wisely crafted spam

The following is the content of a spam email :

-S''ensationall r'evoolution in m''edicine!
-E'n'l'a'r'g'e your p''e'n'i's up to 10 cm or up to 4 i'nches!
-It's h'e'r'b'a'l solution what hasn't side e'ffect, but has 100% g'uaranted results!
-Don't lose your chance and but know wihtout d'oubts, you will be i'mpressed with results!

Clisk here: http://golfarmour.com/

Looking at the words I highlighted in red, no doubt you will agree that this spam email can bypass keyword filter and get into the inbox of the recipient.

Fedora Core 5

FC5 was released in late March 2006. The most distinctive feature compared with previous releases is that it has 64-bit OS version to support 64-bit CPU.

I found a nicely packed FC5 box package with a single DVD and a colorful installation manual selling at HK$80. I better buy it instead of spending serveral days to download the iso images from mirror sites and then burn four CD.

2300 IP addresses of i-cable listed by real-time blacklists

I tried to access Senderbase network and performed a check on hkcable.com.hk. Surprisingly, Senderbase returned that over 2300 IP addresses of hkcable.com.hk were put in realtime blacklists. Some IP addresses have mail volume of 4.7 - 5.1. These IP addresses were connected to compromised machines which are either zombies or open proxies.

The impact of zombies or open proxies will be reduced significantly if an ISP can barred TCP port 25 in the outbound direction. This is a worrying trend and I really hope the ISP in question can take some positive actions to reduce email spams arising from compromised hosts.

Copyright video found on Google Video

A couple of days ago, I accidentally found the 1-hr video of BC24., BC25 and BP 56 of Les Mills could be seen in Google Video. I called a man who had some official connection with Les Mills to take actions. Google was quick to respond and the copyright materials were removed promptly.

Why Google commit such a careless mistake ? The copyright owner could file a law suit and Google would be in trouble.

Email Honeypot

I want to set up an email honeypot which seemed to act as an open relay to attract spammers. The trick is to allow all IP addresses from 1.aaa.bbb.ccc to 233.xxx.yyy.zzz to relay in the /etc/mail/access file. However, the emails queued which are deposited by spammers must not be delivered out. Hopefully, there are some easy to understand settings in sendmail.mc to accomplish this task. I also start a cron daemon to move the files in the default mail queue directory to other protected path. With a bit of luck, my email honeypot is successfully operational.

Openwebmail 2.52

I am deeply attracted by the new features of web disk and personal calendar in Openwebmail 2.52 which I tried yesterday. Web disk can be used as a ftp account and I would say Openwebmail has successfully integrated email and ftp in a web client interface. My PIII-450 MHz server is running RH7.1 which is not compatible with Openwebmail 2.52. I need to migrate the whole hardware to P4 CPU and upgrade the OS to Fedora Core 4.

Dovecot

I installed a mail server with Fedora Core 4. The MTA package was of course Sendmail. However, there was no pop or imap daemons associated with FC4.

According to some experienced FC users, dovecot should be used. I followed instructions from web links and do a "yum install dovecot". The installation was successful but dovecot failed to start with the error message :

Starting Dovecot Imap:Fatal:Can't use SSL certificate /etc/pki/dovecot/dovecot.pem;Permission denied

Wooo.. dovecot's default settings come with SSL certifcate. After changing ssl_enable = yes to no in /etc/dovecot.conf, dovecot started up successfully.

巴士阿叔

這幾天如果你沒有聽過這兩句口頭禪「我有壓力，你有壓力，你做乜挑釁我呀？」和「未解決！」，恐怕你都不可以稱得上是八掛的香港人。

netcat to emulate servers behind a firewall

I need to test request to POP, SSH, WEB and SMTP services behind a firewall could get through. The services are not started up yet. Then how could I test the firewall connectivity.

My colleagues remind me of netcat. Netcat can listen on a particular port and if a PC is running with netcat, it can successfully emulate a server. In Windows mode, the command is something like :

nc -l -p 25 -t -e cmd.exe

Really handy and powerful !

Black Frog

Blue Frog died a week ago due to large scale DDoS attack by spammers on the Blue Security command and control site. This week, Black Frog arises. Talented software people think that they have successfully learnt from the failures of Blue Security and eager to apply their belief on the cyberworld. This time P2P technology is used to avoid the whole anti-spam community network being cracked down by a single point of failure.

Can Black Frog survive ? This is something every IT people wants to witness.

