Malware attacks in LUA

It probably has something to do with the security model of Vista that recently more and more Malwares and Trojans are attacking and surviving in user's account. The reason it is possible is largely explained by the paper "Problems of Privilege: Find and Fix LUA Bugs":

Prior to Windows 2000, HKCR was just a symbolic link to HKLM\Software\Classes that only administrators could write to. This meant that operations performed on HKCR\.txt actually occur in HKLM\Software\Classes\.txt. Windows 2000 introduced per-user registration data, so now HKCR is a merged view of HKLM\Software\Classes and HKCU\Software\Classes (which the user can write to). If a key exists in the latter, it takes precedence. So now an operation on HKCR\.txt occurs in HKCU\Software\Classes\.txt if that key already exists; if it doesn’t, the operation occurs in HKLM\Software\Classes\.txt as it had in the past.

Note that HKCU keys take precedence over HKLM and user has all the rights to modify HKCU\Software\Classes. It is this implementation that now opens up a 'vulnerability' for Malware writer to exploit. Even rogue antivirus "XP Guardian" is exploiting this hole. This support note from Microsoft shows how to exploit this hole.

Most of these Malwares also use the "%Temp%" or even "Temporary Internet Files" folders to park their malicious executable code with total impunity.

Since most computer only serves one user, particularly notebook and netbook, it is pointless to struggle so hard to gain control of the HKLM and protected resources that required elevated privileges. The end result is almost the same - carrying out the dirty deed with total impunity. Anti-Virus program are often of little help.

This problem allowing HKCR to take precedence, even in Vista, allows attackers to exploit this hole in XP, Vista and Windows 7. Even running LUA will not be a good defense against this form of attack and anti-virus is even more ineffective.

iPad design principle is a diametrically opposite to the Apple Computer's founding one

This article by Johnathan Zittrain provides a timely warning of the danger of allowing Apple to exert such a tight control on its recently released products, namely iPhone and iPad. He provides a historical account of how Apple Computer was established based on a computer, Apple II, renowned for its ability to be reconfigured almost infinitely with third parties parts and then contrasting its recent diametrically opposite corporate view - Apple controlling everything.

He reminds us

If Apple is the gatekeeper to a device’s uses, the governments of the world need knock on the door of only one office in Cupertino, California – Apple’s headquarters – to demand changes to code or content . Users no longer own or control the apps they run – they merely rent them minute by minute.
[...]
Mr Jobs ushered in the personal computer era and now he is trying to usher it out. We should focus on preserving our freedoms, even as the devices we acquire become more attractive and easier to use.

Love-hate relationship with Fingerprint recognition system

I harbor a love-hate relationship with finger print recognition system both of government or commercial grade because I have yet met one that reliably recognizing my print. Hence when I come across this research paper, I want to know more particularly the performance of the deployed system, etc.

A fingerprint matcher can make two types of errors: a false match, in which the matcher declares a match between images from two different fingers, and a false nonmatch, in which it does not identify images from the same finger as a match. A system’s false match rate (FMR) and false nonmatch rate (FNMR) depend on the operating threshold; a large threshold score leads to a small FMR at the expense of a high FNMR. For a given fingerprint matching system, it is impossible to reduce both these errors simultaneously.

Fingerprint identification system performance is measured in terms of its false positive identification rate (FPIR) and false negative identification rate (FNIR). A false positive ident i f icat ion occur s when the system finds a hit for a query fingerprint that is not enrolled in the system. A false negative identification occurs when it finds no hit or a wrong hit for a query fingerprint enrolled in the system. The relationship between these rates is defined by FPIR = 1 - (1 - FMR)^N, where N is the number of users enrolled in the system. Hence, as the number of enrolled users grows, the fingerprint matcher’s FMR needs to be extremely low for the identification system to be effective. For example, if an FPIR of 1 percent is required in a fingerprint identification system with 100 million enrolled users, the FMR of the corresponding fingerprint matcher must be on the order of 1 in 10 billion. Such a stringent FMR requirement can usually be met only when fingerprints from all 10 fingers of a person are used for identification. This explains the need to continuously decrease the error rates of fingerprint matchers employed in large-scale identification systems.

It also lists some US government's systems' performance and the FNMR seems to be higher than FMR in just about all system. Does this means that the system will not match more often than finding a match?

I always want to know why my Fujitsu P1510's fingerprint log in system always rejects me with a rate like 20-25 tries to get one successful log in (I have not disabled that system). This paper offers some plausible explanation:

Fingerprint sensors embedded in consumer electronic devices tend to have a smaller sensing area. This factor, combined with users’ improper placement of their finger on the sensor, results in a limited overlapping area between two impressions of the same finger, as Figure 5c shows. Given the very small number of minutiae in the overlapping area, it is difficult to determine if two fingerprints are from the same finger.

One way to alleviate this problem is to utilize level 3 features to improve the matching accuracy in cases where there is only a small overlapping area between the two impressions. However, level 3 features may not be suitable for commercial applications because the sensors used in such applications usually provide only low-resolution images.

