February 2014 - skunkworks - Skunkworks Site

Help on Mod_security blocking Safaricom IPN
by Mike M. 25 Feb '14

25 Feb '14

Anyone experienced a problem with this? My overzealous mod_security blocks the IPN with the following error: [Mon Feb 24 15:10:07 2014] [error] [client XXXXXXX] ModSecurity: Access denied with code 501 (phase 2). Match of "rx ^Identity$" against "REQUEST_HEADERS:Content-Encoding" required. [file "/usr/local/apache/conf/modsec/10_asl_rules.conf"] [line "44"] [id "340362"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: ModSecurity does not support content encodings and can not detect attacks using it, therefore it must be blocked."] [severity "WARNING"] [hostname "mydomainQQQ.com"] [uri "/safscom/process.php"] [unique_id "Uwtgz1jQ0Q4AAE8WZqcAAAA2"] The Safcom IPN data is: http://yourserver/yourscript.php?id=16389103&orig=MPESA&dest=254711343393&t… 13-03-27 04:23:26.0&text=DH33NA709 Confirmed.on 27/3/13 at 4:23 AMKsh50.00 received from 254722540222 ALFRED KAYOKO.New Account balance is Ksh8,189.00& mpesa_msisdn=25472254123456&customer_id=5&user=&pass=&routemethod_id=2&routemethod_ name=HTTP&mpesa_code=DH33NA709&mpesa_trx_date=27/3/13&mpesa_trx_time=4:23 AM&mpesa_amt=50.0&mpesa_sender=ALFRED KAYOKO&business_number=66361 Anyone with an idea of the rule that can allow this?

1 0

Re: [Skunkworks] Microsoft-owned Nokia goes Android
by Jangita Nyagudi 25 Feb '14

25 Feb '14

Isnt Viber already doing this? Viber was bought for $900 m and had 300 m users and had voice, customized emoticons, whastapp for windows plus call out to landlines Whatsapp was bought for $19 b and had 450 m users and no voice, no call out, no windows client etc Maybe I'm missing something? On 25 February 2014 11:43, Haggai Nyang <haggai.nyang(a)gmail.com> wrote: > Not hijacking the thread - something I also saw on the same site from your > link: > > http://metro.co.uk/2014/02/24/the-end-of-phone-bills-whatsapp-to-offer-voic… > > > On Tue, Feb 25, 2014 at 11:27 AM, solomon kariri <solomonkariri(a)gmail.com>wrote: > >> Their title not mine. >> http://metro.co.uk/2014/02/24/microsoft-owned-nokia-goes-android-4315891/ >> >> -- >> Solomon Kariri, >> >> Software Developer, >> Cell: +254736 729 450 >> Skype: solomonkariri >> >> _______________________________________________ >> skunkworks mailing list >> skunkworks(a)lists.my.co.ke >> ------------ >> List info, subscribe/unsubscribe >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >> ------------ >> >> Skunkworks Rules >> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >> ------------ >> Other services @ http://my.co.ke >> > > > _______________________________________________ > skunkworks mailing list > skunkworks(a)lists.my.co.ke > ------------ > List info, subscribe/unsubscribe > http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks > ------------ > > Skunkworks Rules > http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 > ------------ > Other services @ http://my.co.ke >

2 1

The future is awesome indeed!
by Francis Okinyo 25 Feb '14

25 Feb '14

http://www.google.com/atap/projecttango/ -- Warm Regards Francis Okinyo 0710-989318/0735-056206

3 3

Microsoft-owned Nokia goes Android
by solomon kariri 25 Feb '14

25 Feb '14

Their title not mine. http://metro.co.uk/2014/02/24/microsoft-owned-nokia-goes-android-4315891/ -- Solomon Kariri, Software Developer, Cell: +254736 729 450 Skype: solomonkariri

4 4

Best Travel Routers - Portable
by Thuo Wilson 25 Feb '14

25 Feb '14

Hi, Where can i get this routers in KE - http://bit.ly/NtC8mc TP-LINK as no1 One required urgently. Kind Regards, Wilson./

1 0

YEalink - T20 ip phone
by Thuo Wilson 25 Feb '14

25 Feb '14

Hello Guya, Anyone selling yealink or another IP Phone of same quality? Kind Regards, Wilson./

3 4

ISOC grants webinar
by Adam Nelson 25 Feb '14

25 Feb '14

http://www.internetsociety.org/events/information-session-how-apply-communi… This is potentially a good way for Kenyan/Ugandan groups to get grant money (up to $10k I believe) for their projects. There's a 25% matching funds requirement but I'm pretty sure ISOC is all about getting this money out so it's just a matter of smart organizations applying for it - ones that already have money (or goods in kind) being spent on projects and need more of it. -Adam -- Kili - Cloud for Africa: kili.io Musings: twitter.com/varud <https://twitter.com/varud> More Musings: varud.com About Adam: www.linkedin.com/in/adamcnelson

1 0

Bandwith management Tool
by Luke Rotich 25 Feb '14

25 Feb '14

Anybody who knows of the available bandwith management tool in the market? -- Regards *Luke k Rotich*

9 13

NTV Right Now - Samsung S5 Keynote
by ndungu stephen 25 Feb '14

25 Feb '14

Going on right now - compared to Steve Jobs Apple Launch - this is a terrible Keynote

