DEFCON 20 notes: Day 1.

July 28th, 2012

If you asked people to explain DEFCON, what would they say? Some might say: for those who understand, no explanation is necessary, for those who don’t, no explanation is possible.

Others might say that DEFCON is a mystery, wrapped in a riddle, inside…

...an Enigma machine

(Not only did the National Cryptologic Museum bring that, they also were handing out (while supplies lasted) two really cool booklets: “The Cryptographic Mathematics of Enigma” and “Solving the Enigma: History of the Cryptanalytic Bombe”. The inside covers of both books claim they are available for free by sending a request: email me for the address, or try crypto_museum [at] nsa.gov.)

(I also got a kick out of the “NSA careers” cards they were handing out, mostly because it was the first buisness card I’ve ever seen with an embedded microfiber screen cleaner.)

Today’s schedule:

“Making Sense of Static – New Tools for Hacking GPS”: Pretty much what I expected from the description, but still a very good panel. The presenters have been doing a lot of work with systems that use GPS tracking, and they’ve run up against the limits of affordable off-the-shelf GPS hardware. There are all kinds of things you can’t do with retail GPS:

  • Experimenting with spoofing and jamming attacks is hard because you don’t have low-level hardware access to see what’s going on.
  • Implementing methods for dealing with poor signal environments, such as “urban canyons”, is also difficult.
  • You also don’t have access to the newer systems, such as GLONASS, Galileo, or Compass.
  • And it is hard to experiment with advanced positioning techniques.

Much of the presentation was devoted to a detailed account of exactly how GPS calculates positions on Earth, and what some of the limitations of those calculations are. If I were to attempt to summarize this, I’d be doing from memory and likely get much of it wrong, so instead I’ll point to the Wikipedia entry which covers the same material (including the use of Gold codes to distinguish each GPS satellite).

All of this led up to two products:

  • libswiftnav, which is a lightweight, fast, and portable set of tools for building a GPS receiver. The nice thing about libswiftnav, according to the authors, is that it will run on microcontrollers and other relatively wimpy hardware.
  • Piksi, a hardware implementation that uses libswiftnav and overcomes a lot of the limitations outlined previously: it can do highly accurate positioning, very fast updating, and supports other positioning systems.

The presenters have stated that their presentation should be available at the Swift-Nav site as soon as they have a chance to upload it.

I missed the “Not So Super Notes, How Well Does US Dollar Note Security Prevent Counterfeiting?” session simply because the clock got away from me. If I can find the presentation online, I will link to it.

I wasn’t able to get into the “How to Hack VMware vCenter Server in 60 Seconds” session for reasons of it being held in a room way too small for everyone who wanted to get in. This seems to be a version of the presentation from another conference. I’ve only given it a quick skim, but it looks very interesting indeed.

“Bypassing Endpoint Security for $20 or Less” wasn’t quite what I had expected, but it paid off. The basic idea behind this panel was that there’s an increasing emphasis on keeping people from walking out of the office with sensitive data on USB mass storage devices; some companies use software that allows only known and approved devices to connect over USB.

So how do you know if a device is known and approved? Much of the presentation dealt with specifics of how USB, and especially USB mass storage, works. The short answer is that everything depends on “endpoints” (which are sort of “virtual wires” for USB connections) and “descriptors” (which provide information about the device). USB devices identify themselves through a combination VID/PID as part of the protocol, so if you can spoof the VID/PID, you can pretend to be an already authorized device.

Which is what the presenter’s hardware does, for less than $20. I haven’t found the presentation online, but the presenter swears the hardware schematics etc. will be available on github under “usb-impersonator” as soon as he gets around to updating the repository (which he promises will be real soon now).

Edited to add 7/28: Two points in this presentation that I wanted to mention but forgot to last night.

  1. Windows doesn’t see anything but the first LUN on USB mass storage devices. So if you want to hide something on a flash drive from a Windows user, partitioning the drive is a good way of doing that.
  2. If you run modprobe usbmon (this may require running as root) and then fire up Wireshark, wonder of wonders, you get a whole bunch of USB bus devices available as Wireshark interfaces. This is something I want to play with more when I have time: I’ll probably post some Wireshark capture files showing what happens when a device is inserted.

Edited to add: Added link to Phil Polestra’s blog entry, which contains links to the slides and the code, 8/1/2012.

The last presentation I went to was “Safes and Containers – Insecurity Design Excellence”. This is one that’s already gotten a fair amount of attention: a friend of mine emailed me a link to this Forbes article by one of the presenters that neatly recaps the whole thing (including their videos).

Basically, many popular gun safes, especially ones made by the Stack-On corporation, are insecure and can be opened with paper clips, drinking straws, pieces of brass purchased at a hardware store,..or by just simply lifting up the safe and dropping it a few inches.

Why is this? The presenters argue that the people who make these safes don’t come from a culture that says to itself “Okay, I’ve built this safe. Now how can I bypass the mechanism and get in?” Quoting: “Engineers know how to make things work, but not how to break them.” Many of these safes are imported from China and are made as cheaply as possible, which complicates things even more.

There’s also an attitude of “my product meets the standards, so up yours”. The California Department of Justice has standards for gun safes, and these products all meet those standards. However, the CDOJ standards do not involve any kind of realistic tests of the product, such as turning it over to a five-year-old and telling him there’s candy inside.

My one issue with this presentation is that the authors seem to view gun safes as the most important part of protecting your kids from guns; thus they believe safes need to be stronger. I can agree with this, but as I see it, safes should be a last resort, not the primary means of protection. I grew up in a house with guns, and I was never tempted to mess with any of them because my parents raised me properly (and because I knew I’d be beaten bloody if I did mess with them). Age-appropriate training (such as the NRA’s “Eddie the Eagle” program) combined with appropriate physical security (what was that gun safe doing where a three-year old had physical access to it, anyway?), combined with safes that actually do what they’re supposed to do, constitutes a layered defense, and one that works better than just relying on cheaply made Chinese junk.

And so to bed. I’m tired, and stuff hasn’t been working right all night. Project e just shut itself down in the middle of this post, the Kindle’s battery was deeply discharged and I had to wait for it, and dinner was not that great. (More about that later on.)

What. The. Frack?

July 27th, 2012

The Consumer Product Safety Commission is trying to ban Buckyballs? Because a bunch of stupid kids swallowed Buckyballs, a product that isn’t even marketed for children?

Screw those losers at the CPSC. I’m ordering a set for myself now, while I still can.

And what will Woot do, without Buckyballs to sell?

(As relevant now as it was twelve years ago.)

0-day DEFCON 20 notes.

July 27th, 2012

I got in line for my badge around 7:30 AM. Registration opened at 8 AM, according to the schedule.

I got my badge at 9:30 AM. I have no idea how many people were in line, but it was packed. We were told that folks started camping out for badges at 10:30 PM Wednesday night.

But, hey! I got mine!

After what was (in my opinion) last year’s badge fail, they went back to an electronic badge this year, still tied in to a “crypto-mystery” game, but at least the badge does something useful.

Or perhaps can do something useful, would be a better way of putting it. The designer calls it a “development platform”: there’s holes for I/O pins at the top, and we were issued VGA (1) and PS/2 connectors (2) with the badge to attach ourselves. And remember my inquiry a while back about microcontrollers? The badge CPU is a Parallax Propeller.

(I haven’t been able to get the badge and Project E talking yet. I suspect a bad or wrong USB cable.)

I hit two panels today. Worth noting is that today’s theme was “DEFCON 101”: there was only one programming track, and the theme of those items was more “introduction to” rather than “deep dive.”

DaKahuna’s “Wireless Security: Breaking Wireless Encryption Keys” wasn’t quite what I expected, in that he didn’t do a live demo. (Though he did suggest that there would be systems available for practice in the Wireless Village.) Rather, this was something of a “view from 10,000 feet” presentation, giving a basic introduction to hardware requirements and tools for attacking wireless keys, along with explanations of how WEP and WPA keys work, and where the vulnerabilities are. A lot of this stuff I already knew from my academic studies, but then again, I wasn’t the target audience here, and I did pick up a few tips.

The presenters for “Intro to Digital Forensics: Tools and Tactics” sold me in the first five minutes by pointing out that:

  • Not everyone knows everything.
  • It would behoove the community to stop acting like dicks when people ask reasonable questions, like “What switches should I use for NMap?”.

