…how Nature points up the folly of men.
RIP Haruo Nakajima. (Lawrence.)
History shows again and again…
August 8th, 2017Obit watch: August 8, 2017.
August 8th, 2017For the historical record: NYT obit for Mark White.
Ernst Zündel, scummy Nazi Holocaust denier and the center of two criminal trials in Canada.
Richard Dudman passed away at the age of 99, surprisingly. I say “surprisingly” because, as a journalist for the St. Louis Post-Dispatch he led an interesting and dangerous life:
He covered other wars all over the world, including Vietman. He was responsible for the P-D publishing part of the Pentagon Papers. In 1970, he and two other journalists were taken hostage by the Vietcong and spent 40 days as prisoners before being released.
In 1978, he and two other journalists got an “interview” with Pol Pot (though the “interview” was more like Pol Pot haranguing them through translators for several hours). Then someone tried to kill the three journalists.
He had a motto: “Reporter who sits on hot story gets ass burned.”
David E. H. Jones passed away a few weeks ago. That name may ring a small bell for some of you: he was a chemist and professor, as well as a professional writer.
Back in the old days, I used to spend time in the university library reading New Scientist, and Dr. Jones’s column was always the first thing I flipped to.
Obit watch: August 5, 2017.
August 5th, 2017Mark White, former Texas governor.
Headline of the day.
August 3rd, 2017
DEFCON 25 update: August 3, 2017.
August 3rd, 2017Mike the Musicologist tipped me off to this:
Marcus Hutchins, the guy who was in the news earlier this year for defusing the WCry malware, was detained in Las Vegas after DEFCON.
This is still an evolving story, but what I’ve seen from reliable sources (and CNN) is that Hutchins is under federal indictment and charged with creating another piece of malware: Kronos, described as a “banking Trojan”.
The best coverage I’ve seen of this so far is from TechDirt and ArsTechnica. I would keep an eye on those two sites for updates, as this story is still evolving.
I, for one, welcome our New World Order overlords.
August 1st, 2017DEFCON 25 updates: July 31, 2017.
July 31st, 2017Things are going to be a little busy this week, but I do plan to keep an eye out for updates. In the meantime, please enjoy this latest set:
- TJ Horner has a nice blog post up about his experiences hacking voting machines in DEFCON 25’s “Voting Village”.
- “The Adventures of AV and the Leaky Sandbox” (Itzik Kotler and Amit Klein) didn’t catch my attention the first time around, but the abstract sounds intriguing: “In this presentation, we describe and demonstrate a novel technique for exfiltrating data from highly secure enterprises whose endpoints have no direct Internet connection, or whose endpoints’ connection to the Internet is restricted to hosts used by their legitimately installed software. Assuming the endpoint has a cloud-enhanced antivirus product installed, we show that if the anti-virus product employs an Internet-connected sandbox in its cloud, it in fact facilitates such exfiltration.” Slides. White paper. GitHub repo.
- GitHub repo (including slides and white paper) for the Marc Newlin/Logan Lamb/Chris Grayson presentation, “CableTap: Wirelessly Tapping Your Home Network”.
- Here’s some stuff from “Tracking Spies in the Skies” (Jason Hernandez, Sam Richards, Jerod MacDonald-Evoy): North Star Post summary of their presentation. GitHub repo.
- Slides from the David Robinson talk, “Using GPS Spoofing to control time”, are here. Slides contain links to code, per Mr. Robinson. I’ve only had a chance to take a quick look at this, but I’m fascinated.
Obit watch part II.
July 31st, 2017Obit watch: July 31, 2017.
July 31st, 2017Jeanne Moreau, noted French New Wave actress.
(I did not know that she was briefly married to William Friedkin.)
DEFCON 25 updates: July 29, 2017.
July 29th, 2017Third round. I’m not proud. Or tired.
- Slides from Salvador Mendoza‘s “Exploiting 0ld Mag-stripe information with New technology” are here. I think this is the most current version, but I welcome correction.
- Here’s the slides for “macOS/iOS Kernel Debugging and Heap Feng Shui” (Min(Spark) Zheng).
- Mikhail Sosonkin has a series of blog posts up describing vulnerabilities in the HooToo TM6 travel router. I believe this is a longer version of the same material from his “Hacking travel routers like it’s 1999” talk, but I haven’t had a chance to sit down and compare the blog posts with the slides.
- I have yet to find new material on “Open Source Safe Cracking Robots – Combinations Under 1 Hour!” but there’s a BBC article here. Worthy of note, to me: “For example, if one dial is set to open at 14, using 15 and 13 will work as well. It meant the robot could check every third number, making it possible to quickly test the remaining combinations much faster than a human being.” No disrespect intended to the presenters, but that’s exactly the Feynman/Los Alamos technique. (I think they used a different method for getting the number off the third dial, to be fair.) “The only thing we learn from history, is that we learn nothing from history.”
- David Robinson and ZX Security have a GitHub repo up. Here’s NMEAsnitch, a Python tool to detect GPS spoofing. Here are some other related (and some unrelated) tools courtesy of ZX Security.
- GitHub repo for “Snide” Owen’s “Phone system testing and other fun tricks” containing the slides and extras.
- EFF whitepaper, “The Pregnancy Panopticon”, by Cooper Quintin. This is the basis for the Cooper Quintin/Kashmir Hill talk “The Internet Already Knows I’m Pregnant”.
Obit watch: July 28, 2017.
July 28th, 2017John Kelso, columnist for the Austin American-Statesman since Jesus was a corporal, passed away earlier today.
The staff of WCD extends our condolences to his family and friends.
DEFCON 25/Black Hat updates: July 28, 2017.
July 28th, 2017Round 2:
- The white paper for “Free-Fall: Hacking Tesla from Wireless to CAN Bus” (Ling Liu, Sen Nie, Yuefeng Du) is here. Slides here.
- Slides for “Exploiting Network Printers” (Jens Müller, Vladislav Mladenov, Juraj Somorovsky, Jörg Schwenk) are here.
- Found slides for “Breaking Electronic Door Locks Like You’re on CSI: Cyber” here. (I called this one wrong: no Bluetooth. Not a complaint, just an observation.)
- This is one that I saw, overlooked, and now am intrigued by: “All Your SMS & Contacts Belong to ADUPS & Others“. “Our research has identified several models of Android mobile devices that contained firmware that collected sensitive personal data about their users and transmitted this sensitive data to third-party servers in China – without disclosure or the users’ consent.” Slides. White paper.
- Slides for Vlad Gostomelsky’s “Hunting GPS Jammers”. I think this is one that really needs video, too.
- “Intercepting iCloud Keychain” (Alex Radocea) slides.
- And “The Future of ApplePwn – How to Save Your Money” (Timur Yunusov) slides.
- And (hattip to Mr. Yunusov) “Jailbreaking Apple Watch” (Max Bazaliy). I haven’t compared these slides to the onea on the presentations server, just FYI.
Okay, lunch time is almost over, and I feel like I’ve done enough damage to the security community today. I’ll try to have more updates later today or tonight.
DEFCON 25/Black Hat updates: July 27, 2017.
July 27th, 2017Round 1:
- Nitay Artenstein has a blog post up at the Exodus Intelligence site covering his “Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom’s Wi-Fi Chipsets” talk at Black Hat.
- Slides from Jason Staggs’ Black Hat version of “Adventures in Attacking Wind Farm Control Networks” are up on the Black Hat site.
- I don’t see slides for Colin O’Flynn’s “Breaking Electronic Door Locks Like You’re on CSI: Cyber” yet, but he does have a blog post up talking about some of his findings.
- Slides and the white paper from Ruben Santamarta’s “Go Nuclear: Breaking Radiation Monitoring Devices” are up.
- This is one I kind of overlooked, but it could be interesting: Thomas Brandstetter’s “(in)Security in Building Automation: How to Create Dark Buildings with Light Speed”. White paper. Slides.
- No more conference CDs at DEFCON. But here’s the presentations directory on the DEFCON 25 media server. You can also torrent presentations and workshops.
- To save you a small amount of trouble: here’s the (preliminary) version of the slides for “Popping a Smart Gun”.
Edited to add more:
- Karla Burnett’s “Ichthyology: Phishing as a Science” is actually relevant to my professional life. White paper.
- Slides and the white paper for “Hacking Hardware with a $10 SD Card Reader” (Amir Etemadieh, CJ Heres, and Khoa Hoang) are here.
Obit watch: July 27, 2017.
July 27th, 2017June Foray, one of the greatest voice talents ever. (Edited to add 7/28: NYT obit.)
I’ll quote at length the A/V Club obit just to give you some idea of the scope of her work:
She was 99. What a life.
This isn’t quite an obit, but I want to put it up anyway:
The baby is Angelina Liu. She’s the daughter of Sanny Liu and Officer Wenjian Liu of the NYPD.
Officer Liu and his partner, Rafael Ramos, were ambushed and killed in their patrol car on December 20, 2014. The suspect later committed suicide. The Liu’s had been married for three months: Mrs. Liu asked the doctors to harvest and preserve her husband’s sperm so that she could have his child.
Awful lot of dust in the air, you know? F’ing allergies or something.
Here’s your hat.
July 26th, 2017Black Hat 2017 is just getting started.
There’s some overlap with DEFCON 25. For example, hacking wind farm control networks and the SHA-1 hash talk are on both schedules. But there are also a few things unique to the Black Hat 2017 schedule:
- “Breaking Electronic Door Locks Like You’re on CSI: Cyber“. (Hey, didn’t they cancel that?) I suspect there may be some Bluetooth involved here.
- “Hacking Hardware with a $10 SD Card Reader“. I would enjoy watching this, and will enjoy reading about it, but I lack the hardware skills to actually do this.
- “Go Nuclear: Breaking Radiation Monitoring Devices“
- “Intercepting iCloud Keychain“. The use of the words “would have” in the abstract makes me think Apple’s already patched this issue, but you never know…
- “The Future of ApplePwn – How to Save Your Money“. “We’ll present a specially developed opensource utilities which demonstrates how hackers can reconnect your card to their iPhone or make fraudulent payments directly on the victim’s phone, even without a jailbreak.”
- “Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom’s Wi-Fi Chipsets“. If memory serves, this got a lot of recent attention.
- “Hunting GPS Jammers“. Radio. GPS. There.
- “Attacking Encrypted USB Keys the Hard(ware) Way“.
- “Exploiting Network Printers“.
- “Free-Fall: Hacking Tesla from Wireless to CAN Bus“. Based on the abstract, it looks like Tesla has already fixed the issues, but the process of finding and exploiting them might still be interesting.
The same rules for the DEFCON post apply here: if you’re a presenter who wants some love, or if you want me to follow a specific talk, leave a comment.
