The purported key is only 16 bytes. There is no current public-key algorithm capable of maintaining security at a 128-bit key size. If that's a legitimate key, it's definitely a symmetric key. Symmetric cryptography has the obvious problem that the device necessarily must have the key inside of it somewhere, meaning that a reverse engineer could find it.
If Apple used a symmetric key to protect against unauthorized software, it would imply incompetence with cryptography. I highly doubt this is true. It's more likely that it's not.
Vista SP1 is essentially an upgrade to a non-server version of Windows 2008. After the upgrade, the build number is updated from 6000 to 6001, just like Windows 2008 has. Vista SP1 can be called Windows 2008 Professional by analogy with Windows 2000.
Windows XP and later reboot instead of show a BSOD when it bugchecks. This can be disabled, but only a small percentage even know about it. Sneaky Microsoft marketing tactic there.
I installed Visual Studio 2008 and noticed that hardly anything is different from Visual Studio 2005. Oh wait, that's because I'm only using native code. It's very obvious that the mandate from above is to focus only on.NET. Almost all the fancy new features are for.NET only. I think it's only a matter of time before Microsoft declares Visual C++ dead for anything but service packs. (They still need it to build Windows, so it'll just remain this way.) The C++0x support and MFC are probably just throwing a bone to their users.
Sadly, it doesn't look like C++0x copies C99's variable-sized stack array feature, and VS2008 doesn't implement C99, so we are *still* stuck with alloca on VS2008. Why didn't C++0x copy variable-sized stack arrays? And why won't Microsoft add this obvious extension?
A program running as root takes over a machine. News at 11!
It's really annoyed me that security companies continually report these things when they have no relevance to actual security. The concentration should always be on preventing malware from acquiring root access in the first place. Vista, despite its faults, actually does a much better job of this than its predecessors.
Also, this is Slashdot. Slashdot has Linux users, and wouldn't Linux users know that overwriting is even easier to do in Linux than NT? "dd if=trojan.bin of=/dev/hda", anyone?
By the way, there are many more bad things you can do as Administrator than just hack the boot sector. You can use bcdedit to create a fake Windows XP boot entry then put your Trojan kernel there.
What we really need is quantum computing. All modern lockout systems ultimately derive from public-key cryptography. Quantum computing would break all three popular systems - RSA, modular discrete logarithm, elliptic curve discrete logarithm - and there would be nothing Apple or anyone else could do to protect against unauthorized software on their hardware.
More importantly, it would destroy the VeriSign cartel.
Is the energy required to build a quantum computer and keep it coherent exponential in the number of qubits? It would make quantum computing mostly worthless if this were true. It would also be yet another case where nature conspires against those who try to use quantum mechanics to violate the normal laws.
If such things are possible, I hope when the qubit count reaches ~2048 that someone factors the Xbox public key.
The Xbox public key was 2048 bits. I'd love to see the end of that once and for all, now that the console is dead. I don't think it'll be possible any time soon, if at all.
I wonder about quantum computing - it could turn out to be the case that fighting decoherence requires energy exponential in the number of qubits. This would mean quantum computing is worthless. It would also be another instance of nature conspiring against those who attempt to break its laws.
It seems like the entire world is heading toward totalitarianism. Pretty much the only country liberalizing in recent years is China, and not by much. The Western powers are eroding slowly, while the weaker democracies just collapse suddenly. Everywhere it's moving in that direction.
I used to think I would leave the US when Dick Cheney becomes President for Life, but there's nowhere to run to now...
What's causing this to happen? Bad economy? Religion's reaction to the prevalence of science? Too much information disclosure undermining the ability to rule?
If a game doesn't run without Administrator access, copy protection is more likely to be the culprit than any other bad practice. Administrator access is required to issue arbitrary SCSI commands to CD-ROM drives, or to load kernel drivers used to make debugging difficult
The song for Rockman 2's Dr. Wily stages 1 and 2 is my favorite song for any NES game. http://www.youtube.com/watch?v=6b71t6Grvlk - has the song, but is also a funny video from how badly they glitch the game.
The Mac equivalent of Win32's WriteProcessMemory requires your program to be setgid procmod, so essentially you'd need Administrator access. This probably makes Mac malware considerably more difficult to make than on other platforms. Even Linux lets programs ptrace each other on all by the strictest of SELinux modes. Also, on Linux, a lot more machines have GDB installed, so malware could pipe to it when SELinux does interfere. Few Mac users have GDB installed.
Once it gets there and crossing is a non-event, we will see that there is nothing of interest out there. Voyager 2 is just crossing into vast, bleak nothingness.
NT works similarly to UNIX. It supports hard links, so the file instance could be considered an inode. On NTFS, files also have a unique number that could be considered the inode number.
The main difference comes from how NT has mandatory locking. When you open the file, you specify what file permissions other processes are allowed to use. Naturally, very few programs grant the "delete" sharing permission.
A lot of the bad stuff of Windows comes from the poor design of Win32, not the native NT API.
As for the source code in the ROM, check out some of the comments on our site. The slashdotters above commented on it above. This post is from months ago, too - why on Slashdot now?
Anyway, A Japanese PlayStation game named "Beatmania Best Hits" came with the complete source code to "Beatmania 5th Mix", another PlayStation game in the same series. Supposedly, it was complete enough to actually compile and run.
PlayStation games of the era had to have a ~30 meg file of zeros on them at the outer edge due to a problem with the drive. These were known as "DUMMY" files. Some unknown sneaky programmer at Konami put an LZH archive containing 5th Mix's source code as the DUMMY file. (The contents of the file didn't technically matter, it just had to be at the outer edge.)
So it's not an exploit because you already had to get administrator access in order to do it. Funny how they didn't use that logic when it came to implementing mandatory driver signing in Vista 64. A rootkit would already need to have administrator access to get loaded.
Thank you, Microsoft, for proving that you lied about the reason why you made driver signing mandatory.
602. Infringing importation of copies or phonorecords
(a) Importation into the United States, without the authority of the owner of copyright under this title, of copies or phonorecords of a work that have been acquired outside the United States is an infringement of the exclusive right to distribute copies or phonorecords under section 106, actionable under section 501.
The "infringement of the exclusive right" is the exact same wording as what makes piracy illegal. It is no better to import without permission than to download it illegally. The listed exemptions only apply in cases where you have it in your baggage when returning from another country.
The law sucks, but it is definitely illegal and those who import are criminals.
In multi-threaded code (or more correctly: all code using clone() with CLONE_FILES) there's a race when exec'ing (see commit link for details). In some applications this can happen frequently. Take a web browser. One thread opens a file and another thread starts, say, an external PDF viewer. The result can even be a security issue if that open file descriptor refers to a sensitive file and the external program can somehow be tricked into using that descriptor. 2.6.23 includes the O_CLOEXEC ("close-on-exec") fd flag on open() and recvmsg() to avoid this problem.
Yes, this is a good thing. However, they seem to have missed some: sockets and pipes. Sockets are not close-on-exec by default, so you may pass a sensitive socket to a child.
Windows NT has the same problem: sockets are inheritable by default until you call SetHandleInformation to disable inheritance. Other handles' inheritability is selected at open/create time.
Luckily, there is a workaround for it, if not pretty: use a reader/writer lock with opening handles as writers and forks as readers.
By the way, the linked changelog on kernelnewbies.org has a bad link for the "recommended LWN article".
For the SELinux thing against null pointer attacks, won't that break DOSemu?
IE7 64 is the browser I use for high security. Its market share is very small, even among Win64 users. It presumably has the same undiscovered security bugs as IE7, but x86-32 shellcode just crashes on x86-64. They'd have to specifically design support for x86-64, and that market share is far lower than Firefox.
There was at least one exploit against IE that didn't involve shellcode - you could ask a particular ActiveX control to download and run a program. Obviously IE 64 wouldn't be immune to that...
Slashdot Mirror
The purported key is only 16 bytes. There is no current public-key algorithm capable of maintaining security at a 128-bit key size. If that's a legitimate key, it's definitely a symmetric key. Symmetric cryptography has the obvious problem that the device necessarily must have the key inside of it somewhere, meaning that a reverse engineer could find it.
If Apple used a symmetric key to protect against unauthorized software, it would imply incompetence with cryptography. I highly doubt this is true. It's more likely that it's not.
Vista SP1 is essentially an upgrade to a non-server version of Windows 2008. After the upgrade, the build number is updated from 6000 to 6001, just like Windows 2008 has. Vista SP1 can be called Windows 2008 Professional by analogy with Windows 2000.
Windows XP and later reboot instead of show a BSOD when it bugchecks. This can be disabled, but only a small percentage even know about it. Sneaky Microsoft marketing tactic there.
I installed Visual Studio 2008 and noticed that hardly anything is different from Visual Studio 2005. Oh wait, that's because I'm only using native code. It's very obvious that the mandate from above is to focus only on .NET. Almost all the fancy new features are for .NET only. I think it's only a matter of time before Microsoft declares Visual C++ dead for anything but service packs. (They still need it to build Windows, so it'll just remain this way.) The C++0x support and MFC are probably just throwing a bone to their users.
Sadly, it doesn't look like C++0x copies C99's variable-sized stack array feature, and VS2008 doesn't implement C99, so we are *still* stuck with alloca on VS2008. Why didn't C++0x copy variable-sized stack arrays? And why won't Microsoft add this obvious extension?
Barack Obama will not get elected because his name is Obama.
If Republicans get to change one letter of Barack Obama's last name to make a comparison, I get to change one letter of Mike Huckabee's.
A program running as root takes over a machine. News at 11!
It's really annoyed me that security companies continually report these things when they have no relevance to actual security. The concentration should always be on preventing malware from acquiring root access in the first place. Vista, despite its faults, actually does a much better job of this than its predecessors.
Also, this is Slashdot. Slashdot has Linux users, and wouldn't Linux users know that overwriting is even easier to do in Linux than NT? "dd if=trojan.bin of=/dev/hda", anyone?
By the way, there are many more bad things you can do as Administrator than just hack the boot sector. You can use bcdedit to create a fake Windows XP boot entry then put your Trojan kernel there.
What we really need is quantum computing. All modern lockout systems ultimately derive from public-key cryptography. Quantum computing would break all three popular systems - RSA, modular discrete logarithm, elliptic curve discrete logarithm - and there would be nothing Apple or anyone else could do to protect against unauthorized software on their hardware.
More importantly, it would destroy the VeriSign cartel.
Is the energy required to build a quantum computer and keep it coherent exponential in the number of qubits? It would make quantum computing mostly worthless if this were true. It would also be yet another case where nature conspires against those who try to use quantum mechanics to violate the normal laws.
If such things are possible, I hope when the qubit count reaches ~2048 that someone factors the Xbox public key.
The Xbox public key was 2048 bits. I'd love to see the end of that once and for all, now that the console is dead. I don't think it'll be possible any time soon, if at all.
I wonder about quantum computing - it could turn out to be the case that fighting decoherence requires energy exponential in the number of qubits. This would mean quantum computing is worthless. It would also be another instance of nature conspiring against those who attempt to break its laws.
It seems like the entire world is heading toward totalitarianism. Pretty much the only country liberalizing in recent years is China, and not by much. The Western powers are eroding slowly, while the weaker democracies just collapse suddenly. Everywhere it's moving in that direction.
I used to think I would leave the US when Dick Cheney becomes President for Life, but there's nowhere to run to now...
What's causing this to happen? Bad economy? Religion's reaction to the prevalence of science? Too much information disclosure undermining the ability to rule?
If a game doesn't run without Administrator access, copy protection is more likely to be the culprit than any other bad practice. Administrator access is required to issue arbitrary SCSI commands to CD-ROM drives, or to load kernel drivers used to make debugging difficult
The song for Rockman 2's Dr. Wily stages 1 and 2 is my favorite song for any NES game.
http://www.youtube.com/watch?v=6b71t6Grvlk - has the song, but is also a funny video from how badly they glitch the game.
The Mac equivalent of Win32's WriteProcessMemory requires your program to be setgid procmod, so essentially you'd need Administrator access. This probably makes Mac malware considerably more difficult to make than on other platforms. Even Linux lets programs ptrace each other on all by the strictest of SELinux modes. Also, on Linux, a lot more machines have GDB installed, so malware could pipe to it when SELinux does interfere. Few Mac users have GDB installed.
Once it gets there and crossing is a non-event, we will see that there is nothing of interest out there. Voyager 2 is just crossing into vast, bleak nothingness.
NT works similarly to UNIX. It supports hard links, so the file instance could be considered an inode. On NTFS, files also have a unique number that could be considered the inode number.
The main difference comes from how NT has mandatory locking. When you open the file, you specify what file permissions other processes are allowed to use. Naturally, very few programs grant the "delete" sharing permission.
A lot of the bad stuff of Windows comes from the poor design of Win32, not the native NT API.
As for the source code in the ROM, check out some of the comments on our site. The slashdotters above commented on it above. This post is from months ago, too - why on Slashdot now?
Anyway, A Japanese PlayStation game named "Beatmania Best Hits" came with the complete source code to "Beatmania 5th Mix", another PlayStation game in the same series. Supposedly, it was complete enough to actually compile and run.
PlayStation games of the era had to have a ~30 meg file of zeros on them at the outer edge due to a problem with the drive. These were known as "DUMMY" files. Some unknown sneaky programmer at Konami put an LZH archive containing 5th Mix's source code as the DUMMY file. (The contents of the file didn't technically matter, it just had to be at the outer edge.)
So it's not an exploit because you already had to get administrator access in order to do it. Funny how they didn't use that logic when it came to implementing mandatory driver signing in Vista 64. A rootkit would already need to have administrator access to get loaded.
Thank you, Microsoft, for proving that you lied about the reason why you made driver signing mandatory.
Just wait until someone with one of these gets Trojaned and the controller starts DoS-extorting Google.
I'll believe them when they get me to speak Mandarin.
Don't you mean the PS3 effect?
Finally, you won't have to install a custom package to get decent cryptography performance in Fedora. It took them a long time to get away from 4.1.4.
The "infringement of the exclusive right" is the exact same wording as what makes piracy illegal. It is no better to import without permission than to download it illegally. The listed exemptions only apply in cases where you have it in your baggage when returning from another country.
The law sucks, but it is definitely illegal and those who import are criminals.
Federal prosecutors are in the executive branch along with FEMA - do you really think President Cheney would allow that?
Yes, this is a good thing. However, they seem to have missed some: sockets and pipes. Sockets are not close-on-exec by default, so you may pass a sensitive socket to a child.
Windows NT has the same problem: sockets are inheritable by default until you call SetHandleInformation to disable inheritance. Other handles' inheritability is selected at open/create time.
Luckily, there is a workaround for it, if not pretty: use a reader/writer lock with opening handles as writers and forks as readers.
By the way, the linked changelog on kernelnewbies.org has a bad link for the "recommended LWN article".
For the SELinux thing against null pointer attacks, won't that break DOSemu?
IE7 64 is the browser I use for high security. Its market share is very small, even among Win64 users. It presumably has the same undiscovered security bugs as IE7, but x86-32 shellcode just crashes on x86-64. They'd have to specifically design support for x86-64, and that market share is far lower than Firefox.
There was at least one exploit against IE that didn't involve shellcode - you could ask a particular ActiveX control to download and run a program. Obviously IE 64 wouldn't be immune to that...