Archive for the ‘Holidays!’ Category

So, it’s the day after Labor Day (ever wonder why they call it Labor Day when nobody’s laboring? Ironic, no?) Anyway, I was getting back into the swing of work this morning and reading through the security news, blogs, mailing lists, emails, etc. and started collecting my thoughts about what to discuss today. Now, I had originally planned on discussing and entry in Donald’s new blog, but then I saw the McAfee whitepaper about malware in online gaming via Security News Portal and I figured I can’t let them “go there” without opining at least a little bit on it.

Anyway, let me preface what I’m about to say by stating first that I think that the fact that McAfee is concerned about the virtual world idea deserves a kudos. I’ve pointed out a number of times that these online games are “ripe pickins” for the astute criminal. And they are now – and will continue to be in the future – a place where malware authors (and other shady characters) are likely to concentrate efforts. So, “go go McAfee” for looking under this particular rock to see what you can find.

The one cautionary thing that I’d say about this topic though, is to not get caught in the trap of “giant baby” reasoning. Here’s what I mean by that. Say you’re an alien biologist in the far future and you arrive on planet earth far after the human race is extinct. You find some human DNA and decide you’re going to clone up a few newborns to examine what human life was like. You pop a few newborns out of your “Clonimagic 2000″ and you wait to see how the infant develops.

You watch over the first 3 months and see the infant increase in weight by 50%. You watch the next three months and see it increase again by 50%. You try this with a whole batch of infants and they all do the same thing. Since the average newborn doubles in weight during the first six months after birth, if you look at a million babies you’ll always see the same thing: rapid, uncontrollable expansion in size. Now, knowing nothing about babies, would it not be reasonable to extrapolate based on the data that the newborn would reach a size just over a ton before they turn four? Absolutely not…

But we know something empirically that our alien biologist does not. Which is that the growth curve for a newborn is sharpest right after birth. So, while a newborn might double in size the first six months, it doesn’t do so forever. The same thing is true for example of malware (and other security issues) in virtual communities – there might be a sharp uptick in malware and security incidents targeting these communities during the infancy of these phenomena, but – over time – the growth curve will steady out. Meaning that it’s right to look to these communities as a potential source of issues, but don’t assume that what we see today will continue indefinitely. We’re going to have to wait and see how things pan out over the long term.

Hey, so happy new year, welcome to 2007, and all that other jazz that people say around this time of year. It was a great holiday; spent some quality time with Diana and the pups, visited some relatives in New Jersey, and totally ignored the phone and email. Awesomeness. Totally stress-free… with one small exception.

The one island of stress in an otherwise unbroken island of relax-itude was when my father asked me for help setting up his new laptop. You see, my dad doesn’t have Internet connectivity. So when the time came to install all that new shrink-wrapped software he bought with the machine, I experienced a whole world of pain that I hadn’t before: telephone software activation. You ever experience this? It’s painful. Microsoft, at least, has it down to a science: you call them up, read of punch in the 6 groups of 5 digits, they read it back to you, then they read you the 6 groups of 5 numbers that you type in. At the end of the process (about 20 minutes… I kept track), “blammo” it’s registered. Now, that’s for Office. You need to go through it again for Windows, again for the OEM software that comes with the laptop, again for the other software that he bought… again and again and again. Of course, most of the places aren’t open 24 hours – some of them don’t expect you not to have Internet connectivity so they’re not prepared to activate the software. One guy had to figure out how to do it and call me back. All at their expense, mind you.

So, here’s my question. Why do this activation at all? The reason that we’re always given is that it’s a piracy-prevention measure. Now I contend that it doesn’t for a number of reasons – for example, there are tons of groups out there that love to crack software for the intellectual challenge of the reverse engineering experience. But even if it does protect against piracy, is the cost associated with it worth the benefit? For example, one of the places that I called made a piece of design software that was used in combination with a mechanized wood carving tool. In order to support the activation process, my call cost them the following:

- toll-free connection charges for me to call in and activate
- long-distance charges for them to call me back with the activation code
- approx. 30 minutes of customer-rep time to deal with me
- approx. 5 minutes of the rep’s manager’s time to figure out how to register

So, is that worth it? If he wants to install the software on another machine (which he will), he’ll have to call back and go through the process again. If his laptop crashes (which it will), he’ll have to do it again. Each and every time, at significant expense to this company. Usually you don’t hear this from security professionals, but I’ll go on record – what’s a little trust worth? In this case, it’s worth hard dollars – and it’s easier on customers. I’m wondering what the incentive is…