The presenters then proceeded to give example usages for what they considered to be the top five tools for testing and exploration:

  • The Metasploit framework, which they sadly ran out of time while discussing.
  • Ntop, the network traffic analyzer.
  • Nmap, for doing port scans and OS fingerprinting. For example:
    #nmap -v -sT -F -A -oG 10.x.x.x/24
    What does this mean?
    -v turns on verbose mode
    -sT forces NMap to do a full TCP connection to each host
    -F enables fast scan mode
    -A tells NMap to do OS fingerprinting
    -oG tells NMap to output in a format grep can work with,
    10.x.x.x/24 tells NMap the range of hosts to scan.
  • tcpdump, which captures packets on a given network interface.
    tcpdump -i eth1 -n -x
    -i specifies the interface
    -n turns off /etc/services translation, so instead of displaying the service name (ftp, telnet, etc.) it just shows the port number.
    -x dumps hex output to the screen
  • Netcat, which creates TCP sockets that can be used for communications between systems. But that’s a little misleading. Let’s say we have two systems, our localhost and a machine at 192.168.1.128. On the .128 machine, we run:
    nc -l -p 2800 -e cmd.exe
    -l tells netcat to listen for a connection
    -p tells netcat to listen for that connection on port 2800
    -e tells netcat to run a command when a connection is made on that port: in this case, netcat will run cmd.exe.
    On the local system:
    nc 192.168.1.128 2800 connect
    which establishes a connection between our system and the remote system. The remote system will run cmd.exe, which (on a Windows system) should give us a command shell on the remote system that we can use from our localhost.

I took the rest of the day off to visit a couple of bookstores (both are still there, pretty much unchanged) and the Mob Museum.

My first thought was that $18 seems a bit stiff. Then again, the Atomic Testing Museum is $14, And the Mob Museum seems to have more people on staff, and may possibly be a little larger than the ATM. (I can’t tell for sure, but the Mob Musuem bascially has that entire building: all three floors.) ($5 for parking cheesed me off a bit, though.)

Anyway, while the Atomic Testing Museum is still my favorite Vegas musuem, the Mob Museum is well worth visiting, especially if you have an interest in organized crime in the United States. (Not just in Vegas, though that is a key focus; the museum also talks about organized crime in other areas, including NYC and Cleveland.) There is a lot of emphasis on Estes Kefauver, perhaps just a little more than I thought was warranted.(I admit, I chuckled at the “Oscar Goodman” display.)

Two things that surprised me:

  1. The number of families with small children at the Mob Museum. Parents, would you take your kids to a museum devoted to organized crime? (There’s some pretty graphic stuff, but the Museum confines it all to one section, warns you before you enter the section, and gives you an option to skip past it.) (And I feel kind of hypocritical saying this: if my parents had taken me to the Mob Museum when I was, say, 10, wild horses couldn’t have dragged me out of there.)
  2. The popularity among small children of the firearms simulator. Kids were having a lot of fun pretending to be cops, running through various scenarios (like a domestic dispute) and busting caps in bad guys. (I didn’t tell any of the kids that, had they actually been out on the street, they’d be dead before they got their first shot off. Do I look like an asshole?)

Tomorrow is when things start for real. Look for an update, but probably late in the evening.

(Oh, I did want to mention Chad Everett’s death yesterday, but I was using the Kindle to blog, which was a pain, and things got kind of sideways leaving LAX and arriving in Vegas, so consider this your obit watch.)

Obit watch: July 25, 2012

July 25th, 2012

Sherman Hemsley.

This is for Lawrence and Andrew:

 

Hemsley, a former jazz keyboardist, was also a huge fan of prog-rock bands like Yes, Gong, and Nektar…and he even cut his own record with Yes frontman Jon Anderson in 1999 that, sadly, never saw release.

 

I have no joke here, I just like saying…

July 24th, 2012

…”smothering ocean of high-pressure meat“.

-1 day DEFCON 20 notes

July 24th, 2012

Lawrence observed yesterday:

Save a mention for the serial number hacking panel, I’m sort of surprised there seem to be no Apple products on any of the panels this year.

So this is interesting:

…Dallas De Atley, manager of Apple’s platform security team, is scheduled to give a presentation on key security technologies within iOS, the operating system for iPhones and iPads.

