<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
	
	<channel>
		<title>The Hedgie Web</title>
		<link>http://www.hedgie.com/index.php</link>
		<description>Random Thoughts and News From LordHedgie</description>
		<language>en</language>
		<managingEditor>hedgie@hedgie.com</managingEditor>
                <copyright>Copyright 2008</copyright>
		<generator>Pivot Pivot - 1.40.5: 'Dreadwind'</generator>
		<pubDate>Tue, 30 Dec 2008 00:43:43 -0500</pubDate>
		<ttl>60</ttl>
		
		
		
		
		<item>
			<title>Guitar Hero Pedal Fix</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=45&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=45&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p>My cat chewed through the cable of my Guitar Hero World Tour bass pedal.  While there is a cheat code that automatically plays the pedal as required, and thus lets me continue playing, it does mean I can&#8217;t earn any cash for playing songs.  And with replacement pedals <a rel="external" href="http://cgi.ebay.com/Guitar-Hero-World-Tour-Drum-Bass-Pedal-PS3-PS2-Wii-Xbox_W0QQitemZ250348327592QQcmdZViewItemQQptZVideo_Games_Accessories?hash=item250348327592&#38;_trksid=p3286.c0.m14&#38;_trkparms=66%3A2%7C65%3A13%7C39%3A1%7C240%3A1318" title="eBay closed listed">selling for $50 on eBay</a> I couldn&#8217;t bear to buy a replacement.  I could call Red Octane and try for a warrenty repair, but it&#8217;s really hard to explain how a cut cord is a manufacturing defect.  So, I repaired pedal, and took photos in case anyone else has the same problem.</p>	<p>My normal response to a cat chewed cable is to splice and solder the cable back together.  Unfortunately, the enamel coated wire used in my pedal cord is extremely hard to splice.  You have to strip the coating off each strand before connecting them, and the strands are absolutely tiny.  So instead, I purchased a 6 ft male-to-male 1/8&#8221; audio cable, and a 1/8&#8221; audio jack.  The idea was I could glue the jack onto the pedal, and have a cable removable at both ends.  If the cat ate it again, I could simply buy another $3 cable and plug it in.</p>

	<p><strong><span class="caps">STEP</span> ONE:</strong> Remove the foam pad under the pedal toe.  There are two small screws that hold the piezo sensor in place.  Remove these screws, and gently lift the sensor out of the pedal.  Two wires are soldered onto the piezoelectric sensor, and covered in white goo to hold them in place.  I removed the goo around the solder joints with a knife to take the picture below.  Note that the large white area in the middle is actually a conductor &#8212; generate a voltage between that plate and the gold ring on the outside and your pedal will &#8220;fire.&#8221;  Heating the now exposed solder with a soldering iron will allow you to easily remove the old wires.</p>

<p style="text-align:center;"><a href='http://www.hedgie.com/blog/images/122908_ghwt_1.jpg' class="thickbox" title="Piezoelectric sensor" rel="entry-45 external" ><img src="http://www.hedgie.com/blog/images/122908_ghwt_1.thumb.jpg" style="border: 1px solid;" alt="Piezoelectric sensor" title="Piezoelectric sensor"  class='pivot-popupimage'/></a></p>

	<p><strong><span class="caps">STEP</span> TWO:</strong>  I soldered a pair of short jumper wires from a breadboard kit into the same spots I removed the old wires from.  I then soldered the other end of the jumper wires to the audio jack, as shown in the pictures below.</p>

<p style="text-align:center;"><a href='http://www.hedgie.com/blog/images/122908_ghwt_2.jpg' class="thickbox" title="New wires" rel="entry-45 external" ><img src="http://www.hedgie.com/blog/images/122908_ghwt_2.thumb.jpg" style="border: 1px solid;" alt="New wires" title="New wires"  class='pivot-popupimage'/></a></p><br />
<p style="text-align:center;"><a href='http://www.hedgie.com/blog/images/122908_ghwt_3.jpg' class="thickbox" title="Audio jack attached" rel="entry-45 external" ><img src="http://www.hedgie.com/blog/images/122908_ghwt_3.thumb.jpg" style="border: 1px solid;" alt="Audio jack attached" title="Audio jack attached"  class='pivot-popupimage'/></a></p>

	<p><strong><span class="caps">STEP</span> THREE:</strong> Test the repair.  And, as one would expect, it didn&#8217;t work.  I plugged my cable in, placed the sensor back inside the pedal, and not a peep when I kicked the pedal.  </p>

