Found a mirror for android source despite kernel.org (and android.git.kernel.org) being down: http://ping.fm/MXbba

First time a hacking incident directly effected my productivity... kernel.org is down, no more android source.

What is s.nsdsvc.com?

I have been getting a bunch of hits from http://s.nsdsvc.com/App/DddWrapper.swf?c=3. The hits seem like real people, not robots. But there's nothing on that website. Their whois information is private. If you go to that page you just get a blank flash script (is it blank?). Some random post mentions it and it seems to be related to adobe, but that may be just because it's a ".swf". Anyone have any better ideas?

My guess is that it's a script for bouncing people from one site to another, but I really have no idea.

Trend Micro is Recording Your Every Mouse-Click

Many of us use some sort of anti-virus protection. One of the more popular products is Trend Micro. After a bit of investigating, I have concluded that once you install a Trend Micro anti-virus product, their software records every link that you click on the internet and sends that information back to Trend Micro servers.

Recommendation: Trend Micro is Spyware. Uninstall it immediately.

Investigation - Odd Website Behavior:

I run a small website. I am kind of obsessed at making sure my site is operating properly and I monitor the logs closely. I started noticing some unusual activity.

To access a large part of my site, you have to be logged in. However, I started noticing requests from users who were not logged in; it appeared they were clicking on links that required them to be logged in. For example, if someone wants to search the database on my site, they must first log in. I saw quite a bit of activity of people who were not logged in trying to search my database. A normal user would never normally do this because in order to get to the search page, you must first log in. When a user tries to search without logging in, the search fails and returns an error message. (Note: It could also happen if the user logs in, keeps their browser open until their session expires and does a searche. However, this is relatively uncommon and was not happening with the frequency I was seeing).

A Possible Connection to Trend Micro

The strange activity got kept on happening over and over again and it got me suspicious. I checked the IP addresses of the users that did these types of searches. I found that several different IPs contributed to the vast majority of these types of errors. I did a reverse DNS on the IP address and I found that every single one of them comes from a Trend Micro server.

I thought that was strange and I wondered why or how Trend Micro was clicking around on my site. Then I noticed that every single one of the queries that came from Trend Micro, was done by a real logged-in person earlier. Sometimes a user would do it days earlier, sometimes hours. But there was no truly unique request coming from Trend Micro.

I then noticed that my site was getting requests to the administrator area. These areas are unexposed to the open internet and should only be accessed by me. I had an "ah ha" moment when I saw that Trend Micro is the installed anti-virus program on my work computer, where I occasionally view the administrator pages.

I have to conclude that Trend Micro is recording the requests from every user that has installed its software. The software must record the user’s internet requests and send them to Trend Micro. Then Trend Micro re-runs them again, probably to do some security analysis.

I have no idea what else Trend Micro is recording. The only thing I know for certain is that they record what you click on the internet. However, it is certainly possible, and based on Trend Micro's past behavior it is probable, that they are recording your every move on your computer.

An Explanation?

I searched the Trend Micro website and I could not find anything that actually discloses what they are doing. My guess however is that it is involved with the Trend Micro Smart Protection Network. The website says that it "[l]everag[es] cloud computing across Trend Micro's security solutions and services." However it does not say that it is tracking everyone's click and movement on the internet.

If Trend Micro is doing what it appears they are doing, it is a huge affront to your privacy and they may be violating the law. Users of any software should know what the software is doing and have an opportunity to turn it off. Trend Micro has not been upfront with their reprehensible behavior.

IP Addresses

Below are some of the IP addresses where I noticed this traffic. All of them are registered to Trend Micro. The 150.70.x.x IPs are registered in Japan and the 216.104.x.x IPs are registered in Cupertino, California.

• 150.70.172.107
• 150.70.64.195
• 150.70.75.27
• 216.104.15.130
• 216.104.15.138
• 216.104.15.142
• 216.104.15.134

There are probably more IPs than the ones listed above, these are only a snapshot from a couple of days. I am considering blacklisting them from my site.

Lincoln Lawyer: Just a big law-school hypo?

I just saw Lincoln Lawyer this weekend. It seemed like a good movie but I was not really able to enjoy it. The entire time it brought me back to my professional responsibility class, which I'm taking this semester. Throughout the two hour movie I could not stop analyzing the dozen or so legal ethics issues that popped up. Some of the issues are pretty clear cut: In the first five minutes, the lead protagonist intentionally delays his client's case because his client hadn't paid him. But other issues including attorney client privilege and conflicts are harder and the entire time my mind was racing through model rules of professional responsibility.

The movie is filled with plenty cliches and cheesy scenes (getting paid in cash by a motorcycle gang), but it also has some good ones too ("There is no client as scary as an innocent man.").

Overall a pretty good movie. But if you're a law student watching it, try to relax and enjoy rather than treating it like a law school exam.

Addicted to Logs

I released my website just a week or two ago. Since then, I've probably checked and rechecked the server logs a hundred times a day. I'm totally addicted. I now check them more than email. When I'm away from my computer I get nervous thinking about the activity I'm missing.

What I love the most is sitting there refreshing the logs watching a user's every move. I see what pages they click on and how long they stay on a page. I try to imagine them sitting there, reading the different blurbs and thinking about where to click next. When they inevitably navigate away from my site I wonder in agony why they would leave. Was the price too high? Does the site look too unprofessional or do they think it's a scam? Or is there some random browser bug on their system that caused it to be displayed improperly? I may never know. But I always blame myself.

But I continue hitting refresh. The unrelenting self-doubt wont stop me from eavesdropping on the next person who comes on the site. I'll change some text here tweak the layout there. I keep wanting to slash and burn whole areas of the site but I'm also too scared to touch it because it works sort-of.

I think I'll just stay here and keep watching.

New Website

It can be difficult to keep your programming teeth sharp while studying in law school, but I've done just that. I'm happy to say that after learning a host of technologies (see previous post), my new website is largely complete.

The result is Resumé Launchpad. I got the idea for the website while applying to law firms during the end of my first year of law school. It's a tedious process. There are widely published databases containing the firm names, human resources representative names, and email addresses. So the process normally involves building a generic cover letter, copying and pasting the appropriate information into the cover letter, and blasting the email off.

When you first start, you try to customize the cover letter to each firm. It wouldn't be uncommon for me to spend a good twenty to forty minutes per cover letter. But after doing a dozen of these and receiving only form rejection letters, you begin to realize that quantity is more important that quality. Then you literally just modify the name of the firm and recipient and send the email blindly hoping for the best.

I ran into problems. I tried tracking everything in excel, but on several occasions I sent the my application to the same person twice. Worse than that, sometimes I would copy & paste incorrectly and get the firm's name, the recipient's name, or their gender wrong. After sending nearly a hundred cover letters like this, my programming instincts got the better of me and I decided to automate the process.

So I put together a database of legal employers from widely available sources (all legit). Then I wrote a python program which was kind of like a mail-merge on steroids; it could send hundreds of customized emails to various recipients stored in a local database.

Finally, the day of reckoning came. I put together my cover letter, resumé, and other attachments and let my program do its thing. I sent about three hundred emails in a couple of minutes. What would have taken me hours and days took only seconds.

It was successful. I got a number of interviews at some very prestigious firms. At the time, I didn't see it as a product, but more as a tool to make life easier for me. The idea to build a general-purpose web interface to my program started percolating.

The rest is programming history. I learned how to put together a modern complex site and two weeks ago I launched it to the world.

So if you're an attorney, law student, paralegal, or legal secretary and you're looking for legal work, check out www.resumelaunchpad.com.