Category Archives: Newsletter Reprints

Why Does Windows Act Weird?

January 4, 2019Newsletter Reprintscomputer configuration, race condition, Windows 10Jerry Stern

A lot of Windows weirdness is from a technology term called a ‘race event’, like a speed race between lots of programs all trying to compete together. Basically, that’s when software does a few things, and expects to get feedback, answers, or results from those things, and those result arrive in an unexpected order because other software is overwhelming the system. The program doesn’t know what to do with that, and either triggers an error message, or locks up. Once a program locks up, it remains in memory, and Windows doesn’t always know that has happened. And then you see this:

Translation: “The message that says that Windows is ‘ShuttingDown’ isn’t shutting itself down, so Windows can’t shut down. Do you want to ignore “ShuttingDown” and shut down before Restarting, uh, Anyway?”

In the early days of personal computers, we had MS-DOS, the old Microsoft Disk Operating System. It could run one program and do one thing at a time. Multi-tasking (walking and chewing gum at the same time, or the computer equivalent), wasn’t possible at first. So a program could do this:
Print 'hello ' Print 'world'
And that would reliably print ‘hello world’ on some device, usually a monitor, or a sometimes a printer.

But somewhere around 1994, where we had the model 80386 processors and Windows 3.11, computer chips and software gained the ability to ‘time-share’ so that programs could take turns running on the processor, and could do things without waiting for another program. That makes a few assumptions: All programs involved follow the rules, the operating system does everything right, and the hardware is functioning normally.

And if it doesn’t, well, we might see ‘worldhello ‘ instead. That’s a very basic failure of a race condition. Each line of code worked correctly, but the results are out of order. Far more likely: gibberish output and broken Windows.

Since then, we’ve gained multi-core processors that can run far more programs at the same time. We have ‘services’ that run in the background, loading the Internet (communications), antivirus, system monitoring, video enhancements, surround sound, backups, phone-homes for both good and bad reasons, and on and on. As I write this, my computer shows 7 programs running, and 60 background processes (mostly services) either working or waiting for things to do. CPU load is at 2%, so this is normal operation for a modern PC with this year’s specifications.

But what happens if we add a few more antivirus programs and have them monitor all incoming web pages and email? Well, they all try to do things at the same time, and things slow down dramatically. Add some more stuff, like browser toolbars, which mostly run all day long. Or view a web page that automatically plays videos when you arrive, maybe serveral animated advertisements and a full-motion video. At some point, the software overwhelms what the hardware can deliver, either too much for the processor to calculate or too much internet content to pull down. Pieces are skipped. Videos are time-sensitive; if the image pieces show up out of order, the image looks blocky or garbled. Error messages can occur if the programs involved don’t know what to do with contents that are delayed, damaged, or out of order. Video programs know how to lower resolution or skip frames, so they can self-repair, to some extent.

Error messages, however, are written by humans, in advance. How do we do that? Well, the code is something like this, where lines 2 and 4 are ‘error traps’:

Print 'hello ' (and listen for an error number)
If error number received is 6, display 'Printer wants paper.' Print 'world' If any error received, display 'Unknown error after printing.'

OK, so that works unless there is an error that wasn’t expected at the time that it arrived. Most error messages say what the programmer thought was the obvious error that would happen after a specific line in a program. That’s when something happens, not what. It’s a guess.

Now multiply that by those 60 services and 7 programs that are running or waiting. Add some program code with incomplete error traps, or some software phoning home for advertising. The work area (memory) of the computer becomes messy and unstable, as programs receive web content or hardware status messages out of order, as gibberish, or not at all. In a severe case, the computer just locks up. But Windows does a fair job of cleaning up junk in memory, so what you see may simply be unexpected garbage.

So what does this mean for a computer user?

Error messages tell you more about when something happened than what went wrong.
Overloaded Windows gets weird.
Programmers can’t anticipate all delays or every possible error.
Software doesn’t deal with traffic jams well.
Waiting for Windows to recover from an error works, sometimes. If you don’t expect miracles.

And for things to do:

Refresh can help a browser program like Firefox or Chrome when the page looks like junk because it didn’t load completely. Press either F5, or Ctrl-R.
Rebooting a computer clears memory and work areas. (Washes the blackboard.)
Uninstall software that is no longer needed.
Avoid installing software that runs all the time.

Is That eMail for Real?

December 20, 2018Newsletter Reprintsamazon, computer security, phishing, securityJerry Stern

The easiest way for hackers and ransomware to mess with your computer is social engineering. Basically, that means ‘Wear the appropriate repair-guy uniform, walk into the building looking confident, and go directly to the system that you will be “fixing.” No one challenges that, right?

OK, well then, would you click on this email? I don’t remember ordering a pricy server from Amazon, but it looks like I’m getting one. I guess I’d better look in there and see who ordered it for me; could be that my account was hacked.

