Nokia shows off Aeon 'wearable' concept phone

Nokia has unveiled its latest concept phone, designed to highlight the company's focus on products that allow users to more readily stamp their personality on their gadgets.

The concept phone, dubbed Aeon, combines two touch-sensitive panels mounted on a fuel-cell power pack. The handset's connectivity and electronics are built into the panels to allow them to be used independendently. When assembled, one panel would operate as the display, the other as the keypad. Since the buttons are entirely virtual, Aeon can flip instantly between a numeric pad for dialling, a text-entry pad for messaging, or a media-player controller.

It's a cute idea and one that ties in with Nokia's expectation that phones will become essentially "wearable" devices - if foresees users removing one of Aeon's display panels and mounting it on a watch-like strap or worn as a badge.

More than a phone, Aeon might tap into local wireless networks to transmit data acquired from sensors such as devices that monitor the user's health signs - which is the kind of application the company has in mind for its Wibree personal-area network technology.

Nokia shows off Aeon 'wearable' concept phone

Nokia has unveiled its latest concept phone, designed to highlight the company's focus on products that allow users to more readily stamp their personality on their gadgets.

The concept phone, dubbed Aeon, combines two touch-sensitive panels mounted on a fuel-cell power pack. The handset's connectivity and electronics are built into the panels to allow them to be used independendently. When assembled, one panel would operate as the display, the other as the keypad. Since the buttons are entirely virtual, Aeon can flip instantly between a numeric pad for dialling, a text-entry pad for messaging, or a media-player controller.

It's a cute idea and one that ties in with Nokia's expectation that phones will become essentially "wearable" devices - if foresees users removing one of Aeon's display panels and mounting it on a watch-like strap or worn as a badge.

More than a phone, Aeon might tap into local wireless networks to transmit data acquired from sensors such as devices that monitor the user's health signs - which is the kind of application the company has in mind for its Wibree personal-area network technology.

Nokia shows off Aeon 'wearable' concept phone

Nokia has unveiled its latest concept phone, designed to highlight the company's focus on products that allow users to more readily stamp their personality on their gadgets.

The concept phone, dubbed Aeon, combines two touch-sensitive panels mounted on a fuel-cell power pack. The handset's connectivity and electronics are built into the panels to allow them to be used independendently. When assembled, one panel would operate as the display, the other as the keypad. Since the buttons are entirely virtual, Aeon can flip instantly between a numeric pad for dialling, a text-entry pad for messaging, or a media-player controller.

It's a cute idea and one that ties in with Nokia's expectation that phones will become essentially "wearable" devices - if foresees users removing one of Aeon's display panels and mounting it on a watch-like strap or worn as a badge.

More than a phone, Aeon might tap into local wireless networks to transmit data acquired from sensors such as devices that monitor the user's health signs - which is the kind of application the company has in mind for its Wibree personal-area network technology.

Summary of WiFi hacking tools

Air Crack
Aircrack is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, thus making the attack much faster compared to other WEP cracking tools. In fact, aircrack is a set of tools for auditing wireless networks.

Air Decap
decrypts WEP/WPA capture files. Part of the aircrack suite.

Air Replay
802.11 packet injection program. Part of the aircrack suite.

Airpwn
Airpwn requires two 802.11 interfaces in the case where driver can't inject in monitor mode (lots of chipsets do nowadays, see HCL:Wireless for a list). It uses a config file with multiple config sections to respond to specific data packets with arbitrary content. For example, in the HTML goatse example, we look for any TCP data packets starting with "GET" or "POST" and respond with a valid server response including a reference to the canonical goatse image.

AirSnarf
Airsnarf is a simple rogue wireless access point setup utility designed to demonstrate how a rogue AP can steal usernames and passwords from public wireless hotspots. Airsnarf was developed and released to demonstrate an inherent vulnerability of public 802.11b hotspots snarfing usernames and passwords by confusing users with DNS and HTTP redirects from a competing AP

Airsnort
AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

CowPatty
Cowpatty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol. A while back, Robert Moskowitz published a paper titled "Weakness in Passphrase Choice in WPA Interface" that described a dictionary attack against wireless networks using the TKIP protocol with a pre-shared key (PSK). Supply a libpcap file that includes the TKIP four-way handshake, a dictionary file of passphrases to guess with and the SSID for the network

FakeAP
Black Alchemy's Fake AP generates thousands of counterfeit 802.11b access points. Hide in plain sight amongst Fake AP's cacophony of beacon frames. As part of a honeypot or as an instrument of your site security plan, Fake AP confuses Wardrivers, NetStumblers, Script Kiddies, and other undesirables

Genpmk
genpmk is used to precompute the hash files in a similar way to Rainbow tables is used to pre-hash passwords in Windows LANMan attacks. There is a slight difference however in WPA in that the SSID of the network is used as well as the WPA-PSK to "salt" the hash. This means that we need a different set of hashes for each and every unique SSID i.e. a set for "linksys" a set for "tsunami" etc

Hotspotter
Hotspotter passively monitors the network for probe request frames to identify the preferred networks of Windows XP clients, and will compare it to a supplied list of common hotspot network names. If the probed network name matches a common hotspot name, Hotspotter will act as an access point to allow the client to authenticate and associate. Once associated, Hotspotter can be configured to run a command, possibly a script to kick off a DHCP daemon and other scanning against the new victim

Karma
KARMA is a set of tools for assessing the security of wireless clients at multiple layers. Wireless sniffing tools discover clients and their preferred/trusted networks by passively listening for 802.11 Probe Request frames. From there, individual clients can be targetted by creating a Rogue AP for one of their probed networks (which they may join automatically) or using a custom driver that responds to services can then capture credentials or exploit client-side vulnerabilities on the host.

Kismet
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic. Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.

Wep_crack
WepAttack is a WLAN open source Linux tool for breaking 802.11 WEP keys. This tool is based on an active dictionary attack that tests millions of words to find the right key. Only one packet is required to start an attack.

Wep_decrypt
a program for decrypting captured 802.11 traffic that is protect with WEP traffic. It reads in a pcap capture file, such as that generated by prismdump, and outputs another pcap capture file with decrypted packets. By default it will read from stdin and ouput to stdout. The key to decrypt with can be specified as a string of hex characters, optionally seperated by spaces or colons, or as a text string. If a text string is specified, the actual keying material will be generated by the string in the (ad hoc) standard fashion used by many drivers.

WifiTap
Wifitap is a proof of concept for communication over WLAN networks using traffic injection. Wifitap allows direct communication with an associated station to a given access point directly, whilst not being associated ourselves or being handled by access point.

Summary of WiFi hacking tools

Air Crack
Aircrack is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, thus making the attack much faster compared to other WEP cracking tools. In fact, aircrack is a set of tools for auditing wireless networks.

Air Decap
decrypts WEP/WPA capture files. Part of the aircrack suite.

Air Replay
802.11 packet injection program. Part of the aircrack suite.

Airpwn
Airpwn requires two 802.11 interfaces in the case where driver can't inject in monitor mode (lots of chipsets do nowadays, see HCL:Wireless for a list). It uses a config file with multiple config sections to respond to specific data packets with arbitrary content. For example, in the HTML goatse example, we look for any TCP data packets starting with "GET" or "POST" and respond with a valid server response including a reference to the canonical goatse image.

