Impress Your Friends While Watching "Untraceable" 228
Frequent Slashdot contributor Bennett Haselton writes in today with a nerd-oriented review of "Untraceable," which opened in theaters last Friday. Read on for Bennett's take on what the movie gets right — a surprising amount as these movies usually go — but be warned, his review contains spoilers.
I went into the theater planning to come out with notes for an article like "Everything that 'Untraceable' gets wrong" (feeling pessimistic after "Swordfish" and "Firewall"), but it actually doesn't do that bad. Oh, it gets stuff wrong -- I don't think the FBI can "blackhole" an IP address by clicking a button -- but the errors are for dramatic license, not technical howlers, and the plot holes fall more in the category of things that could have been accomplished more easily some other way. In fact the dialog goes out of its way in several spots to make sure we know they know what they're talking about; screenwriters can't win with these movies, because they'll get grief for getting too much stuff wrong, but if they explain things correctly, it breaks the reality when we can feel the writers telegraphing their knowledge to the geeks in the audience. But it is mostly accurate, and the movie throws you just enough softballs for you to impress your movie-mates as well as the patrons two rows in front and back of you.
The movie takes its first stab at geek realism right at the top, when Diane Lane tells Colin Hanks that his Internet date is never going to see him again because she's more attractive in person than he is. (So far, the only thing wrong with this is that Colin Hanks has exactly the kind of adorable-nerd face that appeals to girls who like to think they don't care about looks.) Then Diane Lane explains how she's ensnaring the cyber-criminal on her screen, in a set piece that has nothing to do with the rest of the plot, like the pre-title action sequence in a Bond movie. First, in a horde of pop-ups covers her monitor, and a site tries to entice her into downloading and running a program that contains a trojan horse. She runs the trojan horse on a virtual machine, where she watches it steal a file full of passwords and financial records, but she inserts her own trojan into the data that's uploaded back to the criminal's computer. In a few moments they find the user's IP address and realize that it must be a neighbor stealing that person's wireless service.
Batter up! I think that an FBI cyber crime expert would have a pop-up blocker installed, but moving on. If a criminal wanted to gain access to your machine to steal your financial records, tricking you into downloading and installing a trojan horse as part of another program, is probably exactly how they'd do it. (However, a trojan wouldn't automatically and instantly find a file full of passwords, even if she did named it "passwords.txt" as bait.) The biggest slip is that if you upload a trojan horse back to someone who was downloading data from your machine, there's still no way to force the remote criminal's computer to run it, as happens in the movie. And a criminal that smart would probably be running the operation from the compromised PC of someone in another city, not stealing a neighbor's wireless access. (In any case, while having the criminal's IP address would allow you to go to someone's ISP and ask them to turn over the records of where that person lived, the characters should not have been able to narrow an IP address down to a person's house without that extra step.) Also, if I heard right, the FBI figures out who the guilty neighbor is even though he has no priors, based on the fact that he has two registered handguns. That will offend a certain portion of the audience, so viewers of "27 Dresses" in some cinemas may hear angry gunfire coming from the next theater.
However, most of these errors were probably necessary to show what the main character does in as short a time as possible and to end the set piece with the villain actually getting caught, so this is probably the best the movie could have done. Don't point that out to your date, of course, since she'll be more impressed by knowledgeable sneering, especially if everyone in the seats around you can hear what a smart guy she's with.
Then the main villain's site is introduced, and the movie has to handle the question of how a site with its own top-level domain like KillWithMe.com would be able to remain online despite showing real-time streaming video of a murder victim being killed. (The hook in the movie is that the more people visit the site, the faster some automated murder contraption kills the victim.) Diane Lane explains how, in a virtuoso sentence designed to silence the nerds who would otherwise say afterwards that there's no way that could ever happen. You'll know the line; it's the one right before her boss says, "I didn't understand anything you said; something about 'Russia'?" Apparently the domain is registered in Russia, and the DNS servers use a low TTL (yes, Diane Lane actually says "low TTL" -- sexy!) to switch the hostname between thousands of different IP addresses, each belonging to some compromised machine.
If you had to come up with a way to do this in a film, and if you assumed that Russian authorities could not be persuaded to go after the domain registrar (something nobody tries in the movie), this would probably be the simplest way that was semi-plausible. You need the site to resolve to thousands of possible IP addresses so that it can't be made to disappear by simply taking one machine offline. The way the movie demonstrates this, though, is for Diane Lane to make one of the site's many IP addresses go dark by clicking a button on her screen and causing it to be blackholed, before the hostname switches to the next IP. The only people who can actually do this in real life are backbone operators with an axe to grind, not the FBI (something the movie actually acknowledges with a passing reference to Net Neutrality legislation!). Ah, but here's where you can knock one out of the park: If you assume, as the movie does, that the FBI has the ability to blackhole individual IP addresses, then they could shut the site down not by blocking the site's IP addresses but by blocking the primary and secondary DNS servers for the killwithme.com domain in Russia, so that if people's computers couldn't communicate with the DNS servers, they'd have no way of resolving the hostname.
By now, the surrounding theatergoers should be threatening to jam your USB thumb drive keychain into your nostril, but you're not done yet. At one point a character targets an IP address beginning with "10.*", and everybody knows those are reserved for intranets, not the public Internet, so you can point out that that's like the 555 prefix for a movie phone number. Later, the heroine finds that a Trojan horse installed on her daughter's machine, has access to all files on all PCs in the house. That could work if (a) the other PCs were set to share out files to other PCs on the same local network, or (b) if the traffic between the other PCs and the wireless router were unencrypted, although it's unlikely the main character would make either of these mistakes.
But you don't want fellow viewers getting the idea you're too Net-savvy; one suspect is later described: "He blogged, he built web sites, he practically lived online," which sets the bar a little low for qualifying as a sociopathic online loner.
With regard to the non-Internet technical details, I have no idea if OnStar can actually help you get through a traffic jam the way they do in this movie, but I'm sure they paid a lot of money to have it appear that they could (although maybe they got a discount since the movie later shows the villain hacking into Diane Lane's car's system, during which the brand name "OnStar" is definitely not mentioned). Speaking of product placement, several in the audience snickered when the movie twice showed the heroine conspicuously logging into the Windows Live interface. But Microsoft may have gotten an even better deal: while the villain's operating system of choice is never mentioned, during closeups of his screen at the end, you can clearly see the word "GNU".
Or maybe it just fits with his overachieving character. After he ties his victims to a bedframe, he likes to elevate it into the path of the camera using a remote-controlled motorized winch evocative of a medieval torture device. Unless I'm mistaken, though, that happens before the site is actually streaming, which means he could have just as easily walked over and lifted up the bedframe. With that kind of fetish for doing simple things the horrendously hard way for no reason, why didn't he just go ahead and wear a "Got Linux?" t-shirt?
Another way to impress your friends (Score:5, Funny)
Oh no, they're in my wireless network, I've got to go.
Re: (Score:2)
Re: (Score:3, Funny)
Did you see her in "Unfaithful"?
Re: (Score:2)
Re:Another way to impress your friends (Score:5, Insightful)
Swordfish had Halle Berry topless. HALLE BERRY. TOPLESS. And I still walked out of the theatre wanting those two hours of my life back.
Re: (Score:3, Informative)
Re: (Score:2)
'True' Nerds do have friends - they just don't occur together in large numbers and share some focused intellectual and/or imaginative interest as opposed to a more generalized run-of-the-mill interest. Groups typically somewhere in the neighborhood of 3d4 or so.
He's one of them (Score:5, Funny)
'nuff said.
Re: (Score:3, Insightful)
Millennium (Score:5, Interesting)
Re:Millennium (Score:4, Informative)
Yeah, I got the same feeling too. The episode you're thinking of was called "The Mikado" - Series 2, Episode 13. I never watched too many episodes of Millennium but I did catch this on tv years ago and found it thoroughly entertaining. Definitely very, very, VERY similar to the premise of Untraceable.
I think you mean... (Score:5, Funny)
What tech movies are actually good? (Score:2)
Re: (Score:2)
Re: (Score:2)
"We're in!"
In your dreams, hacker monkey.
Re: (Score:3, Interesting)
Any other "operation sundevil" survivors out there?
Re: (Score:2)
It was kind of like the basic assumption in the Matrix that humans would make good batteries to power robots (we don't.) At least the Matrix had both bullet-time AND Carrie Anne Moss in PVC so you always had something uber-cool to watch. But when the second and third movies built themselves further around this extremely lame assumption, they too became crap with respect to
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:3, Funny)
"Pirates of Silicon Valley"
Re: (Score:3, Funny)
I gotta admit, Hollywood writers are a hell of a lot better than me at piecing together random technical words in a way that makes it sound good.
Re: (Score:2)
Untraceable? Try Unwatchable! (Score:4, Interesting)
these writers should log into IRC sometime and chat with people that know how this stuff works. I could have rewritten portions of this movie to be more plausible as well as more compelling.
Re: (Score:2, Insightful)
Re:Untraceable? Try Unwatchable! (Score:5, Funny)
Re:Untraceable? Try Unwatchable! (Score:5, Funny)
Re: (Score:2)
Re: (Score:3, Funny)
Re:Untraceable? Try Unwatchable! (Score:5, Funny)
Yeah, we told Natalie Portman we were thinking of making this movie and she was utterly petrified.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
Re:Untraceable? Try Unwatchable! (Score:5, Insightful)
* themselves not particularly good, but they made enough money to induce the cloning process
Re: (Score:2)
Re:Untraceable? Try Unwatchable! (Score:4, Funny)
Step one: find an atom
Step two: split it!
Remote Execution: google more (Score:4, Interesting)
This is actually how many worms have spread in the past, actually. If you can get files onto a windows box, you can probably execute them remotely (easy mode: you have acquired logon credentials or the box accepts null sessions).
http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx [microsoft.com]
Re:Remote Execution: google more (Score:5, Informative)
Of course, all of that assumes you have Netbios connectivity... over the Internet. That may have been plausible 5 years ago (probably more more), but someone in between will be blocking it these days. On top of that, current Windows XP and better have a lot more restrictions on Netbios traffic, in particular disabling the default null sessions.
One final point: This scenario is actually quite reasonable if you assume they're exploiting an application on the attacker's system. There's likely to be exploits against the trojan itself if the binary is available for analysis, or if you can identify exploitable bugs in code shared between the client and server components. There's also the possibility of attacking any services he exposes, or perhaps file parser attacks against whatever he uses to read the content he nabbed. The details of such a counterattack are more complex, but well within the realm of reason.
Re: (Score:2)
Re: (Score:2)
Want to trojan them? Throw something in the data that will buffer overflow something parsing the data and execute code for you. You might not even need them to open it when you consider things like Desktop Search and similar features willingly parsing all the data on your harddrive with potentially vulnerable(or backdoored..) parsers.
Re: (Score:2)
On behalf of everybody everywhere... (Score:3, Insightful)
Re: (Score:2)
article title missing a set of quotation marks... (Score:5, Funny)
Re:article title missing a set of quotation marks. (Score:5, Funny)
Re:article title missing a set of quotation marks. (Score:4, Funny)
Impossible (Score:2)
I won't watch this you insensitive clod! (Score:2)
Re: (Score:2)
That was a horror movie, ala The Ring. It was meant to add the supernatural to the commonplace to be scary.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Not sure which one you mean there, but it gave me the idea of sending the killer video from Ring on my mobile and then Bluetoothing it to people at random. Even more fun than 2girls1cup!
Unwatchable Confirmed (Score:2)
As a public service... (Score:4, Funny)
Are you daft?!?!?? (Score:2)
Couldn't be that hard to find the guy. (Score:2)
They know he's in Portland. Once they know that, he has to be on either cable or DSL, or mooching off someone else's nearby connection.
The FBI could ask the cable company to reboot, in sequence, the router for each cable segment. When the right cable segment went momentarily offline, the streaming video would stop for a moment. Similarly, each DSLAM could be restarted. That would narrow it down to a hundred houses or so.
Re: (Score:2)
Talking in a movie? (Score:5, Insightful)
I don't know what kind of dates this guy has, but I don't think any date I have had would want me to talk through a movie and nitpick on every little detail.
Re: (Score:3, Funny)
It was sarcastic (Score:2)
misplaced sarcasm (Score:4, Insightful)
"Don't point that out to your date, of course, since she'll be more impressed by knowledgeable sneering, especially if everyone in the seats around you can hear what a smart guy she's with."
</sarcasm>
i know you are being sarcastic, but a sentence like this pretty much explains the social life with a straight face of a good amount of slashdotters here, so your sarcasm might be wasted here, and actually encourage this sort of behavior
Screen captures from the movie trailer. (Score:2)
Re: (Score:2)
If a number in the IP address has only 1 or 2 digits, we never zero-prefix it to make it three digits. The IP address 192.010.125.120 really hurts my eyes. It actually is a real IP address that belongs to "Symbolics, Inc." The address 127.131.101.180 is the same as 127.0.0.1. All 127.* prefixed IP addresses are reserved for localhost. The third one, 010.191.100.122 is a non-routable intranet IP address. Whether it's valid or not depends on where the computer is.
Re: (Score:2)
All in all, the movie does a good job using non-public IP addresses, like the 555- telephone number that the reviewer made an analogy of. However, 192.168.* are all class C networks, and not all addresses prefixed with 192.* are private. For example, 192.169.* is not private, and it belongs to someone in Hawaii according to its whois information.
Re: (Score:2)
Re: (Score:2)
password.doc (Score:2)
My first reaction was to make the password file a Word document, and write the trojan as VBA macro, but at this time and age I don't know if that's still feasible. The most plausible way would be to craft a malformed Word document that causes buffer overrun when Word reads the file, executing arbitr
Fiction or Fact (Score:2)
- I don't think the FBI can "blackhole" an IP address by clicking a button...
Actually, I used to work for a company that sold products that did just that... sort of. I haven't seen the movie and don't plan to, but for traffic on their own enterprise network our goal was to give users a "big red button" they can hit to blackhole traffic that matches a given signature. This could be an IP, or it could be traffic from a given IP, to another IP on a specific port, or even matches packet content. We had another product for big ISPs that allows them to do the same (but I think it only w
The Net (Score:4, Funny)
--
Toro
"will offend a certain portion of the audience" (Score:4, Insightful)
Owning a gun isn't just legal, it was encouraged by those who wrote the Constitution, and protected by it. Owning a handgun should provide zero suspicion of any other action. In fact, owning a registered handgun is a sign of a law-abiding citizen, since a criminal would likely not have his handguns registered.
Either this section is completely bull, or it's a sad but true description of a government that sees legal handgun ownership as a sign of criminal leanings. Unfortunately the latter is more likely.
Re:"will offend a certain portion of the audience" (Score:4, Insightful)
You're not the only person who's noticed that Hollywood vilifies gun ownership while at the same time zealously worshiping it.
Leaving aside the guilt of the person in the movie, this kind of database trolling is exactly why gun registration is a bad thing. Fortunately, my state (and many others) do not require gun registration.
Re: (Score:2)
STOP! Impress/crucify me Holywood .... (Score:2)
If "Untraceable"is 2007 nerd-oriented
Re: (Score:2)
Impress Your Friends While Watching "Untraceable" (Score:2)
-Bill
For the Millennium fans (Score:2)
Anyone else remember the episode The Mikado [fourthhorseman.com] from season two of Millennium? Based on the trailer, looks like the writers of this movie did too.
Re: (Score:3, Interesting)
Re: (Score:2)
Have you ever watched 2001? As I recall, it's 15 minutes of a plastic ship landing on the moon, 15 minutes of a sphere slowly wandering around a ship, 15 minutes of falling down a flashy tunnel, and 15 minutes of intermission, broken up by chunks of dialog in a style that thankfully currently o
Re: (Score:2)
What about the 45 minutes of monkeys?
Re: (Score:2)
Re: (Score:3, Insightful)
*that* was what bothered you about independence day? It didn't bother you that the guy uploaded a virus on to the Alien mothership's computer which somehow managed to take the shields out? these aliens travel trillions of miles across the galaxy destroying everything in their path and get taken out by a virus that a guy on some backwater planet called Earth whipped up in less than an hour? WTF? Deep impact wasn't as bad as Armageddon,
Re: (Score:2)
Re: (Score:3, Insightful)
Re:Honestly... (Score:5, Informative)
Actually, a PowerBook from 1997 could connect to the Internet on the move. Specifically, mine did. Like thousands of others, I was using a http://en.wikipedia.org/wiki/Ricochet_(internet_service) [wikipedia.org] Ricochet wireless modem from a company called Metricom. Independence Day made a point of attaching a Ricochet modem to the onscreen computer. And yes, Ricochet's coverage area did reach into Washington, D.C.,--apparently, Metricom was hoping that Ricochet's benefits would impress the federal regulators. Unfortunately, Metricom went bankrupt in 2001. Now that the more ubiquitous cellular networks have caught up with better speeds (Ricochet had DSL speeds at the end), it's unlikely that Ricochet will be revived. But, yes, PowerBooks could connect to the Internet in 1997.
Re:Honestly... (Score:4, Funny)
I applaud your support of Independence Day and its technological merits.
However, I think what he meant to say was:
Re: (Score:2)
No, it wasn't explicit, it was surprisingly subtle in a movie that likes to slap things in your face.
Brent Spiner's scientist character makes some comments about the technologies and research avenues that the crashed fighter unlocks.
Re: (Score:2)
It was a terrible movie, with a few stunning visuals, and quite a few cool-looking matte paintings. It's plausibility pales in comparison to the other space invade
Re: (Score:2)
What's wrong with that? IIRC, I had a cellphone with a special port for use to connnect to a serial(?) port in 1997. You could use it as a modem to call an ISP. It wasn't EDGE technology that allowed it to be on the internet, but it was around.
I don't remember when that happened however.
Of more concern was how easy it was to connect the Mac to the alien computers. But I suppose
Re: (Score:2)
When was that ever true? Except for a few biopics (Thomas Edison, Marie Cure) the science has always been wrong, and in those cases the history was usually dubious. It didn't start with movies. Shakespeare's "historical" plays have little relation to what any scholar would call history.
Re: (Score:2, Insightful)
From the article: "But it is mostly accurate, and the movie throws you just enough softballs for you to impress your movie-mates as well as the patrons two rows in front and back of you."
How about you STFU when watching a film in a movie theatre? No one cares what you're thinking or how smart you are.
The movie theater is not your living room.
Re: (Score:2)
Definitions of snicker on the Web:
* a disrespectful laugh
Re: (Score:3, Funny)
Re: (Score:2)
"Hi my names Steve, and I'm a supervillain." [dagobah.biz].
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
...So drive a 1967 Impala or something like that. "Hack THIS!" 8-)
Even with a modern car there's a limit to how much "hacking" you could do.
Even assuming that you could remotely pwn a car, what would you do with it? The computer controls the engine and MAYBE (in an automatic) the transmission. It doesn't control the steering or brakes. Even if you could floor the throttle using the computer (can you?) the brakes are powerful enough to bring the vehicle to a stop.
Beyond all that, on most cars (maybe not the prius or other 'push-button' start vehicles) I'm guessing
Re: (Score:2)
That does sound pretty damn reasonable.... and you know people would totally fall for it. "Yeah, this doesn't look familiar, but it's GPS, so it can't be wrong, right?"
I still can't think of what you could realistically do to harm someone if you pwned their engine control unit or any of the underlying electronics in a car. I suppose you could disable the vehicle quite easily but there are far easier ways to accomplish that (slashed tires come to mind) then trying to do it through electronics.
Re: (Score:2)
Re: (Score:2)