Forkbolt

Mike Connell -- SmartTech

2008-12-30T10:12:00.000-08:00

For those that read my last few updates on SmartTech, Inc. and the massive cluster bomb of associated conspiracies, there is more to wonder about. The main technical player, Mike Connell, recently died in a fiery solo plain crash. Flying a plain by myself is NOT one of the things I would do, if I were going to turns states evidence.

May you rest in peace Mike Connell (unless you helped steal the Ohio elections and helped the Whitehouse hide illegal activity by hosting their external e-mail accounts to bypass federal laws on data retention).

SmarTech Inc., Rove, Ohio 2004 and 2006

2008-11-05T15:02:00.000-08:00

Now that the U.S. election has not been stolen, again -- as far as I can tell -- I'm curious if anybody has heard anything significant about the recent revelation regarding SmarTech Inc. and their possible role in hijacking the 2004 and 2006 Ohio election results.

Documents reveal how Ohio routed 2004 voting data through company that hosted external Bush Administration email accounts

"Newly obtained computer schematics provide further detail of how electronic voting data was routed during the 2004 election from Ohio’s Secretary of State’s office through a partisan Tennessee web hosting company."

2004 Network Schema Diagram

2006 Network Schema Diagram

I really hope this sees the further light of day.

UPDATE: Cyber Security Expert Says KingPin Attack Benefited Bush They're trying to expedite the investigation, as much as possible.

Edifices of Stone and Sky

2008-10-09T23:04:00.000-07:00

At the center of Union Square, San Francisco, I found myself in the shadow of this towering columnar memorial statue, with it's elegant Corinthian capitol, and the lady (victory), raising her trident and laurel wreath. Looking up at the sun falling behind the St. Francis Hotel, you can see light carving between the planes of the building and a massive flag crackling in the wind. If you look closely, there's also a seagull arcing through the top of the sky.

Ceasar's By Night

2008-08-07T18:45:00.000-07:00

BlackHat Day 1 -- DNS: Dan Kaminsky and Research Persistence

2008-08-07T18:26:00.000-07:00

Black Ops 2008: Its The End Of The Cache As We Know It
Dan Kaminsky

I just have to say how happy I am that Dan Kaminsky found this vuln and handled it the way he did. This guy has playfully danced all over DNS for much of his career and finding a problem like this gets to the heart of how the Internet works. This just might even top streaming video over DNS! The amazing thing about DNS is that's it's highly resistant to change, so it hasn't exactly been evolving rapidly. Anyhow, this talk had the normal level of Dan enthusiasm and was packed -- standing, sitting, in the aisles. Dan exhaustively demonstrated what can happen when you can own DNS at the highest levels. When you think about it, it's really insane. He also went into depth about the massive patch orchestration effort that went on behind the scenes. Kudos to everybody involved for making it all happen.

BlackHat Day 1 -- Bad Sushi and Phisher on Phisher Crime

2008-08-07T09:01:00.000-07:00

Bad Sushi:Beating Phishers at Their Own Game
Nitesh Dhanjani and Billy K Rios

These guys easily infiltrated a bunch of phishing forums by pretending to be a young kid wanting to learn how to do it. They were very quickly "helped out" and handed tons of phishing kits, after claiming they couldn't afford the exorbitant prices for the kits. Some of the observations from the presentation were quite comical. The phishing scene (sub-culture?) is one of bravado and backstabbing. They even found lists of other phishers that will rip off other phishers. They called it "phisher on phisher crime." One phisher generously gave the two a bunch of kits, but had clearly attempted to obfuscate something in the primary php uploader code, so that each stolen identity would also have a copy sent to the author. Another hilarious example, was a guy that was giving "instructions" on how to hack yahoo. There were pages of completely fake instructions -- that only someone non-technical would write or believe -- but at the end, to get it to work, you had to enter a working credit card number! When they e-mailed the guy that it didn't work, he simply told them that they "did it wrong" and "do it again". They also talked a bit about the various pricing they saw for stolen credit cards and what some of the likely return rates were. Very fun, stuff.

BlackHat Day 1 -- Wake Up, Register, Eat, Get Punched in the Face

2008-08-06T20:00:00.000-07:00

I was up early this morning and off to Ceasar's, where I quickly registered, grabbed a bagel, coffee, and took the lay of the land. There seems to be a lot more people this year and quite a few more vendors. I saw a few folks I know and managed to call one person by the wrong name. So, I hit the Intro and the Keynote.

Key Note Speech -- Complexity in Computer Security
Ian Angell, Professor Information Systems, London School of Economics

This was a really great knock-in-the-jaw speech (Okay, I was speaking metaphorically!). One of the main points he made was that our instincts to use statistics and risk analysis to simplify complex systems is doomed to fail by its nature, especially when that system has human pressures applied to it. When people ask me about info security risk, I often make a similar point by drawing a standard bell curve with lines for two standard deviations from the mean. For some instinctive reason, people seem to be very comfortable trying map to this distribution world view of risk. Then I draw an arrow pointing to around 2% with a snarky caption like, "Owned". The problem is that, things just don't follow simple models when dealing with emergent systems, because the rules of evaluation can change at any time. There really are no rules that can fully work. I'm going to have to think about it some more ... seriously.

More on Day 1 talks as I get them written up.

Welcome to Vegas

2008-08-06T02:26:00.000-07:00

Alright! Well, I did not get hung up by airport security, as I usually do. I think I've got a clear path figured out, now: if you're on the list, use the frequent flyer programs! I sat next to a guy on the airplane that was wearing grey and also going to BlackHat -- oddly, once we established this fact, we hardly spoke to each other. Prepare to experience Homo Securitas. Upon arrival, I hit the ground running, got to my hotel, checked in, and was immediately off to Ceasar's Palace, where I hooked up with Cvoid and Lara for dinner. I met and hung out with a couple of his co-workers on the InfoSec team at Ebay and then tried to register for BlackHat, but was too late. I swear, some people are payed to be grumpy. I saw a kid in a stroller wearing a toilet-seat-looking neck-pillow, so that his mom could drive him around the hotel, while he slept. She said, very matter-of-factly, "He IS still alive and that's all that matters." The above picture is Cvoid and I crashing the Qualys party (though honestly our crashing didn't last very long). I ironically clinked glasses with a few folks there as we attempted to find Mike Murray (where's Waldo?), but never succeeded. We subsequently failed to crash the BlackHat presenter party, though we had a good shot at it. I got to greet Kingpin in the elevator on the way up to the penthouse. After more hanging out at Ceasar's, I headed back to my hotel and received a nice profanity laced tirade from my cab driver for taking too short a ride. "Why don't you take a #$%ing bus next time," he said. When I started to settle in my room for the night, I got a text and was back off to the yearly, pre-BlackHat, midnight at Denny's with the nCircle VERT team, which I finally was able to make. Now, I've got to be up early to register. Welcome to Vegas!

See You in Vegas!

2008-08-05T14:52:00.001-07:00

On my way out to BlackHat and Defcon. Should be a good time.

Onward!

2008-07-29T22:55:00.000-07:00

Okay, so I've neglected my blog while juggling sundry life adventures. A quote from the inestimable AC/DC is in order:

Back in black, I hit the sack,
I've been too long, I'm glad to be back

I've been at my new gig for a few weeks now and am having fun. As ever -- learning. Beginner's mind is my friend. I imagine I'll be posting some related or un-related security stuff as I go. For now, I'm going to kick start things with blogging Blackhat and Defcon fairly extensively, so watch for it. I'll be in Las Vegas from the 5th evening, till the 10th afternoon. I'm already furiously making plans.

Forking Paths

2008-06-03T22:08:00.000-07:00

In case you haven't heard, I'm no longer Director of Engineering at nCircle. It was a good run. We'll see what happens next!

When Faced with Long Odds

2008-05-29T16:00:00.000-07:00

Nothing so valorous, nor impossible, have I ever seen -- but I'm stirred by recent events to remember this great poem:

The Charge of the Light Brigade

Half a league half a league,
Half a league onward,
All in the valley of Death
Rode the six hundred:
'Forward, the Light Brigade!
Charge for the guns' he said:
Into the valley of Death
Rode the six hundred.

[...]

Alfred Lord Tennyson

New Lines of Work

2008-04-30T15:28:00.000-07:00

A few months back I decided that if I ever needed to sell-out and find another line of work, I would become a linguist for the pharmaceutical industry and sit around all day thinking of ambiguous names for new drugs, using my fascination with language roots and etymology as raw material for the job.

I can imagine the lunch room conversations among the team of brain-stormers: the drug-name-abstraction linguists on one side and the side-effects-minimizing linguists on the other.

Abilify: "I've got a new one that I'm working on that uses 'sanatus' again -- I'm almost there, but I can't quite get it."

May Cause Bleeding Gums: "Have you tried 'sanify'?"

Apparently, I'm not the only one who thinks about this. I found this link in one of my feeds the other day, about a linguist studying the health effects of the names of cancer drugs.

A Mysterious Quotation

2008-04-29T15:16:00.000-07:00

Long ago I read a book about Mountain Climbing in the Himalayas and found a life-changing quote, somewhere in the front of the book.

“Until one is committed, there is hesitancy, the chance to draw back. Concerning all acts of initiative (and creation), there is one elementary truth, the ignorance of which kills countless ideas and splendid plans: that the moment one definitely commits oneself, then Providence moves too. All sorts of things occur to help one that would never otherwise have occurred. A whole stream of events issues from the decision, raising in one's favor all manner of unforeseen incidents and meetings and material assistance, which no man could have dreamed would have come his way. Whatever you can do, or dream you can do, begin it. Boldness has genius, power, and magic in it. Begin it now.”

Well, I had stashed this away in my brain as a quote from Sir Edmund Hillary. I recently went to go search for it again and discovered multiple attributions to William Hutchinson Murray (a Scottish Mountaineer) and Goethe. After some very brief digging it turns out that my memory was, in fact, flaky, and people have clarified this all over the place. Here is the full quote on Murray's Wikipedia entry. I also found this nice investigation on the Goethe side: Is it by Goethe or not?

Anyhow, this is one of my favorite quotes for its obvious merits.

Elite bbox

2008-03-21T22:56:00.000-07:00

I saw this telecom bbox the other day -- 1337! I asked a guy I know who works by it and he says that the stickers have been there for as long as he can remember. Is this an inside joke or a coincidence? Anyhow, thought it was funny.

Karuna or Why I Love A.W.A.D.

2008-03-21T10:45:00.000-07:00

I've been subscribed to A.W.A.D. (A Word A Day) for a while now and I highly recommend it. Sometimes, I read it every day and other times it piles up and I go through a bunch at once. It can surprise you with a word, when you least expect it. Here is the word for today:

karuna (KUH-roo-na) noun

Loving compassion.

[From Sanskrit karuna (compassion).]

"Once we experience and feel this inter-dependence of all
living beings, we will cease to hurt, humiliate, exploit and
kill another. We will want to free all sentient beings from
suffering. This is karuna, compassion, which in turn gives
rise to the responsibility to create happiness and its
causes for all."

Suresh Jindal; Interdependence of All Living Beings; The Times of India (New Delhi); Nov 13, 2003.

Escher at Civic Center

2008-03-20T21:15:00.000-07:00

This shot needed a much better camera, but I still think it's eye catching. I had to go up to go down to catch my train.

Measurements of Scale: Security Metrics

2008-03-18T23:55:00.001-07:00

A fun discussion arose today around security data analysis and the value of data by statistical scale (nominal, ordinal, interval and ratio). One of the funny thing we discussed about applying real metrics to our space was that people often think of certain familiar pieces of data, like ip address or mac address, as higher scale data-points, because they are superficially numerical, when they are only nominal in scale. Yes, that means they're just strings! You generally can't even imply the ordinal scale of an ip address, because it could very well be non-unique (at least in our type of dataset it is).

As these discussion tend to go, we then verged from stats to set theory as we attempted to clear up the usage of "ordinality" from "cardinality" as found in a recent book on security metrics. For those without the desire to follow the links, I will grossly simplify. Ordinality has a special purpose in describing infinite sets as "well ordered" (like the set of all natural number), though it typically can refer to a set of numbers or sets that are in order. Cardinality refers to the size or number of elements in a set.

Let's go back to Cantor, shall we? If you're still reading, checkout Cantor's Theorem and Cantor's Paradox. Here you can read about Aleph and it's use in talking about the cardinality of infinite sets.

Macbeth to His Lady.

2008-03-17T20:22:00.000-07:00

Macbeth: There's comfort yet; they are assailable.
Then be thou jocund. Ere the bat hath flown
His cloistered flight, ere to black Hecate's summons
The shard-born beetle with his drowsy hums
Hath rung night's yawning peal, there shall be done
A deed of dreadful note.

Shakespeare, Macbeth, III, ii

Guess what he's planning? Talk about going to extreme lengths to impress a woman! I love the sound of this. If you say it out loud you can really hear how he's playing with sound (consonance, assonance, and alliteration), while actually talking about sound ("hums", "rung", "peal", "note")!

I was watching some show that heavily borrowed from Macbeth -- the very well-trodden depiction of him being unable to mentally wipe the blood and violence of murdering the King from his mind (or his hands). So, I pulled it out to read that section again and re-discovered this little passage, as well.

Clever Bunny

2008-03-16T15:55:00.001-07:00

Chocolate Box.

Passing Time

2008-03-15T12:17:00.001-07:00

I was standing on the corner of Broadway and 12th St. in Oakland, outside the Downtown City Center BART station -- passing time. This image has a sort of Dali-esque, melting-clocks feel to it. You may have noticed already. I like reflections.

Peet's Woman

2008-03-15T11:59:00.000-07:00

Meet the newest super-heroine: Peet's Woman. She can do quite a lot with her magical bracers. I was roped into playing her arch-nemesis, whom I nicknamed "Lord Starbucks". My primary powers were that I could use a brassy acidic attack and could magically hop from corner to corner, appearing where you least expected me (like inside a bank or a retail shop).

Peet's Woman, in true comic book fashion, was using the full gusto of her sound-action punches to defeat me, ceaselessly. Her devastating hand-to-hand attacks were too much for me: "Latte!" "Mocha!!" "Ginger Cookie!!!" "Black Bottom Cupcake!!!!" After being defeated again and again, I was finally re-cast as Peet's Woman's sidekick: Peet's Lad. I have to admit, that wasn't quite as exciting a role.

Obi Kaufmann -- Optic Whale

2008-03-13T19:06:00.000-07:00

Had a blast Thursday evening with my old friend, Obi Kaufmann. Check out his site. He's also got a link over to the latest edition of Swee(t)Art Magazine, if you want to find out more about the Oakland art scene. We hung out at his studio for a bit, where I took the photo above. He's working on art for 2 new shows in April. We ended up at Lucky 13 in Alameda -- lots of black-light pop art and free sausages (it was some anniversary celebration).

The Nose

2008-03-12T23:49:00.001-07:00

A friend of mine said that I looked pissed-off in the other self-portrait I posted. I recall being more bemused by the cleverly placed mirror in the shop window. Any pissed-offness (piss-offedness?) was completely unintentional. So, this one's for him [courtesy of Photobooth]. I should keep a close eye on this nose of mine or it might cause trouble for me -- as long as I don't catch it about town wearing epaulets.

Pro Patria: Reductio Ad Absurdum

2008-03-12T15:36:00.000-07:00

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Quisque nec lectus leo, et dictum urna. Nulla ut tincidunt turpis. Nulla facilisi. Suspendisse a placerat arcu. Sed congue varius tincidunt. Nunc id eros arcu. Vivamus id viverra erat. Proin est erat, elementum et mattis ac, venenatis non lectus. Vivamus venenatis suscipit nulla, quis dapibus arcu commodo sed. Pellentesque pellentesque erat nec sapien pellentesque fermentum. Donec justo mauris, sodales in varius in, adipiscing nec libero. Curabitur a consequat lectus. Duis facilisis rhoncus ligula, et fermentum erat lacinia id. Etiam ac risus ut justo elementum imperdiet. Praesent id erat eget nulla luctus imperdiet.