So what’s wrong with it? Here goes, most obvious and visible items first:

I ordered no such thing.
The sender’s email address has the wrong domain, ‘amazons.com’ which is also not the web address for Wonder Woman’s family island.
The return address for Amazon orders is generally auto-confirm@amazon.com.
The format of the email is simpler than the usual Amazon shipping confirmation, missing gray backgrounds, logos, and a picture of each item ordered. It looks a lot like an Amazon confirmation from ten years ago.
The order number is not a text link in the email, and the last section has too many numbers.
“it may take 24 hours for tracking information to be available in your account.” No, tracking shows up in Amazon before the email is sent; it’s Fedex and UPS that will just say ‘label printed’ until the next morning.
Finally, not visible above, if you float your mouse over the ‘Order Details’ button, which is missing the orange logo that Amazon would normally use, you will see the link, which goes to usintecmedical_ com_br, not Amazon. That ‘com.br’ points to a site in Brazil, probably hacked.

What to do? Will this big Dell system show up at my door? No. I TYPED ‘amazon.com’ into my browser, didn’t follow the link, and checked. No surprises there. However, that medical address in Brazil would likely have looked like an Amazon page, asked for a login, which it would keep and use, and then forwarded you to the real Amazon. Or the site would attempt to install malware. Be suspicious. These fake confirmations can look like they come from nearly any large company.

Long Passwords are better than Short C0mp1ex Passwords

October 31, 2018Newsletter Reprintslogin, NIST, passwords, securityJerry Stern

Long passwords are better than complex passwords

Who wrote the rule that says that passwords should have “both upper and lower-case letters, a number, and special characters”? And that they should be changed every 90 days? And that it’s OK to verify a password change by asking questions that anyone on Facebook could look up?

Well, that was NIST, the National Institute of Standards and Technology. And they’ve removed those rules. They’re as obsolete as using ‘monkey’ for a password, and that’s good, as the rules and the monkey were both just nonsense.

Anyone who has done the math can tell you that a 16-character password of nothing but lower-case letters is basically one answer in a set that is 26 raised to the 16th power. That’s 4.36 x 10 22, or 401,906,756,202,070,000,000,000,000. Or you can use 6 characters that include that ‘all possible characters’ rule, and that would be around 72 characters, to the 6th power, or 139,314,069,504. That long-but-simple password is 2.8 quadrillion times harder to guess.

This is, of course, based on stupid. Lots of it. Here are the basic assumptions, all wrong:

Humans can remember super-complex 8-character passwords. Yes, maybe one of them. Not one for each banking site, let alone all the trivial web sites that demand a password.
Online attackers can try to guess passwords in groups of trillions. They can’t, even on websites dumb enough to allow it; it would stop the ‘Net just from the traffic alone. A badly-built website would allow a few thousand attempts per day before crashing. Brute force guessing isn’t how attacks succeed on properly-configured web sites. Attackers steal your passwords with spyware, or they guess the top 100 most-popular passwords. Like ‘querty’ or ‘password’. They don’t run through every possible letter & number combination; that won’t work.
Changing passwords on a calendar basis does something useful. Nope. The assumption is that we use the same password everywhere, and once it’s lost, it will be used everywhere else after 90 days. Hackers don’t wait 90 days, and we can’t change passwords daily. But some users do repeat passwords. Don’t do that.
Asking questions about our own history is security.
Like ‘Pick your old address out of these 4 choices’ I’ve done it; they offered addresses of someone else I know that shares my name, my former address at an apartment, and my parents’ address, where I lived sometime in the prior century. I chose the answer of ‘Skip to next financial institution.’
And finally, there’s the stupid assumption that attackers know that you mixed letters and numbers.

They don’t, and it changes the math. If you told them, “I only use upper case”, well yes, that speeds up guessing. But they don’t know if you used all available characters, or three of them. Forcing us to use ALL those character types doesn’t add any security–a brute force guessing program won’t know which characters to guess.

OK, so the new rules are sensible, by comparison. They’re here:
https://pages.nist.gov/800-63-3/sp800-63-3.html

Most of it is government lawyer-babble, an extreme case of what they call ‘terms of art’, and it spends a lot of pages on what standards and rules apply to what type of activity.

The recommendations include these items, all sensible:

Password systems should reject dictionary words as passwords, along with the name of the service, or choosing a user name as the password.
Passwords should be at least 8 characters, and should be allowed to be as long as 64 characters.
Passwords will be stored as encrypted data, not as passwords, in a “one-way hash.” That means that a web site will ask for “the password that will encrypt to something we know”. In other words, they couldn’t tell anyone (or you) your password even if they wanted to, only if it matched what was entered when it was created. Not “it’s one letter off”, which is an answer I’ve gotten from a (former) bank, without even asking.

What does this mean for us?

Well, it means that “ZebraInTheCornfield” is a higher-security password than “f0OT6a11”, and it’s easier to remember and to type. And ‘monkey’ isn’t allowed, ever. Choose your passwords accordingly, with phrases of at least 16 characters that are easy to remember, but not something anyone else would know.