Time May Not Exist.

Very off topic today, but I like science and philosophy so here it goes:

I don't believe in time as a reality or real thing, time is only a convention. A bunch of people agreed on that convention because it made stuff easier, just like inches and pounds are conventions. But it isn't real as in real. It's as real as a fragment of our imagination. Think about it, what is time? the reason Buddhists say: "live in the present, that is all you can do" is so true, because there only is a present. Every moment is the present, a moment ago it was the present and when you finish reading this text, it will be the present again, defining past and future is only fragmenting it and basically unnecessary to it's fundamental concept.

I got inspired by this piece of text below, it clearly says what I felt for a long time, As the Buddhists might say: It's all right here, and right now.

No one keeps track of time better than Ferenc Krausz. In his lab at the Max Planck Institute of Quantum Optics in Garching, Germany, he has clocked the shortest time intervals ever observed. Krausz uses ultraviolet laser pulses to track the absurdly brief quantum leaps of electrons within atoms. The events he probes last for about 100 attoseconds, or 100 quintillionths of a second. For a little perspective, 100 attoseconds is to one second as a second is to 300 million years.

Efforts to understand time below the Planck scale have led to an exceedingly strange juncture in physics. The problem, in brief, is that time may not exist at the most fundamental level of physical reality. If so, then what is time? And why is it so obviously and tyrannically omnipresent in our own experience? "The meaning of time has become terribly problematic in contemporary physics," says Simon Saunders, a philosopher of physics at the University of Oxford. "The situation is so uncomfortable that by far the best thing to do is declare oneself an agnostic."

http://discovermagazine.com/2007/jun/in-no-time

Flash Player Vuln.

This almost got buried in the feeds I read. But, I want to point out that this is a serious issue. So if you haven't heard it yet, Go take a look at the specs and a video explaining it all on gnucitizen:

http://www.gnucitizen.org/blog/bid-24856-flash-player-swf-vulnerability

Wikipwndia.

From day one I hate that name: Wikipedia. It's a meta language demon that is haunting me in my dreams, they abuse URI's and have those horrible names for everything. Moreover they suck at being cool and they've become one big pulp archive listing every dumb thing known to man. I wrote about it before, they think it's okay to have XSS and SQL injection, I won't throw it up again but it's quite true. So if they don't care, I have few next. Let's see how quickly those are going to be patched ^^ Am I evil? No I'm not, I only wanna have some fun is that a crime?

Why it's bad to echo back the PHPSESSID:
http://www.0x000000.com/hacks/wikipedia/session_modification.jpg

Look mom! html injection:
http://www.0x000000.com/hacks/wikipedia/injection.jpg

Javascript Router Scanner

I'm filing this under reconnaissance, because this is another router scanner. I knew about a few, and I even wrote one myself. But I never found time to make a good one, Gareth e-mailed me his updated version today and you know what? It's pretty devilish good. You can even contribute in refining it by submitting your router information to him. It can detect a dozen already, but if you want to help you get something in return. As an incentive in helping out, the database will be released under a GPL license when it's completed. So what are you waiting for?

Sneaking through, null scanning your router like a thief in the night, snipers armed and ready: Javascript here we come!

http://www.businessinfo.co.uk/labs/nat_scan/nat_scan.php

Cenzic Email Blacklist.

This is kinda sweet, I was looking for the Cenzic site and noticed they have a Javascript blacklist containing a couple of email addresses that obviously requested too much Hailstorm trials. And, haha... among them I saw Acunetix that was being blocked. I nearly rolled of my chair from laughing, do they just hate eachother so much? Look at the list below it's hilarious, sorry Cenzic I thought this was funny. ^^

Oh and they made a typo on "acuntetix.com" and I saw watchfire, spidynamics in it as well.

Unsubscribing And Collecting Email Addresses.

Collecting email addresses, how hard is it? Today I unsubscribed myself from a writers mailinglist, then I saw how they unsubcribed me. I was send to a perl script. And oh yeah, I could not resist to tamper. It is some sort of perl maillist script that is easily owned, it's almost too simple. The script is called Arp3 and can be Googled with inurl:arp3-un.pl

Check out the link below, I googled this one next. Change the first parameter c=5072 and see different addresses show up each time you increment it. You can collect them all and unsubcribe them at the same time. All you need is to write a small script that enumerates through it. I'm not sure what that second parameter is doing. Anyway, shame on them i'dd say.

http://www.ezinepriority.com/cgi-bin/arp3/arp3-un.pl?c=5072&p=0734

Firefox Remote Code Execution.

This is where nightmares are made of.

As some of you know there has been a ton of commotion going on about Mozilla Firefox lately. I've waited blogging about it until they had found a real 0day. Today is that day and this time it's for real, Billy Rios e-mailed me his new findings: and anyone could be vulnerable without any user interaction. It's not complicated shellcode execution, but it allows to pass arguments along cmd in windows to launch software among other things.

The first versions required user interaction so I was a bit skeptic, because asking users twice to launch a program is a little far fetched for me. What they did was passing arguments along a command line, which is basic stuff to understand. But this is different, this hurts everyone. I made the switch to Opera last month, and I can't say I regret now.

Example of compromised identifiers:


http://xs-sniper.com/blog/remote-command-exec-firefox-2005/