To contact us Click HERE
Sent by: Kaveri
Sent Via Email Address: websmo@businessthruseo.com
Sent To: Our harvested email address
Determination: Total Spam by a company sending SEO services (probably a scam) to a harvested Email address of an SEO Company has a screw loose and the fact that they are breaking our terms of service means that they are Black Hat SEO service and they engage in unethical practices.
Hi Sir/Madam,
I am Marketing Manager.
We have a SEO going for the following package: -
Monthly Task and responsibilities: -
Package For 15 Keywords:
1. Keywords Analysis & Research
2. 200 Manually Directory Submissions
3. 90 Article Submissions (1 Articles Submit in 30 Top Directories)
4. 10 Press Release Distributions (1 Press Release submit in 10 Sites)
5. 4 Web2.0/Blog postings
6. 30 Social Bookmarking Submissions
7. 10 website themed links
8. 3 Unique Article writing (400+ words)
9. 1 Press Release writing (350+ words)
10. Keywords Mapping
11. Keywords density check
12. Content optimization
13. Keywords proximity and frequency
14. Title Tag changes suggestions
15. Meta tags changes suggestions
16. Alt tag changes suggestions
17. HTML Site Map suggestions
18. XML site map setup
19. Anchor text optimization
20. Interlinking suggestions
21. Google analytics setup
22. Weekly Work Report
23. Monthly Ranking Report
24. Monthly Full Detailed SEO Work Report in Excel
Note: We send weekly report to each of our clients so that they can have regular updates on their website. Also, this shows that we work regularly on the website in a very elegant way.
We use only white hat SEO techniques for each website.
Please let us know in case you are interested.
Thanks & Regards,
Marketing Manager
25 Haziran 2012 Pazartesi
Debt Management Office Of Nigeria - Scam for scam victims!
To contact us Click HERE
Scam Email Sent by: The Debt Management Office Of Nigeria
Scam Spam email sent via email address: angela@wllssy.com
Determination: Interesting scam spam email targeting people who were foolish enough to already be scammed or greedy enough to fake that they got scammed in order to get a settlement they don't deserve.
The Debt Management Office Of Nigeria,
Scam Victims Debt Management
15, Central Business District,
Lagos,
Nigeria.
Email: scamdebtinfo@dmo.gov.ng , svdm-2012@hotmail.com
Telephone: +234-1-8173982, +234-80-9593-3431
Attention,
If you know you have been a victim of online scam by Nigerians or you are owed any debt by the Federal Government of Nigerian then this email is for you. The debt management office of Nigeria has opened another office which will work out means of aking sure your compensation are paid to you completely and with full government concerns on it.
You are to provide the following:
Full details, Contact details, and proof of been scammed (either through email or transfer slip). You are to send it to the email address above or simply click the reply on reading this email and it will be forwarded to us.
Yours Sincerely,
Barrister (Mrs.) Ronke Anuoluwapo
For: Debt Management Office Of Nigeria.
Pleses You are to disregard this email if you are not on the entitled list
Scam Email Sent by: The Debt Management Office Of Nigeria
Scam Spam email sent via email address: angela@wllssy.com
Determination: Interesting scam spam email targeting people who were foolish enough to already be scammed or greedy enough to fake that they got scammed in order to get a settlement they don't deserve.
The Debt Management Office Of Nigeria,
Scam Victims Debt Management
15, Central Business District,
Lagos,
Nigeria.
Email: scamdebtinfo@dmo.gov.ng , svdm-2012@hotmail.com
Telephone: +234-1-8173982, +234-80-9593-3431
Attention,
If you know you have been a victim of online scam by Nigerians or you are owed any debt by the Federal Government of Nigerian then this email is for you. The debt management office of Nigeria has opened another office which will work out means of aking sure your compensation are paid to you completely and with full government concerns on it.
You are to provide the following:
Full details, Contact details, and proof of been scammed (either through email or transfer slip). You are to send it to the email address above or simply click the reply on reading this email and it will be forwarded to us.
Yours Sincerely,
Barrister (Mrs.) Ronke Anuoluwapo
For: Debt Management Office Of Nigeria.
Pleses You are to disregard this email if you are not on the entitled list
24 Haziran 2012 Pazar
VODAFONE COMPANY INC.
To contact us Click HERE
VODAFONE COMPANY INC.
Grant Award promotion 2012
Ref Num: (VNP 671)
Dear Winner
Congratulations to you as we bring to your notice that Vodafone company has chosen you by the board of trustees as one of the final recipients of this year promotion cash Grant/Donation to celebrate the 151st anniversary celebration and your email address have emerged a Grant of {$500,000.00 USD} Five Hundred thousand United State Dollars.
Please fill out below information and indicate how you want your funds sent to you: Either the service of the BANK or COURIER DELIVERY.
1. Full Name:....... 2. Address:........ 3. Nationality:......... 4. Age:.......... 5. Sex:.......... 6. Occupation:.......... 7. Phone/Fax:......... 8. Present Country:...........
Contact Agent: Mr. Glen Hood
E-mail:vodafone-win@wss-id.org
Tel: +447011133562
Your Faithfully Ashley Morrison
scam, phishing, identity theft, spam
Grant Award promotion 2012
Ref Num: (VNP 671)
Dear Winner
Congratulations to you as we bring to your notice that Vodafone company has chosen you by the board of trustees as one of the final recipients of this year promotion cash Grant/Donation to celebrate the 151st anniversary celebration and your email address have emerged a Grant of {$500,000.00 USD} Five Hundred thousand United State Dollars.
Please fill out below information and indicate how you want your funds sent to you: Either the service of the BANK or COURIER DELIVERY.
