Logo




Subscribe:
RSS 2.0 | Atom 1.0
Categories:

Sign In


[Giagnocavo]Michael::Write()

 Saturday, August 14, 2004
Wow, these fortune cookies are right on

Since I've been living alone for the last few weeks, my main food intake is from a local Chinese restaurant. About a week ago, I got this fortune inside the cookie: “An exciting new job will present itself soon.” And the next day, I got a call from a recruiter with XXX. Exciting is an understatement. First time a fortune cookie has been that accurate for me. Because of this, I still order from that restaurant, even though they had a roach in my soup the other day.

Two days ago, I got this fortune: “Someone you haven't seen for a long time will re-enter your life.” Now, I tried to imagine who this could be. Well, again they were right. Yesterday, I sadly said farewell to a friend: My MSDN Code Center Premium Smartcard. The shared source licensing doesn't apply to Guatemala, so I had to have my account deactivated and card returned. Today I'm fixing an error in an app where FormsAuthentication isn't working correctly (signout is not happening). Usually, I'd just slip in my card, navigate to com/netfx/framework/xsp/.... and well, I'd have the source and figure it out quite quickly. That's no longer an option. Enter my the someone I haven't seen for a long time: ILDAasm. Sigh.

Personal
Saturday, August 14, 2004 6:27:04 PM UTC  #    Comments [5]  |  Trackback

Sarcasm Chicken

Does anyone else play the game of “sarcasm chicken“? It goes something like this:

Alice: Well, user's are still opening virus attachments.

Bob: Let's install better anti-virus software on all client machines.
Alice: Well, still, it's not enough. Maybe all attachments need to scanned at the server first.

Bob: Hmm, maybe we should have virus-scanning at the ethernet layer, you know, stop it before it gets into the computer, right at the switch.

Alice: Yea, even better, we could also have a heuristical scanner inside the TCP/IP stack.

Bob: Well, true, but attachments also have to be saved. So maybe the file system could make all new data written unaccessible to the user until an admin approves it or until it's virus scanned.

Alice: Could be, but if the OS gets attacked... what about having it at the disk level? That way we'd have hardware support, and that's a lot harder to hack.

Bob: Hardware support? That's a good idea, but we'd have to buy new hardware.

Alice: Hmm, maybe we can patch the BIOS to.... <g>

Bob: <g>... I was gonna ask if you were serious...

Has this ever happened to you? It starts as a joke, and you keep it up a bit, and then you start to think the other person might actually be serious and well... This is a good outcome. It's no fun if you have to explain your “joke“, esp. on a public DL.

Humour
Saturday, August 14, 2004 6:35:52 AM UTC  #    Comments [1]  |  Trackback

 Monday, August 09, 2004
MSN Web Messenger

Yet another cool thing from Microsoft: MSN Web Messenger. For all those who can't install software on the computer they are using, or if everything except IE is firewalled out, just navigate to http://webmessenger.msn.com/ and away you go.

MSN Web Messenger uses IE (ok, maybe it works with another browser?) and HTTP to pull off a very convincing Messenger UI. It even does the little pop-up message windows! It's not nearly as nice as the real client, but it's definately usable. Wow, I'm impressed.

Misc. Technology
Monday, August 09, 2004 5:56:20 PM UTC  #    Comments [2]  |  Trackback

Microsoft to the rescue of non-Unicode apps!

A while back (ok, for quite some time), I've been complaining about non-Unicode apps. Today's latest offender was MSN Messenger, Korean version. Apparently there's some extra things from Microsoft for the Korean version that allows you to have avatars, instead of just a picture.

However, I couldn't install it, because it's not Unicode enabled. Here's a pic of it's installer (downloading):


Beautiful, eh? Same goes for IRC. I type in Hangeul (Korean script), and it comes out as ????. Others (using a DBCS, codepage 949) type in, and it comes out as garbage (as in the title of the above window). I was hoping to have an app that would set the locale for a specific app, so I wouldn't need to change my whole session locale *just for one app*.

Well, it turns out that Microsoft has already done this, and it rocks. Presenting: AppLocale! This beauty sets the local for a single app, and well, that's it. So now I can easily use IRC to chat in Korean (well, chat perhaps is an overstatement of my abilities)! Yey! And people wonder why I think Microsoft is so cool...

Misc. Technology
Monday, August 09, 2004 7:46:42 AM UTC  #    Comments [0]  |  Trackback

 Thursday, August 05, 2004
More excuses fronted under security

http://www.cnn.com/2004/ALLPOLITICS/08/04/iraqis.unwelcome.ap/index.html

Baffling. Too busy to meet someone? Racist? Utterly terrified for no reason? Just plain retarded? Well, whatever your excuse, you can now “cite security concerns“ to get around things.

 

Misc
Thursday, August 05, 2004 4:46:49 PM UTC  #    Comments [0]  |  Trackback

The sweet sound of silence

Well, the nice FedEx man showed up today with a little package from NewEgg.com: Arctic-Cooling's Super Silent 4Pro L. I can actually run my machine (P4c, 3GHz, 533MHz FSB) with a 2000RPM CPU fan (although it's quiet enough to move it to 3000RPM “just in case”). The Intel one wouldn't run at less than 3700RPM, and that's after a very cold boot, with a glass of ice inside the case.

To test it out, I ran a little keygenerator program which taxes my CPU. I ran two instances to make sure that each core would get a beating. Temp went up to about 60. That's all. And the fan was still running nice and quiet at 2500 or 3000 RPM. Cooled off instantly. Why can't Intel ship a good fan/heatsink combo like this in each processor box? With the old one, running a test like that would push the fan to about 6000RPM, and the whole thing would vibrate like it was about to take off.

Actually, I'm thankful that my machine is even running right now. It's been a long time since I've done any real hardware work, and I've never worked with thermal paste or Socket 487 restrainers (in fact, I took out the entire MB just to figure it out!). Guess I can still do those kinds of things :)

Misc. Technology
Thursday, August 05, 2004 12:09:18 AM UTC  #    Comments [0]  |  Trackback

 Wednesday, August 04, 2004
Little bit of clarification on "3rd world"

My great friend Herbert Sandoval left a comment on my entry about returning to Guatemala. He's a little pissed at me for sounding so cocky and, well, ignorant, hypocritical, etc. And, well, he's got a point there. What is 3rd world? Who is any other country to decide what's 3rd world? But is it an offensive term? I certainly use it to describe certain characteristics. They may or might not have anything to do with 3rd-worldliness (whatever the hell that is). I've lived most of my life in the USA, and Guatemala, with a bit in Canada, so it's not exactly like I have a wealth of data to pull from. He makes some great points about culture (well, *I* made those points quite a long time ago myself, so I want some credit for those ideas!!! :)), and “if you're a 1st class country, why go and attack less fortunate countries” <ok, let's not say anything since I don't wanna start a political battle here!>.

So if anyone is offended, my deepest apologies. That's just a term to describe some of the things I face there. That's all. I don't think I would have married someone from there if I thought “3rd world” was an offensive term. I do like being able to order a Arctic-Cooling Super Silent 4Pro L Heatsink/Fan for $10 and have it arrive at my door in 2 days, and I like being able to use PayPal. Or make a phone call and 5 days later have a 4Mbps connection. As I noted in my comment, perhaps my definition of “3rd world” should be related to how fast I can get a great Internet connection :).

Then again, go check out my parents' clinic: www.hands-of-hope.com. Talk to Anita about what she deals with every day. Sure, things like this can happen everywhere. I think the general term “3rd world” comes out of that in certain parts of Guatemala, things like that are more common. It doesn't reflect on individual people like Herbert (who is a kick-ass designer -- if you ever need graphic work, go here: www.expletus.com), or Juan Gabriel (probably one of the best people I've ever worked with). Just please remember you don't decide where you are born. Being proud or offended by nationality is childish. It may be fun “Yea, we're the best, let's rock the world!“, but it's still silly. I can't remember the last time I was offended by hearing anything negative about Canada. I'm not “proud to be Canadian“ (although I love the passport). There are people doing advanced technology and all sorts of things all over the world. Countries are too large a unit to do much with :). Hey, here's a brand-new blogger, a Visual FoxPro developer in Guatemala.

Being “3rd world“ doesn't affect everything in Guatemala. Actually, being “3rd world” is only a label, it doesn't affect anything at all, except perhaps some peoples perceptions. Hell, if you're in Guatemala City, you probably wouldn't notice much different from many other cities. I love staying at Johnny's Place out in Monterrico. Eve Andersson has a great tour of Guatemala. However, certain things remain factual: high illiteracy rate, lack of medical care in certain areas, widespread poverty in certain areas, crime, etc. There are certain disadvantages (Internet access being my #1 complaint :)). I'm not making any judgements, just saying how I see it. Correct me if I'm wrong. Perhaps it's an elitist term I should stay away from, but I've never cared for being PC :).

Personal
Wednesday, August 04, 2004 9:56:05 PM UTC  #    Comments [2]  |  Trackback

 Tuesday, August 03, 2004
Most creative spam I've seen so far

I don't get a whole lot of spam on my primary account. The bit that I do is usually filtered out by Outlook 2003. However, one message got in, and I read it. It was for an adult matching service. What's so different is that they used ASCII (OK, HTML, since they used a font tag to make one part a different colour) art of a naked woman, instead of including a JPG. Spam on a budget?

HTMLartWoman.html (1.31 KB)

Humour
Tuesday, August 03, 2004 3:17:24 PM UTC  #    Comments [1]  |  Trackback

 Monday, August 02, 2004
Living with stupidity

One of the biggest things I hate about living in Guatemala is the seemingly constant deluge of stupidity from companies.

For instance, when paying your electric bill, you have to have exact change. They don't allow you pay via card (they told me it was because Visa doesn't do that kind of thing over the phone -- WTF?), so you physically have to go in with cash or a check. I once saw someone show up, and their check was for 10 or 20 cents more than their bill (which was for hundreds). They told him to come back with the correct amount.

One thing that really annoyed me was with PriceSmart. Usually they seem to be rather intelligent people, and most problems have had a nice resolution. However, for quite some time I was trying to buy a trampoline. I called all around the country looking for stores. Some had them, but with crazy prices (say, $600 or $800). PriceSmart sells them as well. However, out of the many times I went to PriceSmart, they never had them in stock. I asked them “Why oh why don't you buy enough? They keep on selling out!“ The response was “We do buy enough. But people keep on buying all of them.“

Well, this just happened at Target. I just bought 2 Philips DVP642 players. Why? Well, simply, it's the best bloody player out there. Region free, plays DivX, XviD, optical and digital coax output, handles DVD+/-R +/-RW and +R DL. What more can I ask for? And at a price of $70, it's cheaper than most other players out there. Well, I asked to purchase this at Target and was told “Oh yea, for some reason everyone wants that one. So we're always sold out.“ .... So even the sales clerks realise that it's a hot seller (even though they can't stand why anyone would want to pay less for more), yet they don't stock up on them... Sigh.

The good thing is that now I'm realising the business idiots are all over the place too. I used to think the USA had capitalism and business logic deeply infused in it, but knowing that is not true makes it a bit easier to deal with it wherever I live -- at least I'll know the grass isn't always greener :).

Personal
Monday, August 02, 2004 8:27:15 PM UTC  #    Comments [2]  |  Trackback

News flash: Unicode exists - use it!

Sometimes I don't get it. Why must programmers pretend like it's 1980 and that they don't have to care about things like character sets? People around the world use programs today, it's true! And they don't all speak the same language you do. They might not even use the same characters!

Yet today, so many apps just screw up when you try to use Unicode with them. I'm used to seeing English apps act like this. For instance, every file sharing program I've ever seen. Type in characters that aren't in the default codepage, and it doesn't know what to do with them: zero results.

