Battle of 'legit' malware

I find this humorous. Slashdot reports that Sony's rootkit thwarts Blizzard's spyware:

"First, news of Warden -a bit of code from Blizzard's WoW to trounce game cheats. Then, a Sony rootkit to make your computer safe for music. Now, news that you can use the Sony rootkit to make your game cheats safe from the Warden."

I told you so: Oracle password protection flawed

Schneier has blogged a paper published on the SANS site that exposes the weakness of the Oracle password hashing algorithm. Reading this gives me a warm feeling of validation as I think back to a number of debates I have had with colleagues over the past few years. These debates typically went like this:

Colleague: "Chris, why does your design include building a password hashing algorithm when we could just use [insert commercial database name here]'s password encryption function?"

Chris: "Because I want to be able to demonstrate to our clients that we are protecting passwords with strong cryptographic hashes with a transparent easy to audit process."

Colleague: "But [insert database vendor name here] says this new password protection function is top notch." (Holds up whitepaper from vendor's website)

Chris: "Sigh."

Here is the abstract:

"In this paper the authors examine the mechanism used in Oracle databases for protecting users' passwords. We review the algorithm used for generating password hashes, and show that the current mechanism presents a number of weaknesses, making it straightforward for an attacker with limited resources to recover a user's plaintext password from the hashed value. We also describe how to implement a password recovery tool using off-the-shelf software. We conclude by discussing some possible attack vectors and recommendations to mitigate this risk."

The death of the grave

As part of Halloween fun, my family and I were quite proud of the grave that we created in our front yard, complete with a partially exhumed zombie seemingly clawing at trick-or-treaters on their way to our door.



It seems, as we move now to the Catholic feasts of All Saints (today) and All Souls (tomorrow), that there is some concern about graves not being taken seriously and what that means to our spiritual and psychological well-being. Deutche Welle has this interesting piece on the matter. Here is an excerpt.

"The church remains critical of such changes in burial culture. Joachim Wanke, Bishop of Erfurt, who is himself responsible for questions of congregational policies, put forth this reservation at the German Bishops' Conference.

'It used to be that dead were at the center of funeral ceremonies,' he said. 'Now it's also those of us who are left behind who need a ritual.'"