1. Full Name:....... 2. Address:........ 3. Nationality:......... 4. Age:.......... 5. Sex:.......... 6. Occupation:.......... 7. Phone/Fax:......... 8. Present Country:...........
Contact Agent: Mr. Glen Hood
E-mail:vodafone-win@wss-id.org
Tel: +447011133562
Your Faithfully Ashley Morrison
scam, phishing, identity theft, spam
Bogus story: no Chinese backdoor in military chip
To contact us Click HERE
Today's big news is that researchers have found proof of Chinese manufacturers putting backdoors in American chips that the military uses. This is false. While they did find a backdoor in a popular FPGA chip, there is no evidence the Chinese put it there, or even that it was intentionally malicious.
Backdoors are common, but rarely malicious
Backdoors are a common problem in software. About 20% of home routers have a backdoor in them, and 50% of industrial control computers have a backdoor. The cause of these backdoors isn't malicious, but a byproduct of software complexity. Systems need to be debugged before being shipped to customers. Therefore, the software contains debuggers. Often, programmers forget to disable the debugger backdoors before shipping. This problem is notoriously bad for all embedded operating systems (VxWorks, QNX, WinCE, etc.).
Chips have reached the software level of complexity. It is rare that any designer builds a chip from scratch. Instead, designers construct a chip from building-blocks. One of the most common building-blocks is the debugger, known as JTAG. This is a standard way of soldering some wires to the chip and connecting to the USB port, allowing common tools to debug your custom chip.
Whereas companies (should) disable the debug feature in the version they send to customers, that's not so easy with chips. It requires millions of dollars for every change to chip design. Therefore, chips always have the JTAG interface enabled. What chip designers attempt to do is just not connect the pins to it. Or, if they connect the pins, they don't route to the pins on the circuit board.
This has led to a popular hacking activity of taking a device, finding the JTAG pins, and hooking them up. A lot of devices have been hacked this way – although it requires that the hacker have physical control over the device.
One way to protect against this is by putting a key into the JTAG hardware that only the manufacturer knows, to disable some of the more dangerous JTAG commands. That's what appears to have happened here. Whether you call this a security feature to prevent others from hacking the chip through JTAG, or a secret backdoor available only to the manufacturer, is open to interpretation.
Security of FPGAs
The chip in question (Microsemi/Actel ProASIC3) is a typical FPGA – a chip with a blank array of gates that can be programmed to emulate almost any other kind of chip. As real silicon chips are becoming more expensive to manufacturer, FPGAs are becoming a more popular alternative. Every change to a chip design requires millions of dollars in changes to the masks that print gates onto a chip. FPGAs, or field programmable gate arrays, can be reprogrammed with no additional cost.
Most FPGAs are put in "smart" devices that also contain a processor (often ARM), memory, and drive (often flash). These smart devices run an embedded operating system, often Linux. The gate-array exists as a file on the drive. The file is read from the drive and written to the FPGA every time the power is turned on.
The obvious concern here is protecting intellectual-property. Competitors can easily get their hands on that file, then upload to their own FPGAs, thus cloning the product.
Therefore, to protect intellectual-property, this file can be encrypted. The FPGA can be configured with an AES 128-bit encryption key, known only to the manufacturer of the device. That makes the file useless to anybody else. Nobody can decrypt the contents to find the secrets, and competitors can download it to their own FPGAs without the keys.
While intended to protect intellectual-property, this technique will protect any other secrets. For example, you may use the FPGA as an SSL accelerator in your servers, where the FPGA executes the RSA encryption algorithm, with the private-key stored as part of the gate-array. This technique stops hackers from stealing the private-key should they be able to break into the server.
This encryption also serves as an integrity check, as it prevents hackers from changing the gate-array to do something malicious.
Obviously, a JTAG backdoor subverts all this. It not only allows the original manufacturer to steal intellectual-property, but any other secrets you tried to protect with the original AES key.
How this bug was found
This bug was found by fuzzing the JTAG port looking for undocumented functionality. While there are parts of this process unique to hardware (such as differential power analysis), the technique is ultimately little different than the fuzzing used to find software bugs.
Fuzzing has found backdoors in software before, but nobody claimed it was the work of the evil Chinese. We should keep this perspective.
This is not a "military chip
Much has been made about this being a "military" chip, but that's not true -- at least, it's not what you think.
The military uses a lot of commercial, off-the-shelf products. That doesn't mean there is anything special about it. A million soldiers use laptops to browse Facebook and exchange emails with their loved ones. It doesn't mean that these laptops are anything special or different than any other laptops. They are same Dell, Apple, and HP laptops that everyone else uses.
Sometimes the laptops are different, but that's because they are built to endure harsh environments (heat, radiation, humidity, vibration, and dust). Actel makes a "military" version of this chip, but pretty much the only difference is that it's rated to operate at higher temperatures. None of their chips, including the "military" ones, are certified by the government to hold secrets. Most of their sales are for their non-military versions, and even most of their military versions aren't for military use, but by customers (like oil rigs or airplanes) that have the same environmental concerns.
That's not to say there isn't a problem here. Consider something like the drones shot down by Iran. By their very nature, drones are designed from many non-secret, off-the-shelf components (you might find an iPhone buried somewhere inside). The reason is that they are designed to be cheap, to be frequently lost while flying over the enemy. Thus, it's likely that one of these FPGAs was inside the drone shot down by Iran. While it's unlikely the FPGA had any secrets worthwhile, issues like this make it easier for Iran to reverse engineer the drone and manufacture their own.
So what does this mean?
It's hard to say. We'll know more when the vendor (Microsemi/Actel) issues a response.
It could just be part of the original JTAG building-block. Actel didn't design their own, but instead purchased the JTAG design and placed it on their chips. They are not aware of precisely all the functionality in that JTAG block, or how it might interact with the rest of the system.
But I'm betting that Microsemi/Actel know about the functionality, but thought of it as a debug feature, rather than a backdoor.
It's remotely possible that the Chinese manufacturer added the functionality, but highly improbable. It's prohibitively difficult to change a chip design to add functionality of this complexity. On the other hand, it's easy for a manufacturer to flip bits. Consider that the functionality is part of the design, but that Actel intended to disable it by flipping a bit turning it off. A manufacturer could easily flip a bit and turn it back on again. In other words, its extraordinarily difficult to add complex new functionality, but they may get lucky and be able to make small tweaks to accomplish their goals.
In the software world, security flaws that hackers use generally result from researchers doing the unexpected. In this case, researchers found a new way of analyzing chips, and therefore, found new unexpected results. This is to be expected. We shouldn't be surprised by this backdoor, but we should insist on fixing it. And researchers will not probably hunt for similar JTAG backdoors in other chips.
Conclusion
We'll know more when Microsemi/Actel responds. In the meantime, it's important to note that while the researchers did indeed discover a backdoor, they offer only speculation, but no evidence, as to the source of the backdoor. As somebody with a lot of experience with this sort of thing in software cybersecurity, I doubt there is anything malicious behind it. Also note that the issue is "intellectual property protection" in FPGAs; the "military security" angle is really distant. The Chinese might subvert FPGAs so that they could later steal intellectual-property written to the chips, but the idea they went through all this to attack the US military is pretty fanciful.
Update: the researchers respond
In this article, the researchers respond to this post. It's a bit humorous, because they simultaneously say that the issues their research exposes are "[Trustworthiness] of chip developers who are subcontracted by military but mainly outsource their designs and chip fabrication to China and India" and "we have no idea why people have linked the Chinese to this as it did not come from us". The link to the Chinese came directly from them. Likewise, they deliberately distort people's misconception about the military. The truth is that the military cares about operating at high temperatures, and that in most applications, could care less if the intellectual property was stolen, or if the chip was backdoored.
Update: By the way, I've been accused of putting a backdoor in products the military uses in one high-profile incident (the accusation being nonsense, of course). I guess that makes me an expert in "backdooring the military" of some sort.Update: Over at YCombinator, somebody points out that changes aren't quite as expensive as I thought, because instead of changing the entire mask set, you can change only a single metal layer in order to enable/disable things.Update: In the comments below, Olin Sebert makes a strong argument that while the backdoor may be accidental, Actel's explicit marketing of the device as having no readback capability is evil.Update: Many have pointed out that the current paper does explicitly make the claim that the Chinese were involved. True, but they do their best to hype that danger. Their first references [1] is to a Taxonomy of trojans a Chinese manufacturer might insert into chips, and the page at Cambridge's website announcing the paper draws that conclusion. Moreover, the paper describes the chip as "military grade", but it is in fact only "consumer grade". All the press generated by the paper took the Chinese angle, and it's the paper's authors who are responsible for that.
Backdoors are common, but rarely malicious
Backdoors are a common problem in software. About 20% of home routers have a backdoor in them, and 50% of industrial control computers have a backdoor. The cause of these backdoors isn't malicious, but a byproduct of software complexity. Systems need to be debugged before being shipped to customers. Therefore, the software contains debuggers. Often, programmers forget to disable the debugger backdoors before shipping. This problem is notoriously bad for all embedded operating systems (VxWorks, QNX, WinCE, etc.).
Chips have reached the software level of complexity. It is rare that any designer builds a chip from scratch. Instead, designers construct a chip from building-blocks. One of the most common building-blocks is the debugger, known as JTAG. This is a standard way of soldering some wires to the chip and connecting to the USB port, allowing common tools to debug your custom chip.
Whereas companies (should) disable the debug feature in the version they send to customers, that's not so easy with chips. It requires millions of dollars for every change to chip design. Therefore, chips always have the JTAG interface enabled. What chip designers attempt to do is just not connect the pins to it. Or, if they connect the pins, they don't route to the pins on the circuit board.
This has led to a popular hacking activity of taking a device, finding the JTAG pins, and hooking them up. A lot of devices have been hacked this way – although it requires that the hacker have physical control over the device.
One way to protect against this is by putting a key into the JTAG hardware that only the manufacturer knows, to disable some of the more dangerous JTAG commands. That's what appears to have happened here. Whether you call this a security feature to prevent others from hacking the chip through JTAG, or a secret backdoor available only to the manufacturer, is open to interpretation.
Security of FPGAs
The chip in question (Microsemi/Actel ProASIC3) is a typical FPGA – a chip with a blank array of gates that can be programmed to emulate almost any other kind of chip. As real silicon chips are becoming more expensive to manufacturer, FPGAs are becoming a more popular alternative. Every change to a chip design requires millions of dollars in changes to the masks that print gates onto a chip. FPGAs, or field programmable gate arrays, can be reprogrammed with no additional cost.
Most FPGAs are put in "smart" devices that also contain a processor (often ARM), memory, and drive (often flash). These smart devices run an embedded operating system, often Linux. The gate-array exists as a file on the drive. The file is read from the drive and written to the FPGA every time the power is turned on.
The obvious concern here is protecting intellectual-property. Competitors can easily get their hands on that file, then upload to their own FPGAs, thus cloning the product.
Therefore, to protect intellectual-property, this file can be encrypted. The FPGA can be configured with an AES 128-bit encryption key, known only to the manufacturer of the device. That makes the file useless to anybody else. Nobody can decrypt the contents to find the secrets, and competitors can download it to their own FPGAs without the keys.
