The Myspace Chat hack

MySpace uses the userplane chat application. It is a flash based chat that works well when it isn't being abused. Unfortunately it is often abused and this is disruptive to anyone in that chat room.

It used to be the people who wished to stop the room from functioning would simply send a screenful of emoticons and it would slow everyone's computer to a crawl and many people simply left. For whatever reason (I can only hope it might have been a security update) that fell out of favor for this new exploit.

What happens now is someone says something only you don't see it. You see their name but nothing after that. Then it simply sits there with your network at 100% usage and cpu at 100%. Refresh the page and it is fine.

So I decided to give this a closer look. I suspected they were using packet editors and knew they weren't all that smart so I decided to ask my favorite guru what the appropriate program to use was and he pointed me to a very good packet logger. I found the packet our little friend sent and it looked a lot like this:

rooms/public/2/dispatch_sosendChatTextGoodbye Room. Soon To Be Destroyed. thank your imature lame fucks who have no life ed and kev have fun mind fucking somthing that can't see you
312088735Bqup

So it looks like he's sending a font with one too many characters to begin with. But is there more to it? Not sure yet. And what is the cure? to filter for a packet containing that string, 0ii6699? That seems a bit wasteful on the client end. I do wonder if that number near the end is the user's MySpace number. No confirmation on that just yet. More testing I guess.
--update: That number is the user number of the chatter.

Don't know.

But there it is. So if your google search led you here because you wonder why the room is freezing, there's what I know. I'd bet they'll be changing that font number regularly.

Edit, I see I can't put the actual breakage in here and have it display, so for those of you paying attention at home it is font color=#<0ii6699>

Turkey day questions and answers

Thusly I posed the question to some of my friends:

did you already kill a turkey for the fam? bow and arrow, or just chase the fucker down and club it?

And thusly some answered:

My friend Dave said, " i stealthly crept up while being careful not to make any eccess noise or movement reached out and grabbed it out of the grocers freezer"

another friend replied, "i let the mother in law do the chasing" but I have to wonder about that one.

what sayeth you, did you already kill a turkey for the fam? bow and arrow, or just chase the fucker down and club it?

Blah blah blah linux blah blah blah open source.

There I said it.

Now I'll extrapolate for those that want to read more.

I've been living in the past. I've been using "Dapper" which is a linux distribution released *gasp* several months ago. Recently I upgraded to the newest release. These are my notes.

Dear Firefox:
Please put the "close tab" button back where it was in 1.5, over on the right for all tabs, not on the tab itself. Practically speaking this helps me close the porn windows much faster when the "close tab" button is in the same spot each time.

:Edit:
About:config -- > browser.tabs.closeButtons set value to 3
All fixed now!

Dear Novell:
When did you get back in the game with "evolution"? I promptly uninstalled evolution in dapper with much trouble, as I am much more adept with thunderbird. I gave it a go this time but damn. novell? didn't that go out with win 3.1?

Dear Open Office:
I love you. I will have your children.

Dear KStars:
Please make a release that doesn't rely on KDE's dependencies and I'll have your children too. I'm a slut that way.


Dear Gimp:
I see you are still the posterchild for "Interface Hell." Someone has to carry the cross. I just wish it wasn't you.

I guess that's all the open letters I have for now. I do notice my system runs more slowly with "Gutsy" than it did with "Dapper" but I can live with that. It isn't the fastest processor on the market and yet it still works well. All in all I have nothing but good things to say about the Ubuntu version of the linux kernel.

How to break Windows for fun and profit

So I learned something very valuable today and thought I'd share

How to break windows:

create a file named simply "Program"
it does not have to have any content
place it in the root (c) of a windows drive
restart
system hosed (services located in C:\Program Files\etc will fail)

tested on 2kserver, xp pro, and vista business

VerizonWireless.com also hates baby linux (updated)

I'm not going to live my life trying to persuade website owners to let me in. This will be my last I expect. Still I don't understand how they can get away with this. They can't keep me out of a night club if I'm black. They can't fire me if I work at Ford and drive a Chevy. In addition, the people at ford can't make me drive a ford if I don't want to. I might not get a cherry parking spot but I'm still allowed to park my chevy there, right?

So I asked:

Question about the verizonwireless.com website. Why am I no longer able to log into my account since I switched from windows to linux? I'm using the exact same browser. I'm able to log in and use all features if I spoof my user agent so your program thinks I'm using ie7 on windows vista. This tells me you are specifically blocking non-ms operating systems. Can you provide rationale?

==Update==
And they replied...

On Mon Oct 15 9:52 , Verizon Wireless My Account Online sent:

Dear John,

Thank you for contacting Verizon Wireless through our website. I apologize for the delay in responding to your inquiry.

When using Internet Explorer 7.0, we suggest making the following adjustments to your browser for optimal website functionality.

You can access the tool bar for Internet Explorer 7.0 by hitting the Alt key on your keyboard.

. From the tool bar, select Tools from either the top or right menu bar. From the drop down menu select Internet Options.

. You will see in the middle of the box that displays, under Browsing History, a button labeled Delete. Select the delete button.

. You may select the Delete All button; however, if you wish to keep your stored passwords or form data, you would click on Delete Files, Delete Cookies, and Delete History, separately. Click "Yes" when asked if you are sure you want to delete all Internet Explorer browsing history.

. You will then select the Privacy tab, and from this page click on the Advanced button.

. On the next page, you will need to place a check mark in the "Override automatic cookie handling" box. Select Accept for first and third party cookies, and place a check mark in the box for "Always allow session cookies". Please click OK.

. You will now need to click on the Advanced tab in the upper right hand corner. On this page, scroll down to "Show friendly http error messages" and put a check in that box. Now please click on Apply, and OK.

By overriding automatic cookie handling, you should have full use of your online account.

If you require additional information regarding My Account, you may contact E-Services and Support by replying directly to this email. You may also contact us by dialing 1-800-350-2830 and selecting option 1 when prompted. Representatives will be available to assist you Monday through Friday, 5:00 AM to 9:00 PM, Saturday and Sunday, 6:00 AM to 7:00 PM, Pacific Time.

John, we appreciate your business and thank you for using Verizon Wireless products and services.

Sincerely,

Christopher
Verizon Wireless
E-Services and Support

To which I replied:

It seems I wasn't clear with my problem.

My problem is not internet explorer and has nothing to do with internet explorer.

Here is the problem, restated:

I have been a customer for several years and up until recently I have used a windows based computer to access my information online. I have had no trouble with this and I use Mozilla Firefox exclusively.

Recently I switched my home computer to linux. I still use firefox, the same program I use to access the web on windows.

I am unable to log in to verizonwireless.com on the linux platform but am able to access it on a windows machine using the same browser.

My current workaround is to do something called "user agent spoofing" which is where I tell my browser to tell your web server that I'm using a different browser and or operating system. While this does work it is inconvenient and I feel, unnecessary. When I tell your webserver I am using Windows/ie7 it works fine for me. Therefore it isn't a problem on my end, I have all plugins and abilities to use the website.

I was hoping, with my original question, to find out if there is some rationale to this. I would still like to know if I could be privvy to that information.