Gua Damai located north side of Batu Caves, near Kampung Melayu Wira Damai. Coordinate: 3.2477904, 101.687463. Last few month, I have the chance to spend some evening there, at the place, and did some bouldering with the kids, and of course, cycling. Here are some pictures

Nowadays, you must receive at least one phishing email, containing phishing URL, every time you open your email. Most probably, it will stuck in spam folder. Spam filters nowadays really did what it suppose to do, but not in all cases.


How to identify phishing email? How to make sure you’re safe from phishing?
You cannot trust “From” field in an email. It can be spoof, and it can be anything. You can send an email to anyone, claiming you’re from Maybank Security Team . There is a mechanism to solve this issue, such as Sender Policy Framework (SPF), where it will verify whether the IP of the email sender is a valid email server to send email for the particular domain it claims to be, but it is not implemented widely yet.

The URL. The right bank will not ask you to fill in any username or password from the link they provided. If you happen to receive any email from your bank, just type bank URL in a new tab/window. Dont follow the link provided.

Anyhow, you have to be able to distinguish a valid URL, and phishing URL. In this case, I’m showing an example of Maybank. The valid URL for Maybank online banking is http://www.maybank2u.com.my. Some phishers will create the phishing site at different URL, and twisted to make you believe it is the valid Maybank URL.

For example
1. http://11.11.11.11/www.maybank2u.com.my
2. http://maybnk2u.com/my/
3. http://maybnk2u.com.my/
4. http://www.maybank2u.com.my.mydomain.com/

All of above are invalid Maybank domain. The most important part in a URL were as bolded in the list above. We will go through the link above.

1. The URL is pointing to a server, with ip address 11.11.11.11 (just illustration). The content is hosted at server with IP 11.11.11.11.
2. The host is actually maybnk2u.com. The phisher is trying to cheat you, by using a domain name that is similar to the valid domain. /my/ in this case is just a content folder on the server.
3. The domain name is almost similar like no 2, but the whole domain is maybnk2u.com.my. All .my domain name were handled by Domain Registry. You should report as soon as you see any phishing site using .my domains to DomainRegistry.
4. You can see www.maybank2u.com.my as part of the domain, but the main domain is at mydomain.com. The owner of mydomain.com created a subdomain, and sub-sub domains for mydomains.com. So, www.maybank2u.com.my is subdomain of mydomain.com. The owner of mydomains.com is the phisher.

Rule of thumb

1. Check for host name : from http:// until next /.
2. In the hostname, check for domain name. Usually last 2 or 3 octet of hostname. such as domainname.com or domainname.com.my.
3. If the domain is other than maybank2u.com.my, the URL is a phishing site.

What should I do with phishing site?
There are few databases of phishing website, that were shared to popular browsers to alert users of known phishing site. If you found a phishing URL, most probably a red alert output will appear to warn you. But, if the phishing site is still new, the alert won’t show up. You should contribute to the database as well, to make sure other users wont be cheated.

1. Using firefox : Click help –> Report web forgery
2. Go to phishtank.com, and submit the URL. Phishtank is one of the largest database of phishing sites.

What contribute to increase cases of phishing?

1. Insecure server – Most phishers were riding on a compromise machine to host the phishing site. It will look like the compromised server is launching the phishing site, and keep them behind the scene. Besides, the compromised server sometime being used to send phishing email to massive email list, and most probably your email will be in it. Thanks to email harvester. There is a mail sending script that will facilitate the process.
2. Compromised email account – You ever encountered your friend sending you a suspicious link? Most probably his/her account was compromised, and being used to send phishing URL or anything to you and his/her other friends in contact list. And most cases, it happen on yahoo email. Not sure why, maybe there’s alot of yahoo’s phishing victim. If it comes from yahoo email, you can check which IP the sender send the email from, leading to which country.
3. Open relay mail server – Email server with mail relay enable will allow anyone to use that mail server to send email. There also some software to facilitate the process of connecting, and sending email using the mail server. You can check if your server have open mail relay enabled. Just google “check open mail relay“.