N.B.: This is at Black Hat, not DEFCON. For those who might be confused, I like Borepatch’s description of Black Hat as “more corporate and buttoned down”: basically, they are different conferences, but with considerable overlap. Looking further into the Black Hat schedule, though, it looks like De Atley’s presentation isn’t the only one on IOS security issues.

My understanding is that the organizers try to keep a certain level of separation between Black Hat and DEFCON: why pay $1,500 for Black Hat if all the panels are duplicated at DEFCON for less? Not that there aren’t panels common to both, but it seems that your presentation has to be pretty high quality, sensational, or both in order to get accepted to Black Hat and DEFCON.

Which in turn makes me wonder: given the popularity of IOS devices, did the organizers segregate all the Apple panels at Black Hat, in an attempt to give folks more of an incentive to attend?

I don’t know: this is all purely speculative, and there’s nothing wrong with it anyway. I’m just wondering…

Random notes: July 24, 2012.

July 24th, 2012

Obit watch: Sally Ride.

Previously noted, but bears repeating: The Lustgarten Foundation for pancreatic cancer research.

Noted without comment. (See also.) (See also.) (See also.)

Faced with a crippling combination of low revenues, high labor costs and decreasing funding from the state, El Monte is moving to declare a fiscal emergency and seek a tax on sugary beverages sold within the city.

More:

El Monte officials said they are not at the edge of bankruptcy but need the sugary drinks tax revenue as a protection against insolvency down the road.

I’m fascinated by the events in Anaheim, but I don’t know what to make of them right now. (More here.)

Art, damn it, art! watch (#31 in a series)

July 24th, 2012

This story has gotten a fair amount of attention elsewhere, but I want to highlight one aspect of it.

Ileana Sonnabend was a noted NYC art dealer who passed away in 2007. Her children inherited her art collection, which was valued at $1 billion. So far, her heirs have paid $471 million in estate taxes on the collection, selling off a large part of it to do so.

One of the pieces in the collection is a Robert Rauschenberg piece called “Canyon”.

Because the work, a sculptural combine, includes a stuffed bald eagle, a bird under federal protection, the heirs would be committing a felony if they ever tried to sell it. So their appraisers have valued the work at zero.

The IRS values “Canyon” at $65 million, and wants the family to pay $29.2 million in tax.

“The ruling about the eagle is not something the Art Advisory Panel considered,” [Stephanie] Barron [senior curator of 20th-century art at the Los Angeles County Museum of Art] said, adding that the work’s value is defined by its artistic worth. “It’s a stunning work of art and we all just cringed at the idea of saying that this had zero value. It just didn’t make any sense.”

But doesn’t the fact that the work can’t be sold make it of zero value anyway? Sort of by definition? And is Ms. Barron confusing aesthetic value with market value?

[Ralph E.] Lerner [lawyer for the heirs] said that since the children assert the Rauschenberg has no dollar value for estate purposes, they could not claim a charitable deduction by donating “Canyon” to a museum. If the I.R.S. were to prevail in its $65 million valuation, he said the heirs would still have to pay the $40.9 million in taxes and penalties regardless of a donation.

-2 Day DEFCON 20 notes.

July 23rd, 2012

The schedule for DEFCON 20 is up.

Lawrence reminded me on Saturday that I also had not solicited panel requests, so this is your pre-DEFCON 20 post.

I’m flying out Wednesday morning and getting to Las Vegas around 1 PM. I’m hoping to visit the Mob Museum (just because it is new since my last visit, and I haven’t seen it) and to make a return trip to the two bookstores I visited last year. Lotus of Siam is also required.

There is some stuff going on at DEFCON on Thursday:

Here’s what I’m interested in on Friday:

Saturday, we have a possible tie for this year’s “Hippie, PLEASE” panel:

I shan’t be attending either. The Saturday panels I am interested in:

Sunday! Sunday! Sunday! Live at DEFCON 20! Nitro-burning FUNNY CARS!

So that’s that. If anyone has any specific panel requests after looking over the posted schedule, let me know (by email on in the comments), and I’ll try to hit those events. Also, if anyone has any recommendations for new, cool, or interesting places to eat in Vegas, feel free to leave those in comments.

(Edited to add: It’s a Borepatch-o-lanche! Thank you, brother man!)

We can’t make doughnut jokes any more.

July 19th, 2012

But we can make burrito jokes. TJIC, call your office, please.

