Cuil Not Kewl

Today I caught up on my reading. Normally I read Hacker News and Reddit programming lists each day. But I went on vacation and got a couple days behind. There seemed to be a lot of articles about "cuil". Now I had not heard of this term before. Luckily I found a web page which explained it to me. Cuil is a search engine that is attempting to compete with Google. So I did a Google search on it. Here is what I have gathered.

Cuil claims to be a more comprehensive search than Google. It has 120 billion web pages in its index. The word cuil is supposed to sound like kewl. Cuil is an old Irish word meaning knowledge or wisdom. It does not collect information on its users like Google does. The site was unleashed on Monday, when the servers powering it crashed under a heavy load.

The company behind Cuil was formed in 2006 by ex-Google employees. Currently it has 30 employees. It has raised around $33 million so far from investors. The company claims that it searches three times as many pages as Google, but does it with less servers.

I do not know the extent of Cuil's capabilities. The search engine had exactly one chance to make a first impression on me. So I search for black of hat. Cuil could not find my blog. I then searched for "black of hat" in quotes. Cuil was still unable to show my blog in their search results. So I popped over to Google. My blog is listed on page 1 for a Google search of "black of hat". For now I am sticking with Google. Enough said.

Member of the A Team

I read an interesting news story today. Apparently there was a hacker overseas that was a member of a group called the A Team. His original claim to fame was that he wrote and controlled a botnet that had over one million PCs at his disposal. This came to light when he used this network to steal credit card numbers. The result was over 20 million dollars worth of damage.

This guy must have had the best legal representation. He was never convicted of any crimes. He walked away with an 11 thousand dollar fine. That would amount to little more than a slap on the wrist. Here is where the story gets interesting. Apparently there were many companies that wanted this hacker to work for them. This included companies whose information systems he had hacked. The real amazing feat is that companies were willing to pay this hacker the big bucks to come work for them.

Perhaps this is not too surprising. If you really want to keep your systems secure, what better a way than hiring the best people who know how to break into your system. I guess this is the hacker dream. Either write some progs that get you a lot of money. Or write progs that make you famous and get you the high paying job.

There must be a lot of money in the credit and greater financial industry. So there should be funding to pay individuals like the superman foreign hacker. I wonder if the antivirus industry also employs individuals like this. So far I have only demonstrated on my blog that I can write some programs. So that might only qualify me for a normal programming job. No big bucks there. I imagine that I need to write some more ambitious or profitable code. Time to go to the think tank and figure out which programs they would be.

Loopback IP Address

I used to frequent chat rooms on Yahoo. You would hear all kinds of people claiming that they were hackers. This was amusing. But sometimes I wanted even more fun. So I would announce to the hackers that I would give them my IP Address, and dare them to come hack my computer. Now I would never actually give my PC’s real IP address just in case. However I would shout out “127.0.0.1”. A couple people would get the joke and laugh with me. I would always tell these people that the hackers should delete all the files they find at that location. It might come as quite a surprise.

In case you do not know, 127.0.0.1 is a special purpose IP address. It is the loop back IP address. It bypasses the network interface hardware and resolves to the localhost. In other words, this IP address is the address of your computer. I am sure you can browse what is on the loopback IP address. It is provided so that you can test our things with a real IP address that does not actually go out to the network. It is just an IP address which is your machine.

With the advent of IPV6, 127.0.0.1 is no longer valid. But the joke still packs a punch for those who know. Besides it does not sound cool to say my IP address is 0:0:0:0:0:0:0:1. It just does not have a nice ring to it. Plus the dummies who are posing as hackers (aka script kiddies) might not even recognize this as an IPV6 address.

The good thing about this magic number is not that it weeds out fakers who know nothing about TCP/IP. The good thing is that is helps you find people who might actually want to talk a little shop talk. Chance are if somebody laughs and knows what the loopback IP address is, they also know a good deal about other interesting technology. Now when you are chatting online you might not want to identify and chat up some other nerds. But then again, sometimes you may just want to easily see who else is wearing a black of hat.

DLL Injection

I was recently impressed reading an entry in the Coding the Wheel blog. James Devlin was writing the latest installment of articles on how he reversed engineered online poker games using his hacking skills. His goal was to build a bot that could play and win poker for him. Obviously some of the work for this task involves some sort of screen scraping and user input simulation. However this time around James was showing how he monitored file I/O to reverse engineer some online poker client applications.

The crux of the hack was to perform DLL injection for any poker application processes to keep track of all file input and output. Specifically he wanted to know which files were being created by the poker applications. So essentially he wrote his own version of CreateFile, which any poker app will eventually be called, injected his version of this function into the poker app, then passed the results to his monitoring application. I will say that I have heard about DLL injection before for other type of monitoring such as keyboard logging. But I thought this was a brilliant idea for keeping track of what files an application is creating.

Along the same lines as tracking which files are being created by the poker app, James used DLL injection to spy on all the other type of file I/O being performed. So he knew what data was being written to files. He knew what data was being read from files. The trick was to write his own version of the ReadFile and WriteFile operations, inject his versions in the poker app, and record the results. This is almost not fair. On the Windows system, an application must used these primitives to conduct input and output. It is just the way Windows works. Of course an application that wants to be secure can try to detect such DLL injection techniques. However from a programmatic standpoint this is not easy. The replaced I/O function mimic the behavior of the real ones from an outside point of view.

Good work James. I think I shall keep a watch on Coding the Wheel for other innovative hacks.

Eight Ball

The other day I browsed over to Kasper Graversen’s blog “First Class Thoughts”. His latest post was about a puzzle which most software developers fail. I got the answer right. However I had been asked the question a number of times in the past. The first time I heard this question, I too got it wrong. At least my answer was not optimal. I encourage you to read about the puzzle yourself on Kasper's blog.

One thing I noticed about this blog was that the ads on the right hand side got repeated three times down the page. I did not think this was done intentionally. The ads were supplied by Google AdWords. I like when people maximize their earning opportunities with AdSense. So I actually got in contact with Kasper to let him know about this. The other weird thing about the ads were that they did not correspond closely with the subject of his blog post. This is most likely due to Google’s matching algorithm, and not Kasper’s blog post. I guess I could also contact Google about this mismatch.

My girl is always asking me to challenge her with cool puzzles like this. Perhaps I will try to recount this particular Eight Ball puzzle for her. I have frequently found that people who ask me about this puzzle have a good time when I get the answer wrong. They usually try to guide me to the correct solution. I think in the future I shall purposely get the answer to this question wrong to promote good discussion.

Here is a shout out to Kasper Graversen for a nice blog post. Although Kasper himself is not allowed to say so, you should click on some of the ads on the right hand side of his web site. Kasper most likely gets a little cash each time this happens. Hopefully Google will not constitute my words here as a violation of their AdSense policies. In the effort of full disclosure, I used to have AdSense on my blogs until I got dropped by Google. So I have a little insight into the matter.

Awesome Demo

Yesterday I checked out a video of an awesome hardware demo. The project was called Craft by a hacker called lft. He put together a custom hardware board. This board connected to a standard VGA monitor. A chip on the board had been programmed with 8500 lines of assembly language code. This demo won first place in the Breakpoint 2008 contest. I did not see any of the other entries. However I am sure that Craft blew the competition away.

A funny piece of the demo that continues throughout the whole thing is a bunch of kooky music that plays in the background. There are some non-trivial graphics produced such as reflections of some flames in what looks like some water. I saw a bunch of dots moving in what I assumed to be a stellar voyage of some sorts. The demo had a bunch of complex 3-D spinning as well. The graphics themselves appeared to be a rather low resolution (since at times I could see the actual pixels). This did not distract from the greatness of the demo though. And regardless of the resolution, the graphics seemed to match the music that was being played.

Some of the things that impressed me were the moving camera angles for the scenes that were being displayed by the graphics. There were a lot of amusing messages placed in the demo. For example, there were a bunch of shout outs to lft’s friends. The text often had different effects applied, like some dancing characters at times.

I have seen some other demos before. This one ranks up with many of the better ones I have seen. In the past, I have seen demos written for a PC with minimal resources. For example, I saw demos of apps that ran in as little as 64k of code, or even 8k of code. The unique part of Craft was that it was all done on custom hardware developed by lft. My hat is off to the superhero known as lft. Good work man.

Eric Raymond FAQ

Yesterday I did a Google search for the term “hacker”. The second search engine result was an FAQ maintained by Eric Raymond. This FAQ gave advice on how to become a hacker, as well as guidance on what not to do. I found this very amusing. A regular hacker to be would follow these rules and perhaps look like a hacker. A real hacker would follow his heart and help dictate what should be in the next FAQ. However I thought I would discuss which characteristics I found noble and funny.

One comment from Eric was to write software and give it away for free. Don’t get me wrong. If I could get rich by writing code and charging for it, I would do it. For now I am posting most of my good and new programs here on my blog. So I meet this criteria. I should point out that Eric owns a company which sells software. So perhaps he himself is not necessarily a top hacker. LOL. Another recommendation from Eric was publish useful information. I author a number of blogs. Some of the posts to these blogs are just rants. But I got to hope that some of the information is very useful in a hacker sort of way. So I have maybe 2 of the many traits of a hacker. I am not losing any sleep about my status though.

The funnier part of the FAQ were in the section that described what you should not do. Eric seriously advises against obtaining a silly user ID. Well I might be a little guilty of this one. For instance, right here I am “Black of Hat” or Xero. A little silly I agree. However I do not go by the code eLitehaCkerz or anything weird like that. The second caution from Eric was to not write posts/emails with poor grammar and spellings errors. I almost always agree with this sentiment. There is one exception to this rule in my blogs. I am know as Rawk Starr in one of them. And I will confess that Rawk writes in the worst English and has atrocious spelling. However Rawk is not posing as a hacker so I think I should be OK there.

In the old days I used to chat online and find a lot of self proclaimed hackers. As a joke, I would often tell them my machine IP address is 127.0.0.1, and challenge them to hack my machine. Of course the joke would be on them if they hacked this IP address. That alone might be the source for another blog post.