Your Karen Black obit roundup: NYT. LAT. A/V Club.
I don’t do Facebook, but here’s The Voluptuous Horror of Karen Black’s Facebook page.
Obit watch: August 9, 2013.
August 9th, 2013Random notes: August 8, 2013.
August 8th, 2013I’m not all that interested in the digital Leicas, though. The Leicas I drool over are the vintage film ones. Yes, I shoot digital, but I still have a secret fondness for film and certain film cameras.
Speaking of low-light lenses, I’ve been wanting to link this:
Kubrick used those lenses to shoot scenes lit only by candlelight in Barry Lyndon (which, I have to admit, I haven’t seen yet: I’ve often heard it called “Boring London”, but it is one of those movies I feel obligated to see). Anyway, these lenses still exist, and you can rent them along with a camera modified to take the lenses if you really need to shoot something in very very low light.
The family of Henrietta Lacks has made a deal with the National Institute of Health:
This is kind of a big deal, for reasons outlined in the NYT article. The very short version: Ms. Lacks died of cancer in 1951. Scientists discovered that cells from her cancer were able to survive in lab environments, and those cells have been used in research since her death. However, her family was never compensated for the use of her cells, and didn’t even know her cells were being used until many years later.
The above is a very simplified version of the story. The Immortal Life of Henrietta Lacks
DEFCON 21 updates: August 7, 2013 (part 2)
August 7th, 2013I actually thought I’d published the first update last night, but I got up this morning and found out I hadn’t.
Oh, well.
Anyway, Wesley McGrew and I have been carrying on a pleasant correspondence by email, and he’s graciously allowed me to host the preliminary version of his presentation, “Pwn The Pwn Plug: Analyzing and Counter-Attacking Attacker-Implanted Devices” here until he gets the final version uploaded. You can download the ZIP archive which contains the white paper, slides, and code here.
(By the way, Mr. McGrew is a heck of a nice guy.)
Grammer Nazi.
August 7th, 2013Headline and lead of a story on the Statesman web site: actual story is behind their paywall.
Pioneering egg farmer, organic feed mill founder dies
Jeremiah “Jerry” Cunningham, who founded the state’s first and only organic feed mill, Coyote Creek Organic Feed Mill and Farm, and the eponymous World’s Best Egg company, died Tuesday at the age of 76.
Now, I’m sure Mr. Cunningham was a nice guy, and liked his chickens. But: here’s the definition of the word “eponymous”:
How is “World’s Best Egg Compay” eponymous? Do I not understand the definition? Am I missing something?
More DEFCON 21: August 7, 2013.
August 7th, 2013- Haven’t found anything yet from the Tom Ritter/Doug DePerry femtocell talk, but Tom Ritter does have slides and speaker notes up for another of his DEFCON 21 talks, “De-Anonymizing Alt.Anonymous.Messages”.
- Ryan Holeman has his slides and code from “The Bluetooth Device Database” up here. He also has a blog post that might add a bit more context to the slides.
- Slides from Karl Koscher and Eric Butler’s talk, “The Secret Life of SIM Cards” are available here, and there’s a bunch more resources in that repository.
- Slides from the Eric Robi/Michael Perklin talk, “Forensic Fails”, are here.
Bookity bookity bookity.
August 6th, 2013Two more things that I wanted to bookmark:
Peteris Krumins’ “A Unix Utility You Should Know About: Netcat“. Actually, I want to bookmark his entire site, as there’s a lot of good stuff there, including “Low Level Bit Hacks You Absolutely Must Know“.
Also: Michael Ossmann’s HackRF Kickstarter, which is fully funded and has 29 days to go. This is a project I’m really excited about and will probably end up backing. Short version: HackRF is a project to build a software defined radio that is about the size of a USB hard drive, runs off of USB bus power…and if you back the project (and if it ships, this being Kickstarter and all), the cost is around $300, which puts it into “Shut up and take my money” territory.
