Brian P Kennedy's Blog

Free Rangers Baseball Tickets

2008-06-03T08:02:00.004-05:00

http://texas.rangers.mlb.com/tex/fan_forum/allstar_offers.jsp

The Texas Rangers yesterday began their all star campaign for their players, and seem to be pretty hopeful that a handful of Rangers could end up on the team. As an incentive, they're going to give away 2 free tickets to games in August if you vote 25 times with the Rangers as your favorite team.

The Rangers may be irrelevant yet again by August, but you'll get your choice between watching them play the Rays, Tigers, or Indians.

Corporate accounts payable, Nina speaking. Just a moment.

2008-03-24T22:37:00.002-06:00

It was a bit of a nightmare, you go to login to a website and you can't remember your password. You go through your small keyring of passwords trying to remember the right combination. Maybe you remember your username for sure (which I did). Maybe you are absolutely positive it's one password but it just doesn't seem to be working out. Finally you break down, and you have to click the "Forgot your password" link, a link that just plain says "I give up".

But what if remembering your mother's maiden name and your childhood pet's name isn't enough? What if you were naive and registered for an account with an email address that no longer exists, say, a university email address that for some reason you hadn't switched off of. Will your account, in this case for ebay, be lost forever?

NO! Enter Ebay's live online customer service. I know this is not a new concept, but Ebay is unique in that they offer no over the phone customer support. Ebay instead opts for an instant message based live online support. I opened up a window, chatted with a tier 1 support operator about my account, and she transferred me to an account support operator. Are the days of "Press 1 for english" gone? The support was instant, it was fast, and it was right up my alley. And not just ebay is doing it. I've seen other sites offer live support, one in particular that I have used is Sandals.

When looking at honeymoon locations I checked out Sandals Jamaica. I went to the site and had a few dumb questions that probably could have been answered with some googling, but I was curious about the live chat. A window opens up and I get instant results for my questions: "What airport would I fly into?" and most importantly "Which Sandals resort has Jamaica's largest fresh water pool?"

I sincerely hope that this form of online support becomes a new standard. I'm not sure whether or not some of the people i talked to were IM bots, but they served to redirect me to actual customer service representatives who fulfilled my actual customer service needs. I found the overall experience to be much better than any phone call I could have placed, and it did not intrude on my other activities (read: watching tv and eating Easter candy).

Thanks again, Ebay!

Cold Reboot Attacks on Disk Encryption

2008-02-21T23:33:00.003-06:00

I just read a recent article on slashdot about Disk Encrpytion found here . A team from Princeton found a very commonly overlooked exploit in the way DRAM works, and used it to break encryption. Most people with a fair amount of computer knowledge, and as the article points out many with vast knowledge, believe that as soon as you turn your computer off whatever is stored in your DRAM is erased. This is not entirely true, as the YouTube video on one of the links demonstrates. This has to do with the way that the hardware on the gate level stores bits. The video shows that at room temperatures the data fades in matters of seconds, and at extreme cold fades over minutes.

How does this relate to encryption? Well, if you encrypted your hard drive w/ one of the common solutions, your encryption key is stored in memory. The idea is that on restart or shutdown, the key is no longer in memory and you would have to enter a passphrase to unlock the key again. But, uh oh, your key is not immediately lost in the RAM on restart. The premise of the attack is that you could steal someone's laptop while it is powered on but locked, and be able to exploit the fact that memory fades away instead of instantly switches off, to get to the contents of the drive.

One fairly large oversight that I noticed on watching the video has to do with how the Princeton folks run their exploit software. They use software written to dump the memory and find the key on startup. This software lives on an external hard drive. Their attack assumes that on a restart the BIOS is setup to look at the external hard drive first. I suppose that this is not the case on most computers, as a lot of default BIOS setups prioritize their boots with the Hard Drive first, and maybe CD/DVD-ROM first and then hard drive.

One solution to this oversight is either to power the computer on again, hop into the BIOS real quick and change the boot order, hoping that the contents of memory do not change. Another is to find a way to get the attack software onto the boot drive and have it instructed to run before anything else, however if you are just stealing a laptop from a Starbucks, and it is already locked, you are out of luck.

My suggestion to combat this exploit, should there be workarounds to boot the attack software up, is to scramble or 0 out the memory on startup. If the memory were scrambled on every power on, it would not be possible to recover the key that was in memory.

Unzipping in java

2007-08-03T10:43:00.000-05:00

I tried hard to find a solid example of how to unzip a file in java using java.util.zip, but even the examples on Sun were throwing errors. None of the examples seemed to take care of the fact that zip files can contain directories inside of them, and I kept getting exceptions. Luckily I came across the Java Developers Almanac article here and was able to add in the case of a directory. It worked for my problem.

public static void exlpodeZip(String source, String destination)
{
try {
// Open the ZIP file
ZipInputStream in = new ZipInputStream(new FileInputStream(source));

// Get the first entry
ZipEntry entry = in.getNextEntry();
while (entry != null)
{
// Open the output file
if (entry.isDirectory())
{
new File(destination+"/"+entry.getName()).mkdir();
}
else
{
OutputStream out = new FileOutputStream(destination+"/"+entry.getName());

// Transfer bytes from the ZIP file to the output file
byte[] buf = new byte[1024];
int len;
while ((len = in.read(buf)) > 0) {
out.write(buf, 0, len);
}

// Close the streams
out.close();
}
entry=in.getNextEntry();
}
in.close();
} catch (IOException e) {
}
}

General Brian Update

2007-08-01T00:04:00.000-05:00

It's been awhile since I wrote an entry into here so I thought I'd throw in a few updates about what I've been up to.
*Graduated (see previous post)
*Actually finished school (CS 356 Computer Networks)
*Started Work.

A byproduct of starting work involves me switching over to Linux only environment. No more Windows safety net for tasks that are too hard or too foreign to me. So far there have been no problems, perhaps I don't need that safety net anymore. For anyone who cares I am running Ubuntu Feisty Fawn.

I have photos of my Boston trip (work related):

Boston

As well as photos of my visit to the Star Wars Museum Exhibit in Ft Worth (not work related):

Star Wars Museum Exhibit

Congraduations

2007-05-19T01:36:00.000-05:00

Everyone congraduate me because today I join the ranks of American presidents, Nobel laureates, and renowned scientists worldwide. Yes, today i join the fraternity of college graduates.

haikuxtable

2007-04-26T21:44:00.000-05:00

I was inspired by this nerdy guy on jeopardy who said he wrote a poem every day for about 3 years. I decided, hmm....writing poems could be a neat thing to throw onto a blog every now and then. However, I'm not very poetic or artistic, so I decided that haikus were the way to go. So without further ado I give you: haikuxtable

Wearing a sweater
Always having good advice
Heathcliff Huxtable
-brian p kennedy 4/26

A great MP3 tool

2007-03-27T11:28:00.000-06:00

I decided I'd keep a blog (third time's a charm), where I simply post up things i found on the web I thought were interesting. This is my first post.

I recently bought a Creative Labs Zen Vision:M 60 GB mp3 player because I thought it was time to get into the 21st century. I loaded my 16 GB or so mp3 library onto the player really easily with a drag-and-drop approach. Things were going great until i realized how poorly tagged some of my MP3s are. Those of you who don't know about ID3 tags go here. Any ways, I have a bunch of stuff downloaded from years ago when i just used Napster, Kazaa, or Morpheus and didn't care what the tags were. But now i can't find any of them on my Zen because they're all under the artist. So i found MusicBrainz. Which takes in an MP3, gets the acoustic fingerprint for it, and searches it against their user driven database to return to you the correct ID3 tag. It's not perfect, but it's made my mp3 library a little more navigable.

*edited some frustratring hours later*

So MusicBrainz got pretty frustrating for some of my mp3 cases. Apparently if there are collisions in the fingerprints (like a song existing on more than one album) the program makes you work hard to choose which ID3 tag you want. This got pretty frustrating to me so i found ID3-TagIT, which lets you do some pretty cool stuff like parse the file name into the ID3 tag. A lot of my mp3s seemed to follow certain naming schemes that could be parsed easily, so you may want to use it too.