One of the surest places to find a police officer in downtown Brooklyn, other than the 84th Precinct station house, is the Chipotle Mexican Grill restaurant on Montague Street.

The popularity of this Chipolte among the NYPD might – just might – have something to do with the 50% discount they give to uniformed officers. Of course, accepting this discount violates NYPD policy, or so the department says. However, offering the discount does not violate Chipolte’s policy, according to a spokesman for the chain.

Quote of the day.

July 19th, 2012

From the comments thread on this article:

I’d MUCH rather have a brony watching my six than someone who was self-absorbed and thinking of little more than his image. Someone saying openly “I like this show” has conquered a fear of rejection and has faced down a few inner demons. Someone criticizing that person lacks courage, is pretty much guaranteed to have medical-grade skeletons in his closet, and is therefore a prime candidate for desertion under fire or is blackmail fodder.

(Hattip: Erin Palette at Lurking Rhythmically.)

I want my two dollars!

July 19th, 2012

Back in 2008, Austin Energy (the city’s electric utility) made a deal with Nacogdoches Power LLC to purchase the entire output of a proposed new power plant. The key here was that the new power plant would produce electricity from burning “wood waste”, a renewable resource, and thus would avoid potential federal taxes on carbon-based fuels.

This was not a popular decision at the time. Even the local environmental activists were opposed to the plant. Many people felt the city wasn’t releasing all the relevant information and was rushing into the deal.

The plant went live yesterday.

The privately owned plant will sell $2 billion worth of electricity to Austin Energy for the next 20 years at a price well above the going rate for competing power sources. It will add $1.94 to the average home’s monthly bill of about $100, according to Austin Energy estimates.

More:

But when the deal was unveiled publicly, open-government activists said the city was not releasing relevant details, such as the cost. It was later revealed to be a little more than 9 cents per kilowatt-hour to start, then gradually increasing to around 16 cents per kilowatt-hour. The average is about 15 cents per kilowatt-hour over the life of the contract.
That is well above the current cost of natural gas and wind, and probably above what the utility would have paid for a proposed nuclear plant expansion that city leaders repeatedly turned down.

Austin Energy is currently paying “a little more than” 4 cents a kilowatt hour for “coastal wind” power. If I’m reading the article correctly, natural gas is running at about 2 cents per kilowatt hour.

Sometimes, the questions are hard.

July 19th, 2012

And sometimes there’s not an easy answer.

What is justice?

What is redemption? How do we decide when a person is redeemed? Are there crimes that are beyond redemption?

What is the purpose of prison? What should our goals be when we lock people up? Protection of society? Punishment? Reform?

How should we treat young people who commit horrible crimes? Do we lock them away for life? Do we give them a chance to reform? What if we’re wrong, and reform doesn’t take?

Greg Ousley is serving a 60 year sentence in the Indiana prison system. He’s been there since 1994. In that time, he’s earned a degree in liberal arts from Indiana State (summa cum laude, no less). The corrections staff at his prison apparently thinks the world of Mr. Ousley.

His former work supervisor, Cindy Estes, was more explicit. “This kid has jumped through every hoop the state has put in front of him,” she told me. “He deserves to come out. There’s absolutely nothing to be gained by keeping him in there for another 10 years.”

He’ll be eligible for parole in March of 2019, unless a judge agrees to modify his sentence.

What did Mr. Ousley do? At the age of 14, he shotgunned his parents to death.

I don’t know what to do with Mr. Ousley. I don’t claim to know whether he’s reformed enough that he deserves to be let out. I don’t have answers to those questions. The only thing I have is the knowledge that I’m glad I don’t work in the justice system, because I don’t have those answers.

What the frack is wrong with you people?

July 18th, 2012

Not “you people” as in my regular readers. I’m sure you’re all tall, strong, above average in IQ, and every one of your bodily functions smells like a vanilla Glade plug-in.

No, I’m talking about the rest of the Internet who doesn’t read my blog and seems to be overrun with a massive sense of entitlement.

Item 1: The existence of the GR Bullies site. “GR Bullies” is apparently a website devoted to combating “bullying” on the GoodReads website (for values of “bullying” that seem to include posting negative reviews) by…acting like misogynistic bullies themselves. Good plan, guys; I’m sure Big Fred Nietzsche would approve. Or maybe not. I commend to your attention the take of John Scalzi, an actual professional writer who gets bad reviews from time to time, on this subject. (I also recommend reading the other three writers Scalzi links.)

Item 2: The existence of ChickLitGirls, a site that takes money for reviews, only posts positive reviews, and, when it is politely suggested that their pay-for-review policy may not be 100% clear, issues bumptious lawsuit threats.

(“bumptious”. Such a great word. I need to work that into my vocabulary, along with “gargantuan“.)

Item 3: “How dare you think Dark Knight Rises isn’t the greatest thing since the invention of fire?”

Item 4: “…those like my son who have disabilities have the right to live life with access to everything people who aren’t handicapped do.” So, therefore, Netflix is obligated to closed-caption streaming video. And, no, providing closed-captioned DVDs isn’t good enough. I am so sick and tired of hearing people like Ellen Seidman talk about “rights” without making a distinction between liberty rights and claim rights.

There are some things that should require accommodation; for example, access to governmental services. And it may be good business for Netflix to make this kind of accommodation. Right now, Netflix feels that it isn’t. (As other people have pointed out, Netflix gets the material it uses for streaming from studios, that material probably does not have closed captions, and the studios would be rightfully upset if Netflix started altering their property.) If you want to prove to Netflix that they’re wrong, don’t use the service, or start your own competing service with closed captions. If Netflix looses enough business, they’ll change their mind. But you don’t have a right to closed captioned streaming video, or, for that matter, to “access to everything people who aren’t handicapped do”. Down this path lies madness: should we build a wheelchair ramp to the top of Half Dome?

[Edited to add: Hattip on item 4 to Walter Olson at Overlawyered.]

Banana republicans watch: July 18, 2012.

July 18th, 2012

Joe Wolfe has either resigned or been fired from the Fullerton, CA police department. Former Officer Wolfe was involved in the (warning!) Kelly Thomas beating death (as always, graphic image warning at that link), but has not yet been charged with a crime.

Add Compton to the bankruptcy watch. With a $42 million deficit, I doubt even a tax on rap groups with platinum records will help.

…the city has consistently fallen behind on payments to vendors, including its sheriff’s contract.

Remember when Compton was talking about reopening the Compton PD and spent $1 million on “equipment” before giving up? Good times, good times.

More recently, the city’s independent audit firm refused to sign off on the annual financial statements and quit, after Mayor Eric Perrodin wrote a letter to the state controller’s office alleging fraud might have contributed to the city’s financial issues and asking for an audit.

I’ve avoided blogging this next story because I felt like there was a limit to what my readers (many thanks to both of you) would put up with. Surprisingly to me, though, these banana republican updates have been among the most popular recent posts on my blog. You put up something thoughtful and original, and it gets ignored, but people seem to love California political corruption.

Anyway, there’s an ongoing case involving the Los Angeles Memorial Coliseum and accusations of bribes and kickbacks. The Coliseum is nearly broke, and USC is in talks to take it over.

A bunch of people have been indicted in the case. Former “general manager” Patrick Lynch has already pled to conflict of interest charges and agreed to repay $385,000 he got from a man named Tony Estrada.

Estrada is a former contractor with the Coliseum, and has been charged with “embezzlement and conspiracy”. Estrada is also a fugitive from justice.

Today’s LAT has an interview with the fugitive Mr. Estrada.

Tony Estrada, rocking the ski mask.

No joke. Mr. Estrada claims to be “somewhere in South America”; the interviews that make up the story were conducted by telephone and over Skype. (It is unclear to me how the LAT verified that the man in the mask was actually Estrada.)

And:

Estrada regards himself as a whistle-blower — and some Coliseum officials described him that way in the past — because he came forward to tell a government lawyer and an outside investigator about alleged kickbacks he paid to former stadium General Manager Patrick Lynch and about other purported misconduct by stadium employees. Those payments are the basis of the charges against Estrada, who said Lynch pressured him for money as a condition of keeping his janitorial contract.

This just in: our old friend Cudahy City Councilman Osvaldo Conde (of the bimbo and the badge) has agreed to plead guilty to extortion and bribery. Actually, make that former city councilman: Conde resigned yesterday.

Conde is the last of the three indicted city officials (the others being former Mayor David Silva and former code enforcement head Angel Perales) to take a plea in the case.