Tanguy Ortolo

XMPPloit is an exploit tool for a so-called “flaw” in the XMPP protocol. It has been published recently under the GPLv3 license, and has received much comment. However, it does not seem anybody took the time to study this attack and explain it.

Goals

XMPPloit is designed to serve as a transparent man-in-the-middle between an XMPP client and its XMPP server, in order to force the client not to encrypt its communications, so that it is possible to read them and modify them on-the-fly.

That allows to force the client to use a clear text authentication mechanism, to display its login and password, and to modify any message it sends or receives.

Read more XMPPloit explained

I had to play a bit with MySQL, saving and restoring databases with mysqldump and mysql. These two tools have one severe discrepancy, which I would like to comment here because I think it is an excellent example of what not to do when designing tools to be used together.

Read more MySQL save/restore: an example of what not to do

You already know NTP, the protocol that allows your computers to keep an accurate clock. Thanks to a global pool of time servers, it is available to everyone on the Internet. This public pool is constituted by volunteers' servers and it needs more.

Read more We need you for the NTP pool!

Do you remember how Intel used to be the white knight of graphic card manufacturers, the one from which you could buy hardware without looking, being sure that it would be supported by GNU/Linux directly?

Do you remember how they broke that by releasing the infamous Poulsbo card?

Well, they did it again. The newest Intel Atom D2500, D2550, D2700, N2600 and N2800 processors, codenamed “CedarView” and “Cedar Trail”, include a graphic core that is only supported by a proprietary driver only available on Meego (read: unusable on regular GNU/Linux.

Read more Beware of the newest Intel Atom GPU

Email spam is a plague, but sometimes there is at least on category of spammers it is easy to have fun with: naive manual spammers. People that try to do more or less legal business, using Internet in an illegitimate way, for instance (this is a real example, including the spammer's address: spamming bots, please use it ;-) !):

From: Emma Perroni <emmaperroni@gmail.com>
Subject: Hello

Hello,

Do you have a Facebook page? If you do, I can offer you to add fans by
hunders/thouthands in a single day using an original (and confidential)
technique. We can also add subscribers to Twitter, Youtube or Google+1.

Prices: 10€ for 100 fans, -20% for more than 1000 fans ordered.

Regards

Read more Fun with spammers