Interesting Snippets from 2012-05-31

• extern blog SensePost;

  Widespread use of smart phones by employees to perform work related activities has introduced the idea of using these devices as an authentication token. As an example of such attempts, RSA SecureID software tokens are available for iPhone, Nokia and the Windows platforms. Obviously, mobile phones would not be able to provide the level of tamper-resistance that hardware tokens would, but I was interested to know how easy/hard it could be for a potential attacker to clone RSA SecureID software tokens. I used the Windows version of the RSA SecurID Software Token for Microsoft Windows version 4.10 for my analysis and discovered the following issues:

[/snippets] permanent link

Interesting Snippets from 2012-05-29

• Can an Algorithm Write a Better News Story Than a Human Reporter? | Gadget Lab | Wired.com

  Narrative Science’s writing engine requires several steps. First, it must amass high-quality data. That’s why finance and sports are such natural subjects: Both involve the fluctuations of numbers—earnings per share, stock swings, ERAs, RBI. And stats geeks are always creating new data that can enrich a story. Baseball fans, for instance, have created models that calculate the odds of a team’s victory in every situation as the game progresses. So if something happens during one at-bat that suddenly changes the odds of victory from say, 40 percent to 60 percent, the algorithm can be programmed to highlight that pivotal play as the most dramatic moment of the game thus far. Then the algorithms must fit that data into some broader understanding of the subject matter. (For instance, they must know that the team with the highest number of “runs” is declared the winner of a baseball game.) So Narrative Science’s engineers program a set of rules that govern each subject, be it corporate earnings or a sporting event. But how to turn that analysis into prose? The company has hired a team of “meta-writers,” trained journalists who have built a set of templates. They work with the engineers to coach the computers to identify various “angles” from the data. Who won the game? Was it a come-from-behind victory or a blowout? Did one player have a fantastic day at the plate? The algorithm considers context and information from other databases as well: Did a losing streak end?

• Super Malware Targets Middle East Computers - WSJ.com

  Computer malware described as "the most sophisticated cyberweapon yet unleashed" has been uncovered in computers in the Middle East and may have infected machines in Europe, according to reports from antivirus researchers and software makers in Russia, Hungary and Ireland.

  The malware, dubbed Worm.Win32.Flame, is unusual in its complexity, size and the multitude of ways it has of harvesting information from an infected computer including keyboard, screen, microphone, storage devices, network, Wi-Fi, Bluetooth, USB and system processes.

• ivarch.com: Pipe Viewer

  pv - Pipe Viewer - is a terminal-based tool for monitoring the progress of data through a pipeline. It can be inserted into any normal pipeline between two processes to give a visual indication of how quickly data is passing through, how long it has taken, how near to completion it is, and an estimate of how long it will be until completion.

• Intel releases x86 system image for Android emulator | Android Central

  Intel has released the long awaited x86 system image of Ice Cream Sandwich for the Android SDK and emulator. This will allow the Android emulator (long plagued with slow and buggy performance) to run at native speed on computers using the Intel x86 architecture.

• Ask Stack: How to develop deep programming knowledge? | Ars Technica

  "If you want to learn something, read about it; if you want to understand something, write about it; if you want to master something, program it."

  Programming is like the ultimate teaching challenge. Teaching a computer to do something requires that you know your stuff really well. By teaching/programming, you will learn to become a master.

[/snippets] permanent link

Interesting Snippets from 2012-05-28

• The Intelligent Investor: Could Computers Protect the Market From Computers? - WSJ.com

  Ten or 15 years ago, most U.S. stocks changed hands on either the New York Stock Exchange or the Nasdaq market. Today, stocks fly across dozens of different exchanges and alternative trading facilities. A trade can be executed in less than 200 millionths of a second—about 1,500 times faster than you can blink your eye. During Facebook's first day of trading, more than 570 million shares turned over—or 10% more than the average daily volume of all NYSE stocks combined in 1997.

[/snippets] permanent link

Interesting Snippets from 2012-05-24

• Medical devices: A ticking time-bomb | The Economist

  It is impossible to say how many could be blamed on unsynchronised devices. The reason is that the information is hard to pin down. If the data in the EMR do not match the doctor's recollection, it is impossible to say which erred, man or machine. Not everyone will photograph the wayward clock, as Mr Goldman did with the clotting machine's.

[/snippets] permanent link

Interesting Snippets from 2012-05-23

• Chromium Blog: A Tale of Two Pwnies (Part 1)

  Just over two months ago, Chrome sponsored the Pwnium browser hacking competition. We had two fantastic submissions, and successfully blocked both exploits within 24 hours of their unveiling. Today, we’d like to offer an inside look into the exploit submitted by Pinkie Pie.

  So, how does one get full remote code execution in Chrome? In the case of Pinkie Pie’s exploit, it took a chain of six different bugs in order to successfully break out of the Chrome sandbox.

• xing/wysihtml5 · GitHub

  wysihtml5 is an open source rich text editor based on HTML5 technology and the progressive-enhancement approach. It uses a sophisticated security concept and aims to generate fully valid HTML5 markup by preventing unmaintainable tag soups and inline styles. The code is completely library agnostic: No jQuery, Prototype or similar is required.

• You Call That Innovation? - WSJ.com

  Got innovation? Just about every company says it does.

  Businesses throw around the term to show they're on the cutting edge of everything from technology and medicine to snacks and cosmetics. Companies are touting chief innovation officers, innovation teams, innovation strategies and even innovation days.

  But that doesn't mean the companies are actually doing any innovating. Instead they are using the word to convey monumental change when the progress they're describing is quite ordinary.

[/snippets] permanent link