Archive for August, 2013

TMQ Watch: August 13, 2013.

Friday, August 16th, 2013

We were trying to come up with a clever introduction to the return of Tuesday Morning Quarterback (and, thus, the TMQ Watch) but we couldn’t. On the other hand, we were also suffering from a bad case of 70s nostalgia (brought about by many things, but exacerbated by the death of Bert Lance). So we thought we’d throw some vintage music your way before cracking open this week’s TMQ after the jump. Oddly enough, it turns out to be fitting for reasons we’ll see later on…

(more…)

Random notes: August 16, 2013.

Friday, August 16th, 2013

Mark Sutton, best known as “that guy dressed as James Bond who parachuted out of a helicopter during the 2012 Olympic opening ceremonies”, died yesterday while piloting a wingsuit in Switzerland.

Also among the dead: Barbara Mertz, noted author, Mystery Writers of America Grand Master, and Egyptologist. You may perhaps know her better as “Elizabeth Peters” and “Barbara Michaels”. (Oddly enough, I don’t own any Peters or Michaels books, but I think I have a copy of Temples, Tombs and Hieroglyphs.)

And Bert Lance. Remember Bert Lance? Remember the Carter administration? Bank of Credit and Commerce International?

In later years, he spent increasing amounts of time at his 500-acre hilltop estate near Calhoun called Lancelot, where he cultivated his beloved rose garden and consulted for trucking and carpet companies and informally for Democrats. One side of his large home was built to resemble the White House, the other George Washington’s Mount Vernon.

That sounds like something out of a Ross Thomas novel.

For 15 years, some of the art world’s most established dealers and experts rhapsodized about dozens of newly discovered masterworks by titans of Modernism. Elite buyers paid up to $17 million to own just one of these canvases, said to have been created by the hands of artists like Jackson Pollock, Willem de Kooning, Mark Rothko, Franz Kline and Robert Motherwell.

The punchline: all of those paintings were done by one guy in a garage in Queens.

(Speaking of art, this has already been on FARK, but I do want to note it here for the “Art, damn it! art watch”:

High court rules that Germans can once again give Nazi salutes while feeling up the breasts of an armless mannequin wearing an alien mask

I also want to make note of it because that’s one of the rare FARK headlines that’s pretty much accurate. If you have any doubts, click through to the article and look at the photo.)

(“a dictatorship of art”?)

(Apropos nothing in particular.)

That time of year.

Thursday, August 15th, 2013

New NFL season. New Tuesday Morning Quarterback. TMQ Watch to resume soonish.

Noted.

Thursday, August 15th, 2013

The 5th edition of Learning Python is out.

Since I am not an idiot, I bought the ebook; doing so is easier both on my wallet and on my back. I started reading it and working through the examples last night.

Quoth Chapter 1, under “Who uses Python today?”:

The IronPort email server product uses more than 1 million lines of Python code to do its job.

I can only smile and say “No. Comment.

And a few bullet points later:

The NSA uses Python for cryptography and intelligence analysis.

So remember, folks: the NSA is spying on you, but they’re doing it with open source software. Doesn’t that make you feel better?

(Yes, yes, I’m sure the NSA also uses Perl and Java and Visual Basic and FORTH and even internally developed languages that are still classified. I just found it funny, is all.)

Random notes: August 14, 2013.

Wednesday, August 14th, 2013

Ford stopped making the police variant of the Crown Victoria in 2011. We’re now in 2013, and police departments are starting to retire the last of the Crown Vics.

Law enforcement is a practical, left-brain business of protocol and procedure. But a discussion of the Crown Vic brings out a romantic side. The traditions and symbols of life behind the badge become intertwined with its tools. Two tons of rear-wheel drive and a V-8 engine up front made for a machine that could feel safe at any speed, a reliable nonhuman partner when things got crazy.

I have flirted from time to time with the idea of purchasing a former cop car as a backup vehicle. (“It’s got a cop motor, a 440 cubic inch plant, it’s got cop tires, cop suspensions, cop shocks.”) Problem is, the state surplus store wants nearly $6K for used DPS cars; at that price, I could go get a used Miata or Outback instead.

The 1933 double eagle is on display at the New York Historical Society. I’ve written previously about the strange history of the 1933 double eagle, and the linked NYT article contains a good summary, too.

If you have nothing to hide, why do you object to being stopped and frisked by the police being recorded by a camera?

Yet another reason why Rosemary Lehmberg should resign.

Well, what do you know?

Monday, August 12th, 2013

Whitey Bulger: guilty of 11 murders.

Boston.com:

The jury found that the prosecution had proved that Bulger murdered Paul McGonigle, Edward Connors, Thomas King, Richard Castucci, Roger Wheeler, Brian Halloran, Michael Donahue, John Callahan, Arthur “Bucky” Barrett, John McIntyre, and Deborah Hussey.

It returned a “no finding” in the murder of Debra Davis, and decided that the prosecution had NOT proved that Bulger murdered members of the Notorangeli group, Michael Milano, Al Plummer, William O’Brien, James O’Toole, Al Notorangeli, James Sousa, and Francis “Buddy” Leonard.

He was also found guilty of “…two counts of racketeering, six acts of extortion, as well as narcotics distribution, money laundering, and illegal firearms charges.”

I would link to the Boston Globe coverage, but they’ve put it behind a paywall, so to heck with them.

And even more DEFCON 21 links: August 9, 2013.

Friday, August 9th, 2013

Obit watch: August 9, 2013.

Friday, August 9th, 2013

Your Karen Black obit roundup: NYT. LAT. A/V Club.

I don’t do Facebook, but here’s The Voluptuous Horror of Karen Black’s Facebook page.

Random notes: August 8, 2013.

Thursday, August 8th, 2013

More Leicas!

I’m not all that interested in the digital Leicas, though. The Leicas I drool over are the vintage film ones. Yes, I shoot digital, but I still have a secret fondness for film and certain film cameras.

“Leica makes a lens the way it should be made, with metal and glass, while everyone else is making plastic lenses that are meant to be thrown away in a couple of years,” said Ken Rockwell, a photographer and expert on cameras and lenses. “The Leica lenses are so special because they are smaller, faster and sharper.”

Leica’s lenses can vary in price from $1,650 for the Leica 50mm f/2.5 Summarit-M, to the Leica 50mm f/0.95 Noctilux-M, which costs $10,950. Once you have recovered from seeing the price of the Noctilux-M, keep in mind it is considered one of the best low-light lenses in the world and has such a wide aperture it can shoot almost in darkness.

Speaking of low-light lenses, I’ve been wanting to link this:

In the 1960s, NASA commissioned Carl Zeiss to develop a set of extremely large aperture lenses to capture images of the dark side of the moon in its Apollo missions. The company ended up creating 10 Carl Zeiss f/0.7 lenses. Six were sold to NASA, one was kept by Carl Zeiss, and three of them were sold to filmmaker Stanley Kubrick.

Kubrick used those lenses to shoot scenes lit only by candlelight in Barry Lyndon (which, I have to admit, I haven’t seen yet: I’ve often heard it called “Boring London”, but it is one of those movies I feel obligated to see). Anyway, these lenses still exist, and you can rent them along with a camera modified to take the lenses if you really need to shoot something in very very low light.

The family of Henrietta Lacks has made a deal with the National Institute of Health:

…the data from both studies should be stored in the institutes’ database of genotypes and phenotypes. Researchers who want to use the data can apply for access and will have to submit annual reports about their research. A so-called HeLa Genome Data Access working group at the N.I.H. will review the applications. Two members of the Lacks family will be members. The agreement does not provide the Lacks family with proceeds from any commercial products that may be developed from research on the HeLa genome.

This is kind of a big deal, for reasons outlined in the NYT article. The very short version: Ms. Lacks died of cancer in 1951. Scientists discovered that cells from her cancer were able to survive in lab environments, and those cells have been used in research since her death. However, her family was never compensated for the use of her cells, and didn’t even know her cells were being used until many years later.

The above is a very simplified version of the story. The Immortal Life of Henrietta Lacks by Rebecca Skloot (which is mentioned in the NYT article) is an excellent book about Ms. Lacks, her cells and their use in research, the family of Ms. Lacks, and the ethical questions involved. If you have not read it, and have any interest in bioethics, I commend it to your attention.

DEFCON 21 updates: August 7, 2013 (part 2)

Wednesday, August 7th, 2013

I actually thought I’d published the first update last night, but I got up this morning and found out I hadn’t.

Oh, well.

Anyway, Wesley McGrew and I have been carrying on a pleasant correspondence by email, and he’s graciously allowed me to host the preliminary version of his presentation, “Pwn The Pwn Plug: Analyzing and Counter-Attacking Attacker-Implanted Devices” here until he gets the final version uploaded. You can download the ZIP archive which contains the white paper, slides, and code here.

(By the way, Mr. McGrew is a heck of a nice guy.)

Grammer Nazi.

Wednesday, August 7th, 2013

Headline and lead of a story on the Statesman web site: actual story is behind their paywall.

Pioneering egg farmer, organic feed mill founder dies

Jeremiah “Jerry” Cunningham, who founded the state’s first and only organic feed mill, Coyote Creek Organic Feed Mill and Farm, and the eponymous World’s Best Egg company, died Tuesday at the age of 76.

Now, I’m sure Mr. Cunningham was a nice guy, and liked his chickens. But: here’s the definition of the word “eponymous”:

of, relating to, or being the person or thing for whom or which something is named : of, relating to, or being an eponym

How is “World’s Best Egg Compay” eponymous? Do I not understand the definition? Am I missing something?

More DEFCON 21: August 7, 2013.

Wednesday, August 7th, 2013

Bookity bookity bookity.

Tuesday, August 6th, 2013

Two more things that I wanted to bookmark:

Peteris Krumins’ “A Unix Utility You Should Know About: Netcat“. Actually, I want to bookmark his entire site, as there’s a lot of good stuff there, including “Low Level Bit Hacks You Absolutely Must Know“.

Also: Michael Ossmann’s HackRF Kickstarter, which is fully funded and has 29 days to go. This is a project I’m really excited about and will probably end up backing. Short version: HackRF is a project to build a software defined radio that is about the size of a USB hard drive, runs off of USB bus power…and if you back the project (and if it ships, this being Kickstarter and all), the cost is around $300, which puts it into “Shut up and take my money” territory.

Random notes: August 6, 2013.

Tuesday, August 6th, 2013

Thinking about the WP sale some more:


We must do something about the deadly killer trees!
(See also.)

To celebrate his birthday, the Andy Warhol Museum in Pittsburgh is presenting live-streaming around-the-clock video of two key venues: the church where Warhol was baptized and the grave where he is buried, both in Pennsylvania.

(Insert joke about “Empire” here.)

DEFCON 21 update: August 5, 2013.

Monday, August 5th, 2013

Yeah, I know, I’ve been quiet. Much of Friday’s blogging time was eaten by Bluehost instability, and Saturday and Sunday were busy.

But I do have some updates and links.

I’m going to cut things off here for right now. I’m still trying to find links to some of the other presentations I mentioned (in particular, I’d love a link of some sort to Anch’s “Pentesters Toolkit” if anyone has one) and will post updates as they come in. Depending on what I dig up, there may be a second post tomorrow. In the meantime, this should keep you busy.

Holy crap!

Monday, August 5th, 2013

Breaking news: the Washington Post has been sold.

To Jeff Bezos. Yeah, that Jeff Bezos.

For $250 million in cash. First reaction: the WP was only worth that much?

Second reaction: is this part of some grand Amazon content strategy? Well…

Seattle-based Amazon will have no role in the purchase; Bezos himself will buy the news organization and become its sole owner when the sale is completed, probably within 60 days. The Post Co. will change to a new, still-undecided name and continue as a publicly traded company without The Post thereafter.

Or, to put it another way: reply hazy, ask again later.

More DEFCON 21 stuff.

Friday, August 2nd, 2013

I’ve added the Twitter feeds for everyone who has one published in the schedule, and who was mentioned in my previous post.

I’m going to try to keep an eye on these so I know when folks post their presentations. If there’s someone or something on the schedule who isn’t on my list that you’re interested in, drop me a line and I’ll add them.

DEFCON 21, BlackHat, and related stuff: August 2, 2013.

Friday, August 2nd, 2013

The questions ask themselves:

Trustwave SpiderLabs Security Advisory TWSL2013-020:
Hard-Coded Bluetooth PIN Vulnerability in LIXIL Satis Toilet

Did that say “toilet”?

The Satis is a “smart” toilet. It is controlled using LIXIL’s “My Satis” Android application, which communicates with the toilet using Bluetooth.

Yes. Yes, it did. A toilet with an Android application. And a hardcoded Bluetooth PIN of “0000”.

