Brian Hall

Microsoft Introduces the Xbox One

2013-05-21T13:14:00.000-05:00

Microsoft unveiled its next generation game and entertainment console today: Xbox One. An interesting change is that even though the Xbox One has a Blu-ray drive, you will only use game discs to install the game once onto your Xbox One. It will be interesting to watch to see how this change affects video game rentals (such as the video game rental services offered through RedBox and GameFly).

The Xbox One features an updated, boxy, yet sleek, design, a new controller, and features an updated Kinect device and voice controls. The Verge reports, "On the hardware side, Microsoft has included 8GB of RAM, a single custom 40-nanometer chip with an 8-core CPU and GPU system-on-a-chip, and a custom 500GB HDD. The system-on-a-chip is made by AMD and Microsoft designed its own HDD in-house."

(Source: The Verge)

Synology DS112 Review: A Solid Media Server and Network Attached Storage Device

2013-04-11T12:07:00.000-05:00

I needed something to store and access backups of family photos and important files on my home network. We shoot a lot of family photos and videos, which we like to watch either from a notebook/tablet connected wirelessly, or on our TV through our PlayStation 3. I recently purchased a Synology DS112 network attached storage (NAS) device from B&H Photo for about $200 in February 2013. The DS112 is a very solid NAS device that performs very well as a media server (DLNA/UPnP), as well as a local network file share--although it is not perfect.
Read more »

The Beach Boys Shred - I Get Around

2013-03-25T08:44:00.001-05:00

The original was taken down. Here's another one, which probably won't last long: http://www.youtube.com/watch?v=xYc4DT18EJg

Generate Retro Atari-Like Sounds with the Atari Punk Console

2013-01-14T12:00:00.000-06:00

The "stepped tone generator," or Atari Punk Console (APC) as it has been dubbed, is a fun electronics project for anyone looking to get into electronics or build something fun. The APC generates adjustable, retro style, synth square waves, similar to the sounds of the classic Atari game console. Over the last few days, I have built my version of the Atari Punk Console using proto board, a project enclosure from Radio Shack, and other components ordered online. You can also buy APC kits with all of the parts included, and the schematics are widely available.

Atari Punk Console schematic courtesy of Jameco Electronics

It has volume control, and a switching 3.5mm audio output jack, which shuts off the internal speaker when plugged in. It is controlled with a basic on/off toggle switch, two 500k Ohm potentiometers, as well as a momentary pushbutton for more control, and is powered by a 9V battery. Once it was finished, I had to fight to get it back from my kids!

Good deal: 16GB USB 2.0 Flash Drive $5.99 Shipped

2012-12-01T11:45:00.004-06:00

Best Buy has a 16GB USB 2.0 flash drive for $5.99 with free shipping.

MacBook Pro 13" (latest version) $962.54 on Amazon [u]

2012-11-22T18:46:00.002-06:00

Amazon has the latest MacBook Pro 13" with a 2.5GHz Intel Core i5 processor (Ivy Bridge), 4GB RAM, and a 500GB HD for ~~$1,034~~ $962.54. It's not the MacBook Pro with Retina display, nor the slimmer MacBook Air (neither of which are upgradeable), but I'm seriously considering jumping on this. I think that down the road I would upgrade the RAM to at least 8GB and throw a 256GB SSD SATA 3 drive in it. What do you think, folks?

Here are the specs:

Screen Size	13.3 inches
Max Screen Resolution	1280x800 pixels
Processor	2.5 GHz Intel Core i5
RAM	4 GB DDR3
Hard Drive	500 GB
Graphics Coprocessor	Intel HD Graphics 4000

Update: Best Buy is also offering the same $1,034 deal. While Amazon's price dropped from $1,034 to $962.54.

Update (11/23/12, 4:23 pm): The price on Amazon dipped to $962.54 briefly, then jumped back up to $1,034. Amazon's prices tend to fluctuate. Utilize CamelCamelCamel to set price alerts for a pre-determined price for a product on Amazon.

Sweet deal: OCZ 256GB SSD $130

2012-11-14T09:39:00.000-06:00

Here's a sweet deal for an OCZ Agility 4 256GB internal solid state drive (SSD), SATA III, 6 Gbit/sec, 2.5" for $130 after rebate from TigerDirect. Breathe new life into that aging laptop for not very much money!

iPhone 5 screen distortion

2012-10-17T22:10:00.002-05:00

I noticed something strange with my iPhone 5. When I apply light pressure to the screen, the image on the bottom left distorts. Anyone else seeing this? Might be time for a trip to the Genius Bar.

Coordinated Quadcopters Playing Catch

2012-10-04T21:06:00.003-05:00

The engineering and genius that goes into making this happen is so awesome.

