Cracking Code to Steal Encrypted Data

Researchers Find Way to Steal Encrypted Data

A group led by a Princeton University computer security researcher has developed a simple method to steal encrypted information stored on computer hard disks.

The technique, which could undermine security software protecting critical data on computers, is as easy as chilling a computer memory chip with a blast of frigid air from a can of dust remover. Encryption software is widely used by companies and government agencies, notably in portable computers that are especially susceptible to theft.

The development, which was described on the group's Web site Thursday, could also have implications for the protection of encrypted personal data from prosecutors.

Center for Information Technology Policy, Princeton University

Princeton-based researchers broke the encryption system by freezing memory chips, permitting them to read the software.

By JOHN MARKOFF

Published: February 22, 2008

The move, which cannot be carried out remotely, exploits a little-known vulnerability of the dynamic random access, or DRAM, chip. Those chips temporarily hold data, including the keys to modern data-scrambling algorithms. When the computer's electrical power is shut off, the data, including the keys, is supposed to disappear.

In a technical paper that was published Thursday on the Web site of Princeton's Center for Information Technology Policy, the group demonstrated that standard memory chips actually retain their data for seconds or even minutes after power is cut off.

When the chips were chilled using an inexpensive can of air, the data was frozen in place, permitting the researchers to easily read the keys — long strings of ones and zeros — out of the chip's memory.

"Cool the chips in liquid nitrogen (-196 °C) and they hold their state for hours at least, without any power," Edward W. Felten, a Princeton computer scientist, wrote in a Web posting. "Just put the chips back into a machine and you can read out their contents."

The researchers used special pattern-recognition software of their own to identify security keys among the millions or even billions of pieces of data on the memory chip.

"We think this is pretty serious to the extent people are relying on file protection," Mr. Felten said.

The team, which included five graduate students led by Mr. Felten and three independent technical experts, said they did not know if such an attack capability would compromise government computer information because details of how classified computer data is protected are not publicly available.

Officials at the Department of Homeland Security, which paid for a portion of the research, did not return repeated calls for comment.

The researchers also said they had not explored disk encryption protection systems as now built into some commercial disk drives.

But they said they had proved that so-called Trusted Computing hardware, an industry standard approach that has been heralded as significantly increasing the security of modern personal computers, does not appear to stop the potential attacks.

A number of computer security experts said the research results were an indication that assertions of robust computer security should be regarded with caution.

"This is just another example of how things aren't quite what they seem when people tell you things are secure," said Peter Neumann, a security researcher at SRI International in Menlo Park, Calif.

The Princeton researchers wrote that they were able to compromise encrypted information stored using special utilities in the Windows, Macintosh and Linux operating systems.

Apple has had a FileVault disk encryption feature as an option in its OS X operating system since 2003. Microsoft added file encryption last year with BitLocker features in its Windows Vista operating system. The programs both use the federal government's certified Advanced Encryption System algorithm to scramble data as it is read from and written to a computer hard disk. But both programs leave the keys in computer memory in an unencrypted form.

"The software world tends not to think about these issues," said Matt Blaze, an associate professor of computer and information science at the University of Pennsylvania. "We tend to make assumptions about the hardware. When we find out that those assumptions are wrong, we're in trouble."

Both of the software publishers said they ship their operating systems with the file encryption turned off. It is then up to the customer to turn on the feature.

Executives of Microsoft said BitLocker has a range of protection options that they referred to as "good, better and best."

Austin Wilson, director of Windows product management security at Microsoft, said the company recommended that BitLocker be used in some cases with additional hardware security. That might include either a special U.S.B. hardware key, or a secure identification card that generates an additional key string.

The Princeton researchers acknowledged that in these advanced modes, BitLocker encrypted data could not be accessed using the vulnerability they discovered.

An Apple spokeswoman said that the security of the FileVault system could also be enhanced by using a secure card to add to the strength of the key.

The researchers said they began exploring the utilities for vulnerabilities last fall after seeing a reference to the persistence of data in memory in a technical paper written by computer scientists at Stanford in 2005.

The Princeton group included Seth D. Schoen of the Electronic Frontier Foundation, William Paul of Wind River Systems and Jacob Appelbaum, an independent computer security researcher.

The issue of protecting information with disk encryption technology became prominent recently in a criminal case involving a Canadian citizen who late in 2006 was stopped by United States customs agents who said they had found child pornography on his computer.

