Solving Heartbleed Bug

Earlier this week, security researchers announced a vulnerability (known as “Heartbleed Bug”) in OpenSSL, a widely-used opensource cryptographic software library. It can allow attackers to read the memory of the systems using vulnerable versions of OpenSSL library (1.0.1 through 1.0.1f). This may disclose the secret keys of vulnerable servers, which allows attackers to decrypt and eavesdrop on SSL encrypted communications and impersonate service providers. In addition, other data in memory may be disclosed, which could include usernames and passwords of users or other data stored in server memory.

To be clear, this is a vulnerability of the OpenSSL library, and not a flaw with SSL/TLS, nor certificates issued by Symantec or GeoTrust.

Here are steps to fix this bug:

1. Identify if your web servers are vulnerable (running OpenSSL versions 1.0.1 through 1.0.1f with heartbeat extension enabled). If you’re running a version of OpenSSL prior to 1.0.1, no further action is required.
2. If your server is impacted, update to the latest patched version of OpenSSL (1.0.1g).
3. Generate a new Certificate Signing Request (CSR).
4. Reissue any SSL certificates for affected web servers using the new CSR (do this after moving to a patched version of OpenSSL).
5. Install the new SSL certificate.
6. Website administrators should also consider resetting end-user passwords that may have been visible in a compromised server memory.

Hope you will save in this storm.

MySQL: manage (disable, purge/clean) binary log files (mysql-bin.xxx)

MySQL binary log files contain all statements that update data or potentially could have updated it.
These files have 2 important purposes:

• Data Recovery : after a backup file has been restored, the events in the binary log that were recorded after the backup was made are re-executed. These events bring databases up to date from the point of the backup.
• High availability / replication : used on master replication servers as a record of the statements to be sent to slave servers. The master server sends the events contained in its binary log to its slaves, which execute those events to make the same data changes that were made on the master.

The problem is these files can cause your hard disk full. So you need to manage them to save your hard disk space and match your replication and backup policy. Please note that you shouldn't delete them manually. Instead of, you should configure MySQL for them.

I suggest 2 ways for handling them.

1. Disable these binary logs if you don't use replication function.
Open my.ini (Windows) or my.cnf (Linux), then find the line (starting with log-bin or log_bin) and comment to disable it:
#log-bin = mysql-bin
You should create a backup (dump data) daily if disable this.

2. Purge / clean them frequently if you use replication function.
Login to mysql then use the following command:

mysql> PURGE BINARY LOGS BEFORE DATE(NOW() - INTERVAL 3 DAY) + INTERVAL 0 SECOND;

It will clean all binary logs before midnight 3 days ago.

You may also need to set expire_logs_days value:

mysql> SET GLOBAL expire_logs_days = 3;

And add or modify this variable in my.ini (Windows) or my.cnf (Linux).

[mysqld]
expire-logs-days=3

To avoid to interrupt your replication, run SHOW SLAVE STATUS\G to check, you will see 2 binary logs from the Master: Master_Log_File and Relay_Master_Log_File. Then run this command:
PURGE BINARY LOGS TO 'Whatever Relay_Master_Log_File Is';

Finally you should restart your MySQL. That's all.

Setup free emails with your own domain on Outlook.com

MS Outlook.com offers free email service, in which you can create emails (50 & can more) with your own domain. Further its email is unlimited storage. So what are you waiting for? :)

1. Register your own domain with domains.live.com

Go to domains.live.com, sign in then click Add domain button. Fill your domain to the box then click Continue button. See below image for quick reference:

2. Review and accept agreement

Microsoft will ask you review & accept the agreement. Let accept it.

3. Verify your domain and config MX record

After finishing step 2 above, it will display setting info for you to config your domain. You must verify the domain before using. There are some ways there. I recommend you use MX record way to verify and config your domain to send emails just in 1 step. Let pay attention on Mail setup (required) section as the following:

Go to DNS of the domain and add a MX record with value same as MX server which you see on Mail setup (required) the area. You can add your domain registrar for supporting to add this MX record.
When this is finished, it needs time (few minutes to 48 hours) to verify  your domain. After click Refresh in above picture, if you see Your service is Active like the following picture, that's time you can add emails for the domain:

Or after few hours, you can sign-in domains.live.com again, then select your domain with status Pending DNS configuration to hit Refresh button again, until it is active.

4. Create accounts (emails)

After your domain is active, you can create emails. Or you can add them by clicking Member accounts menu then click Add button. You also can Edit or Delete emails here.

5. Check and send emails via an apps

If you have time, you can read detail instruction here. In this article, I'll brief in major steps:

5.1 Enable POP

Go to Outlook.com, log-in to your email account, then click Options:

Then click Connect devices and apps with POP:

Click Enable option, select Don't let... to keep your emails on the server. Click Save button.

5.2 Config client email app

After enabling POP, now you can receive & send emails via an apps. Below is setting info:

• Incoming (POP3) Server
  • Server address: pop-mail.outlook.com
  • Port: 995
  • Encrypted Connection: SSL
• Outgoing (SMTP) Server
  • Server address: smtp-mail.outlook.com
  • Port: 25 (or 587 if 25 is blocked)
  • Authentication: Yes
  • Encrypted Connection: TLS
• User name: Your email address
• Password: Your password
• If you don’t want email to be deleted from your Outlook.com inbox after it’s downloaded to your email app, select the Leave a copy of messages on the server option.

