technology

Steve Ballmer couldn’t fix an infected Windows PC

business, security, technology / /

From David Frith’s “Microsoft takes on net nasties” (Australian IT: 6 June 2006):

MICROSOFT executives love telling stories against each other. Here’s one that platforms vice-president Jim Allchin told at a recent Windows Vista reviewers conference about chief executive Steve Ballmer.

It seems Steve was at a friend’s wedding reception when the bride’s father complained that his PC had slowed to a crawl and would Steve mind taking a look.

Allchin says Ballmer, the world’s 13th wealthiest man with a fortune of about $18 billion, spent almost two days trying to rid the PC of worms, viruses, spyware, malware and severe fragmentation without success.

He lumped the thing back to Microsoft’s headquarters and turned it over to a team of top engineers, who spent several days on the machine, finding it infected with more than 100 pieces of malware, some of which were nearly impossible to eradicate.

Among the problems was a program that automatically disabled any antivirus software.

“This really opened our eyes to what goes on in the real world,” Allchin told the audience.

If the man at the top and a team of Microsoft’s best engineers faced defeat, what chance do ordinary punters have of keeping their Windows PCs virus-free?

Steve Ballmer couldn’t fix an infected Windows PC Read More »

Search for “high score” told them who stole the PC

security, technology / /

From Robert Alberti’s “more on Supposedly Destroyed Hard Drive Purchased In Chicago” (Interesting People mailing list: 3 June 2006):

It would be interesting to analyze that drive to see if anyone else was using it during the period between when it went to Best Buy, and when it turned up at the garage sale. We once discovered who stole, and then returned, a Macintosh from a department at the University of Minnesota with its drive erased. We did a hex search of the drive surface for the words “high score”. There was the name of the thief, one of the janitors, who confessed when presented with evidence.

Search for “high score” told them who stole the PC Read More »

The origins of 2600

history, law, tech in changing society, technology, writing ideas / /

From Nicholas Thompson’s “Who Needs Keys?” (Legal Affairs: November/December 2004):

The event was organized by 2600, a quarterly magazine whose name refers to one of the great discoveries in hacker history: that the plastic whistles given away free in boxes of Cap’n Crunch cereal in the early 1970s could be slightly modified to create sound waves of 2600 MHz, a frequency that allowed you to make free calls on the old AT&T phone system.

The origins of 2600 Read More »

It’s easy to track someone using a MetroCard

business, law, security, tech in changing society, technology / /

From Brendan I. Koerner’s “Your Cellphone is a Homing Device” (Legal Affairs: July/August 2003):

Law enforcement likewise views privacy laws as an impediment, especially now that it has grown accustomed to accessing location data virtually at will. Take the MetroCard, the only way for New York City commuters to pay their transit fares since the elimination of tokens. Unbeknownst to the vast majority of straphangers, the humble MetroCard is essentially a floppy disk, uniquely identified by a serial number on the flip side. Each time a subway rider swipes the card, the turnstile reads the bevy of information stored on the card’s magnetic stripe, such as serial number, value, and expiration date. That data is then relayed back to the Metropolitan Transportation Authority’s central computers, which also record the passenger’s station and entry time; the stated reason is that this allows for free transfers between buses and subways. (Bus fare machines communicate with MTA computers wirelessly.) Police have been taking full advantage of this location info to confirm or destroy alibis; in 2000, The Daily News estimated that detectives were requesting that roughly 1,000 MetroCard records be checked each year.

A mere request seems sufficient for the MTA to fork over the data. The authority learned its lesson back in 1997, when it initially balked at a New York Police Department request to view the E-ZPass toll records of a murder suspect; the cops wanted to see whether or not he’d crossed the Verrazano Narrows Bridge around the time of the crime. The MTA demanded that the NYPD obtain a subpoena, but then-Justice Colleen McMahon of the State Supreme Court disagreed. She ruled that “a reasonable person holds no expectation of confidentiality” when using E-ZPass on a public highway, and an administrative subpoena – a simple OK from a police higher-up – was enough to compel the MTA to hand over the goods.

