According to King Arthur Flour, today is National Waffle Day.
According to Knifecenter.com, today is National Knife Day.
Like sand through the hourglass…
August 24th, 2016Obit watch: August 23, 2016.
August 23rd, 2016My “Law and Order: Original Recipe” fan window is very narrow. I never took to Sam Waterston’s Jack McCoy. For me, the idea lineup was Logan and Briscoe (and Cragen)/Stone and Kincaid. But I did like Hill’s Adam Schiff: he served as a much needed counterweight to, shall we say, the enthusiasms of the other folks in the DA’s office.
I’m pretty sure most folks remember him for that. But let us not forget his other semi-famous role, especially since that gives me an excuse to use this clip:
Obit watch: August 21, 2016.
August 21st, 2016Convicted Ponzi scammer and boy-band impresario Lou Pearlman.
(Remember O-Town? I do, but only because I had a friend who was into “Making the Band” at the time.)
Jack Riley has also passed away. He was in a whole bunch of stuff, including some of the lesser Mel Brooks movies, but he was best known and regarded (at least to me) as Elliot Carlin on “The Bob Newhart Show”.
I can’t really find a clip I like, but this one comes close:
More from the police beat.
August 18th, 2016Lawrence put up a post yesterday on Austin’s murder rate, which is “up nearly 80 percent from the same time last year”.
I’m not totally convinced on the “understaffing the police department” argument. It kind of seems to me that the police basically come along and clean up after the murder’s already been done. Even with more cops on the street, what are the odds that one of those cops is going to run across the guy with the knife raised in time to stop him from stabbing a woman to death?
The flip side of this is the “broken windows” theory of policing: by concentrating on reducing disorder in neighborhoods, serious crime can be reduced. When disorder increases:
(Hattip to the Center for Evidence-Based Crime Policy for the link.)
This probably isn’t news to most of you, but I bring it up here because of a second item, from yesterday’s Statesman:
As seen at the fun show this past weekend…
August 18th, 2016I don’t know why, but I got a big kick out of this particular gun.
Not that I’m going to buy one (I need another .22 rifle like I need another hole in my head) but I think it would be very useful.
If I was Finnish.
And if I was hunting Germans Russians.
During the winter.
With a Ruger 10/22.
Obit watch: August 18, 2016.
August 18th, 2016Arthur Hiller, noted director. (“Love Story”, “Silver Streak”, “The In-Laws”, “The Americanization of Emily”, “National Lampoon’s Pucked”.) A/V Club.
For the record: John McLaughlin. Should have noted this yesterday, but the day got past me.
Citizen Kane.
August 16th, 2016You’re going down in flames, you tax-fattened hyena! (#33 in a series)
August 16th, 2016Didn’t pick up on this until this morning. Sorry. But it did probably need some time to perk.
Kathleen Kane, the nutty paranoid anti-gun attorney general of the state of Pennsylvania:
Guilty! Guilty! Guilty! Guilty! Guilty! Guilty! Guilty! Guilty! Guilty!
More from philly.com:
This is interesting:
My first thought was that this kind of warning is unprecedented; but on second thought, I’m sure federal judges have issued this kind of warning in the past to convicted defendants. For example, members of the Crips or Bloods. Or drug gangs. Or organized crime groups. But has a federal judge ever felt compelled to issue that kind of warning to a politician? And has a politician ever done as much to merit a warning like that?
Someone once said…
August 15th, 2016“It is morally wrong to allow a sucker to keep their money.”
From Bloomberg News by way of the News@Ycombinator Twitter: the SEC has halted trading in shares of Neuromama Ltd.
Neuromana? Surely you haven’t heard of them: they have a current valuation of $35 billion, and haven’t submitted financials since 2013.
$56.25 a share? What do they do? With a name like Neuromana, you’d think maybe brain science or something like that: perhaps a promising cure for Alzheimer’s?
Cirque du Soleil sold 90% of the company to a group of equity firms last year for $1.5 billion. So a company that stages Cirque du Soleil knockoffs in Tijuana (“the happiest place on Earth!”) is worth $35 billion? But wait: they’ve also got a search engine! And “heavy ion fusion technology patents” whatever the hell those are (if they’re even valid patents).
Did he just say “social network” and “oceanfront property” with a straight face?
“Zubkis” is Steven Zubkis, who has his own “colorful” history. But for that, you’ll need to give Bloomberg their click: make sure to turn on your ad blocker first.
Memo from the police beat.
August 12th, 2016There are a couple of ongoing stories in the news, two of them locally. Both of those two had significant developments today (in other words, “Let’s break this news on Friday afternoon and see if it gets lost over the weekend.”)
First story: You may recall the controversy back in April where our city manager, Marc Ott, accused the police chief of insubordination and fined him five days of pay?
Looks like we know who won that battle.
…
At least, we know who won for the moment. It will be interesting to see how the replacement process plays out, and how much deference (if any) the incoming city manager will be expected to show to the APD and the chief.
Also worth pointing out is what may have been Ott’s final “F— you” to the APD. There was a recent report (the “Matrix Report”) that called for increasing the number of police officers.
So that’s 78 sworn officers over and above the current authorized staffing level, which APD is still about 100 officers short of. What did the City Manager and his team ask for in the current budget?
Twelve. To quote our great and good friend RoadRich: “‘But first let me deny you most of the required staff to protect the city… and then I shall leave you to your fates. Suckahs.'”
(Another problem which I would like to get into, but the margins of this post are too small to contain: there’s also talk of converting the district representative positions, which are currently sworn officers, into civilian positions.)
Next:
DEFCON 24 updates: August 11, 2016.
August 11th, 2016“SITCH – Inexpensive, Coordinated GSM Anomaly Detection” doesn’t just have slides up. Or a whitepaper.
It has an entire freaking website. Which does include, yes, slides and whitepaper. (Thanks to SecBarbie on Twitter for this.)
Slides for the Tamas Szakaly “Help, I’ve got ANTs!!!” talk are here. And his GitHub repo is here.
Good stuff is going up on the Black Hat 2016 briefings site, too. I haven’t had a chance to go through all of the abstracts yet, but my current favorite is: “Does Dropping USB Drives In Parking Lots And Other Places Really Work?”. Slides here, code here, blog post here, no spoilers here.
DEFCON 24 updates: August 8, 2016.
August 8th, 2016- Slides from the Jay Beale and Larry Pesce talk “Phishing without Failure and Frustration” are up here at the InGuardians website.
- At the same site, a talk Jay Beale gave in the Packet Capture Village, “Adding Ramparts to Your Bastille: An Introduction to SELinux Hardening”.
- Slides for Max Bazaliy‘s “A Journey Through Exploit Mitigation Techniques in iOS” are here.
- Haven’t found slides yet, but the tools from Salvador Mendoza’s “Samsung Pay: Tokenized Numbers, Flaws and Issues” are here.
- Patrick Wardle‘s “I’ve got 99 Problems, but Little Snitch ain’t one” slides are here.
Torn from the pages of the NYT.
August 8th, 2016Two stories from the NYT that aroused my interest, for different reasons:
Emperor Akihito of Japan wants to step down from the throne. But it isn’t that simple. There’s no provision in the law that allows him to step down and have his son, Crown Prince Naruhito, take over the throne, so the Japanese government would have to change the law. But the Emperor can’t ask for that directly, because that would be meddling in politics. So he has to hint that he’d like the law changed. But people are concerned that if the government does change the law, they would be exerting undue influence over the throne. So Japan has a mess to sort out, one that’s also tied up with the question of allowing women to take the throne, and what the role of the Emperor should be in present day Japanese society.
