Category: Techie

Anything of particular interest to the techie crowd.

Common passwords

(via Schneier on Security)
If you have ever wondered how well brute-force password attack attempts are, you should check out this bit about a password audit at a popular German dating site (which means the article is in German as well – you can babelfish it for a nearly readable translation). Of particular interest is the number out of roughly 100,000 users with 123456 as their password (1375). Almost 850 others tried to be more clever and used the variations 12345, 12345678, or 123456789 as their password. The good news is that roughly 40 percent of the passwords were unique. The bad news is only about 40 percent of the passwords were unique.

Having done password audits in the past, I’ve seen things like this before. One place I worked used a list of about 30,000 common words (typically dictionary words, names, cities, common numeric sequences, etc), common passwords (NCC-1701 from Star Trek, CPE1704TKS from War Games, Schrodinger or Einstein, etc), and variations on those (backwards, add 1234 to the end, add 1 at the front and 2 at the end, etc). Against less than 1000 user accounts, we got almost 100 passwords guessed in about 4 hours. This was 10 years ago. Today, it would take much less time to get those passwords, and probably more would be guessed, because more common words and more variations could be included.

Good security isn’t easy. Good security involving people is even harder. People are easily the weakest link in security systems, and therefore the mostly common vector of attack.

[tags]Computer Security, passwords, Password audits[/tags]

“Welcome to Practical Aspects of Modern Cryptography” class online

(via Schneier on Security)

The course material and lecture videos for “Welcome to Practical Aspects of Modern Cryptography”, taught at the University of Washington this past winter, are now available online for free.  If you are looking to learn a bit about Cryptography, be sure to check this out.

[tags]Crypto, Cryptography[/tags]

Penetration testing via USB keys

There have been a number of articles written about the security experts who recently during a security penetration test randomly dropped around the target facility USB flash drives with a trojan set to autorun. I like Bruce Schneier’s write-up and story links o this, so will reference it. First, Schneier has this:

Recently I’ve been seeing more and more written about this attack. The Spring 2006 issue of 2600 Magazine, for example, contains a short article called “iPod Sneakiness” (unfortunately, not on line). The author suggests that you can innocently ask someone at an Internet cafe if you can plug your iPod into his computer to power it up — and then steal his passwords and critical files.

So if you aren’t reading 2600 Magazine to keep up with the security underground, you’re in the dark.  Get to reading it.  I’ve found it to contain loads of worthless stuff, but the letters section and at least a few articles per issue are usually worth the cost of the magazine.  And if any of you want to get me a lifetime subscription to 2600, I’d be more than happy to accept it…
Next, he links to the story about the USB drives used for the penetration test.

We figured we would try something different by baiting the same employees that were on high alert. We gathered all the worthless vendor giveaway thumb drives collected over the years and imprinted them with our own special piece of software. I had one of my guys write a Trojan that, when run, would collect passwords, logins and machine-specific information from the user’s computer, and then email the findings back to us.

The next hurdle we had was getting the USB drives in the hands of the credit union’s internal users. I made my way to the credit union at about 6 a.m. to make sure no employees saw us. I then proceeded to scatter the drives in the parking lot, smoking areas, and other areas employees frequented.

After this, it’s just a matter of waiting. And as noted in the penetration testing story, it didn’t take long. I have to admit, I probably would have gotten taken by this attack as well, and I’ve spent years working with computer security. It’s not that I wouldn’t be suspicious of the USB drives. My problem is, I didn’t know USB drives could be set to auto-run just like CD drives can. In fact, it’s the default behavior in Windows!

AutoRun is just a bad idea. People putting CD-ROMs or USB drives into their computers usually want to see what’s on the media, not have programs automatically run. Fortunately you can turn AutoRun off. A simple manual approach is to hold down the “Shift” key when a disk or USB storage device is inserted into the computer. A better way is to disable the feature entirely by editing the Windows Registry. There are many instructions for doing this online (just search for “disable autorun”) or you can download and use Microsoft’s TweakUI program, which is part of the Windows XP PowerToys download. With Windows XP you can also disable AutoRun for CDs by right-clicking on the CD drive icon in the Windows explorer, choosing the AutoPlay tab, and then selecting “Take no action” for each kind of disk that’s listed. Unfortunately, disabling AutoPlay for CDs won’t always disable AutoPlay for USB devices, so the registry hack is the safest course of action.

