Follow by Email

Monday, August 15, 2016

Data Compromise: The Next Chapter

Updated: The Equation Group hack has been verified.

It seems the Oracle MICROS malware insertion hack went a bit deeper and had a suspicious purpose. Several hotels in the US, run by HEI hotels and resorts, that run the MICROS points-of-sale and hospitality software, have been breached. This means the credit card info for lots of people has been compromised. The list of dates affected by the breach indicate that the MICROS hack went in as early as March, 2015!

It is curious that the Westin City Center in Washington D.C. was included in the list, and was compromised for more than 9 months following September, 2015. This amounts to total operational awareness for whoever is running the breach. Let's admit it: if you wanted to know what is happening in US politics, what better way than to own than the comings and goings in Washington D.C.? I suspect FSB, the entity that has replaced the infamous Russian KGB.

I doubt we have seen a complete list of breaches with MICROS. If you are an IT person, visit Krebs on Security for a good list of IOCs (indicators of compromise). If you use MICROS, then change your passwords immediately.

Recently we saw the DCCC hack and the dox'ing of a huge amount of congress, on Guccifer 2.0's site.

This, once again, speaks of a state actor attempting to disrupt American politics.

But there are still a few hacks that can't be assigned easily to state actors. The recent data breach of Sage software, based in the UK, used for accounts and payroll processing, indicates that hackers are still largely following the money.

My sense is that data compromise is perpetrated on an agenda rather than simply because "people have the right to know", the tired axiom used by the media to depict crusading whistleblowers.

More often than not we are seeing criminals looking for ways to pry money out of rich people. Or directly from banking systems. But that might simply be a cover for state actors, who are building a database much deeper than Google's. And for much darker purposes.

And Now For Something Completely Disastrous

In today's news is another story that strongly correlates to the awful scenario in which the NSA's reputed-to-exist Equation Group has been hacked. This group is responsible for Stuxnet, Duqu, Gauss, and other famous modular virus architectures used to hack, among other victims, the Iranian uranium centrifuges.

This story is developing as I write, but an analysis of the example data provided by the hackers, the Shadow Brokers, by Matt Suiche appears to confirm the hack. Just read that source to see how desperate the situation is.

Here is an example of a state actor being hacked. My fears for the Gauss modular virus architecture used to be that it would get reverse engineered and modified by less scrupulous hackers. Now my fears are that essentially every hacker will possess this toolkit. Some eastern European hacking consortium will productize it, make it easy to use, and disseminate it for bitcoins. It's a virtual Pandora's Box.

Update: The Equation Group hack appears to heavily utilize RC5 and RC6 encryption. Comparison of the code by Kaspersky's GReAT team shows it matches the Equation Group's signature. It's all wrapped up in the magical P and Q constants used by Rivest's RC5/6.

Tuesday, August 9, 2016

Big Time Infosec Issue!

Updated: five more point-of-sale systems breached. More info on how long the breach existed. And yet more info on where the compromises might have hit you. More identity information for Carbanak.

Did you ever get a message in a email that says: "We're letting you know your card may have been part of a compromise at an undisclosed merchant."? And not to worry because "We're Issuing You a New Card To Help Keep Your Information Safe". In title case, no less (thanks, daring fireball, for that link).

Apparently the time has come when data compromise becomes huge. Anybody who watches Mr. Robot probably knows that credit card hacking is a serious issue, and can get much more serious. We keep closing insecure points as they are discovered, of course. But, it seems, there are still plenty of ways to get into our credit card data stream.

One such way is through the Oracle MICROS system that handles point-of-sale transactions with credit cards (specifically at restaurants, delis, and hospitality points of sale). Apparently it is possible to rootkit these transaction processors, take control of them, and capture your name, credit card number, and secret code as it goes by. And, of course, send that data to the identity thieves.

Update: five more systems are reported by Forbes to be hacked, possibly by the same Russian cybercrime gang. These are UK-based Cin7, ECRS, Bankcard Services' Navy Zebra, PAR Technology, and Uniwell.

What Happened?