I hope to see everyone is safe online, while IT helps our life. Banking, social network, communication, we really depends on internet to do those things. So, it takes everyone’s responsibility to take online security and privacy seriously.

Hope this post will help some people in understanding one of the massive online threat, phishing.

We depart from Tanjung Gemuk jetty, at about 7am, the earliest ferry to go to the island. On top of the ferry ticket, there was also a marine park permit, that cost us RM7 each. From some articles I’ve read, they said that the ferry should stop at Tekek, then move towards south from it. If you plan to go north, you have to either walk, or rent a boat from Tekek. Our ferry that day start dropping passengers from south to north, starting from Kg Genting. BTW, Tekek is like the main town of Tioman. You will find the only ATM machine (BSN) and airport in Tekek.

We stop kat Kg Air Batang, where there is a lot of small hut, which were suitable for backpackers. The room rates there is almost the same, just tell what kind of hut do you want, either with air-cond or not. However, we have decided to go to Panuba Inn Resort. You have to do some jungle tracking from Air Batang to Panuba Inn. If you have decided to go to Panuba Inn, tell the ferry to drop you straight away at Panuba’s jetty. Yes, jetty for the resort. And dont walk from Air Batang.

Panuba Inn is quite isolated from other resort and huts. If you want to go to other part of the island, or want to do any activities, you can just ask the receptionist for boat with some fees. They also have a diveshop, and also snorkeling gear for rent.

I must say, i really enjoy snorkeling there. The area around the jetty is not really nice, as there was not much corals there. But we took a long snorkeling trip, from Panuba Inn, to Marine Park (300-500 meter north of Tekek). Along the way, we have the chance to see many corals, and some colorful fish, that really stunned us, and take us some time along the way. Please be careful with the corals were very sharp and it can cut. I cut myself when I’m going to the shore, and it was deep.

In snorkeling, actually I enjoy going deep and deeper to the bottom. At marine park, there’s a lot of fish, but I’m more attracted to the deep, and the buoy that they have at the area. The buoy is just a nice place to rest, and launching myself to the bottom There’s alot of fish there, and dont forget to find something to feed the fish. We spend quite some time there.

The next day, we spent snorkeling just around the jetty at our resort. Its about 4 meters deep, and just good enough for me. Luckily that day, we found a friend, a 5 years-old girl. She’s talkative, and brave. She tried to dive from the jetty, and try to dive deep as well.

Tioman have a great water. Clear, and I never find anywhere like it yet before, because I never been to all island in Malaysia yet. Its better than Kapas Island and Pangkor Island for me. I dont know about Redang and Perhentian Island. Hope I could have some time for the other island as well.

The place is quite remote, and you have to drive past villages, but its quite easy to find. Just exit at Lanchang, and just drive straight, until you can see signboard to the sanctuary. There are free tickets to be distributed, but they have color scheme for the tickets. The red ticket is for most people, and with this ticket, you can just see and say hi to the elephant. With green ticket, you can have a shower session with the elephant. But, this ticket is limited to 100 tickets issued per day. So, you have to be there as soon as possible before the tickets runs out.

There are few sections where you can have different experience with the elephants. The first part where there are 2 baby elephant, aged 3 and 4, named langsat and pandan. They are friendly, you can take pictures with them, and feed them with your hands. They will just grab what you offer with its trunk. You can buy some foods from there, there is a shop where you can buy some foods for them.

There are also one section where you can have a shower with the elephants. The elephant at this sections i suppose were quite big, not sure the elephant’s age. Unluckily, we dont have the chance to see the elephants in action that day. With the right ticket and the elephants in the right mood, you can go into the small river, and have a shower with them. There is a signboard, mentioned, “no bikini”. You might want to take note of that

Bukit Tabur is located in Taman Melawati. The place also becomes very popular for hiking activities during weekends, and sightseeing. The sunrise view was magnificent. I have blog about this place once before. There are a few routes, but we choose the place where I’m familiar with, the starting point at the water treatment plant.
Sungai Pisang on the other side is just jungle tracking, just 10 minutes, as we choose to park our cars just by the highway, Karak Highway. Its just about 10 minutes from Gombak toll. I do not want to do 40 minutes tracking anymore, just want to have some picnic, swimming, skip the tracking

Below are the pictures.

