Technik News

Das Blog zu IT, Mobilfunk & Internet

Who says Google doesn’t already have deals with the copyright owners?

von

Reading with interest the flurry of posts about Google’s purchase of YouTube for around $1.6 billion, it seems the main worry right now is that since Google is a very rich company ($131 billion cap!), the lawsuits for copyright violations will start raining faster than you can say MPAA. Mark Cuban is particularly pessimistic about the business decision.

My take is that Google in general, Larry and Sergey in particular, are rather smart, and would not have taken this step, putting the entire company at risk, without first having an agreement with the main content providers that would be likely to sue. This would include TV networks, MPAA, RIAA and the usual suspects. A very obvious conclusion is that if there is money to be made placing ads on content, or selling premium accounts the way Flickr does, why can this not be shared with the copyright owners?

A more twisted conclusion is that the copyright owners could be giving up on microcontrolling every individual byte in an Orwellian manner, and see the light. What is better at promoting new content than the word-of-mouth of millions of fans?

YouTube videos are of notoriously bad quality for the most part, in essence, making it possible to turn the originals into streamable flash clips. Have you ever tried to watch a video full screen? It sucks. What the clip may do is convince me to go out and buy the DVD!

Time will see, but I place my bets on a blanket all-you-can-eat license that will allow YouTube to promote content, keeping both users and moguls happy. 15-second ads at the start of each video? Maybe, but then if you pay us $19.95 a year…

Autopsy of a Fonera

von

Yesterday, I posted a few pictures of the opened Fonera, with a few initial views on the device. When I tried to plug it in, it failed to work, only the power LED lighting up. Neither the WiFi signal was coming up, nor the ethernet port was tickling the switch.

The only course of action? To open it up even more. So, the aluminium chassis came off, and that’s when I realized I had seen this before. The WiFi section, which includes the Atheros AR2315, crystal, filters, power amplifiers and ancilliary circuitry are housed inside this casing, and correspond to a reference design provided most likely by Atheros themselves. Check out the Meraki Mini router. For reference, I provide a side-by-side picture below (click for large image).

Meraki Mini vs Fonera

There is nothing wrong with using reference designs per se, as it is the fastest and easiest way to bring a product to market. If you don’t need to customize your design much, simply use what the manufacturer suggests, and you will be playing on the safe side. A perfect example is Bluetooth headsets, where CSR dominates the market. Virtually all headsets in the market use their reference design, with very little changes between them, other than physical placement of LEDs and buttons.

Block-by-block, here is an overview of the Fonera.

Power

Power is supplied to the Fonera via jack SK1, and is fed through a rapid fuse (Polychem type) to a simple drop-down regulator, which drops voltage from around 5V (4.85V as measured on the wall power supply, using a Fluke 179 multimeter) to 3.3V. The regulator appears to be an AME1117 (though the package markings read AME117), in its CCCT configuration, TO-252 form factor. The regulator is stabilized using three electrolyic capacitors. In these types of regulators, ESR (equivalent series resistance) of the input decoupling capacitors is very important, and this can usually be controlled nicely with tantalum capacitors. These are very expensive compared to electrolytic, however.

There is a second stage of regulation, this time done by an Anpec APL1117, which further drops the voltage to 2.5V. This supply appears to be used by the wireless subsection. Two ceramic capacitors stabilize the regulator.

Without the Atheros chip in place, the PCB drew 90mA at 5V, or 450mW. Since the device was not functioning, the total supply current with WiFi active could not be determined.

Memory

Two memory ICs are available on the Fonera, the first is an ST M25P64 serial flash, with a 50MHz SPI bus and 64Mbit capacity (8MB), in 300mil SO16 format. The fact that SPI has been chosen has the advantage that extra memory devices could be attached to the bus, but it has the caveat that it is slower than a parallel bus. Thus, flashing a new firmware could take a rather long time. Interestingly, there are two footprints on the PCB, presumably to fit a different size and format memory IC, one SO16 and one SO8.
The second memory IC is a Hynix HY57V281620E synchronous DRAM, with a capacity of 128Mbit organized in 16bit blocks. In practice, this results in 16MB of RAM available to the processor.

