2003-05-31 · 20:49

MSDN developer security center

MSDN now has a new security center. It’s billed as “a one-stop source to help developers write secure code”. Check it out. (hat tip: Michael Howard.)

Comments Off on MSDN developer security center

Filed under General Stuff

2003-05-31 · 20:43

TechEd bloggers

This is pretty cool: an aggregated site (or wiki) of bloggers who are speaking at or attending TechEd. I just added myself, but my blog isn’t there yet. Dan Fernandez listed his session picks; I already listed mine over here. I arrive midday Monday and will hit the bloggers meeting, have dinner with the Windows & .NET Magazine folks, and speak on Tuesday afternoon. In between, I may actually get to go to a session, but more likely I’ll catch up with various vendors, friends, customers, and potential customers.

Comments Off on TechEd bloggers

Filed under General Tech Stuff

2003-05-31 · 11:57

New denial-of-service attacks

This is fascinating. Two folks at Rice’s computer science department have written a paper about algorithmic complexity attacks. The basic idea is that an attacker who knows how a program processes input can overwhelm it by choosing patterns of data, or data with specific contents– not the typical DoS caused by flooding. Here’s the abstract:

We present a new class of low-bandwidth denial of service attacks that exploit algorithmic deficiencies in many common applications’ data structures. Frequently used data structures have “average-case” expected running time that’s far more efficient than the worst case. For example, both binary trees and hash tables can degenerate to linked lists with carefully chosen input. We show how an attacker can effectively compute such input, and we demonstrate attacks against the hash table implementations in two versions of Perl, the Squid web proxy, and the Bro intrusion detection system. Using bandwidth less than a typical dialup modem, we can bring a dedicated Bro server to its knees; after six minutes of carefully chosen packets, our Bro server was dropping as much as 71% of its traffic and consuming all of its CPU. We show how modern universal hashing techniques can yield performance comparable to commonplace hash functions while being provably secure against these attacks.

Comments Off on New denial-of-service attacks

Filed under General Stuff, Musings

2003-05-30 · 10:49

Periodic table, revisited

Devin, John, and I had a discussion about Avogadro’s number yesterday, so naturally I was pleased to see this: the Periodic Table of Dessert. (Hat tip: Dori).

Comments Off on Periodic table, revisited

Filed under Musings

2003-05-29 · 08:30

Trip report: TOL-SEA on ATA

I normally fly Delta or Northwest, the former out of habit and the latter because they (generally) offer the least obtrusive way to get from home to SEA, my most frequent destination. However, I recently had to take a short overnight to SEA. NW wanted $1927 for their nonstop ex DTW, and DL couldn’t meet my departure or arrival time requirements. I went out on a limb and tried American Trans Air to see how it works.
Leg 1: TOL-MDW on a Saab 340. I don’t mind turboprops for short hops; the 340 is noisier than a CRJ, but no less comfortable. I used ATA’s web check-in; apart from a minor security surprise, I was able to print boarding passes and use them to get through TOL security, just like on Big Air (although ATA’s app is less sophisticated and can’t do wireless checkins yet). The TOL gate staff was friendly; the FA on my flight to MDW was OK, although her English was heavily accented and she could have benefited from either a good bath or a better grade of deodorant… but I digress. We arrived on time, but there were ominous thunderheads off to the west, and I counted 8 ATA and Southwest 737s lined up awaiting departure as the shuttle took us from one side of the field to the main terminal.
Leg 2: MDW-SEA on a 737-800. I hadn’t flown through Midway in at least 10 years, so I wasn’t sure what to expect. The A, B, and C concourses are arranged like spokes radiating from a central food court, where I had a not-awful turkey sandwich. No wireless or wired Internet connectivity, and few power plugs, meant that I had to forego getting any work done; I was saving my battery for the plane ride. ATA doesn’t seem to handle irregular ops very well; there was a constant flow of conflicting PA announcements about arrival and departure times for various flights, and our flight was gate-changed four times. Boarding was by row and proceeded pretty smoothly. I’d estimate that the flight was 80% full, maybe more. Unsurprisingly, I didn’t see a lot of road-warrior types– there were lots of retirees, plus many toddlers with one or both parents.There were a few of the uptight-looking middle-aged white guys that I’m used to seeing in the F cabin on DL and NW, but none sat near me 🙂
We eventually departed about 70 minutes after our scheduled time. The flight itself was uneventful. I sat in 2D, the right-hand bulkhead aisle seat. Legroom on the bulkhead row is less than on the corresponding row (10) on DL or NW iron. Cabin service was briskly professional; of course, there was no food, but I’d laid in a supply of Fig Newtons ahead of time. Unlike NW’s DTW-SEA flights, this aircraft had an in-flight entertainment (IFE) system, but it only showed music videos, and that for only about 90 minutes. Given how awful DL’s movies normally are, this is probably not a bad thing. Given our late start, and the fact that we were traveling westbound, I expected a late arrival, but we actually got in 10 minutes late– not too shabby. I’ll write about the return flight tomorrow, after I get back.

Comments Off on Trip report: TOL-SEA on ATA

Filed under Travel

2003-05-28 · 11:47

It only looks like a bug

I’m flying ATA to Seattle today, so I tried to use their web site to check in. I had some printer trouble while printing boarding passes, so I clicked the “Go Back” button on the boarding pass page. Imagine my surprise when I got someone else’s boarding pass. I immediately pegged it as a session-rollover hole, so I called ’em up and spoke to a helpful lady at their Internet service desk. I followed up with a screenshot showing the other passenger’s boarding pass, and they followed up with a call from their webmaster. It turns out that instead of including a “your session has timed out” page like, oh, 99.8% of other e-commerce sites, they throw up this fake boarding pass. It’s being fixed. I’m glad it was a placeholder and not a real security flaw, and I’m even gladder that they took prompt action to square it away. I hope their IT staff’s attitude is reflective of the flight and cabin crew’s attitude.

Comments Off on It only looks like a bug

Filed under Security

2003-05-28 · 11:32

Curse you, IBM!

If I had time, I’d write Sam Palmisano a nasty letter. I don’t, so this will have to suffice. Why in the hell doesn’t the battery for the T20 series ThinkPad fit in the T30? They’re the same size, but there’s a protrusion on the T30 battery that’s not there on the T20. Identical capacity, nearly identical casing– I’m tempted to use a Dremel tool to make it fit. Grrrr.

Comments Off on Curse you, IBM!

Filed under Smackdown!

2003-05-28 · 11:20

Getting married remotely

Well, this is a new one on me:

Montana is believed to be the only state that allows marriages by proxy without the missing partner being connected to the ceremony by telephone. Texas and Colorado have proxy marriage laws but both states require the missing party to say their vows by telephone.

This is from a story about an Army PFC in Iraq who married a woman in Montana, without actually being present. This gives a whole new meaning to the concept of man-in-the-middle attacks.

Comments Off on Getting married remotely

Filed under Musings

2003-05-27 · 11:28

I can’t believe I ate the whole thing

I’m a Taco Bell junkie. OK, it’s not quite that bad, but I do like the food way out of proportion to its quality. Recently I have discovered the Southwestern Steak Bowl. Actually, I saw it flash by during a commercial I was skipping while watching 24, so I guess TiVo isn’t the end of ad-supported TV after all.) After my first one, I was hooked– after all, it weighs nearly a pound, and boy does it taste good. I went to the Taco Bell web site to look up nutrition information and found– surprise– nothing! Not being easily discouraged, I filled out their feedback form, and this week I got a nice form letter in the mail, along with a copy of the breakdown. As you can see, this bad boy has almost a whole day’s worth of sodium and half a day’s fat and fiber (not to mention 30% of my vitamin A, 35% of iron, and 20% of calcium). That means I can cut down to two meals a day, perhaps with a little ice cream as a bedtime snack. Top that, Atkins Diet!

Comments Off on I can’t believe I ate the whole thing

Filed under Musings

2003-05-27 · 09:15

Free stickers

All right, here’s the link: Stickers For Hackers. Now please send me my free sticker. (Hat tip: J-Dawg.)

Comments Off on Free stickers

Filed under General Tech Stuff

2003-05-23 · 13:59

TV Land, part 3

The cable guy came today. Remarkably, my appointment time was between noon and 5pm, and he showed up at 12:00 on the nose. Too bad I was at Rotary. After 45 minutes or so of head-scratching, cable-swapping, and complaining about how complicated my setup is, he isolated the problem: the satellite installer used diplexers to save himself from having to run another set of cables. The installer is convinced that the fact that the satellite receiver sends 18V to the LNB is the problem, but I think it’s much more likely that the diplexer sends 2-856MHz to the TV output and 950-2250MHz to the satellite output. The DCT-5100 FAQ says to make sure that you have full 2-1000MHz signal from pedestal to cable box, so I think the diplexer’s bandwidth is at fault. To fix it, I’ll have to run another cable through the basement, then add a port to the wallplate so that I have a clean run from the cable service entrance to the box.
I must say that the Discovery HD picture was stunning, for the few minutes I got to see it while installer-man was doing his thing.

Comments Off on TV Land, part 3

Filed under HDTV and Home Theater

2003-05-22 · 12:19

TV Land, part 2

So far, I’ve learned a number of things about HDTV. First, if you watch a crappy movie in HD, it’s still crappy. (Disclaimer: I didn’t watch the whole thing). Second, for some reason the HD signal from the local CBS affiliate isn’t showing up as HD here; when I tune in something that is supposed to be HD, it’s still 4:3. Third, and worst, I’m still not getting a watchable picture on Discovery or HBO. It may be that the splitter is at fault, or it may be a bad box; a Buckeye tech is due out tomorrow to check.
The bigger issue: Buckeye is going to require subscribers to buy a box; they’re not going to rent or lease them. In that case, I almost certainly will buy an over-the-air and satellite tuner combination instead– that way, I can be guaranteed that they can go where I do, and I’ll get more channels.

Comments Off on TV Land, part 2

Filed under HDTV and Home Theater

2003-05-22 · 11:30

Three things you should read

A hat tip to an (unnamed) pal at Microsoft, who sent me (working) links for three useful documents:

Comments Off on Three things you should read

Filed under General Stuff

2003-05-22 · 10:41

TechEd 2003 right around the corner

TechEd 2003 is right around the corner. In addition to my session, there are a number of other useful sessions that security-minded folks should consider:

  • Mortimore, SEC301, Best Practices for Security and Patch Management (Arena, Monday, 1330-1445)
  • Attwell, MSG328, Reducing Spam with Exchange Server 2003 and Outlook 2003 (Ballroom C1/2, Tuesday, 1045-1200)
  • Riley, SEC304, Enhancing Exchange, OWA, and IIS Security with ISA Server Feature Pack 1 (Arena, Tuesday, 1045-1200)
  • Morris, MSG329, Controlling Viruses with Exchange Server and Outlook (D171/D173, Thursday, 1700-1815)
  • Riley, SEC499, IPSec Internals and Implementation Examples (Arena, Friday, 1300-1415)
  • Batthish, MSG345, Deploying OWA and FE/BE Topologies for Client Access (Ballroom C1/2, Thursday, 1330-1445)
  • Riley, MSG308, Secure Access to Exchange From the Internet (Ballroom C1/2, Wednesday, 1700-1815)

I won’t be able to attend all of these, but I always make it a point to hit Steve Riley’s presentations, and if you’re interested in baseline security and patch management, Mark Mortimore’s session is a must-attend too.

Comments Off on TechEd 2003 right around the corner

Filed under General Stuff, Musings

2003-05-20 · 15:04

TV Land, part 1

If you don’t like boring technical details, you may as well stop reading now. Go here instead.
I just bought a Samsung TXM3097WHF TV. It’s a 30″ widescreen, one step up from the low-end 3096WHF that Best Buy sells. This particular model adds 3:2 pulldown and a two-tuner picture-in-picture circuit to the base model, and I lucked into one for $792 at Sears– about $300 off the best normal price. Of course, I got a floor model, and it’s been discontinued by Samsung, but it met my objective of providing an inexpensive widescreen HD set. (The nearest model I could find that didn’t say “Samsung” on the front is an $1800 Toshiba 34″ widescreen, so I’m prepared to put up with a lot for the $1000 savings.)
Problem #1 is that the TV is too wide to fit in the entertainment center– the flare at the back of the case is about 1 1/4″ too wide for the precut opening. A little saw work will fix that right up, as soon as I get some saw blades.
Problem #2: the TV has two component inputs, which is great. It also has two RCA-style inputs. However, you can’t use all four at the same time. Oops. Somehow Samsung forgot to mention this in their marketing literature.
Problem #3: there’s one S-Video input, and it’s on the side panel. I knew about this one ahead of time, but it’s still aggravating, since the TiVo and VCR are both fed to the TV via the receiver’s S-Video out.
Problem #4: the TV uses two separate buttons to cycle between the inputs. Button 1 goes RF->component1->component2; button 2 goes RF->RCA1->RCA2->S-Video. That makes switching (say) from DVD to TiVo a finger-stretching exercise not unlike a concert pianist’s warmup.
However, for $1000 in my pocket, I’m prepared to put up with a lot. (After all, I’m getting off much easier than this guy did.)
The HDTV feed installation went well, since I did all of it. The installer had 15 minutes of training on the DCT-5100 cable box this morning, before his first install. He’d never seen a component video cable or optical SPDIF, and he was leery of disturbing any of my wiring. I ended up doing the work while he struggled with Buckeye’s call center to get my box authorized. After a three-hour wait, I can now receive two of the four HD channels: Showtime-HD (currently showing a 4:3 movie) and WTOL-DT (currently showing Oprah, which is bad enough in standard definition.) No Discovery Channel or HBO yet, which is too bad; it looks like there’s some good stuff on later tonight. More when I have time to dig into the stack of paper the installer left, much less actually watch something in HD. It’s hard to imagine that I’ll want to watch anything on CBS, but hey, maybe I will.

Comments Off on TV Land, part 1

Filed under HDTV and Home Theater