Samsung Shipping Spyware?

Some dude came out and accused Samsung of shipping laptops with spyware installed. He used a program that detected Starlogger installed on his laptop. So he deduced that the culprit must be the manufacturer. This guy founded a consulting company. Maybe this is him doing a good dead by spreading the info. Or maybe he is looking for some free publicity.

Samsung has since come out and refuted the guy's claims. He says they do not install any such spyware. In fact, they determined that the dude was using a program that thinks it detects Starlogger, but is in error. Well this made for a sensational headline anyway.

Starlogger is a $23 piece of shareware that will secretly record all the keystrokes on a computer. It is supposed to be "undetectable". Starlogger can then email you data it collects. By the way, it can also take screen shots at given intervals to see what the user is doing.

Coin Dozer Hack

I finally finished coding my roguelike game JSRL. Now let's get back to hacking. I have been addicted to this iPhone game called Coin Dozer. It looks like a real arcade game where you put coins in and try to make coins fall out in front.

You start out with 40 coins. There are many ways to get new coins. You slowly gain them as time goes on. You can install other apps on your phone to get some coins. Some of those apps cost money. You can also pay real cash for coins.

My goal is to not have to pay for apps or coins. So how do you do this? There are many techniques to do well in the game. But there is one hack that is very handy. You can always exit the game, and restart it. When you do this, the gold coins get restored back to the original position. This can help you out a lot.

I found the optimal game play is to do two sets of three coins each. That ensures a bunch of coins get pushed out the end for you. Then exit and restart the game. Repeat. This can keep me playing indefinitely with a lot of coins. Yeah it is just a game. But I play this game all the time. This little "feature" is keeping me stocked full of a lot of coins. Good luck in your coin dozing.

Out of Commission

I have been a bit busy lately. My college cancelled a class I wanted to take in JavaScript. I decided to take matters into my own hands and learn the programming language myself. I bought the college textbook on Amazon and started to learn. I find the best way to learn is to actually code in the language. I do all the exercises at the end of each chapter.

So far I have gone through about 10 chapters. At first I did not like JavaScript much. But I am learning to appreciate some things. JavaScript is an interpreted language. When there is an error, the browser knows exactly which line has the error. But let's get back to the beginning. What the heck is JavaScript?

JavaScript is a language invented by the now defunct Netscape. It is a scripting style language that runs in the web browser. The goal of the language was to add the ability to do dynamic operations on web pages. Note that JavaScript is unrelated to Java, which is a general purpose programming language. JavaScript is now starting to be used on servers as well. But that is a story for another post.

Next week I plan to enter a game writing contest to generate a game like Angband. And I am going to code the darn thing in JavaScript if at all possible. I did the same exercise in the past when I was learning the Java programming language. After I get JavaScript out of my system, expect more posts on hacking material.

AVG Antivirus 2011

There is a phony version of AVG Antivirus 2011 going around. It tries to trick users into paying a license fee to avoid the annoying popups it produces. The real hack is that it also adds some registry entries that make most major browsers run the fake program instead.

If you want to get around this, rename your browser executable file names. Get rid of "avg.exe: that is located in C:\Program Files\AVG Antivirus 2011. You should also delete C:\Windows\system32\iesafemode.exe. A good antivirus such a Spyware Doctor can help rid you of this nuisance.

How does the program hijack the other browsers? It adds some registry keys in HKEY LOCAL MACHINE. Specifially there is an ImageFileExecution Options location in the registry that allows you to redirect iexplore.exe, chrome.exe, firefox.exe, and any other executable name. The fake AVG Antivirus 2011 intercepts these and all other popular web browsers. What an effort.

Use for Old Computers

I just read an article on the many uses of old computers. The best ideas seemed to be ways to allow your computer to be used by others over the net. One obvious use is to let the old computer serve up torrent files. Even a lanky old Pentium came server this purpose.

Another noble use for your old PC is to have is join the TOR network. This essentially allows users to hide their location and identity. It makes it harder for somebody to track their internet traffic. The goal of this system is to provide personal freedom. The software is open source. It is good for IRC, Instant Messaging, and web browsing.

Finally you can install the BOINC client on your computer. It lets you choose worthy projects for your computer to work on during idle processing. For example, you can help the search for extra terrestials by choosing the SETI project. If your old computer has a graphics processing unit (GPU), it will help the effort even more. Now there is no need to junk that old PC. Put it to good use.

Two Tales of a Hacking

Markus Frind, founder of dating web site Plenty of Fish, says his site got hacked last week. The hacker got away with user email addresses, user names, and passwords. Plenty of Fish has since reset the passwords.

Frind accuses Chris Russo as the hacker. He said it took Russo 2 days to break into their system. Then Frind states that Russo called Frind's home to extort him. He says that Russo is a 23 year old from Argentina. Frind says Russo wanted access to all the source code from Plenty of Fish, as well as unspecified money for "security services".

Chris Russo, on the other hand, says he only reported a bug. He discovered a vulnerability that affected all 28 million Plenty of Fish user accounts. The vulnerability was fixed. Russo goes on to say that Plenty of Fish wanted to hire him as a security professional.

The specifics of the vuln were based on a Microsoft SQL Server injection hole. It allowed a hacker to make a full backup of the database. You combine that with the fact that Plenty of Fish stores user passwords in plain text, and you get disaster. So who are we going to believe here? I bet like most cases, both sides are telling some truth, and are also adding some lies. It really seems like a mess.

Anonymous was not Really Anonymous

I saw an interesting article on Arstechnica about the FBI raiding people in the Anonymous group. However the real gem was all the reader comments on the post.

Here is what went down. In the USA, the FBI raided the houses of a number of members in the group called Anonymous. They must have been a part of a recent DDOS attack, and used their own computers in their houses. In other words, they got tracked down.

Anonymous says they launched the DDOS as a method of protest. They used the low orbit ion cannon app to blast some web sites. Well if you are going to protest, you got to be ready for the cops to round you up and cuff you.

People are calling the Anonymous DDOS team a bunch of script kiddies. Whatever they are, it looks like the FBI literally was busting down their doors. Couldn't these so called hackers have used some unsecure WiFi that belonged to someone else?

Nope. It looked like they downloaded "loic.exe" onto their own computers and ran it. The thing that is strange is that the FBI usually does not kick down doors when following up on white collar crime like DDOS attacks. Perhaps the Anonymous crew was exaggerating a bit.