Bruce winds up with this comment that seems obvious to everyone interested in protecting computers except the folks at Microsoft:

In the 1990s, the Macintosh operating system had this feature, which was removed after a virus made use of it in 1998. Microsoft needs to remove this feature as well.

[tags]Security testing, USB drives, Autorun, Network security, Bruce Schneier[/tags]

Movie physics – the good and the bad

One of those “How did I get here?” sites I found recently is the Intuitor Insultingly Stupid Movie Physics page. The site covers a lot of the bad physics we see in movies, and then gives a brief review of the quality of the physics displayed in some recent movies. What kind of things are covered on the site? Well:

Flashing Bullets

The terrorist unleashes a lengthy burst of submachine gunfire as the hero runs along a gangway in an industrial plant. Bullets bounce everywhere. This would be a dramatic event for almost anyone, yet moviemakers feel it must be enhanced. The special effects representing impacting bullets give off bright flashes of light. Normal bullets, especially handgun bullets, do not.

. . .

Problems with Windows

No, we’re not referring to Bill Gates’s woes (or lack of them), but to the ways movie windows refuse to obey simple laws of physics. Apparently no one in Hollywood has ever picked up a piece of broken glass and suffered the inevitable bloodied finger.

Saying that shards of broken glass are razor sharp is an understatement. A shattered window contains thousands of incredibly sharp edges and dagger-like points. It takes almost no force for one of these points or edges to cause a laceration. However, people in movies routinely jump through plate glass windows without receiving a single scratch.

All told, there are nearly a dozen descriptions of bad physics in movies, and the reality behind the false portrayals. My favorite, which has a few simple diagrams that show the Hollywood and the reality behind it, is the issue of lasers.

Visible Laserbeams
From security systems to space adventures, conveniently-visible laserbeams are a common part of our movie experience. Too bad they often don’t reflect reality.

Multi-beamed laser security systems are a frequent Hollywood plot device. Again and again movies feature tension-filled scenes in which characters snake their way through mazes of laserbeams artistically arranged in random patterns by professional security fools to entertain us by making would-be thieves do contortions. A simple arrangement of closely-spaced parallel beams would be contortion-proof but certainly not as much fun.

[tags]Physics, Movies[/tags]

Microsoft hoping to replace JPEG?

I don’t know how I ended up finding this article, but here’s a good write-up on Microsoft’s new photo format.  The claim is Windows Media Photo will manage roughly double the compression ratio JPEG has while maintaining or bettering JPEG’s visual quality.  If true, this could really catch on.  Even with high-bandwidth connections more readily available, every opportunity to squeeze more signal per bit through the pipe is welcome.

“One of the biggest reasons people upgrade their PCs is digital photos,” Crow said, noting that Microsoft has been in contact with printer makers, digital camera companies and other unnamed industry partners while working on Windows Media Photo. Microsoft touts managing “digital memories” as one of the key attributes of XP successor Vista.

. . .

Not only does compression save storage space, which is especially important for devices such as cell phones and digital cameras, a smaller file can also print faster, transfer faster and help conserve battery life on devices, Crow said. “Making a file that is smaller has all kinds of benefits.”

Will this catch on?  As I said above, I can see the appeal, and if it works out as well as Microsoft is saying it will (read the article formore details of the intelligence in this format), I can only see problems if licensing costs are prohibitive or if Microsoft hate beats out throughput and image manipulation ease concerns.  Even the Microsoft rep realizes that:

Licensing details for the technology are still being ironed out. These could be a concern, Crow acknowledged, but “the philosophy has been that licensing should not be a restriction” to adoption, he said.

Honestly, I’m hoping Microsoft doesn’t pull an Apple and over-price this.  I’d like to see a better image format soon.

[tags]Microsoft, JPEG, photo format[/tags]

No .xxx domains for now

(via Freedom-to-Tinker)
Well, for now, ICANN has said no to .xxx domains.

ICANN had decided, some time back, to move toward a .xxx domain for adult content. The arrangements for .xxx seemed to be ready, but now ICANN has pulled the plug. The reason, apparently, is that the ICANN board was worried that ICM, the company that would have run .xxx, could not ensure that sites in the domain complied with all applicable laws. Note that this is a different standard than other domain managers would have to meet — nobody expects the managers of .com to ensure, proactively, that .com sites obey all of the national laws that might apply to them. And of course we all know why the standard was different: governments are touchy about porn.