According to Krebs on Security, malware was placed on some internal Oracle server at their retail division. They thought it was just a small number of systems until they upgraded their security software to a new version. And at that point, they realized more than 700 systems were compromised! From there, it spread into the MICROS point-of-sale processors that accept your credit card and verify little things like that little gold chip on it. That was supposed to make the credit card SO much more secure.

The bottom line for us, the customers, is that the breach was detected only on July 25, 2016. And here's the catch: they don't really know how long it's even been active. Could be months.

Update: Bad news! There is info from HEI hotels that the breach might have existed since March, 2015.

Who Did It?

This is a very sophisticated hack. This was no script kiddie.

Apparently the Carbanak cybergang is responsible. According to Kaspersky, they stole $1B by attacking bank system intranets in an advanced persistent threat (APT) campaign culminating last February. This gang is a big time threat, and we have stumbled onto one more page in their playbook.

It gets even more interesting. Carbanak is connected to a Mr. Tverinov, as reported by Krebs, and supported by the sleuthing of Ron Guilmette. Artim Tverinov is CEO of InfoKube, a Russian security firm, that builds the LioN anti-virus application. A Trojan horse?

It's not rocket science - Krebs, while communicating with the shadowy Mr. Tverinov through the Vkontakte Russian social-media site, literally eye-witnessed Tverinov's Vkontakte page get deleted! This was followed by a direct-email denial of any and all wrongdoing.

Supposedly Russia arrested 50 alleged members of the Carbanak cybercrime gang on June 1, 2016. Kaspersky Lab helped to identify the hackers charged, but Tverinov wasn't among them.

It also seems that Carbanak was using a C&C server that is tied to the FSB (the successor of the KGB). This according to Security Affairs.

Update: Carbanak is sometimes also known as Anunak.

Where Was I Most Likely Compromised?

This would have occurred at a chain restaurant, or perhaps a modern restaurant that is taking advantage of modern technology. And you would have used your credit card to pay. Unfortunately, this is not too unlikely a scenario, is it?

You might have seen a colorful point-of-sale display on a tablet or monitor (like this one) at a restaurant, hotel, deli, charcuterie, or even a burger chain.

Update: Forbes, in the same article as the above update, reports that your credit card might have been compromised at Donald Trump's Hotel group, Hyatt, Kimpton, or one of 1000 Wendy's restaurants. Also consult the list of hotels in the HEI list.

The Big Android Hack

Qualcomm GPUs and kernel modules are vulnerable to being rootkit'ed. This involves a huge number (900 million) Android devices. They are called the QuadRooter vulnerabilities, as explained by security researcher Adam Donenfeld in his blog post. This affects the Samsung Galaxy 7, the most popular Android device.

On another note, the Blackberry DTEK 50, "the most secure smartphone in the world" utilizes a Qualcomm 8992 Snapdragon 808 Hexa-Core, 64 bit with Adreno 418, 600MHz GPU. And so it is also vulnerable to four of the flaws.



Sunday, July 24, 2016

State Actors Up The Ante?

One of the fastest changing landscapes on the planet isn't even a tangible one. It's more of a concept: security. Before we go on, for dear readers confused by modern hacker security terms, check out Kaspersky.

I'm a proponent of good encryption. The reason is simple: everybody needs security. You need to keep your banking passwords secure. You don't want malicious actors (trolls) taking over your Facebook account and somehow ruining your life.

You especially don't want anyone to rootkit your computers! Once that's done, they can steal your identity, install malware for collecting passwords and account names, and so forth. Now go to the next level: your computer might then be used as part of a DDoS attack against Homeland Security. Your computer could wind up as the storage location for the malicious actors' illegal data ... without your knowledge. You become their fall guy.

Yes, there are plenty of good reasons for all of us to keep our passwords safe and distinct.

But encryption is not all black and white, is it? And that's the rub. Enter the relativistic observer, to tell you some of the latest. Things are changing too fast to blink, after all.

It's long been known that people outside the law use the Dark Web to organize, proliferate, distribute, and communicate. And the Dark Web is run using the Tor network. Tor, short for The Onion Router, is a volunteer network of servers running special protocols that relay your browsing history and other data through virtual tunnels.

To be fair, the Tor project has lofty goals. And gets used by "family & friends, businesses, activists, media, and military & Law Enforcement", according to their web site. The US Navy uses Tor for open source intelligence gathering, for instance. The EFF suggests using Tor for maintaining secure correspondence and keeping our civil liberties intact.

For people operating outside the law, the Tor network also maintains their OpSec. The Dark Net is called this because the communication within it has "gone dark". Surveillance doesn't work there.

The Tor network and the Dark Web must be a real pain to law enforcement. Given enough desperation, it might be something they would seek to infiltrate.

So what law enforcement would do is this: create their own honeypot counterfeit Tor server (or relay). But put in their own undetectable flavor of malware. Then they can watch the criminal's Dark Net traffic. And watch the crime happening. Collect the privileged conversations.

These really exist, as doctored Tor relays. There are over 100 malicious relays that have been detected. And who could they be? My guess is state actors like the US, China and Russia. If not them, then who? The criminals themselves? This is a game of spy vs. spy, updated for the 21st century. Could the FBI be doing this? Their arrest of child pornography criminals in January 2016 was supposedly accomplished by cracking Tor.

There is a question as to how invasive such investigations should be allowed to be. I'm not saying that the FBI shouldn't go after child pornographers; they totally should. I just think that *everybody* is too broad a target for law enforcement. Privacy is a basic human right.

Friday, November 6, 2015

Rapidly Growing Niche

What is disruption? How does it occur? When we answer these questions, we will see that in many cases the leaders in the market are blindsided by the rapidly growing niche.

The word "niche" describes a market that fits nicely into a crevice of the overall market, but, according to popular opinion, doesn't really matter. And that's actually the funniest thing of all, in a way: the market that doesn't matter can actually take over the larger market, given certain characteristics. Love this stuff.

Cars

Consider the rise of the automobile. The specific market that internal-combustion vehicles displaced was the horse-drawn carriage, trap, dogcart, brougham, or whatever Sherlock wanted to call them. But consider the advantages of the new niche technology.

The space taken up by the conveyance is the first issue: having a horse and a cart means having both a stable and a garage, while a car only requires a garage. Umm, not to mention that the stable had to be swept out(!).

Which brings us to the next issue, consumables: a horse must be fed, and so must a car. But what the horse eats can go bad, and must be carefully regulated to avoid having the horse eat itself to death. Fuels can be easily stored. In plain fact, people were used to using fuels because they lit their houses with kerosene.

Repair was another issue: a horse can go lame and a car can also break down. But when a horse goes lame, it's usually not recoverable (and sad). However, a car can be fixed.

In the personal transportation market, the ever-growing advantages of the rapidly growing niche product, the car, increased its uptake dramatically, even exponentially, displacing the horse-drawn carriage. It took decades to fully play out.

Instead of sweeping out stables, we are now dealing with the hydrocarbon emission problem, and its carbon footprint. One thing is clear: we need to be smarter about the environmental impact of our disruptive technologies!

But now consider electric vehicles. In the US by the high cost of gasoline, which was almost $4.10/gal in June 2008, drove the hybrid Toyota Prius to great success as they were selling about 20,000 of them per month at the time. The cost of gasoline went down, driven by an economic downturn (caused by hurricanes and a crisis in mortgage lending which led to bad debts and a foreclosure increase). This occurred simultaneously with the introduction of the disruptive technologies of shale oil extraction, fracking, and improvements in deep-sea drilling. This caused the biggest oil producers, Saudi Arabia and Russia, to be dominated by the production in the US, for a while. The Saudis countered, with their huge cash hoard as a life boat, by increasing oil production, thus decreasing the price of oil even more, but diminishing their spare capacity. This had the dual effect of helping them to retain clients that they were losing left and right, and also of putting pressure on the Americans whose revolutionary oil extraction techniques might (still) be made too costly by reducing their profit margins.