Today's lame award goes to Filebada, over at www.soribada.com. I downloaded and ran it and it tries to install to C:\program files\<garbage here>\. Come on! What happens is that it has it's name encoded in codepage 949, but when those same bytes are displayed in Latin-1, you get all sorts of fun stuff like the 3/4 sign, the degree sign, etc. Is it that hard to use Unicode these days?

The only way that I know how to get around this problem is to change my Regional Settings to use the codepage desired for all non-Unicode apps. But then half of my other apps stop working correctly (and the fonts get screwed up as well). Does anyone know of a way to tell Windows to use a certain codepage for a specific application?

Misc. Technology
Monday, August 02, 2004 6:20:26 PM UTC  #    Comments [0]  |  Trackback

 Saturday, July 31, 2004
Moving to Guatemala

A few days ago my wife left for Guatemala, since her “permission“ to stay in the U.S. expired, even though her visa's good for much longer. INS (or Citizen Services or whatever lame name they've come up with now), allows you to apply for an extension. In this case, I only wanted a 3 month extension, and applied a month in advance.

Their website indicates it only takes a few days for processing... great! Well, by “few days for processing“, they mean “few days to notify you that we'll start processing“. Their estimated processing time was around 6 months. We'd have had to applied for an extension before we even considered moving to the U.S. $200 for that... sigh. I'd like to dispute the charge since they are purposely misleading on their site, but I'd actually have to spend time dealing with them, so it's not worth the hassle. So off to Guatemala it is.

Seems like just a few weeks ago I was moving to Atlanta... anyways, there are some other good reasons:

  -I did what I came here to do (get some work done on InvisiSource)
  -I remembered that I don't like living here that much after all (OK, I noticed that months ago)
  -Trying to stay here legally long term is too much of a PITA (which is funny, considering this country was built on people leaving other countries)

There will be some things I miss such as my 3Mbps Comcast line. And...that's about it. Fortunately, Bellsouth is offering a 2Mbps wireless connection where I'll be living so perhaps that'll be close enough...

On the plus side:

  -I'll be near family (both my immediate family and my wife's family)
  -I'll no longer have a problem driving without a license or insurance
     (actually, pretty much any issues like that are cheap enough to solve)
  -I'll make more money (cheap cost of living, no IRS worries)

Of course, there are a lot of annoying things about living in a 3rd world country, so this won't be long term. I'm planning on getting my wife Canadian residency while down there, so we can eventually get Canadian citizenship for her. After that, then we can move anywhere we want without immigration troubles. Then the only issue becomes finding a decent country (Canada looks nice)...

Personal
Saturday, July 31, 2004 6:51:08 PM UTC  #    Comments [4]  |  Trackback

 Friday, July 23, 2004
A few interviewing tips for both sides

I interview people as part of my job. Many times I know of someone who's looking for a good developer and I interview people every so often. I'm not by any means an expert interviewer, but I've learned a few things. Here are some notes for both sides of the table. These apply to technical interviews.

My goal as an interviewer is to determine what you know, and what you do not know.

1: Be honest
It's ok to say your an expert in a certain area, but know where you are not. Unless you wrote the entire system in question from start to finish, there's probably a few areas you are unsure in. Take .NET for instance. .NET is huge. It's impossible that you are a guru and know every IL and x86 instruction in every single class. You might have worked on many different parts, but don't try to say you aren't weak in any of them. The interviewer will find an area you're weak with, and you'll be forced to make a retraction “Oh well, actually, I've never touched remoting or Windows Forms.” It's not BAD to not know something. During an interview, the goal is to find if you're smart and will work well. If a question is asked and you have no clue, *say so*. I try to ask a question like that every time (some esoteric thing). Good candidates will answer with “Well, I believe this is related to that, but I'd have to look this up to be sure.“ or “I'm not familiar with that.“ Bad candidates will try to make up some BS answer, perhaps thinking that you have no clue what it is either. In other cases, the interviewer just wants to know your limitations.

If you are interviewing, and feel like you're getting BS'd, start drilling down. Perhaps the interviewee misunderstood the question or is unsure of what you want. I like to give people a second chance if they start something, just to show that BS isn't going to fly. However, if the second answer to “So, you have no weaknesses?“ is “No...“ -- red flag.

2: If your resume says you know something, you better know it
Don't copy and paste the .NET Framework class library reference into your resume unless you truly understand how to use each class in detail. If something's on your resume, we'll pound you on it. That's how we determine how well you know technology. The specifics aren't important. If you write “.NET Remoting”, you better be able to tell me what MarshalByRefObject does and how statics work in this context. If you have a CS degree you better sure be able to tell me what a binary tree is. And by all means, don't say you're a C# expert, and go on to describe that C# is actually just a mix between JavaScript and Visual Basic. (Yes, that really happened.)

When interviewing, many times a great candidate won't have experience with the particular technology you're using. That's ok, provided they can learn and are good in other areas. The problem is always trying to find something you can quiz them on. I look to their resume and see. Whatever they list, I ask them to rate themselves in it. If they still say they are experts in it, then I'll drill in with a few questions on that technology. “How good is their best?“ -- that's what I want to answer.

3: Know some basics
Everyone who can type can use Visual Studio. Saying you built a data-driven app with ASP.NET only tells me that you have basic mouse and keyboard skills. You better be able to handle some fundamental *thinking*. Traverse a tree, reverse a string, add items into a sorted array. Don't bother trying to defend saying “these are impractical -- when's the last time you used BinarySearch in a real app“? Umm, let me think... yesterday. You won't get hired for *real* work if you are just a IDE groupie. Sure, you can make cool things happen, perhaps even get paid. But I'm also interested in that the code you generate is decent. Sure, in many cases you might be able to go allocation crazy and box 1 million ints for fun. In other situations, you'll need to write better code, and you need to know how to do that. If you don't want these questions, say you dropped out of school and have been just programming for years. While it might not save you if you're an idiot, at least it gives the interviewer a frame of reference. At least that's better than saying you have a CS degree, but not knowing what a BinaryTree is, how to sort an array, or so on.

Interviewing people for .NET positions can be hard, because Microsoft's done the hard work for us in most cases. One red alert is “Well, perhaps I'm not that good in that, but I know my way around .NET.“ That's like a mechanic saying “Well, hmm, I'm not sure of the difference between these fluids and those hoses, but I've got 101 power tools and a lot of rags, so I can get it working.“ You don't want people who just “get stuff working“. You want people who are going to build something nice, something you don't mind working on later on.

4: Ask for clarification
If you are unsure about something, ask to clarify it. If you think there could be something else, ask. If you have to write a function, get some context. Is this part of a realtime process and needs to execute with a given amount of resources? Or is this a drag-n-drop application that runs once a year? Sometimes it won't matter, but when it does, you've saved yourself the trouble of saying “Oh, I didn't know you wanted *efficient* code. Let me go rewrite that.“.

Sometimes it's a good idea to hold details back to see what the interviewee does. Good candidates will try to gather requirements or probe you to see what's going on. Not so good candidates just start blasting away. On the job, that means they might be likely to just write some code without much forethought of how it's going to work with everything else. Or it means that they might spend 10 hours writing a super-efficient algorithm in x86 for something that's only called once a day or will never be a bottleneck, thus lowering productivity. Try to see what balances they strike out, what trade-offs they make. If a candidate seems hestitant, volunteer some information. On interviews, people react differently than they will on the job. Hesitation might just mean they want to ask, but are afraid of negative points.

5: Have a good attitude
Almost always, you'll be joining a team and have to work with other human beings. While it might be “right” to get the smartest person ('cause intelligence is all that matters, right? :)), even if they are arrogant, it probably won't happen. You'll want to show that you will get along with other members on the team.

When interviewing, I try to make sure that this person is going to cooperate. Are they going to write code while getting feedback from others? Or will they write their “own” code and defend it at all costs? Will they help out other team members, or try to fight for the “top”?

Anyways, those are just a few notes I've realised when interviewing people. Hope it helps someone!