It’s easy to track someone using a MetroCard Read More »

Tracking via cell phone is easy

business, law, security, tech in changing society, technology / /

From Brendan I. Koerner’s “Your Cellphone is a Homing Device” (Legal Affairs: July/August 2003):

What your salesman probably failed to tell you – and may not even realize – is that an E911-capable phone can give your wireless carrier continual updates on your location. The phone is embedded with a Global Positioning System chip, which can calculate your coordinates to within a few yards by receiving signals from satellites. GPS technology gave U.S. military commanders a vital edge during Gulf War II, and sailors and pilots depend on it as well. In the E911-capable phone, the GPS chip does not wait until it senses danger, springing to life when catastrophe strikes; it’s switched on whenever your handset is powered up and is always ready to transmit your location data back to a wireless carrier’s computers. Verizon or T-Mobile can figure out which manicurist you visit just as easily as they can pinpoint a stranded motorist on Highway 59.

So what’s preventing them from doing so, at the behest of either direct marketers or, perhaps more chillingly, the police? Not the law, which is essentially mum on the subject of location-data privacy. As often happens with emergent technology, the law has struggled to keep pace with the gizmo. No federal statute is keeping your wireless provider from informing Dunkin’ Donuts that your visits to Starbucks have been dropping off and you may be ripe for a special coupon offer. Nor are cops explicitly required to obtain a judicial warrant before compiling a record of where you sneaked off to last Thursday night. Despite such obvious potential for abuse, the Federal Communications Commission and the Federal Trade Commission, the American consumer’s ostensible protectors, show little enthusiasm for stepping into the breach. As things stand now, the only real barrier to the dissemination of your daily movements is the benevolence of the telecommunications industry. A show of hands from those who find this a comforting thought? Anyone? …

THE WIRELESS INDUSTRY HAS A NAME FOR SUCH CUSTOM-TAILORED HAWKING: “location-based services,” or LBS. The idea is that GPS chips can be used to locate friends, find the nearest pizzeria, or ensure that Junior is really at the library rather than a keg party. One estimate expects LBS to be a $15 billion market by 2007, a much-needed boost for the flagging telecom sector.

That may be fine for some consumers, but what about those who’d rather opt out of the tracking? The industry’s promise is that LBS customers will have to give explicit permission for their data to be shared with third parties. This is certainly in the spirit of the Wireless Communications and Public Safety Act of 1999, which anticipated that all cellphone carriers will feature E911 technology by 2006. The law stipulated that E911 data – that is, an individual’s second-by-second GPS coordinates – could only be used for nonemergency purposes if “express prior authorization” was provided by the consumer. …

Tracking via cell phone is easy Read More »

The way to trick smart people

commonplace book, language & literature, politics, science, security, technology / /

From Paul’s “The easiest way to fool smart people“:

There’s a saying among con-men that smart people are easier targets, because they don’t think they can be conned.

I’m not sure if that’s true, but there’s one scam that’s almost guaranteed to make smart people switch off their brains and reach for their wallets. It’s a trick that’s used so pervasively in our culture, that once you become aware of it, you start to see it everywhere. …

Most smart people have a hidden weakness and it’s this – they’re absolute suckers for anything that sounds clever.

As soon as you start hitting people with technical terms, fancy graphs, famous names and the like, you’ll immediately increase your credibility. If they’re smart, they’re even more likely to find themselves nodding in agreement. Many intelligent people would rather cut off a finger than admit they don’t know what you’re talking about. …

Even better, they can pretend to be teaching their audience something important. A person who was previously completely ignorant about quantum physics now feels as if they understand something about it – even if that something is absolute baloney. The audience have been fed ideas they’ll now defend even against someone who’s a real expert in that subject. Nobody likes to be told that something they’ve been led to believe is wrong. …

Consultants behave this way because they know that’s how to get a sale. Bombard people with clever-sounding stuff they don’t really understand, and they’ll assume that you’re some kind of genius. It’s a great way of making money.

