Vulnerabilities in Code Easily Mapped


Nov 14, 2008

On Feb 24, 2008 I wrote specs and a simple parser for my own programming language. The first level of parsing returned a list of types. The second level (currently nearly finished) would sort the types into statements that could be executed line by line using an interpreter or that could be translated into assembly (see ASLang2). The language was designed to compile in automatic bounds checking and would not allow non-deterministic code to compile. This is not an outrageous goal, in fact most interpreted languages do the same. Funny examples of non-deterministic code being executable exist in Python, PHP, and Perl. To a developer, though a magic bullet would be nice. In fact, it would be nice if the compiler was able to print out a list of possible boundary breaks. But before I finished my language, I decided that it would be possible and easy to simply write the same compiler for C/C++. I would get a list of variables, find all pointers in the code, and count whether it's possible to overwrite anything.

Read more »

Talk


Dec 10, 2008

Talk is cheap, but talk takes time, time being money is not cheap, so why do we talk at all? Communication is important to life as social animals. Humans are bound to their society by needs, wants, and so forth and communication is needed to properly satisfy those tasks. From communicating for work, to community, and friendship, communication connects people in a way that no other medium can. Television, blogs, essays, and speeches fail to solve this because they are one-way monologue communication. If a person is properly coherent, people can glean meaning from a monologue form of communication. For example, a person who knows me well or who doesn't know me can read this and understand what I'm saying because I'm a straightforward speaker and I speak my mind in the same way I write a one sentence blog.

E-mail, IM, blog/forum comments, and telephone (a certainly dialogue form of communication) are notorious for their lack of appropriate guides for meaning. Face to face communication solves this issue by adding very quick responses, control over who gets to talk when, and facial expressions which help a lot for context and meaning. The obvious problem with face to face communication is that it takes time and energy to get to the same place at the same time. Since face to face communication is so important, people put a lot of work into making sure it occurs.

Read more »

Large scale SSH port mapping


June 9, 2008

Doing a bit of preliminary analysis, I found out that I could cheaply portscan a single port on every machine on the internet. To what end? Since I wrote a research virus that exploits weak passwords on SSH, it makes sense to know what servers exist and how likely an SSH attack would succeed against the network as a whole. Though I don't plan to unleash this attack and I don't expect that my virus adds to the already widespread SSH bruteforce attacks currently underway by malicious entities, I would definitely like to research and release data on who is using SSH. Since portscanning is quite easy, I started my server on the task. Note that I'm not releasing a tarball at this time since the software to do this can be printed in the usage section.

Read more »

Japanese Spam Analysis (or Artificially Intelligent Teaching by Statistics)


Sept 25, 2008

Japanese AI version 0.1 [sig]

Japanese spam is a good indicator of text in Japanese language. It is also very good tool for understanding common Japanese speech. Most spam is designed to trick the recipient into e-mail or visiting a site. Unlike English spam, most Japanese spam is extremely well-written, targeted at the net savvy and quite well-educated Japanese audience. Also, since spam filters in Japan can pick out words much quicker (since Japan uses Kanji), spammers are using higher quality spam generators.

Read more »

« previous next »