Pete and Repeat walk into bar in this week’s TMQ, after the jump…
Archive for the ‘Geek’ Category
Obit watch: Elizabeth Pena. The name may not ring a bell at first, but she was in John Sayles’ “Lone Star”, “La Bamba”, “Jacob’s Ladder”, and was the voice of Mirage in “The Incredibles”, among a whole bunch of other credits. And I have to give a shot-out to this bit of trivia:
She also starred in I Married Dora, a sitcom about a green card marriage between an architect and his El Salvadoran housekeeper that aired for 13 episodes in 1987. The show is remembered by fans of obscure and weird TV for the conclusion of its final episode, when the actors announced on camera that the story cliffhanger they’d been building toward had been “resolved” by the series’ cancellation.
(Video at the link.)
People who know me are aware that I’m kind of a map geek. The very small handful of people I’ve let into my apartment can attest to this; my decorating theme is “maps”.
So I think this is kind of cool, for obvious reasons: free downloadable USGS topographic maps.
…I give you a very silly quiz from the WP:
I have never seen an episode of “Girls” (since I refuse to have cable). However, I still got a perfect score on the quiz. Which says something: either about my knowledge of Gatsby or about how silly this quiz actually is, I do not know.
Oh, what the heck, I’ll throw this one in, too:
I sent this to Lawrence with the suggestion that it might be worse than Bello De Soto’s website: Lawrence doesn’t think so, and I’m still trying to make up my mind.
There are so many things that push it towards legendary badness for me: the chicken walking around on the live Twitter feed (why?), the auto-play Chinese karaoke (ditto?), the spinning chat avatars, gratuitous abuse of the blink tag…
On the other hand, it hasn’t actually crashed any browser I’ve tried it on so far. On the gripping hand, it is an actually up and (apparently) functional website, as opposed to an archive of one…
This made me laugh so hard my cow orkers asked me what was so funny.
And the first response is just the icing on the cake.
Wired has an article based on the “Weaponizing Your Pets: The War Kitteh and the Denial of Service Dog” presentation which will take place on Sunday. I didn’t write about this yesterday because (and with all due respect to the presenter) it just didn’t strike me as being very interesting. You attached a WiFi scanner to a cat and let it roam around the neighborhood? Not sure I see anything novel there, except maybe if you made the WiFi rig very small. (You could have done the same thing with Kismet on a Nokia N810 years ago. You still can, if you can find a Nokia N810, which isn’t that hard, and if you can figure out a way to secure it to your pet.)
In other news, here are the presentation links I’ve been able to find so far. I’ll try to update this post during the day. If you are a presenter who would like your talk listed (even if it wasn’t on my list) or if there’s a talk you’d like for me to find, please feel free to leave comments or send email to stainles [at] sportsfirings.com.
- Pete Teoh’s “Data Protection 101 – Successes, Fails, and Fixes” talk is posted here.
- The Rick Mellendick and John Fulmer presentation, “RF Penetration Testing, Your Air Stinks” is here.
- I’m not sure if there is any difference between this version and the DEFCON one, but a version from May of the Sarah Edwards presentation, “Reverse Engineering Mac Malware”, can be found here.
- I haven’t yet found a copy of the presentation, but here’s a blog entry from Adam “Major Malfunction” Laurie on the RFIDler (from “RFIDler: SDR.RFID.FTW“). Here’s the GitHub repository. And here’s the Kickstarter.
That’s everything I’ve been able to find from yesterday. We’re only about 30 minutes into today’s sessions. And while looking for links, I ran across this tidbit: DEFCON ordered 14,000 badges this year. They were gone by 6 PM yesterday.
So what’s happening on Friday?
“Domain Name Problems and Solutions” intrigues me the most in the first block, since a) it looks like this is going to involve DNS based attacks on spam, and II) Paul Vixie is one of the key figures in the development of DNS.
“USB for all!” sounds like an interesting talk: “We will demonstrate different tools and methods that can be used to monitor and abuse USB for malicious purposes.”
I would have to go to “From root to SPECIAL: Pwning IBM Mainframes” just because I have a close friend (and former IBM-er) who speaks IBM mainframe. Plus, I’m curious. But “ShareEnum: We Wrapped Samba So You Don’t Have To” would be a good second choice: “ShareEnum uses the underlying Samba client libraries to list shares, permissions, and even recurse down file trees gathering information including what is stored in each directory.” And “Stolen Data Markets An Economic and Organizational Assessment” could be interesting as well. I’d probably still hit the IBM talk and seek out the slides for the other two.
More than likely I’d take a break at 13:00 and look at the slides for “Bypass firewalls, application white lists, secure remote desktops under 20 seconds” and “Investigating PowerShell Attacks” later. At 14:00, “What the Watchers See: Eavesdropping on Municipal Mesh Cameras for Giggles (or Pure Evil)“: “…we decode the previously undocumented mesh protocol enough to (1) “tune in” to live feeds from the various cameras positioned across the city, just like we were in police headquarters, and (2) inject arbitrary video into these streams.”
“Am I Being Spied On? Low-tech Ways Of Detecting High-tech Surveillance” sounds like the best talk at 15:00. And after that, there’s nothing that really intrigues me on Friday.
“Hack All The Things: 20 Devices in 45 Minutes” seems like the best opening panel on Saturday: if you don’t like what you’re seeing, just wait and something else will be along shortly. Plus free hardware!
There’s nothing that leaps out at me until “Secure Random by Default” at 13:00. Because Dan Kaminsky. “PropLANE: Kind of keeping the NSA from watching you pee” would be a good fallback if Kaminsky is too crowded: “…we’ve combined two things every good hacker should have, a Propeller powered DEF CON badge (DC XX in our case) and a somewhat sober brain to turn the DC badge (with some modifications) into an inline network encryption device.” (And hey: I have a DC 20 badge!)
“Secure Random” runs until 15:00, but if I couldn’t get into that, “NinjaTV – Increasing Your Smart TV’s IQ Without Bricking It” would be my second choice in the 14:00 block.
“A Survey of Remote Automotive Attack Surfaces” is at 15:00. This is another Charlie Miller and Chris Valasek talk, and is already getting some press: I kind of want to see this, but, again, there’s a conflict with two other talks I’d also like to see: “VoIP Wars: Attack of the Cisco Phones” and “Detecting Bluetooth Surveillance Systems“. This is another case where I’d apologize profusely to Mr. Miller and Mr. Valasek, download a copy of their presentation, and hit one of the other two sessions.
“Manna from Heaven: Improving the state of wireless rogue AP attacks” sounds interesting, especially with the promise of “a new rogue access point toolkit”. But I just can’t pass up the promise of “Learn how to control every room at a luxury hotel remotely“.
“Attacking the Internet of Things using Time“, which is really about timing attacks, sounds more interesting than the title implies. And “Old Skewl Hacking: Porn Free!” sounds like a great way to wrap up the day.
I don’t know that there’s anything I care that much about Sunday morning, though “Burner Phone DDOS 2 dollars a day : 70 Calls a Minute” and “Optical Surgery; Implanting a DropCam” could be interesting if I was up at that time. “NSA Playset : GSM Sniffing” sounds a bit more interesting: “Introducing TWILIGHTVEGETABLE, our attempt to pull together the past decade of GSM attacks into a single, coherent toolset, and finally make real, practical, GSM sniffing to the masses.”
There’s a gap in stuff I want to see from 13:00 to 15:00. At 15:00, we have “Elevator Hacking – From the Pit to the Penthouse“. I confess to a great deal of curiosity about elevators and how they work. Plus: Deviant Ollam! And that takes us to the closing ceremonies at 16:30.
Tomorrow, I’ll start trying to put up links.
DEFCON 22 sort of fires up today, though the real action doesn’t begin until Friday.
I’m not in Vegas again this year, for boring (money) reasons. Frankly, I’m also feeling a little burnt out. I miss Vegas (well, mostly, I miss Lotus of Siam) but I’m not sure I really miss dealing with that many people crammed into that small a space. I’m also not so sure that what happens at the conference makes that much of a difference any more. It seems like, to borrow the words of another better writer, “Nothing works and nobody cares”.
Or maybe that’s the depression talking. And the fact that my current employer made all of the videos from last year’s DEFCON available internally within a week of the conference.
So. If I was at DEFCON, what would I be attending?
As I said earlier, Thursday is usually kind of slow. I suspect I’d go to the “Data Protection 101 – Successes, Fails, and Fixes” talk; it sounds kind of basic to me, but you never know what you might learn. “Practical Foxhunting 101” also intrigues me. I went transmitter hunting with a friend of mine many many years ago, and I maintain a somewhat more than academic interest in the subject.
“Paging SDR… Why should the NSA have all the fun?” sounds like fun. Basically, this appears to be “how to decode pager traffic with cheap hardware so you can pretend to be Lester Freamon for fun and profit”. On the other hand, this conflicts with “RF Penetration Testing, Your Air Stinks“, a how-to talk for radio frequency penetration testers. I suspect I’d go to this one, and grab the slides from the pager talk later.
I know SCADA and the cloud are hot topics, but I’m not sure I’d go to either “AWS for Hackers” or “Protecting SCADA From the Ground Up“, simply because neither topic interests me that much. Nothing personal, presenters; they just don’t turn my crank.
I like the idea behind “Anatomy of a Pentest; Poppin’ Boxes like a Pro” and would be more likely to hit that than “One Man Shop: Building an effective security program all by yourself“. If I was working in a small organization, though, I’d probably go to “One Man Shop” instead.
I’m slightly more interested in “Reverse Engineering Mac Malware” than I am in the Honeynets talk. And “RFIDler: SDR.RFID.FTW” sounds exciting: “We have created a small, open source, cheap to build platform that allows any suitably powerful microprocessor access to the raw data created by the over-the-air conversation between tag and reader coil. The device can also act as a standalone ‘hacking’ platform for RFID manipulation/examination.”
This is shaping up to be longer than I expected, so I’m going to break it into two parts. I will try to get a second part up tonight and at least cover the Friday and Saturday talks I’m interested in, if not all the way through to Sunday.
The full schedule is here, if anyone wants to look at it and make requests. I welcome comments from presenters and other people who are at DEFCON. And I will be trying to monitor twitter feeds and posting presentation links as I find them.
Box Sized DIE is a public installation in a London banking district by Portuguese artist João Onofre. It’s a soundproofed, airtight black box. Inside, UK band Unfathomable Ruination will be playing death metal until they run out of oxygen, every day for most of July, starting on Sunday. The installation is part of the Sculpture In The City public art program by City of London.
My first thought: what do they mean by “run out of oxygen”? Does the band play until they pass out? If so, how will anyone know, given that the box is soundproofed and opaque? Do they just play until a certain CO2 level is reached? Do they have sensors and an alarm in the box?
My second thought: how long will the band actually play? Or, to phrase the question in another way, how long does it take to use up all the oxygen in the box? Apparently, this isn’t the first time a death metal band has played in the box (though it is the first time this has been done in London). Surely there must be some stats on this, like average length of time spent in the box.
My third thought:
My fourth thought:
Art F City argues that this is one of London’s “worst public art projects,” because “Passersby can’t hear them play, so what’s the point of choosing death metal over anyone else?” But there are many things we can’t see or hear directly from a sculpture. Onofre is charging the invisible core of the object with the specific force and drive of death metal. It’s black. It’s claustrophobic. It’s all angst. Of course it had to be black metal! Unlike most conceptual public sculptures, we know exactly what’s “inside.” Maybe it’s not the most subtle form of compacting tension and placing it into a public space, but I’m biased, so… \m/
Sounds like pretentious bullshit to me.
From the NYPost:
(Previously. Please note that my linking this is more for my own amusement, and should not be taken as an endorsement of the article; while I think it makes a good point or two, I also think it comes close to suffocating itself in the usual entitled whining that seems to characterize far too many (but not all) New Yorkers.)