AirSnarf
Airsnarf is a simple rogue wireless access point setup utility designed to demonstrate how a rogue AP can steal usernames and passwords from public wireless hotspots. Airsnarf was developed and released to demonstrate an inherent vulnerability of public 802.11b hotspots snarfing usernames and passwords by confusing users with DNS and HTTP redirects from a competing AP

Airsnort
AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

CowPatty
Cowpatty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol. A while back, Robert Moskowitz published a paper titled "Weakness in Passphrase Choice in WPA Interface" that described a dictionary attack against wireless networks using the TKIP protocol with a pre-shared key (PSK). Supply a libpcap file that includes the TKIP four-way handshake, a dictionary file of passphrases to guess with and the SSID for the network

FakeAP
Black Alchemy's Fake AP generates thousands of counterfeit 802.11b access points. Hide in plain sight amongst Fake AP's cacophony of beacon frames. As part of a honeypot or as an instrument of your site security plan, Fake AP confuses Wardrivers, NetStumblers, Script Kiddies, and other undesirables

Genpmk
genpmk is used to precompute the hash files in a similar way to Rainbow tables is used to pre-hash passwords in Windows LANMan attacks. There is a slight difference however in WPA in that the SSID of the network is used as well as the WPA-PSK to "salt" the hash. This means that we need a different set of hashes for each and every unique SSID i.e. a set for "linksys" a set for "tsunami" etc

Hotspotter
Hotspotter passively monitors the network for probe request frames to identify the preferred networks of Windows XP clients, and will compare it to a supplied list of common hotspot network names. If the probed network name matches a common hotspot name, Hotspotter will act as an access point to allow the client to authenticate and associate. Once associated, Hotspotter can be configured to run a command, possibly a script to kick off a DHCP daemon and other scanning against the new victim

Karma
KARMA is a set of tools for assessing the security of wireless clients at multiple layers. Wireless sniffing tools discover clients and their preferred/trusted networks by passively listening for 802.11 Probe Request frames. From there, individual clients can be targetted by creating a Rogue AP for one of their probed networks (which they may join automatically) or using a custom driver that responds to services can then capture credentials or exploit client-side vulnerabilities on the host.

Kismet
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic. Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.

Wep_crack
WepAttack is a WLAN open source Linux tool for breaking 802.11 WEP keys. This tool is based on an active dictionary attack that tests millions of words to find the right key. Only one packet is required to start an attack.

Wep_decrypt
a program for decrypting captured 802.11 traffic that is protect with WEP traffic. It reads in a pcap capture file, such as that generated by prismdump, and outputs another pcap capture file with decrypted packets. By default it will read from stdin and ouput to stdout. The key to decrypt with can be specified as a string of hex characters, optionally seperated by spaces or colons, or as a text string. If a text string is specified, the actual keying material will be generated by the string in the (ad hoc) standard fashion used by many drivers.

WifiTap
Wifitap is a proof of concept for communication over WLAN networks using traffic injection. Wifitap allows direct communication with an associated station to a given access point directly, whilst not being associated ourselves or being handled by access point.

Summary of WiFi hacking tools

Air Crack
Aircrack is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, thus making the attack much faster compared to other WEP cracking tools. In fact, aircrack is a set of tools for auditing wireless networks.

Air Decap
decrypts WEP/WPA capture files. Part of the aircrack suite.

Air Replay
802.11 packet injection program. Part of the aircrack suite.

Airpwn
Airpwn requires two 802.11 interfaces in the case where driver can't inject in monitor mode (lots of chipsets do nowadays, see HCL:Wireless for a list). It uses a config file with multiple config sections to respond to specific data packets with arbitrary content. For example, in the HTML goatse example, we look for any TCP data packets starting with "GET" or "POST" and respond with a valid server response including a reference to the canonical goatse image.

AirSnarf
Airsnarf is a simple rogue wireless access point setup utility designed to demonstrate how a rogue AP can steal usernames and passwords from public wireless hotspots. Airsnarf was developed and released to demonstrate an inherent vulnerability of public 802.11b hotspots snarfing usernames and passwords by confusing users with DNS and HTTP redirects from a competing AP

Airsnort
AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

CowPatty
Cowpatty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol. A while back, Robert Moskowitz published a paper titled "Weakness in Passphrase Choice in WPA Interface" that described a dictionary attack against wireless networks using the TKIP protocol with a pre-shared key (PSK). Supply a libpcap file that includes the TKIP four-way handshake, a dictionary file of passphrases to guess with and the SSID for the network

FakeAP
Black Alchemy's Fake AP generates thousands of counterfeit 802.11b access points. Hide in plain sight amongst Fake AP's cacophony of beacon frames. As part of a honeypot or as an instrument of your site security plan, Fake AP confuses Wardrivers, NetStumblers, Script Kiddies, and other undesirables

Genpmk
genpmk is used to precompute the hash files in a similar way to Rainbow tables is used to pre-hash passwords in Windows LANMan attacks. There is a slight difference however in WPA in that the SSID of the network is used as well as the WPA-PSK to "salt" the hash. This means that we need a different set of hashes for each and every unique SSID i.e. a set for "linksys" a set for "tsunami" etc

Hotspotter
Hotspotter passively monitors the network for probe request frames to identify the preferred networks of Windows XP clients, and will compare it to a supplied list of common hotspot network names. If the probed network name matches a common hotspot name, Hotspotter will act as an access point to allow the client to authenticate and associate. Once associated, Hotspotter can be configured to run a command, possibly a script to kick off a DHCP daemon and other scanning against the new victim

Karma
KARMA is a set of tools for assessing the security of wireless clients at multiple layers. Wireless sniffing tools discover clients and their preferred/trusted networks by passively listening for 802.11 Probe Request frames. From there, individual clients can be targetted by creating a Rogue AP for one of their probed networks (which they may join automatically) or using a custom driver that responds to services can then capture credentials or exploit client-side vulnerabilities on the host.

Kismet
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic. Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.

Wep_crack
WepAttack is a WLAN open source Linux tool for breaking 802.11 WEP keys. This tool is based on an active dictionary attack that tests millions of words to find the right key. Only one packet is required to start an attack.

Wep_decrypt
a program for decrypting captured 802.11 traffic that is protect with WEP traffic. It reads in a pcap capture file, such as that generated by prismdump, and outputs another pcap capture file with decrypted packets. By default it will read from stdin and ouput to stdout. The key to decrypt with can be specified as a string of hex characters, optionally seperated by spaces or colons, or as a text string. If a text string is specified, the actual keying material will be generated by the string in the (ad hoc) standard fashion used by many drivers.

WifiTap
Wifitap is a proof of concept for communication over WLAN networks using traffic injection. Wifitap allows direct communication with an associated station to a given access point directly, whilst not being associated ourselves or being handled by access point.

The Hidden Downside of Wireless Networking

Wi-Fi can cause big trouble--and you may not even know it. Here's how to keep the hackers at bay.

Going wireless offers a panoply of attractive benefits to school districts. Because you don't have to run cables to every classroom, it's cheaper to deploy a wireless network than an old-fashioned wired network. Wireless makes it more convenient for administrators, teachers and students to connect.

But there's a perilous downside: A wireless network is easier for hackers to break into. Without the proper security measures, going wireless means opening a gaping hole in your computer systems' defenses.

Worse, you may already have a wireless security problem-even if your technology staff hasn't deployed a single wireless access point. At many school districts, parents and teachers have installed unofficial Wi-Fi hotspots that connect to the school's existing wired network. (Wi-Fi, short for "wireless fidelity," is the trade name for a family of wireless networking standards.) In so doing, they may have inadvertently compromised the school's network, and your district's IT staff may be none the wiser.

Rogue Hotspots
Charlie Garten, the former chief information officer for the Poway Unified School District in southern California, says his district's struggles with Wi-Fi security began as early as 2002. "We weren't surprised that there were ways to jump over our firewall using wireless," says Garten, who retired in 2005. "We were caught a little bit by surprise by the number of rogue access points that had been plugged in." In some cases, his staff would receive complaints about network slowdowns at a school; on investigating, they would find as many as 10 Wi-Fi hotspots that had been installed without the IT department's knowledge. "Well-meaning people wanted to get more access for the kids, but they didn't understand all the consequences of just throwing in a bunch of wireless access points," adds Garten.

In the Palo Alto (Calif.) Unified School District, the security holes introduced by rogue hotspots had a much more public and embarrassing effect. Located in the heart of tech-savvy Silicon Valley, Palo Alto's parent community includes many people who work for companies that supply Wi-Fi equipment. As a result, these parents brought wireless networking into their children's schools at a very early stage.

"We had open networks. When they were first installed, folks could sit in the parking lot if they wanted to get some access," says Marie Scigliano, the director of technology for the district. Scigliano's staff was aware of the security problem but hadn't been able to address it completely when, in the summer of 2003, a local reporter found that she could access the district office's network through an unsecured Wi-Fi connection. Worse, the reporter was able to log on to the student information system and download students' grades, phone numbers, home addresses, medical information, psychological evaluations and even full-color photos.

The district quickly took the network offline and began correcting the problem, according to Scigliano. "We came back up with secure networks, logons, authentication and so forth," she says. However, the story received wide national coverage-thanks in part to the severity of the breach-causing a significant public relations problem for the school.

While the reporter didn't publish or alter student records, press reports noted that it would have been easy for her to do so, if she had been a more malicious hacker. That in turn would have exposed the district to serious liability problems and could possibly have put its students in danger.

Steps for Safer Wi-Fi Wireless doesn't have to be a security nightmare. Here are some tips from Brian Hernacki, an architect with Symantec Research Labs, on how you can keep your Wi-Fi network safe and sound: Turn on encryption Set your network to use Wired Equivalent Privacy or even stronger Wi-Fi Protected Access encryption, which encodes every transmission on the network, making it harder for hackers to "sniff" the data as it goes by. Neither form of encryption will keep hackers out entirely, but they set the bar a lot higher. If you use WEP, make sure you use a 128-bit key, which requires a 26-character pass phrase. WPA is harder to crack and uses easier-to-remember passwords for access, so it's a better choice if your equipment supports it. Limit access Wi-Fi networks can be configured to accept connections only from certain computers, using those computers' Media Access Control addresses, a unique number that's attached to the network adapter in every piece of networked equipment. MAC addresses are difficult to spoof, so limiting access to certain MAC addresses helps you ensure that you control who's on your network.

On the down side, you need to maintain an up-to-date list of permitted machines. Require usernames and passwords Configure your network so that users can gain access only with the proper username and password. If you issue unique usernames to each student, teacher and administrator, you'll be able to track any misuse of the system. Because people may share passwords with each other, be sure to change these every month or every quarter. Keep the network inside By carefully locating Wi-Fi routers and using directional antennas (which focus the signal in a particular direction), you may be able to limit the accessibility of your network outside school grounds. This will make it harder for hackers to do their dirty work unobserved. Turn it off at night Turning off the Wi-Fi network after-hours means that hackers will need to make their intrusion attempts during the day, when they're more likely to be noticed by staff or students. Educate your staff Make sure teachers and administrators are aware of the security risks of using Wi-Fi. For the maximum security, permit access to student information systems (such as grades databases) via wired networks only, and ensure that computers connecting to these systems do not also have Wi-Fi capability.

Read more »

The Hidden Downside of Wireless Networking

Wi-Fi can cause big trouble--and you may not even know it. Here's how to keep the hackers at bay.

Going wireless offers a panoply of attractive benefits to school districts. Because you don't have to run cables to every classroom, it's cheaper to deploy a wireless network than an old-fashioned wired network. Wireless makes it more convenient for administrators, teachers and students to connect.

But there's a perilous downside: A wireless network is easier for hackers to break into. Without the proper security measures, going wireless means opening a gaping hole in your computer systems' defenses.

Worse, you may already have a wireless security problem-even if your technology staff hasn't deployed a single wireless access point. At many school districts, parents and teachers have installed unofficial Wi-Fi hotspots that connect to the school's existing wired network. (Wi-Fi, short for "wireless fidelity," is the trade name for a family of wireless networking standards.) In so doing, they may have inadvertently compromised the school's network, and your district's IT staff may be none the wiser.

Rogue Hotspots
Charlie Garten, the former chief information officer for the Poway Unified School District in southern California, says his district's struggles with Wi-Fi security began as early as 2002. "We weren't surprised that there were ways to jump over our firewall using wireless," says Garten, who retired in 2005. "We were caught a little bit by surprise by the number of rogue access points that had been plugged in." In some cases, his staff would receive complaints about network slowdowns at a school; on investigating, they would find as many as 10 Wi-Fi hotspots that had been installed without the IT department's knowledge. "Well-meaning people wanted to get more access for the kids, but they didn't understand all the consequences of just throwing in a bunch of wireless access points," adds Garten.

In the Palo Alto (Calif.) Unified School District, the security holes introduced by rogue hotspots had a much more public and embarrassing effect. Located in the heart of tech-savvy Silicon Valley, Palo Alto's parent community includes many people who work for companies that supply Wi-Fi equipment. As a result, these parents brought wireless networking into their children's schools at a very early stage.

"We had open networks. When they were first installed, folks could sit in the parking lot if they wanted to get some access," says Marie Scigliano, the director of technology for the district. Scigliano's staff was aware of the security problem but hadn't been able to address it completely when, in the summer of 2003, a local reporter found that she could access the district office's network through an unsecured Wi-Fi connection. Worse, the reporter was able to log on to the student information system and download students' grades, phone numbers, home addresses, medical information, psychological evaluations and even full-color photos.

The district quickly took the network offline and began correcting the problem, according to Scigliano. "We came back up with secure networks, logons, authentication and so forth," she says. However, the story received wide national coverage-thanks in part to the severity of the breach-causing a significant public relations problem for the school.

While the reporter didn't publish or alter student records, press reports noted that it would have been easy for her to do so, if she had been a more malicious hacker. That in turn would have exposed the district to serious liability problems and could possibly have put its students in danger.

Steps for Safer Wi-Fi Wireless doesn't have to be a security nightmare. Here are some tips from Brian Hernacki, an architect with Symantec Research Labs, on how you can keep your Wi-Fi network safe and sound: Turn on encryption Set your network to use Wired Equivalent Privacy or even stronger Wi-Fi Protected Access encryption, which encodes every transmission on the network, making it harder for hackers to "sniff" the data as it goes by. Neither form of encryption will keep hackers out entirely, but they set the bar a lot higher. If you use WEP, make sure you use a 128-bit key, which requires a 26-character pass phrase. WPA is harder to crack and uses easier-to-remember passwords for access, so it's a better choice if your equipment supports it. Limit access Wi-Fi networks can be configured to accept connections only from certain computers, using those computers' Media Access Control addresses, a unique number that's attached to the network adapter in every piece of networked equipment. MAC addresses are difficult to spoof, so limiting access to certain MAC addresses helps you ensure that you control who's on your network.

On the down side, you need to maintain an up-to-date list of permitted machines. Require usernames and passwords Configure your network so that users can gain access only with the proper username and password. If you issue unique usernames to each student, teacher and administrator, you'll be able to track any misuse of the system. Because people may share passwords with each other, be sure to change these every month or every quarter. Keep the network inside By carefully locating Wi-Fi routers and using directional antennas (which focus the signal in a particular direction), you may be able to limit the accessibility of your network outside school grounds. This will make it harder for hackers to do their dirty work unobserved. Turn it off at night Turning off the Wi-Fi network after-hours means that hackers will need to make their intrusion attempts during the day, when they're more likely to be noticed by staff or students. Educate your staff Make sure teachers and administrators are aware of the security risks of using Wi-Fi. For the maximum security, permit access to student information systems (such as grades databases) via wired networks only, and ensure that computers connecting to these systems do not also have Wi-Fi capability.

Read more »

The Hidden Downside of Wireless Networking

Wi-Fi can cause big trouble--and you may not even know it. Here's how to keep the hackers at bay.

Going wireless offers a panoply of attractive benefits to school districts. Because you don't have to run cables to every classroom, it's cheaper to deploy a wireless network than an old-fashioned wired network. Wireless makes it more convenient for administrators, teachers and students to connect.

But there's a perilous downside: A wireless network is easier for hackers to break into. Without the proper security measures, going wireless means opening a gaping hole in your computer systems' defenses.

Worse, you may already have a wireless security problem-even if your technology staff hasn't deployed a single wireless access point. At many school districts, parents and teachers have installed unofficial Wi-Fi hotspots that connect to the school's existing wired network. (Wi-Fi, short for "wireless fidelity," is the trade name for a family of wireless networking standards.) In so doing, they may have inadvertently compromised the school's network, and your district's IT staff may be none the wiser.

Rogue Hotspots
Charlie Garten, the former chief information officer for the Poway Unified School District in southern California, says his district's struggles with Wi-Fi security began as early as 2002. "We weren't surprised that there were ways to jump over our firewall using wireless," says Garten, who retired in 2005. "We were caught a little bit by surprise by the number of rogue access points that had been plugged in." In some cases, his staff would receive complaints about network slowdowns at a school; on investigating, they would find as many as 10 Wi-Fi hotspots that had been installed without the IT department's knowledge. "Well-meaning people wanted to get more access for the kids, but they didn't understand all the consequences of just throwing in a bunch of wireless access points," adds Garten.

In the Palo Alto (Calif.) Unified School District, the security holes introduced by rogue hotspots had a much more public and embarrassing effect. Located in the heart of tech-savvy Silicon Valley, Palo Alto's parent community includes many people who work for companies that supply Wi-Fi equipment. As a result, these parents brought wireless networking into their children's schools at a very early stage.

"We had open networks. When they were first installed, folks could sit in the parking lot if they wanted to get some access," says Marie Scigliano, the director of technology for the district. Scigliano's staff was aware of the security problem but hadn't been able to address it completely when, in the summer of 2003, a local reporter found that she could access the district office's network through an unsecured Wi-Fi connection. Worse, the reporter was able to log on to the student information system and download students' grades, phone numbers, home addresses, medical information, psychological evaluations and even full-color photos.

The district quickly took the network offline and began correcting the problem, according to Scigliano. "We came back up with secure networks, logons, authentication and so forth," she says. However, the story received wide national coverage-thanks in part to the severity of the breach-causing a significant public relations problem for the school.

While the reporter didn't publish or alter student records, press reports noted that it would have been easy for her to do so, if she had been a more malicious hacker. That in turn would have exposed the district to serious liability problems and could possibly have put its students in danger.

Steps for Safer Wi-Fi Wireless doesn't have to be a security nightmare. Here are some tips from Brian Hernacki, an architect with Symantec Research Labs, on how you can keep your Wi-Fi network safe and sound: Turn on encryption Set your network to use Wired Equivalent Privacy or even stronger Wi-Fi Protected Access encryption, which encodes every transmission on the network, making it harder for hackers to "sniff" the data as it goes by. Neither form of encryption will keep hackers out entirely, but they set the bar a lot higher. If you use WEP, make sure you use a 128-bit key, which requires a 26-character pass phrase. WPA is harder to crack and uses easier-to-remember passwords for access, so it's a better choice if your equipment supports it. Limit access Wi-Fi networks can be configured to accept connections only from certain computers, using those computers' Media Access Control addresses, a unique number that's attached to the network adapter in every piece of networked equipment. MAC addresses are difficult to spoof, so limiting access to certain MAC addresses helps you ensure that you control who's on your network.

On the down side, you need to maintain an up-to-date list of permitted machines. Require usernames and passwords Configure your network so that users can gain access only with the proper username and password. If you issue unique usernames to each student, teacher and administrator, you'll be able to track any misuse of the system. Because people may share passwords with each other, be sure to change these every month or every quarter. Keep the network inside By carefully locating Wi-Fi routers and using directional antennas (which focus the signal in a particular direction), you may be able to limit the accessibility of your network outside school grounds. This will make it harder for hackers to do their dirty work unobserved. Turn it off at night Turning off the Wi-Fi network after-hours means that hackers will need to make their intrusion attempts during the day, when they're more likely to be noticed by staff or students. Educate your staff Make sure teachers and administrators are aware of the security risks of using Wi-Fi. For the maximum security, permit access to student information systems (such as grades databases) via wired networks only, and ensure that computers connecting to these systems do not also have Wi-Fi capability.

Read more »

Benchmarking the MacBook Pro

Like us, you may be considering the purchase of an Apple MacBook Pro as a way to bring deadline-friendly processing speed to a Mac-based field workflow. For several years, certain models of Apple's Powerbook line have represented a superb blend of features, screen quality and portability; in fact, the overall design of the company's mobile machines has far eclipsed computers we've used from mainstream PC vendors in all key areas, except one: speed. A PowerPC G4-equipped Mac laptop simply can't keep up to a Windows laptop powered by an Intel or AMD processor.

For intensive tasks such as RAW conversion, applying beefy filters like Smart Sharpen in Photoshop CS2 and previewing folders overflowing with 8+ megapixel photos, a Powerbook doesn't keep pace. For example, processing a 16-bit EOS-1Ds Mark II file with Noise Ninja takes about 44 seconds on a Powerbook with a 1.67GHz G4 processor. The same operation on the same file zips by in under 15 seconds on a Toshiba A70/A75 armed with a 3.33GHz Pentium 4. It's this sort of real-world performance difference that has resulted in site co-editor Mike Sturk relying almost entirely upon a Pentium 4-equipped Dell laptop for on-site work, despite the fact he is at heart a Mac guy.

As we noted in an article introducing the MacBook Pro last month, we hope that the switch to Intel processors by Apple will close the speed gap between Mac laptops and laptops from everyone else. But it's really too soon to address whether an Intel-equipped Mac will perform comparably to an Intel (or AMD)-equipped PC, since so few Mac pro imaging applications have yet been turned into versions optimized for the Intel architecture of the latest Macs. For months to come, the majority of Mac applications we rely on to get photo work done will be PowerPC versions, and will operate on an Intel Mac only through the assistance of the Rosetta emulation technology built into the Mac OS.

MacBook Pro 

It's also really too soon to benchmark a MacBook Pro specifically, since they aren't yet shipping and we don't have one. What we do have on hand is a close cousin to the MacBook Pro: an early 2006 iMac with a 2GHz Intel Core Duo processor. As fans of Stephen Colbert's Colbert Report, we applied his standard of truthiness in coming up with the headline for this article. We really wanted to benchmark a MacBook Pro, but couldn't, so we got hold of an iMac instead and having been calling it a MacBook Pro.

There's a method to our madness: prior to Apple's new laptop hitting the streets, we wanted to get a sense of whether - when running Universal Binary versions of an application - the MacBook Pro is going to deliver anything close to the promised 4.5x+ speed increase (using benchmarking software) relative to a Powerbook G4. And whether PowerPC applications pumped through the seamless but speed-robbing Rosetta will perform at least as well as they would on a Powerbook G4. The Intel Core Duo version of the iMac makes for good stand-in, since it contains similar components, including the all-important Intel Core Duo processor and X1600-series graphics card from ATI. So, without further ado, here's what we tested, and the results:

The Hardware

• 15-inch Powerbook G4/1.67GHz with 2GB RAM, ATI Mobility Radeon 9700 graphics with 64MB memory, 1280x854 pixel display, 80GB/5400 RPM hard drive and OS X 10.4.4. This a mid-2005 model.
  
• 20-inch iMac with Intel Core Duo 2GHz, 2GB RAM, ATI Radeon X1600 graphics with 128MB memory, 1680x1050 pixel display, 250GB/7200 RPM hard drive and OS X 10.4.4. This is an early 2006 model.

As of this writing, the MacBook Pro's Intel Core Duo processor tops out at 1.83GHz, so our 2GHz iMac will almost certainly be a few percentage points faster than a MacBook Pro in tests that exercise the CPU. The hard drive in the MacBook Pro, however, is not at all the same as that found in the iMac. To neutralize that as a performance variable, we used an external 100GB/5400 RPM laptop drive in a FireWire 400 enclosure as the file source or destination, as well as constructed the tests so that there was a minimum of big-file reading and writing. All of that said, we spot-checked several of the tests using the iMac's internal drive as the file destination and saw almost no difference in the results.

Observations


In Universal Binary applications, functions that are written for multiple processors show the biggest speed gains. For example, Photo Mechanic's Preview mode utilizes both cores in the Intel Core Duo, which leads to a speed increase approaching 3X, relative to the Powerbook G4 tested. Previewing high-resolution pictures in Photo Mechanic 4.4.1 on the Intel iMac is really zippy. In fact, it feels faster than the 3X bump suggests. Exporting a newly-created JPEG from Photo Mechanic utilizes only one of the Intel processor's cores, and yet we still measured about a 2X speed increase over the G4. It looks like each half of the Core Duo is considerably more powerful than a G4, at least for the sorts of functions that are at the heart of what a program like Photo Mechanic does. We didn't encounter - in Photo Mechanic or elsewhere - a 4.5x speed increase, but then it wasn't all that likely that real world measurements would match Apple's synthetic SPEC benchmarks. Encouragingly, however, the Photo Mechanic results do fall within the 1.7x to 4.1x speed bump range Apple touts in their own application performance testing.

If Apple wants to show the Intel Core Duo processor in its best light right now, and the audience is pro shooters, they might want to load a few copies of Photo Mechanic on their demo MacBook Pros. The Intel-native iPhoto 6 feels faster on the iMac than on the Powerbook G4 in basic tasks like scrolling, switching views and navigating around the program's interface. But as the test results show, the performance jump in most instances is significant but not outstanding. The experience of using Photo Mechanic, by comparison, is really transformed by the Intel Core Duo. The more modest iPhoto gains overall may be explained in part by the fact that some of the tests performed are more dependent on the graphics card than on the CPU to get the processing job done.

In PowerPC applications, functions that thread through both cores in the iMac's Intel Core Duo processor are completed about as fast, or in some cases faster, than by the Powerbook G4. That's an impressive feat, given how much translation Rosetta must have to do to make PowerPC code palatable to an Intel processor. For an Intel-based Mac to fly, it must be running Intel native code. But until then, Rosetta emulation on average allows the performance of a single PowerPC G4 processor. And for certain tasks, such as reducing noise with the multi-processor savvy Noise Ninja, Intel Core Duo processing times are quite a bit shorter than those of the G4.

As we've seen in iMac benchmarking elsewhere, something's up with QuickTime export on Intel Core Duo Macs. Over 15 minutes to export the test slideshow as an MPEG-4, 30 fps movie on the Powerbook is already pretty pokey, but over 25 minutes on the Intel iMac for the same export suggests a performance-hobbling bug is lurking in the QuickTime code. We sure hope so, anyway.

Why is Lego Star Wars among the applications tested? A certain 6-year-old employee of Little Guy Media here assesses the usefulness of a computer by whether it will play this game. Fortunately, he rated the performance of the PowerPC application acceptable on the Intel Core Duo iMac, as long as Shadow Mapping is disabled in the game's preferences. Apparently it's okay to not have Qui-Gon Jinn cast a shadow as he light sabres his way through a swarm of battle droids.
Lego Star Wars is one of many PowerPC applications that just works through the magic of Rosetta, though with a performance hit. In addition to the applications listed, we've also installed and been using Startly QuicKeys 3.1, Adobe GoLive CS2, GretagMacbeth Eye-One Match 3.4, Netopia Timbuktu Pro 8.5, applications in Microsoft Office 2004, Roxio Toast 7.0.2 and StuffIt 10. So far, the list of Rosetta-related hiccups has been short:

• Nikon Capture 4.0 - through 4.4.1 wouldn't install on the iMac. The problem was in the installer, not in the application itself. When we dragged the components that make up Capture 4.4.1 from the various locations on another Mac to those same locations on the iMac, the program itself worked fine.
  
• Eye-One Match 3.4. The program slows to nearly a halt at several points in the monitor calibration module (not just when advancing past the monitor-type selection screen, as it can on any computer), but in each case the software rights itself and continues on.

We haven't had occasion to tether a camera to the iMac yet, so we don't know if that will present some troubleshooting fun.


Does the Intel Core Duo processor best a Quad G5? Not even close. We performed several of the Photo Mechanic and iPhoto tests on a Power Mac Quad G5/2.5GHz, and the G5-based computer performed a lot faster. For example, previewing 100 EOS-1D Mark II photos in Photo Mechanic is accomplished in about 18 seconds on the Quad G5, compared to 42 seconds for the Intel Core Duo iMac. Importing 20 EOS 5D CR2's into iPhoto takes 40 seconds on the G5, compared to 76 seconds on the Intel.

And this is when the applications are running natively on each processor type. Running PowerPC-coded Photoshop CS2 on both machines widens the gap that much more because, as we've noted, of the required on-the-fly Rosetta translation. For example, applying Smart Sharpen to a 16-bit EOS-1Ds Mark II file takes 33 seconds on the Intel, but only 7.5 seconds on the Quad G5. Noise Ninja filtering of the same file clocks in at 30 seconds on the Intel, and 7.1 seconds on the Quad G5.

The introduction of the Intel Core Duo processor into the Apple lineup means a lot more available horsepower for portable Macs and, to a lesser extent, consumer-geared machines like the iMac (which were already running G5 processors before Apple's Intel revolution began). But this particular Intel processor is not going to unseat four G5 cores running at 2.5GHz for those who need maximum photo processing power on the Mac platform. Especially - but not only - when the application isn't Intel-optimized.


The 20-inch iMac with an Intel Core Duo processor seems to be a fine machine for the digital SLR photographerneeding to carefully balance cost with performance, and who can live with G4-like speed in applications that haven't yet been given the Universal Binary treatment. The screen calibrates well and appears to be on par with our Apple 20 inch Cinema Display in quality, the computer has a sprightly feel when running Intel-native applications, it's almost completely silent in operation, has a good complement of USB 2.0 (3) and FireWire 400 (2) ports, plus built-in Airport Extreme Wi-Fi, Bluetooth and even Gigabit Ethernet. The video out port is DVI, supports mirrored and extended desktop modes and drives the aforementioned Cinema Display for a totally usable two-display setup. The built-in iSight video camera and tiny infrared remote for the somewhat-limited but still useful Front Row software round out an impressive package.

We got this machine on loan as a MacBook Pro simulator of sorts. In using it, however, we've come to see that Apple has stuffed a lot of pro photography goodness into the new Intel Core Duo iMac for shooters considering a desktop Mac purchase but without the budget for a Power Mac.


Conclusion
You can draw your own conclusions from the benchmarks here as to whether a MacBook Pro is likely to deliver enough of a performance improvement over a Powerbook G4 to make a machine switch pay off in the short term. Our take is that with an Intel-optimized application like Photo Mechanic, the MacBook Pro is going to be a fast portable computer, but when running PowerPC pro imaging applications - which will be a necessity for months to come - its processing speed isn't going to be all that different than a Powerbook G4 overall. Until there are a few more key Universal Binary applications, and/or it's demonstrated that an Intel Mac can run a modern flavour of Windows, we're inclined to stay on the MacBook Pro sidelines, using our existing Windows laptops for speed and Powerbook G4's for everything else.

Benchmarking the MacBook Pro

Like us, you may be considering the purchase of an Apple MacBook Pro as a way to bring deadline-friendly processing speed to a Mac-based field workflow. For several years, certain models of Apple's Powerbook line have represented a superb blend of features, screen quality and portability; in fact, the overall design of the company's mobile machines has far eclipsed computers we've used from mainstream PC vendors in all key areas, except one: speed. A PowerPC G4-equipped Mac laptop simply can't keep up to a Windows laptop powered by an Intel or AMD processor.

For intensive tasks such as RAW conversion, applying beefy filters like Smart Sharpen in Photoshop CS2 and previewing folders overflowing with 8+ megapixel photos, a Powerbook doesn't keep pace. For example, processing a 16-bit EOS-1Ds Mark II file with Noise Ninja takes about 44 seconds on a Powerbook with a 1.67GHz G4 processor. The same operation on the same file zips by in under 15 seconds on a Toshiba A70/A75 armed with a 3.33GHz Pentium 4. It's this sort of real-world performance difference that has resulted in site co-editor Mike Sturk relying almost entirely upon a Pentium 4-equipped Dell laptop for on-site work, despite the fact he is at heart a Mac guy.

As we noted in an article introducing the MacBook Pro last month, we hope that the switch to Intel processors by Apple will close the speed gap between Mac laptops and laptops from everyone else. But it's really too soon to address whether an Intel-equipped Mac will perform comparably to an Intel (or AMD)-equipped PC, since so few Mac pro imaging applications have yet been turned into versions optimized for the Intel architecture of the latest Macs. For months to come, the majority of Mac applications we rely on to get photo work done will be PowerPC versions, and will operate on an Intel Mac only through the assistance of the Rosetta emulation technology built into the Mac OS.

MacBook Pro 

It's also really too soon to benchmark a MacBook Pro specifically, since they aren't yet shipping and we don't have one. What we do have on hand is a close cousin to the MacBook Pro: an early 2006 iMac with a 2GHz Intel Core Duo processor. As fans of Stephen Colbert's Colbert Report, we applied his standard of truthiness in coming up with the headline for this article. We really wanted to benchmark a MacBook Pro, but couldn't, so we got hold of an iMac instead and having been calling it a MacBook Pro.

There's a method to our madness: prior to Apple's new laptop hitting the streets, we wanted to get a sense of whether - when running Universal Binary versions of an application - the MacBook Pro is going to deliver anything close to the promised 4.5x+ speed increase (using benchmarking software) relative to a Powerbook G4. And whether PowerPC applications pumped through the seamless but speed-robbing Rosetta will perform at least as well as they would on a Powerbook G4. The Intel Core Duo version of the iMac makes for good stand-in, since it contains similar components, including the all-important Intel Core Duo processor and X1600-series graphics card from ATI. So, without further ado, here's what we tested, and the results:

The Hardware

• 15-inch Powerbook G4/1.67GHz with 2GB RAM, ATI Mobility Radeon 9700 graphics with 64MB memory, 1280x854 pixel display, 80GB/5400 RPM hard drive and OS X 10.4.4. This a mid-2005 model.
  
• 20-inch iMac with Intel Core Duo 2GHz, 2GB RAM, ATI Radeon X1600 graphics with 128MB memory, 1680x1050 pixel display, 250GB/7200 RPM hard drive and OS X 10.4.4. This is an early 2006 model.

As of this writing, the MacBook Pro's Intel Core Duo processor tops out at 1.83GHz, so our 2GHz iMac will almost certainly be a few percentage points faster than a MacBook Pro in tests that exercise the CPU. The hard drive in the MacBook Pro, however, is not at all the same as that found in the iMac. To neutralize that as a performance variable, we used an external 100GB/5400 RPM laptop drive in a FireWire 400 enclosure as the file source or destination, as well as constructed the tests so that there was a minimum of big-file reading and writing. All of that said, we spot-checked several of the tests using the iMac's internal drive as the file destination and saw almost no difference in the results.

Observations


In Universal Binary applications, functions that are written for multiple processors show the biggest speed gains. For example, Photo Mechanic's Preview mode utilizes both cores in the Intel Core Duo, which leads to a speed increase approaching 3X, relative to the Powerbook G4 tested. Previewing high-resolution pictures in Photo Mechanic 4.4.1 on the Intel iMac is really zippy. In fact, it feels faster than the 3X bump suggests. Exporting a newly-created JPEG from Photo Mechanic utilizes only one of the Intel processor's cores, and yet we still measured about a 2X speed increase over the G4. It looks like each half of the Core Duo is considerably more powerful than a G4, at least for the sorts of functions that are at the heart of what a program like Photo Mechanic does. We didn't encounter - in Photo Mechanic or elsewhere - a 4.5x speed increase, but then it wasn't all that likely that real world measurements would match Apple's synthetic SPEC benchmarks. Encouragingly, however, the Photo Mechanic results do fall within the 1.7x to 4.1x speed bump range Apple touts in their own application performance testing.

If Apple wants to show the Intel Core Duo processor in its best light right now, and the audience is pro shooters, they might want to load a few copies of Photo Mechanic on their demo MacBook Pros. The Intel-native iPhoto 6 feels faster on the iMac than on the Powerbook G4 in basic tasks like scrolling, switching views and navigating around the program's interface. But as the test results show, the performance jump in most instances is significant but not outstanding. The experience of using Photo Mechanic, by comparison, is really transformed by the Intel Core Duo. The more modest iPhoto gains overall may be explained in part by the fact that some of the tests performed are more dependent on the graphics card than on the CPU to get the processing job done.

In PowerPC applications, functions that thread through both cores in the iMac's Intel Core Duo processor are completed about as fast, or in some cases faster, than by the Powerbook G4. That's an impressive feat, given how much translation Rosetta must have to do to make PowerPC code palatable to an Intel processor. For an Intel-based Mac to fly, it must be running Intel native code. But until then, Rosetta emulation on average allows the performance of a single PowerPC G4 processor. And for certain tasks, such as reducing noise with the multi-processor savvy Noise Ninja, Intel Core Duo processing times are quite a bit shorter than those of the G4.

As we've seen in iMac benchmarking elsewhere, something's up with QuickTime export on Intel Core Duo Macs. Over 15 minutes to export the test slideshow as an MPEG-4, 30 fps movie on the Powerbook is already pretty pokey, but over 25 minutes on the Intel iMac for the same export suggests a performance-hobbling bug is lurking in the QuickTime code. We sure hope so, anyway.

Why is Lego Star Wars among the applications tested? A certain 6-year-old employee of Little Guy Media here assesses the usefulness of a computer by whether it will play this game. Fortunately, he rated the performance of the PowerPC application acceptable on the Intel Core Duo iMac, as long as Shadow Mapping is disabled in the game's preferences. Apparently it's okay to not have Qui-Gon Jinn cast a shadow as he light sabres his way through a swarm of battle droids.
Lego Star Wars is one of many PowerPC applications that just works through the magic of Rosetta, though with a performance hit. In addition to the applications listed, we've also installed and been using Startly QuicKeys 3.1, Adobe GoLive CS2, GretagMacbeth Eye-One Match 3.4, Netopia Timbuktu Pro 8.5, applications in Microsoft Office 2004, Roxio Toast 7.0.2 and StuffIt 10. So far, the list of Rosetta-related hiccups has been short:

• Nikon Capture 4.0 - through 4.4.1 wouldn't install on the iMac. The problem was in the installer, not in the application itself. When we dragged the components that make up Capture 4.4.1 from the various locations on another Mac to those same locations on the iMac, the program itself worked fine.
  
• Eye-One Match 3.4. The program slows to nearly a halt at several points in the monitor calibration module (not just when advancing past the monitor-type selection screen, as it can on any computer), but in each case the software rights itself and continues on.

We haven't had occasion to tether a camera to the iMac yet, so we don't know if that will present some troubleshooting fun.


Does the Intel Core Duo processor best a Quad G5? Not even close. We performed several of the Photo Mechanic and iPhoto tests on a Power Mac Quad G5/2.5GHz, and the G5-based computer performed a lot faster. For example, previewing 100 EOS-1D Mark II photos in Photo Mechanic is accomplished in about 18 seconds on the Quad G5, compared to 42 seconds for the Intel Core Duo iMac. Importing 20 EOS 5D CR2's into iPhoto takes 40 seconds on the G5, compared to 76 seconds on the Intel.

And this is when the applications are running natively on each processor type. Running PowerPC-coded Photoshop CS2 on both machines widens the gap that much more because, as we've noted, of the required on-the-fly Rosetta translation. For example, applying Smart Sharpen to a 16-bit EOS-1Ds Mark II file takes 33 seconds on the Intel, but only 7.5 seconds on the Quad G5. Noise Ninja filtering of the same file clocks in at 30 seconds on the Intel, and 7.1 seconds on the Quad G5.

The introduction of the Intel Core Duo processor into the Apple lineup means a lot more available horsepower for portable Macs and, to a lesser extent, consumer-geared machines like the iMac (which were already running G5 processors before Apple's Intel revolution began). But this particular Intel processor is not going to unseat four G5 cores running at 2.5GHz for those who need maximum photo processing power on the Mac platform. Especially - but not only - when the application isn't Intel-optimized.


The 20-inch iMac with an Intel Core Duo processor seems to be a fine machine for the digital SLR photographerneeding to carefully balance cost with performance, and who can live with G4-like speed in applications that haven't yet been given the Universal Binary treatment. The screen calibrates well and appears to be on par with our Apple 20 inch Cinema Display in quality, the computer has a sprightly feel when running Intel-native applications, it's almost completely silent in operation, has a good complement of USB 2.0 (3) and FireWire 400 (2) ports, plus built-in Airport Extreme Wi-Fi, Bluetooth and even Gigabit Ethernet. The video out port is DVI, supports mirrored and extended desktop modes and drives the aforementioned Cinema Display for a totally usable two-display setup. The built-in iSight video camera and tiny infrared remote for the somewhat-limited but still useful Front Row software round out an impressive package.

We got this machine on loan as a MacBook Pro simulator of sorts. In using it, however, we've come to see that Apple has stuffed a lot of pro photography goodness into the new Intel Core Duo iMac for shooters considering a desktop Mac purchase but without the budget for a Power Mac.


Conclusion
You can draw your own conclusions from the benchmarks here as to whether a MacBook Pro is likely to deliver enough of a performance improvement over a Powerbook G4 to make a machine switch pay off in the short term. Our take is that with an Intel-optimized application like Photo Mechanic, the MacBook Pro is going to be a fast portable computer, but when running PowerPC pro imaging applications - which will be a necessity for months to come - its processing speed isn't going to be all that different than a Powerbook G4 overall. Until there are a few more key Universal Binary applications, and/or it's demonstrated that an Intel Mac can run a modern flavour of Windows, we're inclined to stay on the MacBook Pro sidelines, using our existing Windows laptops for speed and Powerbook G4's for everything else.

Benchmarking the MacBook Pro

Like us, you may be considering the purchase of an Apple MacBook Pro as a way to bring deadline-friendly processing speed to a Mac-based field workflow. For several years, certain models of Apple's Powerbook line have represented a superb blend of features, screen quality and portability; in fact, the overall design of the company's mobile machines has far eclipsed computers we've used from mainstream PC vendors in all key areas, except one: speed. A PowerPC G4-equipped Mac laptop simply can't keep up to a Windows laptop powered by an Intel or AMD processor.

For intensive tasks such as RAW conversion, applying beefy filters like Smart Sharpen in Photoshop CS2 and previewing folders overflowing with 8+ megapixel photos, a Powerbook doesn't keep pace. For example, processing a 16-bit EOS-1Ds Mark II file with Noise Ninja takes about 44 seconds on a Powerbook with a 1.67GHz G4 processor. The same operation on the same file zips by in under 15 seconds on a Toshiba A70/A75 armed with a 3.33GHz Pentium 4. It's this sort of real-world performance difference that has resulted in site co-editor Mike Sturk relying almost entirely upon a Pentium 4-equipped Dell laptop for on-site work, despite the fact he is at heart a Mac guy.

As we noted in an article introducing the MacBook Pro last month, we hope that the switch to Intel processors by Apple will close the speed gap between Mac laptops and laptops from everyone else. But it's really too soon to address whether an Intel-equipped Mac will perform comparably to an Intel (or AMD)-equipped PC, since so few Mac pro imaging applications have yet been turned into versions optimized for the Intel architecture of the latest Macs. For months to come, the majority of Mac applications we rely on to get photo work done will be PowerPC versions, and will operate on an Intel Mac only through the assistance of the Rosetta emulation technology built into the Mac OS.

MacBook Pro 

It's also really too soon to benchmark a MacBook Pro specifically, since they aren't yet shipping and we don't have one. What we do have on hand is a close cousin to the MacBook Pro: an early 2006 iMac with a 2GHz Intel Core Duo processor. As fans of Stephen Colbert's Colbert Report, we applied his standard of truthiness in coming up with the headline for this article. We really wanted to benchmark a MacBook Pro, but couldn't, so we got hold of an iMac instead and having been calling it a MacBook Pro.

There's a method to our madness: prior to Apple's new laptop hitting the streets, we wanted to get a sense of whether - when running Universal Binary versions of an application - the MacBook Pro is going to deliver anything close to the promised 4.5x+ speed increase (using benchmarking software) relative to a Powerbook G4. And whether PowerPC applications pumped through the seamless but speed-robbing Rosetta will perform at least as well as they would on a Powerbook G4. The Intel Core Duo version of the iMac makes for good stand-in, since it contains similar components, including the all-important Intel Core Duo processor and X1600-series graphics card from ATI. So, without further ado, here's what we tested, and the results:

The Hardware

• 15-inch Powerbook G4/1.67GHz with 2GB RAM, ATI Mobility Radeon 9700 graphics with 64MB memory, 1280x854 pixel display, 80GB/5400 RPM hard drive and OS X 10.4.4. This a mid-2005 model.
  
• 20-inch iMac with Intel Core Duo 2GHz, 2GB RAM, ATI Radeon X1600 graphics with 128MB memory, 1680x1050 pixel display, 250GB/7200 RPM hard drive and OS X 10.4.4. This is an early 2006 model.

As of this writing, the MacBook Pro's Intel Core Duo processor tops out at 1.83GHz, so our 2GHz iMac will almost certainly be a few percentage points faster than a MacBook Pro in tests that exercise the CPU. The hard drive in the MacBook Pro, however, is not at all the same as that found in the iMac. To neutralize that as a performance variable, we used an external 100GB/5400 RPM laptop drive in a FireWire 400 enclosure as the file source or destination, as well as constructed the tests so that there was a minimum of big-file reading and writing. All of that said, we spot-checked several of the tests using the iMac's internal drive as the file destination and saw almost no difference in the results.

Observations


In Universal Binary applications, functions that are written for multiple processors show the biggest speed gains. For example, Photo Mechanic's Preview mode utilizes both cores in the Intel Core Duo, which leads to a speed increase approaching 3X, relative to the Powerbook G4 tested. Previewing high-resolution pictures in Photo Mechanic 4.4.1 on the Intel iMac is really zippy. In fact, it feels faster than the 3X bump suggests. Exporting a newly-created JPEG from Photo Mechanic utilizes only one of the Intel processor's cores, and yet we still measured about a 2X speed increase over the G4. It looks like each half of the Core Duo is considerably more powerful than a G4, at least for the sorts of functions that are at the heart of what a program like Photo Mechanic does. We didn't encounter - in Photo Mechanic or elsewhere - a 4.5x speed increase, but then it wasn't all that likely that real world measurements would match Apple's synthetic SPEC benchmarks. Encouragingly, however, the Photo Mechanic results do fall within the 1.7x to 4.1x speed bump range Apple touts in their own application performance testing.

If Apple wants to show the Intel Core Duo processor in its best light right now, and the audience is pro shooters, they might want to load a few copies of Photo Mechanic on their demo MacBook Pros. The Intel-native iPhoto 6 feels faster on the iMac than on the Powerbook G4 in basic tasks like scrolling, switching views and navigating around the program's interface. But as the test results show, the performance jump in most instances is significant but not outstanding. The experience of using Photo Mechanic, by comparison, is really transformed by the Intel Core Duo. The more modest iPhoto gains overall may be explained in part by the fact that some of the tests performed are more dependent on the graphics card than on the CPU to get the processing job done.

In PowerPC applications, functions that thread through both cores in the iMac's Intel Core Duo processor are completed about as fast, or in some cases faster, than by the Powerbook G4. That's an impressive feat, given how much translation Rosetta must have to do to make PowerPC code palatable to an Intel processor. For an Intel-based Mac to fly, it must be running Intel native code. But until then, Rosetta emulation on average allows the performance of a single PowerPC G4 processor. And for certain tasks, such as reducing noise with the multi-processor savvy Noise Ninja, Intel Core Duo processing times are quite a bit shorter than those of the G4.

As we've seen in iMac benchmarking elsewhere, something's up with QuickTime export on Intel Core Duo Macs. Over 15 minutes to export the test slideshow as an MPEG-4, 30 fps movie on the Powerbook is already pretty pokey, but over 25 minutes on the Intel iMac for the same export suggests a performance-hobbling bug is lurking in the QuickTime code. We sure hope so, anyway.

Why is Lego Star Wars among the applications tested? A certain 6-year-old employee of Little Guy Media here assesses the usefulness of a computer by whether it will play this game. Fortunately, he rated the performance of the PowerPC application acceptable on the Intel Core Duo iMac, as long as Shadow Mapping is disabled in the game's preferences. Apparently it's okay to not have Qui-Gon Jinn cast a shadow as he light sabres his way through a swarm of battle droids.
Lego Star Wars is one of many PowerPC applications that just works through the magic of Rosetta, though with a performance hit. In addition to the applications listed, we've also installed and been using Startly QuicKeys 3.1, Adobe GoLive CS2, GretagMacbeth Eye-One Match 3.4, Netopia Timbuktu Pro 8.5, applications in Microsoft Office 2004, Roxio Toast 7.0.2 and StuffIt 10. So far, the list of Rosetta-related hiccups has been short:

• Nikon Capture 4.0 - through 4.4.1 wouldn't install on the iMac. The problem was in the installer, not in the application itself. When we dragged the components that make up Capture 4.4.1 from the various locations on another Mac to those same locations on the iMac, the program itself worked fine.
  
• Eye-One Match 3.4. The program slows to nearly a halt at several points in the monitor calibration module (not just when advancing past the monitor-type selection screen, as it can on any computer), but in each case the software rights itself and continues on.

We haven't had occasion to tether a camera to the iMac yet, so we don't know if that will present some troubleshooting fun.


Does the Intel Core Duo processor best a Quad G5? Not even close. We performed several of the Photo Mechanic and iPhoto tests on a Power Mac Quad G5/2.5GHz, and the G5-based computer performed a lot faster. For example, previewing 100 EOS-1D Mark II photos in Photo Mechanic is accomplished in about 18 seconds on the Quad G5, compared to 42 seconds for the Intel Core Duo iMac. Importing 20 EOS 5D CR2's into iPhoto takes 40 seconds on the G5, compared to 76 seconds on the Intel.

And this is when the applications are running natively on each processor type. Running PowerPC-coded Photoshop CS2 on both machines widens the gap that much more because, as we've noted, of the required on-the-fly Rosetta translation. For example, applying Smart Sharpen to a 16-bit EOS-1Ds Mark II file takes 33 seconds on the Intel, but only 7.5 seconds on the Quad G5. Noise Ninja filtering of the same file clocks in at 30 seconds on the Intel, and 7.1 seconds on the Quad G5.

The introduction of the Intel Core Duo processor into the Apple lineup means a lot more available horsepower for portable Macs and, to a lesser extent, consumer-geared machines like the iMac (which were already running G5 processors before Apple's Intel revolution began). But this particular Intel processor is not going to unseat four G5 cores running at 2.5GHz for those who need maximum photo processing power on the Mac platform. Especially - but not only - when the application isn't Intel-optimized.


The 20-inch iMac with an Intel Core Duo processor seems to be a fine machine for the digital SLR photographerneeding to carefully balance cost with performance, and who can live with G4-like speed in applications that haven't yet been given the Universal Binary treatment. The screen calibrates well and appears to be on par with our Apple 20 inch Cinema Display in quality, the computer has a sprightly feel when running Intel-native applications, it's almost completely silent in operation, has a good complement of USB 2.0 (3) and FireWire 400 (2) ports, plus built-in Airport Extreme Wi-Fi, Bluetooth and even Gigabit Ethernet. The video out port is DVI, supports mirrored and extended desktop modes and drives the aforementioned Cinema Display for a totally usable two-display setup. The built-in iSight video camera and tiny infrared remote for the somewhat-limited but still useful Front Row software round out an impressive package.

We got this machine on loan as a MacBook Pro simulator of sorts. In using it, however, we've come to see that Apple has stuffed a lot of pro photography goodness into the new Intel Core Duo iMac for shooters considering a desktop Mac purchase but without the budget for a Power Mac.


Conclusion
You can draw your own conclusions from the benchmarks here as to whether a MacBook Pro is likely to deliver enough of a performance improvement over a Powerbook G4 to make a machine switch pay off in the short term. Our take is that with an Intel-optimized application like Photo Mechanic, the MacBook Pro is going to be a fast portable computer, but when running PowerPC pro imaging applications - which will be a necessity for months to come - its processing speed isn't going to be all that different than a Powerbook G4 overall. Until there are a few more key Universal Binary applications, and/or it's demonstrated that an Intel Mac can run a modern flavour of Windows, we're inclined to stay on the MacBook Pro sidelines, using our existing Windows laptops for speed and Powerbook G4's for everything else.

Definition of System Vulnerabilities

Vulnerability is flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

Notice that the vulnerability can be a flaw or weakness in any aspect of the system. Vulnerabilities are not merely flaws in the technical protections provided by the system. Significant vulnerabilities are often contained in the standard operating procedures that systems administrators perform, the process that the help desk uses to reset passwords or inadequate log review. Another area where vulnerabilities may be identified is at the policy level. For instance, a lack of a clearly defined security testing policy may be directly responsible for the lack of vulnerability scanning.

Here are a few examples of vulnerabilities related to contingency planning/ disaster recovery:

• Inadequate information system recovery procedures, for all processing areas (including networks)
• Not having alternate processing or storage sites
• Not having alternate communication services
• Not having clearly defined contingency directives and procedures
• Lack of a clearly defined, tested contingency plan • The absence of adequate formal contingency training • Lack of information (data and operating system) backups

Definition of System Vulnerabilities

Vulnerability is flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

Notice that the vulnerability can be a flaw or weakness in any aspect of the system. Vulnerabilities are not merely flaws in the technical protections provided by the system. Significant vulnerabilities are often contained in the standard operating procedures that systems administrators perform, the process that the help desk uses to reset passwords or inadequate log review. Another area where vulnerabilities may be identified is at the policy level. For instance, a lack of a clearly defined security testing policy may be directly responsible for the lack of vulnerability scanning.

Here are a few examples of vulnerabilities related to contingency planning/ disaster recovery:

• Inadequate information system recovery procedures, for all processing areas (including networks)
• Not having alternate processing or storage sites
• Not having alternate communication services
• Not having clearly defined contingency directives and procedures
• Lack of a clearly defined, tested contingency plan • The absence of adequate formal contingency training • Lack of information (data and operating system) backups