Archive for August, 2009

Obit watch

Tuesday, August 18th, 2009

Everyone and his brother are noting the passing of Robert Novak, but I thought it’d be worthwhile to call out two less noticed passings:

Sherwood Cryer, co-founder and co-owner of Gilley’s, the iconic honky-tonk that begat Urban Cowboy.

Rose Friedman, wife, partner, and collaborator of Milton Friedman. Reason notes in a followup post that you can watch all of Free to Choose here.

The Good and the Ugly

Tuesday, August 18th, 2009

By way of Say Uncle, we learn of a Miami New Times article on store clerks exercising their right to self-defense; “South Florida Store Clerks Go Vigilante“.

In spite of the inaccurate headline, the article itself strikes me as being fairly even handed and sympathetic to the clerks interviewed.

“This is our police!” he declares, pointing at his handgun. “This is our state attorney!”

On the other hand, there’s a developing story here in Austin. Briefly, two young idiots decided to try and steal a 12-pack from a convenience store; the clerk came out and cranked off a dozen rounds at them. The clerk apparently hit with at least one of them, as one of the crooks was found dead inside the abandoned car a few hours later.

The punchline? The clerk is being charged with first degree murder. I see no mention in the article of the getaway driver being charged with anything, even though he was apparently in the process of filing a false police report when the cops showed up at his door.

Police said they later interviewed Romero, who said he fired a pistol about 12 times at Vielma, picked up the shell casings and put them in his vehicle.

He also told police that he picked up the beer dropped by Vielma and threw it into a trash bin, and he deleted images of the incident from the store’s video surveillance system.

Ooooo. Bad move, space cadet. If you had a good reason for shooting, the evidence is only going to help you. Altering or destroying evidence only makes you look bad.

Project e: Part 1, the unboxing

Friday, August 14th, 2009

I’ve been wanting a netbook for a while now.

Why?

It isn’t because I’m unhappy with my MacBook; I love the MacBook (especially now that I’ve taken it up to 4 GB). I love it so much that the MacBook has almost become my primary desktop machine (pushing the beige G3 down on the stack; I’m now mostly using that for word processing and updating the SDC pages). Because the MacBook has become more of a primary machine, disconnecting everything to take it on the road has become an increasingly unattractive proposition.

What about the Nokia N800? Nice machine, very handy, very useful for checking email and some web browsing. Also great for running Maemo Mapper. But the N800 has been discontinued; while there’s a pretty active open source community right now, I don’t know how well that’s going to hold up in the future. Doing LINUX development on it is possible, but painful. And I’m getting to the point where I have trouble seeing the screen unless I zoom to 120% or 150%; doing that often messes up rendering in the browser.

What I wanted was a mid-size machine that I could use as a dedicated LINUX box, with a reasonably sized display, to do various things on:

  • sharpen my LINUX skills
  • penetration testing
  • Wi-fi hacking
  • learning Python
  • brushing up on my Perl, which has become rusty.

What I really wanted was one of the ASUS Eee PC 901 machines; the solid-state drive, form factor, and pre-installed LINUX were pretty attractive. But by the time I got ready to act, these machines had more or less vanished.

“Life is compromise”, said the Buddha. Or, if he didn’t, he should have. After the jump…

(more…)

Light blogging

Wednesday, August 12th, 2009

Blogging has been light this week because I’ve been down with a nasty cold. Plus I’ve been working on getting the SDC pages updated.

I did want to call out this Austin American-Statesman article about the goings-on at our local public radio station. Briefly, KUT cancelled two shows (“Paul Ray’s Jazz”, which ran twice a week, and “Phil Music”, which ran on Thursday) and replaced them with a new show, hosted by the station’s new music director. They also cut back the hours of the two hosts (Paul Ray and Larry Monroe). The end result has been vocal outrage on one side, and spin by KUT.

Several things stand out in this. There’s the sense of entitlement that many of the loud protesters apparently feel. (“How dare you cancel Paul Ray’s Jazz, even if only 300 people listen to in in a city of a million!”) There’s the relationship dynamic going on. (“Stop pledging to the station? Make them suffer financially for a decision I disagree with? I can’t do that!”) There’s the (possibly legit) complaint that the current station management is trying to make KUT sound more like (popular local radio station) KGSR. There’s the fact that KUT apparently has two HD radio channels. (Really? Do you have an HD radio? Do you know anyone who does? Do you know anyone outside the radio industry that gives a flying flip at a rolling doughnut about HD radio?)

Too many people in this world need to grow the heck up.

Since I promised light blogging, here’s a nifty little Flash simulation of the Michelson-Morley experiment, one of my all time favorite scientific experiments.

Curiouser and curiouser…

Sunday, August 9th, 2009

Mina Brees, a prominent Austin area lawyer and the mother of Drew Brees, died Friday in Colorado.

I wouldn’t ordinarily note this, but Ms. Brees was the subject of some attention in Austin and Houston prior to her death. A company controlled by Ms. Brees, Chicksports, sent letters to many restaurants in both cities, claiming that the restaurant’s rights to their business names had expired, and the legal rights to the names had been purchased by Chicksports. The letters went on to state that Chicksports would be happy to sell back those rights for $20,000 to $25,000. (Houston Chronicle coverage; Austin American-Statesman coverage.)

The legality of these letters is, to put it mildly, questionable. Ms. Brees’ legal records were under subpoena by the Texas Attorney General at the time of her death. (“Wonderful thing, a subpoena.” Spot the quote, win a cheese.)

Hello feline, hello funtime…

Thursday, August 6th, 2009

By way of Lawrence: Hello Kitty Warhammer 40K miniatures. (Lawrence says he found those while searching for this, which I think came from a FARK Photoshop thread.)

The Texas Monthly “Eat My Words” web log provides a handy list of the burgers covered in their “50 Best Burgers In Texas” article. (The full article is subscriber-only.)

You may ask yourself, how many of the Austin burger places has the SDC been to? Well…

“2. Counter Cafe, Austin, Counter Burger”. Not yet.
12. Cover 3, Austin, Chop-House Burger (with cheese and bacon)“. Not yet; we were actually kind of turned off by Cover 3, as it looks like a high-end (read: expensive) sports bar, which went in one of the SDC Spots Of The Damned. But we could get motivated to try the burger. (Edited to add: we finally got motivated to try the burger. Link goes to review.)
“14. Burger Tex II, Austin, Burgogi Burger”. Been to Burger Tex, were not all that impressed, but did not have the burgogi burger. Lawrence seems unenthusiastic about the prospect of a return visit, so I may have to go on my own. I admit I’m curious.
“16. Max’s Wine Dive, Austin and Houston, Kobe Beef Burger”. Not yet; Max’s Wine Dive is fairly new, and we haven’t scheduled it.
“26. Parkside, Austin, Cheeseburger”. Not yet.
“27. Black Sheep Lodge, Austin, Black Buffalo Burger”. Not yet.
“30. Roaring Fork, Austin, Half Ass Burger (also in San Antonio)”. Been to the Roaring Fork, like it, but have not tried the burger.
“37. Mighty Fine, Austin, Hamburger”. Yes.

Also on the list, but outside of Austin:
“3. Alamo Springs Cafe, Fredericksburg, Cheeseburger (with green chiles on a jalapeno-cheese bun)”. Somewhat off the usual path for us, but not out of the question.
“29. Mel’s Country Cafe, Tomball, Double Hamburger”. I think Lawrence has actually been here.
“38. Roadhouse, Bastrop, Jalapeno Cream Cheese Burger”. See #3.

Clippings: August 5, 2009

Wednesday, August 5th, 2009

The Las Vegas Sun has a nifty story. Guy’s wanted a Stearman biplane since he was 10. He grew up and got married to a woman who shared his dream. But a flying Stearman is expensive (Google leads me to believe that about $120,000 is typical), so they did the next best thing; bought a crashed one off eBay, and began restoring it. (Really. I didn’t know eBay sold planes, much less crashed ones.) The punchline; it turns out that this particular Stearman was used as a trainer by the Tuskegee Airmen, and may be the only one of their trainers that survived.

Meanwhile, the LAT covers the massive Nicaraguan banana worker pesticide lawsuit fraud, and does so in a manner that strikes me as tilting in the direction of the plaintiff’s lawyers; you know, the ones who are accused of perpetrating the fraud. Overlawyered has been doing a pretty good job of covering this suit as well.
(Brief summary: U.S. lawyers got up a whole bunch of lawsuits in U.S. courts alleging that workers on banana plantations were exposed to DBCP, a pesticide that supposedly caused sterility. Only it turns out that many of the plaintiffs never worked on banana plantations, or if they did, were never exposed to DBCP at a level that caused sterility.)

I meant to blog this over the weekend, but forgot to until today. Before I left, there was some discussion in our circle of the NYT “appreciation” of Walter Cronkite, which was embarrassingly error-ridden. The date of the moon landing was wrong (and this was with all the publicity leading up to the 40th anniversary), the date of Martin Luther King’s shooting was wrong (apparently, no one at the NYT listens to U2); if I had written an article with this many errors when I was a high-school journalist, Mrs. Kutsko would have kicked my ass.

Anyway, the NYT “public editor”, Clark Hoyt, addressed the fiasco in his Sunday column. You should go read it; the column is pretty blunt. I’ll pull what I think are a few choice quotes:

The short answer is that a television critic with a history of errors wrote hastily and failed to double-check her work, and editors who should have been vigilant were not.

For all her skills as a critic, Stanley was the cause of so many corrections in 2005 that she was assigned a single copy editor responsible for checking her facts. Her error rate dropped precipitously and stayed down after the editor was promoted and the arrangement was discontinued.

James Rainey at the LAT weighed in today on Hoyt’s column. He even went back and spoke to two previous “public editors”, Byron Calame and Daniel Okrent. More pull quotes from Rainey;

…Byron Calame, who told me that “a lot of New York Times editors don’t feel, in their gut, they have the right to challenge veteran and star reporters and columnists the way they need to.”

In fact, several people who work at the Times told me they are troubled that Stanley is a star whose continued accuracy problems seem to provoke no apparent discipline,

Both of the Times’ former public editors — Daniel Okrent and Calame — told me their critiques produced sharp rebukes from Stanley.

Okrent — who once criticized the critic for tone, not accuracy — remembers her as “extremely defensive and hostile,” while Calame said she attacked him as a nitpicker.

I want to say, “This is the New York Times, the paper of record. You’re supposed to pick nits.” But on second thought, that’s wrong. Journalism is about getting it right; it doesn’t matter if you’re the television critic for the New York Times or covering the Bozeman, Montana city council meetings. Being right – picking nits – is your job.

Smoked strawberries?

Tuesday, August 4th, 2009

As the founder of the Society for the Preservation and Restoration of Classic Cocktails, you would think that I would welcome the resurgence of interest in cocktails, and the growth of a contemporary “cocktail culture”.
Indeed I do. I am glad to see such things as craft bitters and mixers, as well as small-batch liquors. The availability of absinthe and absinthe like substances (other than Pernod) also makes me happy.
But I’m wondering if we’ve gone too far.

For discussion purposes, I direct your attention to the July 2009 Spirit, the Southwest Airlines in-flight magazine. Starting on page 70, we have the “Spirit Guide to Spirits“, which purports to tell you what tools, mixers, and spirits you’ll need to “replicate at home what everyone drank in the ’30s, ’20s, and earlier”. The article also provides helpful recipes from five of “the best mixologists in America”. This list includes Robert Heugel of Anvil Bar and Refuge, a place I’m very interested in trying next time I’m in Houston.

But let’s take a look at the recipes. Heugel’s recipe for the “Border Storm” is probably the least complicated (a mix of dark rum and ginger beer); I think this would probably work well with a good quality commercial or craft ginger beer. Heugel’s recipe, though, calls for preparing your own ginger beer; the process he gives for this takes about three days to complete, including two days of fermentation, and yields about 48 ounces of ginger beer.

Next up, we have something called “Ninety Years of Aviation”, which “goes best with a creme de violette ‘caviar’.” What that involves is freezing a container full of canola oil, preparing a mix of creme de violette, Parfait Amour, lemon juice, and gelatin, placing that mixture into a squeeze bottle, squeezing drops into the cold canola oil to make ‘caviar’, then washing the ‘caviar’ with cold water (to get the oil off, of course). All of this is for something that’s served alongside the drink itself (which is gin, lemon juice, and maraschino liqueur, shaken over ice and strained into a cocktail glass).

After that, we have the “Ramos Gin Fizz Marshmallow”, which appears to be a basic marshmallow recipe, except for added flavors from gin, lemon and lime juice, and orange blossom water. Ever make your own marshmallows? Neither have I. Is there a point to doing marshmallows? What was wrong with the classic Ramos Gin Fizz?

Next, there’s the “Nubo Di Fumo”, which calls for smoking two strawberries “with cherry wood shavings in a stove-top smoker box”. In addition, the “Nubo Di Fumo” also calls for three slices of “oven-dried strawberries, for garnish”. We also have tequila, Galliano, agave nectar, and Banyuls vinegar. Never mind that strawberries are the most overrated of fruits; again, what are we doing here? Is there a point beyond trying to impress people enough so that they’ll pay $11 for a cocktail? (I’m just guessing; the “Nubo Di Fumo” is not on the cocktail menu at Absinthe.)

Finally, we have the “Bacon Old-Fashioned”. Ah, a classic bourbon cocktail. Only in this case, the bourbon isn’t just bourbon; it is bourbon that’s been infused. How? “…pour the (bacon) fat into a large glass jar and add the spirit, then swirl together. Cover and let the mixture sit in a cool, dry place for three days to one week, then refrigerate for 24 hours.” After which you strain off the congealed bacon fat, and you’re left with bacon flavored bourbon. I like my bacon more than the next guy, but seems to me to be an example of “Just because you can do it, doesn’t mean that you should.”

What is wrong with us? Does it take cheap gimmicks like bacon-infused bourbon and fake caviar for us to try the drinks of our fathers?

DEFCON notes: Day 3, or “Killing Priest won’t bring back your G–d–n honey!”

Monday, August 3rd, 2009

Apparently, one of the pools at the Riviera was overrun by killer bees. The fake ATM has been well covered elsewhere.

Final set of quick takes:

RAID Recovery: Recover Your PORN By Sight and Sound”: Technically, a pretty decent presentation on recovering RAID, building on Moulton’s previous presentations on the inner workings of hard drives and their recovery/rebuilding. (Those presentations are linked here: I’m actually pretty interested in the one on SSD drives.)
Key takeaways:

  • Many people don’t understand RAID levels; they think that RAID 0 actually offers some protection against data loss, or there’s no hurry to replace that one drive in the RAID 5 that failed. (The presenter seemed to believe that photographers are particularly bad about these things, perhaps based on bitter personal experience.)
  • If you have a RAID full of pictures, some sub-$100 tools, along with intelligent analysis of reconstructed images, can help you rebuild the array. Even if you don’t know what order the drives were in originally.

“Cracking 400,000 Passwords, Or How To Explain to Your Roomate why the Power Bill Is a Little High” (preview): Or, how to use John the Ripper, and how to optimize your JtR runs.
Key takeaway: Lists of previously cracked passwords are good fodder for JtR. Would you believe people use the same password on more than one site? Even better, you can use lists of previously cracked passwords to build JtR word mangling rules.

People who deserve a “Thank You” (part 1 of an ongoing series)

Monday, August 3rd, 2009

Joseph Hall, for his excellent set of instructions on setting up WireShark under OS X.

Dining in Las Vegas 2009

Monday, August 3rd, 2009

So where did I eat while I was in Las Vegas?

Well, I had a great meal Thursday night at Lotus of Siam, one of my favorite restaurants in the world.

Breakfast on Friday morning was at Blueberry Hill on Flamingo, one of the locations of a very good local chain. Friday night dinner was at a place called Himalayan Cuisine, also on Flamingo, which serves Nepalese, Tibetan, and Indian food; the lamb Sekuwa was quite good.

Saturday night, I decided to try one of the local oddities (at least, I think this is local; I haven’t run across it in Austin or any other cities); all you can eat sushi, in this case at Yami Sushi, also on Flamingo. (Are you detecting a trend here?) Decent sushi at a reasonable price (about $23 for the all-you-can-eat option). However, there’s an extra charge if you don’t eat the rice, there’s an extra charge if you don’t clean your plate…I was slightly put off.

Sunday breakfast: The Egg and I, one of two locations of a local family-run chain. The egg puns are a little tiresome, but the food is wonderful; this gets an official Whipped Cream Difficulties endorsement. (Try the Collision Course; it will keep you going all day long.)

Sunday dinner: I was a little disappointed by the Tillerman last year, and tried to come up with a better idea. However, I couldn’t, the closing ceremonies ran long, and…well, I ended up back there again this year. Good thing; they’ve added a new “Monthly Specials” menu (not on their website), and the rainbow trout with a honey/citrus sauce was very good, and a steal at $22 (including mashed potatoes and the Tillerman’s massive “salad bar”).

DEFCON notes: Day 2

Monday, August 3rd, 2009

Saturday was a little calmer than Friday from my perspective. Part of the reason for that may have been Adam Savage‘s talk (and the meet and greet afterwards) took a lot of folks out of circulation for two or three hours. (I didn’t go.)

More quick takes:

“Hacker vs. Disasters Large & Small”: Michael Schearer, who did the first part of the presentation, also did the Hacker In Iraq presentation. As a Naval officer, he went through SERE school, so he’s got some hands-on survival experience which makes him worth paying attention to. Schearer’s part of the presentation basically covered short-term wilderness survival (as in, “I’m cold and there are wolves after me.“) and was more practical. Renderman’s half of the presentation was a more long-term, “How do we survive and rebuild society after the Big One?”, philosophical presentation. (Edited to add: links to the final versions of the slides; Part 1, Part 2.)
Key takeaways:

  • “Hacker skills are largely compatible with the skills necessary to survive in the wilderness or during a natural disaster.”
  • “Don’t be squeamish about breaking or destroying something to help you stay alive.”
  • “You are not Jack Bauer, MacGuyver, or Survivorman; you need practice to survive.”

“Personal Survival Preparedness”: Nice guy, okay talk, mostly dealing with survival in an urban environment after some devastating event (Katrina or worse).

“Picking Electronic Locks Using TCP Sequence Prediction”: Excellent presentation, short, and scary. Brief summary: many electronic lock systems are IP based and the traffic on the network is not encrypted. This makes the locks vulnerable to a man-in-the-middle attack (to capture an unlock command) and a replay attack with a spoofed TCP sequence number (to replay the command). These attacks bypass the existing control software, so the spoofed unlock command leaves no audit trail. The author is a network admin at Texas State University; woo hoo! Greater Austin/San Marcos Metropolitan Area represent!

Sniff Keystrokes With Lasers/Voltmeters”: Two pretty amusing guys with another excellent presentation. In the first half, they presented an attack on PS/2 keyboards with very simple hardware; all you need is a slightly hacked power cord connected to a common circuit with the computer in question on one end, and an ADC plus a micro-controller (for data acquisition, filtering, and storage) on the other and viola! In the second half, they outlined a acoustic-based attack that builds on previous research, combined with microphone hardware using freaking laser beams. As the authors said, “How cool is that?”
Key takeaway: “girls will melt when you show this…”

“Bluetooth, Smells Like Chicken”: Pretty much what I expected from the summary. Using software-defined radio gear (about $1000) you can monitor the Bluetooth frequencies. Bluetooth does frequency hopping over about 79 MHz, and the software-defined radio gear can only monitor about 25 MHz (max) at one time. But you can monitor one channel and use information from that packet to actually predict the frequency hopping cycle. The authors also presented a technique that allows aliasing of the entire Bluetooth spectrum to the 25 MHz available in the radio gear they were using without compromising the ability to extract packets. Finally, they discussed Bluetooth attacks using off-the-shelf sub-$10 hardware to sample and inject data.

Key takeaway: there is no longer any such thing as a non-discoverable Bluetooth device.

DEFCON notes: Day 1

Sunday, August 2nd, 2009

I’ve been running a little behind on these, but I’m trying to catch up. I’m also going to try to insert links to the actual presentations as they go up.

Quick takes:

“Is your IPhone Pwned?”: This was turned into a more general talk about the whole class of smartphones, including Windows mobile devices. They demonstrated one exploit that involves settings on Windows devices from some vendors. (Basically, the exploit involves misconfigured security settings that allow a remote computer to send malicious WAP push messages that the phone will accept.) Patching mobile vulnerabilities is difficult; there’s a lot of QA issues that have to be dealt with by each vendor for each platform, plus the FCC gets involved if you touch the radio code. Beyond that, the presenters spent a lot of time discussing the design of their Fuzzit tool for finding phone vulnerabilities. Key takeaway: the state of mobile security today is roughly equivalent to the state of network security as of 1999.

“Hacking With the iPod Touch”: Key takeaways:

  • There’s a lot of tools available for penetration testing on the iPod Touch if you’re willing to jailbreak the device. (Wilhelm’s presentation includes a long list of available tools. Did you know that you can run Perl, Python, and Ruby on the iPod Touch? Neither did I.)
  • Nobody gets suspicious if they see you fiddling with your iPod Touch. A full-sized laptop, or even a netbook, might be a different matter.

“That Awesome Time I Was Sued For Two Billion Dollars”: Jason Scott is a pretty good speaker, but this was sort of a “meh” talk. “Yeah, I got sued for two billion dollars by someone who is apparently mentally unbalanced (in the speaker’s opinion -DB) and the case got thrown out of court.” Key take away: Don’t let yourself be intimidated by legal (or legal-looking) documents.

“Three Point Oh”: Couldn’t get in to see Long’s talk.

“Something About Network Security”: Kaminsky’s talk this year concentrated on vulnerabilities in the PKI infrastructure, and specifically certificate attacks. I still think Kaminsky is the cat’s pajamas, but his talk this year seemed a bit off, compared to some of his previous talks (for example, the tunneling data over DNS hack).

I heartily endorse this event or product.

Saturday, August 1st, 2009

Pico, makers of fine FPGA development boards.

I haven’t actually worked with any of their products (though learning more about FPGAs is on my list of things I’d like to do) but the people they sent to DEFCON 17 were very nice. I even got two of their “business” cards.

IMG_0318

Someone’s getting one of these as a slightly late birthday present.