Showing posts with label hacking. Show all posts
Showing posts with label hacking. Show all posts

Jun 28, 2013

You as a product

Revelations of the emergence of the 'surveillance state' in the US has deeply disturbed many who have been in denial about what massive accumulation of private individual data allows. Even though the private corporations may profess no nefarious intentions, the very fact that they have this data leads to temptations, targeting and inevitable opportunities of misuse. Facebook recently suffered a leak of 6 million private emails and phone numbers. These have surely been recorded by someone and will be used as targets for spammers, or as stolen shell identities to send out spam. The phones will get targeted with international spam calls offering cheap services and holidays. If the social graph (list of contacts) has been obtained then its even worse, as emails will go out to all friends of the stolen identity containing alarming, embarrassing, and unwanted messages.

Online ('cloud') service providers, such as Google, Apple etc. do not want you to be anonymous or even pseudonymous. They want to have the power of attorney over you complete true digital identities. At this year's WWDC, Apple was very happy to publicly declare that it has 575 million paying accounts, most of which have stored Credit Card details. YouTube has been constantly sending out requests to have users change their online public chosen names replaced with their true First - Last names.

A problem is that this identity especially when connected out to other services including ecommerce, becomes a massive target. IT Technology is not absolute - as long as information can be accessed by one person, then the mechanisms meant to keep another out will inevitably be overcome. Weaknesses will be technological as well as human. There are many existing and emerging programs of national surveillance and industrial espionage out there. If one is holding a guarded fort of valuable digital information, one should not wonder if it will be breached but when.

In the Chris Nolan's The Dark Knight (2008), the scene that keeps coming back to me most is when Morgan Freeman's character is mortified, when Batman asks him to use a new surveillance technology over their own company's mobile network to spy on the whole city simultaneously and locate the criminal targets. Freeman suitably calls it 'unethical ... too much power for one man' and agrees only after Batman agrees to destroy the machine at the end of mission. How likely do you think that such a tool, once constructed, would be dismantled in real life? 

The following is a very information packed diagram from Baynote, about where all the privacy data is coming from and going to, in some of the popular online presences.


*      *      *



Apr 7, 2010

Jugaad, getting serious now

A term that has always been more a slang than even a formal Hindi word, has suddenly acquired respectibility in the Management world. India's economic profile rising, and it is only proper that practices that seem to work in this nation are formally propounded, expounded and then propagated as the new gospel. Witness Japan's 'Kaizen' business process philosophy export.

I remember jugaad was a quick word that school and college friends would exchange to refer to a 'thing-a-ma-jig' quickly put together to do what we wanted to do.

Now a blog in the eminent Harvard Business Review defines it in the following terms:
... the gutsy art of Jugaad. The Hindi term roughly translates as "overcoming harsh constraints by improvising an effective solution using limited resources". We call it the art of creative improvisation — within a framework of deep knowledge and experience.

Through our research, we have identified four operating principles or innovation rules:
  • Thrift not waste. This first rule — which promotes frugality — helps tackle scarcity of all forms of resources.
  • Inclusion, not exclusion. This second rule helps entrepreneurial organizations to put inclusiveness into practice — by tightly connecting with, and harnessing, the growing diversity that permeates their communities of customers, employees, and partners.
  • Bottom-up participation, not top-down command and control. This third rule drives collaboration. CEOs who tend to act as conductors must learn to facilitate collaborative improvisation just as players in jazz bands do.
  • Flexible thinking and action, not linear planning. This fourth rule facilitates flexibility in thinking and action. Jugaad-practicing firms are highly adaptable as they aren't wedded to any single business model and pursue multiple options at any time.



Management has always sought to capture the Innovation genie in its bottle of standard methodologies. In a field which focuses more on the way you work, rather than what you are working on, the accepted concepts are as liable to change, as clothes in a fashion show. However, there's just something about Jugaad that makes it incongruous to a formal management definition.

The term has become well known in the wider world with the publication of From Jugaad to Systematic Innovation. The book addresses the right question of

Why is it that India is unable to be the source of major industrial innovations on a sustained basis even though it has highly skilled talent and a penchant for jugaad (creative improvisation)?
- From Jugaad to Systematic Innovation, The Challenge for India, by Rishikesha T. Krishnan, Professor of Corporate Strategy, Indian Institute of Management, Bangalore, India

Jugaad is a starting point that happens in under-resourced conditions, but to scale the initial innovation requires other ways and means. I thought the following words expressed it well:
Jugaad is a survival tactic, whereas a hack is an intellectual art form; i.e. Jugaad is the wile of the poor, and hack the pastime of the affluent cerebral. Jugaad is a hack to get around or deal with a lack of or limited resources, and has a class component to it - jugaad are things poor but clever people do to make the most of the resources they have. They do what they need to do, without regard to what is supposed to be possible.

Examples

The 'Jugaad' (or Maruta) in Punjab region is also used to refer to a 'poor'-man's assembled vehicle, made by putting together a cheap low-powered water pump with a custom body.

Image courtesy Wikimedia

Now one wouldn't call this a great engineering success, but it is heroic in the attempt by rural-poor to cobble together a ride.

Washing machine ad



More examples of Jugaad can be found at Espirit de Jugaad, Hindustan Times.

Explore further



Jul 20, 2008

Gmail vulnerability being exploited by spammers

I knew something was fishy, when I started getting emails from my father inviting me to desktopdating.net. Doing a closer inspection of the email properties, I found it was not sent from Gmail, but from desktopdating.net.

There have been quite a few cases of emails being sent in the name of Gmail (Google Email) users to their contacts which have not been authored by the holders of those Gmail accounts. Known websites that have beeing using this technique are desktopdating.net, yaari.com & gazzag.com. These websites send invites and other spam in someone else's name to their contacts. An easy way to spot such a false email is to see the details or properties - it will show the from address as someone@gmail.com, but the mailed by server will not be gmail, for example it may be desktopdating.net.

These sites have also been mentioned in a blog post of 'Ill-mannered websites'.

If you can, block or filter these websites in your email accounts, web servers an any other online channels. If you have become a member on these, I would strongly recommend that you unregister and remove any personal or social contact details. Finally, if you do recieve any email mentioning links to these websites, do not click on any of these links, as that will start a program that attempts to read through your entire contact list and store it for spamming purposes. Simply delete such email, marking as spam may be tricky as that may block the email address.

Gmail vulnerability


Gmail used to carry all the contact address for an account in its active Javascript for a logged-in email account. Other sites found that in today's multi-tab browsers, if a user is presuaded to visit another web page while keeping their Gmail accounts open, it would be possible to extract those contact list addresses from the Javascript using the new web page. There is more information on this vulnerability in this blog post - GMail Vulnerable To Contact List Hijacking.

Though this vulnerability has since been fixed by Gmail, in the time window that was open some spammers had been able to harvest and collect contact lists for many email holders.



Feb 7, 2008

Windows XP Themes - free and easy

Customizable interfaces that's what we love. Users today spend a large part of the day staring at the same screens, sometimes they want a change but there's not much to have.

Microsoft Vista, window operating system's new avatar, did come out with a lot of that stuff - but it turned out to be something that doesn't go smoothly on your average computer. The result is that many, including me, are now choosing to use the older Windows XP. Seeing the problems in Vista, we are learning to appreciate the relative stability of WinXP, it's compatibility with nearly all popular software products, and ability to get the job done without too much fuss.

Yet, there's still much left to be desired. This blog is about the limited 'themes' in WinXP. By default, you'll find that out-of-the-box you get only 3 themes in WinXP - Windows XP, Windows Classic and 'My Current Theme'. Not very inspiring. 'M themes online...' link never leads anywhere useful.


Now since Microsoft is not very helpful, we end up seeing third party software such as StyleXP. Many of these are not free, which these days is means unusable. Some have custom software to do the configuration. Ideally one should just be able to get themes online and set them using the default WinXP setup shown above.

There had to be an easier way, I found it with Multipatcher - here's how to use it:
  • Get the software here (file is uxpatcher.zip), currently it is at version 5.5. Note that this software will only work on Windows XP/SP1/SP2 or Windows Server 2003 (with Themes enabled)
  • Unzip this to get the file UXTheme Multi-Patcher 5.5.exe. Run this program. This edits the Windows dynamic link library file uxtheme.dll, so that it can accept theme files that have not been signed off by Microsoft, otherwise any other theme files will not be recognised.
  • On running you will get the following dialogue widow:

  • click the 'Patch' button to go ahead with the install. Following window will then appear:

  • This checks out your windows system. Click the 'OK' button. A new window will appear:

  • This warns you about the Windows File Protection dialogue appearing. I'll explain about that further, for now click 'OK'. Next window is:

  • To restart the computer after install, click OK. Make sure any unsaved work on your computer is saved before doing so.
  • Before you restart a Windows File Protection dialogue may appear:

  • For which click 'Cancel', or the following may appear:

  • for which you can click 'Yes'
  • If you are uncomfortable with patching your uxtheme.dll file, note that running this program again will un-patch the file.
Installing Themes
  • You can find WinXP themes at varous online locations such as - here and here.
  • To install these, put the *.theme file and any associated folders in C:\WINDOWS\Resources\Themes
  • Then double-click on the file *.theme and it will open in the standard Display properties window shown above. Choose the theme and click 'Apply'.

Feb 5, 2007

Google bomb: from Bang to Fizz



It took an entertaining event to bring this concept to my attention. All of you know how when you search for something on Google you get a list of results. Now, what comes at the top of that list tends to get associated with that search. So, if you search for apple on Google, what do you get? The local fruitseller's location? No way - the whole list shows links to Apple Computers Inc., the famous seller of iMac, iPod etc. In the internet world this may seem all right, but for a non-technophile this is ridiculous.

These lists are formed by Google's programs based on their analysis of the web (see, I'm not referring to a spider's web). One of the program's methods is to analyse all links (the words with underlines below them, which on clicking lead somewhere else) and where they lead to. So now the Google program has found that the majority of 'Apple' links lead to the company. This causes Apple Inc. to appear top of the Google results list, rather than say 'apple' which leads to a shop where you can get apple products.

Such distortions or conflicts are happy ground for the techies with a sense of humour. Now, they realise that if several hundred of them (at least) set up a bunch of links over several web pages that they control, such as set up 'orange' which points to Apple Inc. this will help shift the Google search on 'orange' to show Apple Inc. at the top of the results list. This is a Google bomb.

Now, the entertaining event. Some time ago, several wits got together and decided that let's create links all over the place to connect to the official George W. Bush biography from the US White House web site with a couple of words. And the words chosen? - 'Miserable Failure'. So now if you, for some reason, were to write 'miserable failure' in the Google search box, you will get the white house as the first result in the list. No kidding! There are more details on this here.



Other Google bombs:
  • google search on "French Military Victories" ...



Show's over. All these had been working since 2004, but apparently changed recently when Google has reworked it's programs to avoid this discrepancy. So now, if you were planning to create your own google bomb, you'll have to find some other way.