Having just criticised Apple for one thing, I’m going to add some praise for another. OS X 10.4.7 is a huge improvement for people like me whose home directories are mounted over AFP. I no longer get an enormous delay when I log in before I can do anything, which is great, and it seems (touch wood) to be more robust than it was before.
(Of course, just after I decided to write that, mdimportserver crashed…)
Some time ago now, in fact in November of 2003, I reported to Apple that it was possible to make the authentication dialog lie about which program was asking for authorisation to do something. This is filed as rdar://3486235, for any Apple employees watching.
Here’s an amusing demonstration:
(the program that did this was definitely not called “Steve Jobs”)
Very funny, but quite scary because it means it’s much too easy to trick an end-user into giving a potentially malicious program root privileges. Apple have been widely—and, to my mind, rather unfairly—lambasted for their attitude towards security holes, but in this case I’m sorry to report that the critics are quite correct. I’m sure they’ll fix this now I’ve published it on the Internet, but I really shouldn’t have had to do this; it should have been fixed back in 2003 when it was first reported.
The problem is that the dialog that appears gets the name of the calling program from argv[0], which as everyone knows is under the control of the calling program’s parent process. So, for instance, if you write something like this:
#include <unistd.h>
int main (void)
{
execl ("/usr/libexec/authopen",
"/Applications/Utilities/Disk Utility.app",
"-stdoutpipe",
"/dev/rdisk0",
NULL);
return 0;
}
which asks the special authopen program to give the calling process a file handle for /dev/rdisk0, what you’ll find is that it displays a dialog box like this
and in case you think that opening up the detail area will save you from getting caught out by a potentially malicious use of this bug, take a look at this:
Now, that definitely wasn’t Disk Utility asking for authorisation. It was the program whose source code is shown above. And if you authenticate, that program gets a file handle for /dev/rdisk0, which is clearly a huge security problem as it effectively gives it access to all of your data. Equally, it could use its own helper tool (rather than authopen) and simply ask for root privileges for whatever malicious purpose it had in mind. But this demonstrates the problem quite ably.
Ordinarily I don’t approve of people publishing security holes, because it puts end-users at risk, but this one makes it too easy to trick a user into giving away privileged access to his or her machine, and Apple still haven’t fixed it, over two years after it was reported. It’s also a sufficiently common issue that the comp.unix.programmer frequently asked questions document actually mentions that “it is possible to invoke programs with arbitrary values of argv[0]”, so the fact that you can set argv[0] to whatever you like is hardly an unknown feature, nor is it likely that the black hats don’t already know about this.
It was quite interesting reading Jonathan Rentzsch’s post about I/O errors and the impact that they might have on ordinary users.
As my company makes disk utility software, we see quite a lot of these kinds of errors, which users often report to us as “bugs”, telling us that they’ve checked the disk with DiskWarrior and it’s fine. Of course, DiskWarrior doesn’t actually check for bad blocks, which is where their mistake lies, so we end up having to explain that the problem is that our product stopped because it found something it couldn’t read, and that this was caused by a problem with their hard disk.
Unfortunately for us—though perhaps fortunately for most users—because of the way that modern disks “fix” them if you overwrite the bad area, together with the very large amounts of data held on disks that are infrequently accessed, the actual frequency is somewhat hidden and tends only to show up if you write applications like backup programs or defragmentation tools, both of which need to read a large proportion of the files on the disk.
Anyway, Jonathan, in his post, takes the hacker’s approach of trying to copy as much of the file as possible and for the bits that can’t be copied, ignore the errors and pretend the data was zero. This is fine for people like Jonathan, or like me, who understand about disks and computer programs and know the kinds of problems this might create. However, very few people in the general user population should really be trying to use tricks like overwriting blocks with zeroes or copying the file with options set to ignore the I/O error, since the consequences of those actions are not always wholly predictable.
To give an example, imagine that the document that has developed a bad block contains important financial information, and let’s also suppose that replacing the bad region with zeroes “fixes” it to the extent that the current version of whatever program wrote it is able to read it. Unfortunately, however, that does not mean that future versions will be able to read it, even if you use the “Save As…” option to save an entirely new copy of the data. So in five years’ time, when the IRS or (if, like me, you’re in the U.K.) HMRC inquire about the information contained therein, you might not be able to read it!
And in case you don’t think that problem is real, I’ve seen similar problems in the past that were caused by bugs in earlier versions that sometimes resulted in subtly corrupted documents, which crashed later versions of the same program when you try to load them.
Keep adequate backups.
That way, when this happens (and it is, I am afraid, a question of when rather than if), you can simply restore the affected file from a recent backup.
If you don’t have a back-up of the file, leave this kind of futzing with files to expert users. If you don’t know any expert users, then either:
Such programs are only marginally useful, and at worst are just snake-oil, particularly if they claim to be able to use statistics about individual bits to recover their original values (that just won’t work with modern disks because of the fact that they use PRML and a Viterbi decoder; it might have worked, once upon a time, with MFM or GCR disks, and maybe even to an extent with non-PRML RLL disks, but the theory doesn’t work for disks using PRML).
Backups are a much better way to keep your data safe.
According to both the BBC and Wired News, Blue Security have shut down their anti-spam operation.
This is appalling because it amounts to an admission that the spammers attacking them are out of control and that unless law-enforcement action is taken they would be able to shut down the Internet completely.
Frankly, I for one would tolerate a few days of ‘Net downtime if it meant that the people responsible for sending spam went to jail. I don’t want tens of e-mails a day offering herbal Viagra or “teens with animals” or whatever other perverted trash they seem to want to send. Nor do I want endless attempts to fool me into giving away my bank details, my PayPal account details, or any of the other scams or cons that these guys send all of us. I just want to use the ‘Net in peace.
