Quality emails from recruiters...

The Upside of Yahoo Bugs

I don't have to endure those godawful trashy ads. ;-)

How not to fix a car

Car key is jammed in the ignition. Engine won't start. We've had ongoing problems with the VATS for the last year or so. This is a common problem in these cars. Obviously that problem has progressed to jamming the key in the barrel.

           

So I embark on a 2 hour adventure to remove the kick-plate, intercept the wiring from the ignition and bypass the feed into the VATS chip with the appropriate resistance to fool the anti-theft system. Pretty technical stuff. 

http://wiki.answers.com/Q/How_can_you_bypass_the_VAT_device

http://www.ls1.com/forums/f6/how-bypass-your-vats-61262/

http://www.youtube.com/watch?v=AKfn7J9CeZM

There's a lot that can go wrong here so not something I would undertake without a good reason. Think airbag.

In the end I successfully completed the operation and for the first time in over a year the security light goes off. The VATS chip is happy. 

But the engine still won't start.  I reassemble everything and put the kick-plate back in place in the hope that that will help. No joy. 

It's then I do something I should have done at the beginning. Set aside my assumptions and check for the obvious. Oh hell. No. I didn't. Talk about stupid. 

So it turns out I didn't need a degree in electrical engineering, a multimeter, soldering iron and 2 hours to fix. Would have been easier just to move the transmission to Park. Yes. I do deserve a medal.

Stay tuned for the sequel. How to change a light-bulb by rewiring your house.

Clusterbeep

My new favorite word: Clusterbeep.

Yahoo! Made Me a Jackass

This morning at 7:49am PST Yahoo! gave a spammer access to my account.

My account was not hacked and nobody has my password. Instead it was accessed via a "Yahoo! Partner's Application". Not one I actively authorized.

Yahoo! authorizes a broad array of internet based services, blogs, widgets and whatnots to access user accounts via tokens and credentials. They also drop copious cookies tied to your profile. Throw in an ever-growing bug-list and our accounts are fair game for the spammers. My password never played a role.

I never opted-in to open my account to any "Yahoo! Partner's Application". I'm very deliberate about my passwords and what systems I use. But I have a pretty good idea why it got added while I wasn't looking.  I also have a good idea why tens of millions of Yahoo! accounts remain vulnerable for months.

There's no such thing a free lunch. The free email providers have to make money somehow. For Yahoo! it's important that their users can range far and wide across their extended network of websites without being stopped at a login prompt.

The 800 pound gorilla in the room is that the vast majority of software has vulnerabilities which leave you at risk. This risk grows quickly as you access more systems. If an internet giant like Yahoo! decides to allow it's extended network to access your account the risk becomes a statistical certainty.

It isn't a priority for Yahoo!  that user accounts are vulnerable. It's a sad reality that it's only taken seriously when it becomes a PR problem. About 10 years back I brought a potentially devasting security bug to the attention of Yahoo and Microsoft IE engineering. I never got any followup- and a year later the bug had not been fixed.

About 100 spam messages went out from my account and now I look like a jackass. No spammer sat down and decided to relay spam via my account. No human targetted me specifically - I was just the next entry on a very long list. Maybe you are on tomorrow's list.

So the lesson here is to check your account security settings carefully and regularly for applications, credential sharing and networks that you've been opted into. Disable and remove everything you don't need or use. And remember that while most of the security recommendations these companies tell you are solid they are not going to discourage a feature that makes revenue for them even when it carries additional risk for you.

My sincere apologies to everyone who got spam from my account. This is the first time this has happened to me in 20 years of pushing these keys. I do computer security for a living so this stings me regardless of who is at fault. I should have been more diligent in checking my account settings for the creeping appearance of undesirable features.

I've reviewed the entire incident and removed all access rights to "Partner" applications (which I never enabled in the first place - thank you Yahoo!) and mobile access (which I don't use). I've also bounced the password a few times though that was not the issue here. This is pretty much all I can think of to do now.

I am going to work hard at finding new ways not to look like a jackass to those people who trust me with their email. Sorry.

-J

http://answers.yahoo.com/question/index?qid=20130606160239AAxdDV9

http://thenextweb.com/insider/2013/01/31/yahoo-mail-users-still-seeing-accounts-hacked-via-xss-exploit-amid-reports-yahoo-failed-to-fix-old-flaw/

Four and a half years...

Well, obviously posting regularly to this blog has not been a priority. What with new job, new house and new life I've been a tad bescheftigt.

And truth be told I find it disconcerting the extent to which personal information on the internet is now harvested, correlated, mined and ultimately, sold. I prefer not to partake.

Hope you liked the "airdog" story and photo from the airplane. So look for another exhilarating post sometime around Halloween 2017?

Lightweight is Good

Wisdom for the day:

A line of code that isn't there is a line of code that isn't broken.

How Systems Are Built

Tree Perspective

Virgin America Flight 909 LAS - SFO

This one is easy: Yosemite Valley in foreground, Tioga Pass on left, Mono Lake at top right and eastern Nevada top left.

CQSAT is free!

As in free to pay money for the beer, not free beer.

Now that the ownership and licensing is all figured out I can release much of this work. The website cqsat.com will be reworked and the wiki written as I roll the rest of this out. The source is on sourceforge.net.

CQSAT divides nicely into 3 parts. This is the first and earliest part, it's quite a complete example of how to use LD_PRELOAD to do library interposing. CQSAT can figure out how a project is comprised and built by examining how make/ant/maven et. al. use the C library and POSIX system calls.

This was probably the most interesting and rewarding piece of software that I've worked on to date. The initial coding was written in 2 frantic weeks in Saigon during the Summer of 2005; laptop, warm monsoon rain and (almost) free beer. But not all at the same time.

Adobe, you make my CPU go wild

One of these days I'll be a good engineer and figure out exactly why the Adobe firefox plug-in npviewer.bin spins up my CPU without reason. Then I'll post a solution and maybe write them a note.

But, ... It's kind of juvenile to write software with busy loops, no? they teach that in the first week of CS, right?

Here's something I occasionally run in a hidden window:


watch -n 30 'pkill npviewer.bin'


Quick way to cut my CPU usage by an order of magnitude.

P.S. I run fedora 9 Linux, Firefox 3.0.2, Shockwave flash 9.0 r124

Airdog

I crossed the street from the post office fully loaded with Netflix movies (unsubscribe!, repeat, unsubscribe!), Starbucks coffee (smells great!), AT&T bill (please let it not be another bill for $0.00 - "do not send any money"; that just plain confuses and scares me).

Riding shotgun in the car at the cross-walk, stretched from passenger seat with nose pressed against windshield was this totally cute terrier, fluffy white hair and big brown puppy-dog eyes (the genuine article no less).

That was the first thought through my head.

Next thought: cute Fluffy should meet shinny bathtub.

Next thought: Fluffy's midsection is awwwwfully close to where the airbag explodes from. No, not close to, resting against.

Last thought: sunroof.

Another day, another Euro

This is a blog entry. I like blog entries.