Glitchy/Crazy iPhone 5 Keyboard

2012-10-01T09:57:00.005-05:00

My friend and his wife have this strange issue with their iPhone 5 (Sprint) keyboard. Whenever it prompts him to enter his password for iTunes or for the App Store, the keyboard looks glitchy and strange as shown in the video here:

My wife and I haven't seen this issue on our iPhone 5's yet. Apparently, this guy had the same problem on his Sprint iPhone 5, and someone at the genius bar told him to reinstall iOS 6, which apparently fixed the problem. I wonder if it's isolated to Sprint.

iPhone 5S Gag

2012-09-13T11:03:00.000-05:00

Not sure where this came from, but my friend tweeted this and I thought it was hilarious.

Map of the global undersea fiber optic infrastructure

2012-07-17T13:31:00.000-05:00

Greg's Cable Map is a fun and interesting site that shows the global infrastructure that links our world together via submarine fiber optic cables. The site shows the landing sites and different capacities of each line.

How to fix insecure password storage security in a database

2012-06-13T17:09:00.002-05:00

Jeremy Collake has a great post that describes a simple, elegant solution for migrating a weakly-encrypted password field in a database. LinkedIn's password database was leaked recently, and it turns out that all they did to secure user passwords was run them through a very well-known algorithm called SHA-1, which doesn't take much to brute force and recover passwords. They did this without adding any "salt" or uniqueness to the algorithm, making it trivial to brute force using a rainbow table.

To add a more secure algorithm without requiring the users to login, simply "hash the hash." Quoting from the article:

So, if the original algorithm was:
SHA1(password)
The new algorithm would be, hashing the hash:
SHA2-512(SHA1(password))

On user login, of course, you simply run the password through SHA2-512(SHA1(password)).

What's significant in the LinkedIn password leaks, is that they didn't add anything to the SHA-1 algorithm when hashing passwords. Ideally, you should apply what's called a "salt" to a hashing algorithm which makes it harder to crack. Taking an example from the article:

SALT^SHA2-512(SALT^SHA1(password))

Obviously, the above examples are simplified, and actual implementation would be different depending on your specific scenario.

This is one way to solve the insecure password database problem. How would you fix it?

Cool stuff from WWDC 2012

2012-06-11T14:38:00.000-05:00

Here are some things that I'm most excited about from today's WWDC keynote:

iOS 6: Turn-by-turn directions (good bye third party GPS apps!), anonymous, real-time crowd-sourced traffic info. The "Can't talk right now...Call you later/Remind me to call" feature in Phone app. Guided Access to disable the home button when my kids are playing with my iPhone. FaceTime over cellular data network instead of WiFi only.

OS X Mountain Lion: $20 upgrade price, buy once, upgrade all your Macs! Power Nap, which fetches data, syncs content, updates system while in sleep mode.
New MacBooks: While the new MacBook Pro with Retina Display looks amazing, there's no way I'm going to drop $2,200 for one. I might, though, take this opportunity to buy a MacBook Air 13" some time later this year.

What are you most excited about from today's announcements?

Look up actual MPG for your car

2012-06-05T09:19:00.001-05:00

I ran across a helpful tool that collects actual fuel efficiency ratings for cars in the US at FuelEconomy.gov. The data comes from actual vehicle owners, and is a nice way of seeing how the car's stated fuel efficiency compares to real-world fuel efficiency. (via MakeUseOf)

Cyberweapons and Stuxnet: Always test your code

2012-06-01T20:01:00.000-05:00

The suspicions of many security researchers were confirmed today in a New York Times article which revealed that the United States and Israel collaborated in creating Stuxnet (codenamed "Olympic Games"), the computer worm that attacked Iran's nuclear centrifuges. The article makes some interesting points and stresses the importance of software testing.

In preparation for deploying the worm, the team build a replica of the Iranian nuclear facility using the same type of centrifuges used in Iran. The centrifuges used for testing were acquired from Col. Muammar el-Qaddafi back in 2003, and were being stashed in Tennessee. After a few weeks of testing, they successfully destroyed some of the units using the computer worm. "One day, toward the end of Mr. Bush’s term, the rubble of a centrifuge was spread out on the conference table in the Situation Room, proof of the potential power of a cyberweapon. The worm was declared ready to test against the real target: Iran’s underground enrichment plant."

After successfully disrupting some of Iran's uranium enrichment centrifuges, an error was introduced into the code that caused the worm to start propagating all over the Internet during the summer of 2010. This just shows us that despite the elaborate testing procedures, even the most skilled programmers can make mistakes. The event grabbed the attention of security professionals all over the world and raised some concerns about the potential harm it could cause to domestic systems. "...No country’s infrastructure is more dependent on computer systems, and thus more vulnerable to attack, than that of the United States. It is only a matter of time, most experts believe, before it becomes the target of the same kind of weapon that the Americans have used, secretly, against Iran."