Stock analysts, economic forecasters, management consultants, futurologists, investment advisors and so on use this tactic all the time. It’s their chief marketing strategy for the simple reason that it works.

The way to trick smart people Read More »

Social network analysis by the NSA

law, politics, tech in changing society, technology / /

From John Diamond and Leslie Cauley’s “Pre-9/11 records help flag suspicious calling” (USA TODAY: 22 May 2006):

Armed with details of billions of telephone calls, the National Security Agency used phone records linked to the Sept. 11, 2001 attacks to create a template of how phone activity among terrorists looks, say current and former intelligence officials who were briefed about the program. …

The “call detail records” are the electronic information that is logged automatically each time a call is initiated. For more than 20 years, local and long-distance companies have used call detail records to figure out how much to charge each other for handling calls and to determine problems with equipment.

In addition to the number from which a call is made, the detail records are packed with information. Also included: the number called; the route a call took to reach its final destination; the time, date and place where a call started and ended; and the duration of the call. The records also note whether the call was placed from a cellphone or from a traditional “land line.” …

Calls coming into the country from Pakistan, Afghanistan or the Middle East, for example, are flagged by NSA computers if they are followed by a flood of calls from the number that received the call to other U.S. numbers.

The spy agency then checks the numbers against databases of phone numbers linked to terrorism, the officials say. Those include numbers found during searches of computers or cellphones that belonged to terrorists.

It is not clear how much terrorist activity, if any, the data collection has helped to find.

Social network analysis by the NSA Read More »

TV signals passing through the Stone Age air

commonplace book, technology / /

From Adam Goodheart’s “The Last Island of the Savages” (The American Scholar, Autumn 2000, 69(4):13-44):

The gift-dropping missions had ended in 1996. There was still no television set on North Sentinel; it remained, like Prospero’s island, a place where the air shimmered with invisible signals, with unseen Hindi soap operas and Thai music that drifted, unheard, across the Andaman Sea.

TV signals passing through the Stone Age air Read More »

Lost tribe hoaxes

commonplace book, history, technology / /

From Adam Goodheart’s “The Last Island of the Savages” (The American Scholar, Autumn 2000, 69(4):13-44):

Even so, every few years there is a report of one “lost tribe” or another – usually in the Amazon rain forest or the highlands of New Guinea – staggering naked from the jungle into the dazzling glare of modernity. Such stories are almost invariably followed by a retraction: the tribesmen turn out to have T-shirts and cigarettes stashed back in their huts, and the original report turns out to have been a mistake or a fraud. (The most famous such incident was the so-called Tasaday hoax of 1971, involving a supposed Stone Age tribe in the Philippines; the tribesmen were Filipino farmers whom local politicians had coerced into posing as naked cave-men for the camera crews from CBS and National Geographic.)

Lost tribe hoaxes Read More »

Google’s number tricks

business, cool stuff, technology, weird / /

From “Fuzzy maths” (The Economist: 11 May 2006):

MATHEMATICALLY confident drivers stuck in the usual jam on highway 101 through Silicon Valley were recently able to pass time contemplating a billboard that read: “{first 10-digit prime found in consecutive digits of e}.com.” The number in question, 7427466391, is a sequence that starts at the 101st digit of e, a constant that is the base of the natural logarithm. The select few who worked this out and made it to the right website then encountered a “harder” riddle. Solving it led to another web page where they were finally invited to submit their curriculum vitae.

If a billboard can capture the soul of a company, this one did, because the anonymous advertiser was Google, whose main product is the world’s most popular internet search engine. With its presumptuous humour, its mathematical obsessions, its easy, arrogant belief that it is the natural home for geniuses, the billboard spoke of a company that thinks it has taken its rightful place as the leader of the technology industry, a position occupied for the past 15 years by Microsoft. …

To outsiders, however, googley-ness often implies audacious ambition, a missionary calling to improve the world and the equation of nerdiness with virtue.

