Unleashing Cybersecurity Skills: The World of Capture The Flag (CTF)

In the realm of cybersecurity, there's a game that isn't just about fun, but also about learning, challenges, and honing your hacking skills. It's called Capture The Flag (CTF). 

In this article, we'll delve into what CTF is, how it works, and why it's a crucial training ground for aspiring cybersecurity professionals.

1. Understanding Capture The Flag (CTF)

Capture The Flag (CTF) is a cybersecurity competition that simulates real-world hacking scenarios. Participants solve puzzles, decode messages, exploit vulnerabilities, and ultimately retrieve hidden "flags" to earn points. Flags are unique strings that prove a challenge's completion.

Image: A visual representation of a CTF flag being captured

2. Categories of CTF Challenges

CTF challenges are divided into distinct categories, mirroring the diverse aspects of cybersecurity:

Image: 6 common categories of Cyber Battle: Capture The Flag

2.1 Cryptography:

Cryptography challenges involve deciphering encoded messages, cracking codes, and understanding encryption techniques. You'll encounter various types of cyphers, substitution methods, and algorithms. Participants often need to apply analytical and mathematical thinking to break the encryption.

2.2 Web Security:

Web security challenges are focused on identifying and exploiting vulnerabilities present in web applications. These challenges mimic real-world scenarios where hackers attempt to bypass security mechanisms, execute code injection, or manipulate URLs to gain unauthorized access. 

2.3 Forensics:

Forensics challenges involve analyzing digital artefacts, logs, and files to extract hidden information. Participants may recover deleted files, decipher hidden messages in images, or reverse-engineer malware to understand its behaviour. These challenges test your attention to detail and analytical skills.

2.4 Reverse Engineering:

Reverse engineering challenges require participants to dissect compiled programs or binaries to understand their functionality. You'll explore executable files, disassemble code, and identify vulnerabilities. This category is particularly useful for understanding how malware operates.

2.5 Binary Exploitation:

Binary exploitation challenges involve exploiting vulnerabilities in compiled programs. Participants find ways to manipulate input data to trigger buffer overflows, code execution, or privilege escalation. This category focuses on understanding software vulnerabilities and crafting exploits.

2.6 Network Analysis:

Network analysis challenges focus on analyzing network traffic to uncover vulnerabilities or hidden information. You might examine packet captures, identify potential security flaws, and reconstruct network activities to understand their implications.

3. How Does CTF Work?

CTF participants engage in a variety of challenges:

3.1 Challenge Discovery

Participants select and tackle challenges based on their expertise. (You can refer to heading 2 "Categories of CTF Challenges").

3.2 Problem-Solving 

Image: Cyber Battle participants Source: itpss.com

Once participants choose a challenge category, they dive into solving challenges within that domain.

These challenges simulate real-world scenarios and require participants to:

• Analyze Code: Examine source code, binaries, or other files for vulnerabilities and hidden information.
• Reverse Engineer: Disassemble and understand the inner workings of compiled programs.
• Decipher: Decode encrypted messages, cyphers, and codes using cryptography principles.
• Examine Artifacts: Analyze digital artefacts like images, logs, or packet captures to extract relevant information.

Challenges require diverse skills, from coding to cryptography.

3.3 Flag Retrieval 

Solving a challenge leads to the discovery of a "flag," a unique piece of text that confirms successful completion. 

Flags are often in the format of alphanumeric strings. They're usually embedded within challenge files, hidden in code, or even transmitted within network packets.

3.4 Scoring

Image: Scoreboard sample of Cyber Battle: Capture The Flag, Source: haxf4rall.com 

For every successfully retrieved flag, participants earn points. The difficulty of the challenge determines the number of points awarded. 

Complex challenges with intricate solutions yield higher points. The participant or team with the most points wins the competition.

4. Importance of CTF Competitions

Capture The Flag (CTF) competitions are more than just challenges; they provide a rich learning experience and numerous benefits that contribute to personal and professional growth. 

Here's an in-depth exploration of the importance of CTF competitions:

4.1 Skill Enhancement and Practical Application:

Image: Participants of the Cyber Battle: Capture The Flag. Source: BruCert instagram

CTF challenges mirror real-world cybersecurity scenarios. By actively participating in challenges across various domains, participants enhance their technical skills and apply theoretical knowledge to practical situations. These experiences equip individuals with the ability to identify vulnerabilities, develop exploits, and defend against attacks.

4.2 Problem-Solving and Critical Thinking:

Image: Brainstorming session. Source: wework.com

Each CTF challenge presents a unique puzzle that requires analytical thinking, creativity, and problem-solving skills. Participants learn to dissect complex problems, break them down into manageable components, and develop systematic approaches to find solutions. This cultivates a mindset that's essential for tackling intricate cybersecurity challenges.

4.3 Exposure to Diverse Domains:

Image: Representation of diverse into cybersecurity domains. Source: evelynlim.com

CTF competitions cover a broad spectrum of cybersecurity domains, including cryptography, web security, forensics, and more. This exposure allows participants to explore different areas of interest and expertise. It encourages them to become well-rounded cybersecurity professionals with versatile skill sets.

4.4 Hands-On Learning and Active Participation:

Image: photo of 2016’s Cyber Battle: Capture The Flag competition, Source: itpss.com

Traditional learning methods are valuable, but CTF competitions offer a hands-on and immersive learning experience. Participants actively engage with challenges, experiment with tools, and observe immediate outcomes. This hands-on learning approach accelerates skill development and knowledge retention.

4.5 Teamwork and Collaboration:

Image: representing teamwork and collaboration. Source: quietrev.com

Many CTF competitions emphasize teamwork, fostering collaboration and communication among participants. Joining or forming teams allows individuals to share insights, strategies, and solutions. Collaborative efforts mirror real-world cybersecurity operations, where a diverse skill set is essential for success.

4.6 Competitive Spirit and Motivation:

CTF competitions add an element of competition that fuels motivation. Participants strive to earn points, solve challenges, and achieve a high rank on leaderboards. This competitive spirit drives individuals to continuously improve their skills, explore new techniques, and push their boundaries.

5. Preparing for CTF Success

Successfully participating in CTF competitions requires a combination of knowledge, skills, and strategies. Here's a detailed breakdown of how to prepare effectively:

5.1 Learn Key Concepts

1. Cryptography: Familiarize yourself with encryption algorithms, decryption methods, and common cryptographic attacks.
2. Web Security: Understand web vulnerabilities like SQL injection, cross-site scripting (XSS), and request forgery.
3. Forensics: Learn techniques to analyze digital artefacts, recover deleted data, and reconstruct events.
4. Reverse Engineering: Study assembly language and understand how to reverse-engineer compiled programs.
5. Binary Exploitation: Learn about buffer overflows, format string vulnerabilities, and binary analysis.
6. Network Analysis: Gain insights into network protocols, packet capture analysis, and network attacks.

5.2 Practice Regularly

1. CTF Platforms: Explore CTF platforms like PicoCTF, Hack The Box, TryHackMe and PentesterLab Engage with challenges of varying difficulty levels to improve your skills.
2. Wargames: Participate in cybersecurity wargames that simulate real-world scenarios and test your problem-solving abilities.
3. Online Tutorials: Follow online tutorials that cover CTF-related topics and provide step-by-step guidance on solving challenges.

5.3 Joining Communities

1. CTF Forums: Participate in CTF forums and communities to connect with like-minded individuals, ask questions, and share insights.
2. Online Platforms: Join CTF-related Discord servers, Reddit communities, and social media groups to stay updated and interact with experts.

5.4 Team Collaboration

1. Team Formation: Consider forming or joining a CTF team. Diverse skills and expertise within a team can enhance problem-solving and strategy development.
2. Knowledge Sharing: Collaborate with team members to share insights, solutions, and tactics for tackling challenges effectively.

Stay Updated with Trends

1. Cybersecurity News: Follow cybersecurity news, blogs, and websites to stay informed about the latest vulnerabilities, techniques, and trends.
2. CTF Write-Ups: Read CTF write-ups and walkthroughs to understand different solution approaches and expand your toolkit.

Embrace the CTF Journey

Image: Top 3 teams of Cyber Battle: Capture The Flag 2016 Source: itpss.com

In the realm of cybersecurity, Capture The Flag (CTF) competitions emerge as a transformative journey that transcends traditional learning approaches. The path to becoming a proficient cybersecurity professional involves more than textbooks and theoretical knowledge—it's about immersing oneself in practical challenges, fostering problem-solving abilities, and embracing a community of like-minded enthusiasts.

CTF competitions provide a gateway to skill refinement, critical thinking, and continuous learning. As you navigate through various challenges—deciphering cryptographic puzzles, analyzing network traffic, dissecting binaries, and more—you embark on a journey of cybersecurity mastery. Every challenge solved, and every flag captured, contributes to your growth and expertise.