Coincidentally, this week it was also revealed that a much more complex cyber warfare and espionage program dubbed Flame has already been in use for several years. It is believed to be government sponsored, but to have been produced by a different organization, and may or may not be related to Stuxnet. The details of these events are fascinating, and are only now starting to be more fully revealed. (Source: New York Times, Kaspersky )

Nothing like a personalized, friendly email to make you feel special

2012-05-25T09:08:00.000-05:00

LastPass Wallet

2012-05-17T12:56:00.000-05:00

If you were to lose your wallet, would you know your credit card numbers, and the customer service numbers to call in case you had to cancel your cards? What about other important information in your wallet? LastPass Wallet is a cryptographically secure solution on iPhone, iPod Touch, and iPad for saving and syncing important data should you become separated from your wallet. I've long been a fan of the multi-platform password management tool, LastPass. According to the LastPass,"Wallet stores the data you carry in your physical wallet on your iOS device, so you can securely backup your most valuable personal information to LastPass."

Wallet adds the ability to attach text, pictures, and audio recordings (secure voice recording available within the app--great for creating a quick memo), to your notes. All data will be synced with LastPass in your browser and mobile apps, but attachments are currently only available in Wallet. A quick test drive of the app shows that it is beautifully polished, snappy, and a delight to use.

As with anything LastPass does, security is never an afterthought. "Wallet offers security settings to restrict access to stored data. 'Logout on close' ensures that the active session is killed when the app is closed, while a pin code prompt can be used to re-authenticate when multitasking between Wallet and other apps." An Android version of LastPass Wallet is reportedly in the works as well. (Source: LastPass)

Disinfecting a Windows machine

2012-04-10T08:17:00.000-05:00

I recently received a spam email from a family member with an unfamiliar, suspicious link. This prompted me to reach out to try to help clean up their computer. I recommended changing the email password from a clean, uninfected machine, but after a few attempts at that, the spam email continued. My next conclusion was that there must still be some malware on the machine. Following are some steps that I provided which may be useful to others who are trying to disinfect a Windows computer from a virus, rootkit, or other malware:

Go to Add/Remove programs and uninstall any "extraneous debris," or any software that you simply don't need. Additional software only increases the attack vector for hackers seeking to leverage known vulnerabilities in software.
Download the Windows Defender Offline tool and create a bootable CD or USB drive from a clean, uninfected computer. You will boot to this tool on the infected machine, which will run before Windows ever loads. What happens is that the malware is so sophisticated that it is able to hide itself from the antivirus scanners using what are called rootkits. The Windows Defender Offline tool should overcome that by booting first and rooting out the problem.
Consider running an additional offline scan using the Kaspersky Rescue Disk. Remember to create a bootable USB or CD from an uninfected computer. Follow the instructions to run an offline scan (meaning that you boot to the rescue disk before Windows loads).
If the above two steps are able to uncover any malware and clean it, then boot the machine as you would normally, and launch the Secunia Personal Software Inspector (online). This requires Java, which I normally recommend uninstalling unless you specifically need it for something, since many of the exploits in recent weeks have leveraged an un-patched flaw in the Java run-time environment. This will scan your computer for any vulnerable or outdated software. Apply the updates as recommended, and ensure that Windows Update is configured to automatically download and install any new updates from Microsoft. You should even launch Windows Update to make sure that there aren't any pending security patches.
If steps 2 and 3 fail to find any malware, consider backing up all of your important files to an external USB drive, then reformatting the computer with your system restore disk (Windows install disk). Sometimes, rather than spend hours and days trying to weed out malware, it is better to start with a clean slate. When you re-install Windows, make sure to load Microsoft Security Essentials before doing anything else.
Going forward, make sure to not click on any unfamiliar links in email or open any email attachments, unless it is something you are expecting--even then, open with extreme caution. Be careful about what software you install--is it something you really need, or are you just installing it for fun? Make sure to run files you download through VirusTotal, which scans the file using a large database of antivirus programs.

Make your mouse scroll wheel work everywhere in Windows without clicking

2012-04-05T15:25:00.000-05:00

If you've used OS X or a UNIX/Linux-based operating system for any amount of time, you get used to being able to hover your mouse cursor over any window or scrolling panel area without having to click on it first. Unfortunately, Windows requires you to click on an area to give it "focus" before the mouse scroll wheel will work. For example, take a simple Windows "Open" dialog box:

It can become annoying having to click on windows or other "scrollable" areas within windows. Sometimes, you end up accidentally clicking on a file or some other object just so that you can use your mouse scroll wheel.

I stumbled across a free, highly useful program called WizMouse that works in 32-bit and 64-bit versions of Windows 2000, XP, Vista, and 7 that solves this very problem. Until Microsoft builds a simple feature into Windows to enable mouse scrolling on mouse hover, give WizMouse a try.

