Archive for the ‘security by obscurity’ Category

What do Microsoft and Apple have in common?

They apparently both have sold out to the entertainment cartels (movies, games, music, etc.) to prevent you from even making legitimate use of what you buy….meaning on the very computers and display hardware that you pay your hard earned money for!

The funny thing is, MacWorld is playing this up like it’s a good thing:

Apple didn’t just introduce new laptops Tuesday; it also introduced a new term to the vocabulary of Mac users—DisplayPort. The Mini DisplayPort found on new MacBooks, the refreshed Macbook Air and 15-inch MacBook Pros replaces the DVI and mini-DVI interfaces found on older models. But is this another proprietary debacle like Apple’s failed Apple Display Connector (ADC) interface? No.

DisplayPort is, in fact, an open industry standard promoted by the Video Electronics Standards Association (VESA), the same group that determines standard sizes for flat panel display mounts, for example. And Apple isn’t the only company supporting DisplayPort. HP, Philips, Samsung, Lenovo, AMD, Nvidia, Intel and many other companies have thrown their weight behind the standard, so we’ll be seeing a lot more DisplayPort-compatible devices in the coming years.

But at least MacWorld does at least try to list some of the downsides:

Unless you’re content with the infinitesimal selection of displays that work with DisplayPort right now, you’ll have to buy more gadgets to get your new Mac to work with a DVI or VGA display. You’re going to pay $29 for the privilege of getting such an adapter through the Apple Store. Unless you need a Dual-Link DVI adapter to hook up a Cinema HD Display or another 30-inch LCD panel, that is—that’ll set you back a full c-note, and you’ll be waiting four to five weeks for it, according to the online Apple Store.

What’s more, regardless of whether you buy Apple’s DisplayPort adapter or a third party’s (if you’re lucky enough to find one, that is), you’re going to mess up your desk with more boxes and wires getting that DVI or VGA display to work.

First Microsoft caved under the entertainment cartel’s unreasonable demands and turned Vista OS/hardware into Vista The Enabler. Now Apple’s newest hardware and OS on the new Aluminum laptop computers has turned into Leopard the Enabler … NOT enabling you as the owner of the harware, but enabling the entertainment cartels to say what you can and can’t do on your hardware with movies, music that you buy. And so many hardware companies have also caved!

All so Apple can make a few bucks in the iTunes Store??

Read it and weep:

Apple brings HDCP to a new aluminum MacBook near you

High Definition Content Protection (HDCP)—you can’t live with it, but you practically can’t buy an HD-capable device anymore without it. While HDCP is typically used in devices like Blu-ray players, HDTVs, HDMI-enabled notebooks, and even the Apple TV in order to keep DRMed content encrypted between points A and B, it appears that Apple’s new aluminum MacBook (and presumably the MacBook Pro) are using it to protect iTunes Store media as well.

So what you say? AppleTV already had this, did you know that? Maybe you want to educate yourself a bit, eh? HDCP, DPCP, DisplayPort Content Protection.

Arstechnica continues a little later in the article AFTER explaining one way in which a teacher has already been frustrated by unreasonable unintended consequences of not being able to play a movie on a Mini DisplayPort-to-VGA adapter, plugged into a Sanyo projector that is part of his room’s Promethean system:

The technology in Apple’s MacBooks that prevents a seemingly arbitrary collection of iTunes Store files from being played on HDCP non-compliant devices is perhaps more accurately called DPCP, or DisplayPort Content Protection. As we’ve covered in the past, DisplayPort was designed as an open, extensible standard for computers that offers lower power consumption over DVI (especially in the Mini DisplayPort format that Apple uses on the new MacBooks). But more importantly, DisplayPort also beats DVI in the studios’ books by offering the option of 128-bit AES encrypted copy protection.

And folks at the Apple Support Forums are also complaining about this iTunes movie purchases will not play on external display – HDCP auth error:

Well, I’m surprised there hasn’t been more of a storm over this one already but I expect there will be.

