Decluttering

declutter photoWith the start of a new year about to happen, I’ve been doing a lot of reflection on where I’ve been focusing my attention, and what I’ve been getting out of those things. My conclusions led me to discover that I have been putting a lot of time and energy into things that don’t necessarily help me, my family, and everything surrounding those primary things (career, creativity, cashflow, etc).

So, I have decided to give up the following:

  • Caring about sports. I may watch some bigger Louisville basketball games, but overall, this has become more of a chore than anything, and I spend way too much time wrapped up in the emotions surrounding games. This is particularly unproductive when they lose.
  • Facebook. I’ve given it up before, but it serves absolutely no purpose for me. If people want to keep in touch, they know how to find me.
  • Clash of Clans. I’ve led a very successful clan for almost 2 years, and been a part of the game for almost 3. I helped start the Reddit Alliance Clans system, and all of this has been a large time sink. I did have a lot of fun, and I met a lot of great people along the way, but ultimately, it’s been entirely unproductive towards helping any of the primary things in life I mentioned above.
  • Reddit. One thing I’ve noticed is that by deleting apps off my phone, I waste a lot less time. So I am removing the Reddit app that I use, and will instead only check in on occasion when at my computer, at home. I tend to get wrapped up in drawn-out conversations (or arguments) on Reddit far too often. While some of these interactions can have positive outcomes (discussing network security, for example), most of the time I am arguing with people who will never change their minds. Why? I have no idea.

I hope to start using all the freed up time and energy (in no particular order) towards continuing my newfound interest in working out, continuing to educate myself, investing more time and energy with my family, making more music, and focusing on the things that support all of the above — the primary things in life.

I will report back more in a few months to let you know how it all goes!

Photo by ollesvensson

Let’s Revisit: Sending Mass Emails The Right Way

envelopes photoThe concept of sending an email to multiple people the right way seems to have eluded the populace as a whole lately. I’m looking at you, schoolteachers, soccer coaches, and party invitation senders. I write to you today because, in recent months, it seems I’ve been included on more and more emails where I’m one of 50 people whose email address is awkwardly stuffed into the CC: field of the email you sent, right there with all the others for everyone in the list to see. I even got an email from the manager of the local Sears store I had recently purchased an appliance from, that got sent to all the people who had bought something there recently, and everyone’s name and address were easily viewable in the CC field.

The problem here is that you are being inconsiderate towards peoples’ privacy, and you are sending around a large list of real email addresses to possibly be harvested by spammers.

There is a way to do this that protects peoples’ privacy, doesn’t annoy the nerds and geeks in your email list, and makes you look like you know what you are doing. What trifecta could be better than that?

The easiest way to do this is by using the BCC: field instead of the CC: field. BCC stands for “Blind carbon copy,” which means that any email address entered in it will not show up to the recipients of the email. The CC: field does show them, so don’t use it.

The trick is that you should enter your own email address in the To: field of the email, then enter the long list of room parents or party invitees in the BCC field. That’s it! Now you too can look cool.

There are some detailed instructions, with pictures, available here, in case you need more info.

Writing for Listverse is a Waste of Your Time

Listverse is often a recommended website for people who wish to make a little extra cash. They make it sound like it is fun and easy to “Write & Get Paid.”

I’m here to urge you not to waste your time. You will be better off writing for real website owners who post projects on Textbroker or any of the other writers’ platforms out there.

The Listverse deal seems rather straightforward at first: come up with a list of things that are quirky and unique, write at least 1200 words about them, cite your sources, then submit them for review. If approved, they send you $100 via Paypal. I thought this sounded like a fun way to make $100 by writing about topics I know and am interested in.

One thing you have to do before writing a list is to make sure they don’t already have a list about the topic you want to write about. Searching their site for existing lists is futile, as their Search feature doesn’t seem to work at all. See the example below, where I searched for a list about vampires that is shown on their home page, and even it doesn’t come up in a search result:

search_-_listverse

This leaves you with having to use Google to query the Listverse site in an attempt to make sure you don’t waste your time writing a list that is already there:

listverse_vampires_-_google_search

Once you think you have a good idea for a list topic, it’s a good idea to read about the Listverse guidelines on what they expect and what the rules of engagement are. Here is how they summarize it:

It works like this: You write your list (10 items per list minimum), you send it in, we reply and say “Great—we’ll publish it” and send you $100 by PayPal (don’t have an account? just make one—it’s easy and free); or we reply and say “Sorry—it isn’t the sort of thing our readers will love—give it another shot.” Just remember, your list should be at least one or two paragraphs per entry.

There is also a more detailed Author Guide that gets into writing style and some more about the rules and what they expect.

The other major caveat is not to write about something in their short list of topics that they are currently not taking submissions for, which are sports, self-help, personal stories, and gaming.

Sounds pretty easy, right?

I dove in and spent about two hours researching topics, writing up a list, proofing it, finding sources for it, then attempting to submit it. Their submission page says, “We only consider submissions with the highest standard of English and submissions should not exceed 1,500 words.”

No problem. I love writing and have what I consider a good mastery of the English language. My article was about 1000 words, so I thought it was ready to go.

First Problem

Only at this point do you learn that lists must be at least 1500 words. Wait…what? Above, on the Submission page, it says that the article “should not exceed 1500 words”. But if you click Submit List, and your article isn’t long enough, you see this:

extra_listverse_com_submit_submit_php

They don’t tell you this anywhere on the submission page until you click the Submit button. And this situation makes it seem like you are set up for failure from the start. So, in one place it says no more than 1500 words, then you are scolded about not having at least 1500 words when you try to submit. What to do?