Today I got a letter from the Mathematical Association of America inviting me to join. Only it was addressed to “Professor Alastair Houghton”!
Well my professorship is news to me :-)
It does make you wonder though, quite how the MAA got my details. I'm betting that they were given them by the ACM, who have also (I think) given my name and address to the IEEE. I don't mind, because these are all the kinds of organisations I might actually want to join, rather than the more mundane junk mail asking would I like a credit card, or a loan, or perhaps a nice new Audi…
I'd love to know why they thought I was a professor though. Still, it gave me a laugh when I saw it, and I'm sure my family probably already refer to me as a “mad professor” type behind my back, so it'll come as no surprise to them.
You may have noticed that I’ve reverted all of my site’s templates to the MovableType defaults. This is because the templates I had before were getting old and it was tricky upgrading them to work properly with recent MovableType versions.
Of course, this means I have some more web design work to do. Oh well…
I’ve just removed all of the trackback pings that had previously been sent to my site. Most of them were junk, but a few were useful, however there were something like 12,000 junk pings in the database that I didn’t have time to deal with.
Now that there’s some level of spam filtering for them, I’m going to re-enable trackbacks on my blog, but spammers take heed: there are terms and conditions here; if you blindly post trackback pings to this site, you could end up owing me thousands of dollars, and if the amount gets high enough, I’m going to be quite tempted to try my luck in court (particularly if I get sufficient backing from the blogging community).
vs
It seems that Apple Corps, the Beatles’ record label, has failed in its wholly unjustifiable attempt to extract money from Apple Computer over the iTunes music store.
It’s a shame that the people managing Apple Corps have drifted so far from the original principals under which their firm was established; here’s a quote from Paul McCartney:
“It's just trying to mix business with enjoyment. We're in the happy position of not needing any more money. So for the first time, the bosses aren't in it for profit. We've already bought all our dreams. We want to share that possibility with others.”
I for one would love to hear an explanation of how suing Apple Computer in an attempt to derive an income from the latter’s innovative music download service fits with not being in it for profit or not needing any more money. Apple Computer certainly doesn’t need to derive any publicity based on the Apple Corps label—if anything, confusion is much more likely to arise in the other direction, so the only possible motive is rent-seeking.
What’s more, the entire dispute was about their use of the Apple logo. I’ve put both logos in this post; do you think anyone would ever mistake one for the other?
Update: Apple Corps say they will be appealing the decision.
Apparently, “The secure stuff uses https port 81.” Well that’s news to me, as well as most of the rest of the Internet, I think. Try port 443, Bob.
Now, what was it I was saying about journalists and facts… :-)
Blog entries, it seems to me, are like busses. You wait ages until you have something interesting you want to say to the world, then two come along all at once.
Well there’s been something of a storm (see here, here and here for starters) about an Israeli company called Blue Security. Their idea is very simple; the reason spam is easy to do is that most people don’t respond to it. Everyone knows that sending opt-out requests to spammers just confirms your e-mail address and means they can sell it on for more money.
Well, Blue Security came up with the idea of running a service to do the tedious job of posting complaints on your behalf. You send them your spam and they contact the owners of the websites advertised in it, as well as their ISPs and any law-enforcement agencies that may be relevant to complain and ask that all members of their “Do Not Intrude Registry” (the “Blue Community”). So far, so good.
The sting in the tail is this; every member of the Blue Community runs a program called “Blue Frog”. If a spammer refuses to comply with Blue Security’s requests for their members to be removed and continues to send spam to Blue Community members, Blue Security’s technical department write a script for the Blue Frog that causes it to go to the spamvertised website and fill-in forms with complaints demanding removal. For every spam sent, one complaint is generated, but because this happens all at the same time, the volume of complaints received can be tremendous.
Some people complain that this is basically a Distributed Denial of Service attack on the spammer, and that all attacks should be banned. But the reality is that the typical spammer is woefully under-provisioned by comparison to the number of spams they send out. If all of the people who receive a typical spam decided to respond in any way, most spammers would be swamped. It isn’t Blue Security that’s responsible for the spammer’s under-provisioning, it’s the spammer, and it’s what makes spam profitable. If you had to have a huge data centre all of your own in order to handle the traffic from a single spam, nobody would bother.
Moreover, because the people who work at Blue Security are technically literate, their solution doesn’t require the general public to understand how to track down the actual spammer and avoid pounding innocent people with e-mails about spam they never sent. Spammers often forge details and have even been known to mount attacks on others by sending spam purporting to come from them, so it’s very important that you take care to complain to the right people.
The point is this: all Blue Security are doing is making it easy to complain effectively and with a significantly reduced risk of “collateral damage”. Spammers are warned that they will receive bulk complaints if they don’t comply with the initial request, but the level of bulk that they receive is far smaller than the level that they send. There’s nothing unfair or immoral about it.
As for the fact that Six Apart were knocked over, well, that’s very unfortunate. We all like Six Apart and a lot of people use their services to run their blogs, so Blue Security have attracted a lot of flak from bloggers for moving their site over to LiveJournal. But look at it this way; Blue Security knew they were being targetted, but only in the same way that an Iraqi policeman knows that he is a target for terrorists. Do you blame the policeman if they blow-up a shop he frequents, killing innocent people? Do you say that policemen should only shop in special shops, away from everyone else, just in case? No, you blame the terrorist and rightly so. That’s what happened in this case, and we should blame the spammer; it was his fault and he almost certainly knew full well that he was attacking Six Apart.