While intended to protect intellectual-property, this technique will protect any other secrets. For example, you may use the FPGA as an SSL accelerator in your servers, where the FPGA executes the RSA encryption algorithm, with the private-key stored as part of the gate-array. This technique stops hackers from stealing the private-key should they be able to break into the server.
This encryption also serves as an integrity check, as it prevents hackers from changing the gate-array to do something malicious.
Obviously, a JTAG backdoor subverts all this. It not only allows the original manufacturer to steal intellectual-property, but any other secrets you tried to protect with the original AES key.
How this bug was found
This bug was found by fuzzing the JTAG port looking for undocumented functionality. While there are parts of this process unique to hardware (such as differential power analysis), the technique is ultimately little different than the fuzzing used to find software bugs.
Fuzzing has found backdoors in software before, but nobody claimed it was the work of the evil Chinese. We should keep this perspective.
This is not a "military chip
Much has been made about this being a "military" chip, but that's not true -- at least, it's not what you think.
The military uses a lot of commercial, off-the-shelf products. That doesn't mean there is anything special about it. A million soldiers use laptops to browse Facebook and exchange emails with their loved ones. It doesn't mean that these laptops are anything special or different than any other laptops. They are same Dell, Apple, and HP laptops that everyone else uses.
Sometimes the laptops are different, but that's because they are built to endure harsh environments (heat, radiation, humidity, vibration, and dust). Actel makes a "military" version of this chip, but pretty much the only difference is that it's rated to operate at higher temperatures. None of their chips, including the "military" ones, are certified by the government to hold secrets. Most of their sales are for their non-military versions, and even most of their military versions aren't for military use, but by customers (like oil rigs or airplanes) that have the same environmental concerns.
That's not to say there isn't a problem here. Consider something like the drones shot down by Iran. By their very nature, drones are designed from many non-secret, off-the-shelf components (you might find an iPhone buried somewhere inside). The reason is that they are designed to be cheap, to be frequently lost while flying over the enemy. Thus, it's likely that one of these FPGAs was inside the drone shot down by Iran. While it's unlikely the FPGA had any secrets worthwhile, issues like this make it easier for Iran to reverse engineer the drone and manufacture their own.
So what does this mean?
It's hard to say. We'll know more when the vendor (Microsemi/Actel) issues a response.
It could just be part of the original JTAG building-block. Actel didn't design their own, but instead purchased the JTAG design and placed it on their chips. They are not aware of precisely all the functionality in that JTAG block, or how it might interact with the rest of the system.
But I'm betting that Microsemi/Actel know about the functionality, but thought of it as a debug feature, rather than a backdoor.
It's remotely possible that the Chinese manufacturer added the functionality, but highly improbable. It's prohibitively difficult to change a chip design to add functionality of this complexity. On the other hand, it's easy for a manufacturer to flip bits. Consider that the functionality is part of the design, but that Actel intended to disable it by flipping a bit turning it off. A manufacturer could easily flip a bit and turn it back on again. In other words, its extraordinarily difficult to add complex new functionality, but they may get lucky and be able to make small tweaks to accomplish their goals.
In the software world, security flaws that hackers use generally result from researchers doing the unexpected. In this case, researchers found a new way of analyzing chips, and therefore, found new unexpected results. This is to be expected. We shouldn't be surprised by this backdoor, but we should insist on fixing it. And researchers will not probably hunt for similar JTAG backdoors in other chips.
Conclusion
We'll know more when Microsemi/Actel responds. In the meantime, it's important to note that while the researchers did indeed discover a backdoor, they offer only speculation, but no evidence, as to the source of the backdoor. As somebody with a lot of experience with this sort of thing in software cybersecurity, I doubt there is anything malicious behind it. Also note that the issue is "intellectual property protection" in FPGAs; the "military security" angle is really distant. The Chinese might subvert FPGAs so that they could later steal intellectual-property written to the chips, but the idea they went through all this to attack the US military is pretty fanciful.
Update: the researchers respond
In this article, the researchers respond to this post. It's a bit humorous, because they simultaneously say that the issues their research exposes are "[Trustworthiness] of chip developers who are subcontracted by military but mainly outsource their designs and chip fabrication to China and India" and "we have no idea why people have linked the Chinese to this as it did not come from us". The link to the Chinese came directly from them. Likewise, they deliberately distort people's misconception about the military. The truth is that the military cares about operating at high temperatures, and that in most applications, could care less if the intellectual property was stolen, or if the chip was backdoored.
Update: By the way, I've been accused of putting a backdoor in products the military uses in one high-profile incident (the accusation being nonsense, of course). I guess that makes me an expert in "backdooring the military" of some sort.Update: Over at YCombinator, somebody points out that changes aren't quite as expensive as I thought, because instead of changing the entire mask set, you can change only a single metal layer in order to enable/disable things.Update: In the comments below, Olin Sebert makes a strong argument that while the backdoor may be accidental, Actel's explicit marketing of the device as having no readback capability is evil.Update: Many have pointed out that the current paper does explicitly make the claim that the Chinese were involved. True, but they do their best to hype that danger. Their first references [1] is to a Taxonomy of trojans a Chinese manufacturer might insert into chips, and the page at Cambridge's website announcing the paper draws that conclusion. Moreover, the paper describes the chip as "military grade", but it is in fact only "consumer grade". All the press generated by the paper took the Chinese angle, and it's the paper's authors who are responsible for that.
HP dm1z $350 perfect for BackTrack 5r2
To contact us Click HERE
I have a hard time recommending HP laptops because they are hostile to geeks (for example, you can't replace the built-in mini WiFi card), but the dm1z laptop from HP is otherwise a great computer for running hacker tools like BackTrack Linux (a distro that comes with all the open-source hacking tools). Right now, you can get one at Dealzon for $350, probably because HP is clearing inventory to make way for a new model.