An attacker could simply download the “My Satis” application and use it to cause the toilet to repeatedly flush, raising the water usage and therefore utility cost to its owner.
Attackers could cause the unit to unexpectedly open/close the lid, activate bidet or air-dry functions, causing discomfort or distress to user.

I have no joke here, I just like saying “discomfort or distress to user”.

On a more serious note, Borepatch has a post up about one of the Black Hat presentations. The math is a little over my head, but the short version is that there’s been a lot of progress made recently in the mathematics that underpin some of the fundamental cryptography used to secure the Internet. According to the presenters:

There is a small but real chance that both RSA and non ECC DH will soon become unusable.

The link above will take you to a PDF of the presentation from Black Hat. Worth noting: Thomas Ptacek is one of the people behind this.

I’m trying to find copies of the presentations I’m interested in; as I dig stuff up and have time, I’ll post links, but I’m not having a lot of luck right now.

More bookmarks.

Thursday, August 1st, 2013

Thanks to Joe D. for the SQL injection by automobile photo in the earlier post.

Something else I happened to stumble across, while reading a Stack Overflow thread (“We have an employee whose last name is Null. He kills our employee lookup application when his last name is used as the search term (which happens to be quite often now).”). There’s a website devoted to preventing SQL injection.

Is that unusual? No. But the URL sent me into giggling fits. My hat is off to the folks behind this site.

Something else I’ve been meaning to link, and which Tom Ritter’s Twitter feed reminded me about: “Applied Cryptography Engineering“.

Applied Cryptography is a deservedly famous book that lies somewhere between survey, pop-sci advocacy, and almanac. It taught two generations of software developers everything they know about crypto. It’s literate, readable, and ambitious. What’s not to love?
Just this: as an instruction manual, Applied Cryptography is dreadful.

Applied Cryptography was an important book for me, and I don’t have the chops that would allow me to intelligently criticize Schneier or Thomas Ptacek. But even I have to admit that AC is almost twenty years old; that’s two or three lifetimes in cryptography. (Also, that makes me…f’ing old.)

Random notes: August 1, 2013.

Thursday, August 1st, 2013

Look, I don’t like drunk drivers. I don’t like drunk drivers who kill people while driving drunk. If I had my way, they’d be charged with murder.

That said, there’s something wrong with this WP editorial arguing that a bar should bear responsibility for the death of a ten-year-old girl “who liked dogs, horses and dancing”. (Would it have been less tragic if she hated horses?)

They also knew something was wrong when Michael D. Eaton downed 17 bottles of the Mexican brew, plus a shot of vodka, in about five hours. It was too much.

So that’s 18 drinks in five hours, or 3.6 drinks an hour on average. The WP doesn’t tell us how much Mr. Eaton weighed, or whether his drinks were evenly distributed over the five hours (as opposed to him being there for 4:30, and then slamming down 17 Coronas and a shot in the last half hour). But assuming he weighed 200 pounds, and the drinks were evenly distributed…according to this chart, he’d be right on the borderline between 0.06 and 0.08. I’m not convinced that’s the sort of visibly drunk that would make the bar responsible for letting him leave.

(It is interesting that none of the articles on this case specify Mr. Eaton’s BAC, but perhaps that has something to do with the fact that he fled the scene and turned himself in 12 hours later. It is also interesting that the WP editorial blaming the bar doesn’t mention Mr. Eaton’s “previous convictions for drunk driving, reckless driving, selling marijuana and speeding “.)

In other news, the Austin PD fired another officer. The twist here is that the fired officer was already on probation and had been suspended for “temporarily ignoring a dispatch and disengaging the tracking system in his patrol car for just over twenty minutes”: even after being placed on probation and suspended, he still turned off the tracking system (and apparently the cameras) in his patrol car another 60 times.

Obit watch: Noted Texas writer John Graves. At some point, I need to read Goodbye to a River.

Speaking of Las Vegas, people are coming back. But they aren’t gambling as much, or spending as much money on other things.

And speaking of DEFCON/Black Hat: WP coverage of the NSA director’s speech.

I’m hoping for some good coverage of Black Hat/DEFCON from Brian Krebs, who, by the way, has an interesting tale to tell:

Earlier this month, the administrator of an exclusive cybercrime forum hatched and executed a plan to purchase heroin, have it mailed to my home, and then spoof a phone call from one of my neighbors alerting the local police.

(Also, credit card and PIN skimmers just keep getting better and better.)