When the agents tried to examine the machine later, they discovered that the data was protected by encryption. The suspect has refused to divulge his password. A federal agent testified in court that the only way to determine the password otherwise would be with a password guessing program, which could take years.

A federal magistrate ruled recently that forcing the suspect to disclose the password would be unconstitutional.

Avoiding Bank Fees

Switch to the offensive to stop them before they hit you again.

I was filing some old bank statements during a routine desk cleanup. One I hadn't opened from last April had a surprise in it. A small slip of paper -- a new fee schedule -- fell onto the floor.

More From Marketwatch.com • Before Accepting a Buyout Package, Consider These Risks • Capital-Gains Pain • Living the Expat Life

An unopened bank statement? OK, you got me. No, these days I don't balance my checkbook every month. Simply don't have the time.

But that's not the issue -- it's bigger. New fees for services, new "punitive" fees. Some lower, most higher. And only for certain types of accounts. Now, with all the accounts they offer, do I remember what kind of account I have? Nope.

And there's a bigger issue: my bank -- and probably yours too -- chooses to notify me once using a nondescript mailing insert. Even if I had opened the statement I probably wouldn't have noticed it. And I still don't know if it applies to my account.

Couldn't they have sent me a computer-generated letter telling me how my fees would change? That would have caught my attention. But did they really want to catch my attention? Probably not.

This sort of disguised disclosure happens with credit cards too. Something buried in the fine print of a new "terms and conditions" piece thrown into your statement. Informative? Proactive? Hardly.

Bottom line: it's worth 15 minutes to double check your fee exposure.

The reason why

Fee increases are common now. Why? In part, because of the mortgage crisis. That's right, with the mortgage business in the doldrums -- or worse, consuming precious bank capital -- banks are out to capture cash where they can. Bank ATM fees generated some $10 billion for U.S. banks last year. It's a big deal.

And in today's environment of "gotcha capitalism," where a quoted rental car rate may be less than half of what you'll actually pay, almost anything goes.

Indeed, Bank of America raised its noncustomer ATM fees to $3 last September, and J.P. Morgan Chase and Wachovia followed suit in some markets. Now that's $3 for them, plus anywhere from a dollar to $2 for your bank, to get that $20 you need to pay for parking or whatever. Ouch.

Undoubtedly, there's more to come. Higher fees for insufficient funds, multiple savings withdrawals, point-of-sale use and others. The good news: a few, like online banking fees, are falling (Competition does work, and banks realize they save money too.)

And you should expect increases in required minimum balances for fee-free or reduced-fee accounts. According to a 2007 Bankrate.com survey, minimum balances to avoid fees were up some 25% last year to over $3,300.

Here's what I'd do:

Review fees with a bank agent. Call customer service and have them lay out all the fees for your type of account -- and for similar accounts that might be a better deal. Getting this info from a bank's Web site can be surprisingly difficult -- you're probably better off to do this by phone. The agent at my bank was informed and helpful.

Check comparison tools. Bankrate.com offers a survey of checking accounts by geography. It doesn't cover all fees but does hit biggies like insufficient funds, and it will show differences between large national banks, regional banks, Internet banks, etc. You can get a ballpark idea of what you should pay.

Consider credit unions. If you're eligible, credit unions still provide the best deal. Checking accounts are often free with ATM fees and free overdraft protection on many types of accounts. Credit unions are not-for-profit and have largely steered clear of the mortgage mess, so they don't share big-bank motives. My recent experience: ATM alliances and online banking have made credit union products very competitive -- even if you travel or have some other situation once considered an inherent disadvantage.

Consider a large deposit to avoid fees. The numbers may work out -- you'll have to check. If you park $10,000 or so in a CD, you'll get a decent (although currently dropping) interest rate, plus the benefits of reduced fees. Together it can pay off. Plus, you won't feel "nickeled and dimed" by your bank.

My advice: spend 15 minutes with an agent reviewing your current fee "menu." Then spend another 15 to check the alternatives. The half hour will be worth your while.

Soporific Diet

Soporific Diet

One of the best natural sedatives is tryptophan, an amino acid component of many plant and animal proteins.

Tryptophan is one of the ingredients necessary for the body to make serotonin, the neurotransmitter best known for creating feelings of calm, and for making you sleepy.

However, the trick is to combine foods that have some tryptophan with ample carbohydrate. That's because in order for insomnia-busting tryptophan to work, it has to make its way to the brain.

Unfortunately, all amino acids compete for transport to the brain. When you add carbs, they cause the release of insulin, which takes the competing amino acids and incorporates them into muscle…but leaves tryptophan alone, so it can make its way to the brain, be converted to serotonin, and cause sleepiness.  

Serotonin-producing bedtime snacks should be no more than 200 calories and should be eaten at least 30 minutes prior to bed.

Here are a few great ideas: 

Bedtime Snacks for Adults

--6-8 oz container of non-fat, flavored yogurt topped with 2 tablespoons low-fat granola cereal
--Sliced apple with 1-2 teaspoons natural peanut butter
--3 cups low-fat popcorn – sprinkled with optional 2 tablespoons parmesan cheese  

Bedtime Snacks for Teens

--One cup healthy cereal with skim milk
--Low-fat granola bar
--Scoop of vanilla or strawberry low-fat ice cream

Bedtime Snacks for Children

--1/2 cup low-fat vanilla pudding
--1/2 banana with 1-2 teaspoons peanut butter
--One cup skim milk with a bunch of grapes (or other fruit)

Facing Online Economy

Facing Online Economy

Most industries do not begin on a single day, but it's easy to see Facebook CEO Mark Zuckerberg's presentation on May 24, 2007, as the starting gun in an entrepreneurial race that some have dubbed "the Facebook Economy."

On that day in May, Zuckerberg announced that the privately held social networking site he founded in 2004 would open to third-party developers, transforming itself from a popular Web site to a platform on which other businesses can operate. Eight months later, more than 14,000 applications from third-party developers are live on Facebook, allowing users to do everything from flirt to browse for books. The most successful are raking in profits from ad revenues.

Is Facebook becoming the social operating system of the Internet, poised to support a whole new generation of businesses? Or is this new industry of applications leaning too heavily on the quixotic popularity of a single Web site? Industry leaders and Wharton experts see major opportunities ahead for those who can manage the risks.

"There's no question that social networking platforms will be the basis for a great deal of innovation and business opportunity," says Kevin Werbach, professor of legal studies and business ethics at Wharton. "What's not clear yet is whether there will be one or two dominant players. It's a very dynamic environment."

For the moment, however, Facebook is "king of the hill" as a social networking platform, and will be for some time, according to Peter Fader, a Wharton marketing professor. While MySpace is bigger--currently the third most popular site in the U.S., compared to Facebook's rank of fifth--it has not yet opened to third-party developers, although owner Rupert Murdoch has announced intentions to do so. "Facebook is like the QWERTY keyboard: There's nothing particularly special about it, but it came along at the right time and place. At some point, that standard just becomes locked in," says Fader.

What makes Facebook attractive as a platform for businesses is obvious, says Kendall Whitehouse, senior director of IT for Wharton. "It brings in this huge audience from the get-go, and so you have a built-in infrastructure [for online interactions], so you get the network effect in spades." The payoff for Facebook? Rich interactive content that keeps users on the site, and an entire world of developers competing with each other to create newer and better applications, says Whitehouse.

With the floodgates now open to developers of every stripe, from Facebook-addicted teenagers to major public companies, Fader says entrepreneurial excitement is reaching a fever pitch. Judging from interest among his students, he jokes, Facebook entrepreneurism could be "a stand-alone major" at business schools. "Many of them aren't even thinking of making money. Facebook is just where they spend so much of their lives already, and now they have a chance to play on it themselves."

But such enthusiast entrepreneurs are just one group climbing onto the Facebook platform, says Fader. For established companies, making a Facebook application is a way to "stand up on a mountaintop and shout." In that category are applications tied into real-life products, like the popular game "Parking Wars," created by A&E Television Networks to advertise a new series about the Philadelphia Parking Authority. This "advergame" allows Facebook users to "park" cars on one another's profiles and earn virtual cash by ticketing illegally parked vehicles.

There's no doubt that Facebook's platform, known as "f8," has spawned a fledgling industry, says Fader. "I'm only surprised it's taken so long." But with many start-ups focused entirely on Facebook, Fader sees potential downsides. "Being based 100% on Facebook is very risky, because social networks are inherently unstable. Five years ago, we would have been talking about Friendster." Still, he says the market is vibrant enough now to at least "give businesses a start."

Two Brothers And A Board Game
Jayant and Rajat Agarwalla are typical in many ways of Facebook entrepreneurs. The Kolkata, India-based brothers first created a Web site for playing an online version of the word game Scrabble several years ago, "just for the love of the game," says Jayant, 21, who also runs an offshore Web development firm with his brother. The Web site attracted about 3,000 regular players. When an American user suggested the brothers launch a Facebook version of the game, they spent 10 days cooking up the application and then launched it in July 2007.

With this small investment, the brothers were suddenly owners of one of Facebook's biggest hits: Scrabulous. As of late January 2008, more than half a million Facebook users play Scrabulous daily, with four times that number having added the application to their Facebook profiles. Because third-party developers can keep all the revenue they generate, the Agarwallas are currently pulling in about $25,000 a month from advertising, according to Jayant, resulting in a "decent profit" after expenses like hosting, labor and server costs.

But the Agarwalla brothers may become victims of their own success: In mid-January, Pawtucket, Rhode Island-based Hasbro (nyse: HAS - news - people ), which holds the Scrabble trademark in the U.S. and Canada, asked Facebook to remove Scrabulous because of copyright infringement. "We have spent many years building the Scrabble brand, and what Scrabulous is doing is piracy," reads an official Hasbro statement. "We ... hope to find an amicable solution. If we cannot come to one quickly, we will be forced to close down the illegal online game."

The Agarwallas' entrée into viral superstardom demonstrates the business opportunities inherent in the Facebook platform, according to Wharton's Whitehouse. Launching an online application is "not like cranking up a manufacturing plant," he says. "The barriers to entry, while not trivial, are relatively low--basically the cost of a clever programmer's time."

The Agarwallas' seemingly accidental success is actually a common pattern, he adds. "Often, developers create their first application without any immediate plans for revenue generation. If it doesn't take off, it doesn't matter, because they didn't expect to make any money. If it does take off, they can then figure out how to generate revenue." Such a nothing-to-lose strategy is less appealing for major businesses. "The lone programmer has a different set of incentives for making his work available for free. An established company, with a responsibility to its shareholders, will probably take a more measured path."

In August 2007, Hasbro sold the digital rights to Scrabble and other games to the Redwood City, Calif.-based online gaming giant Electronic Arts (nasdaq: ERTS - news - people ). The following month, EA launched a version of Scrabble for mobile phones. Technology reviewers gave the game a thumbs-up, except for one potentially fatal flaw: Users can only play with one another by physically passing the phone back and forth between them.

Hasbro does have online multiplayer games. Users can download Monopoly, another Hasbro board game, for $19.95, but playing with friends is only possible if they buy the game as well.

Both attempts at digital board-gaming demonstrate how Scrabulous filled a niche by drawing on Facebook's greatest asset--what Zuckerberg calls "the social graph," the links between users and their friends. Scrabulous makes it possible, for example, to recreate a big family game of Scrabble, even when family members are scattered around the world (assuming, of course, that all family members are tech-savvy enough to maintain a Facebook account). Because Scrabulous games can be saved and played out over weeks or months, they allow for what new-media entrepreneur Rodney Rumford calls "short bursts of interaction."

"I know so many venture capitalists and CEOs who play Scrabulous. It's a new form of golf. Maybe you don't have time to play nine holes, but you can socially interact and challenge one another via Scrabulous," says Rumford, CEO of the Solana Beach, Calif.-based Gravitational Media and publisher of Facereviews.com, a review site for Facebook applications.

"Scrabulous has created value for the product in a way Hasbro would have never thought of doing," says Wharton's Fader. "Hasbro's challenge is to call off the lawyers, do better business development and come up with an online version of the game people will like even better. If people are playing more Scrabble, they should figure out how to tap into that."

Karl Savage, whose Facebook profile describes him as "the unelected, unofficial radio spokesperson for the 'Save Scrabulous' campaign," was asked during a BBC radio interview last week whether he would play a Hasbro-created online Scrabble game if Scrabulous were shut down. "The main selling feature of Scrabulous for me is the fact I can play it within Facebook. If it was on an external site, I would have to search for my friends all over again, and I don't think that would work, and I don't think people would sign up for it," Savage says.

Online Dating--And Greeting Cards
Because the majority of Facebook application developers are individuals or small companies, major companies "who are used to hiring ad agencies with $100 million budgets are only now just beginning to work with microdevelopers," says Rumford. A few major brands have made it big on Facebook, like Red Bull, the energy drink produced by Austria-based Red Bull GmbH, whose Facebook application "Roshambull" offers an online version of the classic children's game "Rock-Scissors-Paper."

But many more major brands may be falling behind. Rumford's Gravitational Media launched a greeting card application on Facebook as a lab experiment, to give its programmers a chance to play around with the f8 platform. "We didn't intend to make any money on it, but now we're beating out Hallmark's application by 10 to one," says Rumford. On a recent day, Gravitational Media's "Cool Greeting Cards" had 2,015 active daily users compared to 205 at "Hallmark eCards."

Online dating is another area where big players are lagging. Like the Agarwalla brothers before the f8 launch, Cliff Lerner ran a Web site, in his case, called Iamfreetonight.com, an online dating site owned by the Manhattan-based eTwine Holdings. After the Zuckerberg announcement in May, Lerner recalls, "We decided to stop working on Iamfreetonight.com for a couple of weeks in order to write a dating application for Facebook." The result was an application called "Meet New People." "In no time, we had more users on the app than we had on the Web site. And we didn't spend a dime on advertising the app--it was all viral."

Lerner's company has since launched an even more popular application--"Are You Interested?"--which allows users to find and express interest in other available singles. The application recently had about 600,000 active, daily users. Lerner's company has now changed its name to SNAP Interactive, and is preparing to shut down its stand-alone dating site and concentrate full time on developing Facebook applications.

In comparison, two of the dominant players in online dating-- eHarmony.com and Match.com--had Facebook applications with 48 daily active users between them on a recent day. And it's not just on Facebook where the online-dating incumbents are losing out. According to comScore, a Web analysis firm based in Reston, Va., traffic to stand-alone sites like eHarmony.com and Match.com fell 21% and 16%, respectively, between 2006 and 2007. Industry observers partly blame the allure of dating opportunities on free social networking sites like Facebook.

Scaling An Industry
Lerner's SNAP Interactive gets extra attention in the Facebook business world because it is one of the few publicly held application-development companies. Its preliminary earnings report for the final quarter of 2007 showed profits around $388,000--a more than tenfold increase over third-quarter profits.

In spite of such tremendous growth for application superstars, including the San Francisco-based Slide and San Mateo, Calif.-based RockYou, Wharton's Werbach asks whether the Facebook economy will remain on a micro level for some time to come. "If you are starting a business that needs only a small revenue stream to support a few people, you can do that on Facebook. But to build a business that would become a public company, valuable enough to be a major acquisition--it's not clear today there is enough opportunity," says Werbach, founder of the Supernova technology conference.

Other questions about the relevance of applications come from Facebook users themselves. Because applications constantly prompt or even require users to invite others, they can lead to a seemingly constant stream of requests from Facebook "friends." One wants to compare movie tastes with you; another challenges you to a game of Texas Hold'Em; a third invites you and a hundred other people to watch a random video. Some Facebook users have begun to protest such "friend-spam."

But Rumford, of Gravitational Media, says he's confident the free hand of the Facebook market will separate flash-in-the-pan applications from the truly useful--and in spite of the proliferation of applications, he asserts there is plenty of room for more. "The low-hanging fruit has been picked, but a whole bunch of niches have yet to be filled."

Those bullish on the Facebook market predict people will conduct more and more of their online lives through social networking venues like Facebook. Styky Phonebook, an application developed by a Wharton undergraduate, for example, allows users to save and synchronize cell phone address books on Facebook pages. Other applications let users import their music libraries or feed in streams of content from outside blogs. And with Facebook planning to launch its own payment system, users will soon be able to shop online without ever leaving the cozy blue-and-white confines of their profile pages.

"The apps currently on Facebook only scratch the surface of what's possible," writes Salil Deshpande of the Menlo Park, Calif.-based Bay Partners venture capital firm, in an e-mail. Deshpande, together with colleague Angela Strange, created AppFactory, a fast-track venture capital fund targeted solely at Facebook application developers. According to Deshpande, the fund has received several hundred applications, and has funded six ventures, all with investments between $25,000 and $250,000.

Deshpande says it is fair to ask whether a healthy industry can grow from a single Web site, but writes that AppFactory's vision "does not require Facebook's dominance. Social platforms are here to stay."

One key to scaling up the industry is "interoperability" among social platforms, says Wharton's Werbach. With Facebook taking the lead, industry participants like Deshpande called on other social networks to make their platforms compatible with Facebook's, so developers can deploy their applications on multiple platforms with a few clicks.

Deshpande says he sees "momentum" in that direction. In early December 2007, for example, the popular social network Bebo announced an open application platform that works easily with Facebook applications. One month earlier, Google (nasdaq: GOOG - news - people ) launched OpenSocial, a standardized applications platform which gained the support of most of the major social networking sites--except Facebook. Such compatibility may be essential for application developers to break into non-U.S. markets, where Facebook is a lesser-known entity.

For the moment, however, Wharton's Fader sees Facebook commanding a mass market in a way traditional forms of media no longer do. "Even TV does not have the same level of engagement. Right now, Facebook is unique."

From being Hired to being Fired

From being Hired to being Fired

Whether we're actually in a recession or not is the subject of debate.

What is certain is the rising unemployment rate. U.S. unemployment rose to 5% for the first time in two and a half years in December. That's likely a result of the fallout from the subprime mortgage crisis--and there's probably more to come.

Don't wait for the alarm bells to sound. Recession or just a temporary slowdown, there are things you can do to keep your job as safe as possible. "You have to be proactive," says Dale Winston, CEO of the executive recruiting firm Battalia Winston International.

In Pictures: Steps To Making Yourself Recession-Proof

The first step: Make yourself indispensable. Show up early and stay late. Now isn't the time to slack. If your boss needs someone to volunteer for a project, raise your hand to do it, then do it well. "Prove you're a contributor no matter what level you're operating at," she says.

If possible, take on projects for other divisions. It's hard to fire someone when they're valuable to several areas of the business. But be prepared to be stretched. Open jobs might go unfilled for long time periods and you will have to take on extra work. Don't start sleeping at the office, but don't complain about working extra hours for several managers.

Also, look for ways to save the company money," says Bill DeMario, chief operating officer of Ajilon Consulting, a staffing firm that specializes in accounting, finance, consulting and human resources management. That includes everything from telecommuting to a faraway meeting to gently encouraging colleagues not to print all 100 pages of a document unless they absolutely need them. (You can even make the reduced printing targets a competition between different departments so it seems less like a company mandate and more like a silly office game.)

Take a broader view, too. Be aware of your profession's and your company's financial well-being and act accordingly. In other words, people who work in industries that are clearly suffering, like print media, should ramp up their job search and consider ways they can use their skills in similar fields. Look for signs to determine how healthy your company is. Are they tightening the purse strings by limiting travel? Are they asking employees to bring their own lunches to previously catered staff meetings? These may seem like small things, but they can be indications of tight financial times.

If you notice those signs, do more than just work hard. Talk to people in your industry to find out which companies are thriving and make contact with employees there. Use your professional network to accomplish this.

On the bright side, if there is a recession, it likely won't be as severe as the last one. Back then there was a confluence of factors, including the dot-com bust and Sept. 11, 2001, that took a severe toll. Also, the demographics of the workforce are evolving. Large numbers of baby boomers are about to reach retirement age, and while they won't necessarily leave the workforce entirely, they will look to slow down or switch careers. That means there is opportunity for younger employees to fill those gaps.

In the immediate future, if there are widespread layoffs, younger generations will likely handle it differently than their older peers, says Mary Crane, a career consultant who specializes in bridging the generation gap. "They've come into the workplace never suspecting they'll take one job and have it for life," says Crane.

"Lots of them will look at it as an opportunity to explore career opportunities. They might take six months off-- that's how long recessions last--and work on a political campaign because they can build their resume and make great contacts. Or they'll teach. They look at this as opportunity."

We can all learn a lesson from that attitude.

Goldentouch Business

Goldentouch Business

No. 1: Accounting Services

Average Pretax Margin: 25%

This industry includes services like bookkeeping, designing accounting systems, payroll billing and preparing financial statements and tax returns. A big yawn--until you see the profits start to pile up. Three reasons: pricing power (everybody needs accountants, no matter how the economy is doing), low overhead and marketing scale, thanks to plenty of repeat clients.

No. 2: Legal Services

Average Pretax Margin: 21. 6%

Lawyers enjoy healthy economics for many of the same reasons their bean-counting brethren do. Overhead is relatively low (a secretary or two, an office lease, some computers and filing cabinets, and a decent expense account). Business tends to come through referrals, keeping marketing costs down, and repeat business is high, thanks to perceived "switching costs" of trading one counselor for another.

No. 3: Dental Services

Average Pretax Margin: 20.9%

Good teeth make for a bright smile--and a fat bottom line. A big reason: operating scale. Dentists can handle several patients at once--depending on the number of "chairs" in the office, dentists can run through multiple patients in one hour. Some of the equipment is expensive, but hygienists don't cost much to employ. Better yet, a lot of customers pay out of pocket. That gives dentists more pricing power relative to other medical providers, who usually have to deal with heavy-handed insurance providers.

No. 4: Specialized Design Services

Average Pretax Margin: 17.6%

This hodgepodge includes interior designers, industrial designers (not architects) and graphic designers. Efficiencies derived from technology, such as computer aided design software, have been a boon to these businesses. Meanwhile, design firms can charge a good buck for their talent.

No. 5: "Other" Health Practitioners

Average Pretax Margin: 17.5%

Chiropractors, optometrists, podiatrists, physical therapists, speech therapists and mental health professionals know that it pays to specialize. These health practitioners often have more pricing power than general physicians, as many are able to circumvent the large health insurers and health maintenance organizations skilled at taking their pounds of flesh.

No. 6: Outpatient Care Centers

Average Pretax Margin: 16.9%

Spas, family planning centers, outpatient mental health centers, rehab centers, HMO medical centers, kidney dialysis centers and freestanding surgical and emergency centers fall under this broad category. Outpatient care is catching on: As technology improves, medical professionals are performing more procedures in these facilities. While outpatient care centers have plenty of overhead, they stack up well against inpatient-care competitors. They also can often avoid dealing with managed-care providers, though more medical plans are seeking them out to control costs.

No. 7: Insurance Brokers

Average Pretax Margin: 15.9%

Included here are insurance agents and those that provide other services, like claims adjustments. Successful agents enjoy annuity-style profit streams: They nab an up-front commission upon selling a policy, as well as fees each year that the policy stays in place. Additional revenues with little additional expense--smart formula.

No. 8: Physicians' Offices

Average Pretax Margin: 15.8%

Of course doctors turn a decent profit--why else would they slog through eight years of medical school and a tortuous residency? And no matter what the economy is doing, there are always sick people to treat. Still, general docs have steadily lost pricing power at the hands of large insurance providers.

No. 9: Medical And Diagnostic Labs

Average Pretax Margin: 15.3%

Small fry may have difficulty raising the scratch to buy expensive equipment; once it's installed, though, the economics of scale start to kick in. Depending on the type of lab, the marginal cost of doing "one more" test--thanks to typically lean staffing--can be very small.

No. 10: Depository Credit Intermediation

Average Pretax Margin: 13.6%

This group includes small banks, credit unions (lenders with cooperative ownership structures, such as the General Motors Credit Union) and other institutions that take deposits. On average, for every dollar of revenue they bring in, just 48 cents goes to cover overhead. While commercial lending has dried up in recent months, community banks have managed to weather the storm thus far--but who knows for how long?

Best & Worst Ways of Minting Money

Best & Worst Ways of Minting Money

Entrepreneurs start companies for all sorts of reasons. Maybe they have a passion, like being in control, want more flexibility--or even hate their current jobs.

But no matter the inspiration, one thing's for sure: They'd better make money. A rising revenue line might make for good cocktail conversation, but if you don't turn a profit--and keep turning one--you won't be an entrepreneur very long.

With the help of Sageworks, a Raleigh, N.C.-based private-company data provider, Forbes.com has assembled a list of the 10 most and least profitable businesses--on a pretax basis--that aspiring entrepreneurs might hope to launch. Average pretax profits ranged from a juicy 25% to a knee-wobbling negative 7%.

In Pictures: The Most Profitable Businesses To Start

In Pictures: The Least Profitable Businesses To Start

The data were drawn from recent financial statements for nearly 100,000 privately held companies in the U.S.--most with annual revenues under $10 million--and bucketed by Internal Revenue Service classifications. We included only industries for which Sageworks had data from at least 50 companies--750 in all--and eliminated categories too broad to be meaningful.

While based on U.S. companies, the numbers also shed light on global profit trends. "The dynamics of each specific industry are slightly different in each country," says Sageworks founder Brian Hamilton. "[But] the relative profitability of these industries--on a pretax basis--holds, generally, throughout the globe."

Of the winners, little surprise that professional services--accounting, law, design and medical-related firms--accounted for eight of the top 10. Two big perks here: constant demand (no matter what the economy is doing, people will still get sick and still sue each other) and relatively low overhead. Bean counters trumped all, with a 25% average pretax margin. Next came the legal-service firms, at 21.6%, followed by dental offices (20.9%) and specialty design shops (17.6%).

Specialization helps in health services, too. Chiropractors, optometrists, podiatrists, and physical, speech and mental health therapists--the fifth most profitable group as a whole, with a 17.5% margin--often have more pricing power (and require less expensive training) than general physicians. A big reason: Many of these niche providers are able to circumvent the large health insurers and health maintenance organizations skilled at taking their pounds of flesh.

Another nice thing about professional services is all the repeat customers. "If someone's been doing my taxes for 20 years, why would I switch?" says John Czepiel, professor of marketing at New York University's Stern School of Business. "There's a perceived cost of switching that keeps customers coming back."

As for those bleeding red ink, the reasons are myriad. Low barriers to entry, huge fixed and variable costs, lack of product differentiation, and little or no pricing power with buyers and suppliers are but a few.

Take community care facilities, the worst of the bunch with a -7.2% average pretax margin. This sector includes residential care facilities that also offer nursing assistance or other health services. Not only is the overhead overbearing, there's a shortage of nurses worldwide, pushing up wages. Pricing power is limited, too: In the United States, these facilities get paid by Medicare and Medicaid, a relatively stingy twosome.

A hodgepodge of support services is next on the loser list. These struggling outfits do everything from organizing trade shows and conferences to labeling and wrapping gifts--not exactly quantum physics. These functions have low barriers to entry and plenty of competition. Coordinator-types also have to pay out subcontractors, gobbling what little profit they hope to make. Average margin: -2.6%.

The next three groups also traffic in commodity products: beverage makers (-2.2%), real estate services (-2.1%), and bakeries and tortilla makers (-0.9%). Small food manufacturers really get squeezed in the value chain--trapped between suppliers, with whom they have little leverage relative to larger players, and massive retail chains with lots of buying power. "The only people making money in the food chain are big corporations, because scale is the only driver of profits in that industry," says James Nolen, finance professor at the McCombs School of Business at the University of Texas at Austin.

To be fair, these numbers are something of a snapshot, as the profitability of any industry ebbs and flows, at least somewhat, with the overall economy. "In [the early 1980s], the U.S. moved from a retail economy to a service-based economy," says Nolen. "In the late 1990s, [it] moved largely to a knowledge-based economy. You can sell [those skills] at a higher rate."

But there are other factors at play. Temporary jolts, such as high fuel costs, a weak U.S. dollar, collapsing real estate prices and a credit crunch, can turn winners into losers, and visa versa. Take small banks and credit unions, the tenth most profitable businesses on our list (margin: 13.6%). Small lenders have been more insulated from the credit crisis than the big guys, like Citigroup (nyse: C - news - people ) and Bank of America (nyse: BAC - news - people ), though who knows for how long.

On the other hand, U.S. liquor retailers haven't fared particularly well--not only because they don't have much pricing power with distributors, but because the weak dollar means they have to pay a lot more for imported alcohol these days.

Size matters too--even within the small-company universe. Tiny shops may not require a lot of overhead, but at some point--say, around $3 million in revenues--the relative level of overhead spikes, crimping margins. Generally speaking, economies of scale don't kick in until a business hits the $10 million in revenue range, says Nolen.

Business models and industry dynamics matter, but they aren't everything, says Sara Sarasvathy, associate professor of business administration at the Darden Business School at the University of Virginia. She conducted a study of 45 "expert entrepreneurs"--individuals who have built, and taken public, at least one company. Her hopeful conclusion: Entrepreneurs who profit in a given industry can see new opportunities where others can't, and are willing to bet on them.

"Philosophically, [expert] entrepreneurs don't think of the world as a given," says Sarasvathy. "They see everything as transformable."

Maybe--but then, data often speak louder than dreams.