29 January, 2010

「瓜田李下」大家都聽過吧?

Standard

引用:中國網攻Google 證據被掌握

自從Google發佈遭駭客攻擊以來,多家電腦安全公司均表示支持Google認為此舉出自中國政府的說法,不過大都無法提出有效證據,但現在情況已經有改觀;《紐約時報》週三報導,一名美國的電腦安全研究人員,說他已經發現他相信是強有力的證據,證實被用在攻擊Google的軟體程式上,有中國程式設計師的數位指紋。

因為我對這則新聞很好奇,所以尋線找到那所謂美國安全研究人員的實驗室網誌,在該篇分析報告發現以下訊息:

There are many different CRC algorithms and implementations of those algorithms, but this is one I had not previously seen in any of my reverse-engineering efforts.

「只此一家,絕無分號」的 CRC 演算法實做。

The full paper was published in simplified Chinese characters, and all existing references and publications of the sample source code seem to be exclusively on Chinese websites.

整篇 Paper 用簡體中文寫作且只在中文網站找得到。

This information strongly indicates the Aurora codebase originated with someone who is comfortable reading simplified Chinese. Although source code itself is not restrained by any particular human language or nationality, most programmers reuse code documented in their native language.

讀中文最輕鬆的首先就懷疑是華語人士吧?

多數人寫程式都會用他們的母語當註解吧?

所以最後的結論是:

(in light of the harsh penalties we have seen handed out in communist China for other computer intrusion offenses), this creates speculation around whether the attacks could be state-sponsored.

在稍早的幾個計算機犯罪事件中,中共當局都是嚴加處置,所以有可能是因為國家資助才造成這次的局面!

題外話:對岸隱藏的策略越來越先進,我還記得之前在分析的樣本發現過下面這種程式片段:

Malware_ZongCan

Google_ZongCan

看來在**單位作程式研發連資料夾的名稱都不能亂取,萬一編譯之後存在 Binary 中,事情就大條了。

MS COFEE 工具疑似洩漏

Standard

Last November, the code for Microsoft's Microsoft's COFEE (Computer Online Forensic Evidence Extractor) forensics tool was leaked to the Internet. COFEE is distributed free to law enforcement agencies all over the world and used to gather digital evidence from computers that are seized in connection with criminal activity. Microsoft does not make it available to those outside the law enforcement community.
http://www.crunchgear.com/2009/11/06/siren-gif-mic...ernet/

Then in December, several sites reported on the release of software called DECAF that could detect the presence of  imageCOFEE  and delete its files and processes as well as clearing its log files. You can read more about DECAF here:
http://www.theregister.co.uk/2009/12/14/microsoft_...decaf/   

On December 18, that first version was pulled by its makers and it was labeled as fake. Now a new version, DECAF 2, is out there. The new version doesn't limit itself to COFEE, but also detects other forensics software including EnCase, Helix, Forensic Toolkit and more. DECAF developers say the first version did work and was removed because of legal concerns, and that they were trying to raise awareness for 「better security and more privacy tools.」
http://www.thetechherald.com/article.php/200953/50...unched

下載資訊:http://www.xun6.com/file/631805d12/COFEE-Microsoft+tools.rar.html

19 July, 2006

刑法第 36 章條文

Standard
第 三六 章 妨害電腦使用罪
第 358 條 無故輸入他人帳號密碼、破解使用電腦之保護措施或利用電腦系統之漏洞,而入侵他人之電腦或其相關設備者,處三年以下有期徒刑、拘役或科或併科十萬元以下罰金。
第 359 條 無故取得、刪除或變更他人電腦或其相關設備之電磁紀錄,致生損害於公眾或他人者,處五年以下有期徒刑、拘役或科或併科二十萬元以下罰金。
第 360 條 無故以電腦程式或其他電磁方式干擾他人電腦或其相關設備,致生損害於公眾或他人者,處三年以下有期徒刑、拘役或科或併科十萬元以下罰金。
第 361 條 對於公務機關之電腦或其相關設備犯前三條之罪者,加重其刑至二分之一。
第 362 條 製作專供犯本章之罪之電腦程式,而供自己或他人犯本章之罪,致生損害於公眾或他人者,處五年以下有期徒刑、拘役或科或併科二十萬元以下罰金。
第 363 條 第三百五十八條至第三百六十條之罪,須告訴乃論。
Original Url: http://law.moj.gov.tw/Scripts/Query4B.asp?FullDoc=所有條文&Lcode=C0000001

15 July, 2006

評等「剽竊」的境界!

Standard
Pschool Huang:
抄襲論文的境界:
「抄襲」是整篇拿來抄。
「引用」是整段拿來抄。
「參考」是整句拿來抄。
「改寫」是整篇拿來改。
「模仿」是整段拿來改。

抄襲程式碼的境界:
「抄襲」是剪下貼上。
「引用」是拼拼湊湊。
「參考」是沿用方法。
「改寫」是更改變數。
「模仿」是拷貝結構。

PinLunLiao:
「原創」必經的過程:「抄」、「偷」、「拷」、「貼」、「改」。

02 July, 2006

虛擬都不鍵盤!

Standard

Kuon 大哥說:「其實利用光線虛擬出來的鍵盤位置輸入到電腦之後還是會被轉成可捕捉的Keystroke!」
所以在此修改我寫錯的部分,另外我把 IrAD 誤植成 IrDA!
重點在於,以上報導提到的兩個「虛擬鍵盤」根本是不一樣的東西!