Ethernet

At the heart of the wired ethernet subsystem is an Altima AC101 ethernet transceiver, capable of 10/100 full duplex operation. The IC is placed on the bottom layer of the PCB, and runs off a 25MHz crystal, strangely placed next to the main power regulator, where it could absorb electrical noise. Usually, crystals are placed well away from sources of interference. Nothing else too exciting here, the transceiver is connected to a standard RJ45 socket, TP1.

Wireless

The wireless section is the most interesting. This is where the Atheros AR2315 single-chip WiFi processor lives. Little public information is available about this or any other Atheros chipset, so it is hard to figure out exactly how it is put in place, but a few details are clear.

First, the chip gets hot. This is why a double heat-conductive adhesive tape bonds the surface to the metal cover, and in turn to the heatsink placed on top. The processor runs from a 40MHz clock source. After the Atheros core, come a couple of filters, and a power amplifier stage. This then runs off to the two antenna tracks. The first antenna exits the aluminium cage and runs up to a test connector. This connector breaks the antenna track when the right mating plug is inserted, which is then fed into a dedicated RF analyzer, which validates that the device is within constraints.

After the antenna test point, there is a split, which can be configured using a zero-ohm resistor, to run to an internal solder pad, or to a PCB-mounted right-angle SMA connector. It is unclear why they chose to use the solder pad, as an in-place soldered connector needs less handling than soldering a pigtail by hand. Besides, my intuition tells me the losses would be lower – I will test this when I get a working Fonera. Both tracks run through an impedance matching network, consisting of two capacitors to ground from the RF track, and an inductor between the capacitors . The purpose if this small circuit is to get the impedance of the PCB track as close to 50 ohms as possible. If the track impedance is mismatched to the antenna, losses take place.

The second antenna runs straight to a PCB pad, where a pigtail may be soldered, also passing a matching network. Below is a picture showing the details of this subsection.

Fonera - WiFi subsystem in detail

Interfaces

There are two IDC-style connectors on the PCB, one 2×5, and one 2×7 but unpopulated. The 2×5 looks like a serial connector, as only power, ground and two tracks lead out from it. The layout has to be studied in more detail to confirm this assumption.
It can be speculated that this is in fact a serial port, but without the AR2315 pinout, this cannot be determined for sure. The 2×7 header seems to be a JTAG interface, possibly compliant with MIPS EJTAG 2.6. The mapping of the header pins to the AR2315 BGA balls is shown below (thanks for adding a row/column silkscreen for the Atheros chip, and thanks to the OpenWRT project wiki for the JTAG information!):

Fonera - JTAG connector

Between the Ethernet jack and the empty SMA footprint, there is a footprint of 6-way header, which needs a bit more study to determine where it leads internally [I will update the post when I find out –Mike].

Conclusion

This is a very compact and simple WiFi router, designed not for being easy to hack, but for lowest cost. The cheap power regulator, use of large SMDs and choice of pigtail rather than board-mounted SMA connector point in this direction. There is only one port which could be used for something useful, if it is indeed a serial port, the only two GPIOs available being the WLAN and Ethernet LEDs – as long as the Ethernet LED is not controlled by the Altima but by the Atheros. The power LED is on as long as there is power applied to the device, so there is no control over this by the Atheros processor. Power consumption is a bit high, considering the wireless device was not present. The PCB layout is very professional, except in a few particular cases such as the large crystal, but overall, quite nice.

In all, a very small device which could have a lot of potential, had it not been for its lack of I/O. It is unclear whether the router will accept custom firmware, as there are rumors that an encryption & signature system is used. The Fonera is probably OK for regular use by Foneros, but it does not have the hackable edge of the Linksys WRT54Gx. The only suprise could come from the edge connector, as of yet of unknown usefulness.

References

Atheros AR2315 chipset website section and product brief.

The naked Fonera

von

After a few days of silence, digesting the hubbub created by my analysis of Fon’s status, I’ve put my head back into more useful things than answering hate mail and out-of-line comments (thanks to those who provided balanced views, either for or against!). So, I decided to open a Fonera and see what lives inside.

