Wednesday, December 15, 2010

Cracking Microsoft Word passwords

If you come across a document that happened to "fall off a lorry" and when trying to open it Microsoft Word prompts you for a password then you have a very limited set of options.


First off, stop looking for a short cut; there isn't any. You can't open the document in a debugger, change a byte, move it to Linux and save it PDF format and have it magically unlocked. Microsoft is way smarter than that. The whole document is heavily encrypted and just can't be opened without a password.


How does one get the password anyway?


One way is to look through the drawers of the person who actually owns the document in the hope that he left the password written on paper. Not gonna happen!


The second way is to try all possible passwords till you happen to hit the correct one.


The third way is... There is no third option.


The method of trying all possible combinations is naturally not something that anyone in his right mind would try doing manually. You are, hopefully, in your right mind which is why you are reading blogs instead of typing in passwords at demonic speeds.


I am going to keep this blog entry short and to the point.


Download a program that will run the permutations for you. The one from Passware is good or you can try Open Password Remover. Both work the same way. There is a third one that I will mention later.


These programs have three methods of hacking:


First, all words from a standard dictionary are tried. This is called a dictionary attack. If the password is something like "computer" or "sugar" then the program will find it.


The second is called the Xieve method whereby word combinations are tried. For example "mycomputer" or "treehotdog". This is much slower than above; a 12-character password can be cracked in a couple of days.


The third is called the brute force method. This tries everything, all combinations. It guarantees finding the password no matter what it is. On my computer the program is right now running and trying over half a million combinations per second.


Great, isn't it? No, it's not.


Don't try it.


A single character from "A" to "Z" has 26 possible combinations. Double it for lower case. Add 10 for digits. Add 10 more for special characters. There are more than 10 special characters but for the sake of argument I am taking a round number.


How many combinations there are depends on the length of the password. Here's a short table to see what this means:



Possible CombinationsLength of passwordTotal Permutations
26315,600
523132,600
623226,920
2657,893,600
525311,875,200
625776,520,240
261019,275,223,968,000
521057,407,703,889,536,000
6210390,164,706,723,053,000

That is one big number of combinations. My computer reports that it will finish trying the permutations in 560,471 years and 2 months! Hmmm... not in time for lunch then, what?


Sorry to rain on your parade. You aren't going to succeed.


Last option: It is practical. Try it if you are really, really adamant about breaking into the document: Spend some money. Not much, mind you, the service doesn't charge all that much. The best service that I found on the Net is Decryptum. They charge $30 or so per document. What they do is that they have a bunch of high speed servers running in parallel that run the permutations in much less time than 560 thousand years.

Saturday, December 11, 2010

Getting Started on Programming in Facebook

Ok, so we are talking about COBOL-based Object Oriented Programming of drag-and-drop mashable objects to build a front-end to SAP that will show your sales forecast on mobile phones.

What?

Hang on. None of the above. Let’s start again.

This post is about “Hello, World” level applications in Facebook. So everyone else: Go away.

Getting a bit serious about it: I’ve been reading up on the Facebook API in the developer docs. The stuff I came across was generating a throbbing headache a couple of centimeters behind my frontal lobe. I was thinking: This is complicated.

The reason is that there’s no developer guide that I could find. The reference, or any other reference manual for that matter, is meant for people already at the medium to expert level who need to refer to parameters of individual API’s. For beginners, you need a beginner’s guide. The few lines of code on FB’s own site failed to bring any revelations. I had to spend a lot of time at Google.

The reason I had to Google so much is this: The tutorials that you find are perfectly good but the problem is Facebook itself. FB people change their API’s and user interface every time one of them comes back from lunch. So the first thing to note is that today is December 10th, 2010. If the FB interface that you see is any different from the screen shots given here, stop reading and go find a later tutorial.

I shall be updating this entry as I find the gotchas. The first gotcha is: check the PHP version on your host. If your server runs PHP5, well and good. If it runs PHP4, go away. I’ve spent too much time looking for 3rd party ports of the API’s. However, they’re all obsolete or may become so any minute now.

Programming Models

There are four slightly different methods of FB programming. Do not confuse the docs covering them.

The first is using an application to run your application. Sounds daft? I meant, there is an application called “Static FBML”. From the FB main page, click on Applications, type Static FBML in the Search box and select it from the result. Add it to your Wall. What this will do is to let you type static FBML code right there to be displayed on your Wall. This can be done for product pages that you make. However, none of the fancy stuff is allowed here.

The second method is your own page on your own website that pulls info from and pushes back to FB. The method is mentioned here because the API’s that you would use would be slightly different in this case.

The last two methods are for displaying a page on your own wall’s tab or that of a product page. In both these cases, there are two things to remember:

1. The page’s code itself resides purely on your server but you never open it as http://www.myownserver.com/MyFBApp.

2. The resulting page is shown within FB’s pages as http://apps.facebook.com/MyFBApp

Let’s call them methods FB1 and FB2.

What they have in common is that they are simple HTML to begin with. For starters, just write <P>Hello, World</P> in a file and save it.

Here’s the first reason for a blank page that every beginner will get: The file must not contain <HTML>, <HEAD> or <BODY> tags. Obvious when pointed out but a common mistake.

Where they differ is… they differ in ways too long to detail. Let me give the short answer:

FB1 generates an IFrame with the source set as your page. FBML will not work in this case. This is an IFrame content being pulled from your server with all that implies. That the IFrame is within an FB page is incidental; don’t try to use any FB features here. To tell the truth, you can get FBML to work here but not by the straight forward method, so till you progress to higher level, forget about FBML.

The page can run JavaScript and it will work as expected. More on that later.

FB2 is the real programmer’s way of doing things; all functions will work. You can pull login info, friends lists, messages, personal info, bank account detail, 3rd grade results. Well, maybe not the last couple of items but pretty much everything else.

The page can run JavaScript but it will not work as expected. The reason is that FB will rename all your id’s.

There are also differences when using FB1 & FB2 methods in the fonts and placement. Since they don’t have a <HEAD> section, the normal method of using CSS won’t work.

Now, go back and read the stuff on the four different methods again and decide how you want to proceed. I shall be going over FB2 only from here.

Done? Let’s proceed.

 

Prerequisites

You need your own server that runs PHP5. This is a beginner tutorial and I won’t be covering C##.NET with Framework 4.5, Delphi, Visual FoxPro and others.

As per the documentation, you need the PHP include file from github. Inside the zip archive is a folder called src which contains a file named facebook.php. This file would be included in ever page.

Time for your next set of errors. Nothing is going to ever work regardless of what you do if you are using PHP4. Don’t even try. This file is for PHP5 only. The official link for the PHP 4 and 5 Client Library for the tar.gz file is giving an error. As I am getting a 404 on nearly all developer.facebook.com pages today, they could be updating the site. Lunch time already?

 

Building the Application

Let’s click on the Applications menu on the left:

AppMenu  and then select the Developer application from the list. One assumes that you’ve gone thru the terms of use, agreed to them, and so on.

Click on the button to Set Up New Application

Give your app a name.

About

 

Nothing special on the About page other than the name of the application, Leave the two URL fields alone till you can provide pages for them.

Website

This confused me for a bit and is another of those things that are clear in retrospect only.

The values on this page are to be used only if you are going to have a page on your own site that uses FB API’s for data. Otherwise, leave them blank.

Integration

Last of the Obvious-Things-That-Trip-You.

The Canvas Page is the URL of the application as far as the external world is concerned. All of them have the same starting http://apps.facebook.com The next part is what yours is going to be known by. Do not try for a cute name; they’re all taken.

The Canvas URL is the physical location of the page. More gotcha’s here: This can not be www.myserver.com/mytest.php This must be a folder name so it can be a file named index.php in www.myserver.com/mytest/. Only in the case of dynamically created pages can it have a name different from the default. But don’t try it right now. That is too an advanced topic.

Some older documents talk of a Callback URL. This parameter no longer exists on this page.

The Canvas Type is our FB1 and FB2 method mentioned above.

Leave all other fields blank.

Leave the other tabs alone. Don’t fill in any values there.

Also note the API Key and Application Secret values. You need to put these in your PHP file.

 

The PHP

All the stuff that was needed to be done on the FB site has been done. The rest shall be done on your server only. Check the results on http://apps.facebook.com/YourAppName.

Let’s ensure that all the FB settings have been done correctly. In your index.php file, put only the single line:

<P>Hello, World!</P>

and test it. If you have done everything correctly then it should work.

Next, check that PHP is working. Add the following lines:

<?php

echo ‘Hello from PHP’;

?>

That should show that you are now all set to start building the most popular FB application in the world.

Next, take the facebook.php file that you downloaded from the FB developer site and upload it to your server.

