Yahoo mail hacked?

March 9th, 2010

I've had three friends with yahoo accounts send me email that was clearly not them sending it. It was a spammer. One friend had every contact emailed, in alphabetical order, in groups of 10. The symptoms seem to be:

  • Emails are really sent from yahoo account, there's a copy in the "sent mail" folder
  • Password is changed such that you need to call yahoo or otherwise reset your password
  • Groups of 10 people emailed

Another geek friend reported the same with a number of his friends who have yahoo email getting hacked as well. Him contacting me prompted this post to get awareness out there ( you know, to all 3 of you who read this). No real news on the interwebs, leave this post: Who Hijacked Yahoo Mail?

Here's the nice view of the email (sensitive data yas been obscured with "***********")::

From: Anders ***********
To: egwit, awarnow, avkirby, starsister77, apnun, ann, jara, apollostwinsis., haywoodashley, me
date: Tue, Feb 16, 2010 at 3:06 PM
subject: Bettina Mischkalla

http://nmprint.com.au/go.friend.php

Here's the raw email I got from my friend's hacked account (sensitive data yas been obscured with "***********"):


Delivered-To: mrjones@***********.com
Received: by 10.231.143.16 with SMTP id s16cs151659ibu;
        Tue, 16 Feb 2010 15:06:51 -0800 (PST)
Received: by 10.140.58.10 with SMTP id g10mr4771311rva.57.1266361611517;
        Tue, 16 Feb 2010 15:06:51 -0800 (PST)
Return-Path: 
Received: from ***********.com (***********.com [207.29.224.50])
        by mx.google.com with ESMTP id 31si10777747pzk.62.2010.02.16.15.06.51;
        Tue, 16 Feb 2010 15:06:51 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of
mrjones@***********.com designates 207.29.224.50 as permitted sender)
client-ip=207.29.224.50;
Authentication-Results: mx.google.com; spf=pass (google.com: best
guess record for domain of mrjones@***********.com designates
207.29.224.50 as permitted sender) smtp.mail=mrjones@***********.com;
dkim=neutral (body hash did not verify) header.i=@yahoo.com
Received: by ***********.com (Postfix, from userid 501)
	id 2AFAC968B7C; Tue, 16 Feb 2010 15:06:45 -0800 (PST)
X-Original-To: mrjones@***********.com
Delivered-To: mrjones@***********.com
Received: from web53107.mail.re2.yahoo.com (web53107.mail.re2.yahoo.com
[206.190.49.57])
	by ***********.com (Postfix) with SMTP id 7D7D4968B58
	for ; Tue, 16 Feb 2010 15:06:38 -0800 (PST)
Received: (qmail 11051 invoked by uid 60001); 16 Feb 2010 23:06:37 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com;
s=s1024; t=1266361597; bh=oJtmpSDF9JfgKjw+1+Q+Wqxiiq1f0Qc9sio+EdymNik=;
 h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:
 MIME-Version:Content-Type; b=oFCN9QuJ13WOanJxxKZHrcbLHOZOMviKII3sm
 Wu/Rno7BWX4i8mBO6CHijcUGJPj/7P1ryPEfVSCB/k72CUbSHcHaJZIpLbF0EXwLje
 uVvkTB/BaeMHhTn5DPbW2h7bcKCvt0AlwfUXUQ+1K3t2zpBH1slw/eUoJqEEVx58A2Ew=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:
  MIME-Version:Content-Type;
  b=kzg14b6v1xa8NPMqRfu5XCsz4dFXa7bASb6Vj3Epb6I74/a8t5rVPWCOBfPtR1C
  2Bg67H5UqE3nmdd/hqTKWmUfOKh/g2rhEuXX23ghs080LTudbyqwF0hQSLVmPlhAQ
  RcedYf86UYfC5Ox8SpH/76T2gc+LRlqglfPenlpLRzw=;
Message-ID: <589297.10551.qm@web53107.mail.re2.yahoo.com>
X-YMail-OSG: ppvFaJUVM1kacZ05sJo0wMYepvD5By3Oxe96QISv6KgKBxmq0_Q1r1
8k75jrUQId8bPmqNP8IjHUU8OBB8bfkioPzwwMw7pj1Br2YORw.qhjM8uWFe8yr_wQv
i7YEAoLhtQvNnyTU.5SLv6lIQFUrTxp6huhu1iOVzwW5PtokoZoBQLQ82lLd_jMg1L6
9lCXsoRvQi6C5PTDrobDdUz7VOj3h0yRWEFf00zgrQ.Vs9kf2cU2epyUdQQuJ_juBPx
accPy7psP2vYnb7ErtxGxfUayl85HvFPG575oMywmq6e8PKqpKz04xXdgwqhgZ6g5qs
5_feAiiHiTH5Tz5gpTdCCuzNThjs3436jDWaTpWx8-
Received: from [66.196.86.118] by web53107.mail.re2.yahoo.com via
HTTP; Tue, 16 Feb 2010 15:06:37 PST
X-Mailer: YahooMailWebService/0.8.100.260964
Date: Tue, 16 Feb 2010 15:06:37 -0800 (PST)
From: Anders ***********<***********@yahoo.com>
Subject: Bettina Mischkalla
To: "egwit@***********.com" ,
  "awarnow@***********.com" ,
  "avkirby@***********.com" ,
  "starsister77@***********.com" ,
  "apnun@***********.com" ,
   "ann@***********.com" ,
  "jara@***********.com" ,
  "apollostwinsister@***********.com" ,
  "haywoodashley@***********.com" ,
  "mrjones@***********.com" 
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii

http://nmprint.com.au/go.friend.php

The little sunflower than could

March 4th, 2010

The sweets is starting some seeds. We have tomatoes, sunflowers and hollyhock. One of the sunflower's has come up with his seed pod still on. Will he make it out alive?!?

Oakland & SF Photos, Coffee and Scotch Whiskey

March 1st, 2010

Ok, this'll be a good ramble. In order of the photos below, first up is the PG&E embarcadero substation. Huge buildings that have no windows are not for humans. They seem to always be for some utility company. Weird and cool looking. Next up is a shot of a late I made at work. Microfoam is looking good, latte art, not so much. We'll get there, just you wait and see. Next up, the shocking truth about the price of a bottle of decent scotch. The first is Eddie's Liquors which has a bottle for $70. Then Trador Joe's has the same bottle for $37. Shocking! After than is the 411 30th building in oakland. Some what unassuming until you check out the details (art deco?) of the lobby. I love this old stuff.

Last night I did a ride from our house, through downtown oakland, through china town, past laney, all the way south down to the park street bridge, all the way around alameda, and the double back almost the same way you came. Along the way I went through the defunct airforce base. The next photo after 411 30th shots are the HUGE doors (no street view) on the base. I love 'em! On the way back I stumbled upon The Hotel Oakland. Woah! This building is 1 square block and looks like it's from New York city. It's on 13th off of Broadway, who knew?! Wikipedia suggests it's on the list of Alameda County Historical Landmarks and some random site has this history:

"A residence and health center for the elderly. The building housed the finest hotel in Oakland until it went out of business in the Great Depression; in 1943 it became an army hospital and by the 1960s a VA hospital. From 1963 to 1979 it was vacant, before being reborn into its current use."

Lastly, a sunset shot of the good ol tribune tower. Hi Modern Cafe!

Vimeo Does AVHCD Light Test

February 28th, 2010

Hey there! A friend asked if Vimeo, who were then thinking of going with for plip.com videos, supported our camera's AVHCD Light format. I'm happy to report, it does! Here's to quick test clips I shot. Noteworthy is that Vimeo Plus, though a bit pricey, has excellent privacy settings which was a huge selling point to me.

http://www.vimeo.com/9808961 http://www.vimeo.com/9809702

Another Very Poor Man's Google Analytics Post

February 27th, 2010

A bit ago I wrote a post about using command line tools to get stats of this blog. I recently wrote another version of this to get the most popular posts here, sorted by the most popular at the top. I love that this can be done in all in one command.

Here's the command:

tail -1000000 access_log|grep 'GET /blog'|cut -d" " -f 7|egrep -v '\.png|\.jpg|wp-includes|\.css|/page/|/category/|xmlrpc|wp-trackback|/feed/|wp-login|/wp-content/|/trackback/|wp-comments|wp-app.php|wp-admin|comment-page|index.php|?p=|page_id|comments|feed'|sort|cut -d"/" -f 3|uniq -c|grep -v ' 1 '|sort -nr>plip.blog.tops.txt

This breaks down into the following:

  • get the last 1000000 of the blog access log
  • look for requests to "/blog"
  • split by space, and get the 7th field, the URL being requested
  • exclude a ton of items
  • sort the results
  • split by the "/" slash and get the 3rd field, the blog name in the URL
  • get the unique list of blog names with a count for each URL
  • remove the singletons
  • reverse sort so the most popular is at the top
  • write it all to a file called plip.blog.tops.txt

The results are in! The winner is currently chocolate-crinkle-cookie-photos! W00T

   137 chocolate-crinkle-cookie-photos
   119 two-loves-css-recaptcha
   109 24-hours-in-photos
   104 our-pet-venus-fly-trap
   103 ruby-less-way-to-add-key-frames-to-flv-videos-for-the-likes-of-jwplayer
    94 toss-your-salad-code
    91 update-firefox-does-have-reset-more
    91 firefox-reset-is-really-launch-in-safe-mode
    84 keep-those-passwords-safe
    81 photos-food-bikes-sunsets-and-stars
    79 thoughts-on-very-large-monitors
    78 when-the-cat-is-away-the-worms-will-play
    76 photos-from-around-the-bay
    76 our-tree
    75 one-foggy-morning-in-my-commute
    74 wordpress-exploit-fog-fruit-plants-and-plates
    72 recaptcha-now-google-recaptcha-will-help-google-books
    72 from-burning-man-town-to-oaktown
    67 gmaps-pedometer-google-calc-8-94607843-minutes-per-mile
    66 the-massive-compost-tower
    65 on-theft-privacy-and-data-loss
    64 pizza-and-dough-from-scratch
    60 this-is-not-an-ipad
    60 go-faster-encoding
    57 fixed-theme-wp-updated-more-wp-hacks
    44 every-vehicle-is-a-prius
    42 photorec-to-the-rescue
    41 the-very-very-poor-mans-google-analytics-tail-cut-sort-uniq-wc
    41 on-comcast-internet
    38 taking-the-plunge-safari-4-full-time
    35 secret-jumps-of-tunnel
    35 i-got-four-cores-but-a-distributed-load-aint-on-one
    34 stir-fry-dinner
    33 tasty-comfort-food
    32 fancy-diff
    26 how-to-fix-zend-studio-5-5-zde-in-os-10-6-snow-leopard
    24 ping-traceroute-and-quotes
    22 wordpress-rich-mans-blog-poor-mans-cms
    21 new-news-old-open-source
    20 old-broken-usb-hub-ipod-charger
    19 gmail-contest
    19 alternate-way-to-have-google-analytics-track-pdfs
    17 this-is-what-makes-a-happy-saturday
    17 macchiato
    16 american-born-chinese
    15 rogue-mysql-queries
    15 fixed-gear-slipped-chain-thankful-for-brake
    13 simple-wp
    13 plip-is-no-longer-a-cobblers-child
    11 plix-plixing-better
    11 itunes-imovie-on-lenovos-new-media-center-pc
    10 wonderful-bike-lane-signs
    10 this-is-what-makes-a-happy-sunday
    10 plip-ts-on-your-back
     9 plipgo-01-released
     9 bart-speaks
     8 yet-another-redesign
     7 update-plip-content
     7 plixing-for-pleasure
     7 plip-for-peace
     7 long-be-gone
     7 kodiak-11-released
     7 dot-com-casualty
     7 dont-just-commit-commit-intelligently
     6 verge-works-solves-all-your-woes
     6 simpsons-for-ever
     6 simple-is-better
     6 plip-gets-its-own-dictionary
     5 aids-ride-completed

How to Fix Zend Studio 5.5 (ZDE) Select Text Problem in OS 10.6 Snow Leopard

February 19th, 2010

This is nothing but a repost of a slightly older fix, but this is AWESOME!

Fixing ZDE 5.5 in Snow Leopard

Enjoy!

Pizza and Dough From Scratch

February 14th, 2010

Note to self – don't make the water too hot or you'll kill the yeast.

On Comcast Internet

February 10th, 2010

Two quick points about Comcast High Speed Internet (HSI):

Thoughts on very large monitors

February 10th, 2010

Now, we all know that I have a little problem with wanting lots of monitors. It should come as no surprise that I LOVE high pixels per inch (PPI) screens. In fact, when ever I see a new laptop with a 24" inch screen (1920 x 1400) crammed into at 17", I day dream of a getting such a beast in standalone form for my desktop.

With that in mind, I've been keeping a close eye to the large monitor offerings. Of course the defacto large monitor was the first 30" for consumers, Apples Cinema display. However, at $1800, it's not really for most consumers unless you're like our friend over at Omnipotent who has one 30" and two 24" from back when the 30" was a lot more than $1800. More recently Apple has come out with the the 27" iMac running at 2560 x 1440. This is a very sweet LED backlit display with a video input, "27-inch models also support input from external DisplayPort sources (adapters sold separately)." – Apple. Since it's such a sweet display, some folks are considering it a really nice $1600 display that happens to come with a free computer.

The poor man's Apple monitor has always been Dell. If you look closely at my desk at work, you'll see they're all old school Dell 2405FPWs. When Apple's 24" was something like $800 (no reference easily found in google), Dell's was something like $400. At my office back in aught five, the original founders were sporting 30" Apples, but soon, every one had a 24" Dell. We've now standardized on more or less the Dell ST2410 for most folks at $260. This one is not adjustable height and has so so contrast. Some folks may get the much nicer Dell UltraSharp U2410 for $600 which is a far superior monitor to the ST2410 and it's ilk. Super fancy folks (aka a few designers and engineers) get the Dell UltraSharp 3007WFP-HC for $1400. Note, all these prices are much less than Apples.

Really the point of this post is that Dell today announced the UltraSharp U2711 for $1100. This is a 27" monitor with the sweet, high PPI resolution of 2560 x 1440. I suspect it is not as nice as Apple's iMac display because it's not LED. However, at $500 less than the iMac, it's much more affordable. No, not quite in the range of most consumers, but both the 27" iMac and the U2711 Dell suggest there's a higher PPI trend which will lead to lower cost, higher PPI monitors which is all I want.

Fixed theme, WP updated, more WP hacks

January 30th, 2010

Back when I fixed this blog's instance of wordpress, I broke the theme. Today I fixed it. W00T! Sadly, this is because I found even more instances of a hacked wordpressery. This was based on the remv.php hacks. I can not stress enough how important it is to keep your software up to date. Go subscribe to the wordpress release feed if you need to. Just stay up to date.

While finding the instances of remv, I took a peek at it. It's actually pretty neat! If you have LAMP stack handy and are interested, here's a copy. Enjoy!

Update: Here's the home page of PHPRemoteView (aka remv.php) translated from russian. Checkout the rockin windows 95 style windows!