Just got a new MacBook last week and finally found a mini Display Port -> VGA adapter so i could use my 19″ external display. I rented a movie from the iTunes store yesterday and when I tried to play it on my external display, it gave me a warning/error that the display was ‘not an authorized HDCP display’ and it would not play. Plays fine on the small MacBook screen, just nothing external. To make it even worse, i tried all the movies that I have purchased from the iTunes store with the same result… NONE of them will play on anything but the MacBook’s small 13″ screen. This is crazy unacceptable.

Has anyone else run into this yet or have any ideas of something I may be overlooking in order to get purchased movies to play on an external display?

Yep…and I am sure there are many more that will find things they can’t do with what they bought.

Gawd, I hate it when I am right. I knew Apple would sell out to the entertainment cartels like Microsoft did.

Companies that are adopting or plan to adopt DisplayPort Content Protection in their hardware.

And as Wikipedia notes DisplayPort is basically just another standard — more of the same but different — like HDMI, it’s direct competitor:

DisplayPort is a competitor to the HDMI connector (with HDCP copy-protection), the de facto digital connection for high-definition consumer electronics devices. Another competitor is Unified Display Interface,[2] a low cost compatible alternative to HDMI and DVI. However, the main supporter of UDI, Intel Corporation, has stopped the development of the technology and now supports DisplayPort.

Yeah, that should help the new TVs, electronics devices and computers work together, eh?

Well, it looks like we add another set hardware that are never gonna be part of this ladies’ electronics gizmos … unfortunately.

Thanks for nothing Apple.

Sad.

This is a conflict of Interest that’s very annoying!

Apple keeps putting in these gawd awful caveats in their SLAs for updates that are really ticking me off…like this one:

4. Consent to Use of Data. You agree that Apple and its subsidiaries may collect and use technical and related information, including but not limited to technical information about your computer, system and application software, and peripherals, that is gathered periodically to facilitate the provision of software updates, product support and other services to you (if any) related to the Apple Software. Apple may use this information, as long as it is in a form that does not personally identify you, to improve our products or to provide services or technologies to you.

And you can’t even get your update unless you agree to that stupid policy! This is not the first time I have noticed this ludicrous statement, but today it really ticked me off, because it was part of the Migration and DVD/CD Sharing update!?! How stupid is that?!

Next Mac OS X — 10.6 — at WWDC 2008? another big cat? end of PPC?

Well, it makes sense that 10.6 will be announced soon especially with Steve Jobs’ comments to the New York Times regarding major Mac OS X, but at WWDC 2008? Hard to say.

There is also the naming question brought up at Mac360 as well …some say the only big cat left is Lion. But even a cursory look at wikipedia’s big cat page would indicate that Lion isn’t the only one unless you go with strict ‘big cat’ names. A more expansive list also includes things like Cougar, Snow Leopard, Clouded Leopard and Cheetah (or Puma) (which Apple has been used already and broke the ice for the more expansive Big Cat naming for Mac OS X).

My guess would be Cougar. I would think that would be the most logical choice. Wait to use Lion till they move to an all Intel based Macs and maybe proved their dominance might be a better choice of timing to use “The King” Lion.

And if the RoughlyDrafted magazine/blog article was correct in 2007 about their thoughts on Unraveling the PPC Myth (linked in their Leopard and the History and Future of Mac OS X on PPC article noted above), then it’s not likely going to be with 10.6.

I tend to be leaning toward RoughlyDrafted being right on that score, at least after reading over the history of Apple again in those two articles.

Also, Ars Technica last year also didn’t give any real hope that ZFS would be in 10.5 — maybe have to wait for 10.6, but I don’t think so. Too soon. I think they will wait for the next one, 10.7? or whatever that will be called. Might as well wait to do ZFS when it goes to all Intel Macs makes more sense. Make the major change then.

So, I would say Cougar makes more sense at this time. No Lion King here yet…no MAJOR change to the underpinning….yet.

