MyLipas :: The Defacement Crawler

If you are a system administrator of websites that is hosted in Malaysia or owner of the domains ended with .MY.. or.. hosting company, you might heard/read about “MyLipas” somewhere, somehow.. maybe in the email subject or something 😉

Ok here are short descriptions of MyLipas and what is he capable with:

• Named MyLipas due to the ugly code (coded in 2 nights)
• Was around since early February 2009
• Highly inspired by Shaun’s (Australian Honeynet Project) Skynet project
• Crawl for the defaced/hacked websites that are hosted in Malaysia (Malaysia IP range) or domain ended with .MY
• Crawler “abuse” Google search and Zone-H list to look for the defaced websites (based on keywords)
1. Yes it can bypass the Zone-H’s captcha 😀
2. If you are a CSM staff and you claim yourself as a Google-Fu, but you don’t know how to Google for websites that is hosted in Malaysia but not limited to those ended with .MY, you brought shame upon yourself
• MyLipas can also receive manual (single or bulk) URL submission
• All URLs will be grouped by IP (of the hosting) and the following information will be collected (automagically!) :
1. IP address
2. Web server information
3. Domain owner/hosting email address (for reporting)
• Email will be sent to MyCERT (grouped by IP) with the information above, for incident escalation process
• Screenshot will automagically be taken for each URL
• Defacer name will be captured into database
• Data will be mapped into damn nice Ajax and flashy Flash graphs and bars.. [Thanks to Nymkum mYnN and @m4ysix]
• The main job of MyLipas is to crawl for defaced website.. But it can easily customized to become SQL injection vulnerability crawler, leaked information crawler etc etc..
• Enough for now…

Updated on 1 Feb 2012
MyLipas is now integrated with few more defacement archiver websites (which wont be listed here)

DontPhishMe; Its in Your Browser, Its in Your Media

“…CyberSecurity, he said, was also realising a browser plug-in called “DontPhishme” for internet users. Once installed, this security plug-in allows automatic detection of fake banking sites.

“Users can download the browser plug-in from the official download repositories of Mozilla Firefox and Google Chrome,” Zahri said….”

Source: Bernama

Counter-eCrime Operations Summit (CeCOS V)

I’ll be presenting “Don’t Phish Me : Browser based phishing detection” in the “The Technology of eCrime and eCrime Response” section.

See you there 😉

More info : http://www.antiphishing.org/events/2011_opSummit.html

Why Improper Naming Convention Sux

Hi,

😀 First of all, i would like to say sorry to those who have read my previous entry (that has been removed; but thanks to Google people can still read it :P)

It was my fault; and here is the story 😛

I’ve been working on something and I simply create a file named aaaaaa.html on my tmp folder. Suddenly I found the FD challenge and decided to play around. I’ve copied the JS into aaaaaaa.html (with an extra ‘a’) and shamelessly tough that I’ve analyze the right file. Without further verification, i straightaway blog about it. LOL!

P/S: the same method used on the correct FD’s JS and again I’m able to decode it without getting my hand dirty. I’ll only share it publicly once I stop working on my JS-obfuscation-related-project.

Thanks

[img source: http://toddecreason.blogspot.com/2011/01/what-are-you-ashamed-to-be-seen-here.html]

Quick Fix for MacFuse 2.1.7 on 64-bit Snow Leopard

You can get from this unofficial update : https://caurea.org/2009/09/15/unofficial-macfuse-release-for-64bit-kernels/