Honestly, aside from making it easier for perverts like me to find good pr0n, I really don’t see the use of this domain. ICANN (nor any other organization) can force an adult site to use the domain, so it’s not like implementing this and then letting site providers, parents, ISP, and so on block it would stop adult sites. At best, it would block adult sites that try to play by the rules and make themselves easy to limit access to.

In the end, apparently ICANN decided the domain would not fit their purposes coordinating allocation of domains and numbers.

Read the full article – it’s lengthy, but full of good information about the organization and about decisions that go on behind domain creation and allocation.

[tags].xxx domains, ICANN[/tags]

MAKEzine blog link dump

Here’s a big collection of projects from MAKE that I’d love to have time to do.

Million Gigabyte thumb drives?

(via Engadget)

Color me skeptical, but according to this announcement from Drexel University, we might in the not-too-distant future see USB keys (or whatever interface dominates at the time) with massive storage capacities.

Imagine having computer memory so dense that a cubic centimeter contains 12.8 million gigabytes (GB) of information.

Imagine an iPod playing music for 100 millennia without repeating a single song or a USB thumb-drive with room for 32.6 million full-length DVD movies.

Sounds good to me. I’ll order a couple now, to avoid the early adopters rush.

Spanier and his colleagues, Alexie Kolpak and Andrew Rappe offrom the University of Pennsylvania and Hongkun Park of Harvard University, are excited about their findings, but say significant challenges lie ahead, including the need to develop ways to assemble the nanowires densely, and to develop a scheme to efficiently write information to and read information from the nanowires.

Dang it, there’s always a catch, isn’t there? I predict that before the year is out, we’ll hear that this technology is feasable, but 5 years away. Next year, we’ll get an update that the technology is feasable, but still 5 years away. And let me go out on a limb and say that in 2008, we’ll get an update that this technology is feasable, but is roughly 5 years away.

In case you haven’t kept up with breakthrough technology, everything is roughly 5 years away.

[tags]Massive data storage[/tags]

Microsoft works to protect your sensitive ears

(via Engadget)
Microsoft has applied for a patent on technology to auto-censor audio streams.  Here’s the abstract:

An input audio data stream comprising speech is processed by an automatic censoring filter in either a real-time mode, or a batch mode, producing censored speech that has been altered so that undesired words or phrases are either unintelligible or inaudible. The automatic censoring filter employs a lattice comprising either phonemes and/or words derived from phonemes for comparison against corresponding phonemes or words included in undesired speech data. If the probability that a phoneme or word in the input audio data stream matches a corresponding phoneme or word in the undesired speech data is greater than a probability threshold, the input audio data stream is altered so that the undesired word or a phrase comprising a plurality of such words is unintelligible or inaudible. The censored speech can either be stored or made available to an audience in real-time.

[tags]Audio auto-censoring[/tags]

Sandboxie for protected surfing and application installation

(via FreewareWiki)

When you run a program on your computer, data flows from the hard disk to the program via read operations. The data is then processed and displayed, and finally flows back from the progam to the hard disk via write operations.

. . .

For example, if you run the Freecell program to play a game, it starts by reading the previously recorded statistics, displaying and altering them as you play the game, and finally writing them back to disk for future reference.

Sandboxie changes the rules such that write operations do not make it back to your hard disk.

. . .

If you run Freecell inside the Sandboxie environment, Sandboxie reads the statistics data from the hard disk into the sandbox, to satisfy the read requested by Freecell. When the game later writes the statistics, Sandboxie intercepts this operation and directs the data to the sandbox.

If you then run Freecell without the aid of Sandboxie, the read operation would bypass the sandbox altogether, and the statistics would be retrieved from the hard disk.

A run for anything sandbox to contain your programs and limit what they can do to your system.  Sandboxie is free, and looks very, very useful.  It’s going on my system for sure.

[tags]Sandbox, Sandboxie, Virtualization[/tags]

Keep up with top-rated web sites in one place

I’m not quite sure even how to describe this site, but I’ll try.  There are a number of web sites that track web sites as recommended by surfers like you and me.  You can see the latest hot web topics by watching Digg or Del.icio.us or other such aggregation sites.  If you find all those overwhelming to keep up with, though, you might want to just look into monitoring popurls instead.  Popurls aggregates the aggregation sites, basically.  If you can keep up with the headlines and popurls, you’ll have a pretty good view of the most popular, interesting, and/or useful web sites at a given time.  Of course, you’ll also see a lot of crap, but that’s because most of the web is crap.

[tags]Web aggregators, popurls[/tags]