Research

Sorry folks, this has nothing to do with bank fraud or anything like that. Your ego’s writing checks your body can’t cash. -Iceman (you better know the movie) I’m a bit of an egotistical asshole. Yeah, no surprise there. But sometimes I realize the old confidence perhaps goes a little too far. I had two incidents in the past two days that made me realize I started to cross that line again. The first was on a private, non-work email list. Someone asked for a simple opinion and I ended up delivering the sermon from the mount (I hear Jews do that every now and then). It should have been a two sentence answer, and I responded with a page of dribble that this individual most likely already knew. Sure, it was accurate dribble, but they didn’t need to hear it from me, and then I had the audacity to follow it up with a second private email of something I’m sure they’d already seen. The second incident was tonight in Karate class. I studied TaeKwon-Do for about 15 years before moving to Arizona. It’s basically the style Michael Farnum has recently taken up. After a two year break I recently started back up, but with a different style, due to an instructor I hit it off with. We were sparring tonight and he was scoring on me at will. I’ve competed as high as nationals, but the reality is I was totally humbled. I could see exactly what he was doing (which I suppose is good), and couldn’t do a damn thing to stop it (bad when you’re getting hit in the face). Anyway, I took a step back and realized that it’s time for me to take the proverbial chill pill. Even when we’re really good at something, it’s all to easy to believe your own hype and take it too far. Especially when much of that hype is self generated. When I first started working as a paramedic I remember one of my instructors telling us you had to be cocky to survive the job, but if you went too far you’d kill people. Maybe even kill yourself. I don’t think I’ve come close to that line, but this week’s made me realize that it’s yet again time to take a step back, re-evaluate, and mellow out. Perhaps I let the stress of building a new house get to me. Not that I won’t still be an egotistical asshole, but at least I won’t be an obnoxious, out of control egotistical asshole. And, to that person I responded to on that email, if you’re reading- sorry I went overboard. Even Maverick learned his lesson and came back to the game stronger. (Seriously, if you haven’t caught the movie reference, you need help). For the record, I wrote this one for myself, but if any of you get any value out of it so much the better. Hope this isn’t too touchy feely, but I’m getting used to the new content of the blog myself. How weird, I just admitted something I’d normally only share with close friends at the bar to, like, the entire Internet. Blogging is weird. Share:

(Yes, as promised I’m still blogging, just not on the technology or information security industries). Look I understand too little too late I realize there are things you say and do You can never take back But what would you be if you didn’t even try You have to try So after a lot of thought I’d like to reconsider Please If it’s not too late Make it a cheeseburger < p style=”text-indent:40pt;”> –Here I Am, Lyle Lovett Last night my wife and I finally watched the copy of An Inconvenient Truth I received as a gift for Xmas/Hannukah. You really need to go watch this movie. Soon. Being the cynical security freak that I am, I’m usually pretty good at realizing when I’m being manipulated. In some cases, usually movies, I just suspend belief as best I can and roll with it so I can lose myself in a bit of entertainment. An Inconvenient Truth blatantly manipulated me. It sent tendrils of social consciousness that slithered past my bastions of distrust to grab a hold of my gut and brain and sway my emotions and change my behavior. There was nothing subtle about it- these were the tendrils of a giant squid, grabbing and crushing any resistance, not some vague, foggy, sinister horror movie kinds of things. Some people think there’s still debate on global warming- not me. Just today were two articles on Slashdot that indicate something ain’t right. Take a look here and here. Lakes under Antarctica? The world’s largest tropical glacier disappearing? Nasty stuff. I don’t really think there’s much of a debate on global warming anymore, despite Michael Crichton. But, the thing is, even if there is some debate it shouldn’t matter. It’s as much gambling as it is risk management. Some bets can’t be changed, some risks can’t be mitigated once accepted. And, in the case of global warming, there are huge potential economic upsides. By buying a hybrid (especially thanks to the tax credit), switching our light bulbs, insulating better, and so on we save considerable money over the lifetime of these investments (maybe not on the hybrid, since we went for the SUV). On a macro scale, investing into more sustainable fuels reduces our dependence on foreign oil, creates new industries and new jobs, and makes the nation more self-sustaining and secure. We’re not talking about a tree-hugging return to hemp-powered cars, we’re talking nuclear power, new fuels, and getting out of the Middle East. Works for me. (And none of that was in the movie). So on one side of the bet we have the future of society, the destruction of coastal cities, the redistribution of global power, and other nastiness. On the other side we have an improved economy, cost savings, energy independence, and lower insurance rates. Seems like an easy bet. Anyway, I’ve preached enough. Go check out the movie for yourself… Share:

I love Mythbusters; and before every show there’s the obligatory warning, “Don’t try this at home. We’re what you call professionals”. Which is really disappointing since I now have no idea what to do with the 500 lbs of explosives, the crash test dummy, and the balistics gel sitting in my garage. This morning Martin reminds me that I’m a bit of a professional myself. As mentioned in this post, I’m running Vista and an XP machine without any antivirus. And as kwismer pointed out in the comments, Vista isn’t completely immune. I can only do this because I’m a highly educated user, only taking risks for myself, with a strong track record of never being infected. History, experience, and training allow me to take actions that are high risk to someone without my background. It’s the same as my rescue activities- the odds of me getting hurt while snowboarding some 300 lbs behemoth in a plastic sled down a black run are smaller than the odds of you blowing a knee on a blue run. Actually, the odds of me fracturing my shoulder while flying down a solo bump run are much higher than if I was doing the same run with a patient strapped in a rig behind me. Know your own risks and make your own assessments; and if you don’t have the skills to even do that accurately, always err on the side of caution. And never place others at risk even if your personal risk is low. Don’t be an idiot. I’m a professional. Share:

I have been told to no longer cover technology issues on my personal blog (that’s this). Unless/until circumstances change I won’t be posting anything related to technology or that could be construed in a way to potentially violate this policy. I will continue to occasionally post on non-technology security (and other) issues, but my rate of posting will obviously decline significantly. I won’t be offended if you drop me from your RSS reader or blog roll due to the change in content. And please, no comments on this one- but feel free to email me personally. I’ve enjoyed my time as an IT security blogger and am sorry it’s coming to an end for now. Share:

I’ve been running my eval copy of Vista (as a virtual machine) for a couple of weeks now and it’s a strange feeling. No, it has nothing to do with the new user interface (most of which won’t run in my virtual machine anyway), User Account Protection (UAP), or any of the new features. It’s because I’m running without any AntiVirus running. At all. And I can’t, for the life of me, think of any reason to install it yet. It’s there. This little zip file sitting on my desktop trying to tempt me into releasing it from the confines of its uninstalled bundle. It calls to me as I sleep, whispering fears of sending Office macro viruses to my family or being unprepared as that just-detected 1-day worm wheedles its way past my firewalls into the heart of my OS. But I resist the temptation as I banish the file to the depths of a subdirectory. Waiting to be called upon when needed, but imprisoned in the bowels of my file structure until the most desperate of times. As someone who practices safe email and browsing habits I often wonder if I need desktop AV at all. I don’t run it on my Mac and I don’t run it on my XP Home PC (that isn’t ever used for email or inappropriate browsing). I only use it on my corporate desktop, where it’s never found anything despite destroying my system performance every Wednesday at lunch, and I’m well protected with our email server AV (which is definitely necessary). Thus there’s no reason to run it on an OS for which there isn’t a single known worm or virus. It’s not like signature-based AV will catch any of the rumored 0days floating around, and my generally safe browsing habits limit my exposure anyway. I’d consider this feeling of freedom strange if I haven’t been experiencing it on my Mac for the past year. Now you Windows users can know what freedom really feels like. At least for now… Share:

Back before Gartner I ran my own consulting/development business for a while. It was reasonably successful, but when a better opportunity came up I shut down operations and joined the company that Gartner eventually acquired. I closed the business about 7 years ago. There are no remaining bank accounts, domains registered to it, business licenses, or anything else possibly connected to it. The old domain name still exists (registered to me personally) since it’s my permanent email, but the website forwards to my joke evilsquirrel site. I ran the business out of Boulder and have moved twice since then, with neither address being associated with the dearly departed corporation. Thus, for the life of me, I can’t figure out why Capital One is sending my dead business credit card solicitations to my current residential address. As far as I can tell there must be some database somewhere with the remnants of the old corp, tied to my SSN (as President and CEO), and they naturally assume I might want one of their credit cards. They’ve connected this with some current database of addresses and tracked me down as an individual to my current address. Don’t you think their fraud systems might consider offering credit to an unregistered, unlicensed business a bit of a risk? And you wonder why we have an identity theft problem?!? It has nothing to do with the Internet, and everything to do with easy credit and abuse of our personal information and databases by financial services. Share:

No, I’m not calling all security researchers torturers. Before you flame me, read the post… Not that I have any personal experience (beyond sitting through Black Dog the day my girlfriend dumped me), but torture is one of those things that rarely seems to give you the results you want, and even when it seems to work comes at an incredibly high cost As I mentioned in the Three Dirty Secrets of Disclosure post, full disclosure, especially “no-knock” full disclosure (releasing everything before even reporting it to the vendor) helps the bad guys more than the good guys. End users don’t have the time or skill, in most cases, to protect themselves. They’re still beholden to their vendor to provide a solution, but now even the lesser-skilled bad guys have a new way to attack. So how is full disclosure like torture? It’s more valuable as a threat. Once used, you can’t take it back, it rarely gives you the results you want, and everyone involved is hurt. Actually, unlike torture full disclosure hurts any innocent bystanders in the process. Some researchers think full disclosure forces vendors to respond and patch. Maybe; but in my experience vendors resist torture like James Bond and end up escaping and just getting really vengeful in the process. I think we need full disclosure as a tool in our arsenal, and that most of the researchers dropping these vulnerabilities think they’re doing good, but full disclosure needs to be a last resort- not a first strike. It’s more powerful as an ever-present threat hanging over the heads of the most unresponsive of vendors. Dropping vulnerabilities and proof of concept code on a daily basis just hardens the vendors and lets them paint you as an out of control rogue. You might think you’re saving the free world, but you’re no Jack Bauer. Share:

Being on the road this week, I missed the latest drama at the Month of Apple Bugs pointed out in this post by Chris Pepper. (One thing Chris doesn’t mention is that this backdoor was only included in a pre-release version of the exploit, not the released proof of concept code). I read LMH’s response and explanation, spoke with him directly, and feel he’s unfortunately damaged the reputation of the already controversial project. Basically, LMH found some individuals scanning the directories where he posted the exploit code samples before the accompanying blog entry was posted. There were no pointers to these files. He included the backdoor code in a file put at that location that the people scanning his server picked up and, in some cases, executed. His goal was to identify these individuals and prevent further looping of his server. I think it was a bad idea, but the backdoor code was not in any released version of the exploit. Basically it was some wacky arms race- with the individuals downloading the code poking around someone else’s server, and LMH taking a vigilante-style response. As I’ve said many times I really don’t like dropping 0day exploit code; it damages the innocent more than the guilty. But if you are going to drop code as part of a full disclosure, it should be to prove the concept and allow people to test and evaluate the vulnerability. Your code should never make the situation worse, no matter what kind of point you’re trying to make. Putting in a backdoor to track and expose who downloads the code, released or not, is never the right way to go. It’s unethical. LMH responded on his blog: The disclaimer is clear enough, and if they go around downloading and voluntarily executing random code (read, a exploit), it’s certainly their responsibility to set up a properly isolated environment. Otherwise you’re total jackass (although, why would you “worry if the bugs are fake”?). Yes- you should set up a test environment before messing with ANY exploit code. I blew 4 hours this weekend fixing my Metasploit copy (still can’t get msfweb running) and creating virtual targets to test a new exploit someone sent me. Then again most people can’t virtualize OS X legally, requiring you to buy a spare Mac to test anything. That said, I don’t think anyone ever has the right to place backdoor code in anything. If you want to track who is downloading or leaking pre-release code you track audit logs or take other actions on your end. You have no right to do anything malicious to someone else’s system, even when they aren’t playing nice. This did nothing but hurt the project. Apple security is a serious issue that needs real debate, but games like this destroy credibility and marginalize the individuals involved. Vendors generally dislike security researchers as it is. Giving them any opening, no matter how small, makes it that much harder on the research community. It allows PR departments to make a legitimate researcher look like nothing more than a malicious criminal, demonizing them in the press even when they play strictly by the book. I don’t consider LMH malicious at all; and after a few conversations have no doubts his goal is to improve security, but I do disagree with his methods on this particular project. Security researchers need to have exceptional ethics to withstand the vendor attempts at marginalization or all their work goes to naught. Share:

Tomorrow morning I’m off on the wonderful 6 hour flight from Phoenix to Boston I probably don’t have time to meet up, but if any of you are in the area and want to give it a shot let me know. Share:

The BCS Championship is in Phoenix tonight (that’s the college football championship game for our overseas and raging-geek readers) and Ohio State seems to have brought around 60,000 of their fans into town. A couple of buddies of mine from Colorado are in town for the game and we spent the weekend out and about. Last night we were heading into one of the bigger Buckeye bar-parties in town and I was totally stunned when it came time to give the bouncer our IDs. As everyone walked up he grabbed driver’s licenses and ran the mag stripes through a handheld scanner. Being both moderately sober and the security paranoid I am the conversation went like this: Me: So, are you just checking for fakes or storing any of the info? Bouncer: Both, it’s mostly for our database statistics. Me: Like how many people came in? Bouncer: Just your name, date of birth, and driver’s license number. Me: Ah. Umm… Okay. Any chance you can skip it and just give my ID a visual check? At that point he, looking like I was some Unabomber-like freak, checked my ID the old fashioned way and let me in. Of course, while watching him I noticed that he was so intent on scanning IDs into his little machine that he sort of, you know, didn’t check the faces of people handing them over. That might explain the one 20 year old girl running around stealing drinks, grabbing any guy within reach in a manner that’s rarely free, and putting the Vegas showgirls to shame. I can’t really think of any good reason a bar named Mickey’s Hangover needs that info. And in the process they reduced their security by relying on a machine to find fakes, and forgetting to see if the ID handed over even slightly resembled the patron at the door. Seriously folks- I don’t think I’m overly paranoid, but it’s hard to justify letting a random bar keep my vital stats just to buy an overpriced beer. Share: