My kids are picky eaters. Two out of the three anyway. XX1 (oldest daughter) doesn’t like pizza or hamburgers. How do you not like pizza or hamburgers? Anyway, she let us know over the weekend her favorite foods are cake frosting and butter. Awesome.

XY (boy) is even worse. He does like pretty much all fruits and carrots, but will only eat cheese sticks, yogurt and some kinds of chicken nuggets – mostly the Purdue brand. Over the weekend, the Boss and I decided we’d had enough.

Basically he asked for lunch at the cafe in our fitness center and said he’d try the nuggets. They are baked and relatively healthy (for nuggets anyway). The Boss warned him that if he didn’t eat them there would be trouble. But he really wanted the chips that came with the nuggets, so he agreed.

And, of course, decided he wasn’t going to eat the nuggets. And trouble did find him. We basically dictated that he would eat nothing else until he finished two out of the three nuggets. But he’s heard this story before and he’d usually just wait us out. And to date, that was always a good decision because eventually we’d fold like a house of cards. What kind of parents would we be if we didn’t feed the kid?

So we took the boy to his t-ball game, and I wouldn’t let him have the mini-Oreos and juice bag they give as snacks after the game. He mentioned he was hungry on the way home. “Fantastic,” I said. “I’ll be happy to warm your nuggets when we get home.” Amazingly enough, he wasn’t hungry anymore when we got home. So he went on his merry way, and played outside.

It was a war of attrition. He is a worthy adversary. But we were digging in. If I had to lay odds, it’s 50-50 best case. The boy just doesn’t care about food. He must be an alien or something.

At dinnertime, he came in and said he was really really hungry and would eat the nuggets. Jodi dutifully warmed them up and he dug in. Of course, it takes him 20 minutes to eat two nuggets, and he consumed most of a bottle of ketchup in the process. But he ate the two nuggets and some carrots and was able to enjoy his mini-Oreos for dessert.

The Boss and I did a high five, knowing that we had stood firm and won the battle. But the war is far from over. That much I know.

– Mike

Photo credits: “The biggest chicken nugget in the known universe” originally uploaded by Stefan

Incite 4 U

1. From fear, to awareness, to measurement… – Last week I talked about the fact that I don’t have enough time to think. Big thoughts drive discussion, which drives new thinking, which helps push things forward. Thankfully we security folks have Dan Geer to think and present cogent, very big thoughts, and spur discussion. Dan’s latest appeared in the Harvard National Security Journal and tackles how the national policy on cyber-security is challenged by definition. But Dan is constructive as he dismantles the underlying structure of how security policies get made in the public sector and why it’s critical for nations and industries on a global basis to share information – something we are crappy at. Bejtlich posted his perspectives on Dan’s work as well. But I’d be remiss if I didn’t at least lift Dan’s conclusion verbatim – it’s one of the best pieces of writing I’ve seen in a long long time… “For me, I will take freedom over security and I will take security over convenience, and I will do so because I know that a world without failure is a world without freedom. A world without the possibility of sin is a world without the possibility of righteousness. A world without the possibility of crime is a world where you cannot prove you are not a criminal. A technology that can give you everything you want is a technology that can take away everything that you have. At some point, in the near future, one of us security geeks will have to say that there comes a point at which safety is not safe.” Amen, Dan. – MR
2. Phexting? – Researchers over at the Intrepidus Group published a new vulnerability for Palm WebOS devices (the Pre) that works over SMS (text messaging). These are the kinds of vulnerabilities that keep me up at night since I started using smart phones. As with Charlie Miller’s iPhone exploit from last year, sending a malicious text message could trigger actions on the phone. Charlie’s attack was actually more complex (and concerning) since it operated at a lower level, but none of these sound fun. For those of you who don’t know, an SMS is limited to 160 characters of text, but modern phones use that to support more complex actions – like photo and video messages. Those work by specially encoding the SMS message with the address of the photo or video that the phone then automatically downloads. SMS messages are also used to trigger a variety of other actions on phones without user interaction, which opens up room for manipulation and exploit… all without anything for you to notice, except maybe the radiation burns in your pocket. – RM
3. Time to open source Gaia – With additional details coming out regarding the social engineering/hack on Google, we are being told that the source code to the Gaia SSO module was a target, and social engineering on Gaia team members had been ongoing for two years. While attackers may not have succeeded in inserting a Trojan, easter egg, or other backdoor in the source code, the thieves will certainly perform a very thorough review looking for exploitable defects. If I ran Google I would open up the source code to the public and ask for help reviewing it for defects. I can’t help laughing at the thought, but it would be a fun Summer of Code 2010 project. That would help Google, and the code could help developers of Google Apps. Otherwise Google has to pray that their coders and testers are better than the hackers. At the very least they had better conduct their own internal review and create some monitoring policies around any discovered defects. That way they can detect outsiders attempting to exploit the service and maybe, just maybe, trace the attacks back to the source. It also might not be a bad thing to engage law enforcement early in the process. – AL
4. Botnet detection is not a market… – Sometimes we need to take a step back and remember cause and effect. We are seeing a lot of technology focused on botnet detection. Two companies from my hometown, Pramana and Damballa, are productizing technology to detect and presumably block bot activity. Damballa works on the network, and Pramana on web sites themselves. I know of another company launching a similar network-based technology (though broader – just ask them) in a few weeks as well. Pramana is taking on CAPTCHA, but that will be hard because it’s free and already works well enough. Regarding network-based activity, we have to remember the bot is the effect, not the root cause, and detecting and blocking bot traffic is just treating a symptom. Which is not to say that understanding what devices are compromised isn’t important, but there are plenty of ways to do that, and ultimately this so-called network bot detection market needs to be part of the perimeter boxes, rather than a stand-alone offering. – MR
5. Not THAT kind of revolution – Are the Israelis making fun of Apple? Is their treatment of “the revolutionary iPad” as a radical and subversive threat a joke? When word popped up that Israel has banned Apple’s iPad from entering the country, and is confiscating them at the airport, I figured something pretty bad having to do with security was going on. Maybe Apple had botched the WPA2 implementation in such a way that passwords were being leaked. And based on Israeli’s posture in the media, they seemed serious so I didn’t think this was an idle threat. But I don’t see anything different about the networking capabilities between the iPad and the iPhone, with the latter already prevalent in Israel. And if the iPhone has not damaged their networks, the iPad certainly is not going to do so. So what’s up? There have been many reported instances of DHCP anomalies, but worst case it’s denial-of-service lite. It’s not like Hezbollah is going to be buying a bunch of iPads and terrorizing Tel Aviv by disrupting Internet service at coffee shops. So this is either financially or politically motivated, or both. – AL
6. WIPS it good… – Yes, now I have that Devo anthem ringing in my head, but the question still remains whether WIPS is something folks need, or is that capability already subsumed into deployed wireless access switches or branch office boxes? The folks at Accuvant are of the opinion that WIPS is important, and hopefully not just because they sell and deploy WIPS gear. Their contention is that WIPS provides both security and visibility into wireless network performance, and adds real value. Hmmm. What other market was initially about security and then evolved to be more about network operations? Right, network behavioral analysis, and we all know that didn’t work out too well. So why is WIPS different? I don’t think it is, though Accuvant does point out that you can either build a WIPS overlay or use existing switches to deploy the technology. If you get it basically for free, more visibility is better than less – which is pretty much the definition of a feature, not a stand-alone solution. – MR
7. Attack of the cloud – According to the VoIPTechChat blog a variety of SIP brute force attacks are originating from within Amazon EC2. The attacks appear to have spun up some virtual machines in Amazon’s cloud, then used them to attack the outside world. This is interesting on a couple levels, and I highly recommend you read the original post with Amazon’s responses. This is a pretty cool concept that Chris Hoff has talked about – the bad guys spin up some EC2 instances, use them for nefarious purposes, then shut them down. Better yet – they can do all this with stolen credit card numbers, route it through proxies, and be damn hard to catch. – RM
8. Does HPCom get close to the TippingPoint? – HP has closed its acquisition of 3Com, and now TippingPoint is an HP property to be folded (along with the rest of 3Com) into the ProCurve division. So the real question for security folks is what happens to TippingPoint? Historically, HP has paid lip service (at best) to security. The ProCurve guys have done some work there, including a security blade for their switches and a NAC OEM from StillSecure, but they really haven’t played into the enterprise. Which on the surface makes TippingPoint look like a square peg. Obviously folks who already have a big commitment to TP should be pushing their HP reps for answers and probably deferring big deployments until the strategy is clarified. For those looking at TP, again fly the flag of caution, because in a space as competitive as network security, nothing less than a commitment from HP to enterprise security will keep TP competitive. – MR