And really, if the truth be known about Cougars — the Cougars are nothing to sneeze at! And with this description: “This large, solitary cat has the greatest range of any wild terrestrial mammal in the Western Hemisphere,[3] extending from Yukon in Canada to the southern Andes of South America.”?? Doesn’t that sound like the desire of Apple with their next version of Mac OS X? To be the most broadly used Mac OS/computers?

Which also would indicate (to me) that they would not want to ditch PPC just yet either … like the RoughlyDrafted articles indicated.

I really think that Microsoft made that Mistake with Vista. And I really hope Apple will not make that same mistake. But who knows with the Entertainment Cartels whispering in their ears just like they did with Microsoft…

When the dust settles and if the Entertainment Cartels get their big Win (controlling when and where you can view content on every front from TV (HDTV, computers, etc.), and the Major OS makers have totally pissed off their real paying customers, we shall see what happens then. But I think we’ve already had about enough of that as evidenced by this ExtremeTech article entitled, “How the Hollywood Morons Can Beat the Pirates! (Thanks Adam for the link!!)

EDIT: Well, I guess I had a better opinion of Apple than I should have. Apparently, according to MacRumers, who was reporting on an article from Ars Technica, Apple has decided to turn PPC users away now after all. Oh, and it’s Snow Leopard, not Cougar. More like Nuclear Winter. Very unhappy Mac user here. What a crock!

Why Trusted Computing and Trusted Internet Won’t Work

Last week, I was reading a wonderful article by Bruce Schneier called, The Myth of the ‘Transparent Society’ (at Wired.com). His arguments are very compelling!

Here’s an example Bruce Schneier uses in the article,

An example will make this clearer. You’re stopped by a police officer, who demands to see identification. Divulging your identity will give the officer enormous power over you: He or she can search police databases using the information on your ID; he or she can create a police record attached to your name; he or she can put you on this or that secret terrorist watch list. Asking to see the officer’s ID in return gives you no comparable power over him or her. The power imbalance is too great, and mutual disclosure does not make it OK.

It is for these very same reasons that Trusted Computing and Trusted Internet will not work.

You have no power, they do. You can’t get their power so it will always be lopsided.

And it will always put varying levels of stress on those being monitored, and potentially cause emotional, physical, mental or spiritual damage to those who are under the microscope so to speak – depending upon the

I really think so many today really need to read 1984 by George Orwell. It’s not a pretty sight, but it’s riveting and revolting.

Even Microsoft’s Ballmer had to acknowledge that even on a personal level he has to deal with the stupidity of DRM (which they hope to enforce using Trusted Computing and Trusted Internet) with his own son in the article iPod users are music thieves says Ballmer – Silicon.com:

The Microsoft boss also claimed some domestic familiarity with the issue.

“My 12-year-old at home doesn’t want to hear that he can’t put all the music that he wants in all of the places that he would like it,” he joked.

This after saying,

Billing Microsoft as the good guys and Apple the villains of the piece – at least as far as corporate America, rather than users, is concerned, Ballmer said: “We’ve had DRM in Windows for years. The most common format of music on an iPod is ‘stolen’.”

“Part of the reason people steal music is money, but some of it is that the DRM stuff out there has not been that easy to use.

Unbelievable. And all this after they brought Cory Doctorow in years ago to talk about the futility of DRM.

Even seemingly reliable e-mail vulnerable

Even seemingly reliable e-mail vulnerable to [unethical] hackers

“The bad guys are trying billions of random combinations … and finding new ways to break in,” says Gartner tech security analyst John Pescatore.

Crooks use flaws uncovered by fuzzing to create tainted files disguised to fool targeted employees. Earlier this year, individuals at several corporations were targeted to receive e-mail carrying an attached Excel file corrupted via a previously unknown flaw. Clicking on the file opened a worksheet with data relevant to the targeted worker; it also gave the attacker a beachhead to probe deeper into the company’s network. “The victims never really knew,” says VeriSign iDefense researcher Matt Richard, who discovered the attack.

In another attack, crooks installed a tainted QuickTime video file at several porn websites crafted to steal data from eBay and PayPal accounts, according to security firm Intego.