Woo. after Black Forg, there might be Red Frog or Yellow Frog. Who knows what next ?

ldd and Windows ldd

"ldd" is the utility to find all the shared libraries or dynamic dependencies of executable files required by each program. I like to state an example to refresh my memory about the usage.

# ldd tcpdump
libc.so.6 => /lib/i686/libc.so.6 (0x4002d000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

It is very clear to me ldd is a must in cleaning malicious codes or Trojan programs in Linux/Unix boxes.

How about Windows PCs that are the targets of spyware programs. I could remember a freeware "Dependency Walker" which performs similar functions with nice GUI.

Anti-spam Warrior BlueSecurity Defeated by Spammers

Sad news ! BlueSecurity has closed down its operation. Earlier this month, spammers sent 10 million packets to attack BlueSecurity. There is no way BlueSecurity could survive. Also, given its war with the largest spammers in the world, no ISP would like to offer service to BlueSecurity.

Lets pay a moment of silence to this anti-spam warrior.

廣告的吸引力

廣告的吸引力有幾大，單看地鐵站內 “moto 明” 的海報便可估到了。

Steganography on images

This week I come across some theories about steganography on images to hide secret text. The method is to change the least signifcant bit to its reverse value. Consider a true colour image with 24 bit colour depth, altering least significant bit will cause a slight change in colour but this can hardly be detected by human eyes. How much information can an image carry ? An image might have 320 x 480 pixels and six pixels each giving out a single bit can contribute to a single ASCII text character. That is to say, an 320 x 480 image can store up to 25600 text characters which should be quite sufficient to spread secret information from one machine to another.

Comat 28 Class Today

Today evening is the launch of Combat 28 in all 7 clubs of California Fitness Center. I intend to attend the 1st class by Yvonne at Causeway Bay starting at 6:30 pm and then proceed to Wan Chai to continue the 2nd class by Stephaine. I can not finish all the 9 tracks in the first class as I need to rush to Wan Chai. I think I will have to leave after finishing the Muay Thai track.

Tomorrow I agree to meet Kay in Central for the class conducted by Michelle D. Wooo... I don't know if my physical strength can sustain three rigorous exercises in 2 days.

SMTP Daemon can not restart

A couple of days ago, my email server crashed and it could not be restarted. The reason was unknown. I had no other method to restore it but had to perform a remote reboot. Hopefully everything worked fine.

Actually, I had not rebooted my server for over 200 days. When running programs are closed, there is no guarantee that residual memory occupied could be 100 % released. Days after days, there is less and less usable memory. It is a good idea to reboot server after a certain time, say one or two months.

Launch of BodyCombat 28

Combat 28 training class will be launched on evening of 12 May (Friday) at the 7 California centers almost at the same time. Frankly, I don't like to have launch class of new release on Friday evening. It is because members might not be able to free themselves from their duties. Saturday and Sunday are the perfect time for launch. I hope the timing of launch class should be considered carefully in the next release.

BTS Forum

BTS is a well-known forum is for instructors, participants and anyone interested in the Les Mills programs. I joined it a couples of days ago.

In the Forum, I see big names of some international renowned trainers. There are not many people from Hong Kong. I counted only 5. As a matter of courtesy, I have dropped them a message to introduce myself.

I gained a lot of new knowledges about Les Mills exercise. For example, the name BodyBalance is not used in USA, rather, it is called Body Flow.

Could I be an active member in the Forum ? I don't know yet !

New banner in blog template

The recent Blue Frog Community Program attracted me, the purpose of which is to unite a large group of people (about half million) together to fight back against spammers. These people set up a do-not-intrude list. If spammers try to send spam email to any of the email account, a large number of PCs will send DD0S to the spammer servers or web hosts.

For more than a year, I have not added any new banner into my blog template. I decided to add Blue Frog banner as part of my blog template. The aim, of course, is to let more people know the Blue Frog Community Program. I particulary like their slogan, " Stop filtering spam, start deterring spammers!"

My first visit to Pakpolee Club

Today, Pakpolee Club was opened to use by members of the California Fitness Cente. I made a tour aroud for about 15 minutes. The changing rooms are at the top floors. Of course, this is not convinient as we have to walk upstair for so many floors. Actually, this comes as no surprise to me.
For group X facilities, the cycling studio is ok. What I dislike much is the size of the multi-purpose studio. It is so small that it can not accomodate 50 people together. It would be very crowded for bodybump or bodycombat classes. Unfortunately, the management of California Fitness Center is not aware of this.