It doesn’t even really matter at this point. Let’s be honest… the average computer user doesn’t know the difference between U2-Somesong.mp3 and U2-SomeSong.exe.

To make matters worse, some attacks may even occur if you are dealing with safe file types, like a PNG [microsoft.com] or even PDF [softpedia.com]. Some security problems exist due to the user’s ignorance or idiocy but “some” isn’t exactly the same thing as “all”.

There are no safe file types. All files can be viewed as programs meant to run in a specialized virtual machine (the program which is used to open them). For example, a PNG file is a program which, when run, will compute an array of bytes (the image pixels). The same goes to PDF. In this view, since all files are programs, it is in principle possible that any of them could contain code which can result in unexpected behavior of the virtual machine executing them.

Of course some file types are easier to compromize than others, either due to sheer complexity or ambiguity of the specification or because they are Turing complete. However, it is impossible to guarantee that every viewer for any file type is free of defects. Anyone still remember ANSI codes for DOS, which could be embedded to text to change color but also to set macros to keyboard keys when the file was viewed ? And of course SQL injection attacks are based on formatting a text string so it will cause unexpected results, not to mention causing a buffer overflow with an overlong string.

I repeat: there are no safe file types. They all have a potential to contain malicious code, because there is no such thing as data which is not also a program. From a certain point of view, GIMP is simply a very specialized compiler…

Is a text file containing a single line of text followed by a carriage return a program? How about the standard input device? When I type at the console keyboard, is that a program feeding into a “virtual machine” created by the console driver? If not, why is a disk device different from another device?

I think you’re missing the fundamental theorem of modern computer science — that “data” and “instruction” are completely interchangeable. See generally, the halting problem.

Is a text file containing a single line of text followed by a carriage return a program?

It can be. For example:

'; ROLLBACK; UPDATE users SET admin = true WHERE username = 'ultranova'; 'If the virtual machine which handles the username field of Slashdot login form naively passed this string to the database layer without specifically quoting it, this text string would make my account an admin account; well, actually, since I haven’t studied Slashdcode, it propably wouldn’t, but the point still stands: even text is not an inherently safe data format in all circumstances.

How about the standard input device? When I type at the console keyboard, is that a program feeding into a “virtual machine” created by the console driver?

The virtual machine in this case would be whatever program receives the input. And yes, the text you type is indeed a program being executed by that machine; each time it receives a keypress from you, that keypress instructs it to do something, right ? Even if that something is merely to output the letter (altought a text editor would also store the input internally, of course). And that is what a program is: a list of instructions.

If not, why is a disk device different from another device?

It isn’t.

I’m with you on this. I know there may be a True Computer Science definition that makes the GP true, but I don’t tend to think of data as a program. Some binary data could be considered code to execute, but surely not text files that are parsed?

Okay, sure, there are scripts, but they have special parsers that turn the text into Real Code that CAN execute. I don’t think notepad can turn a text document into Real Code.

 

The OP has suggested a view that I have often thought about myself, although I have rarely found anyone who quickly grasps the concept.

Think of notepad since you have mentioned it. When notepad opens a file it looks at the contents and does certain things depending on the content of the file. If the first character is hex 61 then notepad will display an “a” in the first character location on the screen. OK, so that is because hex 61 is ascii “a” but that is an arbitrary choice that has been standardised. You can if you like look at notepad as if it is an interpreter for a rather strange and limited language where 0×61 is one of the commands. In some ways it is rather like those old interpreted basics since it is responding both to the file you have opened and to the keys you press on the keyboard. There have been attempts to make languages where instead of typing in commands you select icons with a GUI and join them up in a flowchart like sequence. The ones I saw were interpreted but there is nothing to stop them being a compiled language and thus eventually resulting in real code in a binary file. It is only a small step from there to looking at say photoshop as being a sort of real time mode interpreted language. (Real time in the sense that the commands execute straight away, like the mode in the old basics.)

In some ways this insight is interesting, although not necessarily very useful. But it should serve to remind us that much of our thinking about computers is based on elaborate analogies which the computer itself has no knowledge of. So the distinction between data and code is purely arbitrary. This tends to be more obvious when you play around with assembly, where the machine will happily let you attempt to execute data. For example you can set up a jump into a block of what is meant to be data and the machine will not object in the slightest. The results will of course be unlikely to have any meaning in terms of the analogies we have set up for ourselves, but the machine neither know nor cares since it has no means of doing so.

So Notepad will in fact execute certain real code in response to both the contents of the data file and the keyboard actions of the user. That is fine and good and need not be of any concern to the user, unless what it does is not what we expected in terms of the intended behaviour. An example of this sort of thing would be a buffer overflow allowing an external person to push what should (in terms of our analogies) be data into a place where it will get executed as if it was code.