Misc. Technology | Personal
Friday, July 23, 2004 8:20:37 PM UTC  #    Comments [4]  |  Trackback

 Thursday, July 22, 2004
Birthday attack in C#
How strong is a 128-bit hash? If you are looking to avoid collisions, the answer is not 2^^127, but 2^^64. Why? Due to the birthday paradox. Wikipedia says: “Specifically, if a function yields any of n different outputs with equal probability and n is sufficiently large, then after evaluating the function for about √n different arguments we expect to have found a pair of arguments x1 and x2 with f(x1) = f(x2).” The name “birthday“ comes into play because this holds true in a group of 23 or more people, chances are about 50% that two of them will share a birthday. The actual formula is Sqrt(n) * 1.2.

For a hash function, where strength is measured in powers of two, it's simple to calculate. For the exponent (128), just divide by two. So, we have 1.2(2^^(128/2)), but for most purposes, we leave off the 1.2 and just say 2^^64.

This means that if you're trying to find a collision, say, when attacking a digital signature system, the hash strength is considerably weaker than it sounds.

This sample program (Birthday.cs.txt (4.49 KB)) demonstrates this in C#, against a 32-bit hash (the first four bytes of MD5). Type in two messages, and it will find a collision by overwriting the first for chars of the message with random data. The code is not as clean, and it's definately not optimized for performance. That said, the 32-bit hash is successfully attacked in about 2.3 seconds on my machine (3GHz P4).

How effective is this attack? Very. It's extremely easy to modify most document formats these days. Pretty much every document has some place where you can insert or replace “hidden data” -- things a user or system do not see or process. For instance, in HTML, you could simply add the collision data inside an HTML comment. In a plain text file, you could modify spacing, tabs, and perhaps some other punctuation. It wouldn't change the meaning or validity of the document, but it allows you to generate enough combinations to find a collision.

After finding two colliding documents, you send the “original” to the victim, who then signs it. Then you take the good signature and substitute your “bad” document -- presto, a fake signature.

How can you prevent this? One way which might not always work is to modify a document before signing it. The real way is to use a hash long enough to provide the level of security you need. If you want “128-bit” security, in the sense that someone needs 2^^127 or so processing power to break it, then use SHA256. If for some reason you only have shorter algorithms at your disposal, a possibility is running the hash function again, with modifications to the document (for instance, switch every two bytes). This would give you a longer output.
Code | Security
Thursday, July 22, 2004 9:29:51 PM UTC  #    Comments [1]  |  Trackback

 Sunday, July 18, 2004
AV makers are lame, but this takes the cake!
I got this press release forwarded to me via an MVP mailing list. I couldn't stop laughing! It's from a software vendor (Airscanner.com) who makes AntiVirus products for Windows CE devices: Smartphones, Pocket PCs, etc.  They're proudly announcing the first virus for WinCE, amidst so much FUD, it's funny! What's funny? Take a look:

1: They paint WinCE as the last hope and salvation of Microsoft.
The Windows Mobile operating system is heir apparent to the Microsoft dynasty.  Microsoft knows the desktop and server OS market is saturated. There is no room for growth. And even as we speak, Linux erodes its market share.  How can Microsoft save itself?”
”Heir apparent”? I see... nope, no more shipments of WinXP or 2003 server will be going out, that's for sure. In the future, everyone works on tiny devices with relatively small processing power and storage, running a miniature OS. Windows Embedded is never used because that'd make too much sense. Welcome to the alternate reality where Airscanner lives.

2: They make silly claims about how “insecure” WinCE is:
“But there is a problem. Security is the biggest threat to Microsoft's survival. With its Trustworthy Computing initiative splintering under the pressure of weekly vulnerabilities, Microsoft would surely protect its most favored offspring. Right?
Wrong. Microsoft left its golden child naked and shivering. Windows Mobile has almost no security architecture whatsoever. It is wide open to attackers;“


WinCE is used on portable devices like PocketPCs, Smartphones, and MP3 (excuse me, WMA) players. What “security measures” should it have? It's a single user device you keep in your pocket. “Wide open“ Yep, just like my toaster, blender, VCR and DVD player are “wide open” for attackers. However, they do quickly go on to lavish praise on WinCE (since they're trying to make money off of it).