But it's not just about individual achievement. CTF thrives on collaboration and teamwork, reflecting the collaborative nature of cybersecurity operations in the real world. Forming teams, exchanging insights, and collectively unravelling complex challenges fosters camaraderie and mutual growth.

As you prepare, practice, and engage in CTF competitions, you're not just preparing for a challenge; you're preparing to contribute to a field that's critical to our digital landscape. Your efforts in understanding vulnerabilities, refining solutions, and fortifying defences are essential to safeguarding digital environments and information.

So, whether you're a newcomer intrigued by the world of cybersecurity or a seasoned professional seeking to expand your horizons, embrace CTF as a dynamic avenue of growth. With each challenge, you're not only capturing flags but also capturing opportunities to sharpen your skills, collaborate with peers, and contribute to the ever-evolving landscape of cybersecurity.

As you embark on this journey of mastering the art of CTF, remember that the thrill of solving challenges and capturing flags is matched only by the satisfaction of becoming a stronger and more adept cybersecurity practitioner. Let the flags you capture become badges of honour in your pursuit of excellence in the fascinating realm of cybersecurity.

Image: Reaching the summit. Source: zermatt.ch

May your journey through CTF competitions be exhilarating, enlightening, and transformative—a voyage that shapes not just your skills but also your perspective on the intricate dance between technology and security.

With flags in hand and knowledge at heart, venture forth on your path of cybersecurity discovery. The world of CTF awaits your exploration and contribution.

SAFE IT: Quickly Read Through The "Terms of Service"

We have all been there. Reading too many legal things online before creating an account that we just skipped it and checked the checkbox "I agree to the terms and agreement stated in the Terms of Service" and whatever. But what if, not long after you make an account, they decide to abuse the information you put there of? You can't sue them, because they've mentioned it in the Terms of Service.

As part of +Anak IT Brunei 's initiative for using IT safely, you first need to learn what is the purpose of these Terms of Service.

What is Terms of Service?

According to Wikipedia,

Terms of service (also known as terms of use and terms and conditions, commonly abbreviated as ToS or TOS^[1] and TOU) are rules which one must agree to abide by in order to use a service. Terms of service can also be merely a disclaimer, especially regarding the use of websites.

So therefore, if we sign up on Facebook/Twitter/Google+/LinkedIn, or any other site that plans on us, the people with their private information, to have an account with them, we need to understand what are these "rules" they set out for us.

Sure, that would mean that we have to waste 15-30 minutes of our time reading the Terms of Service. Whoever has time to read through, go ahead and its highly advisable. But for those who doesn't, here's an alternative solution. Let me introduce to you, Terms of Service Didn't Read.ORG

Terms of Service Didn't Read - TOSDR.ORG

Using this service you'll be able to quickly read through a few lines of terms and you'll understand what you are getting yourself into. Ranging from not deleting your account, leveraging the information you put into the site for advertising purposes, using your profile picture for social marketing use, using your hobby information for research and then allow them to sell something to you, etc.

If you go into the website and scroll downwards, you'll find a list of websites with their ratings. Go on, have a look through. Use the search to find the website you signed up on and find out what they're doing to your account and information. Stay safe peeps!