Next major gotcha is that a high number of sample code for index.php that you would see on the Internet looks like this:

<?php 

require_once 'facebook.php'; 

$appapikey = '21e4dd7042467d0b23809aafb6f20217'; 

$appsecret = '115a5e8df3ad491b6bc1a8434af0544e'; 

$facebook = new Facebook($appapikey, $appsecret); 

$user_id = $facebook->require_login(); 

$callbackurl = 'http://www.myserver.com/MyApp/'; 

?> 

I assume that your are aware that the API key and secret should be the one in your application and not from the copy above.

Here is the $callbackurl. There are differing documents about it. Originally, it was in the application description on the FB page but must now be given in your PHP file.

There are three variations of what the callbackurl is:

  1. http://apps.facebook.com/YourAppName
  2. http://www.myserver.com/MyAppName
  3. http://www.myserver.com/MyAppName/index.php

I guess it’s another one of those time-of-day things and the sources that I found claim that only one method works. Check FB documents to see which variation is in vogue today.

In actuality, don’t waste your time. All of the above is not going to work at all. Ignore all sample code along the lines that you see above. The new, updated, improved, latest version of FB API’s don’t support this any more. All such code is obsolete.

As of 1pm today, the one that works is totally different.

First off, upload the fb_ca_chain_bundle.crt file from the zip that was downloaded from FB to your server.

Your index.php should read:

<?php
require_once 'facebook.php';

$appapikey = '21e4dd7042467d0b23809aafb6f20217'; 

$appsecret = '115a5e8df3ad491b6bc1a8434af0544e'; 

$facebook = new Facebook(array(
   'appId' => $appapikey,
   'secret' => $appsecret,
   'cookie' => true,));
$session = $facebook->getSession();
$mypageurl = 'http://www.myserver.com/myapp/';

if (!empty($session)) {
   $userdata = $facebook->api('/me');
   echo '<h1>My First FB Application</h1>';
   echo '<h2>Hello, ' . $userdata['first_name'] . '</h2>';
   echo '<p>Nice to meet you</p>';
} else {
  $login_url = $facebook->getLoginUrl(array(
     'canvas' => 1,
     'fbconnect' => 0,
     'next' => $mypageurl,
     'cancel_url' => $mypageurl,
     'req_perms' => 'PERMISSIONS'
     ));
  echo '<a href="<?=$login_url?">Login</a>';
}
?>

This should be enough for one day.

There are two things that I leave you with.

First off is that there is a lot of data in the $userdata variable that was fetched above. Use print_r($userdata) to see for yourself. This is an array with these items:

  • [id] – The internal numeric id of the FB user
  • [name] – Full name of the user
  • [first_name]
  • [last_name]
  • [link] – The FB profile page of the user
  • [about]
  • [birthday]
  • [hometown] – Array of [id], [name]
  • [gender]
  • [religion]
  • [timezone]
  • [locale]

Two more fields that really are funny:

  • [relationship_status]
  • [significant_other] – This is an array of names and FB id’s. Why? In case of polygamy?

There are two other items in the $userdata array. These are [work] and [education]. Both of them are arrays and most of the items are arrays themselves.

My second, and more important, closing point is that you must not rely on the code samples on various web sites because the FB API’s keep changing so much. You have to always refer back to FB’s own developer reference site to see what will work for you.

Tuesday, May 11, 2010

Technology Managers vs. Technology

I am not qualified to comment on most of the sciences, be they astronomy, botany, entomology or whatchamcallogy. That never stopped me from commenting on them before, though, nor would it in the future.

I am qualified to comment on computer technology or IT or MIS or whatever you call it; a nut by any other name is still what goes at the other end of a bolt.

I've been meeting a lot of my 'peers' over the years. I quoted the word as most of them no longer fit the definition of the word. Sure, they started around the same time as I did or a bit later. The ones who started earlier are those whom I consider beneath myself. Why?

Why is a great question. It's a good question at most times but a great one here.

I manage technology developers the same as they do but there the similarities end. My 'peers' are old and, for the most part, getting fat salaries for overseeing technology and work that they really have no inkling of. Their work could be done as well or as badly by anyone who comes from chemical engineering, culinary or accounting background. Well, perhaps not accounting.

Sit for no more than five minutes with one of them and ask for details of the currently ongoing work. Chances are that a junior programmer would be called in or, better yet, the topic suspended for tea and crumpets. The typical IT manager of today doesn't know the difference between a charge coupled device and a petabyte even though the first are all around us and the second would be commonly available by end of 2011. (Blush if you had to Google for the terms.)

The IT industry changes faster than any other. New ideas, new designs, new paradigms and new languages rise overnight. The types of requirements change along with technology and the solutions become ever more exotic by the day. No one five years ago would have asked for a cellphone application to drive a car using Bluetooth. Yet when everyone saw Bond's Nokia Communicator do just that they whistled thru their teeth. Those few who had access to a Communicator, spare car and lots of soldering wire went ahead and actually built one. See http://www.youtube.com/watch?v=_m4ERvAtP6s

IT managers of today complain that all their time is taken up in administration but they is not quite accurate. A truer fact is that most of their time is spent in administration. That is because they have fallen so out of touch with what they once may have had command over that they are embarrassed to talk details and would rather spend time making budgets, Pert charts and discussing risk profile methodologies.

On the other hand, it is these same people who sign their names to project timelines, efficiency reports and acceptance tests. How anyone can do that without knowing why the JSON call from the Ajax popup was what caused the buffer overrun in the first place, is beyond me.

Just today, one IT manager of a client asked for data import using CSV files but didn't know how to save a worksheet in CSV format. I had made a policy for myself not to rip off people's heads, jump on their carcasses and shout: You moron! I think I shall have to rethink the wisdom of that policy. A few well-mangled carcasses and people would stop spouting utter hogwash around me. It would still be hogwash, mind you, it just won't be utter hogwash.

Since I started working as one, publishers started sending me magazine with titles such as 'CIO' and 'Technology Today'. I've asked everyone to not let me see them any more and throw them in the trash as soon as they come in. Such publications are written for those who once knew what level 77 and 88 declaration in COBOL were by those who flunked out of diploma courses in Computer Science.

There are remedies for most afflictions but ignorance in the field of IT has none. The only viable option is to change to something that requires no real knowledge such as human resource management, sales or accounting. That way you make space for the up and coming youngster whom you hand-picked and groomed. Keep telling yourself that. Actually the youngster is the one whom you could not drag down to your level of ignorance.

In parting, I offer my gratitude to those who stuck with my rambling to read the post so far. Whether you smile condescendingly or scowl in annoyance think about this tonight before you go to bed: Do you really know if the purchase requisition you approved for a SWF profiler is needed or did the designer think it cool to have one?

Friday, February 26, 2010

GPRS on the Nexus One

As many of you know, I have the new Nexus One. It's the greatest cellphone ever invented. For those of you who don't have one: Nyaah! Nyaah!

I've been running it on Wifi and decided to configure GPRS as well. The thing is, other than a couple of games, all the programs on the Nexus want to connect to the Internet for this and that. If your telco offers a monthly fixed charge for unlimited data, go for it. If not, get a second job to pay for the data bill.

I looked up the Mobilink website for the connection settings but that site doesn't list the Nexus or any other Android-powered device. I contacted the Mobilink call centre and they were accommodating enough to send me the settings. Which didn't work, by the way. No problem, just a small change was needed. So, here they are.

A small note for those who are unfamiliar with GPRS settings: Your phone can have multiple connections defined. Typically, you need two; one for regular browsing and the other for MMS. The phone figures out which one is which by the Access Point Name (APN).

The Android settings on Nexus go like this:
1. From the Home screen, open the menu and click on the 'Settings' icon
2. Click on "Wireless & Networks"
3. Click on "Mobile Networks"
4. Click on "Access Point Names"
5. You'll see a black screen. This is because you haven't added anything yet. Press the 'Menu' button and click on 'New APN' from the menu
6. Type these values:
Name: Mobilink Internet
APN: jazzconnect.mobilinkworld.com
7. Click on the back arrow to save. It is important that you do not type anything else in any other field

Browsing service is all set. Now for MMS.

You should be at the "Access Point Names" screen still if you are following the above sequence.
1. Press the 'Menu' button again and click on 'New APN' to add a second connection
2. Type in these values:
Name: Mobilink MMS
APN: mms.mobilinkworld.com
Username: mobilink
Password: mobilink
MMSC: http://mms/
MMS Proxy: 172.25.20.12
MMS Port: 8080
APN type: mms
3. Press the back arrow and then press the 'Home' button.

Do note that there are different entries available for "Proxy" and "MMS Proxy". Enter the values in the fields that I have mentioned and do not type anything in the other fields.

As I was saying, Mobilink doesn't have a fixed monthly charge for GPRS usage. Instead they charge Rs. 18 per MB of download. There is no option in Android to turn off GPRS. Here is what you do to avoid large bills: Define a third APN. Give the name as "Disconnected" and type "dummy" in the APN field. Now whenever you want to disconnect, go to the APN list and select this connection. Your phone would then stop the background data transfer.