Slashdot Mirror
IBM using Napoleon Dynamite Quote to Encrypt Data
schmack writes "A developer discovers a quote from the movie Napoleon Dynamite is being used as the cipher key by IBM to publish encrypted XML at this year's Wimbledon grand slam. But is this a rather glaring lapse in security or an easter egg for curious hackers, many of whom would surely be fans of the quirky movie?"
It was totally retarded, why do people like it?
As to being a security issue, unless someone compiles all quotes from all movies into a text file, it is not.
You can't handle the truth.
on whether or not they were encrypting anything important. If they were then they were idiots.
slashdot troll = you make a compelling argument I do not like the implications of.
"But is this a rather glaring lapse in security or an easter egg?"
If what they were sending was important then it is definately the former, if it's something which they meant for people to have a go at then it'll be the latter.
*''I can't believe it's not a hyperlink.''
Since the most commonly used passwords are 12345 qwerty god and love, I wouldn't be surprised if the password was "Gooodddd" :)
I don't really see this as a "lapse" in security. I mean, it was an XML file with updated scares, not a SQL database with every known Social Security Number. The application in question (a flash scoreboard) doesn't exactly call for some kind of PKE scheme.
Idiots!
If you read the article, you'll see that he found the key in the flash applet that presented the data to the website visitors. So even if they used a truly random key, it would be worth no more, since the client could just read the flash file (de-assemblers for flash is out there. Search on google.), and get the key. So really, there is no point of better encryption, because the determined people will get the key anyway.
Remember that flash runs on your computer. Thus, the encryption key has to be on your computer so the flash application can decode the XML file and show you the results. As long as Trusted Computing does not excist, there is no way to stop a determined person from getting the key. Thus, using a stronger key would not make it more difficult. It is not like the key was discovered by accident. The writer of TFA was looking for the key in the flash file...
Nothing here to see, please move along!
Assembling etherkillers for fun an profit
It was totally retarded, why do people like it?
Look, it's all right there:
Q. Why do people like it?
A. It was totally retarded.
You're, uh, one step away from Yoda-speak.
Not sure why exactly they would want to encrypt the scores as they flew over the network though. The scores are public knowledge...who cares if they are sniffed? Technology demonstration? Wanted to use the 'encryption' buzzword perhaps?
Blar.
What ever happened to the DMCA?
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
I see even so called Linux friendly IBM is blocking Linux users out because there is no Flash 8 for Linux yet. Oh well maybe next Wimbledon. Is there a Flash player 8 out for Mac?
Star Trek, there maybe hope.
Napoleon Dynamite IS a horrible movie, that's why it is liked so much. It's PAINFUL to watch, took many breaks in between the first time through.
In Excel, the Solver, Analysis Toolpak and Autosave add-ins are protected using the password "Wildebeest!!", and the Internet Assistant VBA add-in uses the password "Weezaarde!?"... More info about it is here.
I wonder if the guy who cracked this has nunchuck skills and bowhunting skills too.
But why is the rum gone?
Yay for juxtaposition of tags! I never would expect these to go together
TAGS: wimbledon | ibm | napoleon | dynamite | encryption | liger |
This is my United States of whatever.
....the worst post ever made.
Please, ITninja, like anyone could even know that.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
it is much more fun to talk about than it was to actually see it. which is one marker of a cult classic.
putting the 'B' in LGBTQ+
I just read that headline like Doyle Redland. Is this even news?
'tis but a scratch.
>if you calculated the number of substring with say, 1-10 words, I think you'd find that the key space is more than large enough.
Let N be the number of words in a script.
Number of 1-word substrings: N
Number of 2-word substrings: N - 1 (because the last word can't begin a 2-word substring)
subtotal: 2N - 1
Number of 3-word substrings: N - 2
subtotal: 3N - 3
Number of 4-word substrings: N - 3
subtotal: 4N - 6
10N - 45 is a miserable excuse for a keyspace.
Scripts of popular movies such as the Star Wars trilogy are obvious things to include in a cracking dictionary.
It's a diversionary tactic, gosh!
How do you keep a bunch of computer nerd hackers in suspense?...
The quote cipher was probably shifted over by one, reversed, and hashed a bazillion times. It's very unlikely that one of the /. script kiddies could ever figure it out.
We're looking for a good English to English translator. Would you be available soon?
If you can read this sig, you're too close.
>If a project doesn't require strong encryption, does it require encryption at all?
That is an insightful question.
Historically, weak encryption had a niche for information whose value dropped sharply over time. If you have a lame algorithm that a cluster of supercomputers can crack in a week, you can still safely use it for messages like "unit 3, fall back to hill 41, await instructions".
Sports scores might fall into that category, though the problem in this particular case was not weak encryption, it was a failure of key management.
The other niche is information that you don't want to leak, but that nobody will pay enough to get cracked. No crook motivated by money would crack 40-bit encryption to get the number of your prepaid credit card with the $100 limit. The problem with this idea is the number of crackers motivated by ego rather than money.
Some people have believed that weak crypto makes sense if the most cost-effective attack on the data is to attack something other than the crypto. This was the reasoning behind WEP, "Wired Equivalent Privacy". The idea was that since anyone could tap a wired network, the crypto didn't need to be strong. This failed because the crypto was not just weak but sloppy, causing it to collapse into near-zero protection, and because the threat models weren't comparable. The "cost" of tapping a wired network includes showing your face and getting into the building. Wardriving is much safer for an eavesdroper.
All these ideas are nonsense today because strong crypto is just as easy to deploy as weak crypto, except in the world of puny embedded devices.
..and the result was a disaster. Digg v3 isn't what it's cracked up to be. http://neosmart.net/blog/archives/205
.|A(0{?y01/3z4xy0|?|B|L-Kfpkxey^tom5638BHQ{y9|G.Ak `he&5'|_pl_464:UO>{z7{G@C?D=yDACAFA{/z-z./2
??
Somehow, I'm missing something about how obvious this "quote" is supposed to be.
-- There are 10 kinds of people in the world, those who understand binary and those who don't.
This was hilarious! http://www.atomfilms.com/sw/content/anakin_dynamit e
So, he disassembled a flash program to get a key to "circumvent" encryption. Is the DMCA's formidable vagueness enough to cover this?
It's not clear that the "work" is or isn't protectable (shouldn't be, but I remember a lot of fuss about similar sports related content from some other site). Or is it now enough to have token encryption like this to make it illegal to "circumvent" it?
sic transit gloria mundi
Dynamite was the most deft satire of high school life that I've ever seen. There are a ton of people that are twentysomething or younger that DONT'T like the movie, but in my experience, most do. And the older you get, the more you're removed from todays High School experience, the less likely that you'll enjoy the movie.
They can encrypt is however they want to, ok??? GOSH...
That's nothing... For a long time (and maybe still) one US state's master Medicare/Medicaid database was secured at the admin level with a username/password from an AC/DC song's lyrics. Rock on!
But is this a rather glaring lapse in security...?
Well don't ask me, I voted for Pedro!
How do I know this.
I'm his uncle. We went wolverine hunting once.
"In a world that exists without walls and fences, who needs Windows and Gates?"
I'm sure the entire IBM corporation and its 300K+ employees intended to personally slight the linux user community with the use of this atrociously snobby and exclusive Flash 8 thingamabobber.
You could have at least taken a potshot at Macromedia for not having released a Flash 8 plugin for linux yet. They would seem to be the ones who have left you hanging out to dry.
you can always wine_run W32 Firefox with W32 flash plugin :)
Who logs in to gdm? Not I, said the duck.
Is it not possible that this was a randomly generated key that simply happened to be a Napoleon Dynamite quote?
There is no "fair use" in the UK.
No-one tell Darl
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
The simple encryption which they used coudl easily be made far more difficultto circumvent simply by using a random key, inserting it into the flash app as it is loaded (simple string replace), then using a key to retreive the encrypted scores.
Bang now each time the scores are loaded the flash app would have to be disassembled, which isnt going to happen.
Do you know first-hand that this is true and is the policy?
No. Well, yes it is, but it's not only a 'geek artifact'. On the Internet, if we need any cryptography at all, we need the strongest cryptography we can find, because we never know how capable our adversaries are. Actually, we know a little about our adversaries' capabilities: any adversary is capable of at least every attack that has ever been published, and possibly some attacks that haven't. Whenever we design a system using strong cryptography, we are designing the system with knowledge of current attacks. However, the system will be subjected to both current attacks and future attacks, so we need a margin of security[1] that is large enough that we can have confidence that the system will not be practically breakable while it is still in use.
Basically, we need strong cryptography because designing systems against future, unknown attacks using knowledge of current, known attacks. This is harder than it looks.
-----
[1] By "margin of security", I mean, loosely, the difference between the limit of computing power that we assume will be available to any adversary, and the amount of computing power that we assume will be required to break the system.
http://outcampaign.org/
They should have used Jar Jar Binks and Westly Crusher quotes. Nobody wants to remember them.
Table-ized A.I.
Not sure where they get the idea that a single movie
is so popular with the "hacker culture". C'mon! Napoleon Dynamite???
perhaps a proper survey is in order here.....
meanwhile, Eureka Seven is about to start and I don't want
to miss the episode (for those that don't know, Eureka Seven
is ANIME).
Understanding is much like a 3-edged-sword. in this: there are always 2 sides and the truth.
I once plugged the wrong ram into a IBM RS/6000 40p machine. The
machine bios warned me: "Danger Will Robinson"!
The number of different quotes in the movie that could be used: Like a finity.
I cried real tears when Li Mu Bai died.
WORST. JAPH. EVER.
This obviously isn't an attempt by IBM to try an encrypt the data. I'm not even all that certain of a reason they would want to... I mean, its not like they're getting X amount of money for each time the results are checked. If they were, they would be stupid to not determine the total amount based on the number of times the XML files were accessed... this would allow for them to profit not only from users using their scoreboards, but people using others' as well. Its a simple way for IBM to maximize profit.