	<p><strong><span class="caps">STEP</span> FOUR:</strong> Troubleshoot, improvise, and overcome.  I discovered that the audio jack shorted the cable when the plug was fully inserted.  My guess is that the jack is defective, but I&#8217;m too lazy to unsolder it and return it to the store.  I discovered that if the cable was just barely in the jack, it worked perfectly.  Of course, if it was just barely in, it would fall out easily.  This is a problem for something designed for a seven year old to stomp on.  The solution was to tape the plug into the jack at the correct depth, and then tape the entire assembly onto the base of the pedal.</p>

<p style="text-align:center;"><a href='http://www.hedgie.com/blog/images/122908_ghwt_4.jpg' class="thickbox" title="Finished product" rel="entry-45 external" ><img src="http://www.hedgie.com/blog/images/122908_ghwt_4.thumb.jpg" style="border: 1px solid;" alt="Finished product" title="Finished product"  class='pivot-popupimage'/></a></p>

	<p>The end result works well.  If it breaks again, I will probably get another jack and do it the way I originally meant to.  In the meantime, it&#8217;s a quick easy $5 solution to a $50 problem that takes very little time or skill to perform.  Good luck!</p> ]]></description>
			<guid isPermaLink="false">45@http://hedgie.com/blog/pivot/</guid>
			<category>default</category>
			<pubDate>Mon, 29 Dec 2008 21:43:00 -0500</pubDate>
		</item>
		
		
		
		<item>
			<title>Good News</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=44&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=44&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p>So I got word today that the Navy has decided to let me stay in, despite my pacemaker.  This is good news.  Who wants to lose thier job two days before Christmas?  <br />
<p style="text-align:center;"><img src="http://www.hedgie.com/blog/images/redheartekg.jpg" style="border:0px solid" title="" alt="" class="pivot-image" /></p> ]]></description>
			<guid isPermaLink="false">44@http://hedgie.com/blog/pivot/</guid>
			<category>default</category>
			<pubDate>Tue, 23 Dec 2008 18:10:00 -0500</pubDate>
		</item>
		
		
		
		<item>
			<title>Overcoming a DNS Attack</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=43&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=43&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p>Last summer Kaminsky <a rel="external" href="http://news.cnet.com/8301-1009_3-9998906-83.html" title="CNet article on DNS flaw">outlined a flaw in DNS</a> that could be used to make <span class="caps">DNS</span> cache poisoning attacks easier.  The public comment period for the introduction of <span class="caps">DNSSEC</span> <a rel="external" href="http://www.hackinthebox.org/index.php?name=News&#38;file=article&#38;sid=29182" title="Hack In The Box article">has ended</a>, but it hasn&#8217;t been implemented yet.  This weekend, I found myself unable to visit Yahoo! services when all the <span class="caps">DNS</span> entries came out wrong.  Was it a <span class="caps">DNS</span> poisoning attack, or just a misconfiguration?  I don&#8217;t know, but I wasn&#8217;t about to spend Sunday without my live Fantasy scores updating.  Here&#8217;s how I worked around the problem, and how you could &#8220;fix&#8221; an attack against your favorite servers, too.</p>	<p>My first clue that something was wrong came when clicking my bookmark for <a rel="external" href="http://fantasysports.yahoo.com" title="Yahoo! Fantasy Sports">Yahoo! Fantasy Sports</a> came up with a <span class="caps">DNS</span> error.  This is a good reason not to allow your browser to provide &#8220;Friendly errors&#8221; like IE does by default &#8212; it&#8217;s not enough to know a site isn&#8217;t available, you should want to know why a site isn&#8217;t available.  After two days, I was curious why it hadn&#8217;t come back up, and a quick Google revealed nobody else was having the problem.  This tells me it&#8217;s probably localized <span class="caps">DNS</span> issue, where my <span class="caps">ISP</span> has a bad <span class="caps">DNS</span> cache.  Could this be a <span class="caps">DNS</span> attack in progress?  Perhaps, but I&#8217;m not going to investigate that, I just want my Yahoo! back!</p>

	<p>The first thing I did was to verify that indeed the site was functional.  Using <a rel="external" href="http://www.torproject.org" title="TOR Homepage">TOR</a>, I verified that I could log into the site from England.  That confirms it &#8212; it&#8217;s a localized problem.  I could just use <span class="caps">TOR</span> to check my fantasy scores, but that&#8217;s slow and abusive of TOR&#8217;s limited bandwidth.  I switched <span class="caps">TOR</span> off at this point, having verified that I just needed to correct my ISP&#8217;s faulty <span class="caps">DNS</span> servers.</p>