5 8

Re: [Skunkworks] ECCouncil Hacked
by Gichuki John Chuksjonia 24 Feb '14

24 Feb '14

Nothing is more than 80% secure. All networks are insecure, but what matters is how you protect them. I currently did a Blackbox against an organization that i truly felt was soo protected, and i was actually afraid of taking the job, but later on, i was upside down and every where. Nothing is impenetrable. Hire the best Information RIsk consultants, and you will see how. On 2/24/14, Steve Obbayi <steve(a)sobbayi.com> wrote: > Ah ok Joseph, thanks for clarifying > > ----- Original Message ----- > > | From: "Joseph Tintale" <jayxtintale(a)gmail.com> > | To: "Skunkworks Mailing List" <skunkworks(a)lists.my.co.ke> > | Sent: Lunes, 24 de Febrero 2014 7:23:09 > | Subject: Re: [Skunkworks] ECCouncil Hacked > > | @Steve, did you ever hear me say that you shouldn't do anything and > | wait for hack3rs to break your site? FYI, I'm a security researcher > | and always take web security seriously. > | As much as one tries to mitigate exploits, there are several advanced > | techniques which hack3rs use to break sites. These include: > > | WAF bypasses, encoding sniffing, external entity injection and > | advanced SQL injection. > > | KR, > | Joseph. > > | On Mon, Feb 24, 2014 at 9:52 AM, Steve Obbayi < steve(a)sobbayi.com > > | wrote: > > | | @Joseph I don't agree with your attitude to a high degree. To be > | | honest if your were to ask me to develop my site, I would run away > | | so fast in the opposite direction. Hackers spend a lot of time > | | finding exploits... why can't you as a developer spend as much or > | | more time hardening your website or finding new ways to beat these > | | guys, or recovering as fast as possible from an attack? You don't > | | just sit and say since PayPal or VISA were hacked, there is nothing > | | that can be done. > | > > | | Here is an example of doing something right other than throwing > | | hands > | | up in the air > | > > | | > http://blog.cloudflare.com/good-news-vulnerable-ntp-servers-closing-down > | > > | | My advice to Janiffer, keep worrying and let that worry be positive > | | in that in makes you become better techie. > | > > | | Steve > | > > | | | From: "Joseph Tintale" < jayxtintale(a)gmail.com > > | | > | > | | | To: "janiffer muthama" < j_muthama(a)yahoo.com >, "Skunkworks > | | | Mailing > | | | List" < skunkworks(a)lists.my.co.ke > > | | > | > | | | Sent: Lunes, 24 de Febrero 2014 6:18:50 > | | > | > | | | Subject: Re: [Skunkworks] ECCouncil Hacked > | | > | > > | | | Janiffer, > | | > | > | | | What you need to understand is that all websites are vulnerable > | | | to > | | | hacking. These hackers spend lots of time finding exploits on > | | | their > | | | targets. > | | > | > | | | There's also DDOS which is quite hard to mitigate and major sites > | | | like visa and paypal have suffered occasionally from these type > | | | of > | | | attach. > | | > | > > | | | As a student worry not should you, because worrying is as > | | | effective > | | | as trying to solve an algebra equation by chewing bubblegum. > | | > | > > | | | KR, > | | > | > > | | | Joseph. > | | > | > > | | | On Monday, February 24, 2014, janiffer muthama < > | | | j_muthama(a)yahoo.com > | | | > wrote: > | | > | > > | | | | http://www.eccouncil...org > | | | > | | > | > > | | | | I thought Eccouncil offers certifications to provide the > | | | | foundation > | | | | needed by every Electronic Commerce and Security Professional!, > | | | | The > | | | | professionals are trained by "super professionals" who are > | | | | supposed > | | | | to build and manage an organization's networking and security > | | | | operations and to effectively utilize various resources to > | | | | achieve > | | | | operation excellence. > | | | > | | > | > | | | | Now their site is hacked!! how now??, a shame on their > | | | | professionalism or alama ya Dugudugu? > | | | > | | > | > > | | | | Worried student... > | | | > | | > | > > | | | _______________________________________________ > | | > | > | | | skunkworks mailing list > | | > | > | | | skunkworks(a)lists.my.co.ke > | | > | > | | | ------------ > | | > | > | | | List info, subscribe/unsubscribe > | | > | > | | | http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks > | | > | > | | | ------------ > | | > | > > | | | Skunkworks Rules > | | > | > | | | http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 > | | > | > | | | ------------ > | | > | > | | | Other services @ http://my.co.ke > | | > | > | | _______________________________________________ > | > | | skunkworks mailing list > | > | | skunkworks(a)lists.my.co.ke > | > | | ------------ > | > | | List info, subscribe/unsubscribe > | > | | http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks > | > | | ------------ > | > > | | Skunkworks Rules > | > | | http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 > | > | | ------------ > | > | | Other services @ http://my.co..ke > | > > | _______________________________________________ > | skunkworks mailing list > | skunkworks(a)lists.my.co.ke > | ------------ > | List info, subscribe/unsubscribe > | http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks > | ------------ > > | Skunkworks Rules > | http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 > | ------------ > | Other services @ http://my.co.ke -- -- Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P I.T Security Analyst and Penetration Tester jgichuki at inbox d0t com {FORUM}http://lists.my.co.ke/pipermail/security/ http://chuksjonia.blogspot.com/

1 0