I’ve been looking for a place to climb. Its been quite some time since I last climb, and I found a place not too far. Its in Putrajaya, Extreme Park. I’ve heard there are off-road bicycle trail near that place, but not really sure where is it. The climbing place is not too far from Putrajaya International Convention Center. The coordinate is “N 2 53.318, E 101 40.082” or “2.889, 101.668“, you can find it yourself of you have a GPS.

View Larger Map

They do provide equipments for rent to all visitors. Its quite a convenient for me to bring my friends who do not have any gears to start climbing, and the rates are quite affordable. Its just that some of them are worn out, and not really convenient to use, like the shoes. The entry fee is RM 6 for adults, and RM 3 for student (provided you have a student card)

The climbing section were separated into 4 sections, Easy top rope wall, lead climbing wall, beginner boulder wall, and expert boulder wall. You can start anywhere you want, but make sure you have a good belayer for yourself and your group. You might want to ask the instructor if they have anyone to attend you. I’m quite sure they are quite helpful. They have grades on each route, which tell the difficulties of the route. Make sure you know your limit, try it slowly from easy route to harder route.

The opening hours, they open up from morning(not sure) until 8pm. But on Wed, Friday and Saturday, they will close at 10pm. Make sure you plan your trip, if you want to stay a bit late.

Yesterday I have told you guys I will be going to RMAF Subang Air Base today for Joint RMAF USAF aerobatic performance there today. Well, we made it!
Me with Syarafuddin Sulaiman, we were there a a bit late, as it was raining heavily in the
morning in our place. But, we dont want to miss it, and dont want to live in regret and uncertainty, we just went off there in the heavy rain.
Luckily, the air show still being held, but we missed C-17 Globemaster. I dont know whether it in the air or not this morning.

We can see one RMAF Sukhoi jet flying around over in the traffic jam. The traffic jam was horrible. We could not get much good shots for the Sukhoi
jet. We just park the car by the roadside, and walk for a good place to take picturess. We couldn’t get a good shot of the runway, its quite far, and
blocked by a a fence! Din just did what he can. He still can get some good shots.

F-16 Falcon Thunderbird was great. We arrive just in time for the Thunderbirds to come out. The sounds, the vibration over the ground, it was
exciting! We can feel the shaking while one of the jet fly right on top of us. They did a good and interesting formation, one of them was where four
of them fly from different angle towards the runway, and pass by each other in the middle of the runway. That was close!

We didn’t plan the trip very well, we couldn’t get close to the runway, and arrived a bit late. We also missed the C-17 Globemaster session. I also
not sure whether its in the air or not this morning. Hope to get my hands on one of the DSLR myself. Will wait for the next chance

Thanks Din for the pictures

Picture grabbed from Zagispirit, taken at Townsville ADF Airshow
2009

The event will start at 1030 am, with C-17 demonstration, followed by RMAF Sukhoi airshow. USAF thunderbird airshow will start at 11.30am followed by
autograph signing by Thunderbirds Crew. This event will be open for public for free, and will be expecting huge crowds.

I wish I have my own camera to take the shots. Just enjoying the show la You guys dont miss it!

Press release
href="http://malaysia.usembassy.gov/event_thunderbirds_093009announce.html">http://malaysia.usembassy.gov/event_thunderbirds_093009announce.html
http://www.bernama.com/bernama/v5/newsgeneral.php?id=441102

This post might serve as my first test, to post using DashBlog.

You can get it here.
https://addons.mozilla.org/en-US/firefox/addon/7215