Security by denial

Recently I've stumbled upon the following news Cellphone Encryption Code Is Divulged. Look at the great authorities response:

The G.S.M. Association, the industry group based in London that devised the algorithm and represents wireless companies, called Mr. Nohl’s efforts illegal and said they overstated the security threat to wireless calls.

“This is theoretically possible but practically unlikely,” said Claire Cranton, an association spokeswoman. She said no one else had broken the code since its adoption. “What he is doing would be illegal in Britain and the United States. To do this while supposedly being concerned about privacy is beyond me.”

This looks like a classic sample of Security by denial to me. I should feel relieved knowing that this kind of research is illegal in several countries and that we know only one person that managed to break this encryption. Sigh!

A question to the reader: Do you think it is a good practice for some countries to make illegal the efforts to break those kinds of encryption?

I believe this leads to false sense of security and give advantage to those, who do not hesitate to break the law over those who do obey it. It also leaves all of us, who uses this technology every day, in the dark.

Old story: funny bug in Windows 9x/ME

It's been a while since I've last posted here, but today I'm in a blogging mood and decided to share an old story. It happened around the year of 2002 or 2003 I don't remember exactly.

I was working together with Georgi Georgiev on a small program called "Visual ISO" (can be found on my site). We've found a serious bug. After the user quits the program ALL windows icons (those on desktop, start menu, windows explorer etc.) disappear. I've started to search for the problem. Several hours and a dozen restarts later I've finally found it. It appears that when you get the System icon list handle with Win32 API call - you could successfully call the corresponding API method to FREE IT! This worked on Windows 9x/ME but did not work on Windows NT and above. You have no idea how fast Windows becomes, when there are no icons to display!

Being a good network citizen I've created a small program to reproduce the problem and decided to contact Microsoft about it. However this appeared to be a problem. No contact info could be found on their site. I did several web searches, but still no luck. So I contacted a person known as a security expert, to help me. He replied he is using "security@microsoft.com". I wrote an e-mail with something like: "I've found a problem in Windows API, but I don't think it is security related. Please point me to non security related e-mail". I've got a kind automated reply and the waiting began. More than a month later I've got a reply from some support center in Germany stating something like: "If you have problems programming please contact ...."

... and that's how the problem was never reported ...

That was my story :) and here is my proof of concept code (not tested lately, it's a miracle I've found it at all)

#include <windows.h>
#include <shellapi.h>

int APIENTRY WinMain(HINSTANCE hinst, HINSTANCE hinstPrev, LPSTR lpCmdLine, int nCmdShow)
{
   SHFILEINFO shFinfo;
   HIMAGELIST hImgList = (HIMAGELIST)SHGetFileInfo("", 0, &shFinfo, sizeof(shFinfo),    
                       SHGFI_ICON | SHGFI_SMALLICON | SHGFI_SYSICONINDEX);
   if (NULL == hImgList)
       MessageBox(NULL, "Cannot retrieve the Handle of SystemImageList!",
           "Error", MB_OK | MB_ICONSTOP);
   else {
       if (ImageList_Destroy(hImgList))
           MessageBox(NULL, "SystemImageList destroyed!", "Success", MB_OK | MB_ICONINFORMATION);
       else
           MessageBox(NULL, "Cannot destroy SystemImageList!", "Error", MB_OK | MB_ICONSTOP);
   }
   return 0;
}