Stephan Derrick und Harry Klein

Als DDR-Kind, kannte ich Derrick natürlich nicht wirklich. Okay, davon gehört … schon. Aber geguckt? Hmm, vielleicht hatte ich aus Versehen mal reingezappt. Muß aber dann langweilig gewesen sein.

Einerlei. Island ist klein. Weil Island so klein ist, werden hier haufenweise ausländische Filme, Serien und Shows eingekauft und dann untertitelt ausgestrahlt. Die Vertonung, wie in Deutschland für ausländische Filme üblich, wäre wohl zu aufwendig. Viele meiner Kollegen sind nun in meiner Altersklasse (+/- 5 Jahre) und immer wieder werde ich – kein Scherz – auf “Derrick” angesprochen. “Horst Tappert”, den müsse ich doch kennen. Wenn ich dann auf meine Sozialisierung in der DDR hinweise, bekomme ich meist nur schiefe Blicke. Inzwischen hat sich allerdings der Verweis auf “Derrick” zu einer Art “Running Gag” entwickelt, mit dem man genauso Zoten reißen kann wie mit dem zweiten Weltkrieg oder dem deutschen Akzent … der bei mir (Englisch) leider nicht so stark ausgeprägt zu sein scheint, so daß sich ein Verkäufer letztens wunderte, daß ich nicht Isländisch mit ihm reden würde, weil ich doch eindeutig einen isländischen Akzent hätte und ich von anderen Seiten auch schon einen US-Akzent oder keinen “definierbaren” Akzent zugeschrieben bekam.

Den Derrick mußte ich mir einfach von der Seele quatschen. Nach dem Sandmännchen hat mich allerdings noch keiner gefragt. Nach Polizeiruf 110 auch nicht …

// Oliver

Posted in DE, Island/Iceland/Ísland | 1 Comment

“A brilliant composer, songwriter, singer” ….. NOT!

Last weekend, as a temporary spectator at what you could call a bachelorette’s party, I was introduced to Icelandic “artist” Leoncie and the Icelandic version of this song (luckily it was a double 😉 – and in this case was good for my peace of mind … you’ll understand in a moment). It’s pretty rare that you can hear such music openly, but an Icelandic friend told me the story behind Leoncie that explains it all.

The music itself was rather … traumatizing … and at the same time funny, because it is soooo bizarre. Just check out what is allegedly her channel on Youtube (especially the self-description). She’s soooo famous, despite that music. Yeah, I know … taste differs. However, I am used to all kinds of voices, sounds and appearances and they vary a lot. When almost everyone’s gone I tend to crank up the volume in the office and listen to Mozart’s Magic Flute, the violin and horn concertos or Vivaldi, Telemann and other baroque composers’ music as well as Apocalyptica, Manowar, Nightwish, Rhapsody, ELO, Weltenbrand, Elis, Deine Lakaien, ABBA, Poeta Magica, Haggard, Krless, Blind Guardian, Blackmore’s Night and a lot more (sometimes in shuffle-mode). So it’s not that I have the most exquisite taste … I like what I like. But I also know what I dislike. Leoncie made it into that category in no-time. The Barbarella/Valkyrie/Viking-bride/80s-disco look (or mixture thereof) didn’t really work in her favor either in this case. 😯
Continue reading

Posted in EN, Island/Iceland/Ísland | Leave a comment

Anti-phishing techniques – or how to defeat the purpose of IDNs

International Domain Names (IDNs) are attractive. They allow people to express themselves in the multitude of languages which this planet has to offer. However, they also allow scammers and phishers to trick you into believing a particular domain name is trustworthy, while it is a scam. The idea is that homoglyphs could be used by criminals to trick you into believing to visit a trusted domain. For example if I write the first two letters of a pretty well-known domain name with Cyrillic letters like this: аоl.com you won’t notice (unless your system lacks the necessary glyphs to show Cyrillic). However, a name such as xn--l-7sb6b.com (its raw Punycode form) would raise some suspicion.

In my opinion the threat is real, but the counter-measures are not well thought. The idea of IDNs is to show domains in the native non-latin character-sets (similar systems for TLDs are in the works), so why would anyone not show them at all? Browsers such as Firefox and Internet Explorer 7 (on Vista) refuse to show the non-latin form of the IDN if certain characters are contained.