Selling software exploits to government for a handsome profit

2012-03-26T14:51:00.000-05:00

A hacker can typically profit from newly discovered software exploits in three ways: 1) receive a small reward by responsibly disclosing the vulnerability to the software vendor, 2) sell the exploit through an underground market, or 3) sell the exploit to a government agency. Hackers often go after vendor payouts or industry notoriety as rewards for discovering vulnerabilities in software and systems. These incentives are often part of a contest where many hackers try to be the first to find a weakness in a program or other system. Underground markets for so-called "zero-day" exploits have existed for a while, and in the past have involved organized crime groups. But, recently we've seen an increasing trend towards selling the exploits to government agencies for even bigger profits. A fascinating Forbes article mentions that a US government contractor recently purchased an exploit for iOS for $250,000. According to the Zero Day Blog:

Hackers today are selling zero-day exploits to government agencies via middlemen who charge a commission for setting up the deal. The organizations don’t tell the public about the code they pay for because they use it to gain access to their target’s devices. Selling to them is considered safer than striking deals with the mafia or other shady organisations because in those cases talks can go south at any time.

With these kinds of profits, why waste time with small payouts and contests? I can't imagine there is much incentive anymore for security research or hacker groups to report vulnerabilities responsibly to vendors. This is an interesting trend that will be exciting to watch as the market for exploits continues to grow rapidly.

Improv Everywhere - Spinning Beach Ball of Death

2012-03-09T21:38:00.001-06:00

This is great! At first, I felt so sorry for the dude, but then realized what was happening. Brilliant!

Netflix thinks B-horror movie is "just for kids"

2012-03-05T10:51:00.000-06:00

This morning my 2 year old was happily watching Yo Gabba Gabba on Netflix using the "Just for Kids" interface on the Wii. The video stream had been periodically pausing and buffering. I went downstairs to change the laundry over (I was literally away for about 3-4 minutes) and when I came back upstairs, my son had grabbed the Wii Remote, and was clicking around, likely trying to fix the paused video stream (he's a good troubleshooter). Surprisingly, he was no longer watching Yo Gabba Gabba, but instead a 1960's B-Horror movie called Doctor Blood's Coffin was in the process of loading up. Luckily, I got there in time and changed it back. I was surprised that Netflix would even make horror movies available via the "Just for Kids" interface on the Wii. What likely happened is that he somehow got into the non-kid-friendly Netflix interface and just randomly clicked on a title. "I can't leave you kids alone for 3 minutes!"

Temporal Distortion: Amazingly beautiful time lapse video

2012-02-16T09:42:00.002-06:00

Temporal Distortion from Randy Halverson on Vimeo.

Malicious poisoned redirects in Google search results

2012-02-15T08:56:00.000-06:00

This morning I did a Google search for "free psd web button". I clicked on the third result which links to http://www.sharkwebstyle.com/2011/07/80-prefect-free-photoshop-web-buttons-psd/.

However, upon clicking on this third result, I was automatically taken to Russian site http://uaroyalys.ru/industry/index.php, which is clearly not the correct location, and is apparently an attempt to redirect me to some sort of malicious site (I don't recommend you try to visit this site). Thankfully, I had ScriptNo for Chrome and NoScript for Firefox so, the site didn't do anything, and thankfully it wasn't able to reach its dirty tentacles into my machine (I hope).

I originally discovered the malicious redirect on a Windows machine, and I immediately assumed that the machine must somehow be infected. I switched over to a Mac machine and discovered the same malady, suggesting that the malicious redirect originates on the server side and not on my side.

What's unclear is if this is the fault of the target (SharkWebstyle perhaps infected with a XSS attack), or poisoned Google search results. What's frustrating is that most unsuspecting users are doing these types of web searches all the time and clicking on tons of links. Most are using Internet Explorer or another browser with scripting (JavaScript) fully enabled. Since most infections are launched via some sort of scripting on web sites, it is recommended to use an add-on (such as ScriptNo for Chrome or NoScript for Firefox) that only allows scripting in your web browser for sites that you explicitly allow. It makes me sick to my stomach to think of a friend or family member getting infected with some type of malware served up by Google's own search results. Be safe, folks!

UPDATE (2/15/12): It appears that this was most likely the result of a compromised instance of WordPress (most likely through a maliciously modified .htaccess file). Older versions of WordPress can be susceptible to attacks. If you self-host your WordPress site, you need to make sure you update to the latest version, change passwords for your web host account, FTP, and MySQL database. Check this link if you think you might be compromised. You can also check your site to see if it is infected with any known malicious code at Sucuri SiteCheck.

UPDATE (3/3/12): I received a note from the site administrators at Sharkwebstyle that said, "We encountered a problem with a vulnerability in timthumb script used in our WordPress theme, and that vulnerability can change the .htaccess file content, so that's why there was a redirection to other website." Here are some technical details about the Timthumb Wordpress vulnerability and hack.