What makes the dm1z great is its small size, being only a 3.5-pound 11.6-inch unit, yet having an extremely long battery life. For pentesters, this is awesome. It's not a good primary machine, but such cheap/small units make great secondary machines (my primary machine is a MacBook Air running Windows). It's low price means we don't mind leaving it in harms way, such as at a customer site in the bushes sniffing WiFi.
But at the same time, it does a pretty good job keeping up with the larger notebook computers. The three features that set it above competing small netbooks is gigabit Ethernet, a full GPU, and 8-gigs of RAM. The CPU, however, is anemic -- but except for password cracking (which runs great on the GPU) there is nothing we do that is CPU intensive.
Gigabit Ethernet
The reason I use the dm1z compared to other Atom-based netbooks is its gigabit Ethernet. Other small computers have only 100-mbps Ethernet. This may seem like an unimportant feature, yet it keeps turning up.
I commonly leave the unit at a customer's site connected sniffing an important link to an encrypted drive. While these connections are usually less than 10-mbps, they often peak above 100-mbps. This causes packet loss on a normal system with 100-mbps Ethernet, but is handled by the gigabit Ethernet in the dm1z. It's only a RealTek chip with crappy drivers for Linux (though I hear it has good drivers for FreeBSD), so it's not going to keep up with too fast a network, but it still does a lot more than 100-mbps.
I also use this as a tool for generating HTTP load against web-servers, to test their scalability. Even with a scalable webserver like Nginx and Lighthttpd, you still have to go through a lot of configuration of the server an the underlying OS to make it actually scale. Having a convenient load tester in my pocket really helps.
Finally, there is just the normal case of having to transfer files to/from the device. This d1mz can do this at a full 1-gbps. This would be painfully slow over 100-mbps. This means that the little computer can act as an efficient file-server for your home network.
GPU
The CPU is weak, but the main processor doesn't matter so much as the graphics processor (GPU that's integrated on-die. This runs oclHashcat pretty well for password cracking. It's not as fast desktop GPUs, of course, but it's as fast as the low-end gaming laptops. The WPA cracking tool pyrit also works quite well with it.
Note that Radeon graphics are consistently faster than nVidia GeForce GPUs for password cracking. This makes the dm1z better for password-cracking than competing netbooks using an Atom+nVidia combination, and even faster than high-end gaming laptops based on mobile versions of GeForce.
The system can run the password cracking for hours while on battery power - being integrated right on the CPU makes the GPU very power efficient.
CPU
The device uses an AMD "Bobcat" CPU, which is AMD's answer to Intel's low-power "Atom" CPU. It's a dual-core 1.3-GHz processor (dual-issue, out-of-order). It's about as fast as an Intel Atom, but not as power efficient.
It is 64-bit, though. I eventually upgraded and put 8-gigs of RAM in the box from the original 4-gigs that I purchased with the system.
Opening the case
Popping off the back is easy, and it allows you to upgrade the RAM (to 4gigs) or upgrade the hard drive or replace it with an SSD.
The thing that really annoyed me is that you cannot change the miniPCIe cards. There are two slots for them. HP's BIOS checks the identifier of the card and refuses to boot if an unknown card is in the slot. Apparently, you can get hacked BIOSes from the Internet that get around this, but I don't want to waste my time.
Luckily, BackTrack 5 r2 has all the necessary drivers, so the existing WiFi card works now.
Driver support
The latest BackTrack 5 r2 has all the necessary drivers. You still have to download the proprietary Radeon drives for password cracking, though. (The older BackTrack 5 wouldn't even boot correctly).
The one annoyance is that the mouse drivers aren't configured correctly. The mousepad doesn't have buttons, you have to press down on the pad itself. But then, this moves the mouse, so you end up clicking somewhere else. You have to learn to move with your finger (capacitive), then click with your fingernail (non-capacitive). Or use an external mouse.
3 USB ports
For WiFi hacking, it's got three USB ports. This makes it convenient for hooking up three Alfa adapters. Plus you have the built-in WiFi as well.
Partitioning the drive
I wanted to leave the existing partitions intact, but it already comes with too many partitions (Windows, Windows recovery, special Linux fast boot to browser). I had to fiddle around a bit to make things work.
Buying Guide
Get the cheapest options you can and upgrade them yourself.
The unit ships with a 4-gig DIMM. Instead of paying $120 to upgrade, go to Crucial.com and pay $22 for an extra DIMM.
Paying HP an extra $30 to upgrade from 320gig to 500gig hard-drive is better than buying a 500gig drive yourself for $70, but if I wanted to upgrade the drive, I'd probably go to 750gigs at $90 or 1-terabyte for $120.
Or I'd go for an SSD, where prices have dropped to $1 per gig. HP sells a 160gig SSD, but for $320, which is a bad idea. I'd go for a 60gig SSD for $60.
My unit has the older E-300 CPU at 1.3 GHz, but for $25 you can get the E-450 at 1.65 GHz, with also makes the GPU faster. But the whole point is getting the cheapest, most disposable system. If you need more CPU power, then getting a dm1-4170us instead with a dual-core Core i3 processor for $120 more will blow away the Bobcat processor.
Conclusion
This has proven to be an excellent netbook over the last year. I hate to recommend any HP products, because of the way it locks me out from choosing a different miniPCIe card, but it's otherwise been an excellent system. They are available for $350 on closeout right now, so I'd recommend picking one up.
Below is a picture of the dm1z in an action shot on the beach in the Caribbean. I didn't want to take my primary laptop due to fears of sand getting in it, and it getting stolen, so I took the dm1z instead. If you look closely, you can see the BackTrack background on it. This does highlight the fact that the screen sucks in bright sunlight (whereas my MacBook is pretty good in sunlight), but it's a cheap netbook, so that's what you expect..JPG)
What makes the dm1z great is its small size, being only a 3.5-pound 11.6-inch unit, yet having an extremely long battery life. For pentesters, this is awesome. It's not a good primary machine, but such cheap/small units make great secondary machines (my primary machine is a MacBook Air running Windows). It's low price means we don't mind leaving it in harms way, such as at a customer site in the bushes sniffing WiFi.
But at the same time, it does a pretty good job keeping up with the larger notebook computers. The three features that set it above competing small netbooks is gigabit Ethernet, a full GPU, and 8-gigs of RAM. The CPU, however, is anemic -- but except for password cracking (which runs great on the GPU) there is nothing we do that is CPU intensive.
Gigabit Ethernet
The reason I use the dm1z compared to other Atom-based netbooks is its gigabit Ethernet. Other small computers have only 100-mbps Ethernet. This may seem like an unimportant feature, yet it keeps turning up.
I commonly leave the unit at a customer's site connected sniffing an important link to an encrypted drive. While these connections are usually less than 10-mbps, they often peak above 100-mbps. This causes packet loss on a normal system with 100-mbps Ethernet, but is handled by the gigabit Ethernet in the dm1z. It's only a RealTek chip with crappy drivers for Linux (though I hear it has good drivers for FreeBSD), so it's not going to keep up with too fast a network, but it still does a lot more than 100-mbps.
I also use this as a tool for generating HTTP load against web-servers, to test their scalability. Even with a scalable webserver like Nginx and Lighthttpd, you still have to go through a lot of configuration of the server an the underlying OS to make it actually scale. Having a convenient load tester in my pocket really helps.
Finally, there is just the normal case of having to transfer files to/from the device. This d1mz can do this at a full 1-gbps. This would be painfully slow over 100-mbps. This means that the little computer can act as an efficient file-server for your home network.
GPU
The CPU is weak, but the main processor doesn't matter so much as the graphics processor (GPU that's integrated on-die. This runs oclHashcat pretty well for password cracking. It's not as fast desktop GPUs, of course, but it's as fast as the low-end gaming laptops. The WPA cracking tool pyrit also works quite well with it.
Note that Radeon graphics are consistently faster than nVidia GeForce GPUs for password cracking. This makes the dm1z better for password-cracking than competing netbooks using an Atom+nVidia combination, and even faster than high-end gaming laptops based on mobile versions of GeForce.
The system can run the password cracking for hours while on battery power - being integrated right on the CPU makes the GPU very power efficient.
CPU
The device uses an AMD "Bobcat" CPU, which is AMD's answer to Intel's low-power "Atom" CPU. It's a dual-core 1.3-GHz processor (dual-issue, out-of-order). It's about as fast as an Intel Atom, but not as power efficient.
It is 64-bit, though. I eventually upgraded and put 8-gigs of RAM in the box from the original 4-gigs that I purchased with the system.
Opening the case
Popping off the back is easy, and it allows you to upgrade the RAM (to 4gigs) or upgrade the hard drive or replace it with an SSD.
The thing that really annoyed me is that you cannot change the miniPCIe cards. There are two slots for them. HP's BIOS checks the identifier of the card and refuses to boot if an unknown card is in the slot. Apparently, you can get hacked BIOSes from the Internet that get around this, but I don't want to waste my time.
Luckily, BackTrack 5 r2 has all the necessary drivers, so the existing WiFi card works now.
Driver support
The latest BackTrack 5 r2 has all the necessary drivers. You still have to download the proprietary Radeon drives for password cracking, though. (The older BackTrack 5 wouldn't even boot correctly).
The one annoyance is that the mouse drivers aren't configured correctly. The mousepad doesn't have buttons, you have to press down on the pad itself. But then, this moves the mouse, so you end up clicking somewhere else. You have to learn to move with your finger (capacitive), then click with your fingernail (non-capacitive). Or use an external mouse.
3 USB ports
For WiFi hacking, it's got three USB ports. This makes it convenient for hooking up three Alfa adapters. Plus you have the built-in WiFi as well.
Partitioning the drive
I wanted to leave the existing partitions intact, but it already comes with too many partitions (Windows, Windows recovery, special Linux fast boot to browser). I had to fiddle around a bit to make things work.
Buying Guide
Get the cheapest options you can and upgrade them yourself.
The unit ships with a 4-gig DIMM. Instead of paying $120 to upgrade, go to Crucial.com and pay $22 for an extra DIMM.
Paying HP an extra $30 to upgrade from 320gig to 500gig hard-drive is better than buying a 500gig drive yourself for $70, but if I wanted to upgrade the drive, I'd probably go to 750gigs at $90 or 1-terabyte for $120.
Or I'd go for an SSD, where prices have dropped to $1 per gig. HP sells a 160gig SSD, but for $320, which is a bad idea. I'd go for a 60gig SSD for $60.
My unit has the older E-300 CPU at 1.3 GHz, but for $25 you can get the E-450 at 1.65 GHz, with also makes the GPU faster. But the whole point is getting the cheapest, most disposable system. If you need more CPU power, then getting a dm1-4170us instead with a dual-core Core i3 processor for $120 more will blow away the Bobcat processor.
Conclusion
This has proven to be an excellent netbook over the last year. I hate to recommend any HP products, because of the way it locks me out from choosing a different miniPCIe card, but it's otherwise been an excellent system. They are available for $350 on closeout right now, so I'd recommend picking one up.
Below is a picture of the dm1z in an action shot on the beach in the Caribbean. I didn't want to take my primary laptop due to fears of sand getting in it, and it getting stolen, so I took the dm1z instead. If you look closely, you can see the BackTrack background on it. This does highlight the fact that the screen sucks in bright sunlight (whereas my MacBook is pretty good in sunlight), but it's a cheap netbook, so that's what you expect.
Tuning Linux: TCP hash entries
To contact us Click HERE
Tuning Linux for scalable network applications is hard, partly because it's not documented anywhere. Or if it is, all the top Google results are for old versions of Linux. For example, the TUNABLE file of (I supposed) tunable parameters goes back to the 1.x version of the Linux kernel, even though we are now on version 3.4.One important parameter is the number of TCP hash entries. When a TCP packet arrives, the kernel needs to do a lookup to find which connection the packet belongs to. This is done with a typical hash table. If the hash table is too small, you'll get "hash collisions", requiring several memory lookups before you reach the correct entry. In a scalable system, each memory lookup costs 300 clock cycles.The parameter that controls this is for Linux is "thash_entries=" which you set as a typical boot parameter. The default is 65536 entries for every gigabyte of memory. In other words, an 8-gigabyte system will have 512k hash entries. You can find out many your current system has by doing "dmesg | grep "TCP established hash table entries"This is probably more than enough for even the most scalable systems, so I doubt that you need to change it. That's probably why it was so hard finding the stupid parameter -- while it's a common issue for most operating systems, Linux automatically chooses a number that's big enough, so nobody cares about configuring it on Linux.Now, after rummaging around in the Linux stack, I feel dirty, and am off to go take a shower ...
Update: The equivalent Solaris parameter is tcp_conn_hash_size. I include the name here for people searching for the Linux equivalent of the Solaris parameter.Update: Other useful boot options:
Update: The equivalent Solaris parameter is tcp_conn_hash_size. I include the name here for people searching for the Linux equivalent of the Solaris parameter.Update: Other useful boot options:
- hugepages
- Reserves the specific number of 2-megabyte TLB pages. Allocating hugepages after boot can be difficult, because memory will be fragmented by allocating/deleting 4096-byte pages. Thus, reserve this number at boot time for use by your application when it starts after boot.
Confirmed: LinkedIn 6mil password dump is real
To contact us Click HERE
Today's news is that 6 million LinkedIn password hashes were dumped to the Internet. I can confirm this hack is real: the password I use for LinkedIn is in that list. I use that password NOWHERE ELSE. Furthermore, it's long/complex enough that I'm confident NOBODY ELSE uses the same password. Other security pros are reporting the same result. Therefore, we can confirm that this hack is real.
The way I tested to see if my password was in the list was to first generate a SHA-1 hash of my password, then I searched in the file "combo_not.txt" that I downloaded from the Internet containing the 6 million password hashes. I found a match.
To make it easy to calculate your SHA-1 password, I've included a form below. This is done in JavaScript inside your browser, it does not submit your password/hash to me or anybody else:
Many of the hashes have their first few digits zeroed out (as described in this ycombinator post) as shown in the this excerpt from the file:
Also note that if your password is long enough (like greater than 15 characters) and complex enough, then it's still probably safe. A 15 character SHA-1 password composed of upper/lower case with symbols and digits is too large for "brute-force" and "rainbow tables". However, if you've composed it of dictionary words, then it could fall to a "mutated dictionary" attack.Update: the following link is a pointer to a download of the file, which by the time you read this, is almost certainly been removed https://disk.yandex.net/disk/public/?hash=pCAcIfV7wxXCL/YPhObEEH5u5PKPlp%2BmuGtgOEptAS4%3DUpdate: This is a sorted list of unique passwords. Thus, if 50 people use the password "password", it'll only show up once in this list. Which it does. The password of "password" is hashed using SHA-1 to "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", which appears as "000001e4c9b93f3f0682250b6cf8331b7ee68fd8" in this list.Update: Where do these passwords come from? The answer is the: the cracking underground. When hackers break into a network and steal the encrypted passwords, they crack as many as they can, and then exchange the dumps with their friends. Each hacker uses different tools, uses different dictionaries, and so on. Thus, once they've exhausted your their techniques, another hacker is still likely to be able to crack many more passwords.Update: It took me only a couple minutes to verify that this hack is real, yet LinkedIn has not been able to:
This reflects poorly on the trustworthiness of LinkedIn. It's proper that you make such a comment before you know what's going on, but they've had hours to verify this, we should've gotten an update by now.Update:LinkedIn has a semi-confirmation as explained in their blogpost here. However, it only says they confirm that some of the passwords that were compromised correspond to LinkedIn accounts. That avoids accepting blame, after all, in other prominent password attacks (like one recently against Twitter), the source of the hack was not Twitter's fault, but due to "password reuse", as users used the same password for Twitter that they used for other websites, and it's the other websites that were hacked. As I (and other security pros) have confirmed, we don't reuse passwords. This password list comes from LinkedIn, and from no other source.Update: How fast can hackers crack passwords? The answer "2 billion per second" using the Radeon HD 7970 (the latest top-of-the-line graphics processor). Each letter of a password has 100 combinations (UPPER, lower, d1g1ts, $ymbols). A 5 letter password therefore has 100 x 100 x 100 x 100 x 100 or 10 billion combinations, meaning it can be cracked in 5 seconds. A 6 letter password has 100 times that, or 500 seconds. A 7 letter password has 100 times that, or 50,000 seconds, or 13 hours. An 8 character password is roughly 57 days. A 9 character password is 100 times that, about 15 years. In other words, if your password was 7 letters, the hacker has already cracked it, but if it's 9 letters, it's too difficult to crack with brute force.Update: A site http://leakedin.org will check this for you. They claim to has the password in the browser (like I do above), then check the database. I don't know if this is true -- but since you are going to change your password regardless, maybe it doesn't matter.Update: What does password cracking look like? I started the "hashcat" tool to examine the file. It looks like this:
I'm using the latest Radeon HD 7970 graphics card. Note that I'm only getting a cracking rate of 400-million passwords/second, while the 7970 can actually do 2-billion/second. That's because I'm doing "multi-hash" cracking, testing each hash against the entire original list of 6.5 million hashes. That lookup takes longer than calculating the hash in the first place. I can dramatically increase hashing speed by first removing all the easily cracked passwords from the list, making it smaller, and hence making lookups faster.
The way I tested to see if my password was in the list was to first generate a SHA-1 hash of my password, then I searched in the file "combo_not.txt" that I downloaded from the Internet containing the 6 million password hashes. I found a match.
To make it easy to calculate your SHA-1 password, I've included a form below. This is done in JavaScript inside your browser, it does not submit your password/hash to me or anybody else:
Many of the hashes have their first few digits zeroed out (as described in this ycombinator post) as shown in the this excerpt from the file:
...000000a9da36caf22886a0203caa29e7d2631174000000a9d9ccfdca4d241e44d415c15dba0b4c28000000a9298b1bfc8d1237d6f3995b2d2625ce3a000000a92ee7725afdcac707d22e2333531f9e51000000a92dbec5cff02bfa678a0f7a78b6a46573323300a988286c019e2dcc3100b355557257f632923b00a9574dd89143cde9db87871890a1082bc23c4400a900d31c9634e355e18975f8cfe710ab7d354b00a96d36f0c48d0c286b29120f8409e3bde1405700a93eac557d85d2f1347db8f9a312557fc8...This means instead of searching for the complete SHA-1 output, you want to search for just the later part of the hash. People think that this means that the hacker has already cracked any passwords that have been zeroed out this way, which means that if you see zeroes in your matching password, then your password is already stolen.
Also note that if your password is long enough (like greater than 15 characters) and complex enough, then it's still probably safe. A 15 character SHA-1 password composed of upper/lower case with symbols and digits is too large for "brute-force" and "rainbow tables". However, if you've composed it of dictionary words, then it could fall to a "mutated dictionary" attack.Update: the following link is a pointer to a download of the file, which by the time you read this, is almost certainly been removed https://disk.yandex.net/disk/public/?hash=pCAcIfV7wxXCL/YPhObEEH5u5PKPlp%2BmuGtgOEptAS4%3DUpdate: This is a sorted list of unique passwords. Thus, if 50 people use the password "password", it'll only show up once in this list. Which it does. The password of "password" is hashed using SHA-1 to "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", which appears as "000001e4c9b93f3f0682250b6cf8331b7ee68fd8" in this list.Update: Where do these passwords come from? The answer is the: the cracking underground. When hackers break into a network and steal the encrypted passwords, they crack as many as they can, and then exchange the dumps with their friends. Each hacker uses different tools, uses different dictionaries, and so on. Thus, once they've exhausted your their techniques, another hacker is still likely to be able to crack many more passwords.Update: It took me only a couple minutes to verify that this hack is real, yet LinkedIn has not been able to:
Our team continues to investigate, but at this time, we're still unable to confirm that any security breach has occurred. Stay tuned here.
— LinkedIn (@LinkedIn) June 6, 2012
This reflects poorly on the trustworthiness of LinkedIn. It's proper that you make such a comment before you know what's going on, but they've had hours to verify this, we should've gotten an update by now.Update:LinkedIn has a semi-confirmation as explained in their blogpost here. However, it only says they confirm that some of the passwords that were compromised correspond to LinkedIn accounts. That avoids accepting blame, after all, in other prominent password attacks (like one recently against Twitter), the source of the hack was not Twitter's fault, but due to "password reuse", as users used the same password for Twitter that they used for other websites, and it's the other websites that were hacked. As I (and other security pros) have confirmed, we don't reuse passwords. This password list comes from LinkedIn, and from no other source.Update: How fast can hackers crack passwords? The answer "2 billion per second" using the Radeon HD 7970 (the latest top-of-the-line graphics processor). Each letter of a password has 100 combinations (UPPER, lower, d1g1ts, $ymbols). A 5 letter password therefore has 100 x 100 x 100 x 100 x 100 or 10 billion combinations, meaning it can be cracked in 5 seconds. A 6 letter password has 100 times that, or 500 seconds. A 7 letter password has 100 times that, or 50,000 seconds, or 13 hours. An 8 character password is roughly 57 days. A 9 character password is 100 times that, about 15 years. In other words, if your password was 7 letters, the hacker has already cracked it, but if it's 9 letters, it's too difficult to crack with brute force.Update: A site http://leakedin.org will check this for you. They claim to has the password in the browser (like I do above), then check the database. I don't know if this is true -- but since you are going to change your password regardless, maybe it doesn't matter.Update: What does password cracking look like? I started the "hashcat" tool to examine the file. It looks like this:
I'm using the latest Radeon HD 7970 graphics card. Note that I'm only getting a cracking rate of 400-million passwords/second, while the 7970 can actually do 2-billion/second. That's because I'm doing "multi-hash" cracking, testing each hash against the entire original list of 6.5 million hashes. That lookup takes longer than calculating the hash in the first place. I can dramatically increase hashing speed by first removing all the easily cracked passwords from the list, making it smaller, and hence making lookups faster.
Kaydol:
Kayıtlar (Atom)