Panayiotis Mavrommatis

Zero Day by Mark Russinovich

2011-04-04T00:33:00.000-04:00

The book Zero Day is an instant computer security classic. Unlike The Cuckoo's egg (which I also recommend), Zero Day is a fictional story, but not at all less plausible.

It's very fun to read, with a captivating plot. I kept flipping to the back cover making sure I remembered correctly, that the author is a computer security expert who wrote sysinternals, a hardcore system administration tool for Windows -- He may well have been a professional novelist.

Its target audience is not limited to computer professionals, but computer geeks should really enjoy it. When it gets technical, the author does a great job at explaining the terms, and the technical parts are extremely accurate. I'm quite familiar with the technology though, so I'm probably biased -- others might find it too technical for their taste.

The threat of attacks against big Western companies isn't imaginary -- RSA and Google among many others have been the targets of attacks just like the ones described in the book. When the purpose of the attack becomes destruction, the story is certainly more interesting.

Estimating web malware infections

2011-03-31T03:34:00.000-04:00

Many reports on web malware infections tend to use Google queries to estimate the impact of the infection. The latest example comes from Websense.

I don't recommend using Google's "About ... results" to estimate the number of infected URLs. Clicking through the search results, the estimate changes dramatically. What seems to start as "About 533,000 results" at some point drops dramatically to "Page 38 of 374 results"

These result pages change very fast, you might hit the "end" of your results in a different page than I did. This number is not accurate either -- Search result pages typically limit the number of URLs they return per site.

That's one reason I'd be cautious of this method. The other reason is perhaps more fundamental. A search engine does not index HTML tags, only text between these tags. So a query for "<script src="http://lizamoon.com/ur.php" does not necessarily yield pages infected with that script -- but mostly pages where the infection was unsuccessful, and that tag appears as HTML-escaped text. The blog post from websense actually illustrates this:

This is not a script include -- it's text, and in this case, harmless. Some of the infections might actually have worked. As the first image shows, 2 of the results are marked as "may harm your computer" by Google.

Google offers a different way to estimate infections, the Safe Browsing Diagnostic page. For this site, at the time I fetched the page, it reported that 5 sites were infected. That's not to claim that the diagnostic page is the most accurate estimate out there, but I work on the team and I trust it :).

Eddie Izzard on Software Updates

2011-03-23T00:19:00.000-04:00

Awesome clip from Eddie Izzard about software updates, terms and conditions, and of course iTunes.

How to open a temporary text editor in Chrome & Firefox

2011-01-20T01:14:00.000-05:00

Open a tab, type this in the url bar

data:text/html,<pre contenteditable="">type here</pre>

You can bookmark it for faster access. Hint courtesy of Tab Atkins.

Seismos: A seismograph app for Android

2010-12-24T12:38:00.004-05:00

My brother wasn't very fond of the existing seismograph apps for Android, so I made one according to his requirements (namely, one that shows all 3 axes at the same time).

The development was surprisingly easy -- I'll publish the source code soon -- but it was very straightforward and done within essentially 1 day.

It's probably a bit buggy and slow (at least on the Nexus S). I've tested it on a G1, Nexus One, T-Mobile MyTouch 3G slide, and Nexus S. I'll address the speed issue in the future. To give it a try, you can download it from the Android Market (Search for "Seismos")

Old but classic.

2010-09-19T13:07:00.000-04:00

Geeks will get it. This was taken at 1234567890. I guess we are already at 1284915948.

Photo by Niels. Michalis was there too.

A few tips to stay malware-free online

2010-09-16T20:17:00.000-04:00

Niels and I posted a few tips on staying safe online, since there's a bunch of exploits in the wild right now. Here's the snippet:

Keep your OS, browser, and browser plugins up-to-date.
Run anti-virus software, and keep this up-to-date, too.
Disable or uninstall any software or browser plug-ins you don’t use — this reduces your vulnerability surface.
If you receive a PDF attachment in Gmail, select “View” to view it in Gmail instead of downloading it.

Full post on the Google online security blog.

Also check out a post of mine on avoiding this and future PDF 0-days

Boombox.gr, a Greek music site

2010-09-14T01:32:00.003-04:00

Remember jykebox? Yiota and I decided to fork it and repurpose it for Greek music (but also non-greek music that's popular in Greece :-)). Check it out!

FlashBlock for Android (not needed)

2010-05-23T16:09:00.001-04:00

I've been testing Froyo (Android 2.2) for about a week now, and in particular Flash in the browser. Lots of sites with embedded videos now work great, which is awesome. As a side effect some rich media ads now show up as well, and on a phone that can be non-optimal.

I was thinking that sooner or later a browser would launch with a "flashblock" feature. Fortunately that's not necessary ... the android browser itself provides this functionality.

- open the browser
- Menu
- More
- Settings
- Enable plugins
- On demand.

An icon appears in every embedded flash object. When you click it, the Flash object plays.

Honeybot, Your Man in the Middle for Automated Social Engineering

2010-04-28T00:21:00.003-04:00

Tobias Lauinger et al. presented a fun and interesting paper today at USENIX LEET 10

Titled "Honeybot, Your Man in the Middle for Automated Social Engineering", the study shows how chat bots can become much harder to detect. The paper is available in PDF

Chat bots log in to chat rooms and initiate conversations with users. They try to get the user to follow a URL and maybe download and run a program, or provide their credentials to a phishing site. Or plain old spam.

In any case, it's relatively easy for human users to tell spam bots from real users, because the responses are generated by a program, and as we know, it can be hard to appear like a human.

Instead, the chat bot initiates a conversation with user Alice, and one with Bob. The first message is something simple such as "Hi". The response from Alice is then forwarded to Bob, and Bob's replies to Alice. The bot simply acts as a man in the middle. Alice and Bob have a real, human conversation, but for all they know they are chatting with a different user, with a nickname that's "neither female nor male" :) At some point in the conversation they would throw in a URL and see if the users would click it.

The funniest part of the paper comes in Figure 2, where the authors have instructed the bot to change gender-related words in conversations from male to female. Because most of the users in the dating site they were experimenting in were male, the conversations between 2 men ended too early. So the authors changed conversations such as "Are you a dude?" to "Are you a chick?" The click-through rate increased significantly :)

Batch transcoding images for GTA-316 (Google Picture Frame)

2010-01-04T09:26:00.006-05:00

Google sells / gives away digital picture frames with some third-party software that's as ungoogly as it could get.

In particular, the JPGs you can add to it need to be of a certain "format" that a certain proprietary, windows-only binary (SunPlus PMP Transcoding Tool) knows about.
The tool was probably written in Visual Basic and is completely useless if you want to transcode more than 2-3 images -- it takes 4-5 clicks per image, no batch support etc.
Some forums mentioned that Microsoft Paint (!) was able to transcode the files successfully too. So I tried something more sophisticated (GIMP) which turned out to work as well, given the following settings:

Open the original
Resize / crop as needed (I recommend resizing to 640x480 so you save space on the limited capacity of the device (24MB)
File > Save as
use JPG if it's not already JPG
In the "Save as JPEG" dialog, expand the "Advanced Options" and uncheck everything (no Optimize, not Progressive, no EXIF data, no thumbnail). I don't know exactly which combination of these metadata the device does not support, but disabling all of them has you covered.
Hit "Save"

That's of course not faster than Paint or PMP transcoder tool but at least it works on Mac and Linux, not just Windows. The other advantage is that you can turn this into a batch process using a GIMP Plugin, for example: DBP: http://members.ozemail.com.au/~hodsond/dbp.html I tried it on Windows but in theory this works on all platforms but needs compilation. There are probably more GIMP plugins that could work as well.

The batch process plugin also lets you define a particular output folder, renaming options and output options, where again you can disable any metadata in the JPG.
Then copy the output images to the PHOTO directory of the device, reboot the device, and enjoy.

3G and gprs for cyta/ cytamobile and android

2009-12-19T17:14:00.004-05:00

I gave my dad my old Android phone (T-mobile G1). After a lot of search we managed to get it to work with Cyta's 3G network. First we called Cyta on 132 and asked for a data plan. For €9/ month you get 200MB, which is probably decent. They also have more plans for more bandwidth. The next day we called again and confirmed our account was ready They told us that we had to setup the phone as well. They gave us some instructions for the HTC touch which is a WinMo phone and they almost worked. We could connect to websites but only via their proxy and only via HTTP. HTTPS and native phone apps (talk, gmail, etc) did not work.

For reference, the instructions that you should NOT follow are the following:

APN cytamobile Proxy Port 8080 -- these don't work

Here's the instructions that do work:

APN: internet . Nothing else. Enjoy!

Cytanet traffic shaping

2008-09-01T05:28:00.004-04:00

Cytanet is no longer a monopoly for broadband in Cyprus in theory, but everybody still uses them since they are stuck with them. It's sad to see they are throttling traffic so blatantly:

Upload to Picasa with a theoretical 16kBps limit: 5kBps
Upload to Picasa, but via VPN: 14kBps

Otenet sounds like a better choice (at least based on the user reviews)

Send all files in a directory to your gmail

2008-04-05T19:16:00.006-04:00

Sends all files in the current directory to your email. Reads the subject and your gmail password from the console, and sends an email for each file

#!/usr/bin/python

import os
import smtplib
from getpass import getpass 
from email.MIMEMultipart import MIMEMultipart
from email.MIMEBase import MIMEBase
from email.MIMEText import MIMEText
from email.Utils import formatdate
from email import Encoders

USER = '<user>@gmail.com'
PASS = getpass("Password for %s: " % USER)
SUBJECT = raw_input("Subject: ")

print "Connecting to server"
server = smtplib.SMTP('smtp.gmail.com', 587)
server.ehlo()
server.starttls()
server.ehlo()
server.login(USER, PASS)

print "Subject is %s" % SUBJECT

for f in os.listdir('.'):
  msg = MIMEMultipart()
  msg['From'] = USER
  msg['To'] = USER
  msg['Date'] = formatdate(localtime=True)
  msg['Subject'] = SUBJECT

  part = MIMEBase('application', 'octet-stream')
  part.set_payload(open(f, 'rb').read())
  Encoders.encode_base64(part)
  part.add_header('Content-Disposition',
                  'attachment; filename="%s"' % os.path.basename(f))
  msg.attach(part)

  print "Sending %s" % f 
  server.sendmail(USER, USER, msg.as_string())
  print "Done" 

server.close()
print "All Done"

Exploring OpenSocial

2008-02-17T17:14:00.003-05:00

Fivos and I spent some time hacking an opensocial app yesterday. We want to use features such as list the owner's friends, persist data about the owner, retrieve data about the owner's friends (those who use the app) and then display all these in a fun/useful way. We are eager to test it, and because most sites "whitelist" apps or developers, i.e. a guy has to read our email and it's a long weekend, we were basically unable to so far ...

hi5: persisting data is mocked out
orkut: whitelist request made ...
myspace: whitelist request made ...
ning: works! no wait ... it doesn't. it's only up to version 0.5 so far, and it must have a bug with persisting data -- a very weird one.
plaxo: whitelist request made ...

Which leaves us with waiting for a whitelist approval, which might force us to actually not code this weekend. horrible! not code on a weekend! what else can we do?

USB Frappe mixer

2007-11-10T17:14:00.001-05:00

Our Project Vouzounos was featured in a Greek gadgets blog. More information on the project's homepage. Here are the videos, on YouTube this time...

Istos Dyo Teleia Miden

2007-05-10T02:17:00.000-04:00

Web 2.0 translations in (Cypriot) Greek.

Thanks to Marios Assiotis of course for some of these

Do you SpeakGeek?

2006-10-11T02:27:00.000-04:00

I have begun posting some sketches of "fun and interesting" computer science terms such as

man in the middle
man behind the curtain (!)
blue screen of death

to SpeakGeek.blogspot.com. Take a look, leave a comment...

Peer to Peer Identification Paper

2006-04-23T20:53:00.000-04:00

A class project "Identifying Known and Unknown Peer-to-Peer Traffic" in 6.829: Computer Networks by me and Fivos Constantinou was accepted in the IEEE NCA 06 conference.
The project's webpage contains a draft of the paper, an early presentation as well as source code and detailed results.

EPC Global network: A formal specification of EPCIS

2006-01-01T03:28:00.000-05:00

A formal specification of the EPC Information Service component of the proposed EPC Global Network. The EPC Global Network aims to enhance the global supply chain with Radio Frequency Identification (RFID) technology, by providing real-time information about items as they pass various points in the supply chain. A formal specification as well as a scalable, fault-tolerant, reliable and highly available implementation are given, specified formally in TIOA.

EPC Formal Specification [PDF]

Peer to Peer Identification (2005)

2005-01-01T03:29:00.000-05:00

A new approach for P2P traffic identification in large networks, using only transport layer headers and fundamental characteristics of P2P protocols, such as a large network diameter and the presence of many hosts acting both as servers and clients. We identify both known and unknown P2P protocols in a simple and efficient way. P2P Identification Homepage

B-tree implementation (Java)

2004-05-01T03:48:00.000-04:00

In March 2004 I joined the Theory of Distributed Systems Group in MIT's LCS as an undergraduate assistant. My first job was to provide a new data type implementation in the IOA Toolkit. I was also taking 6.046 at the time and for some reason I thought implementing a B-tree would be a good idea. 1000 lines of code later I realized it was probably not such a great idea. The code even has an abstraction function and implementation invariants checked in a checkRep() method:

Java implementation of a B-tree (BTree.java)

TIOA Simulator (2004-2006)

2004-01-01T12:00:00.000-05:00

The TIOA Simulator can test a distributed system specified in the TIOA Language. With TIOA, one can specify, test and verfiy complex distributed systems with guarantees of correctness, performance, fault-tolerance and availability.

The TIOA Simulator simulates execution of primitive and composite automata, and displays the results in both a "trace" output as well as in a graphical user interface. Screenshot:

Download and Install the TIOA Simulator
Documentation: TIOA Simulator Thesis [PDF]

Project Vouzounos

2003-09-01T03:44:00.000-04:00

Vouzounos is the codename for our modified frappé mixer. See more about the the greek coffee frappé in the Wikipedia article.

Before becoming Vouzounos, the mixer was a traditional frappé mixer as the ones sold at Parthenon Foods.

As both I and Fivos were taking 6.170 (MIT's hardcore software engineering class), the reduced efficiency of the traditional mixer was simply not enough to satisfy our coffee needs. And so Project Vouzounos evolved:

Version 1.0-alpha (Sept 2003)

The battery compartment that supplied 6V to the motor was disconnected and the power adoptor from Fivos's laptop was used instead (15V DC). Result: Very powerful and efficient, but the motor fried after about one week

Version 1.0-beta (Oct 2003)

Replaced old fried motor with a new one (12V input) and the laptop adapter with a new one (12V 800mA output). Also removed the capacitors and resistors that for some reason were inside the mixer.
Difficulty: New motor's shaft was thicker than old one's. Overcame by extremely hi-tech moves. (push front shaft into the motor shaft until the shaft comes out from the back of the motor)
Difficulty: New motor is bigger. Won't fit in nice blue cover. Overcame by putting a lot of tape around it. Result: Ugly cover but worked great:

Photos of Vouzounos beta:

Version 1.0 (final)

We observed that the need to drink coffee was directly related to the hours spent working on programming assignments on our laptops. This observation, along with the fact that requiring a plug for Vouzounos to work was annoying, motivated our decision into making Vouzounos portable.
By coincidence, the webcam of Fivos's sister Lenia became malfunctioning, so the idea of using the USB cable from it seemed perfect. Moreover, why not also use the sleek, sexy spherical webcam cover for the mixer as well? The result: USB Vouzounos.

Photos of USB Vouzounos:

Videos of USB Vouzounos at work:

3D Gizmoball (Java)

2003-01-01T03:48:00.000-05:00

3D Gizmoball allows you to design and play your own pinball boards. Our (Fivos Constantinou, Panayiotis Mavrommatis, Velin Tzanov and Chex Xiao) version also runs the game in 3D and won the artistic award. Screenshots :

3D-Gizmoball.zip

IOA Compiler (2002)

2002-01-01T00:00:00.000-05:00

Chryssis Georgiou, Nancy Lynch, Panayiotis Mavrommatis, and Joshua A. Tauber, Automated Implementation of Complex Distributed Algorithms Specified in the IOA Language, in the Proc. of the 18th International Conference on Parallel and Distributed Computing Systems (PDCS 2005), Las Vegas, NV, 2005.
MIT Technical Report [PS]
IOA Homepage