The Real Unreal Rootkit

Seems an interesting discussion.
http://forum.sysinternals.com/forum_posts.asp?TID=9630&TPN=1

They claim none of the present anti-rootkits have been able to detect it.

Public Vista 0day

Before the consumers worldwide get even the first hand on the most secure windows ever, a new public exploit is already on the rise and has been posted to the full fisclosure which describes a privilege escalation attack allowing a logged in user to elevate himself to SYSTEM.

I tested the PoC published code and it seems to work very well as advertised. This exploits seems to be the first for Vista platform though it effects all windows versions for 2000 and above, even my current fully patched XP SP2 installation.

More technical details can be found here.

Collections Versus Generics in .NET

A pretty common task these days at work is migration and upgrading of older 1.1 framework code to the 2.0 framework. Some of the code is really straight forward to port to for example the System.Management Namespace based classes. However to leverage the new features of 2.0 a few changes must be made.

For anyone developing in .Net 2.0, Generics are definitely a great tool, allowing cleaner and more type-safe code. I was interested in how the use of Microsoft’s provided Generic classes in System.Collections.Generics performed relative to their non-generic alternatives.

I am often running into a question of whether or not I should bother changing out liberal use of the Systems.Collections classes in older code to use Generics. So I ran some tests….

Probably the most common collection used in pre-2.0 code is the ArrayList, so in these test I have compared the System.Collections.ArrayList class to the System.Collections.Generic.List class.

I created a c# console app in Visual Studio 2005, that ran a set of common operations against the two collections.The Complete code listing can be found at the end of the post.

I did a worst-case load for both generics and collections, letting the collection dynamically resize for random integer insertion, which is followed by a sort, and a traversal using the Contains() method. All of the items are 32bit Integers.

The test for Arraylist is exactly the same as the List test, with the obvious exception of the collection declaration. I ran the series of operations against the two collections with increasing item counts, and programatically timed them.

Result Output:

Size: 10000
Time taken by Collection: 15.6042 ms
Time taken by Generic: 0.002 ms

Size: 100000
Time taken by Collection: 187.2504 ms
Time taken by Generic: 15.6042 ms

Size: 250000
Time taken by Collection: 546.147 ms
Time taken by Generic: 62.4168 ms

Size: 500000
Time taken by Collection: 1263.9402 ms
Time taken by Generic: 218.4588 ms

It’s pretty clear who the winner is here. The Generic.List collection comes out substantially ahead of the ArrayList.

Not only is the Generic class faster, but it appears to scale substantially more linearly than the ArrayList, and handles the 10 million items in <1 second, compared to the 21+ seconds of the ArrayList.

From running a few more tests, I learnt that the real bottleneck on the Arraylist was during sorting and traversing the list. Each item is stored as an object, so it must be typed runtime, and then compared for sorting/searching. On the other side, the Generic List had all its items typed compile time, which saves alot of workload during sorting and searching.

So the first thing that comes to my mind, was that perhaps the collection logic was improved for the List, and it was dynamically resizing in a smarter fashion, which helped give it such a substantial speed increase. So I ran an interesting test…. I modified my code to use a List<object> instead of List<int>, so in theory, it would perform just as the ArrayList unless some other collection logic had changed.

The results were surprising. A List<object> performed within 5 ticks of ArrayList on any number of items.

This confirms that the performance gain of Generic Collections is entirely due to dropping the Object wrapper, and ridding us from the need to use Reflection on each object. So in conclusion, I can’t imagine wherein you would EVER want to use an Arraylist or SortedList in your .Net 2.0 code.

Happy coding.

using System;
using System.Collections;
using System.Collections.Generic;

namespace GenericCollectionComparison
{
internal class Program
{
public static int Length = 100000; //Int32.MaxValue;
private ArrayList arrayList;
private List genericList;
public static DateTime startTime;
public static DateTime endTime;
public static TimeSpan timeSpan;
public Random randomNumber = new Random();

public void fillCollection()
{
arrayList = new ArrayList();

for (int i = 0; i < Length; i++)
{
arrayList.Add(randomNumber.Next());
}

arrayList.Sort();
arrayList.Contains(randomNumber.Next());
}

public void fillGenerics()
{
genericList = new List();

for (int i = 0; i < Length; i++)
{
genericList.Add(randomNumber.Next());
}

genericList.Sort();
genericList.Contains(randomNumber.Next());
}

private void Run()
{
Console.Out.WriteLine(“Size: ” + Length);
startTime = DateTime.Now;
fillCollection();
endTime = DateTime.Now;
timeSpan = endTime.Subtract(startTime);
Console.Out.WriteLine(“Time taken by Collection: ” + timeSpan.TotalMilliseconds + ” ms”);

startTime = DateTime.Now;
fillGenerics();
endTime = DateTime.Now;
timeSpan = endTime.Subtract(startTime);
Console.Out.WriteLine(“Time taken by Generic: ” + timeSpan.TotalMilliseconds + ” ms”);

Console.WriteLine(“”);
}

private static void Main()
{
Program program = new Program();
for (int i = 10000; i < Int32.MaxValue; i = i + 10000)
{
Length = i;
program.Run();
}
}
}
}

First Blogger now the WordPress ban

Freedom of speech, upgrading of the network infrastrucure, internet facilities in all parts of the country is what our government claims. but starting from the new Year they gifted us with another ban on the worlds leading free blog provider: wordpress.

Earlier last year the Pakistani authorities blocked blogspot. Earlier this year they suddenly realised there is another blogging engine (wordpress) gaining popularity, why not block it as well, and there you go. As of 1st Jan all outgoing traffic to *.wordpress.com is being filtered and blocked. This time they’ve been a bit more wise though. They’ve also made an attempt to ban and filter some public proxy lists and open site relays (for e.g unipeak.net , xroxy.com , openproxyservers etc)

Blogspot ban was sad and irritating but many people found workarounds (TOR, pkblogs, google caches, anonymous and open proxies) to access them. Eventually the same will happen to wordpress. Little pity they do not realise they are just irratating the mass who only takes a little time in finding another way to get the content they want.

I am not against censorship, I believe countries like China and the ones in Middle East do a pretty good job in blocking porn and lame sites like orkut (im calling it lame due to the PURPOSE it is used specially in pakistan, and with the increasing number of teenagers subscribing and wasting their time and bandwidth); but our dear policy makers will not ban morally questionable material, they will not block a limited number of blogs which they could find harmful, they could not
filter traffic based on content, they just block all *.wordpress.com, phew. More irritating is the fact that there seems to be no news, no prior notice, no press release, no NOTHING about whatever they do, block, allow or filer.

I am not saying that there is no illegal or censorable material on the wordpress blogs but i believe the boom of Web 2 and specially open blogging have contributed more in the postive sense to structured and organised information / idea distribution.

Living in a country which is already very behind in education, reasearch and more importantly freedom of speech and press, internet censorship to worlds two of the major blogs and numerous other linked (subnet and ip) sites will only harm the growth of personal expression of talent, ideas, information and knowledge.