Types of Viruses

1. Resident Viruses
   • A terminated-and-stay resident virus permanently attaches to the host computer and operates in memory (RAM). It attempts to load before other mechanisms that attempt to analyse, detect and identify its purpose and origin and can bypass, interrupt or manipulate basic operating system functions.
2. Stealth Viruses
   • A Stealth virus hides the modifications made to files and boot records by modifying and forging the results of calls to functions, therefore programs believe they are reading the original file and not the modified file. A good anti-virus software will probably detect a stealth virus due to the fact that a stealth virus attempts to hide itself in memory when a anti-virus software is launched.
3. Macro Viruses
   • Certain applications contain embedded scripting or "macro" languages enabling users to automate long series of operations as single shorthand actions. A macro virus targets these applications by containing code that replicates and replaces other macros to launch the virus payload when common functions are called
4. Slow Viruses
   • A Slow virus is a difficult virus to detect due to the fact it only modifies and infects files when they have been modified or copied. Therefore the original file will not be infected by the actual copied file. A good way to protect yourself against slow viruses is by using an integrity checker or shell.
5. Direct Action Viruses
   • An aggressive form that replicates and takes direct action when triggered by some condition, date or event. The direct action virus typically resides in system folders or the root directory path where it can be readily accessed and activated and carry out its tasks when the system boots up.
6. Revisiting Viruses
   • A Revisiting virus is a worm virus and attempts to copy itself within the computers memory and then copy itself to another linked computer using TCP/IP protocols. The Morris Worm virus in the late 1980's was the first major virus threat to hit the Internet.
7. Retro Viruses
   • A Retro virus attacks the anti-virus software designed to delete it. The retro virus usually attempts to attack the anti-virus data files such as the virus signature store which disables the ability of the anti-virus software to detect and delete viruses. Otherwise the retro virus attempts to alter the operation of the anti-virus software.
8. Armored Viruses
   • A Armored virus attempts to protect itself from anti-virus software by trying to make anti-virus software believe it is located somewhere else. Therefore the Armored virus has made itself more difficult to trace, disassemble and understand.
9. Overwrite Viruses
   • A virus can partially or completely delete information contained in the files it infects, even replacing portions of application code with its own payload. Viruses of this kind are generally easy to identify with anti-virus software, as they generally tent to alter end-user and system applications in noticeable and identifiable ways.
10. File Infector Viruses
    • The traditional virus is a file infector that targets executables to cause direct or indirect execution of its payload. Most viruses fall under this category and are further classified depending on what is targeted and the actions taken during the infection process.
11. Companion Viruses
    • A Companion virus creates a companion file for each executable file the virus infects. Therefore a companion virus may save itself as scandisk.com and everytime a user executes scandisk.exe, the computer will load scandisk.com and therefore infect the system.
12. Phage Viruses
    • A Phage virus is a very destructive virus that re-writes a executable program with it's own code, rather than just attaching itself to a file. Therefore a Phage virus will usually attempt to delete or destroy every program it infects.
13. Polymorphic Viruses
    • A polymorphic virus is an encrypted virus that hides itself from anti-virus through encrypted (scrambled) data and then decrypts itself to beable to spread through the computer. The thing that makes it hard for anti-virus software to detect polymorphic viruses is that the virus generates an entirely new decryption routine each time it infects a new executable file, making the virus signature different in each signature.
14. Multipartite Viruses
    • A Multipartite virus attempts to attack and infect both the boot sector and executable files at the same time.

Tips to Secure Your Password

Salam readers...

"Oooppsssie~ I saw your password tadie jeng~ It was ****** a.k.a semua bintang 6 kali hahaha baik ko tukar password baru jeng..." - Less educated shoulder surfer

Today I would like to share tips on securing or "hardening" your password... I will also list out certain techniques of password stealing... First, you need to know what are activities to be done by the password stealer in order to steal your password... Here are some common activities done by the password stealer:

• Shoulder Surfing - just like in the picture above, someone is watching things you do with your machine including when entering your password on your keyboard
• Key-logger - Click here to know more about hardware keylogger and you are advised to read this article as well (only if you haven't). Keylogger basically RECORDS everything that you type on your keyboard including your password
• Physical access to your computer's surrounding - some people will have their passwords written everywhere nearby their computers so that they don't have to memorise them. But if that password is physically accessible by other people, it would be a disaster...
• Man-in-the middle attack - as how it sounds like, a man "sitting" in the middle to "READ" any data passed THROUGH including confidential data like passwords
• Protocol Analyzer - Works just like Man-In-The-Middile but it is more towards an application which reads any packets of data going through a network interface and is able to "catch" any clear text including unencrypted passwords
• Web Phishing Attack - A fake site which looks similar to the original site which requires you to type in your username and password which will then saying that your password is incorrect and redirect you to the original site where your username and password is already being sent to the fake site's owner
• Dictionary Attack - Guessing the password with common words found in the prebuilt dictionary
• Brute Force Attack - It will try every valid combination of words, characters, numbers and even symbols in order to create a string of text which is then to be tested whether it is valid or not. Usually it takes time but with the help of today's high-end machine, it is then another disaster

So now you already have basic ideas on how password stealers will do their mission. It is time for you to learn some tips on how to protect and secure your passwords. Some of these might be useful to you:

• When creating password, never use a simple word which can be found in any universal dictionary such as "computer" or even "password" itself...
• Try to put CAPITAL letters instead of making it all in small letters...
• Use numbers as well!
• If possible, try to use symbols as well such as !@#$%^&*()_+ dan yang sewaktu dengannya...
• When you are going to type your password on your keyboard, try to look at your surrounding and make sure there is no one nearby...
• Know your own machine! Always make sure that your machine is not running any malicious program in order to prevent keylogger (software type) being implemented by other people...
• Never write your password on a post-it paper or even scrap paper and leave it insecure...
• Know your physical network! Make sure that you are not connecting to any anonymous internet connectivity...
• Checking email at cyber cafe is a bad, bad and baaaadddd idea... Not only email... Any activity which requires you to type in your password...
• If you are surfing the net, make sure that you are entering the valid domain name. For example, if you want to log into you yahoo mail account, make sure you go to yahoo.com, not y4h00.com...
• Use different password for different accounts...
• Remember this one last important point... "Easy to remember" is also another meaning of "Easy to be guessed"...

There you go... Simple tips on how to secure and protect your password... Hopefully berguna untuk kitani semua...

If you have questions or opinions, kindly post your comments =) thank you...

Sekian, until next time~

How less valuable data may become a threat

Thursday, 01 July 2010 22:47 | Written by Administrator

Salam Anak IT.

How less valuable data may become a threat... In other words, cemana bulih data yang "kurang mendapat perhatian" or nya urang kitani "inda kana care" akan menjadi security threat arah kitani...

On this "lesson", I will show you how people with extra-ordinary thinking may use the "scrap" data into something useful. "Something useful" which will be demonstrated here are:

1. Finding vulnerabilities on web application
2. Password guessing

DISCLAIMER: Before you do or follow any activities written on this article, please note that any activity that you are going to do next is your own responsibility. This article is just for demonstration. Anak IT will not responsible for any activities that you are going to do based on this article. Do it at your own risk.

So first, we will start with "Finding vulnerabilities on web application"... The most basic step is, find out what application is being used... THEN we can easily find the vulnerabilities with the help of "GOOGLE".

For this example, I choose http://mail.gov.bn, not really a "web application" but more into "mail application" with web-based front-end... How to find what application is used?...

Next... Find any "less valuable" data... What can you find on the page itself?

• Icon ada tangan "STOP" or our teenagers prefer calling it "talk-to-my-hand" sign hahaha
• Panji-panji negara...
• "User name"
• "Password"
• "Sign In"

Thats it?... We can't really use the listed data for something... Alright... How about, we see the page's source code? Errr... That might be helping us out... But how?

Since I use Mozilla Firefox, go to View>Page Source or simply press CTRL+U keys at a time... The following window will appear...

There are lots of "less valuable" data you could find in there especially HTML Tags... But there is something which I "think" might be used for the activity... As you can see on the image above, I highlighted the area and copy it into clipboard... Then you might guess what I would do next! Obviously...

Yuuup~ That's right~ I googled it... And as you can see, there is a word which really catched my eyes in instant... A word "domino"... But, apakan tue?... Nevermind... Just continue browsing through the page...

Ok... Another "domino" but now it is "Lotus Domino".... Lotus... Macam pernah mendangar... Oh... Now I remembered... "Lotus Symphony", an office application by IBM. But... Does it mean this "Lotus Domino" is also part of IBM's products? Maybe yes... Meybe not... So next step is to directly google "Lotus Domino"... I found out that it is also one of the IBM's products... Other than google it up, I also google for its image... Surprisingly, I encountered that there is a common about this "Lotus Domino" image that I found through Google with the demonstrated page... Apanah?...

It is the icon used on the page or also known as page's "favourite icon"... From there we know that the demonstrated page uses IBM's "Lotus Domino" mail application. Good thing is now we know such application exists and might want to try it out next time...

Other than the icon, I also found the following image:

It looks way much similiar with the demonstrated page and so no doubt about application that is being used by the page...

Now we move on into how bad people uses "less valuable" data for Password Guessing...

I will use "pisbuk" profile page as an example to this demonstration...

Imagine there is this one buajah namanya "Hjh Lintuk"... Ia tedapat pisbuk... Her information is as follows:

For us, we might just think that the information listed on her profile page is just an ordinary info and so we DON'T CARE... But bear in mind that for bad people, it is TOO VALUABLE for them to trigger an activity...

As you can see from the information given on her profile page, it is easy for the bad people to guess her passsword... IF I am the bad people, here is the list of possible passwords I might guess:

• lintuk107
• lkuncang
• 1071962
• neverold
• imyouth
• 987654
• 00987654
• l987654k
• babylintuk
• babylintuk107
• 107babylintuk
• baby107lintuk
• nyubarang
• sgnyubarang
• dan yang sewaktu dengannya...

