A sensation of wonder about technological developments

Putting aside hype and advertising, every news we get about new developments usually plays with our sense of wonder. It's a common thing to admire the way someone solved what was previously a limitation. The funny thing is this can be true even when faced with things we normally consider evil, because we can see that the application of the technology is different from the way it was used.

This happened to me while researching data about how to detect if your computers are members of botnets. I came upon a series of data that appears to be a timeline of bot control methods, and I can say it is great to see how the apparent generations work. Let me tell you a little story about it.

In the beginning, we had the direct control. One user infected specific computers and send direct commands to them. It's obvious to note that direct control has a limitation about how many computers it can control, the user. As each computer has to be given a command, it becomes difficult to control large groups. Here comes automation to the rescue. By scripting, the user could now control a great amount of computers, but only if all did the same thing at the same time, every time the same.

It was then time for a new innovation: Cascade Control. With Cascade control a user needs to control only primary nodes (infected computers). A second group of nodes (also infected computers) receives it's orders from the first node ones, and so on with different node levels. This method is great to control several groups that each do a different thing, but begun a pair of different problems: detection and feedback. A cascading user generally has feedback on the first node computers, but usually lacks that same feedback from the second tier and beyond. This means that he could be trying to control a healed computer without knowing it, and if it's being actively monitored after the healing, it could be dangerous.

Thus, to enhance feedback and avoid detection a simple method was devised. Every infected computer had a mini ICQ client inside the infected programs, complete with a username and password, different for each bot. So, upon connecting to the Internet, the bot logs onto ICQ, and waits. When the attacker decides to launch an attack, he simply logs with an ICQ account that has all the rest registered as friends. Now he can write messages to groups of users and everyone gets the same message that contains a command, and can answer back. This solved several problems: now the infected are the ones that report back even before starting any attack, and only the infected connect. But, of course, the number of friends you can message at the same time was low, thus leading to a different but similar method for control.

It was time to go for an old protocol. By mounting a channel on an IRC server, the user can now see which bots connect with their built in IRC clients. IRC supports real massive plain text messages, so it seems like a match made in hell. Now the attacker can issue a single command and be listened by hundreds of infected nodes. Logically, feedback now becomes burdensome, as hundreds of users talking back at the same time can be a little too much. But not every command needed feedback, as infected nodes can declare their presence by connecting to the chat room. When IRC sites begun to being policed to prevent this, it was time to move on, and they did.

The next target was a completely unsuspecting one. Now it was time to evolve into social networks. The target was Twitter. With a simple sub 140 characters command, a user can make Twitter servers to relay this command to all his friends. If all his friends are bots with twitter clients and accounts, we have a new evolution. This time it gives back some feedback and some timing adjustment (as the delay introduced by the twitter servers are unknown and variable)but gains a simply astoundingly massive control method.

So, after all this reading, one thing becomes clear: knowing where our computers are connecting to can become the difference to detect infections. Later developments seem to favor built in messaging clients with login data. This means that those bots are connecting as we connect the computer, even when not being part of any attack, only waiting forever, making it easy to spot this with any port scanner.

Changes in Project Wonderful

I have another blog, a Spanish one, called Demasiado Personal, where I have the Project wonderful ads I plan to get here sometime in the near future. Lately it seemed like the ads weren't coming at all, and I thought it was because of the world wide economic crisis. Turns out I was wrong. It had to do with a change in Project Wonderful.

The new system divides the world in four areas, 1) United States, 2) Canada 3)Europe and 4) Rest of the world. This is possible because Project Wonderful now does geoip, and through it geotargeting of their ads. So people from each area only sees the ads paid for that area.

This means that although I don't see ads in my blog, I have ads in different parts of the world, and that ads keep on making money for me. Even more, if I get ads in more than one area for the same space, I receive money from both, which is really neat. Now I have 4 ad channels in each ad space, multiplying my possibilities.

I also noticed something else, even when I got ads in other areas, I could get no ads in others, and it's a little ugly and discouraging form people to see the empty ad spaces. So I made a suggestion to Project wonderful to get the winning ad in other channel shown in empty channels, and I threw in some ideas about how to manage two winning bids in different channels (since only one can be shown for free in other areas). Ten minutes later I received an answer telling me that it was an interesting proposal and that they were going to discuss it with the development team.

Of course that made me happy, because not only I have more chances, I also have a ad supplier that knows how to listen, a rare commodity nowadays.

Linux format frees cover art

Due to the ammount of people asking for it, the Linux Format magazine has decided to release it's cover art as Wallpaper. This wallpapers are freed under a Creative Commons licence, similar to the one that protects and frees this blog contents.

This licences are copyleft type, quite similar to the GNU licence, which means that as long as some simple conditions are respected, the content is completely free. So, if you respect them, you'll receive respect and confidence in return. This is what Copyleft means (which make it's opposed to copyright)

I've already downloaded and have one of this wallpapers installed. It's the wallpaper number 4 that rotates every 16 hours (this is a feature of KDE4.x, which is default in my Kubuntu). This wallpapers where you can see great artwork, with an attention to detail that adds to form the whole picture.

I highly recomend them, so visit the page where this wallpapers are released, and remember to ask for the ones you want that are still not featured, as they will add them when asked for.

A new type of brute force attack

Till now, it was easy to spot brute force attacks. A brute force attack is one where attackers are using dictionaries to try and guess correct combinations of username and password.

As those dictionaries are really long, this type of attack used to be easily detectable, because the attacker had to put a big part of his machine to the task and so he tended to do a lot of attempts per second, so this was easily spotted by most firewalls.

But since the the technology to herd large zombie computer farms was developed, this is changing in a subtle way. For better understanding, a zombie computer is a dormant infected computer, and has inside a virus, worm, rootkit or back door that allows the attacker enter and use commands from that machine as if it were his own.

A zombie computer farm is a group of dormant computers infected by the same person, so he can make this group of computers send massive quantities of spam, a little each one. He also can use them to host webpages with ilegal content, whithout risking being traced. The last use was a joint attack to some server, trying to get a Denial of Service provocked by the sheer ammount of virtual attackers.


However, once more this evil minded people have shown they have brains up there and know how to use them. Using zombie computer farms, they aren't using them to do mindless ping attacks. They are now using them in a step by step kind of attack, where each zombie uses a small part of a far bigger dictionary to do spaced attempts.

So, instead of getting a lot of quick attacks from a single IP, now we get tens, hundreds or thousands computers, each one slowly and patiently testing a combination of username and password.


This is almost impossible to detect by automatic means, you need to do a manual revision of firewall logs to check the attempts to access the system over a long time to detect the pattern. Luckily, there's some hope. Most zombies seem to come from a pretty limited range of IPs, so the people over at Begin Linux posted a method to block most zombie machines with iptables, using a list of offending IPs gathered by spamhaus.

Consequences of open software and hardware

Maybe some of you believe I'm some kind of blind fanatic , and that's not true. I recognize when a closed program has details that I like (my friends have seen me praising some little details I like about Vista). Nontheless, I can't stop seeing along the things I like those other things I dislike and I can't change because it's closed software. That lack of freedom is the main reason why I keep on writing about open stuff, things that give us the freedom to change them the way we want. There I see the future.

Let's start this article after the necessary introduction. A little time ago, I wrote about Open Hardware. You'll recall there was a special mention to the Arduinos, because there were a lot of them and I didn't want you thinking there were the only things in that page.

Today something surprised me in a pleasant way, and it was related to those Arduinos. I found a webpage called diydrones (Do It Yourself Drones) which basically deals with unmanned vehicles we can build ourselves, in a reduced scale.

There you'll find a lot of different projects with different types of hardware, but there are two that receive special care in the site: ArduPilot and BlimpDuino. I think you'll understand why those names rise some special emotions in me.

BlimDuino is in development stage, soon it will be released, with kits for sale, and release of the arduino hardware modifications back to the comunnity. ArduPilot is already on production, with kits on sale and open hardware released.

What are this two projects for? ArduPilot is a authomatic pilot for miniature planes which handles navigation by GPS, control of the ruder (direction) and throttle (altitude by speed control). There's more coming through, a new version is being developed, called ArduPilot Pro, and this one will also control ailerons.

BlimpDuino is just fabulous. It's a control for blimps (small dirigibles, or small airships, as you prefer). There's a demo video of a blimp being indirectly controled with infrared markers in the room. In the video you can see the way the motors tilt to gain or loose altitude, how it makes them turn in one direction to gain speed and in other to loose it, how it uses them to turn. It's wonderful to think how little it takes for this blimp to take it's own decisions based on the situations we put it through.

I don't know if this is havving any effects on you, but after seeing this I've gained a lot of respect for the Arduino platform and it's possibilities. Besides, I can't stop noticing what can be achieved with open hardware and software and inventiveness. Don't you see a small scale glimpse of the future in this developments?

Law Problems: lack of understanding

Today I was reading an excellent article in Groklaw where I learned about the case of a teenager that killed herself (apparently because of peer pressure over the Internet)

What raised my attention was that they are convicting someone accused of actions against the Computer Fraud & Abuse Act. This law was written in the United States with the purpose of punishing those that gain illegal access to internet sites or do abusive things with their computers, clearly meaning hackers, crackers, spammers, virus distributors, etc. Not peer presure.

This is a worrisome issue, because the person charged didn't do any of those things. She simply lied while creating her MySpace profile. This is against MySpace's TOS (Terms of agreement ). What they are trying to do is raise this break of agreement (written and interpreted by MySpace) to the status of federal felony.

I'm going to try to make you understand what this means. Suppose that I said somewhere in this blog that I don't want any kind of Spam in it. Now someone spams in one article's commentaries. According to this interpretation of the law, I'd have the right to criminally acusse him just because of an arbitrary policy created and interpreted by myself. Quite disproportionate, isn't it?

Anyway, I'm not from the United States, and this article isn't only for United States people. It also isn't a detailed description of the case, for that check people that know about law, like Groklaw. This article is here simply to make yourselves aware.

If we let each of our contrie's legislators make the laws they want, if we let advocates and judges use them badly, it will be us, the ones that have computer knowledge, the ones left with a great share of guilt. That would be because we didn't show our disagreement, we didn't document the problem with technical knowledge non technical people can understand. We just kept on sitting in our comfy chairs while people without the knowledge or understanding of the real issue did what it was within their reach.

Think about it. We are living in a time where legislations are being made about what we do in Internet and what we generate with our computers. Can we afford the luxury of let them do whaterver they want, or simply whatever they can do with their limited knowledge?

Open Hardware

Since I remember there have been free access electronic circuits, I remember electronic magazines including several projects each issue. But lately this trend has gone further.

Internet has given normal people the capacity to put things so that others can check them, so when applied to electronics we find a clear improvement: we are not limited to the things we can put in a magazine, neither are we limited in the level of knowledge needed to use the electronics, as usually are the magazines that are intended for a certain audience.

So new ways of distribution of knowledge are opened as a lot of circuits more or less completed, more or less complicated, are published with freedom in mind, with the freedom to use them for whatever we want (indeed, several of this projects allow even commercial applications).

Thus it's born the category known as Open Hardware projects. It's a step beyond of the Open Software concept. Here communities are born around the use, modification, improvement and redesign of advanced circuitry. There are several sorts of circuits, ranging from general purpose to ultra specialized, from a big majority of exposed circuits to a full fledged modern cellphone.

I'm a programmer, so I admit I only made baby steps into electronics, that's why I can't do anything but admire this marvelous things we are freely offered. We are given the freedom of buying them, of buying components and building them. We also have the freedom of developing from them and, if we want, we can release our modifications to the community, thus making bigger the list of Open Hardware devices and their capabilities.

A little advice: the page where I dicovered this is ordered by alphabetical order, so you'll see a lot of Arduino devices first. Don't worry, there are a lot more things below.

Creative minds, a pity they are evil

It's really worrisome to see the way the malware and spam business is evolving, but at the same time it's impressing to see they skills they use to defeat each measure taken against them.

Social engineering is being fabulously applied by this groups, they have distributed content making people think it was completely safe, using ingenous and intelligent ways.

But todas I bumped into a news story that made me laugh at the same time my mind raced behind the implications. There's now a little program for Windows that has a female stripper that undresses if we do what she asks.

She doesn't ask too much, only that we correctly write some quite deformed words that she shows us. If we write the correct word, she strips a little more and shows another scrambled word. This appears quite harmless, but this is just an appearance, under the hood things become more sinister.

The deformed words don't come from an internal list, they don't come from the site of the programmer. The deformed words are taken from thousands of websites that use that sort of control words to stop the spambots. So, every time someone writes one of this words, it's fed unto a spambot that was trying to connect to a site, so that it can pass this security measure and drop it's hated payload.

On one side, I really despise what spammers do, contaminating our lives. On the other hand, I salute them for the sheer creativity they showed to pass the captchas.