All of this will eventually lead to a spike in oil prices and thus even greater reliance and demand for electric vehicles, like the Tesla Model S, which I am seeing everywhere. Perhaps because I live near Silicon Valley. Hmm.

Progress is accelerating

As mechanical wonders turn into embedded computers and sensors make them ever more cognizant of our environment, the size of a gadget is going down dramatically and the capabilities of a gadget are increasing tremendously. Once you can carry it in your pocket, it becomes irreplaceable, essential. The smaller gadgets get, the faster they will improve: now the improvements are often a matter of simply writing new software.

So what used to take decades now takes a few years. In the future it likely won't even take that long. Now let's look at some more examples of disruption (and disruption prevented) in this era of faster progress.

Computers in general

Well, now we come to the biggest disruption of all, which is actually in progress: computers. The rise of the smartphone shows that an all-in-one gadget can succeed over the feature phone. And by modifying its form factor and use cases, the rise of the tablet shows that there is a great alternative to the netbook, laptop, and even the home computer. Even businesses find that iPads can replace a host of other, clumsier gadgets.

What were the advantages that triggered the displacement of the feature phone by the smartphone? A single high-resolution glass touchscreen was an astounding improvement over the button-cluttered big-fat-pixel interfaces of the feature phones. A simpler interface with common visual elements won out over the modal menu environment that had to be searched through laboriously to find even the simplest commands. It can even be argued that the integrated battery made the process of owning a phone simpler. What cemented the advantages of the smartphone was the ecosystem that it lived in. On the iPhone, this is exemplified by the iTunes Music Store, the App Store, and the iBookstore. A telling, crucial moment was when the smartphone didn't have to be plugged into a desktop computer to be updated and backed up.

The next step was the tablet. In retrospect, it was more than just increasing the size of the screen. It required more power and it probably had a very different use case. The use case was closer to the laptop. On the smaller end, tablet sales are probably being cannibalized by the larger phones such as the iPhone 6S Plus. On the larger end, the power of tablets will increase until they become viable alternatives to laptops.

Still, I love my laptop.

But all it would take is a significant increase in battery technology to let the tablets reach the power of the best laptops. Then it will be purely a matter of ergonomics. Tablet are lighter, still quite useful, and clearly good enough for many types of businesses. The disruption of the PC market is but a few years away, I expect.

The post-PC era is nigh.

Those who call tablets PCs really don't quite have a handle on the form factor. Perhaps it's like Microsoft says: all it takes is a keyboard and your tablet becomes a PC. Detachables have the advantage of a keyboard and a bigger battery, with the prohibitive cost of the weight of the device.

While I like my laptop - it IS heavier than a tablet by a huge margin. Perhaps the rapidly growing niche of tablets will displace the laptop - but the growth isn't there yet.

Social media

Now: why did Facebook buy Instagram? Because it was a rapidly growing niche that was taking on more and more of its customers' time. By purchasing it they accomplish two things. First, it's a hedge against the niche technology taking over and displacing them. Second, it prevents their competitor, Twitter, from purchasing it. Mark Zuckerberg, Facebook's leader is smart. He knows that the rapidly growing niche can take over. After all, Facebook successfully did the same to other portals such as MySpace and Yahoo.

And what comes around goes around.


Wednesday, June 4, 2014

Interesting Persons, Part 1

Back in the 1980s I was fascinated by sound synthesis and analysis. The most well-known work I did was a little application called SoundCap (for Sound Capture) that was coupled with an Analog-to-Digital converter initially sold by Fractal Software, my partnership with Tom Hedges, and eventually sold by MacNifty. It is fortunate for many of the early Macintosh developers that this box hooked up to the back of a Mac through the serial port. Several sound-producing apps were produced with it, including Airborne! by San Diego's Silicon Beach Software.

Stephen St. Croix was a friend of mine. He contacted me at Fractal Design in the 1990s and wow'ed me with a few of his wondrous stories. We spoke at length on several occasions about digital sound synthesis, one of my many hobbies. I was surprised to learn that he was one of the inventors, at Marshall Electronics, of the Time Modulator, the box that introduced digital delay line flanging to more than a few famous musicians.