The main symptom of this, prominently displayed on the billboard, is a deification of mathematics. Google constantly leaves numerical puns and riddles for those who care to look in the right places. When it filed the regulatory documents for its stockmarket listing in 2004, it said that it planned to raise $2,718,281,828, which is $e billion to the nearest dollar. A year later, it filed again to sell another batch of shares – precisely 14,159,265, which represents the first eight digits after the decimal in the number pi (3.14159265). …

Google’s number tricks Read More »

Google’s data trove tempts the bad guys

business, security, tech in changing society, technology / /

From “Fuzzy maths” (The Economist: 11 May 2006):

Slowly, the company is realising that it is so important that it may not be able to control the ramifications of its own actions. “As more and more data builds up in the company’s disk farms,” says Edward Felten, an expert on computer privacy at Princeton University, “the temptation to be evil only increases. Even if the company itself stays non-evil, its data trove will be a massive temptation for others to do evil.”

Google’s data trove tempts the bad guys Read More »

In Britain, you can see footage of you captured by CCTV

business, law, politics, security, tech in changing society, technology / /

From Patrick Keefe’s “Camera Shy” (Legal Affairs: July/August 2003):

In London, a city even more intensively scrutinized by closed-circuit television cameras than New York, citizens can at least retrieve copies of footage taken of them through a provision in Britain’s Data Protection Act. Americans have no such legal recourse. …

In Britain, you can see footage of you captured by CCTV Read More »

The difficulties in establishing time of death

law, science, technology / /

From Jessica Sachs’s “Expiration Date” (Legal Affairs: March/April 2004):

More than two centuries of earnest scientific research have tried to forge better clocks based on rigor, algor, and livor mortis – the progressive phenomena of postmortem muscle stiffening, body cooling, and blood pooling. But instead of honing time-of-death estimates, this research has revealed their vagaries. Two bodies that reached death within minutes of each other can, and frequently do, show marked differences in postmortem time markers. Even the method of testing eye potassium levels, which was recently hailed as the new benchmark for pinpointing time of death, has fallen into disrepute, following autopsies that showed occasional differences in levels in the left and right eye of the same cadaver. …

And the longer a body is dead, the harder it is to figure out when its owner died. In their book The Estimation of Time Since Death in the Early Postmortem Period, the world-renowned experts Claus Henssge and Bernard Knight warn pathologists to surrender any pretensions of doing science beyond the first 24 to 48 hours after death.

The difficulties in establishing time of death Read More »

Matching identities across databases, anonymously

security, technology / /

From MIT Technology Review‘s’ “Blindfolding Big Brother, Sort of“:

In 1983, entrepreneur Jeff Jonas founded Systems Research and Development (SRD), a firm that provided software to identify people and determine who was in their circle of friends. In the early 1990s, the company moved to Las Vegas, where it worked on security software for casinos. Then, in January 2005, IBM acquired SRD and Jonas became chief scientist in the company’s Entity Analytic Solutions group.

His newest technology, which allows entities such as government agencies to match an individual found in one database to that same person in another database, is getting a lot of attention from governments, banks, health-care providers, and, of course, privacy advocates. Jonas claims that his technology is as good at protecting privacy as it as at finding important information. …

JJ: The technique that we have created allows the bank to anonymize its customer data. When I say “anonymize,” I mean it changes the name and address and date of birth, or whatever data they have about an identity, into a numeric value that is nonhuman readable and nonreversible. You can’t run the math backwards and compute from the anonymized value what the original input value was. …

Here’s the scenario: The government has a list of people we should never let into the country. It’s a secret. They don’t want people in other countries to know. And the government tends to not share this list with corporate America. Now, if you have a cruise line, you want to make sure you don’t have people getting on your boat who shouldn’t even be in the United States in the first place. Prior to the U.S. Patriot Act, the government couldn’t go and subpoena 100,000 records every day from every company. Usually, the government would have to go to a cruise line and have a subpoena for a record. Section 215 [of the Patriot Act] allows the government to go to a business entity and say, “We want all your records.” Now, the Fourth Amendment, which is “search and seizure,” has a legal test called “reasonable and particular.” Some might argue that if a government goes to a cruise line and says, “Give us all your data,” it is hard to envision that this would be reasonable and particular.