	<p>Next I hopped over to <a rel="external" href="http://www.dnstools.com" title="DNS Tools Homepage"><span class="caps">DNS</span> Tools</a>, one of hundreds of free web sites that allow <span class="caps">DNS</span> queries to be entered via the web.  By using a <span class="caps">DNS</span> server other than my ISP&#8217;s, I will get different, and hopefully correct, results.  Sure enough, fantasysports.yahoo.com gave me an IP address while querying my ISP&#8217;s server gave me nothing.  Success!</p>

	<p>I then edited my <a rel="external" href="http://en.wikipedia.org/wiki/Hosts_file" title="Wikipedia article">hosts</a> file (on Linux it&#8217;s /etc/hosts, older versions of Windows have it at /Windows/hosts, newer versions put it at /WINNT/system32/drivers/etc/hosts).  All I need is one line telling my computer not to query a <span class="caps">DNS</span> server for this site, but to use a static IP address:</p>

	<p>98.136.70.92	fantasysports.yahoo.com</p>

	<p>Loaded my bookmark in Opera, and it works!  Success!  Except I click on the link to log in, and then it dies again.  I notice that it&#8217;s trying for a different server, so I repeat the process twice more until I get this:</p>

	<p>98.136.70.92	fantasysports.yahoo.com<br />
98.136.70.92	football.fantasysports.yahoo.com<br />
98.136.60.78	sports.yahoo.com</p>

	<p>Now everything seems to be working fine.  I can browse through all my fantasy pages without any hitches.  But what about the Flash applet that tracks scores in real time?  Can I get to it?  I click the button, and no&#8230; Just a blank page.  Not even an error.  Now it&#8217;s getting more complicated.  I turn to the web hacker&#8217;s favorite tool &#8211; &#8220;View Source&#8221;.  What I find is a new server hosting the Flash applet:</p>

	<p>embed src=&#8220;http://aud.sports.yahoo.com/nfl/nfl125.swf&#8221;</p>

	<p>aud.sports.yahoo.com ?  I look that one up in <span class="caps">DNS</span> Tools, and stick it into my hosts file.  Click reload, and my applet loads up!  I feel really proud of myself, until I notice that all my players are listed as having a bye week, and the score is zero-zero despite having played games on Thursday.  Something is definately not right, and it&#8217;s time for a new tactic.</p>

	<p>I can&#8217;t easily view the source of a Flash applet, so I decide to do the next best thing.  I fire up <a rel="external" href="http://www.wireshark.org/" title="WireShark homepage">WireShark</a>, a protocol analyzer/packet sniffer.  I start capturing all the traffic on my network, press reload, then stop the capture, grabbing only 129 packets.  That&#8217;s a small enough sample that it&#8217;s really easy to look through&#8230; Especially since I&#8217;m only looking for <span class="caps">DNS</span> queries.  It turns out there are eight <span class="caps">DNS</span> queries, all sent in rapid succession, and all for the same server &#8212; aud1.sports.mud.yahoo.com.  Okay, so that&#8217;s easy to fix, right?  One more entry into the hosts file.</p>

	<p>If you were curious, the eight queries all got responses from my <span class="caps">DNS</span> server.  The server responded back with a response that had no error codes, yet the IP field in the packet was blank.  Go figure.  Does this mean it&#8217;s an attack or a misconfiguration?  I don&#8217;t know.</p>

	<p>So I click reload, and &#8230; no dice.  I still see all my players as having a bye week.  Undeterred, I turn Wireshark back on, and do another capture.  As I suspected, this time it went to aud4.sports.yahoo.com.  A little trial and error with <span class="caps">DNS</span> Tools confirmed that aud1 through aud10 were valid domain names, and they went to sequential IP addresses.  I put all ten into my hosts file, and &#8230; it works!  Like magic, everything is working flawlessly.</p>

	<p>In case you got here through a Google attempt to fix Yahoo! sports, here&#8217;s the end result in my hosts file:</p>

	<p>98.136.70.92	fantasysports.yahoo.com<br />
98.136.70.92	football.fantasysports.yahoo.com<br />
98.136.60.78	sports.yahoo.com<br />
209.191.123.12	aud.sports.yahoo.com<br />
64.215.156.33	us.i1.yimg.com	<br />
209.191.123.227	aud1.sports.mud.yahoo.com<br />
209.191.123.228	aud2.sports.mud.yahoo.com<br />
209.191.123.229	aud3.sports.mud.yahoo.com<br />
209.191.123.230	aud4.sports.mud.yahoo.com<br />
209.191.123.231	aud5.sports.mud.yahoo.com<br />
209.191.123.232	aud6.sports.mud.yahoo.com<br />
209.191.123.233	aud7.sports.mud.yahoo.com<br />
209.191.123.234	aud8.sports.mud.yahoo.com<br />
209.191.123.235	aud9.sports.mud.yahoo.com<br />
209.191.123.236	aud10.sports.mud.yahoo.com</p>

	<p>This all took a lot longer to explain than to do.  Total time to fix this problem was about five minutes, and now you can do the same if you find your ISP&#8217;s domain servers are broke.  If your ISP&#8217;s domain server is <span class="caps">REALLY</span> hosed, add 74.52.112.155 in as dnstools.com, so you can do your queries off their servers.  Simple, right?</p> ]]></description>
			<guid isPermaLink="false">43@http://hedgie.com/blog/pivot/</guid>
			<category>default</category>
			<pubDate>Sun, 30 Nov 2008 00:53:00 -0500</pubDate>
		</item>
		
		
		
		<item>
			<title>Open Source Investigation</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=40&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=40&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p>No matter how hard I try, I cannot seem to convince some people just how powerful open source research is.  Google is your friend, I say.  Unless you&#8217;re trying to hide something, of course.  But RJMetrics has put together a great demonstration of what you can discover by searching the Internet, and how he did it.  It&#8217;s very enlightening, and hopefully inspiring enough to get you to solve whatever mystery has been bugged you lately.</p>	<p>His article describes those &#8220;Single? www.foosingles.com&#8221; signs that are popping up around the country.  Depending where you live, you may or may not have seen them &#8212; but if you live anywhere near one of the areas that has them, you&#8217;re probably sick of them.  They&#8217;re <strong>everywhere</strong>.  </p>

	<p>His interest was piqued when he saw a sign for HaddonHeightsDating.com, which he knew was a small town.  Using <a rel="external" href="http://wikipedia.org">Wikipedia</a> he discovered Haddon Heights had 7,000 residents, 56% of whom were married, and 25% of whom were under the age of 18&#8230;  Leaving about 1,330 potential customers, assuming all unmarried people over 18 in the town were seeking partners.  Since no dating company could possibly survive with such a small customer base, he decided to decode the business model for this company.</p>

	<p>Using <a rel="external" href="http://domaintools.com">DomainTools.com</a>, he was able to find 8,870 domains that fit the formula town plus a dating keyword, such as &#8220;putzvillesingles.com&#8221; or &#8220;schittsvilledating.com&#8221;.  But the 8,870 domains all resolved to three IP addresses at three different hosting companies.  Next he wrote a small script to pull the town names out of the domain names, and compare it to a list of towns in America.  Obviously, a lot of towns exist in multiple states, but with a little fine-tuning he discovered that these signs are all over the country &#8212; but a few states like Texas and Wiscosin were very heavily hit.</p>

	<p>Not having any luck deciphering the business model, he tried to figure out who was behind the scourge of signs.  Not surprisingly, the thousands of websites were virtually identical &#8212; and contained no contact information.  Using whois didn&#8217;t seem to help, as all the websites were registered via either a web development company in Panama or a marketing company in India.  So he did something sneaky &#8212; historical whois, which often reveals who is behind a company before they get smart enough to hide behind proxies.</p>

	<p>Before long, he found one domain originally registered with a name and a new company &#8212; therightone.com.  A dating service.  With 500 employees in 80 satellite offices around the country, which roughly match where the signs are found.</p>

	<p>WIth a company name, real digging can occur.  <a rel="external" href="http://ripoffreport.com">RipOff Report</a> had claims the company made $3,000 to $15,000 off each customer.  By massmarketing to zillions of Americans with pseudo-localized content, weeding out the smarter, er, normal customers and focusing on the gullible and rich, the company can rake in $54 million a year.  Wow.</p>

	<p>What&#8217;s my point?  Without breaking any laws, without even leaving his computer, this man was able to track down the size and scope of a company that&#8217;s intentionally tried to cover its tracks.  He was able to get a name and identity behind a scam that&#8217;s undoubtedly bordering on illegal, if only for littering.  His resourcefulness is an inspiration.</p>

	<p>And if you&#8217;re going to try some Internet research, make sure you hit <a rel="external" href="http://archive.org" title="Internet Archive">The Wayback Machine</a>, which combined with Google, is a great way to really dig up dirt on your friends.  Or just read the original article <a rel="external" href="http://themetricsystem.rjmetrics.com/2008/11/06/single-lawn-signs-conquer-the-american-landscape/" title="RJMetric&#39;s Blog Post">here.</a></p> ]]></description>
			<guid isPermaLink="false">40@http://hedgie.com/blog/pivot/</guid>
			<category>default</category>
			<pubDate>Sun, 09 Nov 2008 01:28:00 -0500</pubDate>
		</item>
		
		
		
		<item>
			<title>Correction: WPA not cracked, merely fraying</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=41&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=41&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p>In an update to yesterday&#8217;s post, it appears the new exploit doesn&#8217;t actually allow recovery of <span class="caps">TKIP</span> keys, but does allow decryption of shorter packets.  Decryption of packets doesn&#8217;t sound too useful, but it does still allow injection of small downstream packets.  Small downstream packets include&#8230; <span class="caps">DNS</span> and <span class="caps">ARP</span> messages.  So while the exploit itself remains pretty much useless, it can provide that little hole to insert the lever of poisoning.  The fact remains that users of <span class="caps">WPA</span> are vulnerable to attack.  More details <a rel="external" href="http://arstechnica.com/articles/paedia/wpa-cracked.ars" title="Arstechnica">here.</a></p>

	<p>The root source of the exploit?  While WPA2 requires <span class="caps">AES</span>, <span class="caps">WPA</span> doesn&#8217;t require it&#8230;  meaning <span class="caps">DES</span> is still in the standard.  Whoops.</p> ]]></description>
			<guid isPermaLink="false">41@http://hedgie.com/blog/pivot/</guid>
			<category>default</category>
			<pubDate>Fri, 07 Nov 2008 22:34:00 -0500</pubDate>
		</item>
		
		
		
		<item>
			<title>TinEye</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=22&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=22&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p><a rel="external" href="http://tineye.com" title="TinEye Search Engine">TinEye</a> is in open beta, meaning anyone can get an account.  It is to images what Google is to text &#8212; it searches not for words (like Google Images does) but for the image itself.  Upload an image, and it will find copies <em>and varients</em> across the web.  Good for locating stolen copies of copyrighted images, or sources of photoshopped pictures, etc.  Very powerful and interesting web tool for graphics!</p> ]]></description>
			<guid isPermaLink="false">22@http://hedgie.com/blog/pivot/</guid>
			<category>linkdump</category>
			<pubDate>Mon, 18 Aug 2008 23:02:00 -0500</pubDate>
		</item>
		
		
		
		<item>
			<title>Free Fun Games</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=14&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=14&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p>Here&#8217;s another high-quality free game, better than most store games &#8212; <a rel="external" href="http://www.wesnoth.org" title="Battle for Wesnoth website">Battle for Wesnoth</a> is a turn-based strategy game similar to Warlords.  Try the Wesbowl multiplayer variation for unique fun!</p> ]]></description>
			<guid isPermaLink="false">14@http://hedgie.com/blog/pivot/</guid>
			<category>linkdump</category>
			<pubDate>Fri, 01 Aug 2008 17:45:00 -0500</pubDate>
		</item>
		
		
		
		<item>
			<title>Looking for good beer?</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=7&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=7&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p>When it comes to beer, its quality over quanity.  But how do you find the gems amongst all the Coors?  Try <a rel="external" href="http://www.beermapping.com">Beer Mapping</a>, the Google Maps of beer.</p> ]]></description>
			<guid isPermaLink="false">7@http://hedgie.com/blog/pivot/</guid>
			<category>linkdump</category>
			<pubDate>Wed, 09 Jul 2008 20:39:00 -0500</pubDate>
		</item>
		
		
		
		<item>
			<title>What I'm Playing Today</title>
			<link>http://www.hedgie.com/blog/pivot/entry.php?id=4&amp;w=my_weblog</link>
			<comments>http://www.hedgie.com/blog/pivot/entry.php?id=4&amp;w=my_weblog#comm</comments>
                        <description><![CDATA[ <p>Okay, I&#8217;ve been playing this for years.  I&#8217;m a lifetime member of <a rel="external" href="http://www.quadradius.com">Quadradius</a> (username Hedgie).  You can play for free; members get some extra options and extra powerups appear in member-only games.  Try it out, and if you see me, say Hello.</p> ]]></description>
			<guid isPermaLink="false">4@http://hedgie.com/blog/pivot/</guid>
			<category>linkdump</category>
			<pubDate>Tue, 08 Jul 2008 14:33:00 -0500</pubDate>
		</item>
		
		
		
	</channel>
</rss>