 

This is the case for Von Neumann machines [wikipedia.org] because they have a single memory area for programs and data. An attacker only has to move the current program control flow to some compromised place in the data (say some lines of machine code hidden in a corrupt bitmap) and the processor will happily compute those instructions. In other architectures, namely Harvard architecture [wikipedia.org], there are physically seperate memory locations for programs and data and the processor WILL not carry out instructions “hidden” in data. A shift towards seperate memory architectures is required to secure computers. Unfortunately a paradigm shift at this level is all but impossible in general purpose computing.

 

No, but whatever program is running on the processor and interpreting the data will. SQL database, Python interpreter, Mozilla… all of these are based on treating text (data) as a list of instructions (program). It is obvious in the case of Python, since that is openly a programming language, but HTML itself can be considered a series of instructions for building the DOM tree, which then gets rendered, as dictated by default rules and those given by optional CSS; and of course there is always Javascript.

It is impossible for a general purpose computing to be immune for this class of attacks. Not just “all but impossible”, but flat out impossible due to a logical flaw: the very ability to simulate different machines which treat data as a list of instructions – program – is what makes it a “general purpose” computer. If you can program it, you can program it to misbehave when it reads a suitably malformed PDF/PNG/HTML/SQL/whatever file. The only way around that would be for the computer to be intelligent and capable of common sense, so it could understand that the programmer propably didn’t mean for it to execute any random piece of SQL someone feeds into a Web forum login box; but then it would be vulnerable to social engineering.

So after a little toying with the carousel and learning a few cool effects of jQuery , I made up http://gallery.naveeng.com . Right now it is very very basic and it’s development is still under progress. I will be adding a lot more features to it, which include:

• Multiple Albums
•  Admin Panel
• User Comments
• Ratings
• Last Added Pictures
• Random Pictures
• Tags

It may take a lot of time but one day all the above features (plus a lot more!) will be there for sure! The gallery has a lot of jQuery JS code, with the image details stored in XML format on the server. The server side scripting and image manipulation are done in Perl using the fantastic PerlMagick API of ImageMagick .

• The code needs to be modified if the hash keys contain any digits
• The sort algorithm can be changed as per the requirement, by default I’m sorting by hash values which are digits

print grep {s/\d//g} grep {/1/} map { $i+=1 , $_.=$i , “\n”} sort {$hash{$a} <=> $hash{$b}} keys %hash;

Download the module from CPAN or elsewhere. Place it in any directory, where you have permissions. Preferably, create a directory called

lib

in the application directory and place your module there. Untar it, you will see a few files and folders – Makefile.pl (to install the module, we don’t need this) , Readme.txt (this either), Examples (not required), lib directory – this is the only thing we are concerned with. It contains the main module files. Go inside the lib directory, and copy all the folders (if any) and all .pm files and place them directly inside the lib directory you just created. Remove all other files and folders.

The next thing which you need to do is go to the Perl code where you want to use that module and write the following:

BEGIN { unshift @INC, "./lib"; }

use Module::Name;

And voila!! Your code works like a charm with all the functionalities of the module included.

How it works? - When you use a module in a program, like

use CGI::Ajax;

perl searches for it in a predefined library search path on the system. You can determine which directories are in the path by executing

perl -e 'print for @INC;'

Any module in order to be usable in the program needs to be in any of the directories above, which is where the modules get installed if installed via

cpan or ppm

command or using Makefile.pl.

But in the situation discussed, it is not the case, as we cannot install a module as it should be. Instead what we do is place the modules in a directory of our choice (lib) and then insert the path of that directory in the

@INC

so that later when the perl interpreter tries to do

use Module::Name;

it finds its path in

@INC

Why BEGIN { } ? -

use Module::Name

happens at compile time, when the interpreter reads the program while

unshift @INC, "./lib"

happens at run-time, after the compilation, i.e, attempt to load the module, even if the latter is placed above the former in the program. So in order to force the program to modify

@INC

before trying to use the module, we use

BEGIN { }

block. Any code which is written within

BEGIN { }

block is executed at compile-time as opposed to other code which is executed at run-time.

Note: Remember that many modules have further dependencies, i.e. modules which are required for the former to work. And if these dependencies are not on the system, the code won’t work. You need to perform the above operations for each of those dependencies as well. For example, if CGI::Ajax requires Class::Accessor to work, you need to

a) create the directory CGI and place Ajax.pm within it

b) create the directory Class and place Accessor.pm and the directory Accessor within it and

c) unshift/push the path of the directory which contains these 2 directories CGI and Class, into @INC.

I have used this method to use more than 30 odd modules and have faced no difficulty whatsoever. However it will not work if the module’s Makefile.pl does more than just copying the .pm files in the right place and do some other work such as using external C libraries etc.

Another method of extending

@INC

is setting the

PERL5LIB

environment variable on your system to include the path of the manually placed modules.