Let’s take the domain name I recently registered which reads сніжок.net. If you hover over the link in FF or IE, you will see this instead http://xn--f1aihfm1k.net. The reason is simple, this IDN contains homoglyphs. So let’s dig into it a bit more.
Continue reading

Posted in EN, IT Security, Software | Leave a comment

Sterbehilfe illegalisieren?

Wie kommt es, daß insbesondere Unionspolitiker wie Herr Oettinger sich gegen Sterbehilfe aussprechen? Geschieht dies aus dem Kalkül des Kapitalisten heraus, daß jeder tote Bürger quasi den ROI (Return of Investment) mindert? Oder hat es mit den christlichen “Werten” zu tun, nach denen Selbstmord Sünde ist? Man kann sich sicherlich über die Form “dieser Sache” streiten, aber bei einvernehmlicher Sterbehilfe sollte sich meines Erachtens nach der Staat gefälligst nicht einmischen.

Abgesehen davon, war es nicht gerade die christliche Lesart, daß das Schicksal eines jeden Menschen von Gott vorbestimmt ist? Wieso meinen sie also den Sterbehelfer oder dem Geholfenen zu richten? Nach christlicher Lesart sollte dies doch Gott vorbehalten bleiben, oder? Ach ja – da war ja noch der freie Wille. Das ist natürlich doof. Aber jeder legt es sich ohnehin so zurecht wie er’s braucht.

Und dann gibt es ja noch die “christlichen” Sterbehelfer, die meinen entscheiden zu dürfen, ob das Leben des Kindes oder das der Mutter mehr Wert habe. Ist das nicht auch unerwünschte Sterbehilfe an der Mutter? Was genau ist der Unterschied? Vielleicht die Tatsache, daß bei einvernehmlicher Sterbehilfe alle Beteiligten im vollen Bewußtsein handeln, während man das von einem Ungeborenen eben nicht annehmen kann?!

// Oliver

Posted in DE, Gedanken, Ich, der Zyniker | 3 Comments

A clarification – because it is needed

Almost one month ago I wrote a blog post. Some people more or less took offence by it. In German we have a saying that goes like this “Wem der Schuh paßt, der zieht ihn sich an.” – which translates to “He whom the shoe fits puts it on.” (see German proverbs).

One thing, however, seems to require clarification: this is a private blog, these are my views and opinions, no one persuaded me to write anything (it’s called free will), nor do I allow anyone to take any influence on the topics I write or don’t write about (I have enough interests to cover more than enough topics, the Earth days usually just don’t have enough hours).

Feel offended? Does “the jacket” fit? I didn’t disclose any identities. Intentionally so! However, my identity is not concealed. So it depends solely on you (i.e. the offended people) how public you want to go. Feel free to do so, but think a bit more thoroughly this time instead of threatening anew uninvolved people

// Oliver

PS: Comments intentionally disabled for this post. Direct contact here.

Posted in /dev/null, EN | Comments Off on A clarification – because it is needed

Keine Angst – es geht uns doch gut

Da es nicht etwa so ist, daß viele Deutsche der Mittelschicht und drunter Zukunftsangst wegen der sich abzeichnenden Inflation haben, kann sicher auch nicht behauptet werden, daß die durch die Gegner des Grundgesetzes vorangetriebene Totalerfassung der Bürger, ihrer Kommunikation, ihrer Finanzen, ihrer Gesundheitsdaten usw., im Hinblick auf die sich abzeichnenden sozialen Umwälzungen einer zukünftigen total(itär)en Kontrolle dienen könnte. Immerhin sind wir eine (wenn auch nur repräsentative) Demokratie – steht doch klar und deutlich auf dem Etikett!

Keine Angst also, wenn Herr Schäuble dafür wirbt die Fingerabdrücke auf dem elektronischen Personalausweis speichern zu lassen. Es gibt dabei sicher noch keinerlei Hintergedanken. Und da sich bspw. Hitler bekanntlich nicht dem demokratischen Prozeß stellte um dann vom deutschen Volk jubelnd gewählt zu werden, sondern sich bekanntlich an die Macht putschte, ist nichts abwegiger als einen Zusammenhang zwischen totaler Datenerfassung und totalitären Gesellschaftssystemen herstellen zu wollen oder gar auf einen möglichen Datenmißbrauch bei einem Umsturz in ein totalitäres Regime hinzuweisen.

Total abwegig!

// Oliver

Posted in DE, Gedanken, Ich, der Zyniker | 1 Comment

CreateRemoteThread, Vista and separate sessions

Recently I’ve hit a wall during development. I had written a nice workaround for a problem, based on code injection. In fact the code wasn’t injected by loading a DLL but instead by loading relocatable (32bit) code of less than 250 byte size. However, once I started testing it on Vista, the topstack method to retrieve the address of kernel32.dll inside the target process didn’t work anymore, so I had to resort to the PEB method. No big deal.

However, once I got that sorted out, the whole thing worked when run from the same (terminal) session, but failed as soon as the program (in simulation of the later real-world conditions) was started as SYSTEM by the task scheduler (i.e. from the session in which services run). Obviously the task scheduler isn’t all too talkative about the reasons of failure of a scheduled program, so my assumption was, that it must have to do with the stricter session separation on Vista and the documentation of CreateRemoteThread() confirms this:

Terminal Services isolates each terminal session by design. Therefore, CreateRemoteThread fails if the target process is in a different session than the calling process.

Continue reading

Posted in /dev/null, IT Security, Programming, Reversing | 24 Comments

What’s the deal with Obama?

It seems Germans are overly enthusiastic about the visit of presumptive US presidential candidate Barack Obama. Obviously no German has a say in the election, but putting that fact aside, it is still astonishing how enthusiastic many Germans are.

I for one will wait until he assumes office – in case he wins, of course. Personally I am not too sure whether his presidency would change anything. Sure, he’d be the first black US-president, so what?

Many people world-wide have resigned, given the hegemonial power of the USA. While on one hand the US claims to spread peace and democracy, on the other hand there exists a camp on Cuba which – according to the US administration – is not subject to the US legislation. Hence, while being home to many warm-hearted and nice people, the hegemony of the US seemingly led it to be home of a lot of ignorance as well. So people who you would expect to show compassion towards other human beings (including muslims) and show the cultural world-leadership claimed by them, just don’t seem to care. It seems the country that once helped liberate Germany from the Nazis has adopted some of the methods of their former enemies under the disguise of “The War on Terror” …

Many of the thoughts I have now remind me of the fears I had as a child when the “evil imperialists” announced SDI. These fears gave me some vivid nightmares as a child …

Let’s see whether a president Obama could or would change this.

True patriotism hates injustice in its own land more than anywhere else.
(Clarence Darrow)

// Oliver

Posted in EN, Thoughts | Leave a comment

сніжок.net

Just a test сніжок.net :mrgreen:

PS: If the URL looks horrible, it’s Firefox or IE. No further comment 😉

Update: link removed.

Posted in /dev/null, EN | Comments Off on сніжок.net

CSimpleBuf, a C++ utility class under BSD license

Today I am happy to announce the release of a C++ buffer class that is of special use for interfacing with Windows system functions. The class is a template class and thus only one header file is needed. The template argument is the “character type”. However, please note that the “character type” can be literally anything, including unsigned int or even an arbitrary struct.

Friðrik, my boss at FRISK Software International (FRISK), was so generous to allow the release of this C++ utility class under a non-copyleft license. He agreed on the new (simplified) BSD license. This allows everyone to use this code for free, with the only “restriction” being that attribution has to be given. Even Microsoft is using code under BSD license (TCP/IP stack and utilities).

So, what does the class offer? Well, first of all the standard operations you’d expect from a simple string class such as concatenation and assignment (those are based on the idea of C-strings being zero-terminated) . But what sets this class apart from other simple buffer classes that I have found, as well as from the string classes which tend to be very restrictive when it comes to modifying the buffer they encapsulate is the fact that it can be used seamlessly with most APIs. The only exception from the rule are APIs which expect an untyped pointer (including ellipsis arguments), in which case you have to use the Buffer() member function. It offers resizing of the buffer (ReAlloc(x);) as well as completely freeing it (ReAlloc(0);) or zeroing it out with Clear();.
Continue reading

Posted in EN, FSI/F-Prot, Programming | 5 Comments

Windows in XEN domU on laptop, using screen and VGA?

Does anyone among my readers have a clue whether or not it is possible to set up XEN in a way so it will pass control over the screen to a domU to which I want to assign it? It would be a nice scenario for having both Linux and Windows running in parallel on the same box while still being able to use all those 3D-features of the graphics card. But from what I found so far, it doesn’t really seem to be possible.

Apart from firewall/proxy scenarios it would offer some other creative ways of using the laptop.

// Oliver

Posted in EN, Software | Leave a comment

GoDaddy.com SSL cert …

It was a bit of trouble to get it done, even after my purchase was approved. But I have ît now 🙂

Here I just want to share the information with you, since the FAQ on the GoDaddy website wasn’t particularly helpful. I had chosen the multi-domain certificate for up to five domains. It was clear that besides the CN (Common Name) they’d allow me to enter the SANs (Subject Alternative Names). However, this didn’t quite work out. When I had created my CSR (Certificate Signing Request) and tried to submit it, the system refused it and referred me back to the tech support. Darn …

This meant waiting one more day as – due to the timezone difference – the problem would be handled only when it was night in my timezone again. Anyway, I got a reply. Now I had originally pasted my CSR along with the support request in order to help them figure it out. The CSR was complete (with the begin/end markers) so that could be ruled out. However, apparently the CSR parser over there doesn’t like if you enter the SANs already before submitting the CSR, so the final hint from the tech support came in handy: I’d be able to enter the SANs after submitting the actual CSR, so I should try submitting my CSR without SANs. Done – and it worked. So why isn’t this documented in their FAQ? Anyone could have done that easily. The challenging part was originally to get the SANs into the CSR.

But well, it works now. So if anyone else is using these multi-domain certificates from GoDaddy.com, this should help figure out the missing link that wasn’t in the online help 😉

// Oliver

Posted in EN, IT Security, Thoughts | Leave a comment

Two weeks after beta: IDA Pro 5.3 released

Those who haven’t heard the news, get your update now. Here’s a link to the update-request page.

NB: According to Ilfak, the debugger has seen major improvements.

// Oliver

PS: Don’t forget to get the new SDK and the support tools (FLAIR etc).

Posted in EN, Reversing, Software | Tagged | Leave a comment

Ziemlich effektiv

Der “Patch” den ich für mein GMX-Konto benutze hat sich als ziemlich effektiv herausgestellt. Alle 10min loggt sich mein Perlskript (es benutzt Mail::IMAPClient via SSL) bei GMX ein und sortiert alle Ham-Mails aus dem Spamverdacht in den entsprechenden Unterordner. Seitdem ist mein Spamverdacht lange nicht mehr so voll. Die paar (~50) Spam-Mails pro Tag sichte ich nur noch und das meiste fliegt ohnehin schon aufgrund des Titels raus.

Dank Regulärer Ausdrücke, werde ich vermutlich auch diesen Teil noch halbwegs automatisieren können.

// Oliver

Posted in DE, Software | 2 Comments

Nice work! Found hardware keylogger in a DELL laptop.

Read the full story here. DHS denying request under FOIA.

PS: If you read the scanned document closely, you notice the two times 8-digit “file number” which could be a date. If this was state of the art three years ago, what’s the state now? Let me guess, there are a bit more than DELL computers affected? … 🙄

Update: There are claims this was a hoax (from 2005). Let’s hope it was. Read here and here.

The sad part, it is actually not incredible enough to find out it is a hoax immediately. One comment on the first of the links reads:

I can not describe my desire to ridicule people who actually buy into this stupid bullshit. I’m even more outraged at people actually trying to prove other people that this is not said bullshit.

Seriously, what are the chances of someone actually getting away with this?

Well, who would get away with becoming US president without actually getting elected the first time, but getting a second term without being thrown out of office and this time even getting elected (although it also smelled fishy)?

Posted in EN, IT Security, Thoughts | Leave a comment

Very thorough anti-fraud department ;)

I just ordered a five-pack of SSL certificates at GoDaddy.com a few days ago because they have the best offer in that the price is nice and the browsers they cover are virtually 100% of all browsers. The remaining close-to-zero doesn’t need to visit my websites anyway 😆

When paying the thing, I registered with my German postal address, simply because the domains (for which the SSL certs are intended) are registered on it as well. However, I paid the thing with my Icelandic credit card as it is more convenient for me that way, despite the unfortunate difference in the dollar rate (yes, also the ISK has plummeted) or the fact that a registration with my Icelandic (matching) address would have saved me the VAT. That brought the anti-fraud department onto the plan and I got a friendly mail in which I was asked to confirm the purchase and my identity. Due to the fact that I paid with a credit card whose billing address is in a different country than the address of my registration, they thought it was a fraud. I cannot actually think of any fraud where a domain in the hands of the payer (coincidentally the name on my Icelandic credit card is my name :mrgreen: ) could be abused in any way. I used the same email address to register at GoDaddy which you can also see on my contact forms 😉

Anyway, now it is kind of stalled. When requested, I sent immediately the front side of my national ID card as a scanned image, although I would have preferred a secure transmission in their customer area or so (which runs over https). After all, privacy was the reason to get SSL certificates in the first place. And now I can only wait. Everyone says they offer a swift service and the emails so far were pretty quickly exchanged. Also I have to take into account the time zone difference. Now that’s the hardship you get from being a world citizen 😉 … let’s see how this turns out.

Greetings to the GoDaddy.com anti-fraud department,

// Oliver

PS: And yes, I understand the skepticism and appreciate the concern. If someone would have used my credit card data to make a fraudulent purchase somewhere, this would hurt all parties except the fraudster. It’s just so damn inconvenient 😉

Update: Issue is resolved. A mail from support got lost on its way, that’s why it seemed to take so long.

Posted in EN, IT Security, Thoughts | 2 Comments

Saving the world?

Programs of a new type have been created by different companies recently. The first I am aware of was developed in 2006 and violated the GPL back then. More of them seem to be offered all the time.

These programs claim to save you from malware, just like AVs, only better and also for unknown threats. And indeed the idea is intriguing and I have heard of the first implementation – although more complete than the half-hearted solutions offered now – in 2005. That particular solution would move the Windows kernel into ring 1 and could then supervise it. In fact every process would literally see its own copy of the system. Process separation to the max.
Continue reading

Posted in EN, IT Security, Software, Thoughts | Leave a comment

From the G8 summit we learn …

… that nuclear energy comes to the rescue of the world climate. Even better. If you think thoroughly enough, it comes to the rescue of nature as well. While humans have managed to drive several species to extinction over time, dumping waste that will persist for millenia to come will ensure that through increased mutation (thanks to the radioactivity) the diversity in nature will flourish once again. Whether humankind will still inhabit Earth by then is more than questionable though.

// Oliver

Posted in EN, Thoughts | 2 Comments

GMX “patchen”

Jupp, richtig gehört. GMX hat zwar seit Jahren einen Spamfilter, aber sie haben es nicht geschafft reguläre Ausdrücke zu dokumentieren (scheint aber PCRE zu sein) oder einen Filter vor dem Spamfilter zuzulassen. Filterregeln ja, aber erst nach dem hauseigenen Spamfilter von GMX. Da der leider nicht sonderlich lernfähig ist und das Verschieben in einen anderen Ordner vom “Spamverdacht” aus den GMX-Spamfilter nicht zum Lernen animiert sondern quasi umgeht, wird der GMX-Spamfilter es auch nie begreifen. Dumm nur, daß es keinen Sinn macht, Mails als “Kein Spam” zu markieren da dies automatisch die Mail in den Posteingang verschiebt und eben nicht nochmal durch die Filterregeln laufen läßt. So ist es denn so, daß ich seit Jahren meine Mails von den Mailinglisten NTDEV, NTFSD und WINDBG – über die ich übrigens noch nie Spam erhalten habe – brav aus dem “Spamverdacht” in den vorgesehenen Ordner verschiebe. Ähnliches gilt für Mailinglisten von CVSNT, ReactOS und Security Focus und so weiter und so weiter.
Continue reading

Posted in DE, Gedanken, Software | 4 Comments

Are they allowed to tell the truth like that?

Read and judge yourself: Intellectual Property Regime Stifles Science and Innovation, Nobel Laureates Say.

Posted in EN, Thoughts | Leave a comment