But what other solution do they have? There was no other solution. Our Anonymous Resolution technology would allow a government to take its secret list and anonymize it, allow a cruise line to anonymize their passenger list, and then when there’s a match it would tell the government: “record 123.” So they’d look it up and say, “My goodness, it’s Majed Moqed.” And it would tell them which record to subpoena from which organization. Now it’s back to reasonable and particular. ….

TR: How is this is based on earlier work you did for Las Vegas casinos?

JJ: The ability to figure out if two people are the same despite all the natural variability of how people express their identity is something we really got a good understanding of assisting the gaming industry. We also learned how people try to fabricate fake identities and how they try to evade systems. It was learning how to do that at high speed that opened the door to make this next thing possible. Had we not solved that in the 1990s, we would not have been able to conjure up a method to do anonymous resolution.

Matching identities across databases, anonymously Read More »

Killer search terms

security, technology / /

From The Inquirer‘s “Killer phrase will fill your PC with spam”:

THERE IS ONE phrase which, if you type into any search engine will expose your PC to shed-loads of spam, according to a new report.

Researchers Ben Edelman and Hannah Rosenbaum reckon that typing the phrase “Free Screensavers” into any search engine is the equivalent of lighting a blue touch paper and standing well back. …

More than 64 per cent of sites that are linked to this phrase will cause you some trouble, either with spyware or adware. The report found 1,394 popular keywords searches found via Google, Yahoo, MSN, AOL and Ask that were linked to spyware or adware and the list is quite amusing. Do not type in the following words into any search engine:

Bearshare
Screensavers
Winmx
Limewire
Download Yahoo messenger
Lime wire
Free ringtones

Killer search terms Read More »

Why infosec is so hard

security, technology / /

From Noam Eppel’s “Security Absurdity: The Complete, Unquestionable, And Total Failure of Information Security“:

A cyber-criminal only needs to identify a single vulnerability in a system’s defenses in order to breach its security. However, information security professionals need to identify every single vulnerability and potential risk and come up with suitable and practical fix or mitigation strategy.

Why infosec is so hard Read More »

Windows Metafile vulnerability

security, technology / /

From Noam Eppel’s “Security Absurdity: The Complete, Unquestionable, And Total Failure of Information Security“:

On Dec. 27, 2005 a Windows Metafile (.WMF) flaw was discovered affecting fully patched versions of XP and Windows 2003 Web Server. Simply by viewing an image on a web site or in an email or sent via instant messenger, code can be injected and run on the target computer. The vulnerability was in the Windows Graphics Rendering Engine which handles WMF files, so all programs such as Internet Explorer, Outlook and Windows Picture and Fax viewer which process this type of file were affected.

Within hours, hundred of sites start to take advantage of the vulnerability to distribute malware. Four days later, the first Internet messenger worm exploiting the .wmf vulnerability was found. Six days later, Panda Software discovers WMFMaker, an easy-to-use tool which allows anyone to easily create a malicious WMF file which exploits the vulnerability.

While it took mere hours for cybercriminals to take advantage of the vulnerability, it took Microsoft nine days to release an out-of-cycle patch to fix the vulnerability. For nine entire days the general public was left with no valid defenses.

The WMF Flaw was a security nightmare and a cybercriminal dream.It was a vulnerability which (a) affected the large majority of Windows computers (b) was easy to exploit as the victim simply had to view an image contained on a web site or in an email, and (c) was a true zero-day with no patch available for nine days. During those nine days, the majority of the general population had no idea how vulnerable they were.

Windows Metafile vulnerability Read More »