A full review is coming, but first impressions:

  • The plastic casing looks and feels very nice, the molds must have been expensive, as the different parts mate very well.
  • Inside lives a single PCB, with components on both sides. The top holds the bulkier components, such as power regulator, RAM and WiFi section, inside an aluminium RF shield.
  • The PCB looks professional and well laid out on first inspection.
  • Components used (I haven’t opened the aluminium chassis yet) are older SOIC and TSSOP, thus cheaper to handle and solder. Balled components require from special handling, such as baking in hydrogen for 24 hours to dry them before soldering, etc.

Here are some pics (click each photo for bigger views on Flickr) I have taken with a Nokia N93 (really nice phone btw, mini-review coming):

Fonera - underside of casing

The underside of the case, with screws off.

Fonera - perspective view

Perspective view of the top PCB.

Fonera - Bottom PCB

Bottom side of the PCB.

Fonera - firmware version

Sticker on the flash IC showing the firmware version.

Unix Course: Unix Security – Lecture 4

von

The Insides of Athena Unix

Today we are going to talk about Unix security.  The first topic will be the first security system you run across when using Unix.

[] Password Security

Next we will talk about some of the implications of the networking programs which are available.

[] Networking

We will then talk about what it means to protect a file

[] File Security

After that, we will discuss ways for keeping information even more private should you decide to do so.

[] Encryption

I have no intention on teaching you how to break into a system. Instead, I hope to point out some of the things you should do to make sure that you are not the victim of someone elses attempts to breach security.

———————————————————————-
[] General Overview

UNIX is not a „secure“ operating system.  It really wasn’t designed to be one, though.  But, what do we mean by security?  Let’s start by considering several types of security.  There is physical security. This is made up of things like locks on doors, and the Campus Police. For some systems this is sufficient.  For instance, if a computer, and all the terminals which can connect to it are in a locked room, then the system is as secure as the lock on the door is. 

What happens, though, when you add a dialup?  Or a network?  No machine which can be accessed from the outside should be considered secure.   The first line of defense is passwords though.  The idea is to keep people who aren’t supposed to be using the machine from being able to do so.  If they can’t do anything at all, then their not going to be breaking security.  Of course, not all password systems are so great.  It is often possible to obtain passwords by guessing them, or
through various other means.

The last type of security is of particular importance to Athena.  What do you do in an anvironment where lots of people have accounts, but not all these people can be trusted.  You need some way of controlling access to resourses such that people have access to their own files (or other files in certain ciscumstances), and only limited (if any) access to other peoples files.  It is at this level that keeping a system secure becomes a problem because the potential intruder has so many more attacks he can try.

[] Password Security

Let me start by talking about password security.  Under UNIX, passwords are stored in the /etc/passwd file.  This is a publicly readable file, so clearly, something has to be done to protect the passwords.  Passwords are encrypted in such a way that they can not be converted back into the plaintext they were generated from.  When you log in, the system asks you for your password, it then encrypts the password, and compares the encrypted version to what is stored in the /etc/passwd file. 

There are several attacks to breaking this security method.  One approach is brute force.  An attacker tries all possible passwords until he finds the correct one.  This attack is impractical because of the time required. 

Fortunately (for the attacker), most people choose common passwords. There username, their name, or words that are in the dictionary.  In one experiment (described in „Password Security: A Case History“ by Robert Morris and Ken Thompson), 3,289 passwords were collected over a along period of time.  Of these,

15 were single ASCII characters
72 were strings of two ASCII characters
464 were strings of three ASCII characters
477 were four alphanumeric characters
706 were five letters either all upper, or all lower case
605 were six all lower case letters

492 appeared in various available dictionaries

A few things have been done to make things more difficult for the attacker.  An encryption algorithm is used that takes a lot of time to run.  This tends to increase the time required to guess passwords. Passwords are also „salted“.

One attack that has been used is to come up with a dictionary of encrypted passwords, and compare the encrypted password in the password file with the encrypted dictionary.  This takes a lot less time per entry than having to encrypt the plaintext word you want to test, and then comparing it to the encrypted password.  Salting a password means that a random number is selected when the password is initially created, and added to the plaintex before it is encrypted.
This random number is then also added to the encrypted password before it is written to the password file.  When a password is checked, the same random number is taken from the encrypted password, appended to the plaintext which is then encrypted, and the result compared with the encrypted password.

Salting the password means that there are now 4096 versions of each password that are possible.  Thus, an attackers dictionary would have to be 4096 times as large.

[] Networking

The availability of remote login and remote execution in a networking environment (as exists with Athena) introduces many new ways to breach system security.  The problem is how to authenticate users across the network without requiring them to enter their password again.  The way this has been accomplished is through the concept of a „safe host“.  A job can log in, or remotely execute commands without a password only if the user is logged in from a „safe account“ on a „safe host“.

Networking has presented many other problems for system security, but I do not intend to discuss them at this time.

———-
[] File Security

What does it mean to protect a file?

Under UNIX, there are several fields in the protection of a file.  The first three bits control access to the file by its owner.  The next three define the access by other people in ones group (people in the group that owns the file).  On Athena, most peoples groups are „mit“, so this group field is really just another field for „world“.  The last set of three bits define the access for everyone else.

The bits on a file control read, write, and execute, but one also needs to be concerned with the protection bits on directories.  If someone has write access to a directory, then they can create, and delete files contained in it.   Read access to a directory gives one permission to look at the directory (with ls for example). Execute access conveys permission to connect to the directory and to search it for a file which you know the name of.

It is also important to note that someone with access to the root account can read, or write ANY file on the system regardless of the protection.  Pleople who have this access include Athena staff, some consultants,  some system wizards, and occasionally someone who has managed to break the systems security.  On Charon, certain SIPB member have root access.

When you log in, your .login sets a „umask“ which defines the default protection you want to give files you create.  This mask is 3 octal digits defining the bits that you DO NOT want to appear in the protection for the various entities (owner, group, and world). Further, if you have given niether read, nor execute access to a directory, then other users will not be able to access files beneath that directory regardless of the protection of the individual file.

[] Encryption

As you can see, there is no way to keep a file totally secure under UNIX.  Since the file can’t be secure, you may want to use encryption to keep the contents secure.  Currently there is a program called crypt which can be used to encrypt files.  Unfortunately, the algorithm used in crypt has been broken.  In the near future, Athena will be distributing a new algorithm (I believe based on DES) to replace crypt.  This algorithm is believed to be more secure.

The real FON statistics – lies, manipulation or fantasy

von

On September 14th, FON launched the new version of their online mapping service, after several months of complaints from users that the service wasn’t up to scratch, and announcements stating the development team was working on the problem.

On a first look, the maps look really nice – they use Google Maps, by default in the mixed view, where you see a satellite image and an overlay of roads and placemarks. I will not bore you with the details, as it is better that you check them out yourself and make up your mind.

This post is not intended as a review of the service itself, but rather, a revelation of the real figures behind FON’s network – peeking under the layer of PR and flamboyance. Martin Varsavsky is always boasting about FON being the largest WiFi community of the world – in my view, this is not accurate.
During months, FON has been claiming to be a “movement”, with a marked communist image behind (the marching workers, the spray-painted logos, etc.). This movement was supposed to kill mobile operators, who currently oppress people with their sky-high tariffs. We could go into a long debate just on this topic, but lets move on. During all this time, FON has suffered untold problems with staffing, PR mini-scandals, shipping broken routers or taking weeks and months to even send them out, not replying to repeated requests to support@fon.com, and blatantly ignoring the public forums, where the community behind the movement was expressing its increasing anger and frustration.

The blinding truth – less than 3.700 routers online worldwide

Digging a bit deeper into the workings behind the maps, I have found that there is a method to run a query to retrieve all the hotspots in FON’s database, not just two hundred, or those in a particular region. If you want to see an example, click here. This is a query that will return all hotspots on the planet that have been FONing home during the last hour. It can take a little while to load, so be patient. Until a couple of days ago, results were returned in XML format, which has been dropped in favor of the new plain, comma-delimited format.

I predict that FON will not like the above link, and thus will try to either change the format of the php call, or add artificial records to confuse the application I have written to process the data. First, I wrote a simple application using RealBasic (having been a long-time Visual Basic acolyte, it is a welcome change, allowing me to code under Mac and Windows transparently) – source code here. A screenshot of a full run is shown below.

Application screenshot

Just from the details shown after the run, a few enlightening facts surface:

  • The highest user ID found is 92.192, but the total amount of processed records is only 55.384. I have to investigate a bit further, but it appears that in some cases, a record is stored twice, once holding the user type (Linus, Alien or Bill), and again holding the router mode (online or unknown). This is the reason why some people see both the orange dot and the green halo on their locations at maps.fon.com, and also the reason why at this time I cannot confirm that the real number of Foneros is 43.896.
  • There are only 3.674 routers online on the entire planet. So much for the largest WiFi community in the world. The other 7.814 are registered routers, from which nothing has been heard during the last hour. These figures have been checked a few times during the last few days, and they stay more or less constant.
  • Out of the entire user base, only 1.317 have become Bills. So much for milking one’s WiFi.
  • The highest router ID found in the results was 19.889, so if we add offline and online routers (best case scenario), then around 8.401 routers have never been registered, representing 42.2% of sold routers. Extrapolating this to the 1 million routers Martin wants to sell would results in a loss of $10.55 million!.

Looking at the per-country statistics (per-city could be made, given some extra time and coding), some curious details also stand out:

  • There are two registered routers in Afghanistan – but neither is online. Not surprising, considering the amount of explosives that have been dropped on the place.
  • China and Taiwan have 9 routers registered, but none online. Martin was blogging about his expansion into Asia, which looks rather bleak right now. 165 Foneros are registered however.
  • Germany and Spain have around the same number of registered routers, although Germany almost doubles Spain in the number of online routers.
  • The United States ranks third in number of registered and online routers, however, it holds the highest number of Bills (408). The next is Germany, with 237.

Finally, we can derive a few figures from these numbers. These are highly interpreted, and must be taken as theoretical extremes.

  • If FON sold one $3 one-day pass every day of the year on each of the online routers, it would make a gross income of $4 million. This is before tax and the Bill’s share where applicable. You at the back, stop giggling!
  • Making a wild assumption that each router’s signal reaches 100 people, FON would only cover 0.11% of Germany’s population of 82 million.
  • Boingo gives you access to 45.000 hotspots. FON has about 8% of that figure, and with location quality debatable – it is a fact most FON hotspots will not be optimized for even street-level coverage.

I believe it is time for FON to stop boasting about having the largest WiFi community in the world, and start concentrating on its real problems. And if they still don’t know what these are, they have a nice summary at the online forums. Besides, for spending 500.000 Euros per month, this is a pretty poor show, in my humble opinion.

PalTalk sues Microsoft and Xbox with patent for….IRC

von

Ars Technica reports that Microsoft is being sued by a company named PalTalk, which has two patents on a “Server-group messaging system for interactive applications”, original patent filings here and here. If you read through the patents, it becomes evident that they cover a hugely broad number of messaging systems, wether delayed or in real time.

The patents date back to 1998 and 2001, and I remember vividly using IRC during my university years (it was born late August 1988), and mailing lists even before that. Heck, remember BBSs over 1200bps modems? Well, these people at PalTalk seem to have patented just that. IRC and mailing lists. And by default, all other chat platforms that have come ever since – MSN, Yahoo, ICQ, Google, to name a few big ones, but miriads of smaller, targeted server-based chat mechanisms. Voice you say? I was using voice to talk to simulated ATC (yes, people actually acting as ‘virtual’ air traffic controlers, way cool!) while flying on a simulated airline in Microsoft Flight Simulator eons ago, when 800×600 was a decent resolution to run your games at.

Can anyone say ‘prior art’ and ‘patent trolls’? Further info on BusinessWire’s PalTalk press release.