In Bourne Shell do something like-

PERL5LIB=/path/to/module/directory; export PERL5LIB

It is useful when you do no want to write the BEGIN blocks in all the files where you use the module. But only users who are setting the

PERL5LIB

environment variable can only use it and other users can’t.

The auditorium was good enough with a capacity of around 150, well-airconditioned and the stage space more than enough. The LCD projector could have been more to the center of the stage, rather than just behind the dais, with speaker coming right in between the screen and audience. The only and a very big disappointment from the arrangements point of view was the absence of microphone!! Huh! A seminar without a microphone! Well, the equipments were there but the keys to them were with a gentleman who preferred skipping the college that day and was untraceable!

So after lot of failed efforts by the volunteers to get the microphone working – they even brought another one, but it didn’t work – the event got underway at 11:30 AM, 1 hour behind schedule. Hussain was the first one to start off on RIA – Rich Internet Applications. It was a great insight on the Web 2.0 client side technologies which are riding most of the snazzy websites today and threw light on AJAX, Flex, Flash , OpenLaszlo among others. His thoughts were well received by the audience with quite a few questions popping up on the subjects.

Next came Pradeep with a talk on what is AJAX and how to implement it in Web Apps. He showed some nifty piece of code on how to create xmlHTTPRequest and fetch data from the server in asynchronous mode. Also included were examples on how to use JSON instead of xmlHTTPRequest to implement AJAX. The content of his presentation is available at http://www.go4expert.com/forums/showthread.php?t=6829&referrerid=146 and can be downloaded from http://www.slideshare.net/s_pradeep/building-applications-using-ajax

Shabbir bhai resumed the proceedings after a well deserved lunch break with his expertise on optimising web pages, and gave a lengthy (detailed) talk on Speeding up your Web Pages. He covered topics such as Database Design, Query Optimization, Web Server & Programming tips and tweaks among others.Although his soft voice was finding it hard to make up for the lack of mic, he too put up a great show.

I was next on the block. With fears of rushing too fast and getting over with my stuff in 10-15 minutes, I started off on Web Development in Perl. Since most of the audience were students with little or no previous exposure to Web Development, Programming and Perl, added to the fact that previous sessions were a bit too technical for most of them, I had to make it as simplistic as possible. So I stressed most on the introduction part which dealt with explaining the Web Development cycle, internet in general and programming. Yet, technicalities about Perl needed to be covered as they were a part of my presentation and most importantly, were the focal point of the show! After around 30 minutes Hussu started prompting me that we were running out of time and I needed to pack up fast! So I hurried with the last part of the presentation by going through the points of difference between Perl and PHP.

The presentation can be downloaded from http://www.slideshare.net/naveeng/web-development-in-perl/

The first of its kind Web Technology Conference on Open Source Technologies, WEBOSS ’07 is being organised in Kolkata on Saturday 13th October, 2007. I was pleasantly surprised when Hussain (Hussu) , friend of Pradeep, called upon me to ask whether I would be interested in speaking at the event. The event focuses on Web 2.0 technologies and is a great attempt by Hussu’s Teks to create awareness about what standards and practices are dominating the industry today. Other speakers include Hussu himself – on RIA, Choosing the right Technology and Ruby on Rails , Pradeep on AJAX, Shabbir bhai on Speeding up Web Apps.

I will be sharing my thoughts mostly on Perl and CGI with some flavour of Web 2.0 as well. Its really exciting to be a part of such a great initiative and kudos to Hussain and his team for pulling it off!

The venue will be WBUT Main Campus (West Bengal University of Technology) in Salt Lake, Kolkata – Click Here for Google Maps Location. So a good proportion of technology students, who will be joining the industry very soon, will be a part of the audience.

It is a free for all event and participation/volunteering is highly appreciated. The details of the event can be found at http://weboss07.pbwiki.com/ . So register yourself for the event and be a part of tomorrow. Sponsorships Welcome

1. Go to Start —-> Run . Type regedit, then enter
2. Navigate to HKEY_CURRENT_USER ——–> Software —> Yahoo!  —–>pager—->Test
3. On the right pane , right-click and choose new Dword value
4. Rename it as Plural
5. Double click and assign a decimal value of 1
6. Now close registry and restart Yahoo! messenger .For signing in with new id open another messenger. Open as many messengers u need

The above has been tested on Windows XP and Yahoo! Messenger Version 8.1.

Cheers

(Click on the image to enlarge)

I guess the guys at BSNL need a good sleep! I opened my mailbox a while ago to be shocked by the number of times the payment notification mail had been sent by their mail server. I know that it is an automated process but something is going amiss big time. Just imagine the magnitude of bandwidth and network resources this dirty exercise would have consumed, as the same would be have occurred for all customers who have opted for email notifications (and by conservative estimates, it should run into lakhs). Thank God for Gmail, which has a conversation view which condensed the whole mess into just 2 rows, else 3 pages of my inbox would have been gulped by the same trash! WTF!