Like last year’s challenge, this year’s challenge (imho) is another lame attempt at publicity.
The cipher is presented in a SWF -
FWTDLCSWV. YD
NSLMIJFWEJFD GSW SL
NIJNQBLM FOBV EJFDVF
DLNIGTFBSL. KBVBF
YYY.AHB.MSK/NSCDC.OFZ
FS EDF WV QLSY SA
GSWI VWNNDVV.
It’s a simple substitution cipher that gives -
stupendous. we
congratulate you on
cracking this latest
encryption. visit
www.fbi.gov/coded.htm
to let us know of
your success.
Not exactly “latest encryption”. 
No, the above image does not have anything to do with what I’m going to blog about. I just find it creative and amusing.
Well anyways, MetaSploit Framework 3.2 is released. Almost all modules have IPv6 support now and there’s a bunch of other cool new updates. Be sure to check it out!
As a side note, Onn Chee has pointed out in the security meetup mailing list, a presentation by Tim Bass on the insecurity of proxy caches. See his blog post and his presentation (presented at OWASP AppSec Asia 2008). It’s a good read.
Yesterday, I read at Hacking Truths, an article entitled Delete an “UnDeletable” File. I largely disagree with the post and am thus making a post on how to delete most “undeletable” files on Windows systems.
Die, file, DIE!!!
Access Denied
Cannot delete file: Cannot read from soruce file or disk
There has been a sharing violation
The source or desination file may be in use
The file is in use by another program or user
Make sure the disk is not full or write-protected and that the file is not currently in use
Usually, these error messages occur when another process is accessing the file, with or without you knowing it. However, Windows does have its false-detection times. Below are some methods that may assist you -
1. AUTOEXEC.BAT is your best friend
Windows, by default, includes a file called AUTOEXEC.BAT in your Windows root drive (C:\ by default). The .BAT extension refers to a MSDOS batch file and the file is executed right before a user logs on. In prior versions of Windows (Windows 95, Windows 98, Windows ME) executed AUTOEXEC.BAT right after Windows has booted up and CONFIG.SYS loaded. It is usually used to set environment variables and initiate drivers. This means that the file is run before any process starts.
Simply edit your AUTOEXEC.BAT file and include, on the first line -
del /s/f/q [Drive]:\[Folder]\[File].[Extension]
For example,
del /s/f/q C:\Unwanted\File.doc
Save it and restart your computer afterwards.
2. Processed misery
If you don’t feel like restarting your computer, you can, of course, attempt to identify the source of your misery and terminate it. 
Enabler is a tool whereby all processes running in the background are shown. It detects all dialogs/windows that are displayed and hidden and allows you to terminate them. If you have good idea of what process is causing your file to be “undeletable”, this might be your solution.
Unlocker is a tool which “unlocks” a file and avails it for deletion. It is much more detailed and suited for file deletion than Enabler, showing you all the processes that are currently using your file, then allowing you to delete the file and even unload a DLL. Highly recommended!
Of course, if the above two methods are too elaborated for your liking, there’s always the Windows Task Manager and the option of ending explorer.exe. That might work for you too.
3. Being attached is tricky
This is something which I have learnt in my experiences of dealing with viruses and their un-terminate-able status. Apparently, processes can be “attached” to another. This particular virus I was trying to get rid of was attached to winlogon.exe, a SYSTEM process which cannot be terminated.
To solve this, use Process Explorer from Winternals (Microsoft). You can suspend the process in question, detatch the malicious bugger, terminate it and resume the process afterwards. Nifty, eh?
I just read that DarkFig from milw0rm released a PHP script that targets multiple vulnerabilities present in Invision Power Board (IPB), versions <= 2.3.5. I run an IPB forum together with a few other people and I noticed that right at the bottom, there’s this little footnote…
In all frustration, I told one of my guys to remove the version from the footer. After all, with almost 50,000 members, half of whom are probably easily irritable and irrational, it wouldn’t take too much of a genius to notice the same things I did and launch an attack.
In defence, he presented me with this argument - displaying the version number shows users that we are diiligent at patching our software, with 2.3.5 being the latest version available and we’ve got it. It gives them the sense of security and the “illusion” that we are responsible forum admins.
This lead me to think - is removing the version number from software that is exposed to the web (including, but not limited to web applications, server operating system, web backend, etc) just security through obscurity? Or is there really more to it?
When people say “security through obscurity is no security at all”, it probably holds true in the long term, whereby the number of attacking attempts and possible vulnerabilities found increases as time passes. In the short term, though, it might be better to always provide yourself with some time buffer. So, I say, spoof / remove version numbers from being displayed.
What are your views?
It has always been traditional that we delete installation folders upon the successful installation of a web application. Well, for me at least. Leaving it where it is (especially with directory listing turned on) is just suicide - possibilities are endless.
- Reset of admin account password
- Flushing of database
- Generation of publicly-accessible database dump
- Etc.
And that’s exactly what will happen to you if you think that you’re safe -
(Of course, I’ve informed the site administrator about it.)
I hope he’s learnt his lesson. And everyone else has learnt from his mistake too.
Edit: Yet another one
You'd think they'd follow instructions. But, no...
And again-
wooooot!
That aside, YourOwnBux has just suffered a full vulnerability disclosure from milw0rm. Expect more of its sites to get hacked pretty soon.