Can you imagine if one of the passwords listed is actually her valid password?... =) sama-sama tane fikirkan...

So I guess that is it for today, semoga dapat pengajaran bersama serta dapat menimbulkan rasa "alert" dikalangan kitani...

Sekian, wabillahittaufiq walhidayah, wassalam...

Most Common Password in Cyber Threat

Salam Anak IT Readers~

Tiba masanya, pantun dijunjung,
Pantun kini, karya satu cerita,
Cerita yang panjang, nada penghujung,
Mun catu tantu ku pindikkan tah saja~

Here is the list of most common passwords in cyberworld...

• 123456
• abc123
• qwerty
• iloveu
• password
• pass
• *IC Number
• 12345678
• 123
• manutd
• liverpool
• letmein
• iwantu
• soccer
• 111111
• enter
• imissu
• hello
• aslplz
• computer
• keyboard
• guitar
• *Car's plate number
• hannah
• montana
• princess
• pwincess
• cool
• imhot
• stabber
• *First name
• mypass
• hotmail
• aaaaaa
• whatever
• uknowit
• secret
• kembayau
• piasau
• lovehubby
• *Country Name
• *Phone Number
• chelsea
• flower
• redrose

Anything else? If ada ketinggalan, mind to post it through your comment =) Thanks~

Security+ Certification

Tuesday, 22 June 2010 14:24 | Written by Zulfadly

"CompTIA Security+ is an international, vendor-neutral certification that proves competency in system security, network infrastructure, access control and organizational security.

The CompTIA Security+ certification designates knowledgeable professionals in the field of security, one of the fastest-growing fields in IT. Security threats are increasing in number and severity, and the gap between the need for security professionals and qualified IT personnel is the largest of any IT specialty, according to a 2008 CompTIA study. Even in a troubled economy, most businesses plan to maintain or increase their investment in security." - CompTIA

Security+ Certificate

For further information on the Security+ certification, go to CompTIA's website at http://www.comptia.org/certifications/listed/security.aspx or simply click here. Those who need some guidance on the certification, you may approach me.

As Anak IT's motto, "Mun rotan ganya sejangkal, jangan mendaluh lautan dalam" encouraging you to improve and further your skills.

Sekian, semoga biskita mendapat inspirasi dan juga manfaat. Wabillahittaufiq walhidayah...

Hardening your USB Drive

Assalam...

Last time, the admin posted an article of "Defend your drives from AUTORUN.INF malware" and it is recommended that you read that article first before you proceed to the next paragrapgh...

This article may be a continuous article from the article mentioned in the previous paragraph but it is actually more into "hardening" to "protecting". The following steps require you to use any Linux-based Operating System. The reason is that, Windows OS will NOT allowing you to do this kind of activity hahaha *obviously*. In this tutorial, I will use my favorite Ubuntu (Karmic Koala) OS.

After you have created the "autorun.inf" folder based from the previous "Defend your drives from AUTORUN.INF malware" article, go inside the folder and then

1. create a folder named "con" and
2. create a file named "desktop.ini"

Using a text editor (gedit in Ubuntu), simply type in the following parameters inside the "desktop.ini" file:

Or copy and paste it from here...

[.ShellClassInfo]
CLSID={2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}

Save the "desktop.ini" file and close the text editor. Next, go inside the "con" folder and then create a folder name "aux".

Inside the "aux" folder, create another folder named "nul. ", followed by your favourite words with "dot" in within the words. For example, I named the folder as "nul. Bwua.huhwu.hauhwa". Now you are done =) hehe

Oh... Lupa gitau... If you want to create a folder in Ubuntu OS, right click on the blank spaces inside the window and click on "Create Folder"...

Cabut USB drive biskita and pacak arah any Windows OS-based computer... I used my Windows XP to examine the result... As you can see, the folder's icon has been changed to "kunci manga" and try to click on it and see what will happen... The answer is, "nothing" will happen hahahaha... I haven't try this technique on Windows Vista or Windows 7... Let us see if someone actually can access the file from Windows OS other than Windows XP else it would be still prone to autorun.inf malware (malicious software) attack...

Hopefully that would give benificial to all of us and help you to minimise your USB drive especiallypengdrive from being infected by other machines...

Sekian, sampai jumpa lagi~

Wassalam.