INTERNET!~ I knew it was the SD card, I knew it! The Vodafone bot vector analysis I mentioned earlier this month was correct. It’s over.

The infection of microSD cards for the HTC Magic with the Mariposa information-stealing client and other strains of malware was first reported after Vodafone Spain supplied a malware-infected Android phone to a Panda worker earlier this month. [From the register]

Users get new microSD cards. Yay, but at what cost did buying the $2 phone really bring? 3,000+ phones infecting every windows machine that they come in contact with, snap. I guess that means more you have to start using Linux or scan your new phones with a Linux machine first. Hey there’s a new service, phone virus removal…

A quick analysis of the malware reveals that it is in fact a Mariposa bot client.

Every android phone *can* be plugged into any PC or Mac via USB. Under windows it works just like any other insert digital medium (CD, DVD, Flash Drive). Upon being plugged in, it opens the folder and executes the file specified in autorun.ini. This would be the vector a bot herder/malware researcher would use to launch it’s “spread” and stay infected. As long as nobody notices the files on the phones, users would just keep getting re-infected every time they plug in their phone to download their photos. One speculation that may be responsible is: “the SD card” since all that someone would need to do is put “files” in the root of the SD card for them to execute. So the question might be instead be: “How would someone slip a file onto a flash card before it’s inserted into a phone?”.

Interestingly enough, the Mariposa bot is not the only malware I found on the Vodafone HTC Magic phone. There’s also a Confiker and a Lineage password stealing malware.

Why did it take so long for a person to notice malware on the phone? The HTC Magic is one of the most popular smart-phones in the UK. In the US, T-mobile branded this product as the “myTouch 3G“, and that phone has a massive pop. Where is the supporting evidence on the phone? The only “proof” we have so far is a few windows screen shots. I’m intrigued by this and it will be interesting to see what comes to light. I’ll keep you updated when I hear more.

In a move to stop CPU waste from processing bloated content, Virgin Airlines has trash-canned all of their FLASH content. I commend them on this move; someone needed to start the movement. Flash is bloated. End of story. There is no standard, there is no open source, and there is no relief. As soon as you start adding flash to a site, you’ve degraded the ability of the browser.

“Apple does not support Flash because it is so buggy… Whenever a Mac crashes more often than not it’s because of Flash. No one will be using Flash…The world is moving to HTML5.” — Wired

(HAHA!). But flash has it’s place, it is the best medium to deliver video on a web page and play web-games.

Hopefully, HTML5 can fix the web game problem.

Adding my own flavor to this post:

Over the technology years, flash has been metaphorically turned into a baseball bat by business owners and web publishers. This proverbial baseball bat has been beaten across every web developer’s face (repeatedly) for the last 11 years and there hasn’t been anything that the developers can do about it. You MUST specialize in flash, to make flash.

New personal hero: Ravi Simhambhatla

He has some sweet open source ideals as well.

So hilarious but; your own hope at remaining off the web…

[thanks SD]

Oh, heads up!

I’m in the process of starting a new web hosting solution for my friends, family, and colleagues. The service is dedicated to providing quick  customer support response times and easy to use web hosting tools (this alleviates headaches of most hosting providers). Starting out, I will be the sole person managing the servers, applications, and support. Your questions, comments and concerns will go straight to me. The best part about this service is that I can now offer you any web related service (ruby on rails, postgresql, ad serving, social network integration, endless etc.).  If you would like some solid, secure, and highly customizable hosting on my managed dedicated servers then please contact me at fantomstranger.net. Keep an eye out here for web hosting discounts by subscribing to the fantom-stranger.com facebook fanpage.

Here’s the google techtalk about what they did to take over the botnet and analyze it (get ready its long and boring (an hour and 15 minutes) but crazy):

Protect your passwords and your intertubes!

[Reference]

Stepping into the verse’ of the known, we try to change our concept of reality with technology. It’s a very weird feeling moving your ideals into a new plane of thought. Augmented reality is such an approach that you perceive extra dimensions on-top of your physical plane. Here is a building that displays QR codes that can be used for a variety of applications (shopping, twitter updates, advertising, entertainment, etc).

The iPhone application is not in the iTunes App Store, but is available to interested parties on request. The project is a collaboration between teradadesign and Qosmo.

Imagine yourself walking around the grocery store holding your phone up to every product for up-to-date reviews. Imagine going out to a night club, pointing your phone at a person  to view their social profile (“Oh, that person like’s cheese?”). There may be a time where you browse your favorite books at the library with QR codes. You could put a QR code on the back of your transportation that links to your website. The best part about QR codes is, you don’t know what you’re going to get. It’s like finding treasure (good or bad).

[Thanks Designboom!]

Streaming games over the web is always evolving. Windows, OS X, Linux, whatever; imagine your games you want, right now. OnLive Game Service is taking the first big leap in cloud gaming. They are planning on releasing a small gaming console (MicroConsole) that streams video games to your TV. You can sign-up for their beta program now. Here is the latest in game hardware and software mashing games on demand over the web:

If you didn’t watch the whole video, they are basically saying that the “new game titles” and will be available as soon* as they are released. And by *soon, I mean as fast as your internet connection can start a streaming session. Obviously, this does require internet to work.

