Software Analysis and Forensic Engineering » General

Marc Dreier’s story

zeidman — Thu, 02 Sep 2010 00:00:41 +0000

Marc Dreier was the founding partner of the New York law firm Dreier Stein and Kahan. At its peak in 2009 the firm was reportedly bringing in about $100 million in revenue. You might have heard of Marc Dreier if he had not been overshadowed by Bernie Madoff. But Dreier ran his own Ponzi scheme, cheating clients out of “only” $400 million. Prosecutors asked for a sentence of 145 years. Defense attorney requested a 20 year sentence. He got the shorter sentence.

Maybe you’ve wondered, like I have, what’s going through the minds of these people. Do they think they won’t get caught? Do they not care? Maybe they figure they’ll live it up while they can? Dreier’s letter to the judge in the case, prior to sentencing (downloadable here) might give some insight into Dreier’s state of mind. Some say this was just a way to get sympathy from the court (in which case it appears to have worked). To me it seems sincere. It definitely doesn’t excuse Dreier’s behavior, but it does possibly explain how such a successful man could end up in his situation and what was going on in his mind.

Multiprocessing CodeSuite-MP

zeidman — Wed, 01 Sep 2010 23:54:05 +0000

Until now there were two ways of running really big jobs of CodeSuite. One was to simply run it and wait for as long as it took. Really large jobs can take as much as a week or two. The other option was to run the job on CodeGrid, our framework that distributes the job over a grid of networked computers. CodeGrid shows an almost linear speedup for each computer on the grid, but it requires someone to maintain the computers and the network and that can be a daunting job. Now there’s a third option;, CodeSuite-MP allows you to run multiple jobs on a single multicore computer. We’re seeing a near-linear speedup for the number of cores, and there’s no special maintenance required. We’re even seeing a near-linear speedup using virtual cores. If you want to get a license for CodeSuite-MP, contact our sales department.

The DMCA Exemptions

zeidman — Tue, 03 Aug 2010 04:19:24 +0000

The Digital Millennium Copyright Act has been praised by some, vilified by others. Many don’t know that the DMCA specifically allows copying of protected works by researchers, libraries, nonprofits, and academic institutions. Also, the Librarian of Congress is required to issue exemptions from the prohibition against circumvention of access-control technology when such technology prevents people from making non-infringing uses of copyrighted works. The current exemptions, issued just last week are described below. Note that all of these allowable uses assume that the person copying the work has purchased the work or has otherwise rightfully obtained it.

To copy short portions of movie DVDs for the purpose of criticism or comment, specifically:
- Educational uses
- Documentary filmmaking
- Noncommercial videos
To enable computer programs that allow cell phones to run software applications written for other cell phones (known as “jailbreaking” or “rooting”).
To enable computer programs that allow used cell phones to connect to a phone network as long as it is authorized by the operator of the network.
To run video games on personal computers for the purpose of testing for, investigating, or correcting security flaws or vulnerabilities.
To bypass broken or obsolete dongles that prevent a program from running.
To enable an ebook’s read-aloud function or screen readers that convert the text into a specialized format.

The Report Generator (RPG)

zeidman — Thu, 01 Jul 2010 06:10:58 +0000

The Report Generator (“RPG”) is a new program from SAFE that automatically generates draft expert reports and declarations for litigation. Reports have several generic sections such as an expert’s experience and descriptions of the technologies involved in the examination, which can be shared amongst reports. By automating the compilation of the generic information into a formatted and structured draft report, the expert can focus on performing the analysis and writing the case-specific arguments.

When using the RPG, an expert selects the type of case, type of report, types of technologies involved, types of tools used, and expert background profiles from a GUI. Then a Microsoft Word draft report is generated that includes all of the selected generic information intermixed with blank sections where case-specific information should be filled in manually.

Currently, many experts either dig through their prior works to find specific descriptions or write them from scratch each time. Maintaining a library of generic report elements is a challenge, especially when multiple experts are involved. RPG acts as a version control system between multiple experts who can upload and download detailed descriptions of experts, technologies, and tools from a central server. The reports are generated according to specific formats, so an entire team of experts can easily produce reports that are consistently formatted with the most up-to-date descriptions.

RPG also keeps synced descriptions of CodeSuite, so it can include the most up-to-date descriptions and pricing of the tools without having to search the S.A.F.E. website or CodeSuite help files.

If you’re interested in trying out RPG, contact our Sales Department.

The Supreme Court rules about software patents and business method patents (kind of)

zeidman — Thu, 01 Jul 2010 06:01:40 +0000

Many in the intellectual property business have been holding their breath waiting for this case to be decided. Many countries don’t allow software patents at all and most countries don’t allow business method patents. The United States allows both, but the lines, limits, and legality have been changing over the past years. The Court of Appeals for the Federal Circuit (CAFC) decided that Bilski’s patent on a method for handling energy hedge funds was not patentable because patents must be tied to a particular machine or transform an article from one thing or state to another. This “machine-or-transformation test” is probably as confusing to you as it is to the thousand of inventors and attorneys who had to understand it. Bilski appealed to the Supreme Court and on Monday the Supreme Court decided. Bilski loses his patent, but not because of the machine-or-transformation test. Abstract ideas have never been patentable and that’s what Bilski’s patent is, according to the Supreme Court. They also ruled that the machine-or-transformation test is only one test for patentability, not the only test as the CAFC had stated. They also ruled that business methods are patentable, as long as they are not abstract ideas.

Still confused? So are many others. Except for Bilski who now knows for sure that he doesn’t have a patent. Looking at it as an inventor, I see that the court has broadened the scope of patentable materials, which is good, but has made the test for patentability muddier which means I will spend even more time and more money arguing with patent examiners. Looking at it as an expert witness for patent litigation, this ruling is sure to cause a lot more disagreements, which means a lot more litigation, which means a lot more business for me.

An excellent discussion of the Bilski ruling can be found at Patently-O, written by Dennis Crouch,
Associate Professor at the University of Missouri School of Law. His regular columns on patents are the best ones available anywhere.

CodeCLOC for software transfer pricing cases

zeidman — Wed, 02 Jun 2010 03:21:33 +0000

Last month we announced CodeMeasure, our new standalone tool for measuring software growth. This month we announced the release of CodeSuite 4.0 that includes CodeCLOC for measuring how software evolves across versions of code. CodeCLOC uses the same algorithms that were implemented in CodeMeasure and that were developed for the landmark software transfer pricing case Symantec v. Commissioner of Internal Revenue.

You’re probably wondering what is the difference between CodeMeasure and CodeCLOC. CodeMeasure is a simple, inexpensive program for generating the CLOC measurement statistics for multiple versions of a program. CodeCLOC, intended for litigation, compares only two versions of code but produces a detailed database of results that can be further filtered and analyzed using CodeSuite or your own custom tools. The results from CodeCLOC can be presented in court and the CodeCLOC database can be presented to the opposing party for verification.

CodeSuite 4.0 also has a few other nice features including a revamped user interface. There’s also a new function to generate statistics from any CodeSuite database and the command line interface has been enhanced for integrating with other programs. CodeSuite 4.0 is available for download here and can be purchased on a term license or project basis. CodeCLOC is priced at $20 per megabyte. A one year term license for CodeSuite is $100,000.

Can whitespace patterns provide clues to plagiarism?

zeidman — Wed, 02 Jun 2010 03:11:57 +0000

Over the years I’ve run into expert witnesses and attorneys who have told me about software copyright infringement cases where the only clues that copying occurred were patterns of spaces and tabs (“whitespace”). The idea is that if a truly ambitious thief wanted to cover his tracks, he would modify the stolen code so much that there was no longer a visible trace of copying. However, the clever software sleuth could find patterns of whitespace that the thief had missed; although virtually nothing remained, the invisible tabs and spaces could produce a conviction.

This always sounded intriguing, but I wondered whether anyone had ever tested this theory. We could find no articles or papers on the subject, except for one inconclusive paper, and I dreaded to think that some programmer was convicted based on an untested theory. I decided to have my consulting company, Zeidman Consulting, do some carefully controlled research. If the results turned out well, SAFE Corporation would add whitespace pattern algorithms to CodeSuite to further enhance its ability to detect copying.

Our results were published in a paper entitled Measuring Whitespace Patterns as an Indication of Plagiarism that was recently presented at the ADFSL Conference on Digital Forensics, Security and Law. Our results are summarized in the final paragraph:

This whitespace pattern matching method can be used to focus a search for evidence of similarity or copying, but this method cannot stand by itself.

What we discovered is that even very different files have often have similar whitespace patterns. At Zeidman Consulting we’ve used whitespace patterns to confirm copying that was already detected through the use of CodeMatch to find correlated programming elements. In those cases, the whitespace patterns offered further confidence in our findings and in some cases showed which program had been developed first. For a copy of the paper, email us at info@SAFE-corp.biz.

Our next research project is to look at sequences of whitespace within files. Maybe there we’ll find some clues to copying. But for now our results show that whitespace patterns without any other evidence should not be used to determine that copying occurred.

SAFE releases CodeMeasure for software developers

zeidman — Sun, 02 May 2010 15:43:52 +0000

SAFE has just introduced its latest product called CodeMeasure™ that can measure the growth of software. Unlike our other products, this one is intended for software developers (look for a litigation version coming soon to CodeSuite). The tool is based on the technique that Zeidman
Consulting developed for the case Symantec v. IRS that we call the Changing Lines of Code (CLOC) method of measuring software changes. It worked pretty well in the Symantec case to help calculate software transfer pricing, and saved Symantec over $500 million in taxes.

We have a whole new website about the product, designed for software developers, at CodeMeasure.com. Check it out and let me know what you think of the product and the website.

North Face v. South Butt

zeidman — Sun, 02 May 2010 15:40:28 +0000

Jimmy Winkelmann, a freshman biomedical engineering student at the University of Missouri, decided to create his very own line of sportswear and called his company The South Butt (motto: Never Stop Relaxing). The North Face, a San Leandro, California-based outdoor products company, was not amused and smacked Winkelmann with a cease-and-desist order that Winkelmann read and promptly ignored. Then came the trademark infringement lawsuit. South Butt’s reply, filed in court, is pretty funny. Among other things it defines the company name as “being the soft undercarriage of the non-mountain climbing human anatomy, commonly known and referred to in non-salacious form as, among others, rump, bootie, bottom, buttocks, posterior, rear, saddle thumper and butt.” In a similar vein it describes “Little Jimmy” himself as “a handsome cross between Mad Magazine’s Alfred E. Newman of ‘What me Worry’ fame, and Skippy the Punk from the Midwest” If anyone knows who Skippy the Punk from the Midwest is, please let me know.

The North Face didn’t get the joke. Their lawyers scheduled a deposition of Winkelmann’s father, James Winkelmann Sr. That didn’t go too well. It turns out that Winkelmann Sr. was once a partner at the St. Louis brokerage firm of HFI Securities where partner Don Weir Jr. pleaded guilty a year ago to charges he stole more than $10 million from clients (Winkelmann was never implicated in any wrongdoing).

I suggest you download the reply and the deposition when you want to have a good laugh at the expense of the legal system. The reply is pretty sarcastic and it’s not clear to me who it’s supposed to appeal to (except readers like us, but not necessarily the judge). The deposition reads like a Marx Brothers skit and is every bit as funny. Litigation has never been so much fun.

The value of corporate secrets

zeidman — Sun, 02 May 2010 15:32:35 +0000

Forrester Consulting just put out a report that I found interesting. According to Forrester, chief information security officers (CISOs) face increasing demands from their business units, regulators, and business partners to safeguard their information assets. Security programs protect two types of data: secrets that confer long-term competitive advantage and custodial data assets that they are compelled to protect. Secrets include product plans, earnings forecasts, and trade secrets; custodial data includes customer, medical, and payment card information that becomes “toxic” when spilled or stolen. Forrester found that enterprises are overly focused on compliance and not focused enough on protecting their secrets. Forrester’s key findings are the following:

Secrets comprise two-thirds of the value of firms’ information portfolios.
Compliance, not security, drives security budgets.
Firms focus on preventing accidents, but theft is where the money is.
The more valuable a firm’s information, the more incidents it will have.
CISOs do not know how effective their security controls actually are.

Download the report to report to get the details.