3: “Unfortunately, Windows CE was designed without security. Worse, handheld devices are now the easiest backdoor into a corporate network. “
Come again? Raise your hand the last time your Windows CE devices executed code under your domain account, on a domain computer. I don't see any hands. Raise your hand the last time your WinCE device executed ANY code on a corporate machine. Still no hands? WinCE adds no more risk to a corp network than already exists. Just more FUD.

4: Their terrorizing virus doesn't do anything. It prompts the user, “Can I spread?” And then it proceeds to “infect” files. They play this as a “proof of concept”. Ok, what exactly does it do? Because it sounds very much like a program *that writes to the disk*! That's it folks. It writes to files on your devices memory. If you're wondering what's scary, don't ask me. I guess the idea is to say “Basic IO works in WinCE! Run for your lives, arrg!” They portray this as a proof of concept. Well, Microsoft has these proofs of concepts around for a while. They're called Build Verification Tests.

5: The virus writer (which I'm guessing was paid for by Airscanner) writes:
“This is proof of concept code. Also, i wanted to make avers happy.The situation where Pocket PC antiviruses detect only EICAR file had to end …”
He WANTS to make the AV companies happy. I see. So, some guy takes his time to write a virus that doesn't do anything malicious, and only spreads on demand, and mails it right to the AV companies, *just to make them happy*? OK...

Even better, apparently there are only two things their software checks for. This means that anyone can write an AV in about an hour. And they want $29 for this product. Well, I guess if they sold 5 copies, that'd work out to $145/hour for them, so that's not that bad, eh?

6: The people from this company apparently can't write a simple algorithm.
“If the file has been infected, it will be marked with the word “atar” at the offset 0x11C. This is used during the infection process to see if the file was already infected. Without this check, the virus would keep re-infecting files over and over until the device ran out of memory.“
Mind you, this is the AV company, not the virus writer. They apparently believe the only way the only way to prevent an infinite loop on a set of items is to modify each item, “otherwise it'd run out of memory.” Are they truly saying there's no other way to do this? Sure sounds like it.

7: Even though it's low risk, they wanna play up the potential:
Note, however, that in the lab we were able to easily bypass these protection checks by making small changes to the virus binary. There is nothing to prevent malicious users from doing the same and repackaging this malware as a Trojan.“

Repackaging it as a Trojan? Excuse me? The virus doesn't DO anything. Maybe they meant “by rewriting everything“ instead of “making small changes to the virus binary“. Anyways, these things *don't spread*. Even if they tried to make it spread, it'd be very hard. The reason is because you don't usually copy EXEs around from one mobile device to another. You usually have a installer or host management system that handles this for you. If I want to give you a game, say DiamondMine for PPC, I don't copy files from my PPC to yours. I give you the DiamondMine installer, which runs on your Windows XP machine and that installs the game on your device.

For it to really spread, maybe it could email itself around. Of course, the steps would be: Get the email. Rename attachment (since EXE files are usually blocked). Copy to PocketPC device (since Pocket Outlook doesn't download attachments by default). Run file. You might as well just call the user and say something startling, causing him to drop the PocketPC. It'd do more damage that way.

Users beware: Desperate companies will make up whatever garbage they can to scare you into buying fake security products. Save your money and buy yourself a soft pretzel instead.
Humour | Security
Sunday, July 18, 2004 5:47:01 PM UTC  #    Comments [0]  |  Trackback

 Friday, July 16, 2004
Must read: Microsoft Research DRM talk

Before you form another stance on DRM, read this briefing. Cory Doctorow presented this talk to Microsoft last month. Cory's exactly correct about DRM. He talks about exactly WHY *I'm not* going to buy any more DVDs or CDs until someone fixes the technology. Very excellent article; a definate must read if you're working with anyone in contact with DRM.

Misc. Technology | Security
Friday, July 16, 2004 12:45:01 AM UTC  #    Comments [3]  |  Trackback