The internet gaming service uses a high powered compression algorithm to “play” a game @ their server location, and wrap it into a tunnel sending it back to you fast enough that you perceive you’re playing the game locally. This means no long download times and no waiting to play. You won’t need their console to play the games either. Browser plug-in on a PC or Mac will be able to do the equivalent to their console hardware, making their service very cross-platform. OnLive‘ services also include a server-side feature that allows gamers to record their games in HD. You may be able to try this for free if you sign-up for their beta program.

[Thank you Stabaho, for this information].

Forget the upcoming holiday woes and come blast me and my friends in the face with virtual projectiles (like bullets, plasma shells, rockets, swords, frisbeez, you name it). All you have to do is get yourself hyped for Saturday (November 14th) and then bring your computer over on Saturday…

There is going to be a keg so keep that in consideration when deciding what to bring. Entrance fee is $7 (7 United States Dollars). There will be Call of Duty: Modern Warfare 2 or Netflix Instant watch for friends that don’t bring computers. No violent attitudes, you will be forced out of the location left to wait for your things. Gaming starts at Noon, drinks later, show up any time. We may be playing some Heros of Newerth, so grab a key from a friend if you don’t have that yet. Don’t be pissed when we play network hearts. It’s a lan, when else would we have that opportunity?!

facebook event page

DON’T FORGET YOUR NETWORK CABLES AND POWER STRIPS!!

If you can bring a table, please do. Also if you could please let me know that your coming somehow, that would be nice. Thank you.

If using Windows 2000 and IIS 5.0, you need to disable socket pooling. Here is the Microsoft article for disabling socket pooling in IIS 6.

This info discusses how to change (force) which IP addresses that IIS listens too. There are several scenarios that this would fall into. Most people generally only need to separate services and IIS listens to all IP addresses by default, IP so errors will occur if multiple web servers are using port 80 on the same IP. Example: Your server has multiple IP addresses and you need to run a new apache wordpress blog site on a separate dedicated IP address then your .net survey e-commerce IIS site to avoid any conflicts. There are other options in this scenario if you only have one IP address on a server but also need to run more then one web server on a single box, but that’s a different post. Alternatively, I also address binding IIS to all addresses.

To do this, we first stop IIS from binding to all addresses and explicitly select which ones to use. Once we tell it this, the IP addresses will be free to use by other applications and services. If you’re using Windows XP, then you may need to install Windows XP Service Pack 2 Support Tool. If you’re using Windows 2003, then you don’t need to worry because it’s most likely installed.

1. Now we need to open a command prompt. The quickest way to open command prompt in windows is to press “windows key”+R, and then type cmd into the run dialog box. Then press enter…
2. Were going to use “httpcfg” to setup IIS. So type:
   

   httpcfg query iplisten

   That should return:

   IP                      : 0.0.0.0
   ——————————————————————————

3. The first change we make should delete the listening on all IP addresses, so lets do it:
   

   httpcfg delete iplisten -i 0.0.0.0

   If you typed everything correctly and the program likes it you should see:

   HttpDeleteServiceConfiguration completed with 0.

4. Now we assign the IP address(es) that you would like IIS to bind too:
   

   httcfg set iplisten -i 192.168.0.23

   and again for if we need multiple:

   httcfg set iplisten -i 192.168.0.24

5. Now we need to restart the http service so it will use the new configuration:
   

   net stop http

   and then:

   net start http

6. Now we really need to check IIS manager to make sure that the sites are working properly. If you find any sites that are offline (marked with a red X), make sure the site configuration is using one of the IP addresses you entered earlier or “(All Unassigned)”. If it isn’t set it to the new address and turn on the site.

After IIS restarts, it will only be listening to the IP addresses you told it to. You can now setup your other web services to use the unallocated IP addresses. If you are still experiencing issues after completing these steps, you may need to disable socket pooling.

Force IIS to bind (listen) to All IP Addresses

Make sure you have httpcfg, then do the following:

1. Open a command prompt. The quickest way to open command prompt in windows is to press “windows key”+R, and then type cmd into the run dialog box. Then press enter…
2. We need to check what the current assignment is:
   

   httpcfg query iplisten

   That should return something similar to this:

   IP : 192.168.0.23
   ——————————————————————————

3. We should delete the entry for any IP that isn’t 0.0.0.0, like this:
   

   httpcfg delete iplisten -i 192.168.0.23

4. Next, we assign 0.0.0.0 to iplisten. 0.0.0.0 tells IIS to assign to ALL IP addresses:
   

   httcfg set iplisten -i 0.0.0.0

5. Check the current configuration and make sure that 0.0.0.0 is the only assignment. If it isn’t, delete the other IP address(es) until it is:
   

   httpcfg query iplisten

   IP : 192.168.0.24
   ——————————————————————————
   IP : 0.0.0.0
   ——————————————————————————

   httpcfg delete iplisten -i 192.168.0.24

6. Now we need to restart the http service so it will use the new configuration:
   

   net stop http

   and then:

   net start http

IIS should now be listening to all IP addresses again.

I found these sites useful when I was collecting my information:
Prevent IIS from Binding to all Assigned IP Addresses
egghead cafe question
IIS wikipedia entry
Setting metabase property DisableSocketPooling has no effect