Why do I have so much trouble with fingerprint recognition system? This paper offers these suggestions:

In some cases, a fingerprint recognition system may not even successfully capture the user’s fingerprint. Failure to enroll (FTE) and failure to acquire (FTA) refer to the fraction of users who cannot be enrolled or processed by a particular system due to the poor quality of their fingerprints— for example, people such as manual laborers or the elderly with “worn-out” fingers. In practice, FTE can be rather high (a few percentage points) depending on the target population and the occupation of users in the population.
[...]
Due to nonideal skin conditions, inherently low-quality fingers, and sensor noise, a significant percentage of fingerprint images are of poor quality. Extracting features from and matching low-quality fingerprints, like those shown in Figures 5a and 5b, is a challenging problem that will require significant research.
[...]
Pressing soft finger skin on a sensor always introduces some distortion, which is generally not repeatable. Matched fingerprints may appear very different under severe distortion, as Figure 5d shows.

The paper's conclusion is reassuring to know that it is not totally my fault:

Although fingerprint recognition is one of the earliest applications of pattern recognition, the accuracy of state-of-the-art fingerprint-matching systems is still not comparable to human fingerprint experts in many situations, particularly latent print matching. Significant advances require not only a deeper understanding of friction ridge formation, but also adaptation of new developments in sensor technology, image processing, pattern recognition, machine learning, cryptography, and statistical modeling. While successful commercial applications have driven fingerprint-matching technology, more breakthroughs could be achieved with greater investment in fundamental research.

Brisbane Office Vacancy rising - one possible explanation

Well, it was reported that Brisbane CBD average of 5.1 per cent and is the highest vacancy in the CBD since January 1995 and one possible explanation is Mincom's contribution by making 30 people redundant end of Jan 2010.

This is really funny - various use of iPad

This report is really funny citing the lack of originality of the word iPad,

Fujitsu Ltd. said its US subsidiary in 2002 launched the "iPad", a sleek handheld multimedia device with a 3.5-inch screen, used by retail store clerks to keep inventory data, scan barcodes and manage business operations.
[...]
Germany's Siemens uses the trademark "iPad" for small engines and motors.

The Swiss-based microchip maker STMicroelectronics has reportedly also registered "IPAD", short for "Integrated Passive and Active Devices."

In Canada, the Ontario-based company Coconut Grove Pads Inc. has since 2007 made a line of bra inserts and shoulder pads called the "iPad", according to an online report by the Globe and Mail daily.

A Japanese company that makes a product of the same name -- pronounced "ai pad" when transcribed from the Japanese -- is Awaji-Tec, a manufacturer of adult nappies with a high-tech twist.

The company says its nappies feature an electronic device that can send a signal to a remote caregiver when it needs to be changed.
[...]
Meanwhile in China, a company has used a different name -- the "P88" -- for an iPad look-alike, with a slightly larger screen, faster processor and larger memory but battery life of only 1.5 hours compared to the iPad's 10 hours.

The following comment really hurts:

But the makers of the P88, Shenzhen Great Loong Brother Industrial Co., said Apple appeared to be the copycats. 

 "We don't understand. Why did they make the same thing as us?" Huang Xiaofang, an executive at the company, told AFP. "We launched it earlier."

Well done!

iPad is not the thinnest...

iPad (or would it be iBad) is not the thinnest device on the market - a piece of paper is. Some may argue this is a stupid comparison but when a device that cannot show 70%-75% of the Internet graphic contents using Adobe flash, it is as functional to my piece of blank paper for showing the Internet contents.

Hence my rather sarcastic comparison is therefore not without merit and foundation.

Poor Apple also being caught out of false advertising displaying a web page containing flash content that can only be visualized by iPad owners with tonnes of imagination or boxes of crayons. The ability of flash to show graphic contents has proven too great a temptation for Apple to resist.

Something that every non-iPad or iPod owners could see and enjoy on his or her computers or smart phones is only a distance longing for iPad or iPod owners. But then again there are people who love to be controlled and dictated by Apple and will not mine throwing money at Jobs' feet for the contempt he dishes out to his customers.

Investing in failure to create success

A recently published article of this title contains some uncomfortable truths to many so called IT companies:

Given IT innovation is trial and error, how much should you invest in allowing for errors?

The short answer is a lot. Some IT companies are risking up to 75 per cent of their R&D budget for a winning result.

Others have invested years in seemingly losing ideas that eventually transformed into a winning one.

[...]
“A lot of companies will try a product, fail and think it's too hard and crawl back in their box. Australia is quite conservative,” Gardiner says.

However, to compete in a global market companies must take risks.

“(US companies) are risk-takers and to compete with them we have to be too.”

[...]
He believes managers today are too focused on immediate results and are reluctant to spend on developing products that will only pay off years down the track. Some will milk proven products in lieu of trying new ones, despite pouring money into research.

At the end sound advice:

His advice for companies unsure of investing in new ideas includes:
- Decide what game you are in, then play to win
- Invest in the development team and keep learning so you can discover how you can adapt
- Have lots of tenacity, patience and perseverance. A solution that is very hard to conquer is also very hard to copy, giving its owner an immediate advantage.