That's all. Bye! See you in next geek!

Review email services for own domain

A good email service is very important for your business and also for your online life. How about your current email service? did you lose any email? did it run smoothly? how much does it cost you?

It's time to look around email services for finding your best email service for your own domain.

1. Outlook.com

I really love it, it is a profuct of Microsoft which is the last guy in top big buys still gives free emails. To register, you must set up your domain on http://domains.live.com
Free emails: 50
Price: $19.95/email account/year to remove ads
Storage: unlimited
Attachment: up to 25 MB

2. Google Apps

I used it for many my domains. This guy is leading in email services, but Google Apps stops to give free emails from 2012. Really sad for that.
Free emails: None
Price: $50/email account/year
Storage: 30 GB
Attachment: up to 25 MB

3. Office 365 Small Business

Another guy from Microsoft beside Outlook.com. This guy is main competitor of Google Apps.
Free emails: None
Price: $60/email account/year
Storage: 50 GB
Attachment: up to 25 MB

4. Yahoo Small Business

Yahoo still is one of the leaders in email service. Before Gmail, I just use Yahoo! Mail. Now I still keep my Yahoo! Mail for some my contacts and Yahoo! Messenger.
Free emails: None
Price: $35/email account/year
Storage: unlimited
Attachment: up to 20 MB

5. FastMail

Owned by Opera, FastMail is the most popular alternate to Google Apps for email service on the own domain for years now because some good reasons. Cheap, stability, fast.
Free emails: None
Price: start form $10/email account/year
Storage: start from 250 MB
Attachment: up to 20 MB

6. Rackspace Email

Between tons of hosting providers sell email service, Rackspace is one of the best guys.
Free emails: None
Price: $24/email account/year
Storage: 25 GB
Attachment: up to 50 MB

7. Zoho Mail

Zoho is famous guy in CRM. However he is also big player in email service. Especially, it give 5 free users.
Free emails: 20
Price: $24/email account/year
Storage: from 5 GB (free)
Attachment: depend

Hope you can select the best email service for your own domain.

Detect and remove SPAM SEO (BlackHat SEO)

Today using SPAM SEO (Black Hat SEO) is a stupid way to get higher ranking in Google. The website uses SPAM SEO is detected easily by Google and Google will shoot penalty the website if it detects many SPAM SEO for the website.

However this is the best way to knock out a competitor. The competitor will take much time to work with Google and remove / disavow these SPAM SEO links. It is not an easy work.

So your website may become a victim of bad guy for his cruel purpose.

1. How to know if my website gets Malware Spam SEO (MW:SPAM:SEO)
You can do one of the following way:
-Install an antivirus like Avas, AVG, etc. on a computer, then browse your website. It will alert if your website infects MW:SPAM:SEO.
-Scan your website via sitecheck2.sucuri.net. It will alert and point out where MW:SPAM:SEO appears on your website. Although it just makes highlights the MW:SPAM:SEO on HTML code, but it will help you to find out where the Malware comes in the source code of your website. I recommend this tool.

2. How to know where MW:SPAM:SEO stays in the source code
2.1 Use antivirus software to scan your source code files. Normally, some antivirus software can detect infected / compromised files. This is fastest way to remove the Malware if its code pattern is in a database of an antivirus.

2.2 Sort files by created / modified date to limit files or make priorities on files for exploring.

2.3 Check & sort by date your web server log on POST requests if you have configured the log. It will help a lot to limit files or make priorities on files for exploring the Malware manually.

2.4 Based on scanning result of sitecheck2.sucuri.net, you can know which page then guess which file can be infected.

2.5 Search special phrases
-Some popular malwares can have a special phrases to find out. e.g. Clickjack will have function dnnViewState or function xViewState. So just do a search on these famous phrases and see if you are lucky.
-After doing above steps, and you still cannot find where the Malware stays. It's time to do some hard works. It will take your time depending on your experiences. If your source code is written by PHP, search special functions of PHP such as: eval, base64_decode, gzinflate, str_rot13, hexdec, file_get_contents, mail, fsockopen, pfsockopen, stream_socket_client, exec, system, passthru. For example, if your server is Linux you can use below command to find all files containing eval or base64_decode function then export these file names to forexploring.txt file:
find . -type f -name '*.php' | xargs egrep -i "(eval|base64_decode) *\(" > forexploring.txt

In my real case, I have 2 websites infected MW:SPAM:SEO. One website infect Clickjack, then I remove it easily by searching function dnnViewState mentioned in step 2.5 above. Another website I tried to scan with some antivirus as also as searching keywords of popular malwares but not found. Then I use step 2.4 above, then I guess that it can be in a free module which I installed in my Joomla website. The module is mod_InowSlideShow. After that I search special functions of PHP in the source files of this module, and I found the file modules\mod_InowSlideShow\tmpl\default.php use function file_get_contents to insert a HTML code to my site. I removed it, then didn't get any warning after doing step 1 again.

3. Prevention is better than cure
-Update frequently security fixes for your server (OS, web server, DB server, PHP etc)
-Update frequently security fixes for your CMS (Joomla, WordPress etc)
-Set up an antivirus on your server, set up firewall on your server
-Set up logs for your server
-Change your passwords frequently and follow password name rule

Good luck to you!