This is a cross-post from my company’s blog that I posted today.

The injection of malicious <script src="malicious.js”> JavaScript tags on a massive scale into everyday popular and reputable Web sites, commonly visited by the casual surfer at home (and at work), has been the trend. Today, as my team and I here at Security Labs made our routine rounds around the block to spy on what the bad guys are up to next, we discovered a somewhat weak but interesting piece of malicious code, whose techniques date back to the early days of encryption - the substitution cipher.

Wikipedia has a good introduction on this topic:

In cryptography, a substitution cipher is a method of encryption by which units of plaintext are substituted with ciphertext according to a regular system; the “units” may be single letters (the most common), pairs of letters, triplets of letters, mixtures of the above, and so forth. The receiver deciphers the text by performing an inverse substitution.

Doing a character for character substitution, using a keyword of “MALCODE“, we get:

Plaintext:  ABCDEFGHIJKLMNOPQRSTUVWXYZ
Ciphertext: MALCODEHIJKFBNGPQRSTUVWXYZ

Using that mapping, we can encrypt a message from a hypothetical botnet master to his/her herd of bots from this:

LAUNCH THE DDOS ATTACK NOW

to this:

FMUNLH THO CCGS MTTMLK NGW

It’s a very trivial algorithm, and extremely weak in terms of the protection it provides (by today’s standards), but it is definitely good enough to conceal the true message from casual prying eyes. This was certainly as good as bulletproof during the days of Julius Caesar (wow, we’ve come a long way!).
Read more

I was messing around with Google’s App Engine this week, and learning some Python (the programming language, not the snake! I had someone ask me that) at the same time.

App Engine (for scalability reasons) does not support SQL, but instead provide and API they call Datastore for persistent storage. For the app I made, I queried for data ordered by date, but for some reason the result set still comes out unordered. Odd. I’m probably not calling it right. Anyway, it was just an exercise to see what App Engine was all about.

Here’s a replica of the Facebook Wall I made, feel free to write your heart out. As you can see, I’ve had friends say some really nice things about me already. The full address is liew.appspot.com .. but there’s an iframe to it if you’re too lazy to click on that link :)

Update 6/15/2008 — Tinkered around a little and realized why its unordered .. I lost the timestamps on some of the posts, so for those that come out unordered, it’s because there are no records of which came first (the timestamp was NULL). It should be fine going forward. The un-stamped posts take precedence in ordering over the stamped ones, so you may have to scroll down a little to see your post (or just CTRL-F it).

Cell phones, mobile phones, hand phones, whatever they are called, wherever they are in the world–can change the world! We already see it help drive economic development in microfinance, and now, we’re making strides with healthcare technology, another field I’m interested in because I love seeing technology change lives. The convergence of sophisticated UX-centric mobile devices, Internet/Web 2.0, Software as a Service, cloud computing — not to be missed!

From the article:

Despite all the advances in medical diagnostics, two-thirds of the world’s population has no access to imaging technologies. Worse, about half of the imaging equipment sent to developing countries goes unused because local technicians aren’t trained to operate it or lack spare parts, according to the World Health Organization. But thanks to the proliferation of cellular and other wireless networks, researchers are stepping up efforts to deliver crucial medical services from afar. “You go through India, anywhere, in the middle of the road, there’s someone with a cell phone. A friend calls me from the jungles of Costa Rica,” says Rubinsky. “I can see so many applications in which the cell phone becomes an integral part of a medical device. A cell phone can cut the cost of almost every [diagnostic] device.”

We have the $10Mil fbFund for Facebook apps, $100Mil iFund for iPhone apps, $10Mil for Google Android apps, and the to be announced $150Mil Blackberry apps fund — will we see a fund to drive healthcare technology apps?

With the iPhone spurring more handset makers to introduce similarly robust devices, the U.S. market for medical cell-phone software is expanding rapidly. Sales of phone applications for medical professionals are expected to rise from $111.8 million last year to $276 million in 2011, according to consultancy Ambient Insight.

On the “heavier” tech side, we’re definitely making huge strides in having robots that can now operate on people.

Consider this: Suppose there are only 10 surgeons in the world that specialize in this really complicated brain disease, affected by not that many people, but the number of victims dying from it is significant enough (say, 5,000 deaths a year worldwide). There’s only so many surgeons to go around, and with that many victims around the world, even if these surgeons worked themselves to death to save the world, they can’t possibly help everybody with just two hands and only 24 hours in a day. Seriously, it takes almost a day to just travel halfway across the world, and that’s just a one-way.

The solution: remote surgery. In terms of supply and demand, the supply is scarce (the Ph.Ds in this very narrow field) and the demand far exceeds the supply, and the number of victims is probably going to grow at a rate faster than the rate Ph.Ds in this field can be minted. Technology here serves to increase supply, that is, not by letting universities churn out more doctors (although that would work too), but rather by increasing the “utilization rate” of the existing doctors by allowing them to perform their work anywhere at anytime, by saving on travel time and expense. Even if we had an infinite amount of money to spend on the fastest jets, nobody can buy more than 24 hours in a day. 10 hours on a jet spent traveling is 10 hours that could be spent operating on a patient.

“If you are looking at the future, it’s hard to envision a hospital not offering robotics,” said Robert Glenning, chief financial officer at the Hackensack University Medical Center in New Jersey

Technology, changing lives and making the world a better place–I love it!

This post consists of my “value-added” thoughts on David Kirkpatrick’s article on Fortune here.

Since I love all things technology and passionately believe that it wields the power to change the world, these numbers are just plain interesting to me. I’ve overlayed on the data some general technology trends on Web 2.0 startups, venture capital, microfinance and poverty, all cleverly slapped into one big fat blog post. Why? Because they’re all inter-connected, and I haven’t written anything all this week (been so darn busy lately!) Off we go.

Indonesia:
- 1 in 100 owns a PC
- 1 in 1,000 has broadband Internet
- 63 million cell phone subscribers, representing 27% of the population (of 234 million)
- Annual cell phone subscription growth rate: 36%

India:
- 166 million cell phone users
- Last year’s cell phone subscription growth rate was 84.5%

Switzerland:
- The Swiss have 85.1 PCs per 100 persons, beating the United States at 80.3 PCs per 100 persons

Global PC penetration is 12.9 for every 100 people. Room for growth? You bet. Many of PC owners are obviously in well developed countries, and not poor countries with lots of people. OLPC’s efforts to reach the billions at the BoP will move the needle here, if they succeed. Not forgetting the “middle” market, more of those who are neither rich nor poor will also buy computers and get on the internet. (Better start loading up on some PC stocks!) But wait, am I sure that the middle-class is not going to get poorer and not buy computers? Well the stats from Hans Rosling’s TED talk show that the overall trend here is that the world is slowly digging itself out of poverty, and I take comfort in that. Actually, read on below as I describe another trend that supports that.

Now, for some cell phone stats:

United States:
- 77.4 subscribers per 100 people
- Everywhere in Europe (except Turkey) exceeds penetration in US. Italy is at a whopping 135.1 cellphone subscribers per 100 persons.
- Hong Kong beats the US in penetration too, at 135.3

The global average is 41.6 per 100 people.

Cellphone usage growth in fast growing markets last year*:
- Peru: 57%
- Vietnam: 114%
- Pakistan: 170%
- Ukraine: 185%

*numbers might be fuzzy, but they show a general trend

What’s also important to note about this upward trend in adoption is that mobile phones were the crucial piece that first enabled the poor in Bangladesh to get out of poverty (see section on Village Phone). Women built business models around it and turned it into a source of income. These days, mobile phones are also playing another role in microfinance: enabling the transfer of money and information over, well, mobile phones! In poor countries, a brick-and-mortar bank branches with ATMs are hard to come by (ditto for computers and broadband), so mobile phones are serving this unmet need, facilitating microfinance and thus helping reduce poverty.

Other interesting stats:
- 1.3 billion of global population connected to the Internet, compound annual growth of 20.3% for past 8 years.
- Internet ad spending of $40 billion is only 6.6% of global total of $605 billion and is growing at 33%. (Ha, I should double down on this little company while I can!)

Data from 2008 Global Internet Snapshot compiled by Imran Khan, senior analyst at JP Morgan. (hmm, can anyone get me access to that full report?)

That’s why medium and big tech companies can weather the unfavorable US economy trend by going abroad. Fruit trees in your backyard not yielding? Then go after the greener pastures outside of your backyard too. It’s called diversifying. That’s the other thing I love about software is that it’s not a physical object–a computer scientist can create value with merely a laptop (and some coffee!) The cost of making that first software copy is the most expensive, then every other subsequent copy ad infinitum is basically free. This is just the nature of information economics, and has obviously served Microsoft very well. Actually, tiny tech startups can do this too — by leveraging the distribution power of this thing they call the internets.
Read more


While most of us in the well developed parts of the world battle attention poverty (I’ve come to peace with the fact that I will *never* be able to keep up with all of my RSS feeds!), we forget that this is actually a luxurious problem to have. Many in the underdeveloped world face the opposite problem: information poverty–the lack of access to information, which in turn means lack of access to knowledge and education, which really feeds back into the cycle of financial poverty.

As more people hop on the internet bandwagon in the developed world at rates that dwarf technology adoption in the poor countries, this will obviously further increase the gap between the rich and the poor–which we all know is a not a good thing. If you are unable to find food to eat or medicine for your baby, would you consider violence and theft? Decision making under those circumstances are difficult. The poor becomes an easy target for people with bad intentions; can you imagine someone walking up to you with a gun and saying, “Fight for me, and I’ll give you food.”

This digital divide is not a newly discovered problem, and is actually one of the initiatives of the World Economic Forum. I’m passionate about technology because I believe it’s an enabler for a better quality of life. I’m excited that I’m not the only one who thinks so, and there is a real startup with real products with that same vision (imagine that!).

Inveneo says it well in their mission page:

Information and Communication Technologies (ICT) can:

  • help save lives (rural healthcare and relief)
  • provide better economic opportunities (agriculture, market access)
  • help enforce human rights (monitoring/reporting)
  • offer a better future for children (education)

Read more

MSI announced that the company has recently invented the world’s first powerless air cooler for computer motherboards. For those new to computer hardware, as we ignore Moore’s Law and advance computer technologies by making them faster and store more data, cramming more and more transistors into a piece of silicon, the heat generated by all these components start becoming a non-negligible problem–as anyone managing a data center with hundreds of computers will identify with.

There are many ways to cool the insides of a computer, but the most common is through the use of heatsinks and fan’s. Computer hardware junkies prefer a more advanced hack: liquid cooling, a more quiet and efficient (and l33t) way of dissipating heat from their overclocked CPU’s. This invention by MSI makes the fan inside your computer power-free, thus less power drawn from the computer power supply.

The basic idea employed here is one derived from the Stirling Engine. MSI’s invention captures the heat from the component, whose energy is then converted to push the fan blades around, which in turn cools the heatsink.

From their press release:

The “Air Power Cooler” transfers the chipset heat into air momentum, when the air becomes hot, the air will expand then push the fan to rotate and In doing so cooling the heatsink immediately. After the air moves from the bottom to top of the piston, the air will become heavy to push the up piston down. The better air piston design can transfer over 70% heat power and transfer to air power, that’s great efficiency transfer from Stirling engine theory. In a comparison with solar power the transfer rate is only around 20~30% requiring more surface and as a result cost.

I think the claim of besting solar power is interesting, but would like to see some independent tester verify that statement (just for my assurance that this isn’t the typical corporate PR mudslinging nonsense).

This actually reminds me of Tesla Motors’ regenerative braking system. Energy from deceleration is captured and stored for later use in acceleration. Genius!

In a battery-powered electric vehicle, regenerative braking (also called regen) is the conversion of the vehicle’s kinetic energy into chemical energy stored in the battery, where it can be used later to drive the vehicle. It is braking because it also serves to slow the vehicle. It is regenerative because the energy is recaptured in the battery where it can be used again.

Tesla Motors is an interesting electric car startup in Silicon Valley headed up by Elon Musk (of PayPal fame), who also started SpaceX and SolarCity (I’m an admirer!).

But I digress.
Read more

No, I’m not referring to some zen-ish meditation. Check this out.

This is why I love technology. If I recall correctly, humans are the only living things that know how to augment our own capability with tools. And we’ve just taken it to a whole new level by separating our body from our conscious mind. Look at how fast the robot can quickly scan the left corridor and then the right corridor at the T-junction. It’s almost as if the operator is there in person, quickly turning his head from left to right (which he is, just remotely!)

Note to self: perfect cubicle toy for corporate drones.

This is pretty darn cool. I never thought of immediately taking RAM out and freezing it. The fading picture of the graphic as the capacitors lose their charge is also pretty cool. You read the theory of why RAM is volatile memory but you don’t actually get to see it in action (or at least, I didn’t!)

Coverage from news.com

A BINARY STEP COUNTER?! OH MY! This is *amazing*, you have to see it. This reminds me of a rudimentary transistor, and how we keep cramming more and more of them into a piece of silicon we call a microprocessor, on top of which we have this thing called a computer, on top of which we have this thing called web two dot oh, … and ..

From TED. Watch his commercial here:

Summary of Wikipedia’s entry on Disruptive Technology:

  • Disruptive technology/innovation is a technological innovation/product/service that uses a “disruptive” strategy, rather than a “sustaining” strategy (incremental improvement)
  • Can be classified into low-end and new-market
  • New-market disruption aims at non-consumption/untapped market; targets customers who have needs that were previously unserved by existing incumbents.
  • Low-end disruption aims at mainstream customers with needs not met/underserved/overserved by existing solutions. Low-end disruption targets customers who do not need the full performance valued by customers at the high-end of the market
  • Disruptive technology can dominate market by filling a role that older technology cannot fill or by displacing incumbents by means of successively moving up-market through performance improvements (e.g. digital photography)
  • Low-end disruption occurs when the rate at which products improve exceeds the rate at which customers can adopt the new performance. Therefore, at some point the performance of the product overshoots the needs of certain customer segments. At this point, a disruptive technology may enter the market and provide a product which has lower performance than the incumbent but which exceeds the requirements of certain segments, thereby gaining a foothold in the market.

I’m somewhat familiar with the name Ray Kurzweil and his works in artificial intelligence, and today I can finally associate a face with that name. Below is a vid clip of a talk he gave at TED. Little things like that makes me truly believe in technology, which I have a passion for. If you have 23 mins to spare, and you somewhat like technology — then you will like this:

I was thinking about Tivo earlier. While it’s no rocket science product, it certain has become a common standard in households in the US now. In fact, Tivo has achieved the status of Google in the sense that people now use it as a verb. How many times have you heard, “I tivo’d that show”, “I will tivo that movie tonight”, “wanna come over, I have that game tivo’d”?

Anyway, I just thought it was interesting to note that one of the ways Tivo creates value for its users, is by reducing/eliminating the opportunity cost for its users. Opportunity cost or economic cost, is the cost of something in terms of an opportunity forgone (and the benefits which could be received from that opportunity), or the most valuable forgone alternative (or highest-valued option forgone), i.e. the second best alternative.

For instance, if there were two shows on two different channels that will show at the exact same time. If you only had one TV, you must pick only 1 show to watch. Even if you had 2 TV’s, you can’t really watch both at the same time. So in the pre-Tivo and DVR days, you would pick the show you liked better. The opportunity cost for viewers would be that other show that they unfortunately could not watch. Tivo fixed that. And good for them, because this is a pain that customers were willing to pay in order to get rid of. Just as a contrast, there are plenty of problems that aren’t painful enough such that customers aren’t willing to pay for a solution.

I like problem solving, and am on the lookout for interesting ways to create value. This is one way, so from now on, I will keep my eyes peeled for opportunity cost problems that can be solved.

Phew, what a long ride it has been! My undergrad math research paper that I co-authored with Dr. Andrew J. Hetzel and Dr. Kent E. Morrison is finally published in MAA (Math. Assoc. of America)’s June/July 2007 Monthly.

In this article, we exhibit the results of an undergraduate research project where we asked the question: How frequently is an n x n matrix with integer entries diagonalizable over the complex numbers, the real numbers, and the rational numbers, respectively? Such a frequency is couched in terms of a variant on the number theoretic notion of “natural density.” Complete information is given for the frequency of diagonalizability over the complex numbers, and results are provided for the frequency of diagonalizability over the real numbers and the rational numbers if n = 2. At the end of the article, we provide three open questions based upon this work that may be suitable for other undergraduate research projects.

Here’s a preview (options to view in other formats are available, even in voice), courtesy of scribd:

I presented the research on this with April Jeffcoat at the AMS and MAA 2004 Joint Math Meeting in Phoenix, AZ. Here’s a picture of what appears to be perhaps one of the nerdiest time in my life. (you can drool over the sexy graphs charts behind me)

April "May June" and Jay "Kay ELL"

So I was thinking about this today, you know how people carry around those key chains with a seemingly random number generator that’s used as a password? I have one issued by my company, and the way it works is, to access this thing (this resource, whatever, I’m trying to be generic about it), I type in the number showing up on my key chain at that very second, PLUS my password. You can read up more about two-factor authentications here.

Basically, the upside of using this RSA SecurID key chain I have, is that even if someone were to find out what my password is, without knowing the number showing up on the key chain (which changes every 60 seconds), my password is useless. So they would require physical possession of my RSA SecurID token. This is great, because if my password got leaked to say, some random guy in Russia, and I’m here in the US — he is going to have to come a long way to get my token, that is, if he can get it out of my kung fu grip. Likewise, the possession of my SecurID token without knowing my password is equally useless. I could show you the number on the token, but without my password you can’t gain access to anything.

I realize that some banks actually issue these hardware random number generator “tokens” to customers. Now that’s a great security practice, but these tokens are not cheap. I think they cost about $20-40 per unit. I’d imagine how costs would stack up once the number of customers start growing. Anyway, so my idea is this — we know that most people today have cell phones, and most people have a cell phone service where they have caller-ID (the ability to see the number that is calling them). Let’s say a big bank here in the US were to buy up 1,000 phone numbers. Then, whenever their customer wants to login to their website online — one of these 1,000 phone numbers would call the customer’s cell phone. This number would be then used in conjunction with their password to access the site.

Basically, we’re turning your cell phone into a RSA SecurID token. If some bad guy knew your password, UNLESS they also have possession of your phone, they won’t know the right number to punch in. They could guess, but first of all, they would need to know the 1,000 numbers the bank first possesses. That’s hard to figure out. The bank could do better than 1,000, perhaps 10,000. And, they could rotate the numbers. Meaning, buy 1,000 phone numbers, use these for 2 weeks, sell off these phone lines for another new 1,000 numbers.

The other requirement would be that after one of these 1,000 numbers call you, if you do not login to the website within say, 3 minutes, it will be invalid. So if you take longer than 3 minutes (perhaps you got interrupted, picked up a phone call, whatever), then the bank will just have to call you from another number.

So let’s recap how difficult it is to break this system. An online bank robber would have to know your password, and steal your phone. What if they have your password but dont have the guts to steal your phone? Can they do without the phone? Let’s see what they would have to guess without your phone.

  1. US phone numbers have 10 digits. Each digit goes from 0 through 9. So anything from 000-000-0000 to 999-999-9999 is possible. That’s 10 billion numbers
  2. Of these 10 billion numbers, you have to figure out how many of these actually belongs to the bank. Let’s take a conservative approach and say the bank has 1,000. So your odds are 1,000 divided by 10 Bil or a chance of 0.0000001. That’s a pretty darn small number. As a virtual bank robber, you wouldn’t know this exact number anyway. Unless you have an insider working for you who knows. This should be a highly guarded secret
  3. Now let’s say, these 1,000 numbers change on a bi-weekly basis. The numbers were hard to guess to begin with, and now they are constantly changing. So if you knew that a bank had 123-456-7890 as one of it’s numbers today, that may no longer be true tomorrow.

The added security benefit is this: If you were at the beach and you saw one of these numbers call you, you would know instantly that someone is trying to login to your bank account online.

There are many variations of this, such as, you could have a bank call up your cell phone from the same number over and over, but instead of looking at the number that just dialed you via caller ID, you pick up the phone, and a machine’s voice reads out loud at 10 digit number to you (great for customers with no caller-id). Or, the bank sends you a SMS text message with some number (also great for people with no caller ID). Whatever. The point is, your cell phone could be used by the bank as a second authentication mechanism.

For customers who don’t have cell phones, they probably don’t have electric in their homes. So they probably won’t need a bank account anyway. Or if they did, they wouldn’t have computers, so there would be no need for this anyway :D And this business model “scales” very well. The bank pays the initial cost of having such a service in place, and then for every new customer, there’s virtually no additional cost. With the RSA SecurID token, they’re paying $20-40 for EVERY single customer they sign up.

Perhaps now that I’ve said this, I’ll hear of a startup doing exactly this, and then selling it to banks.

Update 7/5/2007 - http://www.pcbanker.com/ has some of the best interest rates for CHECKING (not savings) account, and they provide their customers with the RSA SecurID tokens. Thanks Nigel.

An interesting trend, see the 6 min video clip by Karl Fisch, edited by Scott McLeod.

I’m sure everyone has heard of a fingerprint biometric device, where your fingerprint is scanned and you are then granted access to something. In the movies, you see the villains getting around that by chopping off the finger they need from the person, to gain access. I just read this blog post on newscientist.com and it talks about how this Japanese company has solved this problem.

The company’s biometric system uses an infrared camera to record the unique pattern of capillaries just beneath the skin, which can only be seen when blood is pumping through them. When this blood flow is cut off - when the finger is cleaved from the body, for example - the pattern disappears and the finger can no longer be used for identification.

Interesting technology, although it doesn’t stop the villain from forcing the victim to willingly scan his/her finger, by say, holding the victim’s loved one as hostage.

For those who have never heard of the Turing award, it’s basically the Nobel prize for computer scientists. The latest recipient has been announced and for the first time ever in history, it goes to a woman, Frances E. Allen. Not to be a male pig about it, but in a male dominant field such like computer science, this is definitely a milestone worth noting.

Read more about the press release here.

Lifehacker has this post on a command line feature that will invoke Skype to call a phone number. Looks like it works! Now you can schedule wake-up calls to your cell via Skype. The command (for Windows) is:

c:\Program Files\Skype\Phone\Skype.exe /callto:001XXXXXXXXXX
(replace X’s with 10 digit phone number)

1. Run command

2. Skype initiates outgoing call

3. Phone rings!

Cool stuff. Now all you gotta do is write a script that will initiate the call at a certain time to fully automate it. Maybe throw in a web based interface and hook it up to the web so that you can schedule these “reminder” calls from anywhere with internet access.

* At time of writing, Skype offers free PC-to-phone calls to US and Canada

I stumbled upon Venture Blog by accident as a result of Googling for “sand hill road” and was pleasantly surprised to find yet another interesting blog to add to my RSS reader.

Paul Graham recently gave a talk at Foo Camp 2006 about what the Y Combinator has learned from building startups. Here’s my compressed version of the entire post on Venture Blog by David Hornik.

Paul Graham: What We Learned So Far From Y Combinator About Startups

  1. The biggest weapon entrepreneurs have against failing is focus and determination. Startup success is the absence of failure. Let’s face it, there are infinite ways a startup can fail, and most do. Astoundingly smart people fail because they lack the maniacal focus required to help a startup succeed against the odds. Paul goes so far as to say that smart isn’t that important. There are lots of smart people. To him, smart pales in comparison to focus.
  2. Make something people want. The easiest way to make something that people want is to make something that you want. Yahoo! started out as a directory of Jerry and Dave’s favorite links. Jonathan started Friendster to find a girlfriend. Zuckerberg started FaceBook to find a girlfriend. If you build something you want, chances are pretty good that someone else with want it as well.
  3. Build something you know others will want. It requires a lot of listening and a lot of luck. Truly successful startups solving other people’s problems are often started by domain experts who see big problems with the status quo and leave their industries to go solve those problems. That might work. But it is still really hard. It’s a lot easier to really understand your own problems than someone else’s.
  4. Listen and react. Even companies building something that the founders themselves want need to listen to feedback on their product in order to morph their idea to appeal to the largest (or most valuable) constituency possible. It is OK to be stubborn and have good judgment, but it is still better to have bad judgement and not be stubborn. Startups are necessarily fluid and agile. It is what gives them a chance of succeeding despite the long odds and giant competitors.

You may have a technology or a product that gives you an edge, but your people determine whether you develop the next winning technology or product.
Steve Ballmer, Microsoft’s CEO

Business, a human driven element. It’s a small world we live in. Invest in building meaningful relationships. Quote courtesy of Business 2.0

Next Page →