Research

Six months ago fellow blogger (and recent friend) Martin McKeay posted that he wanted to be a “Security Evangelist”. As of today, he is. If it worked for him, I figure what the heck, it can’t hurt. That’s not greedy, is it? Share:

Back in May 1997 I was running security for the annual “Kinetic Sculpture Challenge” in Boulder; a big costume party/concert/race/BBQ/festival/rite of spring sponsored by the local radio station. It’s about a 30,000 person event and I ran a staff of about 90 paid and volunteers. It was one of the more enjoyable events to work every year (the year I was working out East as a paramedic I even flew back just for that weekend). But that morning wasn’t nearly as much fun as usual. The police were all on edge, all looked like they had a bad night, and were far more aggressive than usual. When we opened the gates they were literally hand searching every single car coming into the parking lot for alcohol and other contraband. Traffic was backed up for miles, and the entire place had a very uneasy feeling. I asked one of my friends on Boulder PD what was going on and she just stared at me quizzically. “You mean you don’t know?” “Know what?” “Last night. You realize there was a riot?” Riot? Boulder? Outside of the 60s? I mean, we’re talking about a town that would build houses out of hemp if they could figure out the engineering. We’re talking home to the cosmic center of the universe (behind the old Pasta Jay’s, if you’re wondering). The night before as I was going to bed early to make my 6 am crew call, the students of Boulder banded together to fight for social justice. That’s correct, a full on riot with bricks, tear gas, burning couches, and flipped cars all in the fine tradition inherited from the social consciousness of protesting Vietnam and racial inequality. Okay, it was about beer, but times change. That entire academic year Boulder was brewing with hostility. A town known for its relaxed, hippie attitude was really a nine month slow burning fuse of conflict that finally detonated during finals in a series of evening riots with some serious violence. “What do we want!” “Beer!” “When do we want it?” “Friday after finals!” A lot of people know that the riots were the result of a severe police crackdown on underage drinking. Officers would literally stop students randomly in the streets and administer breathalyzer tests, handing out tickets on the spot. They’d bust parties by surrounding the house and grabbing everyone inside (or jumping out the windows), testing them all, and handing out tickets. Students started driving drunk more often just to avoid an MIP! (Minor In Possession ticket). But not a lot of people know what caused this crackdown, and why tensions rose in the course of a single academic year. Due to some random coincidences I was right in the middle of it. Two major events caused the tension, and at the heart of it is economics. First, in (I think) 1993 the CU athletic department changed their contract for security for football games. For years it was run by the CU Program Council- a semi-independent student group that put on all the concerts and other entertainment events. I was security director that year, and for insurance and cost reasons the athletic department bid out the contract instead of using a student group (despite our being recognized as one of the best security teams in the Big 8 ). We followed a principle known as “peer security”, where the “Event Staff” is composed of a demographic close to the attendees. It’s a great way to reduce tension and relate to the crowd. Despite there being two respectable event security firms in the area, one of which we had very close ties to (CSC), the athletic department awarded the contract to the lowest bidder- “Andy Frain Associates”. Andy Frain ran the local airport screening, and didn’t have a single local manager with any event experience. I ran the first few games as a subcontractor with my own people, but after they started bussing in high school students for minimum wage, we pulled out. With no effective crowd control the police, who used to just sit on the sides to back us up, had to start taking a more proactive role and go into the crowd. There’s no way that ends well- police have different training and responsibilities. When they break up a fight people get arrested. They have firearms at their waists, a nerve-wracking experience if you’re surrounded on all sides, that instantly escalates any situation. Once one officer started macing students charging the field after a big victory, the nature of the stadium during games, and between police and students, was never the same. All because someone wanted to save a dime and use cheap labor. The next cause was far more tragic. One night, a couple years earlier, a group of students in a Ford Explorer decided to get drunk and go car surfing down Flagstaff Mountain, a twisty turny mountain road. The car rolled, killing at least one young girl (I can’t remember the details, there may have been 2 deaths). Flagstaff was part of the district where I was a volunteer firemedic. While I wasn’t on the call, my coworkers told me about it. It wasn’t a pretty scene. The parents, understandably, were devastated. One totally legitimate response was to attack the culture of alcohol tolerance in Boulder. It led to the Boulder Police applying for, and winning, a grant to fight alcohol abuse among minors. The decision was made to ramp up enforcement to never-before seen levels. And it all came to a head in 1997. The relationship with police had been becoming more adversarial since 1993, culminating with that macing incident I mentioned that made the national news. At the same time, once the grant was processed and new enforcement started that relationship degraded to the point where it caused the riots. I’m not justifying the action of those riot participants- especially the ones that nearly killed some of my law enforcement friends and put one on disability. Bricks to heads are friggen insane.