One of the things that I found most striking about this article was a reference – which appears to have been deleted from the current version of the article, but there are comments mentioning it – to Crown Prince Naruhito’s wife, Masako, Crown Princess of Japan, who according to the article (this is also backed up some by Wikipedia) has lived in virtual seclusion for the past fifteen years battling crippling depression. That’s about the saddest thing I’ve heard in a long while.
Story number two: a man named Neil Horan, who lives in London, was upset that Vanderlei de Lima was selected to light the Olympic flame.
Why?
Neil Horan shoved Vanderlei de Lima into the crowd during the 2004 Olympic marathon, probably costing him the gold medal. (De Lima ended up winning the bronze.)
I believe “asshole” is actually the word the paper of record is looking for here. But what reason does Horan have for being so worked up?
That’s funny. I would have said the person who failed in “basic manners of human decency and courtesy” was Horan, when he pushed an athlete that had done nothing to him into a crowd and ruined his chance at winning the race.
Seriously. This guy is upset because the man he wronged refuses to accept his apologies, or even contact him. That’s not surprising; that’s the kind of behavior you expect from delusional assholes.
The question on my mind is: why did the NYT chose to devote space to the rantings of an attention-seeking nut?
More on Blue Hydra.
August 7th, 2016Earlier, I wrote “It runs! It works! Mostly. Kind of.”
I’ve been banging on Blue Hydra in my spare time since Thursday, and I stand by that statement. Here’s what I’ve run into so far.
The README is pretty clear, and I didn’t have any problems installing the required packages. (I don’t have an Ubertooth, so I skipped that one. We’ll come back to the Ubertooth later.)
First problem, which was actually very tiny: I know next to nothing about Ruby, other than that cartoon foxes are somehow involved, so the phrase “With ruby installed add the bundler gem” was more like “I don’t speak your crazy moon language”. Google cleared that up pretty quickly: the magic words are gem install bundler.
Next problem: running bundle install resulted in an error stating that it couldn’t find the Ruby header files. It turns out that, while my Ubuntu installation had Ruby 2.1 installed, it didn’t have the ruby-dev package installed. sudo apt-get install ruby-dev fixed that issue.
Next problem: the SQLIte Ruby gem failed to install when I ran bundle install. It turns out that I also needed the sqlite3-dev package as well. And with that installed, the bundle built, and I could do ./bin/blue_hydra.
Which gave an error stating that it didn’t have permissions to open a handle for write. Okay, let’s try sudo ./bin/blue_hydra (because I always run code from strangers as root on my machine; everyone knows strangers have the best candy). And that actually worked: Blue Hydra launched and ran just fine. In fairness, this may be a configuration issue on my machine, and not an issue with the software itself.
In playing with it, I’ve found that it does what it claims to do. Sort of. It’s been able to detect devices in my small lab environment with Bluetooth discovery turned off, which is impressive. I also like the fact that it stores data into an SQLite database; other Bluetooth scanning tools I’ve played with didn’t do that.
However, it seems to take a while to detect my iPhone; in some instances, it doesn’t detect it at all until I go into Settings->Bluetooth. Once I’m in the Bluetooth settings, even if I don’t make a change, Blue Hydra seems to pick up the iPhone. Blue Hydra also has totally failed to detect another smart phone in my small lab environment (and I have verified that Bluetooth was both on and set to discoverable.)
Now, to be fair, there may be some other things going on:
- I’ve also observed previously that Bluetooth under Ubuntu 15.10 didn’t work very well. At all. So at one point on Saturday, just for giggles, I upgraded Project e to Ubuntu 16.01.1 LTS. And shockingly (at least for me) Bluetooth works much much better. As in, I can actually pair my phone with Ubuntu and do other Bluetooth related stuff that didn’t work with 15.10. That seems to have mitigated the discovery issues I was seeing with Blue Hydra a little, but not as much as I would have liked. (Edited to add 8/8: Forgot to mention: after I upgraded, I did have to rerun
bundle installto get Blue Hydra working again. But the second time, it ran without incident or error, and Blue Hydra worked immediately aftewards (though it still required root).) - I was using the Asus built-in Bluetooth adapter in my testing. Also just for giggles, I switched Blue Hydra to use an external USB adapter as well. That didn’t seem to make a difference.
