RealDVD

I read a post on the Technologizer blog. It was entitled “A Real Review of RealDVD” by Harry McCracken. Real Networks has released a new application which copies DVD contents to your computer hard drive. There are already other programs out there that do this. However the competitors actually decrypt the DVD, which might be an illegal activity. The RealDVD product from Real Networks takes another approach.

RealDVD is a DVD copying program. It is, in fact, a DVD ripper. However it does not violate the DCMA rules. It achieves this by not removing the copy protection. In fact, RealDVD adds extra copy protection to the output it stores on your hard disk. In essence, you cannot share copies of the rip with anybody else.

This program costs $30. McCracken says that it is easy to use. The ripping does not degrade the quality of the DVD. The amount of DVDs you can rip is only limited by the amount of disk space you have. You can also rip a DVD to a USB drive. The ripped movie is bound to the device you rip the DVD to. So you cannot just make a copy somewhere else and hope that it will work. This is the key benefit of RealDVD.

Personally I watch all my DVDs on a DVD player. So I don’t have the need to store a copy on my computer. I am also not worried about backing up the DVD. If something happens to my DVD copy, I will just buy another one. The interesting part of the RealDVD program is that Real Networks found a way to copy the DVD, encryption and all. You can then play the DVD back, but it is somehow tied to where you ripped the DVD to. I wonder how many takers Real Networks will get for this product. It is not excessively expensive. I just don’t know whether they can stand out in a crowded market or not.

Comcast Limits Confirmed

Previously I had read an article about Comcast possibly limiting the monthly download bandwidth for customers. It seems this article was right. I am a Comcast high speed Internet customer. Yesterday I got an e-mail from Comcast. They are going to be modifying their acceptable use policy (AUP). Starting in October, monthly bandwidth usage over 250GB will be considered excessive.

The e-mail had all kinds of justifications as to why this was a fair policy. Their spin was that this would protect customers from negative impact. Comcast stated that users with ultra high bandwidth consumption caused performance problems for other users. Then Comcast went on to quantify how this limit would not hurt the average user.

Less than 1% of their customers use over 250GB of bandwidth. Normal consumption is between 2 and 3 GB per month. Therefore the new limit is 100 times the average usage. The 250GB limit is equivalent to 50 million e-mails, over 62 thousand songs, or 125 high definition movies. Comcast was also careful to point out that online gamers do not come close to consuming 250GB of bandwidth either.

Hey. I am all about protecting my ability to have good Internet performance. However it seems like Comcast is trying to move to a pay per usage model at the high end, while still charging users at the low end the same normal rates. That does not sound right. I would be unhappy if I was one of those high bandwidth consumers. Luckily I am not. However I would still prefer Comcast to truly go to a per usage model and save me some money. Of course they are not going to do this, as it would eat into their profits. This still seems like a sleight of hand.

Sarah Palin Hacked

Have you heard the news about Vice Presidential candidate Sarah Palin getting her yahoo mail account hacked? I read a blog entry by Michelle Malkin entitled “The Story Behind the Palin E-mail Hacking” to get the details. It put some of the details in perspective.

The main clarification was that the perpetrator who did the hacking was not part of some elite hacker group. There is a site called 4chan that has a lot of discussion boards. People post on this site as Anonymous normally. You don’t need to sign in with your credentials. One person hacked Palin’s Yahoo account early Tuesday morning. The account and password were then shared on one of the 4chan discussion boards. The plan was for other readers to go crazy and use the e-mail.

In the end, this discussion board thread was deleted by the moderators. Some users had taken screen shots of what they saw on 4chan. It was these screen shots that were shared with the mass media. Later a poster that goes by the handle rubico claimed to be the original person who hacked the account and shared the password on the 4chan board. Rubico’s e-mail address is rubico10@yahoo.com.

Here is a synopsis of what rubico said he did. He used Wikipedia to find information about Palin. He then used Yahoo’s password recovery features to trick Yahoo into providing him with Palin’s password. Rubico then proceeded to read each of Palin’s e-mails. However he did not find any incriminating evidence. There were just personal things like family pictures in there. He decided to post the password to 4chan as a prank. He was unhappy that somebody who disagreed with he work went in and changed the password of Palin account.

There were a number of interesting issues surrounding Palin’s account being compromised. One is that Palin uses a free e-mail service like Yahoo. The other is that it is easy to take advantage of the Yahoo password recovery system. Finally, there was a lot of misinformation about the story in the mass media. That is typical I guess.

Comcast Limits

Some time ago, I read an article that stated Comcast would cap downloads at 250 Gigabytes a month. You would get a call from Comcast if you exceeded that amount. They are planning to add an extra fee if you go over this amount. The fee will be something like an extra $10 for every 10G you go over 250G per month.

Comcast’s spin on this new charge is that it will help ensure that everybody gets good performance. That is typical management speak. It means that they can give everyone good performance, but somebody other than Comcast has to pay. It almost seems like we are going back to a per-use charge. However they are leaving out the part where you get to pay less if you use less bandwidth. Companies are tricky like that to maximize their profit.

To tell you the truth, I have no clue how many Gigabytes I download on a monthly basis. Comcast says the medium amount for their users is less than 3G per month. I have not received any calls from Comcast recently. Maybe that means all is well. However I would still like to pay a lesser monthly charge if I only download 1G a month, and somebody else downloads 200G in the same time frame. You either charge us a flat fee, or you give me a discount. You can’t have it both ways.

I know I do watch videos on the Internet all the time. However these are usually short videos from YouTube. Someone calculated that 250G a month download is equivalent to downloading 4 high definition movies a day. Yeah I fall way under that limit. Comcast better give me a better Internet plan if they are going to charge the heavy users some more money.

This is post is not directed solely to Comcast. Other cable companies like Cox and Time Warner cap the monthly download at lesser rates. They too should either charge all users a flat fee, or give rebates to those of us who do not use up a lot of bandwidth. What do I have to do to be given a fair deal in broadband access? Call the FCC?

SSH Passwords

I read the abstract for an Association of Computing Machinery (ACM) paper entitled “Timing Analysis of Keystroke and Timing Attacks on SSH”. The paper was written by Dawn Xiaodong Song and others. Unfortunately you have to be a member of ACM to read the body of the paper. I am looking into getting my company to pay for my membership. However I thought it would be fun to go over the abstract and think about what these researchers did to break SSH.

The key finding of this paper is that you can determine the approximate size of the original data sent over SSH. This is furthered by the fact that SSH sends every keystroke immediately to the server. Thus you can find out thing like how fast somebody is typing. You can also employ some statistics to figure out how long a person’s password is. The authors are not claiming they can decode the password. But given the length, they can severely cut down the number of guesses a brute force attack needs to do.

In case you do not already know, SSH stands for secure shell. It provides a mechanism to exchange data over a secure channel. SSH is used to remotely log into UNIX accounts. It replaces older telnet technology, which passed passwords as plain text over the network. SSH instead uses public key cryptography. Initially, SSH was vulnerable to man in the middle attacks. That alone is worth a separate discussion. However SSH was updated a long time ago to plug this gap. SSH uses both encryption and compression. So you would think that you could not easily determine the exact length of your password. However you can probably determine a good guess using a little statistics like the abstract says.

I will share some more information if I get a subscription to the ACM. Until then I will be trying to think how the researchers took apart SSH.

Chrome First Impressions

I had some trouble accessing the CarMax web site this weekend. I thought maybe there was something wrong with my Internet Explorer browser. This was the perfect opportunity to install and try out the Google Chrome browser. During install, Chrome displayed an options screen. However the screen just froze. Nothing seemed to be happened. All I could do was move the screen. Underneath the window, I found another window that said the Chrome install was complete. That was very strange. This cannot be the correct behavior.

Nevertheless, it looked like Chrome installed on my computer. I chose to import my Internet Explorer bookmarks. Unfortunately Chrome reordered my bookmarks in alphabetical order. I did not like this. So I tried to manually reorder the bookmarks. Chrome did not want to let me do that. I guess I had to live with the order that Chrome chose.

The good news is that Gmail feels a little faster in the Chrome browser. Netflix also feels a little faster. But I have lost the ability to drag and drop movies in my Netflix queue. This must be some web features that Chrome does not support yet. Playing videos seemed to work at about the same speed in Chrome as in Internet Explorer.

I understand that Chrome runs different tabs in different Windows processes to assist with crash protection. That sounds like a good idea on the surface. But I went to one web site on a single tab. I spied on Chrome user Windows task manager. I found three separate Chrome executables running. That did not feel right. I also found that a GoogleUpdate process running even when I have not launched the Chrome browser.

The main goal I had with Chrome was to see if it could help me view the CarMax web site. It was not the cure for this problem. That web site must have been physically down this weekend. So Chrome did not work much better than Internet Explorer for me at all. In fact, I was annoyed with some of the Chrome executables running at what seemed strange times and multiple instances. I don’t want my computer being slowed down by secret Chrome processes. Therefore I uninstalled Chrome for now. It is still in Beta mode. Maybe I will try it again later.

Master Boot Record

I read an interesting article entitled “Writing Boot Sector Code” by Susam Pal. He has a whole set of articles that describe what happens when a computer boots up. The article I read concentrated on how to write boot sector software which automatically gets executed when a PC boots up. This can allow you to take over a computer from the start.

Susam said that PCs start executing code at location 0xFFFF0 at start up. This is a memory location in the BIOS ROM. The boot sector is the first sector of data storage. The first byte of this sector is actually executable code. Deeper into the sector is information on the disk itself, such as the partition information. Susam recommended you first verify your code before putting it into the boot sector. You can do this safely by running an emulator such as DOSEMU or DOSBox.

I found this topic so interesting that I did some more research on the boot sector and how a PC starts up. I consulted sources such as Wikipedia, About.com, Microsoft, PC Guide, and Ars Technica. Here I will share some of my findings. This is a ripe topic for much further research. The great thing is that you only need a PC to start tinkering with it.

The boot sector is for booting programs. Usually you will boot an operating system. The BIOS first selects a device (such as a hard disk) for booting. It then copies the first sector on the disk to memory location 0x7C00. Viruses sometimes replace this code with malware for evil purposes.

All disks are divided into sectors. The very first one is the boot sector. The first section contains the Master Boot Record (MBR). The MBR has information about the partitions on the disk. The MBR has code which loads file “io.sys” for MS DOS. Windows XP has a built in recovery console. One utility in the recovery console is Fixboot, which can correct partition problems on the boot sector.

Know that we are talking about machines with the 80x86 architecture here. PCs first conduct a power on self test (POST). Then they figure out which device to boot from. Sector one is loaded from disk to memory. The PC then begins executing instructions at that location. Normally the first 3 bytes of the boot sector do a jump to another memory location. That is because the next 8 bytes are data and not code in the boot sector.

The Master Boot Record used to be a target of malicious code in the old days. Antivirus software now detects and prevents this. Windows Vista has built-in safeguards to prevent malware from messing with the MBR. However some companies that track viruses say that MBR attacks are on the rise.