I almost used the title, “we can’t afford religion”, but figured that might hit Digg a little too fast and piss a lot of people off. But that’s kind of what I mean. After my global warming post I got a personal email from one of you that I respect a lot. He doesn’t buy into it, but he’s also not adamantly opposed. As he put it, people tend to have a religious response on the issue, depending on what side they’re on. Right now I tend to believe the consensus that there’s man is accelerating the natural warming of the earth. I haven’t always believed it, and if very clear evidence to the contrary appears my opinion could change. And hopefully you got the point of the original post- that I think even if it isn’t true (but I think it is) there is a huge potential economic upside if it is. But not everyone thinks like that reader and myself, on this and many other issues. A recent study performed functional MRI scans on people while discussing politics and religion. The result? The same emotional response. Yes folks, blind faith even in politics- an area that seems to demand more logic than emotion (nah, I’m not naive enough to think that’s how it really works). Religion relies on faith by nature, but science, politics, and even your daily decision to buy something or put on your seat-belt shouldn’t. There isn’t a single thing in this world that doesn’t change over time (Dick Clark and Keith Richards excepted), and any doctrinal beliefs are destined to eventually be wrong. To be honest, I think a lot of the problems we have in this world are due to rigid minds. Even every single major world religion undergoes constant interpretation and reinterpretation; that’s why the call it religious studies. Doctrine limits free thought and options. It taints analysis of information and situations. It often even biases what information you’re willing to expose yourself to. You can’t afford it. Analyze the data and make your own decisions. Don’t let some random doctrine or religious belief (not religion itself, you know what I mean) make your decisions for you. It doesn’t mean you don’t know right from wrong; it means you know how to think for yourself. Share:

Sorry folks, this has nothing to do with bank fraud or anything like that. Your ego’s writing checks your body can’t cash. -Iceman (you better know the movie) I’m a bit of an egotistical asshole. Yeah, no surprise there. But sometimes I realize the old confidence perhaps goes a little too far. I had two incidents in the past two days that made me realize I started to cross that line again. The first was on a private, non-work email list. Someone asked for a simple opinion and I ended up delivering the sermon from the mount (I hear Jews do that every now and then). It should have been a two sentence answer, and I responded with a page of dribble that this individual most likely already knew. Sure, it was accurate dribble, but they didn’t need to hear it from me, and then I had the audacity to follow it up with a second private email of something I’m sure they’d already seen. The second incident was tonight in Karate class. I studied TaeKwon-Do for about 15 years before moving to Arizona. It’s basically the style Michael Farnum has recently taken up. After a two year break I recently started back up, but with a different style, due to an instructor I hit it off with. We were sparring tonight and he was scoring on me at will. I’ve competed as high as nationals, but the reality is I was totally humbled. I could see exactly what he was doing (which I suppose is good), and couldn’t do a damn thing to stop it (bad when you’re getting hit in the face). Anyway, I took a step back and realized that it’s time for me to take the proverbial chill pill. Even when we’re really good at something, it’s all to easy to believe your own hype and take it too far. Especially when much of that hype is self generated. When I first started working as a paramedic I remember one of my instructors telling us you had to be cocky to survive the job, but if you went too far you’d kill people. Maybe even kill yourself. I don’t think I’ve come close to that line, but this week’s made me realize that it’s yet again time to take a step back, re-evaluate, and mellow out. Perhaps I let the stress of building a new house get to me. Not that I won’t still be an egotistical asshole, but at least I won’t be an obnoxious, out of control egotistical asshole. And, to that person I responded to on that email, if you’re reading- sorry I went overboard. Even Maverick learned his lesson and came back to the game stronger. (Seriously, if you haven’t caught the movie reference, you need help). For the record, I wrote this one for myself, but if any of you get any value out of it so much the better. Hope this isn’t too touchy feely, but I’m getting used to the new content of the blog myself. How weird, I just admitted something I’d normally only share with close friends at the bar to, like, the entire Internet. Blogging is weird. Share:

(Yes, as promised I’m still blogging, just not on the technology or information security industries). Look I understand too little too late I realize there are things you say and do You can never take back But what would you be if you didn’t even try You have to try So after a lot of thought I’d like to reconsider Please If it’s not too late Make it a cheeseburger < p style=”text-indent:40pt;”> –Here I Am, Lyle Lovett Last night my wife and I finally watched the copy of An Inconvenient Truth I received as a gift for Xmas/Hannukah. You really need to go watch this movie. Soon. Being the cynical security freak that I am, I’m usually pretty good at realizing when I’m being manipulated. In some cases, usually movies, I just suspend belief as best I can and roll with it so I can lose myself in a bit of entertainment. An Inconvenient Truth blatantly manipulated me. It sent tendrils of social consciousness that slithered past my bastions of distrust to grab a hold of my gut and brain and sway my emotions and change my behavior. There was nothing subtle about it- these were the tendrils of a giant squid, grabbing and crushing any resistance, not some vague, foggy, sinister horror movie kinds of things. Some people think there’s still debate on global warming- not me. Just today were two articles on Slashdot that indicate something ain’t right. Take a look here and here. Lakes under Antarctica? The world’s largest tropical glacier disappearing? Nasty stuff. I don’t really think there’s much of a debate on global warming anymore, despite Michael Crichton. But, the thing is, even if there is some debate it shouldn’t matter. It’s as much gambling as it is risk management. Some bets can’t be changed, some risks can’t be mitigated once accepted. And, in the case of global warming, there are huge potential economic upsides. By buying a hybrid (especially thanks to the tax credit), switching our light bulbs, insulating better, and so on we save considerable money over the lifetime of these investments (maybe not on the hybrid, since we went for the SUV). On a macro scale, investing into more sustainable fuels reduces our dependence on foreign oil, creates new industries and new jobs, and makes the nation more self-sustaining and secure. We’re not talking about a tree-hugging return to hemp-powered cars, we’re talking nuclear power, new fuels, and getting out of the Middle East. Works for me. (And none of that was in the movie). So on one side of the bet we have the future of society, the destruction of coastal cities, the redistribution of global power, and other nastiness. On the other side we have an improved economy, cost savings, energy independence, and lower insurance rates. Seems like an easy bet. Anyway, I’ve preached enough. Go check out the movie for yourself… Share:

I love Mythbusters; and before every show there’s the obligatory warning, “Don’t try this at home. We’re what you call professionals”. Which is really disappointing since I now have no idea what to do with the 500 lbs of explosives, the crash test dummy, and the balistics gel sitting in my garage. This morning Martin reminds me that I’m a bit of a professional myself. As mentioned in this post, I’m running Vista and an XP machine without any antivirus. And as kwismer pointed out in the comments, Vista isn’t completely immune. I can only do this because I’m a highly educated user, only taking risks for myself, with a strong track record of never being infected. History, experience, and training allow me to take actions that are high risk to someone without my background. It’s the same as my rescue activities- the odds of me getting hurt while snowboarding some 300 lbs behemoth in a plastic sled down a black run are smaller than the odds of you blowing a knee on a blue run. Actually, the odds of me fracturing my shoulder while flying down a solo bump run are much higher than if I was doing the same run with a patient strapped in a rig behind me. Know your own risks and make your own assessments; and if you don’t have the skills to even do that accurately, always err on the side of caution. And never place others at risk even if your personal risk is low. Don’t be an idiot. I’m a professional. Share:

I have been told to no longer cover technology issues on my personal blog (that’s this). Unless/until circumstances change I won’t be posting anything related to technology or that could be construed in a way to potentially violate this policy. I will continue to occasionally post on non-technology security (and other) issues, but my rate of posting will obviously decline significantly. I won’t be offended if you drop me from your RSS reader or blog roll due to the change in content. And please, no comments on this one- but feel free to email me personally. I’ve enjoyed my time as an IT security blogger and am sorry it’s coming to an end for now. Share:

I’ve been running my eval copy of Vista (as a virtual machine) for a couple of weeks now and it’s a strange feeling. No, it has nothing to do with the new user interface (most of which won’t run in my virtual machine anyway), User Account Protection (UAP), or any of the new features. It’s because I’m running without any AntiVirus running. At all. And I can’t, for the life of me, think of any reason to install it yet. It’s there. This little zip file sitting on my desktop trying to tempt me into releasing it from the confines of its uninstalled bundle. It calls to me as I sleep, whispering fears of sending Office macro viruses to my family or being unprepared as that just-detected 1-day worm wheedles its way past my firewalls into the heart of my OS. But I resist the temptation as I banish the file to the depths of a subdirectory. Waiting to be called upon when needed, but imprisoned in the bowels of my file structure until the most desperate of times. As someone who practices safe email and browsing habits I often wonder if I need desktop AV at all. I don’t run it on my Mac and I don’t run it on my XP Home PC (that isn’t ever used for email or inappropriate browsing). I only use it on my corporate desktop, where it’s never found anything despite destroying my system performance every Wednesday at lunch, and I’m well protected with our email server AV (which is definitely necessary). Thus there’s no reason to run it on an OS for which there isn’t a single known worm or virus. It’s not like signature-based AV will catch any of the rumored 0days floating around, and my generally safe browsing habits limit my exposure anyway. I’d consider this feeling of freedom strange if I haven’t been experiencing it on my Mac for the past year. Now you Windows users can know what freedom really feels like. At least for now… Share:

Back before Gartner I ran my own consulting/development business for a while. It was reasonably successful, but when a better opportunity came up I shut down operations and joined the company that Gartner eventually acquired. I closed the business about 7 years ago. There are no remaining bank accounts, domains registered to it, business licenses, or anything else possibly connected to it. The old domain name still exists (registered to me personally) since it’s my permanent email, but the website forwards to my joke evilsquirrel site. I ran the business out of Boulder and have moved twice since then, with neither address being associated with the dearly departed corporation. Thus, for the life of me, I can’t figure out why Capital One is sending my dead business credit card solicitations to my current residential address. As far as I can tell there must be some database somewhere with the remnants of the old corp, tied to my SSN (as President and CEO), and they naturally assume I might want one of their credit cards. They’ve connected this with some current database of addresses and tracked me down as an individual to my current address. Don’t you think their fraud systems might consider offering credit to an unregistered, unlicensed business a bit of a risk? And you wonder why we have an identity theft problem?!? It has nothing to do with the Internet, and everything to do with easy credit and abuse of our personal information and databases by financial services. Share:

No, I’m not calling all security researchers torturers. Before you flame me, read the post… Not that I have any personal experience (beyond sitting through Black Dog the day my girlfriend dumped me), but torture is one of those things that rarely seems to give you the results you want, and even when it seems to work comes at an incredibly high cost As I mentioned in the Three Dirty Secrets of Disclosure post, full disclosure, especially “no-knock” full disclosure (releasing everything before even reporting it to the vendor) helps the bad guys more than the good guys. End users don’t have the time or skill, in most cases, to protect themselves. They’re still beholden to their vendor to provide a solution, but now even the lesser-skilled bad guys have a new way to attack. So how is full disclosure like torture? It’s more valuable as a threat. Once used, you can’t take it back, it rarely gives you the results you want, and everyone involved is hurt. Actually, unlike torture full disclosure hurts any innocent bystanders in the process. Some researchers think full disclosure forces vendors to respond and patch. Maybe; but in my experience vendors resist torture like James Bond and end up escaping and just getting really vengeful in the process. I think we need full disclosure as a tool in our arsenal, and that most of the researchers dropping these vulnerabilities think they’re doing good, but full disclosure needs to be a last resort- not a first strike. It’s more powerful as an ever-present threat hanging over the heads of the most unresponsive of vendors. Dropping vulnerabilities and proof of concept code on a daily basis just hardens the vendors and lets them paint you as an out of control rogue. You might think you’re saving the free world, but you’re no Jack Bauer. Share: