Monthly Archives: April 2007

Security

Photoshop and Paint Overflow

Leave a comment

The exploit code circulating right now has all sorts of “have fun” comments. I think there should be a sports channel dedicated to software security.

This particular incident might show up on the “competitive buffer overflows” program.

Or how about a reality show that pits the common corporate development manager and engineers against the wily security consultants and insider threats? I would include outside threats, but frankly I don’t think the outsiders have a chance without some kind of inside connection.

Castles were either breached by long battles of attrition and overwhelming odds, or someone “found” a weakness by paying an insider or someone who had at some point been inside…

Anyway, the breach was reported about a day ago and I have not seen any response from the vendors yet. He suggests that you just need a target user to open a special PNG file in Photoshop or Paint Shop Pro on Windows XP and you can do nasty things like open a backdoor.

Multiple image editing applications are prone to a remote buffer-overflow vulnerability. This issue occurs due to a failure by the software to properly bounds-check user-supplied input prior to copying it to an insufficiently-sized memory buffer.

Successful exploits allow remote attackers to execute arbitrary machine code in the context of a vulnerable application. Failed exploit attempts likely result in denial-of-service conditions.

Perhaps the most annoying thing about this kind of attack vector is that images flow so freely today and Photoshop and Paint are so common. Note that the PNG attack follows the announcement last week by the same author that .BMP, .DIB and .RLE are also suitable methods of attack.

History, Poetry, Security

Compact Editions

Leave a comment

I just found an amusing article. Anyone who has suffered through my ramblings about the dated format of literature should really appreciate this:

To howls of indignation from literary purists, a leading publishing house is slimming down some of the world’s greatest novels. Tolstoy, Dickens and Thackeray would not have agreed with the view that 40 percent of Anna Karenina, David Copperfield and Vanity Fair are mere “padding�, but Orion Books believes that modern readers will welcome the shorter versions.

I disagree with their method as they’re trying to solve the wrong problem, like strapping wheels and an engine to a horse to make it faster. But as I’ve said for years, I think we definitely are ready for a new “book” format.

On a related note, I find it fascinating that a publisher is trying to argue that they can compress a message without destroying the integrity. Something tells me their measurements might be a bit loose, if quantitative at all.

History, Security

Gravel’s view resonates in the UK

Leave a comment

The BBC has some odd commentary on the US Presidential hopefuls:

Mr Gravel’s strong views clashed with what we all perceive to be the average American world view.

Mr Gravel said the front runners actually frightened him, so addicted were they to war and violence, a comment that would describe the attitude of many around the world to the US itself.

Interesting to hear a presidential candidate voicing that fear. It reminds us all that there is another America, which is not always on show.

This reminds me of the warnings you find now on peanuts jars: “may contain traces of peanuts”. It should be self evident that rational (e.g. real) Americans are still inside America, despite all the attempts to obscure them with violently dogmatic substitutes like those appointed by the Bush administration.

Craig recently pondered why a media giant would want to tightly control access to presidential debates.

I asked whether he thought the Amerian people had a right to this debate since it is our election. He said that “the American people have ample opportunity to view the debate on MCNBC and two North Carolina stations.�

Shameful. What makes NBC think it has the right to own the democratic discussion in this country?

It’s a rhetorical question, really, but firstly I think the answer has to do with how the current administration believes that the business of information makes “free” or “open” communication a harmful concept. They want the discussion owned and they trust large corporations, even foreign-owned, rather than citizens. Secondly, it is perhaps because they want to help “shape” the conversation and thus carefully influence the views available to their audience. For example, something tells me this sort of honest, open and frank American opinion found on Craigslist would never reach the air on NBC (Warning: May Contain Traces of America):

From an Angry Soldier
Date: 2007-04-10, 1:00PM PDT

I’m having the worst damn week of my whole damn life so I’m going to write this while I’m pissed off enough to do it right.

I am SICK of all this bullshit people are writing about the Iraq war. I am abso-fucking-lutely sick to death of it. What the fuck do most of you know about it? You watch it on TV and read the commentaries in the newspaper or Newsweek or whatever god damn yuppie news rag you subscribe to and think you’re all such fucking experts that you can scream at each other like five year old about whether you’re right or not. Let me tell you something: unless you’ve been there, you don’t know a god damn thing about it. It you haven’t been shot at in that fucking hell hole, SHUT THE FUCK UP!

How do I dare say this to you moronic war supporters who are “Supporting our Troops” and waving the flag and all that happy horse shit? I’ll tell you why. I’m a Marine and I served my tour in Iraq. My husband, also a Marine, served several. I left the service six months ago because I got pregnant while he was home on leave and three days ago I get a visit from two men in uniform who hand me a letter and tell me my husband died in that fucking festering sand-pit. He should have been home a month ago but they extended his tour and now he’s coming home in a box.

You fuckers and that god-damn lying sack of shit they call a president are the reason my husband will never see his baby and my kid will never meet his dad.

And you know what the most fucked up thing about this Iraq shit is? They don’t want us there. They’re not happy we came and they want us out NOW. We fucked up their lives even worse than they already were and they’re pissed off. We didn’t help them and we’re not helping them now. That’s what our soldiers are dying for.

Oh while I’m good and worked up, the government doesn’t even have the decency to help out the soldiers whos lives they ruined. If you really believe the military and the government had no idea the veterans’ hospitals were so fucked up, you are a god-damn retard. They don’t care about us. We’re disposable. We’re numbers on a page and they’d rather forget we exist so they don’t have to be reminded about the families and lives they ruined while they’re sipping their cocktails at another fund raiser dinner. If they were really concerned about supporting the troops, they’d bring them home so their families wouldn’t have to cry at a graveside and explain to their children why mommy or daddy isn’t coming home. Because you can’t explain it. We’re not fighting for our country, we’re not fighting for the good of Iraq’s people, we’re fighting for Bush’s personal agenda. Patriotism my ass. You know what? My dad served in Vietnam and NOTHING HAS CHANGED.

So I’m pissed. I’m beyond pissed. And I’m going to go to my husband funeral and recieve that flag and hang it up on the wall for my baby to see when he’s older. But I’m not going to tell him that his father died for the stupidty of the American government. I’m going to tell him that his father was a hero and the best man I ever met and that he loved his country enough to die for it, because that’s all true and nothing will be solved by telling my son that his father was sent to die by people who didn’t care about him at all.

Fuck you, war supporters, George W. Bush, and all the god damn mother fuckers who made the war possible. I hope you burn in hell.

Yeah, that’s what I’m talking about.