PhiloSecurity

"...has shut down the first fully-functional Mac OS X ransomeware" Here I was hoping it was the second malware coded with functional programming. Scheme last time [1]. I was hoping to see some systems Haskell or ATS in there. Oh well. Always another opportunity when it comes to malware. [1] http://philosecurity.org/2009/01/12/interview-with-an-adware-author

Relevant IBM ad from those days: http://philosecurity.org/wp-content/uploads/2009/04/hollerith.jpg

or blackhat it up with tinyScheme http://philosecurity.org/2009/01/12/interview-with-an-adware-author

The plaintext passwords may well be sitting somewhere in memory even on Linux (e.g. see [1]) but I do agree that the organised caching of such passwords in Windows is a weakness. I'm quite surprised that LSASS.EXE is not protected in the same manner as AUDIODG.EXE [2]. Just goes to show how DRM protection is considered more important than system security. [1] http://philosecurity.org/pubs/davidoff-clearmem-linux.pdf [2] http://msdn.microsoft.com/en-us/library/windows/hardware/gg463417.aspx

This reminded me about an interview to an adware author, in which he told a story about creating unwritable registry keys and file names 'by exploiting an “impedance mismatch” between the Win32 API and the NT API': http://philosecurity.org/2009/01/12/interview-with-an-adware-author The adware registered a key in the Windows Registry with Null unicode in the middle of the string so that the UI of Windows failed to display or modify that string.

They are seriously less insecure by design than Windows. http://philosecurity.org/2009/01/12/interview-with-an-adware-author Don't tell me you aren't familiar with this.

Relevant, semi-related story about methods an adware-author used to write and conceal his adware in Scheme: http://philosecurity.org/2009/01/12/interview-with-an-adware-author

Every time I hear from someone that scheme has no real world applications, I like to pass them this link: http://philosecurity.org/2009/01/12/interview-with-an-adware-author

Your fingers are going to be crossed for a long time. I think the Steering Committee has too many divergent interests on it for there ever to be agreement on a serious standard library. Schemers are very DIY; for example, see http://philosecurity.org/2009/01/12/interview-with-an-adware-author. Rolling your own libraries on top of a tiny implementation is not particularly uncommon. (I just hope you can write more, uh, ethical software than that guy!) PLT has the most batteries of any distro I've ever seen (disclaimer: one of its authors was my undergrad advisor). That is, PLT is (a) free, (b) mature, and (c) has a fair number of modules written by people other than the developers of the language. There's no sense in waiting, just dive in. If you don't want to use PLT, Bigloo can call Java libraries---solving your battery problem in a different way.

nice read there. would make sense to post this link here too: http://philosecurity.org/2009/01/12/interview-with-an-adware-author

I am not here to defend those engineers, but it's a very easy trap to fall in to. An interview I enjoyed reading, as a warning, was with a programmer who wrote adware [1]. It was just one more small step each time, first kicking competitors off, than maybe sneaking in an easier re-install, then maybe not going away... In the case of these overdraft fees, it doesn't even seem to me that it would take a particularily skillful or creative engineer to implement it, just a conniving enough boss to ask. After that, it's just any one person who's willing to do it for the paycheque, and we see many other people do much worse to get a paycheque. As an engineer myself, it's even scarier when the problems are challenging and exciting, but the application scares me. Oh man, would I ever like to try and put together advanced intercept/listening systems (think cell phones, over the air)! I get excited thinking about all the technical challenges, so if someone wanted to pay and support me to do it, wow that'd be interesting! It takes me a moment to stop and think to realize that I don't want to be involved in giving that kind of power to the people who would want it. [1] http://philosecurity.org/2009/01/12/interview-with-an-adware-author