- In fairness, Blue Hydra may be designed to work best with an Ubertooth One. The temptation is great to pick one of those up. It is also tempting to pick up a BCM20702A0 based external adapter (like this one) partly to see if that works better, partly because I don’t have a Bluetooth LE compatible adapter (and this one is cheap) and partly because the Bluetooth lock stuff is based on that adapter. (Edited to add 8/8: I’m also tempted by this Sena UD100 adapter. It is a little more expensive, but also high power and has a SMA antenna connector. That could be useful.)
- It may also be that I have an unreasonable expectation. Project e is seven years old at this point, and, while it still runs Ubuntu reasonably well, I do feel some slowness. Also, I think the battery life is slipping, and I’m not sure if replacements are available. I’ve been thinking off and on about replacing it with something gently used from Discount Electronics: something like a Core i5 or Core i7 machine with USB3 and a GPU that will work with hashcat. Maybe. We’ll see. Point is, some of my issues may just be “limits of old hardware” rather than bugs.
- And who knows? There may very well be some bugs that get fixed after DEFCON.
tl, dr: Blue Hydra is nice, but I’m not yet convinced it is the second coming of Christ that I’ve been waiting for.
DEFCON 24: August 7, 2016 updates.
August 7th, 2016The presentations on the conference CD are here, if you’re looking for something specific that I didn’t mention. I’m still going to try to provide links to individual presenters and their sites, simply because I believe those are the most recent and best updated ones. Just to be clear, I’m not trying to rip off anyone else’s work, which is why I link directly. I want to provide myself (and possibly other interested folks) with one-stop shopping for the latest versions of the things I’m most interested in.
- Sean Metcalf’s “Beyond the MCSE: Red Teaming Active Directory” isn’t up yet, but it will be here when he gets around to it. (This isn’t a shot at him; if I was in Vegas right now, uploading my presentation would be the last thing on my mind, too.) That site does have his Black Hat presentation, “Beyond the MCSE: Active Directory for the Security Professional”.
- Haven’t found an updated copy of Master Chen’s “Weaponize Your Feature Codes” presentation yet, but the GitHub repo with his code is here.
- The slides for Joe Grand and Joe FitzPatrick’s “101 Ways to Brick your Hardware” are up on the Grand Idea Studio website.
- And the slides for “BSODomizer HD: A Mischievous FPGA and HDMI Platform for the (M)asses” are also on the Grand Idea Studio website.
- The material from the Six_Volts/Haystack “Cheap Tools for Hacking Heavy Trucks” presentation will be here within a week of the conference, according to the presenters. Here. Shake hands with danger.
- The GitHub repo with the slides and the code from the Anthony Rose and Ben Ramsey “Picking Bluetooth Low Energy Locks from a Quarter Mile Away” talk is here.
- Here are the slides and the whitepaper from Marc Newlin‘s “MouseJack: Injecting Keystrokes into Wireless Mice”.
- The slides from the Rogan Dawes and Dominic White “Universal Serial aBUSe: Remote Physical Access Attacks” will be here eventually, according to the presenters, and the tools will be here (ditto).
This takes us into today. I’ve been at this for about an hour and a half now. I’m not proud. Or tired. But I do have some other things I want to do, and I think it is a bit early to expect Sunday presentations to be up. I’ll end this one for now, and see if I can do another update tomorrow. Also, I want to do a further write-up on Blue Hydra, possibly tonight, maybe tomorrow as well.
If you are a presenter who’d like to provide a link to your talk (even if it is one I didn’t specifically call out) or you have other comments or questions, please feel free to comment here or send an email to stainles [at] sportsfirings.com.