Reality Bytes » Reviews

Philippine Election Automation-Sequel

jesh — Mon, 27 Apr 2009 14:14:46 +0000

Recently, I have just published a blog entry with regards to my views and opinion regarding the challenge being imposed on the new Election System. An automated system which is foreseen to be used for the 2010 Philippine National elections. I have also been reading some articles and doing some research related to the same hacking challenge that is being imposed to this so-called sturdy election system.

An article in SlashDot was recently published talking about Chinese hackers trying to infiltrate NYPD workstations. The article states that NYPD claims to log a total of 70,000 attempts per day. They seem unsuccessful but there attempts are endless. Whatever are their motives and intentions, this is still yet to be known.

Another source states that the Pentagon cyberspace was also infused by cyberspies (also been identified to be China-based hackers) stealing information and unveiling design details of the US’s F-35 air fighter. With this incident, the jet fighter’s electronic system design is now known to that attacker.

An extortionist was arrested after he was reported to be exploiting communication lines of two companies in the United States. However, with the FBI’s fast preventive actions, the extortionist was caught with the help of a Spyware that the FBI used to identify and track the exploiter’s activity over the internet.

Within the country, there was also another news that a company based in Makati, Philippines, had it’s computer network system infiltrated by one of their employees who had resigned some period prior to the hacking incident.

There are more incidents on cyberspace intrution and the like. All of which are either unique in intentions or unique in operations. This is not to discourage various sectors of the IT industry. Hence, this is a challenge of strengthening our plans of prevention and to provide the constancy of change. We will never know what motives may lie behind each and every attack. But as long as you obtain relevant and valuable information, you will always be a target.

Revisiting the ILOVEYOU Virus

jesh — Fri, 24 Apr 2009 08:48:48 +0000

Recalling a few years ago, the Philippines received one recognition from the world. It was during the outbreak of the very famous ILOVEYOU virus. After tracing back the root cause and main source of this virus, the fast spreading activities of this virus was finally put to an end. The author of the virus was caught, but was never convicted and all charges were dropped because the country never had laws governing these types of activities. Now we revisit this famous Filipino “destructive” creation. Gathering the worst computer viruses of all time, this sleek ILOVEYOU virus has found its way to be in the list of top ten (10) worst computer viruses. Click here to read the whole article and also here for this virus’ section.

Source: http://howstuffworks.com

“Try me!”-Philippine Election Automation System

jesh — Wed, 22 Apr 2009 09:18:16 +0000

Everyone in the IT industry and field are laughing about it. Recently, Cayetano has been bragging about the ability of the new, hi-tech and state-of-the-art system that shall be used for the Philippine Elections this 2010. Personally, and being part of the IT industry, I find his statements totally hilarious. Security matters are not those common topics being challenged. Programming schemes and techniques are ennumerable. The IT sector would always say that there is always a way for the end result to be visible and it is the implementation that matters.

Nowadays, computer security has been a grave issue. To simply put, nothing in this world of information systems and technology is safe. With this statement, you might say that there is no use for automation and information improvement. Of which, that is wrong. Yes indeed nothing is safe and secure. However, it is in the strategy and contingency plans placed to secure and “prevent” your system from such attacks.

Application source code inspection is the most absurd act. This leads to only more opportunity for attack and exploitation. Knowing the source code and algorithm would also give a venue for system hackers to identify loop holes within the system. This would then make your 128, 256 or so-bit encryption scheme useless. Unit, integration, and system test plan documents are enough to prove the reliability of the system. Application source codes are not supposed to be visible to end-users and to the public. Nevertheless, this system has been published to be an Open Source Software.

It has been a few years since I have been dealing with Information Systems. Being a developer and lead technical designer of a various project developments, it entails a lot of end advantages in the part of the development team. As system developers, there is a special feature referred to as the “System Backdoor”. Wikipedia defines a System Backdoor as “a method of bypassing normal authentication, securing remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program, or could be a modification to an existing program or hardware device.” It may also be planted directly by the system developer for the convenience within the duration of the development phase.

With this kind of challenges, I remember the conspiracy behind system applications and softwares. Right now, one of the problems the IT industry is facing is regarding Piracy. Not only does it involve music and movie piracy but also software application piracy. Cracks and Key generators for high end and famous PC games, applications and operating systems have been circulating all over the internet most especially in torrent sites and peer-to-peer applications. The question of conspiracy lies not on the question of who are circulating this applications, but what kind of persons are they. And the mostly heard answers is that they are programmers from EAGames, Blizzard, Microsoft and the like are the one’s that distribute them. Moving on with the analogy, saying that there could be someone that could crack the election system, there is a possibility that he or she is part of the system’s development team. This has not yet been proven, however, it remains to be a conspiracy.

Relating altogether, as a devoted programmer and an anticipating voter, this challenge might have gone out of hand. This might imply that Filipinos are indeed intelligent persons that could be able to get into this high-tech system or politicians are just desperate to prove their innocence to corruption and lack of submission to a fair political campaign and contest. This issue was possibly raised because of another posibility of attack intentions to the system are comming from the candidates themselves. However, putting it to the innovative and technological point of view, preventive measures are better means of security rather than reliability assurance.

IT Industry at a struggle

jesh — Mon, 26 Jan 2009 05:37:48 +0000

I was browsing over the newspaper just this morning when a very big headline struck my attention. Since the down fall of the economy for this past few weeks, months or so, this dilemma has finally got into the way of the IT industry.

Just this morning, I’ve read from the Inquirer that the Intel plant in the Philippines is closing. Moreover, the Philippine government fears that there might be a possible loss of 60,000 employments within the IT industry. I dug into some articles in the Inquirer’s website, and there I found more news in the arena where I’m in; Computer Technology and Information Technology. This does not only include the closure of one manufacturing plant of Intel in the Philippines, but also the cutting up of jobs in Microsoft and the freezing of Yahoo employee salaries. Moreover, Intel’s rival; AMD has also reduced their employee population and salary wages. Also, Accenture RP lays off some of their workers. By reading through this articles, the IT industry might be at critical state.

Some of these companies might state of good cause why they are reducing their employees. Some of them might be greatly affected by the current state of the economy.

Homer Simpson in CSS

jesh — Tue, 27 May 2008 04:48:00 +0000

(

)

•

(

My officemate showed me this picture of Homer Simpson. What you see above might be just a typical photograph of Homer. But as soon as you will see the disection of this image, you might be impressed of how the artist (Román Cortés) of this “image” made and composed this. This image was created in full CSS! For those HTML/Web newbies, CSS is used to make your webpage appear better and impressive. The power of Cascading Style Sheets enables you to arrange and customize the layout in a very flexible way. And like what this guy here (Román Cortés) did, he placed the powers of CSS to its limits. By looking at this closely, it uses letters, symbols and numbers to be able to form one masterpiece; Homer Simpson. Like what a reader has stated:

o + o + o + o + ( + O
+ O + O + \ + L + ( + O + O + O + O + O + \ + L + ( + O + | + | + \ + \ + | + | + \ + \ + \ + \ + ( + ( + 8 + o + o + o + ( + ( + 8 + o + o + o + o + ) + ) + b + o + O + o + o + o + o + o + o + ) + b + o + O + o + o + o + o + o + o + o + o + o + / + /+ / + • + • + • + • + • + _ + _ + _ + • + • + • + C + C + O + ( – + CSS = HOMER !!

Note: This might only give desireable results on the following web browsers:

Internet Explorer 5.5, 6 y 7
Opera 9
Firefox 2
Safari 3

Román Cortés also made a CSS version of George Bush.

No related posts.

Linux hails and MAC goes down the drain in CanSecWest hacking contest

jesh — Thu, 03 Apr 2008 02:52:00 +0000

I was waiting for a work order at the office while I was browsing over some forum sites. It was just recently last March 26-28, 2008 that CanSecWest held its annual PWN2OWN contest. The name of the game is simple. Any registered attendee of CanSecWest 2008 can participate as a contestant. One contestant, one machine and hack at least one, if not, all machines running in different operating systems. You hack the machine, and you own the machine. Basically, you “pawn” and you “own”.

Here are the contest rules:

There are three target platforms all set and installed with typical client and user configurations. Once you are able to hack it, you get to keep it. These are the target:
- VAIO VGN-TZ37CN running with Linux Ubuntu 7.10
- Fujitsu U810 running with Vista Ultimate Edition SP1
- MacBook Air running in OSX 10.5.2
Each of these machines contains a special text file that holds the procedure in claiming another set of prize/s.
In the contest’s three-day duration. Target machines are set with higher security level. First day involves hacking only with the operating system. Then moving to the second and third day, more applications will be installed on these target machines to increase its potential security level.
The contest was not used to exploit the performance of these platforms in terms of security. This was just to guide the vendors and buyers by addressing the vulnerability of these platforms.

Throughout the whole duration of this contest and with over 400 participants, two (2) persons emerged to successfully pawn these machines with one laptop each. These are in the name of Shane McCauley and Charlie Miller winning the MacBook Air and Windows Vista respectively.

MacBook Air was hacked first in this contest with just two minutes upon the start of the contest. This was done by utilizing some loopholes that the hacker found within the Safari Web Browser. Every thing was set in the first day and was successfully hacked on the second minute of the second day after applying user interaction with an email opened in Safari.

Second hacked was the Vista Ultimate Edition SP1. It was in some hours after the start of the second day when Vista’s system was successfully dominated. It was through the Java software installed in the system. It was some in flaw of the Java-Windows combination that allowed this attack to succeed.

And the last man or the last “system” standing was the Linux System having been surviving multiple attacks from 400 hackers. There were some bugs found in the Ubuntu Linux operating system but the attendees did not want to work in making the exploit code for such bug.

With this, I leave you with your own critiques in lieu with these operating system platforms. It might impress or it might depress.

More detailed information can be found on these links:
http://cansecwest.com/post/2008-03-20.21:33:00.CanSecWest_PWN2OWN_2008
http://channel9.msdn.com/ShowPost.aspx?PostID=393788#393788
http://apple.slashdot.org/apple/08/03/28/0126221.shtml

Smart BRO-ken??

jesh — Fri, 18 Jan 2008 22:15:00 +0000

I was reading a blog entry of a friend of mine and this really amused me so much. You can read her whole story through this link.

BTW, it’s by April Kwong. :)