“It’s not just Microsoft,” says Secunia Chief Technical Officer Thomas Kristensen. “Crooks now use many different ways to gain control of computers.”

This is nothing new to many of us, but the fact that USA Today has even posted this article shows how pervasive the problem really is. And how easily people within companies, corporate or home office/small/mid sized businesses are being affected, as well as home users.

Social Engineering is alive and well. And although Windows computers are mainly targeted, no operating system is entirely safe.

However, to limit the problem to simply saying that email is the problem would be a disservice to the public.

With thousands of ordinarily safe websites hacked by unethical hackers, people don’t even have to open a dangerous email to have their computers infected with malicious tools that steal passwords, install keyloggers or other malware in order to take over the computer or spew spam, or open backdoors to pretty much do whatever they want. All behind the scenes. Often going unnoticed unless the computer becomes inordinately slowed to the point that it interferes with what the legitimate user wants to do on their computer.

There is an old saying, curiosity killed the cat … for many today, curiosity killed security, thoroughly.

On the other hand, it is also wisely reported at ImformIT in the article entitled, “Crime, War, and B.S. in the Electronic Universe“,

Unlike Chicken Little (and plenty of people in the media), Michael Kemp doesn’t believe that the sky is falling and our electronic connections will soon evaporate under attack by terrorists, criminals, and [unethical] hackers. But he does warn of a more insidious threat: By pandering to these fears, industry professionals may drive themselves right out of business.

And later in the article,

The U.S. Patriot Act has become a stick with which to beat security researchers and invade personal privacy alike. Also in the U.S., the Digital Millennium Copyright Act (DMCA) has been employed to criminalize even legitimate reverse-engineering (thanks to supposed copyright infringement), making a criminal out of Dmitry Sklyarov, and impeding research by cryptographers and security consultants alike. And what has the security industry done about these legal trends? Thus far, not a lot.

There are always AT LEAST two sides to a coin depending on which ‘dimension’ you refer to.

Overall, I think our best intelligence would dictate that we can not be naively clicking on anything that piques our fancy, or be too busy to think through before clicking or opening a file from email or on a website, or make sure that a file in an email truly is from the person we think it’s from, or assume that person has a virus-free computer, and making sure we virus check files with the latest virus definitions before opening them. Period.

We can’t assume, rightly or wrongly, that everything on a website is benign just because the organization is a good one. We have seen in the news that we can’t blindly trust every security site, bank site, sports site, news site, kid’s site, good cause site, etc.

Sometimes we seem to get caught by malware, when we were only doing what seemed reasonable — trusting a known good site.

We need a heads up on what search results appear to be safe and which ones do not appear safe or have some problems like good and bad downloads, or popups, or massive emails sent after visiting a particular site.

There are some really good security tools out there for many of the problems that we might come up against. They may not all be free, but they are available.

Fear is never a good thing. F.U.D. (Fear, Uncertainty, Doubt) is a big enemy to thinking individuals, communities and governments.

Stop The Spying!

Stop the Spying!

14 year old hacks train – Security by Obscurity Fails

14 year old hacks train – Security by Obscurity Fails .. yet again!

If you haven’t seen this story yet then you’ll be in for a surprise. A 14 year old boy in Poland hacked into the train control system and was able to take control of the train junctions. Several trains derailed causing numerous injuries, but luckily nothing worse.

Based on the information in the articles, the boy’s “hack” was simply building a device that could send the correct signals to the train track control system. The device was created from a TV remote control and communicated with the train controls over infra-red.

Security by obscurity never works long term. The sooner people realize it, the safer we all will be. No matter whether it’s utilities, hardware, operating systems and programs. And as we see in this story…people can get hurt when it fails.

So, when will “they” start hiring people with real knowledge that can think out of the box?!

Yeah, I know. That was a rhetorical question. Forget I mentioned it.

Tag Cloud

Follow

Get every new post delivered to your Inbox.

Join 304 other followers

%d bloggers like this: