hackademix.net

So the Hokkaido G8 has food security, climate changes and oil prices in a prominent place of its agenda.

Bush has made accountability a major theme for this year’s G8 meetings, arguing that “we need people who not only make promises, but write checks, for the sake of human rights and human dignity, and for the sake of peace.” The G8 includes Britain, Canada, France, Germany, Italy, Japan, Russia and the United States.

G8 leaders are expected to address an array of political, security and economic issues when they meet for three days. “We expect that they will discuss a broad range of issues, including development, Africa, food security, trade and investment policy, energy security, climate change and issues relating to the global economy, including oil prices.

Obviously, we expect the very same people who became insanely rich thanks to these “issues” ¹ to clean up their profitable mess and save the world.

We expect politicians whose career and position is entirely built upon terror to fight it.
We expect governments driven by ruthless corporate interests to regulate for a planet-sustainable economy, which may require profit margin reductions or even degrowth ².
We expect oil companies, mercenary armies, reconstruction contractors and weapon manufacturers, which rather than bribing the elected people representatives like they used to do in the past, nowadays have their executives directly placed in key government roles as an obscene parody of democracy, to shoot themselves in their feet.

Just like expecting anti-virus vendors to push technologies and approaches making our information systems really safer, or Microsoft to promote open (web) standards…

Notes

Looks like I’m helping Obama’s campaign in an unexpected way :)

Update

Let’s help Google doing its part too: John McCain, John McCain, John McCain, John McCain, John McCain, John McCain, John McCain, John McCain, John McCain…

Discovered the ultimate cure for the NIMBY syndrome!

Reported by Beppe Grillo (popular Italian blog), but ignored by mainstream television news as usual: with an urgent decree effective since May 1st 2008, Italian Government allows toxic/nuclear waste storage sites, polluting power plants, incinerators and similar tourist attractions to be covered by State Secret.
Information about their existence, location and environmental impact can be declared “classified”: anybody revealing them risks up to 5 years in prison.
Even the official Public Health agencies are banned from exercising their ordinary monitoring powers: in other words, no common people can actually measure, know or tell if a certain place in the sun-blessed Italian seaside or countryside is being actively poisoned by a government-blessed shit factory.

In the embedded Youtube movie clip, former Minister of Culture and Tourism Francesco Rutelli (of the cabinet which wrote the aforementioned decree) invites you to visit the Best Country in the World®.
Where are you going to spend your summer vacations?
Any relocation hint for me and my family?

One of my early Hackademix posts was about SQL injection vulnerabilities exploited to deface the United Nations main web site. In a later update I explained how, rather than fixing their holes properly, the U.N. technicians deployed a pretty useless Web Application Firewall, masking the most obvious attack surface but keeping their sites just as vulnerable as before.

Now WebSense is reporting that both the United Nations and the UK Government have web pages affected by the infamous “Mass Malicious JavaScript Attack”, which has been spreading since January across thousands of sites, bombing visitors with a chain of 8 client-side exploits triggered by an external script hosted on remote servers (e.g.

).
These exploits leverage a Microsoft Internet Explorer 7 vulnerability patched last year (bad guys seem not to trust Windows Update effectiveness), “as well as [bugs in] other applications”. Well, since modern browsers embed a lot of “other applications” which are usually quite vulnerable, maybe a good idea (actually the only sane idea, other than reverting to Lynx) is switching to a safe web browser and — shameless plug(in) — making it even safer by preemptively blocking execution of malicious scripts and embedded content. On a side note, Opera’s web site preferences couldn’t help in cases like these, when the compromised site is probably among the ones you trust, allowed to run scripts; NoScript, instead, still blocks the external malicious code even if the main page is in your whitelist.

As previously explained by SANS, the

tag importing the malicious JavaScript code is inserted into the victim web pages through trivial SQL injection vulnerabilities, so much trivial that an automated tool has been used to find vulnerable sites through Google and infect them with the payload.
The default search pattern of this tool is

: in English, “those web pages developed with Microsoft Active Server Pages technology and accepting query string parameters”. Unsurprisingly, this profile matches the original, still unpatched U.N. SQL injection; as I already said reporting the first accident, I believe crackers primarily target ASP sites (even though they are relatively few nowadays) because of the poor coding standards often shown by ASP coders, who usually have a Visual Basic desktop programming background and are less aware of web application security.

At any rate, some simple googling reveals that some U.N. sites are still infected, while UK Government sites have been “cleaned up”.
The sad truth, though, is that even those “clean” sites are still vulnerable, hence they could be reinfected at any time: some people just never learn…

According to the main Italian press agency ANSA, the major of the beautiful city Florence, Leonardo Domenici, has just filed a complaint to take in court Wikipedia, accused of defamation.
Reason: the encyclopedic entry about him, currently obscured as a legal precaution*, reported a story about his wife being favored by the city administration in public contracts. In a note, major Domenici states that this is “a slander”, as already ruled in a trial.

Question: since Wikipedia is open to public editing and discussion, did Domenici try to rectify the story, possibly abducting the aforementioned ruling as a reference, before trying to take this case in a court? And, most important, who’s legally responsible for editorial content which is freely editable by anyone and whose authority is supposed to derive by external references and editing history/discussion?

*March the 1st, a couple hours later…

A previous version of the article dating to August 2007 has been restored, removing the whole “Criticisms” section as shown by this chronology diff.
For those who can read Italian, here’s the Wikipedia editors discussion about this case: at the core, they’re raising same question I asked myself this morning: couldn’t he simply click the “Edit” button?