Random notes: August 6, 2013.
August 6th, 2013Thinking about the WP sale some more:
- I don’t think I was clear in my implication yesterday. Yes, the reports are that Bezos is going to run it as an independent company, instead of an arm of Amazon. I question how long that’s going to last: does Bezos want to be Charles Foster Kane? (Not that there’s anything wrong with that.) Or is he playing a long game here?
- Interesting point from the NYT: the sale does not include Slate (or The Root and Foreign Policy). I wonder how much longer Slate has.
We must do something about the deadly killer trees! (See also.)
(Insert joke about “Empire” here.)
DEFCON 21 update: August 5, 2013.
August 5th, 2013Yeah, I know, I’ve been quiet. Much of Friday’s blogging time was eaten by Bluehost instability, and Saturday and Sunday were busy.
But I do have some updates and links.
- Slides for Benjamin Caudill’s “Offensive Forensics – CSI for Bad Guys” are here. See also his post on the Rhino Security Labs blog.
- Amber Baldet has a post up with links to the slides from her “Suicide Risk Assessment & Intervention Tactics” talk, and some additional resources. I’m not on Twitter, so I can’t add to the support she’s been getting there. But I will say, again: thank you, Amber, for doing this.
- Amir Etemadieh and the other Google TV hackers have a page up at the GTVHacker site with slides and resources from their DEFCON 21 presentation, “Google TV or: How I Learned to Stop Worrying and Exploit Secure Boot”. There is also a blog entry that (I think) gives a little more context to the slides.
- Dan Crowley, David Bryan, and Jennifer Savage have slides, a white paper, and sample code from their presentation at Black Hat, “Home Invasion 2.0 – Attacking Network-Controlled Consumer Devices” up at the Black Hat site. From the descriptions, I assume tha the DEFCON 21 version is very similar to the Black Hat one.
- Chris Valasek and Charlie Miller have a blog entry up at IOActive with links to the content and their white paper on “Adventures in Automotive Networks and Control Units”.
- The LMG Security blog has a post up with links to the white paper and source code from the Sherri Davidoff/Randi Price/David Harrison/Scott Frethem talk, “Do-It-Yourself Cellular IDS”.
- Ryan W. Smith has a post up at the Lookout blog about the talk he did with Tim Strazzere, “DragonLady: An Investigation of SMS Fraud Operations in Russia”. That post, in turn, links to the white paper summarizing their presentation.
- I haven’t found the DEFCON slides for Joseph Paul Cohen’s “Blucat: Netcat For Bluetooth” presentation yet. But here’s the Blucat SourceForge page, which includes slides from a couple of other conferences, and the source code, and Mac OS X binaries for 10.6 and 10.8. Wow. I got more than what I asked for. (Edited to add 8/6: Mr. Cohen has added the DEFCON 21 slides. Praise be unto him, and may flights of angels sing him to sleep.)
- The slides for Aaron Bayles’ “Oil and Gas Infosec 101” talk are here.
I’m going to cut things off here for right now. I’m still trying to find links to some of the other presentations I mentioned (in particular, I’d love a link of some sort to Anch’s “Pentesters Toolkit” if anyone has one) and will post updates as they come in. Depending on what I dig up, there may be a second post tomorrow. In the meantime, this should keep you busy.
Holy crap!
August 5th, 2013Breaking news: the Washington Post has been sold.
To Jeff Bezos. Yeah, that Jeff Bezos.
For $250 million in cash. First reaction: the WP was only worth that much?
Second reaction: is this part of some grand Amazon content strategy? Well…
Or, to put it another way: reply hazy, ask again later.
More DEFCON 21 stuff.
August 2nd, 2013I’ve added the Twitter feeds for everyone who has one published in the schedule, and who was mentioned in my previous post.
I’m going to try to keep an eye on these so I know when folks post their presentations. If there’s someone or something on the schedule who isn’t on my list that you’re interested in, drop me a line and I’ll add them.
DEFCON 21, BlackHat, and related stuff: August 2, 2013.
August 2nd, 2013The questions ask themselves:
Did that say “toilet”?
Yes. Yes, it did. A toilet with an Android application. And a hardcoded Bluetooth PIN of “0000”.
I have no joke here, I just like saying “discomfort or distress to user”.
On a more serious note, Borepatch has a post up about one of the Black Hat presentations. The math is a little over my head, but the short version is that there’s been a lot of progress made recently in the mathematics that underpin some of the fundamental cryptography used to secure the Internet. According to the presenters:
There is a small but real chance that both RSA and non ECC DH will soon become unusable.
The link above will take you to a PDF of the presentation from Black Hat. Worth noting: Thomas Ptacek is one of the people behind this.
I’m trying to find copies of the presentations I’m interested in; as I dig stuff up and have time, I’ll post links, but I’m not having a lot of luck right now.
More bookmarks.
August 1st, 2013Thanks to Joe D. for the SQL injection by automobile photo in the earlier post.
Something else I happened to stumble across, while reading a Stack Overflow thread (“We have an employee whose last name is Null. He kills our employee lookup application when his last name is used as the search term (which happens to be quite often now).”). There’s a website devoted to preventing SQL injection.
Is that unusual? No. But the URL sent me into giggling fits. My hat is off to the folks behind this site.
Something else I’ve been meaning to link, and which Tom Ritter’s Twitter feed reminded me about: “Applied Cryptography Engineering“.
Applied Cryptography
Random notes: August 1, 2013.
August 1st, 2013Look, I don’t like drunk drivers. I don’t like drunk drivers who kill people while driving drunk. If I had my way, they’d be charged with murder.
That said, there’s something wrong with this WP editorial arguing that a bar should bear responsibility for the death of a ten-year-old girl “who liked dogs, horses and dancing”. (Would it have been less tragic if she hated horses?)
So that’s 18 drinks in five hours, or 3.6 drinks an hour on average. The WP doesn’t tell us how much Mr. Eaton weighed, or whether his drinks were evenly distributed over the five hours (as opposed to him being there for 4:30, and then slamming down 17 Coronas and a shot in the last half hour). But assuming he weighed 200 pounds, and the drinks were evenly distributed…according to this chart, he’d be right on the borderline between 0.06 and 0.08. I’m not convinced that’s the sort of visibly drunk that would make the bar responsible for letting him leave.
(It is interesting that none of the articles on this case specify Mr. Eaton’s BAC, but perhaps that has something to do with the fact that he fled the scene and turned himself in 12 hours later. It is also interesting that the WP editorial blaming the bar doesn’t mention Mr. Eaton’s “previous convictions for drunk driving, reckless driving, selling marijuana and speeding “.)
In other news, the Austin PD fired another officer. The twist here is that the fired officer was already on probation and had been suspended for “temporarily ignoring a dispatch and disengaging the tracking system in his patrol car for just over twenty minutes”: even after being placed on probation and suspended, he still turned off the tracking system (and apparently the cameras) in his patrol car another 60 times.
Obit watch: Noted Texas writer John Graves. At some point, I need to read Goodbye to a River
Speaking of Las Vegas, people are coming back. But they aren’t gambling as much, or spending as much money on other things.
And speaking of DEFCON/Black Hat: WP coverage of the NSA director’s speech.
I’m hoping for some good coverage of Black Hat/DEFCON from Brian Krebs, who, by the way, has an interesting tale to tell:
(Also, credit card and PIN skimmers just keep getting better and better.)
DEFCON 21: -1 day notes.
July 31st, 2013Just because I’m not going to DEFCON 21 doesn’t mean I can’t try to cover it. From 1,500 miles away. Sort of half-assedly.
DEFCON hasn’t even started yet, but Black Hat is going on, and some stuff is coming out. The biggest story so far has been Barnaby Jack’s death. I haven’t mentioned it previously because I’ve felt like it was well covered elsewhere (even FARK).
Another “big” (well, I think it is) story that I haven’t seen very much coverage of is the phone cracking bot. Justin Engler (@justinengler on Twitter) and Paul Vines, according to the synopsis of their talk and the linked article, built a robot for under $200 that can brute force PINs. Like the one on your phone.
This is one I’ll be keeping an eye on.
Borepatch is in Vegas this year, attending both Black Hat and DEFCON. He’s got a couple of posts up: a liveblog of the NSA director’s presentation at Black Hat, and another post about the links between black hats and political candidates.
So the DEFCON schedule is up. If I was going, what would get me excited? (I’ve included the Twitter handles of the speakers from the DEFCON 21 schedule information; I figure this gives a central source for looking up someone’s feed and getting copies of their presentation.)
From Thursday’s talks: I’d probably go to “Hacker Law School“, as I’m a frustrated wanna-be lawyer anyway. Why not?
Anch’s (@boneheadsanon) “Pentesters Toolkit” talk makes my heart skip a beat:
Push some more of my buttons, please.
The Aaron Bayles (@AlxRogan) “Oil and Gas Infosec 101” talk kind of intrigues me, but it would depend on my mood at the time as to whether I went to that one, or skipped out for a break.
Likewise with the Beaker and Flipper talk on robot building: yeah, robot building is something I’m interested in doing, but I might just be in a mood to visit the Atomic Testing Museum instead, and read your slides later. Nothing personal: I’m sure it will be a great talk.
I’m intrigued by the ZeroChaos (@pentoo_linux) panel on the Pentoo LINUX distribution for penetration testing. I’m not sure how that differs from, say, BackTrack, but I’d probably show up just so I could find out.
The “Wireless Penetration Testing 101 & Wireless Contesting” talk by DaKahuna and Rick Mellendick (@rmellendick) hits yet another of my hot buttons. I can’t tell from the description how much of this is going to be describing contests in the Hacker Village, and how much will be practical advice, but I’d show up anyway.
That takes us into Friday. Just from a preliminary look at the schedule, it looks like the big thing this year is hacking femtocells. Doug DePerry (@dugdep) and Tom Ritter (@TomRitterVG) are doing a talk on “I Can Hear You Now: Traffic Interception and Remote Mobile Phone Cloning with a Compromised CDMA Femtocell”:
The Charlie Miller (@0xcharlie) and Chris Valasek (@nudehaberdasher) talk, “Adventures in Automotive Networks and Control Units“, sounds interesting as well. I’m just slightly more interested in femtocells than automotive hacking, so apologies to Mr. Miller and Mr. Valasek: if the two weren’t in conflict, I’d hit your talk for sure.
And if you haven’t been to a software defined radio talk, Balint Seeber’s (@spenchdotnet) sounds promising.
“The Secret Life of SIM Cards” by Karl Koscher (@supersat) and Eric Butler (@codebutler) intrigues me the most out of the 11:00 talks. And I’m kind of interested in the Ryan W. Smith (@ryanwsmith13) and Tim Strazzere “DragonLady: An Investigation of SMS Fraud Operations in Russia” presentation because, well…
There’s not much that intrigues me after Benjamin Caudill’s (@RhinoSecurity) presentation on “Offensive Forensics: CSI for the Bad Guy“. If I was at DEFCON, this is the time where I’d probably be browsing the dealer’s room, though I might go to the Amir Etemadieh (@Zenofex)/Mike Baker (@gtvhacker)/CJ Heres (@cj_000)/Hans Nielsen (@n0nst1ck) Google TV panel: these are the same folks who did the Google TV talk at DEFCON 20.
I feel kind of conflicted at 4:00. The Daniel Selifonov talk, “A Password is Not Enough: Why Disk Encryption is Broken and How We Might Fix It” sounds interesting. But I’m also intrigued by the “Decapping Chips the Easy Hard Way” with Adam Laurie and Zac Franken. Decapping chips is something I’ve been fascinated by, and it looks like Adam and Zac have found methods that don’t involve things like fuming nitric acid (and thus, are suitable for an apartment).
This is also the time when we, once again, present the “Hippie, please!” award to Richard Thieme for “The Government and UFOs: A Historical Analysis“.
I’m slightly intrigued by Nicolas Oberli’s (@Baldanos) talk about the ccTalk protocol, “Please Insert Inject More Coins”:
Saturday morning, we have the second femtocell talk, “Do-It-Yourself Cellular IDS”, by Sherri Davidoff (@sherridavidoff), Scott Fretheim, David Harrison, and Randi Price:
Opposite that, and worth noting, are the annual Tobias/Bluzmanis lock talk, and the David Lawrence et al talk on using 3D printers to defeat the Schlage Primus.
More than likely, I’d hit the Daniel Crowley et al (@dan_crowley) talk, “Home Invasion 2.0 – Attacking Network-Controlled Consumer Devices“, and the Philip Polstra (@ppolstra) presentation “We are Legion: Pentesting with an Army of Low-power Low-cost Devices“. I’m particularly intrigued by the Polstra talk, as one of my areas of interest is how small can we make devices that can still do useful hacking? What’s the smallest feasible wardriving system, for example?
I do want to give Jaime Sanchez (@segofensiva) a shout-out for his talk on “Building an Android IDS on Network Level“. This is worth watching.
I’d have to go to the Phorkus (@PeakSec)/Evilrob “Doing Bad Things to ‘Good’ Security Appliances” talk:
Because, tape! But the Wesley McGrew “Pwn The Pwn Plug: Analyzing and Counter-Attacking Attacker-Implanted Devices” talk also interests me.
The PIN cracking device talk is on Saturday, opposite Amber Baldet’s (@AmberBaldet) talk on “Suicide Risk Assessment and Intervention Tactics“. I’m glad DEFCON accepted her talk, and I am looking forward to seeing the presentation online.
Also noteworthy, I think: James Snodgrass and Josh Hoover (@wishbone1138) on “BYO-Disaster and Why Corporate Wireless Security Still Sucks“.
Todd Manning (@tmanning) and Zach Lanier (@quine) are doing a presentation on “GoPro or GTFO: A Tale of Reversing an Embedded System“. I don’t have a GoPro (yet) or much of a use for one (yet) but I think they are interesting devices, so I’ll be watching for slides from this talk. Same for the conflicting Melissa Elliott talk, “Noise Floor: Exploring the World of Unintentional Radio Emissions“.
This takes us to Sunday. There’s not a whole lot that really turns me on early, though I admit to some interest in the Jaime Filson/Rob Fuller talk on harvesting github to build word lists:
I like the idea behind John Ortiz’s “Fast Forensics Using Simple Statistics and Cool Tools“, and he teaches at the University of Texas – San Antonio, so I’d probably go to that.
Now is when things start heating up from my perspective. Joseph Paul Cohen is giving a talk on his new tool, “Blucat: Netcat For Bluetooth“:
Holy crap, this sounds awesome. All I ask for is code that compiles.
(Unfortunately, this is up against the Eric Robi (@ericrobi)/Michael Perklin talk on “Forensic Fails“, which sounds like fun. But Bluetooth hacking is a big area of interest for me; sorry, guys.)
Speaking of Bluetooth hacking, Ryan Holeman (@hackgnar) is doing a talk on “The Bluetooth Device Database”. Which is exactly what it sounds like:
Dude lives in Austin, too! Holy crap^2!
And that takes us through to the closing ceremonies and the end of DEFCON 21. I will try to link to presentations as they go up, significant news stories, other people’s blogs, and anything else I think you guys might be interested in. If you have specific requests or tips, please either let me know in comments or by email to stainles at mac dot com, stainles at gmail dot com, or stainles at sportsfirings dot com.