I went back and added more meat to my list, getting it to the minimum length required, and was finally allowed to proceed. The resulting page and the resulting confirmation email I got told me that it would be up to two weeks before hearing from them. Apparently they read every entry they get, and it is time consuming. I am a patient man, so I was OK with this.

Problem Two: Rejection

I got the rejection letter this morning. I understand not getting accepted for legitimate reasons; it was more about the issues surrounding it that led me to writing this lengthy blog post.

First, the rejection letter itself was not the “highest standard of English,” which was amusing more than anything, but I thought I’d point it out. For example, it said this:

“We regret that your list is just not quite what we are looking for right now; this is usually because your subject matter is outside the scope of the direction in which we are taking Listverse.”

Taking Listverse? Ok, whatever. Moving along…

Second, they go on to list out some of the same caveats about submitting a list, but only this time is it in more detail than before you actually write your list:

We are currently not taking any lists from the following categories: self-help, opinion, product rankings or reviews, money making guides, personal experience stories, health advice, gaming, sports, music, TV, movies, and animals.

My list was not in any of those categories, but I did stop to think that many of these had not been mentioned up front, and I’d have been pissed if I had spent a lot of time on a list about animals, for example.

They went on to list some “technical” reasons for rejection:

1. The list is too short, too long, or does not have ten items
2. The list requires too much editing (poor English or lack of proofing is usually the reason)
3. The topic is already covered on Listverse or the Internet in general
4. The topic is simply not in keeping with the style of content we publish

Regarding 1, I had exactly 10 items on my list. Was I rejected because the list was over 1500 words long, even though I was unable to submit a list unless it was 1500 words long? That seems stupid.

I knew my rejection wasn’t due to numbers 2, 3, or 4, as I had researched everything, proofed it all, and come up with something rather unique to write about, and made it appealing to the type of audience they cater to.

The Final Knockdown: It’s an odds game

Being rather bewildered at the reasons for rejection not lining up with my article, and still not understanding why my submission was not taken, I carefully re-read the rejection email and I found this sentence in the middle:

We receive more than 150 submissions each day and can only choose three for publication.

Only now, after spending all this time writing a list, researching it, proofing it, and waiting on the outcome, did they choose to mention that 3 per day is the limit. The odds sure would have been helpful to know up front, way before any of this ever happened.

But then, why would anyone ever choose to write a list and submit it if they knew the odds, right?

I will not be wasting any more of my time on Listverse, and I urge you not to, either!

Note: I will publish my list here soon. Since they rejected it, I retained rights to it 🙂

WordPress Security from WordCamp Asheville 2016

One of the coolest things about WordCamp is that they post videos of each talk and presentation on WordPress.tv for viewing afterwards. It give you the chance to see all the great presentations you may have missed, or to revisit the ones you attended.

With so many WordCamps happening all over the world, it is a great resource.

My presentation from WordCamp Asheville 2016, titled WordPress Security: Don’t Be a Target, is now live on WordPress.tv.

The NSA Hacks System Administrators

This article reveals that the people holding the keys are often the juiciest targets, regardless of their innocence, as they are a means to and end. However, perhaps the most interesting part of the article, Inside the NSA’s Secret Efforts to Hunt and Hack System Administrators, is this:

Once the agency believes it has identified a sys admin’s personal accounts, according to the posts, it can target them with its so-called QUANTUM hacking techniques. The Snowden files reveal that the QUANTUM methods have been used to secretly inject surveillance malware into a Facebook page by sending malicious NSA data packets that appear to originate from a genuine Facebook server. This method tricks a target’s computer into accepting the malicious packets, allowing the NSA to infect the targeted computer with a malware “implant” and gain unfettered access to the data stored on its hard drive.

Looks like I chose a good week to cancel my Facebook account 😉

Cracking Password-Protected MS Office Files

Disclaimer: Don’t do this unless it’s for legitimate reasons, such as the one outlined below.

At work, I recently came across the need to crack a handful of MS Office files that someone had password protected. Of course, that person was no longer around, so the person who took over needed to figure out how to access these documents, and they asked the Security team for help.

My first instinct turned out to be the correct one: use John the Ripper on Kali 2.

The main issue I faced was extracting the password hash from the Office docs in question so that John The Ripper could have something to run against. Turns out there is a handy python script you can use that does exactly this: office2john.py (https://github.com/kholia/RC4-40-brute-office)

Instructions

Download office2john.py, then make it executable.

# chmod a+x offce2john.py

Now you can use this tool to extract the hash from the Office document, and save it to a text file:

# ./office2john.py secret-company-secrets.docx > hash.txt

Now check out the contents of the hash file if you want:

# cat hash.txt

All you need at this point is a good password list to run through John the Ripper, and a few options to run it with. The sqlmap.txt file that comes with Kali2 is a good candidate:

/usr/share/wordlists/sqlmap.txt

Here’s the full command:

# john --session=docx --rules --wordlist=/usr/share/wordlists/sqlmap.txt hash.txt

Options:
–session=docx – This is the name of this session. Could be anything, really.
–rules – Enables word mangling on the defined wordlist
–wordlist – Path to the word list you are running this against

Now, sit back and wait for John to do its thing.

PDFs

Just use pdfcrack in Kali.

Have you been pwned?

This website has come in handy a couple of times recently. I was made aware that my username and password were found in lists of those stolen from hacked websites, including Dropbox and LinkedIn. Of course, I had long since changed my passwords, but it’s still interesting to see this happen, and it could one day really save me. I suggest you sign up!

https://haveibeenpwned.com/

Have_I_been_pwned__Check_if_your_email_has_been_compromised_in_a_data_breach

clicky