing right after you paste it. The character is at the bottom of this post as it becomes very hard to type forwards if pasted anywhere in the middle of the article. It looks like the filename is made up of the code to insert the gpj. backwards at the end of the filename (or appear as such to the viewer,) and then the actual filename, Nice Picture.scr. Apparently XP is not affected because it does not correctly support Unicode for filenames within explorer.exe and therefore the desktop. This vulnerability was first demonstrated at Heise Security and adapted here to include my additional data on the cause.

Another view of the problem in the 7Zip program, first in XP:















And in Vista:













And now the character I believe is responsible, along with the character that makes it possible to copy and paste it, otherwise the character doesn't take up any space and therefore can't be highlighted to copy, it would just cause everything you typed after it to be backwards, as I'll demonstrate here:

‫‬‭‮‪‫‬‭‮҉

this is what happens after you paste and start typing
‫‬‭