The most interesting story he told me was about the job he did with Lay's. Yes, the people who make the potato chips. It seems that their spokesman, Jack Klugman (of Quincy fame), had lost his voice as a result of throat cancer. This really made a problem for them because his commercials for Lay's potato chips were pulling quite well. After all, he was a very recognizable and a well-loved actor. His voice was distinctive. People listened to him.

Stephen informed me that they invented a new kind of voice synthesis device to recreate his voice. It used formant synthesis. Incredibly, they could exactly duplicate the distinctive gravelly sound of his voice in this manner! It seems that the very low-frequency warbling of his vocal cords, though inimitable by human voice impersonators, was entirely imitable by digital synthesis techniques.

At Marshall Electronics, they spent quite some time analyzing sound. They had room analyzers. And so they also had room simulators. But the least known cleverness involved voice analyzers. Imagine picking apart someone's voice, layer by layer. Figuring out the pitch-profiles and the syllabic inflections. Hand-tuning the cadence of the words. My mind was boggled constantly by Stephen's work.

I informed him of my work in music extraction. I had a special application called Do-Re-Mi that allowed you to whistle a tune that could be output using MIDI in key duration format, complete with amplitude and pitch profiles suitable for modulating a pitch wheel and a volume pedal. It could tell you how many cents (hundredths of a semitone) sharp or flat you were when you whistled. I used a clever correlation technique that involved a time-delta histogram for correlation, pitch-multiple disambiguation, Lagrange peak-finding, and other techniques for isolating the pitch accurately. This work was all done in the 1980s, before Fractal Design, as part of Fractal Software's work.

Tom Hedges, of course, was the hardware designer of the first Macintosh sound sampling box and my contribution was the software, much of it written in Motorola 68000 assembler. Our work with sound continued when we did a bit of work with Bogas Productions, involving Ed Bogas, Ty Roberts, Neil Cormia and others. I met them through a mutual acquaintance, Steve Capps, who was working on the Finder in 1984.

I wrote a sequencing application in 1984 and Tom was fascinated by it. He modified it so it could sequence samples and then proceeded to digitize his piano, note for note. This was in a day when samplers existed, but were quite crude and expensive. He encoded Rhapsody in Blue (he was so proud of playing it) and also a perennial favorite, Wasted on the Way (a thickly vocal-harmonic piece from Crosby, Stills, and Nash). We were both musically literate, but in different ways. I was a composer who played piano and I was fully familiar with sheet music (actually, I had to teach the rudiments of it to Tom before he could digitize the songs, which took a week or so to get it just right). Tom was a DJ with KZSU Stanford and an advanced audiophile. And he had a very wide understanding of music. His father played piano (which explained Tom's interest in Gershwin's Rhapsody in Blue).

So when I began speaking with Stephen St. Croix, I was very deep into audio analysis and synthesis. And the author of a very popular application for sound manipulation on the coolest new computer around, the Macintosh.

It wasn't a big surprise at all that we spent hours and hours talking about sound synthesis, analysis, music, and the recording business. Crazy times and a really good guy.

Seven Ways

There are seven ways that we best retain information, and five of these ways are tied to our natural innate skills as humans. These five are: typing, handwriting, speaking, seeing, and hearing. Two other ways help you complete the process of learning by semantic cross-tagging: mixing and anchoring.

Typing is a skill that we develop to codify something in symbolic notation: language. When we use keyboards for entry, this gives the language center of our brain a workout, which is concerned with coding and symbolication. But what are these codes and symbols? In language, we break our writing into chapters, chapters into paragraphs, paragraphs into sentences, sentences into words, and words into letters. These symbols, their organization, and their semantic meanings are inherent to symbolic processing. And, as humans, we definitely excel at this.

But there are more kinds of codes and symbols. When we use a musical instrument, we usually produce music in a coded symbolic representation: note for note. We break songs into sections, such as verses, refrains, and bridges. We break sections into chords. We layer melody on top of accompaniment, on top of bass. We accent with drums. We break melodies and chords into notes. We even break notes into tone, duration, and volume. Unlike text, music has quite a number of internal properties of continuity. Like staccato and slurring notes together. All of these are also kinds of language symbols that our brains use. Clearly we are using our brains' auditory centers when we make music.

I certainly didn't miss that writing is a bit like music, also. Because when we write creatively, we use plots like we use the interrelationship of melodies and leitmotivs. We make characters and develop alternate realities. We use metaphor and hyperbole. We season our writing with alliteration and onomatopoeia. A theme can pervade a novel. The resolution of a character's arc can stir us like a brilliant cadence. But writing struggles in the last chapter to compete with the finality and intense closure of the coda for a great piece of music.

Handwriting is a perfect way to match our muscle memory to our brains. We coordinate our hands and eyes to denote what we hear or what we think. Taking notes can be a compelling way to retain your thoughts. When we combine it with symbolic representations, we can end up with text, mathematical equations, musical notation, or even scribbles, doodles, and drawings. Let's face it, we think a bit more when we are handwriting than when we type, because a different part of our brain is required to do it.

In some ways, handwriting is utilizing the visual center of our brain. Typing does this also because we use our eyes to verify the text we enter. It seems like it is the connections between brain centers that reinforce our understanding of knowledge and help us to retain and memorize.

Speaking is our natural form of expression. We use our voices conversationally and this method of communication is highly generative, using our cognitive powers to express a thought, a concept, to deliver commands, to convince or inform. We use our language processing centers in a different way, and this is evident in the way we often speak very differently than we write: less formally. When we are in front of a group, we speak from memory, following a train of thought. Actors and presenters learn to do this and shade their performances with attitude and gesticulation, making the art of speaking a multi-dimensional task.

When we sing, we are expressing much more than just notes and words. We are using emotion. We link our generative capabilities to our voice when we sing. When we learn to play piano and sing, we are using much more of our brain than we usually might employ.

Seeing is much more than just looking at a photograph or diagram. It's also seeing in the mind's eye. Some people are very visual and can instantly see a concept in their head before they can express it. They can see the directions on a map in their head when they drive. Our eyes are the key to visualizing, certainly. But even blind people can see concepts. We have spatial reasoning to thank for this. When you have a visual memory, you get to see an object when it is described.

There is more to visualizing than just what is real, though. We can thank our imaginations for this fact. We can imagine impossible figures, for instance, and this concisely illustrates that our imaginations can transcend the real.

Perhaps for many people the spark of an idea comes visually. Perhaps concepts are symbolic for others. Perhaps concepts are neither visual nor symbolic for some: just floating in consciousness waiting to be expressed in some way.

Hearing is a natural way to capture and acquire information. But few of us actually hear a sentence and turn it into text in our head. Maybe a few of us turn it into visual information. But most likely hearing is its own domain. Somehow what we hear simply gets directly converted to knowledge. Still, often we must write something down to retain it, usually.

When I am composing or playing piano, I do not generally rely on my ear to remember the tune and the rhythm. Thankfully, I can record what I play. In other situations, I write down what I play (by hand), in common musical notation.

Even so, I can hear quite a bit of music in my head. It even seems like it is playing back. At 17 years old, I used to do this just before going to sleep, in that nebulous state in between waking and sleeping. I would consciously play a piece in my head. One that I was working on, or a familiar song. Or even a symphony. I guess I was practicing the ability to imagine polyphony. I was on the verge of being a composer at that age.

Mixing modes is the most powerful form of memorization. Sight-reading is a great way to commit a piece to memory. Playing a piece I'm composing, to cement the chord and melody structure is a good way to hone a piece. Record it and listen to it later, to take a step back and form new ideas for where the piece is going.

Listening and taking notes is a good mixture of modes for memorization and retention. But if you really want to cement it into your memory, type up your notes later. Draw diagrams. Learning, though, is much more than memorization. True retention requires application of a concept.

Anchoring is an essential endgame for learning a subject properly. I have a friend who says "I don't want to hire the people who can memorize terms and subjects, I want to hire people that can do something with what they've learned". Memorizing words in a foreign language is useful, but using those same words in sentences is much more powerful because then the words will forever be connected to concepts and subjects in your mind.

Sunday, February 2, 2014

The New Brand

In my notes from 1997 and 1998 I found this graphic from the last days of Fractal Design, immediately after the merger with MetaTools, and the start of the newly-formed company, which was to be called MetaCreations. It shows my irreverent take on typography, with letters verging on an alien alphabet. Perhaps this was my thinking in those days, clearly influenced by Star Trek: The Next Generation design and increasingly beginning to think that aliens were taking over my company.

The graphic was a last hurrah, buried in my logo-search stack. These were the papers that detail the search for a new company name and logo, begun as a result of merger. Those were turbulent days, full of interesting ideas that never made it. Here is another little sketch from that collection of the doodles drawn in those days when the meetings were long and the bickering was uncomfortable. I was already thinking about the metaphors for the idea processor.
Name search

First came the name search. The first edict, from John Wilczak (the MetaTools CEO and soon to be replaced) was that the name should contain "Meta". Once you put that flag in the ground, there are only so many names that can be chosen. We all bought into it.

John Derry and I thought up several meta-rooted names for the company. We centered around various concepts, like making: names like metaforge, metafactory, and metaforce. We also tried words around branding: names like metabrand, metaware, metafactor, and metacraft. Next we covered concept names like metapath, metaform, and metadesign. Of course, we also looked at location names like metaworld, metastage, metasphere, metawave, and metalevel. Combination names sometimes became useful, like metalith and metastar. We were going for simplicity and pith.

We had a hundred names to choose from, and three or four made the top of the list. But it turned out that they were always taken by one company or another, and so proved themselves to be unsuitable for our purposes.

In the end, the root word meta (meaning "on another level") was merged with "create" and we somehow found MetaCreations as our new name. We worked out the typestyle, using a PR branding firm called 30SIXTY, contracted by Sallie Olmstead. The result was a very good type treatment. One of their designs stuck, seen here. MetaCreations passed the trademark search and so we found ourselves in the position of needing a good catchphrase to go with it.

Catchphrase and Logo

At this point, we hired a new CEO and the branding began afresh. This cast us into disarray: the implications of three separate groups pushing in different directions. Let me introduce you to the three groups:

One group was Gary Lauer's group. Gary was the new CEO, hired by the board and taking on the challenge of merging two cultures with a third culture of his own. The second group was Kai Krause's group. Kai was the design thinker from MetaTools and the creative face of the company. The third group was John Derry and myself, Mark Zimmer. But, frankly, I took the lead because I was the representative to the logo group. As you will see, the three groups couldn't agree less. And yet we eventually found a logo. Here I show a doodle from a page drawn during the endless logo meetings.

The catchphrase Gary preferred was staid and traditional: The Visual Computing Software Company. The logos from his group were not unlike the ones from Claris in style. The other two groups saw the logos as pedestrian and frankly uninteresting. Here you can see one of the color schemes of his final logo set. The earlier ones were considerably more amateurish. This one features an M-shape with a bit of a shine nestling into it. My comments on this particular logo are unprintable, sadly: I will leave them to your imagination. Kai felt pretty much the same about this logo.
The catchphrase Kai preferred was genuinely clever: where great ideas are born. Also, John Wilczak, before he left, preferred start the migration, though I'm still not sure where he was going with that one. The logos from Kai's group initially centered on an egg - with the idea of hatching a new idea. Other groups just kept thinking "Meta lays an egg" as the headline. After a brief trademark search, we discovered Software Ventures had an egg with a shadow as its logo, and that was the final crack.
In the sessions for my group, John and I tossed around the creativity concept endlessly. One catchphrase was bringing creativity to you. Another was changing the way people think. Our final try was sparking your creativity. While fascinating and very ambitious, I still think Kai's catchphrase was best. Our logo designs centered on a hand - for software that was human-centric. The hand was the artist's signature from the days of the cave-painters. Other groups just saw "stop" - a hand telling you not to enter. Here, we placed it inside an oval form to suggest an egg.
All three groups had a basic problem - the other two groups opposed their design. So Gary, thinking his group was more equal than the other two, decided to make a presentation of his logo. Allowing us to choose the color scheme. Ah, that was a rough meeting.

This required Kai and I to work together on a new logo. I dredged up an old design: the trefoil knot. I had made this design in 1983 when working as a consultant for Auto-Trol (I was building them a 3D system for computer-aided engineering). I had resurrected this design when working on Detailer, the 3D Paint Program, adding a mirrored surface to it. Here we see a small version of this knot, produced in Detailer using a brassy look. Kai's people used Bryce to create a much cleaner, smoother nicely-tilted version of this knot, and added a slight soft shadow underneath it.

This shadow was eventually omitted and the catchphrase was changed once again.

This time I wasn't asked. As you can see, it became The Creative Web Company. The times were changing, and at this time, before the dot-com boom and collapse, everything had to be  naively covered with web-web-web. The trefoil knot had a nice reflection and self-shadowing, though. Kai and I approved the form.

After Kai and I decided to redesign the logo, he had his people design some new forms. Many of them were based on threefold symmetry, which I also tend to prefer. One designer, Athena Kekenes, produced some iconic figures that still hold up today. The first figures were triangular-symmetry organic forms that had a very interesting, yet somehow alien, lilt to them. With tree-like branching properties and spherical ends, it looked a bit like some strange form of sea-weed. You can see one of the designs here. We asked for some more ideas.

One was a cube that had a sphere subtracted from it. This, when viewed from the direction of a corner, had a six-fold symmetry that was quite pleasing.

Here you can see the cube, with the sphere subtracted. With Boolean operations in Bryce, this stuff just jumped right out of the imagination into the page.

When you look at it, it's a bit busy. It has a shadow, the three visible sides of the cube have different shades. The sphere has gradations. The objects even shadows itself!

I'm sure this is what Kai and Athena were thinking when they came up with the simpler version of the logo.


Here we can see the flower logo. It's very clean, simple, stylistic, and suggestive of 3D.

Negative space is used in two ways: the sphere is negative space when subtracted from the cube, and the flower is the result of looking through the negative space of the 3D form and coloring in the holes.

In some way, though, we found these cube-based logos to be too derivative of the Silicon Graphics logo. I even found the SGI logo in my notes right next to this one.

Kai's group never really gave up on the egg, until the trefoil knot became our focus. By that time we were tired of the process of logo search.

Here is an egg-derived logo that used the shape several times in negative and positive space to form an op-art logo. This held up better because it could be reproduced in black-and-white. As any good logo should.

But eventually we centered on the trefoil knot. It's iconic form was clear. Before any of his people had a chance to perfect the trefoil with reflections and shadows, he had his people do special black-and-white versions of the trefoil.

This version is exceptionally clever, using rotated versions of the knot silhouette in alternating colors, then subtracting out the middle.

Though we liked the line art reproduce-ability of this form, we thought it looked a bit too much like the woolmark logo.

In all, we spent too much time working on the logo. Gary, in his desperation, did an end-around and created his own logo and placed it on our products. This was done because, after all, we had to have something to put on shipping products. This was another logo based on the M (and, it seems, on Freddy Krueger).

As you can see, Gary even replaced the typeface we selected! His quest for a unified package design was next. This actually made us mad, because each product was a brand of its own and the entire concept of unified product packaging design seemed wrong.

What did we do to deserve this?

In all, I wasn't really satisfied with what came out of this process. Personally, I doubt Kai was either. Meta continued to create great products, nonetheless. Bryce, Painter, KPT, and Poser saw fantastic new versions. And Ray Dream Designer metamorphosed into Carrara, which was a very ambitious project and a great product in its own right.

And I just kept drawing new iconic logo designs. I knew that someday they might be useful to me. And someday the story would be told.