Today, all my hosting problems should have come to an end.
There are just a few small problems left, for example the Wordpress spam plugin isn’t working anymore. So I have temporarily disabled comments, because I was getting fifty spam comments per day, and was sick of deleting them every day.
To be honest, I was kind of busy the last few months so the hosting problem was a great excuse not to post for a while 
I’ll try to keep up from now!
Unfortunately my server died on me last weekend, so I had to spend the weekend on migrating everything to another host….
Everything should be running smoothly now, as I am no longer in charge of the server and have no ways of screwing it up
Two days ago the hackers who release the Zero for owned (maga)’zine’ released the fifth version, ZFO5.
For who do not know what I am talking about, check this link to read it.
Basically they hack some “wannabe” hackers and whitehat hackers which, according to them, are commercial fuckers who do not really help their customers on the long term. I am not going to comment on this statement, but the these guys had another statement that got me thinking:
The very concept of “penetration testing” is fundamentally flawed. The problem
with it is that the penetration tester has a limited set of targets they’re
allowed to attack, while a real attacker can attack anything in order to gain
access to the site/box. So if a site on a shared host is being tested, just
because site1.com is “secure” that does NOT in anyway mean that the server is
secure, because site2.com could easily be vulnerable to all sorts of simple
attacks. The time constraint is another problem. A professional pentester with
a week or two to spend on a client’s network may or may not get into
everything. A real dedicated hacker making the slog who spends a month of
eight hour days WILL get into anything they target. You’re lucky if it even
takes him that long, really.
They have a point here. In most pentest contracts ( at least the ones I know of) companies will only pay for theire most vulnerable or important systems to be pentested. But a blackhat could (easily) hack one of the others that have not been pentested and then he has a totally different attack vector, one the whitehat has not been able to test because of the lack of time and/or money. Besides that in the end everything could be hacked. The only thing that prevents many systems from being hacked is time and the fact that most systems are not worth hacking.
Today I was behind my computer when I received tweets about a severe vulnerability in Microsoft Office Web Components. Although it did not apply to me ( I am not using internet explorer, actually most of the time I am not even using windows ), I figured I had loved this way of information exchange when I was a network/system administrator in a previous job.
In a fairly big network it would have been plausible that every few hours a PC would be infected due to this vulnerability. So the faster the problem is known, the less damage could have been done to the client machines.
I can recommend any system/network administrator to sign-up for a twitter account and follow some security related persons / groups. Reading tweets costs time, but it will spare you time when something bad is on the loose.
Today the Santa Maria Times posted an article about Cyber Warfare, and they even called it a new cold war. Perhaps they are luring people to their website with their sensationally article, because I do not think we are in a new cold war… yet.
Last weeks we have heard of reports of DoS attacks on several US government websites and South-Korea government websites. But there is absolutely no prove that these attacks have been organised by country Cyber warfare agencies from for example Russia or China although a lot of PC’s were located in these countries.
I think it is pretty clear why a lot of DoS involved PC’s where located there. These countries are compared to the western civilisation relatively poor, but they do have PC’s. My guess is that these people do not have money for , or do not want to spend it at, legal software and thus are vulnerable because they do not get (sufficient) updates.
Some investigation on my part supports this: according to statistics at statcounter.com, the windows XP usage is 92% in china, and according to this article 80% of all software in China is pirated .
These machine are an easy target for groups of hackers who want to form a botnet and can then be used to perform the DoS attack. Of course, those hackers could be in service of some government, but I highly doubt that.
If I would be some cyber warfare minister I would upgrade all internet lines to 10 MB/s of all departments in my country and all embasies abroad, get me some servers in data centers abroad so I could tunnel traffic through them and develope an application that should run as a service on every machine in that department.
Why would a country do all effort to get ( and maintain ) a botnet if it already has all necessary means?
Of course, for more covert operations you would like to have a botnet because it is less easy to trace, but for the rest: In a real war you also know who you are up against, so why not in cyberwar?